Cyberattack Patterns Becoming More Sophisticated – Tobias Träbing, XM Cyber

This is texturong TV. Hey guys. Thanks for the throw.

We're here with Toby trading who is technical director for Mia for XM cyber? And we're talking about how cyber attacks are increasing both in volume and in sophistication, but not everybody appreciates the sophistication part of that issue in Trend. So tell me if you don't mind.

What kind of patterns are you seeing in the attack surfaces or they are they getting more sophisticated are these things getting more lethal and are the bad guys more clever than ever? Well, that's a good question. Actually really like it.

I think I think what we can say is that we out of course absolutely see an increase in the sheer amount of attack path and the tax across the across different clients and different regions of the world. They are getting surely more sophisticated but also still profit from a bad it hygiene with an awful lot of clients also that we work with right when we start engaging we see that, you know password security local credentials domain credentials are not being very well managed software vulnerabilities still a couple of years old are still lying around. So at the same time, yeah getting more sophisticated absolutely on the other hand.

There is still a big gap between what people need to do and organizations need to do in order to harden and and strengthen their security maturity level. What's kind of the wow this they're craziest attack pattern you guys have seen as of late. That might shock somebody.

Interesting question though. Actually, we've recently engaged with a with the client out of the manufacturing vertical around 7,000 employees. We had an early stage deployment early stage deployment basically means we're starting very slow and as in a small satin ad and basically expanding over a couple of weeks, the interesting part of that of that engagement was that we were while we were basically launching so-called attack scenarios with that client.

We will we were able to identify different attack path to critical assets and critical assets are usually including standard said that we see with every client with every in every environment. So for example, domain controllers exchange service and stuff like that. However, this specific employment also included a server that is responsible for controlling unmanned or uncrewed vehicles in one of the factories, right?

So those little Vehicles are basically transformed transporting manufacturing goods from A to B in the factory right taking it from here bringing it over here. Now with XM cyber decline was basically able to identify in several actually attack path including software vulnerabilities, but also misconfiguration and credential issues that wouldn't allow that would allow an attacker to compromise the controlling server of those ungrute vehicles. And if you basically translate that further if a real adversary would be able to compromise a server that is controlling machines or basically vehicles in a network in a factory that can actually even cause physical harm and damage and basically be in being health health and safety issue to the Personnel that would that would work there right or that is working there.

Um getting access to that to that server is quite critical. They can control the units that are you know, driving around the in the in the factory and therefore cause and cause an awful lot of health and safety issues. It was one of the major reason examples that we've seen with one of our clients.

In almost sounds like this size of the attack surface is expanding beyond our ability to secure it and the bad guys are laughing at us because they're not exactly doing anything overly complex. They're just basically finding new things to Target in we can't catch up. I think especially when you when you look at the current infrastructure of the client why back in the days, we all had that one data center with a perimeter around it.

We try to build the the world's thick at this just to be super secure. However, we are now expanding we are dependent on on many factors applications that are using I give you an example look for J as a software within their code. We are not really aware of dead yet.

We are still using the software. We are expanding into the cloud. We're using AWS Azure gcp and all of the other Cloud vendors that are out there and we are shifting basically from their very old picture of a parameter secured environment into a very Dynamic environment that makes it for sure very easy for an attacker to move around to find different different holes to Pivot into a network and well then basically move around in a network right?

I know when when I speak to to Little to to customers the very first time they are super focused as an example on software vulnerabilities Right Toby. Do you cover cve whatever in XM cyber? Of course, we do.

However, actually the most sophisticated or well actually the most the highest amount of attack techniques that we see are involving actually credentials. So they're focused on this but the problem is actually more on that side on the other hand, right? So it's a bit of a of a mix of having a dynamic environment, but also a bit of a not ideal Focus to it security And what in your opinion is the issue with the focus because we are seeing so many routine issues being exploited.

It's not like we're not banging the drum about these things every day the week. So ultimately is it just inertia fatigue or lack of caring what seems to be the fundamental core issue where we see such poor security hygiene time and time again. So I think with fatigue you actually mentioned a very valid point, right if I would scan any environment for you know, show me all of the vulnerabilities that that this environment would have.

