← Cybersecurity Headlines
Cybersecurity Headlines
Week in Review: Senators' CSRB bid, Deepfakes dodge detection, Microsoft-CrowdStrike collaboration
00:27:43
Loading summary
Transcript25 lines
- [00:00]
Rich
From the CISO series, it's cybersecurity headlines. Replay attacks, bypass deepfake detection. Senators ask for reinstatement of Cyber Review Board and Microsoft and CrowdStrike partner to link hacking group names. These are some of the stories that my colleagues and I have selected from this past week's cybersecurity headlines. And now we're looking forward to some insight, some opinion and most certainly some expertise from our returning guest, Rusty Waldron, chief business security officer over at AD. It's been about 18 months since you've been on Rusty, so I have to ask, how was your week in cybersecurity?
- [00:39]
Rusty Waldron
Hey Rich, thanks for having me. It's always fun being here with you guys. Very much enjoy being invited back. The week's been fantastic. I mean honestly, it's been a lot of fun. There's a lot of activity that's been going on both I guess positive and negative. Although as a security guy, I like that glass half full kind of aspect of things. Right. Like I have to keep a positive out outlook on life. But yeah, there's been a lot of creativity. I think a lot of things are going positive in the world and I'm great to see that. So it's glad to be here and happy to have a little fun with you today.
- [01:16]
Rich
Absolutely. Got a ton of interesting stories and Rusty, you highlighted some great ones in our prep today, so I cannot wait to get to that. Before we do though, a little bit of housekeeping. First up, have to thank our sponsor for today, Conveyor, the number one AI for Trust center and Security Questionnaire Automation. And then I have to invite all of our audience. If you have, if you haven't already, make sure one week to come and join us on YouTube live. Just go to cisoseries.com hit that events dropdown and look for the cybersecurity headlines. Week in review image. That'll get you there. You can subscribe to our YouTube channel. Have some fun. We're already seeing some fun conversation going up. TJ Williams is having an awesome day. Rusty, just like you, keeping the positivity going. We got CCL on there, we got Max Tronic, we got Kevin Farrell and of course the big boss man David Spark in there. You can join them, be amongst this elite crew. Been having some new people in there and having some fun. So make sure you join us each and every Friday. If you can't join us live though, send us an email feedbacksoseries.com Let us know how we're doing on the show. Thoughts on one of the News stories that we covered. Did we get something wrong? We want to know if we got something right. Also, I will accept a virtual pat on the back. We're about to jump into the news. Before we do so, just a quick reminder that Rusty's opinions are his own, necessarily, though of his very glorious employer, friends, staff, affiliates, really, anyone else in his life. This is pure Rusty tried and true. We got about 20 minutes, so let's get started. First up here. This is one of those ones just fascinating me since I read it. Replay attacks bypass deep fake detection. This comes from a new paper from Resemble AI and a team of European academic researchers. And it chose a new method for getting around existing audio deep fake detectors. And it's dubbed a replay attack. This involves generating synthetic speech, then playing it over speakers like real speakers in the real world, and then rerecording it with actual background noise. Just getting the room toner things that's going on. The research believe this process of rerecording removes key artifacts that detection models rely on. So, Rusty, this is also our producer Steve's favorite story of the week. Not focusing on the deepfake workaround specifically, but the endless creativity that threat actors have when it comes to trying to tear our defenses down. And thankfully, we have some creative researchers too. Would you ever consider using such a story, I guess, as a teachable moment for your team?
- [03:34]
Rusty Waldron
Yeah, you know, it's great to see this type of creativity coming out of the world. I mean, AI has had so much hype over the last several years and, you know, the capability and the process power just continues to explode. And I think that, I mean, just not, not just within the space of kind of getting around detection capabilities, but the actual creativity of the individuals to really take the tools that they have and be able to leverage them in a way both for good and bad. Unfortunately, most of the time these tools are used for bad to begin with, but I think ultimately it allows things to catch up, the world to catch up to them. And I think that's really where we're going to start to see a tremendous amount of activity in this space. I. I think what's. What's interesting, you know, as we were talking a little bit earlier, is I was watching last week a recording of two AIs communicating with each other and, and how they ultimately were were able to kind of shift to their own language that was more efficient. And I thought that was a really kind of brilliant transition into what the future is going to look like for all of us in this space. But you know, as a security professional, one of the things I just kind of wonder in the back of my head is how do we make sure that we're doing this in a good way, that we can ultimately use the capabilities to, you know, in some cases kind of detect fraud and things like that. But ultimately, what are those governing controls? Because trust, right, becomes so important when you start talking about defects. You're starting to. To play on people's trust in whatever activity. So I think that I love it. I am a huge AI geek in this space and very much looking forward to this work as it continues to transition and kind of influence our lives.
