LastPass’ Mike Kosak on Election Security Threats

This is Textron tv. Well, the great pleasure of being joined by Mike Kosack. Mike is senior principal intelligence analyst at LastPass.

Notice the intelligence part gonna talk about that. And, uh, he has, comes from quite an interesting background and, and intel intelligence and, and defense and that kind of thing. So, we'll, we'll have you introduce yourself, Mike, but it's good to have you joining us today.

Yeah, thank you so much for having me, Mitch. Uh, yeah, so my name's Mike Kosack. I am the Senior Intelligence Analyst with LastPass.

I've been here for about, uh, a year and a half now, but, uh, I've been an intelligence analyst for over 20 years. Um, the majority of that was the Department of Defense, um, in the intelligence community, uh, started in counter-terrorism and then moved into cyber threat intelligence over the last decade or so. Uh, so, you know, really deep background in, in intelligence and intelligence analysis acro across a couple of different disciplines.

Interesting. Um, just kind of an aside question, why, why does LastPass have an intelligence analyst like yourself of your caliber? That That's, no, that's a great question.

So we really put a lot of emphasis and, and, uh, and, you know, really it's critical to our mission to protect our, our company and our customers. So part of that is looking outside and looking at the threats that could target us, our customers, what's coming down the pike, what, uh, threat actors are doing out there so we can make the right adjustments and, and help mitigate those risks. Have a two dual side co sided coin.

You gotta protect your business as well as your customer's Business. Absolutely Fantastic. So we're talking about, um, you know, it's election season.

If, if you hadn't noticed out there, how could you not? Yeah, um, and of course, you know, we're, we're constantly hearing little trinkets in the news about something about nation states, uh, doing something to try to influence or hack or deep fake or any number of things in our election. I think the general population certainly doesn't out of appreciation for how much is really going on.

Maybe if you can kind of set the stage for us of, as you think about this election season, what's unique about 2024 and what's happening today that maybe we haven't seen as much or any in the past? Yeah, so, so there's a couple of things that really sort of set the stage for 2024 and, and, and make this a, a particularly fraught time. Um, one, there's obviously, you know, within the United States, a a really heightened sense of political division, um, and that that sort of makes a fertile ground for misinformation and disinformation.

Um, that's, that the, that sort of, uh, that sort of division is exacerbated by that misinformation and disinformation. Um, so there's, there's that aspect of it. Um, and then really we've seen some advances in technology that, that, that make things more concerning as well.

You know, you mentioned DeepFakes there, um, the sort of, uh, democratization of that, the increased availability of that. It's easier to use, it's faster to put together, it's much more convincing than it was the last selection cycle or, or even in 2016, obviously, you know, there's been a lot of advancements. Um, so you know, these, even as there's been an increase in sophistication among the populace and the understanding of the threat, there has been a sort of commensurate increase in sophistication in the capabilities that these threat actors have.

Um, so it's getting harder to detect some of these things. So, um, you know, there's, there's kind of those, those two key elements. And then what we also see, um, is sort of this two tiered approach with some of these, uh, cyber operations or these, these, uh, election interference operations where there's sort of the strategic aspect, which is the misinformation and disinformation that I mentioned.

Um, and then that sort of bleeds into the concerns around the more technical side of election security and cybersecurity. So, you know, you, you do hear some things concerns about, you know, uh, hacking, voting machines themselves, um, changing votes, anything along those lines. Um, you know, that's kind of the other side of it.

You use the strategic side to sort of create that fertile ground for those misinformation and disinformation campaigns more around the, the technical side. Um, so, you know, we kind of have this, this, you know, these, these multiple elements coming together to make this a particularly concerning and, and, and, uh, you know, really kind of, um, fraught time. You know, as, as I think about it, one of the differences that I would describe too is it's just underlying trust or lack of trust in the whole thing.

Rightly, I don't know if I'm, what I'm reading is genuine, who I'm, what I'm seeing is genuine. Um, you know, is the voting, is the voting process systems, all of that, is it trustworthy? You just don't know what to trust.

So it seems like in terms of nation states just fomenting that lack of trust through whatever means is a big part of what they're trying to do. Absolutely. And that's, that's where the, that strategic element of this, the, you know, driving that narrative around, uh, um, you know, you can't trust the vote.

