Loading summary
Transcript24 lines
- [00:02]
A
You're listening to the Cyberwire Network, powered by N2K.
- [00:10]
B
Since secure backups can't be altered or encrypted or deleted, a lot of times they are the source of sort of digital fingerprints for threats that have evaded detection. You know, they can act as a record of threats that other security solutions have missed. What we've found is that threat actors understand this. They've sort of conducted a proof of concept for the threat vector. And so it's something that we expect to be a lot more going forward. But just in general, we see it as another source of telemetry that is too often overlooked.
- [00:57]
A
Hello and welcome to another episode of Data Security Decoded. I'm your host, Caleb Tolan, and if this is your first time joining us, welcome to the show. Make sure you hit the that subscribe button so you're notified when we drop new episodes. And if you're a returning subscriber. Thanks for spending some more time with us. Drop a comment below, give us a rating, let us know what you think about the show. It really helps us reach more listeners like you who are trying to improve the resilience of their business, and it helps me know what content you want to hear more about. So today I had a really great conversation with Kyle Feeler, a transformation analyst at RubrikriLabs. His expertise across AI and infosecurity, cybersecurity and geopolitics, cyber resilience and IT leadership. He works really closely with CxOs at G2UK enterprise organizations on matters of zero trust and secure digital transformation. We'll talk about backups being a snapshot into failed attempts at stopping bad actors. A really interesting conversation and a really refreshing take. Let's get into it. Well, Kyle, welcome to the podcast. So excited to have you on. We're here to talk about backups, which is not something that a lot of security teams tend to spend a lot of time with, but it seems like you believe that they should. So what are some things that backups reveal that traditional security telemetry often misses?
- [02:12]
B
Yeah, so since secure backups can't be altered or encrypted or deleted, a lot of times they are the source of sort of digital fingerprints for threats that have evaded detection. You know, they can act as a record of threats that other security solutions have missed. So, example, a threat that is embedded in, you know, a hypervisor, those things are backed up. But traditional EDR solutions often lack visibility into those. So what we've found is that threat actors understand this. They've sort of conducted a proof of concept for the threat vector. And so it's something that we expect to see a lot more going forward. But just in general, we see it as another source of telemetry that, as you rightly point out, is too often overlooked because it is another source. And I think if you're in charge of defending a company from the myriad of threats facing any large organization today, you want all the information that's available to make the best decisions possible, right?
- [03:20]
A
Absolutely. And when you're analyzing these compromised backups, where are most organizations going wrong? Are you noticing any patterns throughout all the different organizations that you're kind of analyzing and working with?
- [03:30]
B
The biggest thing is just companies not recognizing that their backup data is that additional source of telemetry, like I mentioned. So it's often just completely overlooked. I think that in general there is an opportunity for security teams to be scanning backups for indicators of compromise using Yara rules hashes to be searching for threat actors in their backup data, especially ones who have the utmost motivation to not be found. These are traditionally state backed actors who are interested in establishing persistence and evading detection so that they can conduct these long term operations.
- [04:11]
A
Right. And so if backups are showing repeated failure patterns over time, who owns fixings that? Is it the ciso, is the cio, is the board? Is it a combination of all of these folks who kind of owns addressing this issue?
- [04:26]
B
Yeah, so I think it's different. It's different by organization. And you know, in general there is this issue in managing backups about ownership, who owns it, you know, is it IT or security. And I think more and more it will need to become a security function as we notice groups that are financially motivated threat actors who recognize the importance or the opportunity I should in targeting backups specifically. So Evil Corp is a, is a Russian based ransomware group that has figured this out very well. They know that they can delete, you know, recovery routines, delete the backups themselves, and by doing so they've maximized their leverage over whoever their target may be. So it's, I think it's increasingly becoming a security concern as we see more and more financially motivated threat actors who are interested in achieving the payday as soon as possible. They actually want to trip that wire. They want to trigger a response from a security team because that's the quickest way to get the engagement going.
- [05:43]
A
Absolutely. It's interesting to think about how, you know, of course there's plenty of organizations out there that are aware of these different groups, different threat Intelligence groups are tracking all of these different organizations, kind of like you mentioned already too. And we're always looking for the new and shiny thing, but there's obviously some of these hidden vulnerabilities that are really important. And to your point, if backups are seen as this kind of snapshot of all of the failed attempts of your, the rest of your security stack from stopping attackers from getting in, then it is a very valuable asset for organizations to be leveraging.
- [06:17]
B
Right. If you're only looking for the latest and greatest, you may be missing what's been known to work for some time.
- [06:25]
A
Absolutely. And I'd like to talk a little bit about backup's best friend, and that is recovery. You know, oftentimes we're talking about backup and recovery. And another theme that you and your team talk a lot about is MTTR or mean time to response. So how should security leaders think about meantime to response or mttr and what should they be doing to reduce that?
