The Impact of Data Science on Security – Bob Rudis, GreyNoise Intelligence

This is Textron TV. Hi everybody. This is Mike Rothman back in 2023 for our first tech strong TV, or at least my first tech strong TV interview.

I'm just very excited to be joined by it by an old friend. Bob. Rudis who is now over at gray noise intelligence God.

I've known Bob for a long time. He is one of the earliest folks that jumped on the whole wow, data science and math could be applied to you know, kind of cybersecurity problems many moons ago and he's just had really an epic run after leaving being a practitioner and applying some of those Concepts, you know join rapid seven pretty early on and it's been there for a while building out there research team is now with great noise intelligence. So Bob rudis so great to see you man and welcome to text from TV.

Why don't you just tell I gave a little bit of a background, but you'll do much better Justice to your incredible background in data science and security. Absolutely Mike. It's actually great.

Start the new year talking with you. Happy New Year. Hopefully we'll be happy New Year for you and everyone watching and listening to this.

Yes, so I am VP of it's a long title. I never use a long title is telling like that VP of data science security research and detections Engineering at Greenways. And because we actually do all those things to power gray noise and we need someone to be responsible for all those things and somehow they picked me to do that, which is crazy man.

And I kind of love it. It's it's an amazing opportunity. We've I've known the greenhouse folks just Andrew specifically and a bunch of them Foo going up five years now before they were even really accompany and just been just amazed at what they've been able to do and now what being inside what we're able to do but as Mike mentioned before this, I was at rapid seven Chief data scientists there amazing research team there a bunch of security researchers and data science folks and just awesome product folks there.

It was it was awesome working with them. This was just a great opportunity that I couldn't pass up. I ran this little thing called the dbir for a couple of years before that.

I think people might know what that is. But I want to emphasize like and I appreciate my saying this like I was a practitioner for like 20 years. I was in the trenches.

I mean mostly at Fortune 100 organizations. So I had more money than most people probably watching this call get at their organizations to fight security battles, but you know after after seeing all the stuff coming at Defenders and seeing all the gaps and that security vendors had I decided I'm complaining about all these things. I should go do something about those things which is why I transition from practitioner to try to help folks at scale and right now as I was off telling Mike before this one of the things that is my mission with that the Andrew is chartered us with great noises intent to stop Mass like exploitation on the internet as a may I cannot wait to make that happen.

I'm hopeful I'm just privilege to be a part of that. Yeah, and I want to kind of highlight on that. Bob because stop Ask Mass exploitation on the internet, right?

So when we think about what it is that we need to do as Defenders, right what we need, you know to help organizations, you know protect their stuff to help consumers protect their stuff. I mean, that's really what it's about. So so again, I think that there's some you know, really interesting stuff that you guys have going on at gray noise will dig into that a little bit but but there was one thing I wanted to start with right because again be guys that have been around the block is you know, someone so Bob get some good goes.

Well, you know, he goes, you know, we're a lot more great used to be you absolutely are true, you know time time goes more time. But you know, we started kind of getting into this idea of has security improved right and I kind of came out with the whole idea that well, you know, it's not like it's gotten better over the years and Bob, you know, you're responding you said well, I don't know that that's really the case. So let's let's kind of unpack that a little bit right, you know.

Know my position is if we look at it from an outcome standpoint or still dealing with the same stuff, right? We're still on the same. You know, remember the old hamster wheel of pain right hamster wheel is security we still you know run on that, you know every day reach around on and kind of new Advanced attacks and and different types of adversaries and all of that seems to be the same as we just, you know, kind of reset into a new year right 2023.

Why is it gonna be different it? Is it going to be different and and I love to get your perspective on what you think is better right, you know kind of from the last you know, 10 15 years, it would be dealing with this sure. Um, so one reason why I indicated that so not everything is better as you like.

We are still feeling that ham every Defender I think out there feels the hamster wheel of pain to some to some degree, but what shocked me in my previous role I rap at seven just to give more shout out to them and Technology there. Yeah, I joined there because Sonar and a less talked about Heisenberg, which is a mirror of kind of what we do but on a smaller scale of great noise, I got to measure the internet like regularly about like what's out there and what's on the internet and you know what telnet goes down every single it's not going down by half every year but it's going down every year and the use of https is going up every and I could go through a bunch of different protocols and even more recently if you look if anyone follow Shadow server, if you don't follow shout us over those are amazing humans and this smartest coolest people ever. They just noted that hey host self-hosted exchange and self-hosted vulnerable exchange is also going down, right?

So we're making really slow progress, but we are making progress and some of this exposed vulnerability landscape that might be out there exposed weak configuration landscape that's out there. So I have I have hope that as that continues and as we see more and this is gonna sound wonky. But as we see more government policy and more Folks at that at that level care about this, Are to focus on this my hope is that within five years.

