M on this report they're also talking
about like brute forcing vpns so it
looks like firewalls under attack but
also vpns right where they're just
trying to guess the passwords I I take
it yeah any any system um I mean there's
a constant background noise of people
trying username and password um
combinations um it's why you should
really change the default password on
any system like as soon as you're
opening out the packet or you're taking
delivery of it change the default
password immediately we can't reduce
risk to minimum but but these are good
place to sorts um and the other thing is
uh multiactor
authentication um so especially with
administer accounts whether that's
administer U account on any network
system or your network infrastructure
absolutely make sure that you got to
have uh multiactor authentication on
that any user account on your network
infrastructure make sure you've got
multiactor
authentication hey everyone it's David
bumble back with Martin Lee from TS
Martin lots of things happening
hopefully you're going to tell us about
it welcome back well it's great to be
here um maybe it's unfortunate we have
so many things to talk about but yeah
stuff that needs to be discussed and
needs to be spread so that people know
what to do Mar I've got to address the
elephant in the room right yeah tell us
have released a report but like last
week at the time of this recording there
was this uh report released about um f
walls so Cisco Seco fiall was hacked but
it's not just Cisco so we've got like
for we've got um Cisco we've got P Alto
there's a whole bunch of them foret has
had a lot of problems recently and I
mean I can mention various Brands but um
what's what's going on Martin um if we
go back this is part of a broader
campaign of activity if you'd have been
asking me the same questions this time
last year i' would have been talking
about Jaguar tooth which is another
campaign that we saw and all the way
back so the we've been talking about
this since 2016
so in 2016 there was a Caesar report
about threats to network infrastructure
over the years that threat or that
Menace of the threat actors has has got
larger and larger so any any network
Appliance you know they're small
computers um you know you plug them in
and you don't think anything more about
them but but these things they have an
operating system they have a CPU they
have spare CPU cycles and because
they've got software them really
anything that has software on it has a
vulnerability uh we in Cisco we spend a
lot of our time making sure that there's
a as few vulnerabilities as possible by
hiring very very good software Engineers
by having solid software engineering
processes by having testing by having
good design and design reviews and all
that still and with with anything there
will be vulnerabilities that creep in
what we've been seeing over the past
couple of years is really the threat
actors taking notice of this what I say
with any threat is you've got to turn it
around and think about things from the
threat actors point of view so if you
want to get inside an organization and
you're a threat actor okay number one
you you'd start with a person you'd
start with fishing then you'd get
malware on a laptop somewhere and then
and then use that to to spread out your
attack throughout throughout the system
endpoint protection is actually not bad
now it's pretty good we are pretty good
at detecting bad guys on end points on
laptops we're not perfect but we're
we're pretty good I think what that has
led to is then the bad guys looking at
well what else can we get on Y and those
network devices so whether it's
firewalls whether it's routers whereas
it's switches the bad guys are looking
thinking hey if I can get on there this
is a system that has an operating system
it can run software it's got spare CP
cycles that can be stolen there will
definitely be vulnerabilities there that
are waiting to be discovered but do you
have AV running on your router exactly
nobody does it's just that box in the
corner Black Box yeah absolutely when
we're thinking about cyber security
we're thinking about our servers we're
thinking about the laptops we we're
thinking about people logging in we're
thinking about emails I think too often
we're overlooking that little box with
the blinking lights that sits in the in
the cupboard the bad guys haven't
forgotten about it and so they are now
and we've seen this over the past few
years looking at ways of can they
exploit the vulnerabilities we'll first
discover the vulnerabilities on the
systems then exploit them compromise
that system as with any attack get a
foothold on it something which is
persistent there and then use that as a
way of furthering the objectives hitting
use it as a launching point for further
attacks or doing Network reconnaissance
but ways of having that point of
presence inside a network and then using
that for subsequent attacks this is what
we're seeing at the moment for your
audience this is so so so important you
really really need to pay attention on
this um Network infrastructure is
vulnerable it's actively being exploited
by by the bad guys we need to think
about this as any kind of computer
system patch it you know whenever we
find a problem with ins Cisco we're
going to be really public about it we're
going to be really really transparent if
there's a problem we'll tell you about
it you need to patch it you need to
