The State of Enterprise IT Security

On Thursday, they issued a emergency
directive mandating that all federal

agencies immediately hunt for signs
of a known Russian APT that broke

into Microsoft's corporate network.

And then it, they pivoted to steal
some sensitive correspondence from us.

Government agencies.

And this directive comes, I think it's
a little less than three months after

Microsoft confirmed that attackers
also stole source code from them.

And here's the thing.

They think that this group might still be
poking around in their internal system.

Hey

everybody.

I'm Brad Bussie, chief information
security officer here at e360.

Thank you for joining me for the State
of Enterprise IT Security Edition.

This is the show that makes
IT security approachable and

actionable for technology leaders.

I'm happy to bring you
three topics this week.

The first, as MFA, which is multi
factor authentication, adoption

grows, so do MFA bypasses.

Second, U.

S.

government on high alert as
Russian hackers steal critical

correspondence from Microsoft.

And third, announcements
from Google Next Conference.

So with that, let's get started.

Now, first topic of today as MFA
adoption grows, so do MFA bypasses.

So multi factor authentication
MFA is really now, a mandate for

most organization and accounts.

You need it.

To get things like cyber insurance
policies for an organization.

And it's even part of a
presidential executive order.

And it's interesting because just
as all of this is starting to

get enforced in organizations.

Attackers are now finding
a way to bypass it.

So what I thought I'd do is talk a
little bit about how attackers are

bypassing MFA and some of the things
that you can do, not just as a user,

but as a cyber professional or an
IT person in your organization.

So one of the first styles of attacks
when it comes to MFA Is what's called M.

F.

A.

Fatigue.

And this is where a threat actor
essentially peppers a target user with

alerts just to confirm authentication.

And what they're hoping for is somebody is
just going to get tired of it and approve.

The authentication request.

And this actually does happen
because the user starts to think,

well, maybe the issue is on my side.

Maybe my, my email needs some
kind of authentication or one of

my applications is freaking out.

And if I approve it, it'll stop.

And interestingly, if you
do approve it, it does stop.

But the reason it stops is someone
now has that token or that six digits

or just the push authentication,
which then gives them access.

So what's what's interesting here
is that Apple has seen the style of

attacks, but it took it one step further.

Not only was the user getting peppered
with all of these requests, The user then

got a phone call from someone that was
pretending to be Apple support and said,

Hey, there's a problem with your account.

We need you to read us the six
digit code that just popped up.

Yes.

We understand there was like thousands
of them all of a sudden, but that

last one, why don't you go ahead and
read it to us and then we can fix it.

So not only are we talking about
MFA to fatigue, but we're also

talking about social engineering.

To a certain extent, and Microsoft
has gone on record saying that

they see somewhere in the realm
of 6, 000 MFA fatigue requests

every day in their organization.

So people are targeting Microsoft and
just think of that 6, 000 of these

a day for just one organization.

A second way that MFA is, is
having some challenges is with

what's called SIM swapping.

So inside of a phone or device,
you have a SIM card and there are

ways of cloning a SIM card without
it even leaving your device.

So if you're interested in
that, there's a whole bunch of

information on how to do that.

Please don't.

, and if you're, if you're trying
to do it for nefarious purposes.

Really don't because it's, it's a bit of a
challenge for cyber professionals because.

A lot of users, they don't
want to use an MFA app.

They don't want to use a token app.

They don't want to use
something like that.

So what's the next best thing?

Well, you get a text message.

Now, if I've cloned your SIM
card, guess what's going to happen

when a text message goes out?

I'm going to get that as the attacker.

So then I've got the code and
then I can go on and continue to.

attack you, take over your email,
move laterally, all that bad stuff.

Third way that MFA is having
some challenges is around what's

called session cookie theft.

And that is where a threat actor will
Swipe, what's, I mean, I like to call

it the browser's hall pass, and that
is the session cookie and it's just

a stored string of characters that
allows for, think of it as like re

entry into an application or system
without re entering a password.

So essentially all the good stuff
like, Hey, I knew who this person is.

They are who they say they are.

They're coming from a device
that says that it is what it is.

We verified that we don't
need to necessarily check

that again for 30 minutes.

So then it creates one of
these, session cookies.

It's just kind of how applications
work in a zero trust environment.

It actually would check each
authentication and authorization request.

So this kind of theft
doesn't really happen.

Most organizations still are,
are implementing zero trust.

It's not fully there.

So.

This one is a bad one.

This actually impacted Okta
back in October of 2023.

And that's how some of their
customers got compromised.

Now, probably the more useful thing,
when it comes to this is what,

what can you actually do about it?