We're gonna see a massive reduction of some things that are out there not just our Mass exploitation thing, but just the way that they'll be legislation and requirements out there. But but to your thing like sure it just if you look at the headlines from the like so Emma soft just did their like a little like the Deep dive on ransomware for 2022. It's devastating and this is just from publicly known incidents, right?

So ransomware is still bad. We can talk about 2023 for that later. Any of the the reality is that sure there's still a lot of work we need to do especially at the small to medium sized organizations.

I think the bigger ones are funded well enough I I was absolutely funded well enough when I was in larger organizations, and I think they are now and we just need to see how we can help those small to meet and organizations do a better job with the skin resources that they have now that that's right. And and I think the reality is yes, we've seen Improvement in almost every aspect of how we do the practice of security and that's fantastic. I don't want to minimize that at all.

Thousands tens of thousands of people have been putting in the work for a long time in order to get get it there. Right? And I guess just what we've seen is.

Point Counterpoint, right reaction counter reaction and you know, it's just a matter of what's the next shoe to drop and I don't know right? I mean, you know, none of us can really anticipate you to kind of what the next thing is. So I think this is just an ongoing battle.

And again, I think that math really has a huge role to play and how we have improved a lot of the practice. And again, I'll be one of the first to say, you know, you were kind of on the on the front end of that approach with Wade and J Jacobs and and the number of the folks that really kind of look that. Um, you know, how you can use quantitative approaches to you know, you start to hone in on you know, improving in the way we do things and I think that's fantastic.

So so yeah. So what are we looking for this year? You mentioned ransomware, right, you know kind of that continues to play almost no, not everybody but, you know kind of way too many people, you know from that standpoint, you know, you have all sorts of other, you know DNS attack.

We're starting to see you still have endpoint attacks that we're going. So what you look at it from a how do we stop this broad concept of mass explore exploitation, you know on the internet. So what are some of the things you know, you really looking at to you know, start to help folks get out ahead of that process.

Yeah. So like one of the things that really intrigued me about Great noise and the early emissions and even it's current mission is, you know, the fact that we have I so and for scale is just amazing. So folks may not know this we have like over 5,000 sensors like everywhere across the internet in countries that you wouldn't even expect us to be able to get sensors in it's kind of amazing.

So we get to see all these things happening across the board. So we see all of the botnets and we see all of the additions of exploits that they add to those and we see new actors come in for various things that are out there and we get ahead. I mean so we have a lot of things internally and we don't have time to go through them.

So I won't go into it in any detail. We have a lot of things eternally that helps us see emerging things happen. Like on a daily basis that lets us get ahead and lets us say, oh there's malicious activity coming from this IP address and we basically do it on an hour by hour basis.

So unlike a lot of other threat and tell and this is not a pimping of the company just like under a lot of like threatened through on the places, you know, those things feel like oh this IP address we saw it and we're gonna keep it on this list for a month. We keep it on our list for an hour and then we let you know that we see it or don't see it on there. So our goal is to basically make that data up to them in a data available to organizations to isps to network providers to to anyone that can get it in stream and say don't let this IP address talk to anything on your network and if we can get to the point where folks from that kind of opportunistic exploitation to do that.

We basically limited to targeted exploitation which now, we we give a lot of folks and organizations time to go focus on the targeted stuff and make kind of weed out the whole point of the noise, right? So weed out all those things out there. So I I see from an opportunistic standpoint that are taking advantage of like remote Exploitations injection type things or whatever those things.

I think it's doable if there's a good partnership together with with not just us but like the stuff it again the federal level and the government level to be able to go do those things. What does concern me is we still have a massive gaping hole on the implant if we put you said this so brilliantly earlier like the endpoints are still like the weakest point. It's not the humans, right it like so and I actually if one thing could happen to every security person listening to this in 2023.

Stop blaming the humans for stuff. No, no really because the end points are insecure pieces of garbage Windows is garbage Macos is kind of garbage Linux is just riddled with holes. And thankfully we'll never have a year of the Linux desktop because if we did it would be devastating so like so we like that that's where my concern is and that's why I ran some more attacks work so well because the endpoint defenses are just built in and the weaknesses of the operating systems and software just terrible.

They're still credentials everywhere. Like people just haven't caught up to where we need to be with those things which is why I did like guys were indicating I think ransomware and like Brett from emisoft had a brilliant thing in their column, which was I think we need to stop calling our ransomware like at this point. This is just, you know digital extortion.

Yeah, it's it and we calling it ransomware does it a disservice because it is now the they've evolved there's craft to the point where they can actually be do things that in ways that are just that don't disclaim about ransoms. So like the I think that that's where we need to start putting a lot of the focus of how do we get the endpoints more defensible and then I guess secondarily is like and there's been a good move with this thanks to cyber insurance and large part. But how do we get like companies to start caring about what they put on the internet more than I have in the past.