- [05:38]
Rich
All right, next up here, Fire Panel security flaws could put OT systems in hot water. CISA's issued an advisory about two flaws impacting the CS5000 fire panel manufactured by Consilium Safety. One flaw allows for a device takeover using the old default account that was pre installed. Of course, owners can change the account over ssh. It's not hard coded in there, but CISA found that it remained unchanged on every installed system observed. They checked the tape. It turns out no one did it. The other flaw comes from a hard coded password that does run on a VNC server, which not great either. Consilium said it was aware of the flaws, but chose not to mitigate them. Instead, it recommended that customers upgrade to its newer line of products. So, Rusty, which is worse in this scenario? I guess we're doing a what's worse scenario here. From CISO series podcast here. The fact that no one ever changes the default passwords on their IoT device admin accounts, or the fact that Consilium Safety is recommending people buy more of their newer stuff?
- [06:40]
Rusty Waldron
This one, the very first thing that came to mind for me in this one was like, how long has IOT been around? Like we've been talking about that. That's so last decade, right? I mean, it's been around and you know, you go back to some of some of the very early compromises in different types of devices. A lot of them were related to some sort of iot. And what's crazy is today everything that we use has some sort of IOT in it. It keeps getting smaller and faster and we have to get smarter as technology professionals, not even security professionals, but technology professionals and just like really understanding the network things that are on our network, the controls, a good security word there. Which by the way, the first one is access control, right? Like who like those simple basic things. And I really feel like this is one of the reasons I love this I feel like this is one of those going back to basics that, that we're all going to really get back to probably over the next six to 18 months that there's going to be a lot of this activity where, where we're going to go back in and we're going to be looking at the hygiene of those most basic components, whether or not it's operating systems or, or the generic passwords to get in. But it's not just going to be limited to like the traditional hardware. Like it's going to be headphones, microphones, anything that's ultimately connected. I think we're going to have to go back in and look at that. This, this one's one. I just, I kind of want to smack myself on the head. Go. Really? We're still talking about IoT, but it's a thing, right? It's not going anywhere.
- [08:30]
Rich
Yep. Kevin Farrell, of course, contributing the chat Always change the default credentials from admin password to password admin 60% of the time. It works every time. Hey, I mean, I don't want to spill the tea here, but sometimes I take root and I spell it backwards. Boom. It's flawless. Flawless. No one will ever catch me. And of course, David Cross in the chat. AI plus OT equals Skynet. Our first two stories coming together for the doom of us all. Don't worry, we're going into the always pleasant world of government policy. Next story here. Senators asked for reinstatement of Cyber Review Board to work on Salt Typhoon Investigation Four Senate Democrats have sent a letter to Homeland Security Secretary Kristi Noem asking her to re establish the Cybersafety review board, or CSRB, whose 20 board members were dismissed days after the President's inauguration back in January. The Senator's letter describes the dismissal as depriving the public of a fuller accounting of the origin, scope, scale and severity of the salt typhoon compromises. They add that the dismissals are particularly confounding in light of the administration's repeated insistence on the need to leverage private sector and external expertise in government. Now, Rusty, we obviously work hard here to avoid getting political on this show, but we can look at this clearly from the viewpoint of assessing the value of the CSRB itself and contextualizing that within the larger kind of salt. Understanding what Salt Typhoon is up to, what they are doing, just the extent of it, kind of going back to what they were saying in the letter. I'm curious, from your perspective, is the CSRB a useful organization? What does it mean to you in terms of responding to these Types of attacks.
- [10:09]
Rusty Waldron
Yeah. So the csrb, cisa, like, there's a number of the agencies that have really been under pressure. Pressure lately. And I get it. Like, that's kind of normal in kind of the political realm. Where I fall on this one is I truly believe that many of these boards and these government organizations, they play a critical role in the overall cybersecurity world. One, cybersecurity is such a big, complex problem. And by the way, it's not just an American problem. Right. It's a global problem. And it really does take the capability, the funding and even the prioritization of a government agency like the CSRV to help us understand what kind of that strategy of what's coming, where we move. There's some real value in both the investment of both money and time. But what I do agree with is that it really is moving into more of that realm of that public private partnership that's actually been around for more than 20 years. The National Cybersecurity alliance, which I'm on the board of directors for, is one of those. And, and like, there's a lot of good work, a lot of good education that comes out of there, but it is that partnership to understanding that investment for those, those bigger events and that leadership so that they can actually work its way down to, you know, the, the, the normal people of the world like you and me.