You can't trust what you see. You can't trust what you hear, um, you know, that really sets that ground. And, and so it does, it, it, it sort of creates this environment in which people don't know what they can and can't believe.

Um, you see a lot of effort from governments and, uh, you know, across the world and in, in particular right now within the United States to try and counteract a lot of that messaging. Um, you know, we see cisa, the cybersecurity and information or, and, uh, infrastructure security agency and FBI putting out regular reports on, you know, here's what, you know, here's what you might see around ransomware. Here's what you might see around website defacements reinforcing the fact time.

And again, that to date, there's been no reporting that indicates a single vote has ever been changed, a single voter has ever been turned away, or single registered voter has ever been turned away at the polls. Um, so, you know, really kind of trying to reinforce that faith in the system and counteract those messages. Um, but, uh, it takes time just as it took time for those messages to take root.

It takes time for the counter messaging to work too. Um, and there's really a lot of effort going into that these days. In, in both, uh, you know, websites, reports, media reports.

You see a lot of government officials out there. This was a huge topic at Black Hat. It was, it was the keynote speech, you know, they had Jen Easterly and, um, the director of cis and a few other folks talking about this, you know, really highlighting that the level of effort that they're putting into this, and also trying to really reassure people that, you know, they're, they're aware that these messages are out there, they're aware of the concerns and that, you know, really this is shaping up to be so far one of the most, they feel very prepared.

Let's say it's, you know, that from a cybersecurity perspective, there's a lot of confidence out there. This is a really good point. I, you're, you're spot on.

It does seem like we know to what we know to expect it, we can't. We, we know there'll be unexpected unknown things that are gonna happen, but we know that this is a, a tactic, uh, taken, you know, whether it's for financial gains for ransomware, et cetera, or just, you know, fomenting distrust or potentially, uh, you know, corrupting the, the process, et cetera. So LastPass services both and customers in a retail sense, but also of course, corporations are there things.

What if you were gonna talk to the individual person, now you and I are naturally suspicious of, I get a text and says, are you gonna vote for Kamala or for, uh, Ms. Donald? Then I'm like, yeah, I don't know who this is.

I'm not gonna answer that question. You know, this might be a poll, might be a enter your social security number. Yeah.

Um, you know, we're, we're naturally suspicious, but you, I don't sense that the general population is always as cautious. Maybe we're overly cautious, but what are some of the things that, uh, the general population can do? Yeah, I, I think, uh, you know, to your point, there's, there's sort of a, a polite paranoia that you can bring into your sort of day-to-day, especially cyber interactions.

If you don't recognize a number, if you don't recognize that email, don't interact with it. Just ignore it, delete it, report reported as spam. Um, if it's really important, I promise I'll try and get back to you.

You know, if, if you're not sure, just assume the worst. Um, it doesn't mean you have to take action on it. You just don't have to take action on it, you know?

No, not action is good enough. Um, you know, there's, there's certainly that aspect of it. The other thing is too, if you ever, especially around election, um, local election times operations concerns, anything like that, if there's ever a question, and, and this is a point that's highlighted across reporting from all, you know, the United States government all the way down, and then across, uh, international, uh, governments as well, contact your local elections office, call them, use the number on the official website, um, and call them.

So that's, you know, if, if you have a question verify, you know, and, and, and you have the, there's, there's opportunities to do that, you're empowered to do that. If there's ever a question, if you feel confused about something, take advantage of, of, of the avenues you have. It, it seems that if the individual taking the action as opposed to responding to something, not in all cases, but there's a better chance that we're gonna go to the right website, we're gonna call the right phone number to talk to a real person or get information as opposed to, okay, I don't know if this is valid or not, but it looks real so I'll, you know, I'll consume it.

Um, but taking that step ourselves is a way to protect us. Absolutely. Absolutely.

And those, how about, you know, oh, go ahead. Sorry. No, I was just gonna ask you what, what about the business side?

You know, we don't necessarily think about businesses out, they don't vote, at least not, not in the way you and I might as individuals. What about that kind of corporate side of things in, in terms of the election? Yeah, I, I think there's aspects around that of just being sort of good digital citizens and, and, you know, highlighting some of these points.