- [06:47]
B
Yeah, so stepping back a little bit, what some interesting data we've found is that in conducting year after year surveys, we've found among our respondents, who are IT and security leaders all over the globe, large organizations, confidence in recovery times tends to be falling. And I think the numbers are something like barely a quarter of it. And security leaders feel that they could respond in 12 hours or less to a security incident, whereas a year ago that number was over 40%. So what are the reasons for that? I suspect one of them is the deliberate targeting of backup data. And then another, I would say, is identity infrastructure is often compromised as a part of these attacks. And this is where too many organizations are still relying on manual processes to recover their identity infrastructure because oftentimes threat actors will escalate privileges in order to get something done. I mentioned the deleting of recovery routines. You know, oftentimes you need elevated privileges to do that. But what happens when. When threat actors start to compromise identity infrastructure is almost no access or authorization processes can be trusted. And so it's so important to restore identity infrastructure to a clean state if you're going to take that power away from the threat actor. Now, in terms of mttr, what we talk a lot about at Rubrik zero Labs is how do we turn that from a coarse metric of okay, you know, my mean time to recover? We were aiming for four hours and it took us six. That doesn't tell you why. So a lot of what we've focused on is how can we use the data that we have to sort of break that process down into discrete phases. So is the problem that it took you a long time to determine the scope of the compromise, is the problem that it took you a long time to validate that you recovered to a clean state, or is it some other phase in there? So we often talk about how understanding the phased recovery process points you to potential areas for improvement where you can cut that overall mttr. And then of course, these are things you'll hear from security leaders all the time that you cannot go into an incident that's not the time to be testing your recovery. So these things have to be drilled continuously as sort of a lifecycle management of recovery capabilities.
- [09:30]
A
I want to go back to something else that you mentioned at the top of that question. And you talked a little bit about how identity based attacks kind of operate and the challenges facing, you know, attacks that operate in that aspect. But you also mentioned that threat actors are targeting backups. And so we talked about how backups can be used as this unique security telemetry tool. But I kind of want to talk about it from the threat actor perspective. I understand why an organization, you know, a nation state group or some hacktivist group is targeting a backup system. But what can organizations do about that? If, you know, they're thinking of their backups as their last line of defense, how can they prepare against those kind of attacks?
- [10:11]
B
Yeah, so it starts with things like isolated clean room recovery environments, air gapping. You have to be able to limit your access to the backup environments themselves. And so that's why, that's why a lot of threat actors today are targeting cloud based backup, cloud native backups specifically, is because there's not that, you know, there's not that barrier there. So I mentioned Evil Corp. There's another group that Microsoft is following closely called Stormo 501 that I think is sort of the proof that this has become a pure leverage play. So this group is known to deliberately target and delete backups to the point where they're no longer deploying traditional malware with their ransomware threats. They're just exfiltrating the data, deleting the backups, and then delivering ransom without what we would consider a traditional piece of ransomware. This group used to deploy, you know, things like Lock Bit or Hive, a black cat. But they've just completely left that off the, you know, the ATTCK chain now because it's not necessary for them. They've already compromised the target to such a degree that, that the leverage is there.
- [11:35]
A
How did you and your team start to identify backups as a valuable intelligence asset.
- [11:40]
B
Yeah, I think at Rubrik zero Labs, it started with us, you know, in part the recognition that we are conducting something like two and a half million snapshot scans per day and realized that this had to be sort of a useful source for threat intelligence. And I think one of the other things we found is that we weren't just finding the latest headline grabbing threats. You know, we were finding ransomware groups that the security community more or less knew about, but they continued to evade detection, either because they weren't being scanned for or they were evading detection in some other way. Web shells are another example of, you know, not necessarily new breaking threats, but threats that can certainly act as an initial access vector. And so finding those and then being able to build in, you know, alerts into the product, which is something we're, we're currently working on, is we recognize the value there and it's something that's unique to what Rubrik does. So we wanted to make sure that we were maximizing that value for our customers.
- [12:50]
A
So going back to how organizations can really leverage their backup data and start, you know, maximizing their value there, what are the three actionable steps that security and IT teams can take today to start getting that full value from their backup data?
- [13:06]
B
Well, I mean, one is starting to scan the environment. You have to be conducting the scans to get any real benefit from them. You want to be monitoring for things like configuration drift. So any suspicious activity in logs that you wouldn't expect to see in places like VPNs or appliances that are not, you know, the quote unquote boxes that are not typically scanned by, you know, an ADR tool or other security solutions. And then finally, I would say the hardening and recoverability of that identity infrastructure is critical, especially if, you know, you're in a position where you're relying on cloud native identity infrastructures like the entre IDs and things like that.
- [13:59]
A
Great things for everyone listening to start considering about their own organization if they're not already. But Kyle, thank you so much. Is there anything else that you want to leave the listeners with that we haven't already covered already?
- [14:09]
B
I think I would just, you know, reiterate that because secure backups are not, you know, can't be altered, encrypted or deleted, they often act as a de facto record of what your other security solutions have missed. So there's really no reason not to be probing them for that valuable threat intelligence.
- [14:29]
A
Right, Absolutely. That's a really interesting and different perspective than we've heard before, so thank you so much for joining us. Until next time, of course.
- [14:36]
B
Thanks for having me.
- [14:46]
A
That's a wrap on today's episode of Data Security Decoded. If you like what you heard today, subscribe wherever you listen and give us a review on either Apple Podcasts or Spotify. Your feedback really helps me understand what you want to hear more about. And if you want to email me about the show, email me directly at data-security-decoded2k.com thank you to Rubrik for sponsoring this podcast. The team at N2K includes senior producer Alice Carruth and Executive producer Jennifer Ibin. Content strategy by Mayan Flout Sound design by Elliot Peltzman Audio mixing by Elliot Peltzman and Trey Hester Video production support by Bridget Kirkey Wilde and Sorrel Joppe. Until next time, stay resilient.
- [15:28]
B
Sam.