follow the the the advice patch it make
sure it's secure that in itself probably
isn't enough we need to look at the
configuration of the system so you can
configure it to be in an insecure state
so think about how these systems are
configured again there's advice there's
standards that you can that you can
follow but think about the configuration
as with any computer system don't expose
too much to the outside internet you
know make make sure that we're we're
exposing the absolute minimum of
services so again we're making it
difficult for the bad guy to to get in
but again you know we we we we can't
reduce risk to a minimum but but these
are good place to SS um and the other
thing is uh multiactor
authentication um so especially with
administer accounts whether that's a
minister um account on any network
system or your network infrastructure
absolutely make sure that you got to
have uh multiactor authentication on
that any user account on your network
infrastructure make sure you've got
multiactor authentication and then the
last bit is frankly you got to be
paranoid you you you you've got to look
for evidence of um of incursion the
evidence is there if you look for it um
in the blog we've described in great
detail all the ioc's how the um attack
looks like what can you look for there
are other reports as well start thinking
and start being paranoid what would it
look like if part of my network
infrastructure was compromised how would
I discover that the traces are always
going to be there but you got to look
for it um and actually the number one
Trace so the bad guys again they know
that the traces are there y first thing
your bad gu is going to do he going to
switch off logging so again for the good
guys for the Defenders look for the
absence of logs look for evidence that
someone has switched off a log this is a
Telltale signal that that that something
wrong is is going to be there again
think about it from the bad guys point
of view what are they doing what are
they going to do and then look for that
evidence um the traces will always be
there either in your logs or the fact
that you don't have any logs cuz someone
switched it off look for that those are
the clues you need to look for that'll
then show that actually you've got bad
guys in your network infrastructure when
we were preparing for this interview you
mentioned something about a single UDP
packet can you explain what that was
about was that related to this or is
that something else so that's um that
was another attack the the um Danish
cyber security um uh agency produced an
absolutely superb report um would have
been sort of late last year on um attack
against critical National infrastructure
in Denmark um there were 20 something um
suppliers of electricity or in the
electricity supply chain that were
compromised by a sophisticated threat
actor coming in through the network
infrastructure one of the um the the
that phone home bit so
again point of view what are they doing
they want to know that their attack has
succeeded one of their phone home you
know connections um from one of their
devices it was a single UDP packet it's
crazy but again you know if you can
think again think about it from the bad
guy point of view what do they need they
just need one packet to go back to tell
them that they've been successful from a
defender's point of view we can use this
to our advantage so in your logs I mean
it's not an easy thing to find out but
you know what are the IP addresses that
we've only ever pinged once with a
single packet that that kind of stuff is
suspicious and again there's only so
many ways that you can conduct an attack
there's only so many ways you can
establish Commander control there's only
so many ways that you can phone home we
can actually look for evidence of this
happening in the systems and we can find
it but it's only going to happen if
you're really paranoid about it and
you're actively looking if you never
look you will never find them but if you
start looking you can find these bad
guys and then take the steps to kick
them out your network so you make sure
that they're all logs number one cuz
like they turn off logging that's a
problem but the I'm going to push you
now because the problem with logs right
there's so much it's overwhelming this
is why we have Big Data Systems this is
what it what what it's all about um you
know think back the cuckoo egg in the um
tail end the
1980s um you know this was one
researcher gy gyina um in a university
laboratory he was the systems admin um
and he hunted down a KGB spy um he did
that through looking at the printouts of
logs you know this was this is the Stone
Age of computing now we we have so so so
much more data um it is I I hesitate to
say it but I think I believe it's
probably easier to find the bad guys
because we have the data the difficulty
is actually managing and processing that
data this is why we have the Big Data
Systems this is why we have the xdr
systems to help you do that but your
systems and the data that you've that
you're logging and and everything that
you've got and the management of that
it's only as good as the questions that
you're asking it if you can ask the
right questions and you've got the data
that will actually give you those
answers you can find it this is this is
threat intelligence this is what I write
about in your book this is what this is
what it's all about how do I learn is it
like a start year right yeah you you you