- [11:47]
Rich
Yeah. Any, any chance we can have, especially once for something like cybersecurity where it touches everything. But it is, I guess it can be incredibly niche of having. Yeah. That industry inputs and in this particular case of just trying to. For people that are making policy, understand how this very damning thing happened that impacts literally anyone that's used a phone, you know, like, like that level of stuff of like, hey, can we just do the homework on this one issue? Not saying to, to, you know, to restart the entire CSRB necessarily, I think is, and again, when you know that this is, this is not an abstract thing. Right. This is not. We need to investigate nebulous threat actor. It's like, no, this is a very specific thing. I, you know, I don't know if it will happen. I hope we have as much visibility as we can ever get into in terms of the scope of this particular attack. For sure.
- [12:43]
Rusty Waldron
Absolutely.
- [12:45]
Rich
All right, next up, before we get to our next story of the day, have to spend a few moments with our sponsor for today. Conveyor. Ever wish you had a teammate that could handle the most annoying parts of customer security reviews? You know, chasing down SMEs for answers, updating systems, coordinating across teams, all the grunt work nobody wants to do, plus having to finish the dang questionnaire itself. Well, that teammate exists. Conveyor just launched sue, the first AI agent for customer trust. Sue really is the dream teammate. She never misses a deadline, answers every customer request from sales, completes every questionnaire, and knocks out all the coordination in between. Sue handles it all so you don't have to learn more@conveyor.com that's C O N B E Y O R.com.
- [13:36]
Rusty Waldron
All.
- [13:37]
Rich
Right, sticking into the world of government policy here. Next story. Sean Cairncross has policy coordination in mind. At a Senate confirmation hearing, Sean Cairncross outlined his vision for leading the Office of the National Cyber Director, emphasizing the need for interagency coordination and alignment with administration policy. While acknowledging his lack of technical cyber expertise, Karen Cross highlighted his leadership expertise in managing large organizations and responding to cyber attacks. During his tenure at the rnc, he avoided directly addressing concerns about potential cuts to cisa, but stressed a proactive stance against foreign threats. So again, Rusty, not getting political here. The current administration has demonstrated repeatedly that they favor outside people over career technocrats. I think that's fair to say, based on history. And now at this point, what are your feelings about having someone who admits to having extraordinarily limited technical cyber expertise in this position? Is it helpful to have a fresh perspective? Is it helpful to have to be able to communicate, particularly within this administration, with people at the top?
- [14:43]
Rusty Waldron
Yeah, you know, this is always an interesting topic. That happens a lot in the private sector, right. When you start thinking about leadership and what can that leader bring? Do they have experience or not have experience, or what does that experience look like in whatever industry? And in this case, it happens to be cybersecurity. I think what's interesting about this is because it kind of ebbs and flows. I think there are times when it makes more sense to have tenured people with deep experience helping to lead these initiatives. And then there are other swings of that pendulum where you need to bring in someone who's got some fresh ideas. You know, it's hard, right, because this, you live through this. And, you know, the, the private world we live, we live through this. And I'm sure governments do, too. It's hard to tell whether or not it's going to be a good thing or a bad thing. I really think it's going to depend on the leadership style and the direction of the strategy that they said and how they leverage what, what, what they're doing. And by the way how long that tenure? Because to be perfectly honest, someone in a leadership role like this, they may last a week, a month, a year. Like, who knows? Government can sometimes be tough, especially for people from the private sector. I'm hopeful though, like I do believe that good experience and good leadership can really help whether or not it's in the public or the private sector.
- [16:09]
Rich
Well, in particular, you know, we always talk about this is not a CISO role, but when we're talking about security leadership, like at that very top level, really your job is in a lot of ways is translation right. You're not going in there and giving a technical briefing to your CEO. For the most part, that will fall on deaf ears. You have to translate this into business logic. I don't want to undersell for someone in this position, which can be extraordinarily technical, to be able to communicate this. Having an effective means of communication is a non trivial skill. We see this all the time of I'm in the cybersecurity subreddit all the time for research for our different shows and stuff like that. And there is a lot of frustration when you have technical people that see like, oh, this person doesn't know how to do X, Y and Z. But I'm an expert in this. At a certain level in leadership, it's not, it's more important that you be able to one, communicate it to leadership and then two, actually delegate it because you're dealing with such a large organization. So I'm hopeful now to your point in terms of tenure, how effective that communication is. And in any given administration those things ebb and flow. So you know, I know that there is some internal politics within that that is kind of outside of our purview. But nothing I saw in the confirmation stuff was necessarily, I guess, a head scratcher necessarily, given what we know of how this administration likes to operate.
