Evolution of Cybersecurity – Rick McElroy, VMware

This is Textron TV. Hi everyone. Welcome back to Textron TV.

Our next guest today is Rick McElroy. Rick is with VMware. He's the first time he's been on texture on TV.

So let's get give them a welcome. Hey Rick, how are you? Good.

Thanks for having me. Pleasure to have you on so Rick. Why don't we give folks?

Maybe what do you do with VMware and a little bit of your background? Yeah, look principal cybersecurity strategist for being more carbon black publicly. I think you can think of me as the translation layer for what we're doing for security and then internally with our customers and Prospects.

I really work as a trusted advisor to help them mature what they're doing from a security operations perspective. And yeah, I've been in infosec for 25 years and I love it and you'll often see me at blackhat RSA or any of the major conferences out there. Us too me too.

So Rick you mentioned. I think you called it. VMware carbon black so obviously carbon black was an acquisition by VMware I'm going to get to is what two two and a half years ago.

Yeah. Yeah. and I think most of our audience knows VMware look they pioneered the hypervisor and tanzu is is a big offering and but this this many many tentacles if you will many many facets of VMware carbon black being one of them.

I I would venture most of our audience notes carbon black from before VMware even acquired them. But for those who aren't You know, maybe they don't know Carbon black. They're not up to date on where VMware is a market today.

Would you mind kind of just doing a little level set? Sure car black on we work at the endpoint, right? So Cloud workloads an endpoint security everything from application control to endpoint detection of response.

We sort of pioneered that market right and I think it's part of the acquisition with VMware. Where are we going strategically from a virtualization perspective. I think it becomes keenly interesting the amount of data that it digital infrastructure can actually produce and then of course that data can be brought to bear on the security problems, right?

So having things like full inspection into hypervisor traffic being able to correlate traffic from both the application and the process level all the way over to the network level put that context together and then actually have higher competence and what we're doing from the security operations perspective. So, that's really I think what we're working on inside of VMware. Excellent.

All right. Now that we got that out of the way, let's dive into what you and I wanted to talk about today and that is You know, you mentioned mentoring endpoint detection and response, right? the bad guys that just you know, they're not dumb right they're so I mean, they're they're like, you know deceptively like Mr.

Evil Dr. Evil right there. It's coming up with crazy new stuff and we we've seen kind of a raft of new Attack vectors of new kinds of technology that they're using to to hack in whether it be to deliver a ransomware payload or or something else.

one of the one of the kind of new kind of Frontiers in this is the so-called deep fakes. Why don't you I mean again our audience might have heard of it. They might not they may think they know what it is.

What are we talking about here Rick? Yeah, so deep fix right essentially the ability to create synthetic humans and there's two manifestations of that. I think the one most people are familiar with is the video version.

So things like Tom Cruise that isn't Tom Cruise and Joe Rogan kind of put together, right or I'm a fake Nancy Pelosi video that was put out and so generally speaking these defects have been associated with external influence campaigns. So so the ability to manipulate a mass group of people into doing something in the physical world, right? Well, we know that most people are Ken detect those the technology up until very recently was a little rudimentary you have to throw a whole lot of compute and gpus at it.

Right because you're you're rendering this video content based on other videos and pictures and all of that stuff, but it's gotten a lot cheaper. And so what we've seen the adversaries do over the last two years start to Pivot from external INF. Campaigns to actually manipulate humans via deepfake audio right to perform things like wire transfers and frauds or video to do things.

Like I'm on board and get jobs and actually receive a paycheck and benefits from organizations with the at which the FBI put an alert out in June around so I think over the next year you're going to see this expand into Healthcare. Certainly, I think with the omnipresence of Telehealth. I think you're going to start to see medical fraud pivot towards defects as well.

Insidious little bastards are you know in my mind Rick when I look at it? There's a couple of different. Categories of this one I think is the one you said right in the beginning which is kind of let's call it the traditional deep fake.

I'm I you know, I purport to be a picture of President Biden stumbling down the stairs because I'm old or feeble or and nothing against biting it all but that, you know, we use that for political gain, but it could be used for much more Insidious stuff than that, but it's really so what we're really doing is making a fake of of a known person whether that's a political or public figure to use externally or a private figure to use internally in a company. You're in person naming a known person. Another aspect of deep fake is just making up.

fake people random, you know generating random humans so that I can The social security card I can get a Facebook account. I can you know, get a job and get maybe tax returns or whatever, you know what it is. So we're not impersonating a known person.

We're actually making up a fictitious person and giving them an identity and everything else to use. You know for nefari's purposes usually. you know that that's get a different aspect of this deep fake stuff the My fear is is that we're just scratching the surface though.