start you start there number one by by
knowing your trade if you're a network
admin or a systems admin you know know
know how your system works know what
normal looks like which is the first the
first first bit really is knowing what
normal looks like make sure that you got
the basics right um you know there's no
point doing fancy stuff if you've got
you know you're not patched or you got
stuff wide wide open to the network get
get the basics right once you've got
that it becomes a bit of a sport really
it's a competitive sport um it's about
hunting the bad guys you need your
hunting grounds your logs and your data
are your hunting grounds and then your
skill is in being able to ask the right
questions think um you know go read
these these these blogs and think what
would that attack look like in my system
what kind of traces might it leave and
then how would I uncover that and then
start asking those questions of your
data see what you can come up it might
not be easy you might be well coming up
with questions that um that actually you
don't have the data to support you know
you wouldn't be able to find the
question that's actually a good thing
because you can then start thinking well
okay what I think this is a really good
question what data do I need to keep in
order to be able to ask that and that's
the bit you can start going well I I
going ask the boss for some money
because I think this is important and
I've got a Blog here tell us about an
attack and I think we could detect this
attack if only we had this data also you
might find that you can't quite answer
the question that you'd really like but
you can kind of find something similar
with with what you got I'm I'm very much
in favor of working with what you've got
when you can um so even if that question
that you don't can't quite answer but
you can get something similar work with
that and and start having multiple
queries going um when you find something
you think might be um a good question to
ask you know turn this into a procedure
which is just working in the background
continuously and can tell you when some
when it identifies something um but if
you can have all of these little eyes
looking for evidence of compromise
looking for something that's wrong
that's when you're going to find the bad
guys Mar you're you're a bit older than
perhaps some of the audience so you're
going to you got to explain that for
everyone who's watching okay so um it's
a super book um the cuckoo egg written
by Clifford stall he was a systems admin
in um was it Lawrence Livermore National
Laboratory um anyway University
laboratory that had public sector
research contracts and there was an
accounting issue there was like a couple
of cents worth of computing time that
hadn't been accounted for and and the
boss asked him can you work out what was
wrong here but it's that bit there's
just some a little tiny thing that quite
that didn't quite Square um and so he
goes in and looks into this uh what was
initially accting issue um looks at it
in great detail is scrolling through the
logs and he identifies yeah a KGB spy
based in in Germany that was trying to
to to steal nuclear secrets as I as I
remember it but but what's really
pertinent is that it was his sense of
questioning you know why why why is our
accounting like two cents out you know
most people just shrug their shoulders
you know put the F hand in the pocket
well here you go it's 10 cents you know
problem solved
um but he was like no no no let's find
out what do we find oh there's this
weird thing what does that mean well
that leads to this is which is weird
what what what what's happening what's
happening what's happening and and for
any threat Hunter now it it's that it's
asking those difficult questions not
being satisfied until you've really
found the origin of the of of the
problem if anyone in your audience is
hiring cyber security practitioners and
threat Hunters this is why it's so so
difficult because you hire the world's
most difficult people this is the best
kind of threat Hunter is someone who'll
never take no for an answer who's always
asking why why is it like that why is it
like that but these are the skills that
we need and we need more people who
aren't satisfied who just like I we'll
just write off this two cents um anomaly
it's like no no no no we got to find out
why we got to find out what's happening
we've got to think what would the bad
guys look like on my network um what
would happen How would I find that
single UDP packet sent to an IP address
that we've never ever contacted before
what would that look like in the logs
how could I write a query to actually
see um if we've ever done this this this
is what we need to do and it's that
sense of wanting to know more of
curiosity and insatiable curiosity this
is how we're going to defeat the bad
guys we need this Martin you gave us
some great tips about like protecting
the firewall right and one of them is
MFA I've heard like every cyber person I
ever talk to MFA MFA MFA but in the
Talis report now for January to March of
this year one of the biggest threats is
MFA I think 50 50% or something of the
attacks that t us looked at had MFA
issues MFA is great but doesn't seem to
be working MFA fatigue so um MFA it it's
not a silver bullet it's really really
useful it it it's part of what we need
as our basic cyber security posture um
but it's also important to know the
weaknesses of um of