- [17:32]
Rusty Waldron
Yeah.
- [17:32]
Rich
All right, next up here, Microsoft and CrowdStrike partner to link hacking group names. This is probably this story. My eyes went wide when I first saw this one. So the two companies have announced a partnership to connect the aliases used for specific threat groups without actually using a single naming standard. They say this will be done by mapping or linking the different names their security analysts use for each group they track for any kind of publications, particularly Microsoft is putting out Here they add that this is the initial step toward making tracking overlapping threat actors. Excuse me, making tracking overlapping threat actor activity easier and avoiding unnecessary confusion and complexity. And notably Google Mandiant and Palo Alto Networks unit 42 say they're also on board with this. So we got a lot of big names kind of all agreeing to put, you know, the formerly known as or dba. You know, I'm thinking of like your, your mortgage here, right? You have all the names of banks, you have all these names of threat actors. I'm curious though, how is this more efficient than simply agreeing on a single name for a threat group? Or does that get into more, I guess, organizational pride aspects of this?
- [18:39]
Rusty Waldron
Yeah, so one, I'm very excited about this. The it I've, I've been able to be a part of a number of organizations with knowledge sharing, right. And really around any types of cyber attacks, the, the IOCs and TTPs that, that we're all familiar with. I, I, I think what becomes hard and, and it's, this is kind of a curious announcement is that, you know, it would be great if we could all name everybody the same thing. But I think that we see it from a different perspective. We see the attack and the threat, the types of tools and techniques that they're using and we're using those indicators to ultimately try to identify some threat actor or group that's been, that's been running, whether or not it's a nation state or, or, or some other group that's popped up. And I think I, and listen, I am not a bad guy. I don't play one on tv, although I like to wear a hoodie and sunglasses. But oh, I, I wonder, I wonder how many of these, these actors and these groups out there are constantly collaborating, working together, breaking up. Like they don't seem to be at odds with each other. But I, I wonder, I wonder if, if as and like do they recruit, right? Like, are they hiring from each other? Try like it's really interesting to see how that goes. So I think this is actually a good step forward. But I ultimately, I would love to see more of private sector because a lot of that attribution really sits in the public sector and we don't always have access to that except in special circumstances. My two cents.
- [20:21]
Rich
Max Tronic has a great idea here. We should actually let the pharmaceutical companies do the naming and they can come up with catchy jingles for, you know, we can do like Cozy Bear. You know, we can have that, that song going on here. Great thought there, Max. My other thought would be we can just like, we can just like at some point we're going to just reverse, right? Because Microsoft's going to come out with their big book and say, oh, this is UNC4022 with aka this group, aka this group from Palo Alto or Mandian. All they need to do is just change the heading. It's just like, oh, but we're going to call this collection of linked names by something and then we can all refer to that collection of linked names by the meta name. And then slowly we're just going to, just going to reverse engineer. But I agree with you. Yes, this is something I get up on my hobby horse about is that. But a lot of times we're dealing with like intervals of confidence with attributing attacks or attributing attacks to nation state actors or something like that. And because these groups can be so fluid, I actually do think it is a net positive to not be so declarative of being like this group is AKA this group is AKA this group because we don't have that visibility. Right. And I think locking ourselves into that actually kind of narrows our vision in a way that is not helpful for a lot of these groups. So completely in agreement with you on that, Rusty. Our last story for today, the UK brings cyber warfare out of the closet. The UK published its 2025 Strategic Defense Review on June 2, openly committing for the first time to cyber warfare as part of integrated military operations. The review proposes a centralized cyber EM command to coordinate cyber AI and electromagnetic capabilities. It's terrifying across land, sea, air and digital domains, citing 90,000 gray zone cyber attacks on UK military networks over the past two years. It also introduces the Targeting Web, a new AI driven system for rapid cross domain decision making and attacks inspired by lessons from the war in Ukraine, which I think has really reset all of our expectations in terms of how cyber and hot warfare can kind of are now just part of straight continuum. Right. There's no distinction between those in so many different ways we're seeing in that conflict. So Rusty, the story seems to have some, I guess some good feels here. Is there anything that causes you concern or is this just a timely development? We'll see more countries following suit.