I think we are described in the service. Obviously, we have our own observations. Those are observations are based on our incident responders.

So folks that deploy our technology after a compromise and a breach in over 500 gaugements a year or whether that's the Telemetry that we actually collect right which is petabytes of data that's ingested into our threat intelligence cloud and fuse together. Right? So I think every vendor has a partial view into this problem, right but as we're starting to compare notes as we're starting to look at other people's things.

I do think as it relates to the future of humans and our interaction online specifically as we start to move towards a virtual reality and an augmented reality World humans are going to have to get better about Discerning this because there is no real technical solution to the day. So I think Facebook and Google have attempted to make a run at Acting that on their platform. However, that's generally going to be for external use right.

It's not going to be your CEO calling the CFO on the phone and asking for that wire transfer to go out creating that sense of urgency and oh by the way, it sounds exactly like your CEO and so I think for humans there's a couple of things we can do. One thing for organizations start to talk to your it teams and you're legal and finance teams today. They're the ones that are currently being targeted because they have access to money and to be able to do password resets and give out credentials and all of those things right and then come up with some very rudimentary ways to break this chain from the attackers.

So as an example Alan if you were my CEO and I was your CFO we could have our own challenge path phrase that we use and only the two of us know so that if you call me to perform a wire transfer, I would expect to hear that language, right and maybe we rotate that and we get a little fancier but I think two two person Integrity rules still applies when it comes to, you know transferring money out of an organization. You know, what? I remember is Star Trek original series episode like that.

Scotty needed the password from Captain Kirk before he would like take down the phaser alert or something. It's real. I think that's an excellent idea.

I mean we Rick we look we're a little nothing company here and we've already seen it where like some of our folks have gotten text messages that purport to be for me saying hey, I need you to do me a favor. I need to gift card to give someone or if little stupid scams like that, but they would be so much more powerful and effective if it was an audio message instead of a text message and they heard my voice and the ones that work fairly well are actually voicemails, you know, so because it goes through two systems you have an identifier in your phone that says Alan called right? He called me and then I have a voicemail from now.

Well, my phone is telling that's good question it. Yeah, right. Yeah, that's scary stuff man.

Scary stuff and the other thing that I think is scary too is you know, this is a typical security scenario where we're yeah, we're gonna catch up but we're almost by definition gonna be one step behind these folks because the technology continues to improve right and and you know if If we've got to put in. Past your catch phrases or something it you know, we're back to passwords. What was what was the word I was using with Rick right?

I don't remember because I have a different word with Tom and a different word would take in a different word with Harry and you know that I don't know how scalable that is is my problem. Yes. So that's a that's a very fair point.

Right and I do think You know, the vendor Community will have to innovate in this space again, especially as we get towards, you know, virtual reality and augmented reality. And so this idea and if you look over our past throughout reports, right we've been talking about one particular theme in different manifestations and and the theme is manipulating reality. So if you if you go back a couple years you'll see we talked a lot about what these attackers and cyber criminals were doing inside of the environment to bend reality messing with time messing with logs messing with data, right because they what they want to do is hide and they want to change the your digital reality right?

Same thing for the humans, right? They're digitally trying to manipulate these humans. And so I think we as humans need to understand that this whole internet is a bad neighborhood and there's a whole lot of people trying to scam us.

And so I think we've got to come up with some better mechanisms to verify each other as a human entity and Is a synthetic entity and then secondarily you brought up a really good point earlier about these synthetic personas that are created. Well, look, I can go buy those on the dark web. And and in fact some of these personas make posts on gardening sites, right?

So they have a whole digital background that comes with them that becomes very identity. Yeah, and it's been years and it's been running for years and and posting on Instagram and Facebook and all of these things and and so yeah that this being able to discern that synthetic content from an actual human is is becoming tougher and tougher as the days go on. I'm just listening to you talk about this and cringing because you know, look there's there's your garden variety cyber Thief who's doing this for financial gain.

There's your hacktivist who you know are doing it for and then there's your nation state actors who are looking to manipulate public opinion or you know influence things or or break into things, right? Um, I mean the list goes on and on this is It's some scary stuff. I mean quite honestly, right.

I've been in security a long time and I always feel confident. The good guys will win we'll figure out some technology that you know makes this not so easy. I just as I said here today.

I don't I don't see that technology, right? I don't feel confident in. Well, where's that gonna come from?

Right? Well, yeah usually and it's sad and I think just a it speaks to human nature. Right?