Right? And I think if we can get both of those two things 2023 doesn't have to be like the absolute terrible thing. I think it's going to be because ransomware was really really bad this past year and it's going I don't see that like whatever we're going to call in 2023 getting any better.

Trying to see it actually getting kind of worse. Yeah. And again, I I will continue to focus on the fact that humans are humans, right?

So so building your security structure to assume that humans aren't humans. Right? It's again, that doesn't mean that we don't need to train them.

We do need to train them, right we need to give them basic skills to protect themselves, but at the end of the day if somebody's targeting your organization, there's nothing you're gonna do to stop them, you know from getting in so it is about you know, kind of detecting faster, but one of the things we can do in this kind of plays into some of the trends we're gonna introduce next week at our predict conference. Um, but you know this idea the managed Network right Bob that's one of the things where we can start to maybe leverage some of the intelligence that we get from guys like you to understand what we can and can't do but if we're going through a more managed Network environment, right which says you know, what you don't need to get to that place and catch me. Yeah, right.

You should be going to Salesforce right? You should be going to work day. Those are the side door Office 365 right?

Those are the sites that you need. Play with out on the Internet or you know, something that comes through a curated environment like a Google and we'll block the rest of this stuff. Right?

So this idea of the management Network whether you want to call it sassy or you know, whatever it is. But factoring in the reality that we've got all of these remote employees, they're not coming back. Maybe they'll come back for a day, but they're not coming back all the time.

Right? So we have to start thinking differently about how we provision both the connectivity as well. As you said right the protection of what we're doing with a lot of these devices that are out there the applications that are there.

So one of the cool things about, you know, kind of my new role you talk about your new role a lot. Yeah, like, you know kind of a text from being in the middle of this not just security where I've been for 30 years, right, but now devops and Cloud needed instruction in this whole, you know, kind of generational upgrade in a fact that we're trying to you know Implement within a lot of different environments gives us the ability to really start to really think how we do protection. It starts to allow us to factory in some of the really cool analytics that are out there some of the data streams.

That help us more specifically identify. What's good and what's bad right in an environment and it just helps again come the great on wash. Right the folks that don't have, you know, kind of a fortune 10 Banks resources in order to protect themselves, but to give them better tools and better options to be able to you know, again, give some measure of you know, kind of protection and safety in their environment.

Absolutely. Yeah that actually the one thing that I would hearken every actually technical Professional Security it whatever if they haven't already begun to look at wire guard as a technology for doing networking, it's always using the context of VPN and I really hate I hate you so I mean it is that but I hate the association because actually it's a way of that getting everything off the internet like there's a most organizations don't need as much stuff on the internet as they have right now, especially if it's internal things for for employees and I think even if folks like Salesforce and other large SAS operations, Managed to work from a hey we're going to put this on the internet to a watchguard type Network and like and as an example like I did and I'd get nothing for saying this but tail scale is an example where even individuals can do that or organizations can do in a really really simple easy managed way getting more things away from the attackers direct access forces them into a funnel like you were saying where then oh, we can capture all the data in that funnel. We can see what's happening in that funnel and we can stop some of this stuff that's happening in that funnel and ways that we weren't able to do before so just making it really hard for attackers to just do the things that they want to do to be able to kind of and we have tons what I love and one reason why I was more optimistic about how things are getting better and you said it to a degree that the detections technology out there.

I mean, I would have killed for some of this technology like like 10 12 15 years ago. I mean this is there's our some amazing from a whole card. I wouldn't even mention one because there's a card rate of security vendors that are producing excellent technology that if deployed well and are fed.

The right data is you were saying give Defenders like a leg up that they never had before and combine that with funneling and getting into a narrow input for the attackers and they're up as you were saying for the attackers. I mean, I'm hopeful that like in three to five years we may see tide turns and you were you were indicating we're fighting humans like providing the attacker humans. They're smart adversaries.

This isn't like Intel having to figure out new ways of doing Atomic things with silicon, right? This is no where we're fighting the paid organized attackers in foreign countries and foreign places. But so we're always gonna have that battle we can make it a lot harder for them.

And I think I think we're on the cusp of a lot of breakthroughs in that space that we can get organizations just to think of the professionals to think a little bit differently now, that's right. And you know, when you start seeing some of the Innovation that we're seeing in terms of attack service management really understanding what your environment looks like in terms of and again, we can b**** about, you know, kind of the operating systems, but if you look at you know, kind of Maco, yes now versus what it was five six years ago. Listen, there's isolation.

There's you know, absolutely Applications and deploying. So there's been a lot of innovation. There's been a lot of progress on that front, but you again it's not one of these battles where there's a large vested interest in adversaries continuing to figure out how to steal things.