I most probably get a list that is like super long and I have no idea where to start and this can be just very simply overwhelming with the resources I have and I think over the past we have been focusing on very very distinct silos right software vulnerabilities configuration issues or misconfiguration tools security or application security, but Really put all of the things together. Because this is actually what attackers do right or adversaries do they take a bit out of the vulnerability bucket take a bit of the misconfiguration bucket, and maybe it's just some security relevant user activity Citra together and have their attack path in a network while my team or one of the in the clients world team. They basically just look at software vulnerabilities have their long list and don't know where to start what it actually really important.

So I think looking at a at a At a tool that would basically help to to look at all of the different silos and help you prioritize to protect your critical assets and Essence, right? You can't protect everything. I think that's that's fair to say but focusing on what matters most to you as an organization is I believe critical to to protect protect that critical data.

We hear a lot about devsecops these days. Are you someone optimistic that long list of vulnerabilities that you are pointing to my one day be reduced as we get a little better at securing things before they're deployed. Um, yes and no deaf secops is a is a good topic and and of course, you know building up a new environment in in any of the infrastructure as a service provider a Landscapes is surely more it security-focus these days but not for every client and and yet we we will remain in an awful lot of clients are remaining with an traditional.

I'm going to call it traditional domain data center focused environment and you know shift some workloads out in the cloud, for example, they might do it securely but if you have a bad it hygiene and you're on Prem as world that might actually reflect the cloud world as well and you can actually only do that. If you really find the resources to help you with deploying secure workloads in the cloud. So again, it's shifting issues from A to B, but yet they are anyway interconnected.

So if you're doing a bad job over here, it will ultimately have an effect over here. And why's worse are so I think that's that's an issue when it comes to that cyclops. You also wonder maybe that we're a little too defensive-minded and to your point about a tax services.

Maybe we need to think more like the attackers and kind of figure out how to hack our own systems and then that'll help us with the defense a little bit more because it seems like we're trying to defend against every infinite possibility and I think Frederick the great one of the great Germans of all times and he defends everything defends nothing. So, how do I prioritize That's a good one and basically tizen very well to why I joined XM cyber a couple of years back. It's really I can't defend I can't basically put defensive out on defend every single client or every single server, but I need to focus on what attackers would use.

And compromise my critical assets and be it a domain controller or be it my customer data or PCI relevant data only if I start looking on how attackers would basically see my network and what they can actually leverage based on the information that are that is that is available in that Network. I can really understand on how all of the different bits and pieces come together how an attacker would see that use that information and then compromise the critical critical asset and and as you rightly said, I think that's that's a that's a general issue. Right?

We're super defense focused yet. We are forgetting that if you basically again take bits out of this Silo bits out of this bucket and such together as an attacker would do giving that attackers view. It's really a bit of a game changer actually to to security because well then if you understand on how an attacker would move along within your network, you can actually start patching the Machines fixing the right service Harden the other devices that would be involved and stock the attackers of get on getting to your critical assets.

All right. So what is that one thing that you see organizations doing from a cybersecurity perspective that just makes you shake your head and go I can't believe we're still fighting this fight. That's an interesting question.

So I I think I kind of mentioned it earlier a bit when I when I speak to clients kind of For the First Time second time. They super focused on on software vulnerabilities, which is you know, absolutely fair to do. However, they are prioritizing based on let's say cbss scoring and while CVSs is is super helpful.

No question about it. It doesn't really necessarily say an awful lot about the exploitability and the environment if an attacker could actually even reach that vulnerability and exploit it Etc. So while it's good actually to page of vulnerabilities no doubt about it.

And it's it's at the same time you are wasting essentially an awful lot of resources on that as well while you have other burning issues. Let's take credentials as an example or Miss configurations on the device itself that would basically attract any other adversary or attacker rather than exploiting vulnerabilities. All right, folks.

I heard it here. It's all about prioritizing those efforts and figuring out exactly what's most important and defending accordingly Toby. Thanks for being on the show.

Mike thank you for having me good speaking to you. All right guys back to you in the studio.