MFA um I think it's also useful let's
just wind Way Way Back Again to the the
the Stone Age of computing um and start
thinking about usernames and passwords
so um we've got Mainframe systems um in
universities and we need a way of
actually doing the accounting for
computer time who is allowed what and
the way that we came up about that is
with username and passwords that you
need you're assigned a username you
create your own password that way you
log into your account on this shared a
Computing system and that way your
activity can be logged in the logs and
we can work out how much to charge you
or your department so it wasn't really a
security idea it was never a security
idea it also let's be fair since the
dawn of computing usernames and
passwords have never really worked well
my password is still password 1 23 yeah
yeah um so right in the early days we've
got the these these risks and
vulnerabilities that we know about you
know shoulder surfing just peering over
someone's shoulder um one of the first
uh vulnerabilities in computers that was
discovered was the fact that you could
actually send the entire uh file of
usernames and passwords to the printer
and take it out and then you can use
somebody else's username and password to
do your pet project um and use their
credits on the system because it's too
expensive for you so there there's
always been a motivation to compromise
the username and password system it's
never really been secure no um things
have got much better um certainly when
we move to things such as single sign on
that instead of having dozens of
usernames and passwords in a corporate
system we've got a single username and
password which then gets you onto the
network and gets you onto the systems
makes it an awful lot easier for the um
network administrator to administer so
that if someone is romise we can just
kick them off the network and close all
of their accounts whilst we resolve the
problem same when people leave the
organization again okay great on your
last day one button to click okay now
you don't have access so you can't come
back in four months and and and hack
into see things so this is all good
never been perfect multiactor
authentication add another layer of
security on that so when you're logging
in you're typing in your username you're
typing in your password you're then
getting a ping on your phone which
you're then responding to in some way
that can be just a tap to authorize or
it can be a number that you've got that
you've got to type in there are still
weaknesses with this system uh the first
is with anything that has software in it
there may well be software vulnerability
so there might be a software
vulnerability in the system it's the
first thing to consider secondly the
configuration we need to get the
configuration right you can configure
these things in in an insecure state or
configure it where there's
bypasses again I'm sure almost everyone
on your uh in your audience will have
come across the the the the issue the
boss wants an exemption exactly you know
these things and then you've got a code
in an exemption and in fact encoding in
the exemption you accidentally make
anyone in this group you know there's a
million and one ways of doing it but
however this this this is real life so
we need to think about these things and
be aware of it the other issue is of
course humans whenever we have humans in
the mix again there's a whole world of
vulnerabilities in this and again as I
say think about things from the bad guys
point of view think about things from
your user's point of view the great
thing about multiactor authentication if
the bad guy gets your users username and
password perhaps through fishing they
can't use that to get access until the
user approves it so what's your bad guy
going to do okay bad guy I'm wearing a
black shirt we're going to try and log
into the system what happens we get a
ping onto our user's phone okay the user
thinks well I didn't log in and I'm just
going to ignore that bad guy does it
again and again and again and again and
your user is there trying to get on with
their day with their work and their
phone is going ping ping ping ping ping
ping ping so the Temptation on the user
is like I'm just going to I'm just going
to click okay and then the problem goes
away and they can get on with their with
their lives with their with their day
without being um distracted or annoyed
by their phone but in fact what they've
done is they've just authorized the bad
guys to get to get access so this is a
weakness with the system we need to work
with our users your users are part of
your security system they can be really
really helpful as sensors make sure that
your users know what to do if their MFA
system is is getting lots of pings on it
this this isn't something to ignore it
isn't something just say okay to make
the problem go away they need to get in
touch with you because there is a
problem so incentivize and encourage
your users to act appropriately if they
Identify some kind of problem with a
with a with a system they may not know
that it's a security problem but we need
to tell them if the MFA system is just
going ping ping ping ping ping you need
to do something and you need to get in
touch with us and we're not going to
shout at you you know you're not going
to get into trouble you're not going to
get shive indeed if you're doing it
right you give them an award or give