- [22:42]
Rusty Waldron
Yeah, I think this is just the natural evolution of where we are today in maybe a non traditional warfare type of theater. I mean it's been kind of escalating since before the pandemic. Right. I mean it, we continue to see more of it. I know there were some, some drone attacks recently, I don't remember which one that one was, but the, I, I think the world is shifting in that space and more, more countries are, are starting to understand and I think this one is one. I would say they've probably Been doing this for a while. They're just now acknowledging it. And, and I think that's really what you're, what you're seeing here is, is that it's going to be a globally with, with different countries. The, the really interesting thing about this is you don't have to be a big nation state in order to do this. I mean you can, you can have cyber capabilities, especially with the tools that are available and AI becomes more available and, and the delivery pack capabilities become much easier like this, this is something that, that we're here, you know, going back to. It is Skynet. Right. Like we're, we're all getting back into that space. So I think this is just a natural evolution of, of where things are. I don't know if it's good or bad.
- [24:01]
Rich
All right, before we get out of here, just a quick thank you to everybody getting involved in our chat here. We had George Strasberger coming in kind of feeding off of the, the Microsoft and CrowdStrike naming Concordat. I don't know what we want to call that detente that they've come to saying we need a list of names for threat actors similar to the NHC name for hurricanes. I do like that. We've been. There was a talk of a severity, not a severity scale. Was it a severity scale or a complexity scale for cyber attacks using that convention? I think we covered that on the show as well. So George, fantastic point. This just also to everybody in the chat though. Kevin Farrell, T.J. williams, CCL just mentioned. George, just a lot of, a lot of fun, a lot of good conversations having there. Everybody liked the, the naming story. I was not alone in enjoying that. Rusty, before we get out of here, was there any story this week that was a thumbs up you heartily endorse or an eye roller you just can't believe it it either in our rundown or in just in the news of the week this week.
- [24:59]
Rusty Waldron
Yeah, I'm gonna say the deep fake it one is just I, again I'm, I'm a nerd with that kind of stuff. I love it. I, I and, and I eat it up and, and it's just one of those things that it, it we are, we're in that precipice, right? We're gonna look back in time and we're gonna see that this moment that we're living through this, these three or four years is gonna be about like the, the dot com era of the late 2000s. Like we're really living through that. And I'm excited about it and so I'm going all in on that one. I love it and looking forward to the great things coming in the future.
- [25:33]
Rich
I'm just going to go ahead and put up my research paper that if you take a deep fake video and shoot it on a mini DV cam and then upload that footage, it also defeats deepfake detectors. I'm just going to go ahead and say that I'm just calling it right now. MiniDV is the hacking tool of the future. Rusty Waldron, Chief Business Security Officer over at adp, thank you so much for being on the show. Where can people find you on the cyberspace if they are so inclined to give you a follow?
- [25:59]
Rusty Waldron
Yeah, you can find me on LinkedIn. I don't do a lot other than that, but LinkedIn. Feel free to find me out there and reach out anytime. Love talking about this stuff and you might see me at the National Cybersecurity alliance event. So looking forward to that.
- [26:13]
Rich
Fantastic. And thanks also to our sponsor for today, Conveyor, the number one AI for Trust center and Security Questionnaire Automation. And also thanks to our audience today. Once again. You know we can't always get everything up on the screen, but it just makes the show better. I smile every time I look at the chat. I have to hold it back. So sometimes Rusty says something, he's talking about something very serious. I see something funny in the chat. I have to control myself. But you guys make it fun each and every week. So thank you all so much. And remember, if you can't join us live, you're listening to this in your podcast. You're like, oh, I missed it. I'm so bummed out. Don't worry. Feedbackisoseries.com Shoot us an email. We will read them on the show if they're good. I mean if they just say thank you, we like the show. I might not read that, but I do appreciate it. We read each and every one. Thank you so much in advance. Remember to join us next week for another episode of the Week interview that starts at 3:30pm Eastern. For more information on that, just head over to the events page@cisoseries.com in the meantime, you get your daily News fix every single day through cybersecurity headlines. Give us about six minutes. We'll get you all caught up. For myself, for our glorious producer Steve Prentice, for Rusty, for all of us here in the CISO series Extended Family, here's wishing you and yours to have a super sparkly day. Cybersecurity headlines are available every weekday. Head to cisoseries.com for the full stories. Behind the headlines.