So when it comes to cookie theft,
one of the best things you can do is

just shorten the amount of time that
a cookie is valid before it expires.

Some applications, it's like 90 minutes,
some are days, others are minutes.

And those are the types of applications
that I like, is just kind of

limit how long that cookie's alive.

The, I would say the, the gold
standard, and this is something that

comes from CISA, and you hear me
talk about CISA pretty often, and

that really is focusing on protecting
multi factor overall, and that's

creating a phishing, resistant MFA.

And this is using like a smart
card, a, what we call a Fido

security key, where only the key
owner has access to their device.

So think of it as something you have,
something you know, and then take it one

step further with something you are, your
face, your fingerprint, things like that.

And really even a one time code.

Sent to a phone is, is not bad.

It's not the worst way to authenticate.

And I would say any MFA is
better than no MFA at all.

But I would say, because of some
of the things that we talked about,

just making sure that we have another
factor of authentication for the

important things, that's, that's
where I would be angling for second

thing that I wanted to talk about
today is the U S cybersecurity agency.

CISA, again, on Thursday, they issued
a emergency directive mandating that

all federal agencies immediately
hunt for signs of a known Russian APT

that broke into Microsoft's corporate
network, and then they pivoted to steal

some sensitive correspondence from U.

S.

Agencies.

Government agencies and this
directive comes, I think it's a

little less than three months after
Microsoft confirmed that attackers

also stole source code from them.

And here's the thing, they think
that this group might still be poking

around in their internal systems.

And you've heard me say this on a previous
podcast, I don't like to say the name of

the attacker group because I feel that
it gives them notoriety and some power.

So I'm not going to do it.

So if you want to know who they are,
you can, you can look up the, the

actual breach from three months ago.

And read more about this hacker.

So according to the directive from CISA,
federal agencies, they need to analyze

the content of exfiltrated emails and
reset any compromised credentials.

and take additional steps to ensure
that authentication tools for privileged

Microsoft Azure accounts are secure.

So what they're, what they're saying
here is anytime that you think you've

been part of a breach, or you've been
notified that you are part of a breach,

one of the first things you should do
is go and reset compromise credentials.

I say, take it a step
further, reset everything.

So if you get one of those letters
in the mail that says, Oh, sorry.

You know, someone, someone went
through our systems and they now

have your username, password,
blah, blah, all that kind of stuff.

Here's your free credit monitor.

Thank you.

Great.

Take your credit monitoring,
but then go and cycle all of

your usernames and passwords.

Especially.

I know some of you are going
to kind of go, Oh, that's me.

If you are using variations of the
same password on all of your different

websites, accounts, anything like that.

And for those of you that use the same.

Password for everything.

I don't even know what the
word I'm going to use is.

How about don't and, try a password
manager because if, if you don't have

the time to remember and change and do
variations, it does all that for you.

And you can find free ones.

It's definitely better
than what you're doing now.

So when it comes to the compromise of
the Microsoft system, A lot of it was

the corporate email accounts, and there
was that X fill of correspondence between

government agencies and Microsoft, and
that's where the real concern happens is

that since this is a Russian attacker,
they are looking at this from the

government standpoint, the different
agencies that are communicating with

Microsoft, and it's and it's kind of
working its way out as a blast radius.

So that's what we're really.

Concerned about that's what sysa is
concerned about, and that is what

Microsoft is concerned about now.

Microsoft has represented to sysa that
for the subset of affected agencies

whose emails perhaps contained.

Things like authentication secrets,
that would be like credentials or

passwords, why that was in there.

I don't know, but it, it happened.

They, Microsoft said that they'll
provide metadata for those agencies.

And what that means is they
can take that metadata and see.

what the impact looks
like in their systems.

So a lot of this is for the agencies
that are impacted, but I think this is

just an interesting story because it
goes to show even large organizations

continue to struggle with this.

And the larger the org, it seems like
the more that they're being attacked,

especially by well funded nation States.

So Microsoft, after providing this
metadata, they are basically saying

that because this was a professional
hacking team that used not, not like

an old style of attack, but it's a
common style, which is a password

spray to compromise compromise.

A legacy non production test tenant,
and that's how they gain their foothold.

So just keep this in mind when, when
you're thinking about, well, how did

these attacks continue to happen?

We've got, you know, multi
factor authentication,

which we just talked about.

We've got all of these hardened systems.

We have all of these things.

A lot of the time, the
challenge comes from tech debt.

It's these old systems that someone
still needs for some reason.

You can't turn them off.

You can't change the password.

You can't even look at the system
wrong or it crashes and next thing

you know, you've got a bunch of
people that are unable to work.