them at the very least give them a thank
you email for doing it that gives you
the visibility that there's a bad guy
coming in what you do you know reset the
username and password of your of your
user then the bad guy doesn't have the
their active password at the moment you
might also be able to detect that in the
logs if you're again if you're looking
for it so this is a good thing to have
that automated detection going we've got
a user that's getting like multiple
pings um from the MFA system in a in a
short period of time look at what IP
addresses are trying to connect you know
that'll give you a heads up it'll give
you a clue yeah MFA improves username
and password security it's not a Magic
Bullet it's not going to make the
problem go away but it gives you an
additional point to make the bad guys
life difficult you know you're putting
up barriers right you're putting up
barriers you're making their life
difficult you're also making their job
noisy and you're giving yourself
multiple chances to be able to identify
that there's an issue that there's a bad
guy trying to attack your system you've
then got multiple opportunities to act
you know we can disable the IP address
we can lock down a system we can reset
the user's password we we can actually
see if there's part of a further um
action there might have been a fishing
campaign and this is your first
indication there a fishing campaign
great there might have been other people
that had fallen for it you can you can
find this it's giving you options the
worst thing you can do is not have
visibility of the problem and just think
yeah everything's fine so Martin it's a
problem right because this is
highlighted as the big issue in the
Tellis report yeah number one is fatigue
it seems to be like that where the user
just gives up and and presses the button
but but I want to ask you because I know
the audience will be interested in this
SMS toofa is it good should we be using
it should we replace it um again it's
better than nothing absolutely it goes a
long way it's better than nothing we're
making the bad guys life difficult which
is um all about what we do typically the
apps are better than doing it by SMS the
reason being is that um the bad guys can
clone your sim so redirect your SMS into
their device or if they can log into
your user portal with your phone
provider they may well redirect or
request a new um phone number um for you
so again sms's may go may go elsewhere
so um having it on an app in your phone
I would say is more secure than an SMS
however that's not to say that the SMS
system is inherently secure it's a hell
of a lot better than not having it but
yeah I do I do slightly worry like when
my bank sends me SMS messages it's like
do you know what I I'd really rather
have this on an app um again we've got
to think about usability and working
with the with the with the users and
what works for what works well for you
being a tech professional May well not
work for your 90-year-old grandmother
you know so so that the security is all
about tradeoffs um but anything that we
can do to make the bad guys's life
difficult frustrating noisier is all
good yeah well in the report on and some
of the Talis people I I watched videos
about have mentioned the use of uh voice
cloning so they they they simply dial
into your voicemail get your voicemail
get your voice off the voicemail clone
it and then use that voice to phone the
help desk to get them to change the SMS
or something so it's crazy man ah it's
amazing isn't it I mean technological
Advance is going to keep us in business
unfortunately you know nothing would
make me happier than making myself
redundant and unemployed however um yeah
you know human Ingenuity uh never ceases
to amaze me uh one of the issues that
I'm waiting to happen is actually voice
cloning in the use of business email
compromise so this is a scam we write
about it in our in our latest uh uh
report
um been happening for years uh the way
that happens is you get an email from
your from your boss saying I'm at a
conference we've forgotten to pay the
invoice they won't let me give the
keynote speech in in 20 minutes unless
we pay this invoice please urgently
urgently transfer £10,000 $110,000
£10,000 whatever to uh this bank account
and and and will be good in fact
complete scam what happens is the bad
guys wait for your big boss to be
talking a conference he'll be a headline
speaker or they'll be a headline speaker
so they'll know when this individual is
going to be on stage they will time
their attack they will have researched
um who who may fall for this so it's
likely to be uh it could be an
administrative assistant could be
another member of the senior management
team could be the Chief Financial
Officer themselves but it's someone
who's going to feel feel under pressure
and also someone who can arrange for the
someone with authority to make to make
the payment y the way to defeat it is
through having good processes of saying
actually okay this is great if we've
forgotten to pay the invoice tell me who
the organizer is or I will phone the
organizer to confirm that so we need to
have offline confirmation of it out of
band right yeah out of band confirm
or even you know send a credit note and
say yeah absolutely we will pay this as
soon as possible however we can't pay
things without 3 days notice or
something like that so have Rock Solid
procedures at the moment we see this