Exactly. Pretty much like it's been since the Dark Ages, right? So we're not going to change human nature from that scene, but I do think that a lot of the work that that you Bob are doing it having great noise and a lot of the other folks that are trying to again apply much more quantitative scrutiny to how folks are doing.

They talk about detection engineering mean. I know folks that actually have software shops in their security business, you know in their team that's awesome build these detections, right? They want to a pipeline.

I mean, it's considered real software now and that's a huge huge Innovation from from where we've been so, you know, and again I tend to as opposed to my Persona right? I tend to be a reasonably optimistic and I do think things are getting better, but we do have to stay focused on the outcome. Right how we helping a special those great unwashed folks that don't have the resources where you and I tend to spend, you know, most of our time with you know, the folks that can invest significant money.

And people right in this problem. But again, I I do think that we all making improvements. I know you guys did some pretty interesting research recently.

So I want to give you a chance to highlight that before we you know, kind of need to wrap up. Yeah. I appreciate that Mom and I'm doing this mostly for my team because they did and said all year that I've only been here for three quarters of a year, but they did work great work before that and they've done great work since then in this actually mostly them and not actually me the we did a look back on 2022's what what I guess what we call our Mass exploitation report and that's a little bit of a misnomer because we basically focused on some core vulnerabilities that the researchers on the team thought were the things that they wanted to call out and why and one thing I stressed for the report is listen, we're not just gonna document like this vulnerability happen and whatever like we need to talk about.

This is the this is the vulnerability. This is this is what happened with the vulnerability. This is why you need to care about this.

This is what you could have done differently if you were impacted by it. And if you weren't this is probably what you what you did to do that so we To make it be very actionable. Every section has at least some practical guidance Kimber from the team as well did an amazing thing where we talked about like basically, it's like you caught the hamster wheel of pain for individuals.

Well, this is like the celebrity vulnerability kind of cycle, which is also kind of a hamster wheel of how that actually works too. So be a basically if you just take the report if you go to Great noise that I owe which is like yeah, I think that I should know who this off by top my head but it's great news that I know you can grab a copy there. Basically we talk about the log for Jay response, which grainos was at the Forefront of we at rapid Health at that tiny bit from a contributing that to like various sources, but great news was honestly right at the cusp of that had great information really really helped a lot of organizations with a lot of the Telemetry they provided and we now provided and just for the other ones just real quick.

So last season was a really big thing last year because everyone uses it they stick it on the internet and they leave it badly configured and that's just a repeat story for any other piece of technology you Set it and forget. It just don't do that. I think the other thing is my biggest problem and my biggest complaint.

In my eyes to make sure this is honest. Yes. This is my biggest complaint is when we is when security technology vendors are themselves the problem and I'm not gonna call out like you can read the report to see the one I'm talking about, but they weren't the only one last year when you have router manufacturers and when you have firewall manufacturers and when you have load balancer manufacturers whose core mission is to provide safety and resilience for your infrastructure, like have inherent flaws within their system and nothing's perfect.

There will always be vulnerabilities, but we could do a lot better than that. So my challenge also for 2023 is every technology vendor, but especially networking and security ones do a better job with your own internal ability to detect what's wrong with your code, especially when it comes to exploitation possibilities and don't make don't be the problem for Enterprises help try to continue to be the solution and you know the uplift or for Enterprises instead of being the thing that they have to worry about. Do they have to patch it this month or not.

I think I think if we could do a better job on that side of the industry A we can help everyone out a whole lot better as well. Yeah, you know, I I couldn't agree with you more on that Bob. I think you know and and it's not like we haven't learned this lesson before right, you know kind of the whole Citrix thing years ago where my gosh.

Oh you had to do is Google, you know kind of that certain patch level and and you were in the hundreds of thousands of you know, kind of remote access boxes, you know, we saw that with pulse secure, you know, kind of easily is supply chain attack obviously solar winds. I mean, these are things that are thousands and tens of thousands of companies have this technology in there. So that is proven to be vulnerable.

It becomes a huge problem for a lot of organizations that are not in a good spot to you know, kind of really protect themselves from that. So yeah. Oh great stuff Bobby, you know list.

So here's the thing right we could go on for hours we could Unfortunately, I can't because I'll get the hook my mouth detection on TV are like giving me the you know waving me off from that standpoint, but one thanks for being here man. Happy New Year. Really remember to see you from that standpoint?

Um, just one more time great noise that I/O is that it's great. Great news that great noise that I oh great noise that I go check them out again big just math and intelligence and a lot of the stuff. That's really how we're gonna start to change the tide against a lot of these adversaries and with that Bob.

We do need to wrap it up so good. Thanks again for for being with us. Barbara's old friend.

Really appreciate me. It was awesome being it was great. It was great to see and talk to you again.

Like all right. We will send it back to you for our next interview.