We usually have to wait for the losses the pile up before we'll make an invest it and so I think given what the FBI said I think given what we're looking at and and talking to people about and the pure volume that this is starting to be executed in I I would assume that you'll start to see some investment go into this space but Frankly Speaking Alan well deep fakes are very sexy fancy. I do think it's the future of Fraud and scams as it relates to, you know, the internet, you know, basic things work all the time from the summer rooms, you know getting into someone's inbox and fishing now and then running Mimi cats to get their credentials that those are all things that happen all the time and I get into words haven't stopped them. Right so I think but look there is some good news on the defender side because I I get to talk to a lot of them.

We ask specifically about things that are working on our side and I think if you look globally there is a hot War that's occurring right now. We all know Warfare is preceded and concurrently run with cyber warfare to take down infrastructure and interrupt the supply chain to do all of these things. I would say overall.

The West is done a fairly good job defending against some of the most advanced attacks in the planet. And so I absolutely I think that gives me hope right it gives me hope that those lessons are being applied to other NATO countries. Those lessons are being pulled back into vendor technology.

The threat now intelligence is being shared. But now we have to specifically start to look at this new manifestation of manipulation, right? Yeah, I mean to me look and you're right by the way considering that there's a war going on in Eastern Europe.

And it's almost cold warisk. It War light Cold War like in its, you know, Russia versus the West kind of thing the fact that we haven't heard of more. cyber tax related to that not that they haven't been attempts.

Is probably you know better than we could have hoped for I think the real issue is, you know, everyone today talks about metaverse. You called the virtual reality reality augmented reality. If one were to believe what Zuckerberg in the Facebook guys and these guys talk about this whole metaverse thing is going to explode and that's just fraught for deep for fakes in my mind.

Right because you know, you're in a abstract reality. It's just obviously a place where that's gonna be but I would hope that you that you can build sort of an on-ramp. That would that would.

verify, you know your Humanity if you will though the whole idea of having you verify a Humanity to go to a inhuman and you know, not human environment artificial environment is crazy anyway, but I do think that's where we're really gonna see this. you know rubber meet the road and we're gonna have to have something and In there, I do think conversations are laying in that way. But I also think there's a massive privacy discussion that should occur concurrently with that and I think that'll be a real interesting one to see where we land.

But yeah, see, what's that? Yeah. Yeah yesterday.

I heard folks discussing on a podcast this idea of like your social security number being associated with your web identity. Right? So like it.

Yeah, that is well and then I went that's a bad idea and then and then again, there's some I think privacy concerns as well. That being said I think organizations and Company certainly if you're producing something like a metaverse Arena, you would probably verify identities very close to the way Ticketmaster does today and make sure you picking and absolutely my point on that rank. Is this so it's it's an interesting ironic kind of thing.

You speak to a lot of young folks say I'm not saying just close, you know, I've been around the block. But the concept of privacy online with them is not as strong as maybe it is to you or to me, right? They know that everything's online and when they put it online they're assumption is if it's online people are going to see it.

Whatever kind of Corral you try to put around your info. But yet the idea of someone in personating them. this is them off to know it right but the connection between hey when you put when you when you Don't value your privacy, right and you put your privacy to decide for the sake of Greater visibility or whatever online.

This is a consequence of that. That I don't know if they're making that connection. Right.

It's in it's interesting. I do speak with tons of them. I think their definition of privacy is different.

So you think you're right. They generally expect that their data online is sniffed looked at, you know, good not just bad guys. No Facebook Twitter the government.

Yeah everyone else right? But if you I think more tactically ask them to like open their phone and their messages and show their parents as an example or show a teacher they do care about privacy, right and they said so it's just yeah, our intrinsic definition is I don't want people snooping on any of my stuff. I don't want soup done right?

I'm a big privacy Advocate that being said, I actually understand the kids mentality because they're kind of born into that world where they didn't get a choice about it and it looks like the unwinding and that is going to take a long time. And so I think if we as professionals can talk to them in a way that that makes sense and draw that line because they just don't understand. And the intrinsic risks of like governments across the globe Gathering all of this data and being able to manipulate them.

Absolutely. Hey man, we're about out of time Rick for people want to get more information about VMware carbon black security and stuff. com, or is it yeah, you it'll still round.

com. You can find me at infosec Rick on Twitter LinkedIn and also my team the howlers so follow us and we're always out there trying to teach people some better stuff to get some better outcomes. You know where he's looking for foreheads and to help the audience come back and tell us more Rick soon.

Awesome. Thanks for help me out. Thank you, Rick McElroy a VMware carbon black here aren't extra on TV.

We'll take a break. We'll be right back.