with email through the wonders of AI we
now have the possibility of voice
cloning so we may well get an a phone
call apparently from the boss using
their voice um telling you it's so
important I demand
that you that that that you do this um
actually the the the other day um my
lovely daughter uh found me and she need
me me to pay to pay for something and
I'm like are you sure are you sure yeah
your daughter yeah yeah I I asked her a
couple of questions just to just to
verify that she really was my daughter
and the type of questions only she would
know or only someone you know within my
family would know um just because again
you know be paranoid about this stuff um
it it's it's happen if it's not
happening already it's going to happy
happen in the near future so so uh be
aware of it within your own friends and
family you know you can set up a secret
password that only you know or a shared
memory or a shared joke or a a song line
that only that person would know to ver
to to to verify in a business um
environment you need to have those Rock
Solid Financial procedures and have the
discipline to make sure that everyone
follows these no exceptions of course
you know sometimes yes people will
forget to make a payment or a payment
will fail or or an invoice will be will
be missed build that into your procedure
so that if that's if that happen say
okay that's fine we'll issue you a
credit note we'll email you to say you
know we're going to follow our
procedures we will pay this but have
those procedures to check and to verify
that um this is a correct payment and
don't give into the time pressure all of
this works by creating a sense of
urgency if you have those procedures and
someone phones up say I need you to I
pay this now it needs to be done within
20 minutes you say well actually our
procedures that you signed off clearly
state that um you know there has to be a
three-day delay um you have to get
buying from everyone and you have to be
rigid and very very disciplined on that
but if we can do that we we we can solve
this scam fairly easily it's amazing
because when I phone some of the UK
Banks and I won't mention which um they
say don't you want to use voice uh to
authorize your bank account it's like I
will never do that yes yes absolutely
absolutely never never ever ever ever
yeah because in the report it talks like
you just mentioned the business email
compromise um it's like a quarter so
more than double of the previous
quarters more than half of the attacks
so it's it's basically what you've just
mentioned right emails uh voice cloning
stuff like that to try and get people to
send money or do something that they
shouldn't be doing yeah yeah and the
same with fishing as well you know you
get a phone a phone call from your it
help desk um oh we need to verify your
account can you read me the numbers on
your um your authenticator um happens
actually I was reading about this the
other day with bank fraud um again the
the supposedly the bank's help desks
phones you and says we need to verify
your account can you read me the numbers
on your authenticator no no no no no
never ever ever ever ever and actually
it annoys me greatly when my bank phones
me and wants to talk to me I say you
know tell me the the phone number
I can verify remotely I'm going to use
another phone to pH you back on um and
then we can talk but but no way am I
ever going to talk to someone who phones
me pretending to be my bank um in in any
circumstances Martin on this report
they're also talking about like brute
forcing vpns so it looks like firewalls
under attack but also vpns right where
they're just trying to guess the
passwords I I take it yeah any any
system um I mean there's a constant
background noise of people trying
username and password um com
combinations um it's why you should
really change the default password on
any system like as soon as you're
opening out the packet or you're taking
delivery of it change the default
password immediately um so that's
something that bad guys are looking for
also the bad guys know we're not
particularly good at remembering
passwords as a as as human beings um
with the number of password breaches
that there have been now um yeah pass
your your your password is probably out
there and at this moment in time there's
probably someone trying your username
with that password that's been leaked
from another from another system um this
is another reason why um two-factor
authentication or MFA is is is so
important um so that if someone does
guess your username and password and
that's whatever system it's not
necessarily VPN it could be Network
infrastructure it could be a web service
it can be your your your web mail
account your bank account whatever it is
someone is probably trying to either
guess your password or use a password
that you've used before in order to
access that system so make it difficult
for them if you know your password has
been compromised yeah it's time to
choose a new one um use two Factor
authentication and know when you start
getting lots of pings on your system
that that's not a good sign but if you
can do that again you're in a good
position so for the vpns TFA 2fa
absolutely 100% tofa And then logging
cuz I I mean you you always recommend
logging um and it's in the report as
well yeah absolutely yeah it'll um
that's your hunting ground this is what
how you hunt the bad guys they they're
out there in the logs uh you know your