Um, you know, a lot of the lessons that, that private companies try and teach, you know, their, their, their customers just around, you know, again, kind of going back to the don't trust phishing emails, here's what to keep an eye out for. Those are the same kind of points that can be highlighted there. Um, you know, as, as companies if, if they do get engaged about these topics, it doesn't come up a lot, you know, sort of consumer to company talking about these things.

But, um, there's that aspect of it. And then there's also some of these companies are involved with providing some of these services, um, you know, either, uh, tangentially or directly. And so that's where practicing good basic cybersecurity hygiene, um, following, there's an election isac the information, uh, sharing and analysis center, um, NIST has guidelines out there following those guidelines can be, can be critical and it is critical to this as well.

Very good. Um, talk about LastPass specifically then, kind of how does that fit into the equation? And obviously in a bigger, in a bigger environment, just beyond elections, but is there anything specifically around that that, um, is helpful?

Yeah, sure. I mean, for us, part of the draws we have municipalities as, as customers, we have, um, you know, local, local, state and government customers. Um, so there's that aspect of it.

And again, kind of going to that good digital citizen aspect of it, we want to help educate people on this issue as well, because the more this message can get out there, um, the more it can resonate. Uh, so it's, and, and, you know, we felt it was important to, to get that word out and um, you know, sort of frame this in a way that our customers and, and, and everybody else can understand as well and help amplify that. Excellent.

You know, I'm not saying this just 'cause you're from last pass, but, um, I recently posted about, you know, there's certain things I think should be required everywhere, and one of them is a password manager. Um, I don't write my own passwords. They're all managed through that process, right?

I stay outta the, take the human out of that part of the loop, much less chance of having an issue. It seems as we're, we continue to evolve in, in more and more digital interactions and experiences as part of our daily wi life, whether it's staring at our phone, watching things, or consuming things, buying things, interacting with websites, you know, the, the password is, hasn't gone away yet, but, um, you know, we have some technologies, passkey, things like that, that are starting to aid us. What do you think about passkey and how, how, where does that play into this kind of helping us be more secure?

Yeah, I think, you know, we're sort of at the bow wave of past key adoption, and I think that's, that is gonna be any sort of technology that, uh, boosts these sort of phishing resistance, um, is, is, is, is gonna be critical for this moving forward. I mean, even we've seen, and even in just this election cycle, we've already seen targeting of, of campaign, uh, emails and that sort of thing, and trying to get into email accounts to get access to sensitive information for, you know, to use for any number of reasons. Um, and so, you know, and, and that all comes down to phishing, phishing, those passwords, you know, it's still the classic sort of social engineering.

So when we start to look at pass keys and these adoptions that make things in these technology adoptions that make things more efficient resistant, it's just gonna help as, as time goes on. I mean, so, so think about if someone's not a passkey expert, it isn't simply getting into your password manager and finding, you know, your password or having you enter it somewhere. Passkey is a little different, relying on PKI and encryption and things like that, identity associated with it.

So it, it seems like it also raises the bar significantly of, even if you could get to that information, actually using it is much more difficult. Absolutely. Yeah.

It, it, it, even if, as you said, even if you can get your hands on one half of that key, you still only got half of the answer. Um, so it just protects you that much more. Exactly.

Great. Wonderful. Well, um, what are you doing between now and, uh, was the November 5th?

What are you spending your time focusing on? Uh, so certainly keeping an eye on this. Um, and then, uh, I actually personally will be volunteering, uh, to, as, as, uh, to do some, some, uh, some work at, at the local polls.

Um, so yeah, keeping busy and getting ready for that. Excellent. No, thanks for your contributing your expertise in multiple ways.

That's awesome, Mike. Um, so folks that want to learn more about LastPass, I know we haven't talked too much about LastPass, but, um, good places. com.

And we also have, for folks who are specifically interested in learning more about threat intelligence or some of our other writing, um, we have LastPass Labs, which is really focused on threat intelligence and security issues. Oh, Interesting. That blog there.

I did not know that. I'll have to check it out. Fantastic.

Uh, Mike, appreciate you being on with us and, uh, let's, you know, let's keep our fingers crossed and everybody's working hard to keep a safe election and the distractions to a minimum, if I can put it that way. It's hard to describe it without offending someone, but yeah. Um, appreciate your hard work and thanks to, uh, the folks at LastPass as well.

Absolutely. Thank you, Mitch. Thanks for having me On.

You bet.