So when it comes to those types of
systems, we need to wrap some additional

layers and controls around them, because
if they're still being used, even in

development, this is a great example.

Of you can still establish a foothold
in some systems because developers,

system admins, engineers, sometimes
we create these backdoors into systems

just for us, it's just meant for us.

But next thing you know, somebody
else is using that type of a, um,

backdoor to get into other systems.

So if you're creating something just
for you to use in your application,

your systems, your network.

I'm going to bet money that somebody
else is going to find and use that.

So I would recommend a don't create it B
if you are creating it during development,

document it and make 100 percent
sure that it is no longer accessible.

Third topic for today is the Google
Next conference, which I recently

attended, and I got to learn a
third of a lot about some of the new

solutions, products and features.

So one of the interesting things was
Gemini for cloud and cyber security.

So many of you probably remember
the experiment by Google,

which was known as BARD.

Well, BARD.

Was powered by a large language
model, Gen AI, and the name that

it's going by now is Gemini.

So Bard is gone.

You can still type bard.

google.

com.

It'll take you to Gemini.

Same good stuff.

I'm not going to say same.

Better stuff.

A lot better.

More to the large language model now.

So I attended the conference.

It was full of innovative solutions.

I mean, I walked the show floor
and I, this is kind of funny.

I had an AI scan my face and then tell
me what job I'm most likely to have.

And apparently it thinks I should
have been a firefighter, an astronaut.

Or a journalist.

I think that was a bit of a
range, but, but I'll allow it.

I think it's, it missed
the mark a little bit.

I mean, it, it did skip cybersecurity
professional, but Hey, I think, you

know, they're still training the model.

So it's not perfect yet, but Google
introduced a bunch of new features that

provide AI assistance to help customers.

Work code, identify and
resolve security threats.

And what I found also interesting is
they've expanded access to some of the

general AI models, and they introduced
something called an AI hypercomputer.

and AI powered workspace features as
part of their enterprise offering.

So starting from this conference,
they, they, Google is upgrading some

of the features like we'll call it
Gemini code assist, and that can

generate and test code for developers,
which is, which is pretty exciting.

And then they're Also providing
some more AI driven tools

to help security operations.

So this really is helping an
organization spot threats and

summarize the intelligence that's been
discovered and, or fed into the system.

And then I like take action.

Against the threat and or attack.

So Gemini has a threat Intel component.

Now it's in preview, but it's
still functional, which, which,

which I definitely like it uses
natural language to deliver.

Think of it as like a deeper insight
about how threat actors actually behave.

And I think what's useful about this is
that it does use that natural language.

There's a pretty large
context window that enables.

Anybody to analyze bigger and bigger
samples of potentially malicious content.

And that can be code that can be
a bunch of different things, and

it just gives you better results.

I, one of the things that I, that I
liked that I saw as some, some good value

AI security add on, and that's really
looking at data, privacy and security.

Because those continue to be top of
mind for me, top of mind for you.

And with Gen AI really taking
center stage, what's interesting is

data breaches, they increased 20%.

Last year, and I think the bigger that
GenAI gets, we're going to start seeing

more and more breaches because as you've
heard me talk about previously, if you

haven't done data governance correctly,
the biggest insider threat you can

introduce into your organization is.

Generative AI.

It is this large language model because
the model is just going to do what it's

been primed to do what it's learned to do.

And in some cases, you're
going to ask it a question.

What's its job?

It's going to go get you
the answer to that question.

It doesn't know if it's necessarily
supposed to have access to that

information if it does have access to it.

It's going to pull it back and
it's going to give it to you.

And if you have users that are giving
PII or information to these gen AIs and.

It's, it's not supposed to go out.

Well, it doesn't know that
it's not supposed to go out.

So we're needing to wrap more and
more security controls around this.

And this is what Google has identified.

So they're starting to add more
components to their security suite

to help with all of the things.

That, that I just talked about and
they are starting to weave Gemini

into, Gmail into workspace and they're
bringing the whole zero trust principles

into augmenting Gemini and helping
to deliver AI powered threat defense.

And I look at this as, you know, our
job in security, it's, it's never done.

And with the way that the market is
innovating, really, I love organizations

that are focused on helping to keep us
third topic helping to keep our data safe.

And I think when you look at some of
the neat things that Google's doing,

things like, you know, extending DLP
controls, allowing classification

labels into Gmail, they're, you know,
they're not the only ones doing this,

but I just was drinking a whole lot of,
of Google Kool Aid over the past week.

And I walked away from the experience.

Really, really happy with a lot of the
security things that I'm starting to see,

get woven into that, that whole suite.

So thank you for joining me and I
look forward to next time on the state

of enterprise, it security edition.