logs are like your your your Forest
where you're hunting uh hunting wild
animals um it's there but if you don't
have the hunting ground you will never
find them question about tofa cuz now we
keep saying tofa MFA you know how it
surely it's difficult for attackers to
to do this or is it easy these days it's
um it's difficult to do it yourself um
however it's uh relatively easy to buy a
kit so um this really goes with any kind
of um a threat or attack the bad guys
develop a business about it you know
coming up with your own uh bespoke zero
days or ways of attacking systems is
actually quite difficult and there's
probably relatively few people in the
world that are that are capable of doing
that um you know probably measuring this
in the world of tens of thousands shall
we say
um possibly 100 thousand but but you
know tens of tens of thousand certainly
not Millions um but these people from
their own point of view again think
about it from the bad guys point of view
if you come up with a new way of hacking
systems you know you're not going to
work 24 hours a day doing that you know
you've only got so many hours in a day
that you want to work what you can do is
set that up as a business as a franchise
so license out your elect um
intellectual property your attack Cod
code and your way of doing it create
that as a software as a service license
it out to Affiliates who can then either
do it themselves or license it out
further so that way as the the the chief
bad guys come up with the vulnerability
uh or the exploit for the vulnerability
in the first case you could have
thousands of people conducting these
attacks and take a small cut of that or
or having them paying you rent for your
system and you can make more money than
you ever could by doing it yourself so
it's a whole business right yeah yeah
the these these these systems exist and
and this is how a lot of cyber crime is
um is conducted again from the defender
point of view we we can use this to our
advantage if so many attackers are using
the same attack then actually we're
reducing the number of attacks that we
that we need to defend against if
they're always using the same techniques
or the same vulnerability then we can we
can patch the vulnerability or we can
put in mitigations from that we can put
in detection code for this attack so
actually it as a Defender it does tend
to make our lives easier I think for
society it's a it's a bad thing because
we're we're we're allowing people to
start on that apprenticeship of of of
evil and becoming top um top hackers so
we're giving them away an easy step into
the world of cyber criminality which is
not which is not a good thing but if
they're remaining fairly unsophisticated
in terms of their attacks and that gives
us opportunities and advantages to
defend against it it's interesting cuz
in the report they mentioned this uh
Tycoon TFA and it sounds like they've
really made it easy exactly like you've
said it's like a business it's got good
landing pages that give you fake
Microsoft 365 logins Google logins um it
picks up your tokens CU that's another
problem so let's mention that because
one of the problems is when you log into
a website and this has been a problem
I've seen on YouTube and a lot of places
it stores a cookie on your computer
right
so your session token can be stolen and
it looks like they're really good at
doing this yeah or or you can do um a
bit like fishing you can have the fake
page but at the same time when someone
goes and and logs in you send the
legitimate ping to them so they think
that they're that they're logging in
yeah there's lots of ways of doing it um
unfortunately human Ingenuity um has no
bounds certainly when it comes to
illicit gain um so again yeah be be
aware of it this is why we say TFA it's
not a Magic Bullet it's not going to
completely completely um solve the
problem but it goes a hell of a long way
and also in those logs so your hunting
ground you've got the trace but you got
to be looking for it so Mar the problem
is you know those cookies are stored in
your computer and a lot of like social
media companies would let you stay
logged in for a long time do we force
users to log out uh it's always a
possibility um however let's be
realistic um are you really going to log
out every time you check social media
and then log back in again with your 20
character password and the two when you
just want to check you know what P what
Pub your mate is in or whatever it's not
so Martin you've mentioned this word
quite a few times paranoia or being
paranoid but on the flip side you've
also said that you can't you know have
it weighing you down too much do I need
to go live in a cave quite the opposite
uh you need to be a healthy rounded
individual we we are all in this in the
cyber security industry we're in this
because we want to make the world a
better place yeah everyone who works in
cyber security is working towards making
the world more secure and fighting
against the bad guys the flip side of
that is you know you can feel the
pressure um you know the threats don't
stop it keeps coming um you know it is
24/7 365 days um days a year it is so so
important that everyone in the industry
looks after themselves um you cannot be
effective in your fight against threats
if you are burnt out so for everyone's
good not just your own but also those
systems that you're protecting and I
know there's people out there who are
the only person in their entire company
who are keeping the lights on and
protecting their systems again against
attacks if you are that person you need
it is so so important that you take the
time to destress because after a while
it will get to you so both um physical
and mental health is so so important and
I I fundamentally believe that the two
are very very closely linked you meaning
this for 21 years man uh yeah and and
yeah I'm still breathing there there
have been some close calls but I am
still breathing um so getting up away
from the computer spend some time a day
away from the computer I know everyone
who's watching this their hobby is going
to be computers their job is going to
give you computers they spend their life
in front of a keyboard I do the same but
I make sure that at least actually six
times a week for an hour a day I am
doing exercise um so number one physical
health every hour or even better every
50 minutes get up out of the chair go
walk around get the blood moving if
you've got some kind of Weights uh next
to you even like a water bottle wave W
wave it around get the blood pump in
stand up get away from the computer at
least once an hour if you can do
exercise an hour a day double benefit
doesn't have to be super Hard Exercise
it can be just be walking outside even
better if it gets your blood flowing in
your heart pumping and yourself a little
bit out out of breath one that's looking
after your physical health also it helps
your mental health so much you have to
d-stress you have to take some time away
from all of that pressure to keep the
lights on to fight to height the bad
guys you have to do something else so
that you're allowing your mind to relax
and you're allowing your mind to um to
de-stress uh my thing that I I found
fairly late in life is actually running
very very slowly but long distance is
through the through the countryside and
the the the biggest thing that it get
that it that it gave me and one of the
reasons why I started is I realize that
if I'm out running in the middle of the
countryside and someone phones me cuz
there's a problem you can do there is
nothing that I can do exactly you know
if I'm 4 hours away from the laptop
there is absolutely nothing I can do and
they will have to phone someone else so
even if you are not technically on call
if you're working secure always on call
you know there's always going to be
people calling you um whether it's about
work or a personal issue or or whatever
make sure that you can be away from that
and completely disconnected so that the
the the problems aren't continuously
your problem um at least one day a week
be completely disconnected go do
something else recharge and get rid of
all that stress and what you will find
is when you're thinking about something
else this is when you have your best
ideas when you've got your mind
distracted and you're thinking about
something else you're allowing your mind
to wander it's at that moment that you
will come up with hey I know how to
solve that problem I know how to find
this threat and you can then go in and
be more performant at your job because
if you're thinking about this 24/7
focused on just one just one thing that
that inspiration that creativity will
never come to you you need to uh um help
that creativity come and you do that by
think thinking about something
completely different decharging getting
rid of the stress doing something else
and also looking after your your your
physical health yeah I mean there's a
big problem with the mental mental
health a lot of people are struggling
yeah yeah because they get burned out
because the threats never stop um we
we're we're under staffed we're always
under staffed we never quite have enough
people uh the bad guys are continuously
hitting us um our jobs are important to
to us keeping these systems uh alive and
the and the uh and the lights on we
never get the recognition that we that
we that we deserve um but it's so so so
important especially once you begin to
feel those those signs of of burnout and
the stress getting too much yeah
disconnect disconnect go do something
else go do something physical something
that doesn't involve computers because
yeah you're important Martin I really
want to thank you for sharing but also
you know not just the technical stuff
but also like the life stuff because we
humans and we we we need help um you
once again are the author of this book
you work for Cisco tellos but big
question a lot of people will be having
is you know can they connect to you on
LinkedIn or somewhere how can they get
hold of you so uh number one thing read
the Talos blog because this is where
we're we're posting everything that we
think um is important um yeah I'm I'm on
LinkedIn uh genuinely I am open to
people connecting uh the first thing I
would say yeah don't look like a scammer
um you know don't be weird uh but
seriously if there's you know I I'm in
this business to help people uh and if
there's a way that I can help please
please please get in touch um
specifically when it comes to people
early in career and helping them with
careers and career advice um again get
in touch and um you know I can give some
advice or at least some pointers um yeah
so I'm here to help get in touch um
don't be weird don't look like a scammer
I like that I've put modern's links
below go and connect but again don't
look like a a scammer Martin thanks so
much for sharing really appreciate it
cheers