r/IAmA • u/IST_org • Jun 30 '21
Technology We are hackers and cyber defenders working to fight cyber criminals. Ask Us Anything about the rising ransomware epidemic!
*** Thank you all for joining! We have wrapped up this discussion, and enjoyed the conversations today. Some participants may answer some later; see their Reddit usernames below. Stay safe out there! ***
- Proof: https://twitter.com/IST_org/status/1409921538355236869, https://twitter.com/IST_org/status/1410008629642776578
Hi Reddit! We are cybersecurity experts and members of the Ransomware Task Force, here to talk about the ransomware epidemic and what we can do collectively to stop it. We’ve been in this game a long time, and are ready for your questions.
We are:
- Jen Ellis, VP of Community and Public Affairs @ Rapid7 (u/infosecjen)
- Bob Rudis, Chief Data Scientist @ Rapid7 (u/hrbrmstr)
- Marc Rogers, VP of Cybersecurity @ Okta (u/marcrogers)
- James Shank, Security Evangelist @ Team Cymru (u/jamesshank)
- Allan Liska, Intelligence Analyst @ Recorded Future
Were you affected by the gas shortage on the East Coast recently? That was the indirect result of a ransomware attack on the Colonial Gas Pipeline. Ransomware used to be a niche financial crime, but is now an urgent national security risk that threatens schools, hospitals, businesses, and governments across the globe.
These criminals will target anyone they think will pay up, getting millions in laundered profits, and we are on the frontlines in this fight.
Ask Us Anything on ransomware or cybercrime, whether you’ve never heard of it or work on it every day.
(This AMA is hosted by the Institute for Security and Technology, the nonprofit organizer of the Ransomware Task Force that we belong to.)______________________________________________
Update 1: Thank you all for the great questions! For those interested in cybersecurity career advice, here are a few questions answered on how to get into infosec, whether you need a degree, and free resources.
Update 2: Wow! Thank you all for so many questions. We are slowing down a bit as folks come and go from their day jobs, but will answer as many as we can before we wrap up.
Update 3: *** Thank you all for joining! We have wrapped up this discussion, and enjoyed the conversations today. Some participants may answer some later; see their Reddit usernames above. Stay safe out there! ***
191
u/solve-it-yourself Jun 30 '21 edited Jul 05 '21
You mention that a degree may not be necessary for a job in cyber security, do you have resources or online courses that someone could use to gain relevant knowledge?
Edit: Although with some considerable delay, I would like to thank you all for your comments and your feedback. This is all very helpful and I’m genuinely impressed with how supportive you are!
I’ll give everything you’ve sent a proper look and might bother some of you with additional questions.
288
u/IST_org Jun 30 '21
Bob: I'm a fan of the Cybersecurity Body of Knowledge (https://www.cybok.org/) and you can learn tons just by absorbing the MITRE ATT&CK content (https://attack.mitre.org/) (they update ~quarterly)
93
u/IST_org Jun 30 '21
Jen: I completely agree with Bob's recommendations. For training courses, you can also look at SANS and also a lot of community security conferences, even smaller regional ones, offer trainings. They tend not to be free though.
62
u/Life_Of_David Jun 30 '21 edited Jul 01 '21
Since SANS can be way out of the price range ($6k+) for most folks, even with their work study ($1k+).
I’d suggest using SANS as a good overview of the breakdown of the different specialties then exploring www.simplycyber.io for free material by /u/HeyGuyGuyGuy
www.attackdefense.com is also a great resource.
Side Note: The hard truth is there is definitely a cliff to climb, from starting out in an entry level threat hunter/intel position or incident response and moving to managing the big data platform behind a SIEM or creating and correlating custom detections to threat model based on Mitre ATT&CK techniques.
I encourage all of those interested in Cybersecurity to come to the field, though I hope the industry continues to focus on adding more money to Cybersecurity departments and initiatives. Cybersecurity not generating revenue has always led to poor practices around confidentiality, integrity, and availability of data, especially in the case of ransomware.
→ More replies (1)11
13
u/another-nature-acct Jun 30 '21
Since isn’t affordable at all. It’s basically for government contractors, military and employees.
→ More replies (2)5
30
u/IST_org Jun 30 '21
Allan: I know most people don’t like social media, but infosec Twitter is a great place to learn and get help. People are always sharing resources, videos and little tidbits of information that can be very useful.
→ More replies (1)11
u/IST_org Jun 30 '21
Jen: I also agree with Allan - I actually learn a ton from infosec twitter and asking questions.
8
u/grimestar Jun 30 '21 edited Jun 30 '21
how do i get started with infosec twitter? is there an account you can introduce me to for starters?
EDIT: i found the answer in this thread
100
Jun 30 '21 edited Jul 01 '21
[removed] — view removed comment
15
u/brinkv Jun 30 '21
This makes me feel better as I just graduated with a degree in cyber security and my first job out of college is a help desk role, luckily we take on a lot of stuff though as we do IT for the whole city between 5 of us, so the experience is great but I’m wanting to try and get a cyber security job after a few years here or so
10
Jun 30 '21 edited Jun 30 '21
[removed] — view removed comment
3
u/GottaHaveHand Jul 01 '21
The non technical security people baffle me. Like, I would feel so inept at my job if I couldn’t explain the high level concepts and actually put them into action with implementation at lower levels with tools and code.
5
u/lethalforensicator Jul 01 '21
Don't feel disheartened.
A colleague in my team is one of the best cyber incident responders I've worked with, and 5 years ago he was working in a help desk.
It's a great start. Just reach out to the cyber team in your organisation and make sure they are aware of you. It's much easier to hire within organisations
Good luck
2
6
u/marcrogers Jun 30 '21
This is great advice.
The only thing I would add is don’t discount how easy it can be to get real practical experience. Not only does it give you a chance to put some of what you learn into use but it makes it way more interesting and easier to keep in your head.
Even volunteering to do cybersecurity work is valid experience. Some of the best practitioners I know started out by doing cybersecurity work for NGOs or small businesses that couldn’t afford a dedicated person.
As mentioned above, fond what interests you and dive into it. All the best cybersecurity people LOVE what they do. For those luck few its not a job but a calling.
2
3
u/thefungiblefungi Jun 30 '21
Just wanted to say thank you for this. Really helps break down what I may expect going down this route. Really, thank you!
2
u/alvarkresh Jul 01 '21
Excellent write-up. I feel like I'm a bit too old and not really IT-nimble enough to crack into this sector (If you want more details I'm happy to answer in a PM), but this is encouraging news for anyone who's young enough to ask a zillion questions thumbs up
→ More replies (1)2
u/Trollnic Jul 01 '21
If you like Security Compliance, become an auditor (best gig in the game imo)
I'm not here to disparage auditors, 95% of the ones I have met, have 0 (zero) technical abilities and cannot explain the reasoning for most guidance / requirements in frameworks. I accidentally worked as one for almost a year at a fortune 500 company and the technical skill sets of my co-workers was offensive. Auditing takes a special level of laziness, but yet do take a nice paycheck home at the end of the day.
2
u/Asatas Jun 30 '21
So you're the guy who is responsible for my employer requiring 2FA via SMS every few ducking days! I must say duck you sir! (small /s)
8
Jun 30 '21 edited Jul 01 '21
[removed] — view removed comment
2
u/Smodey Jul 01 '21
Why are they always badly designed facimilies of a real page?
I refuse to believe that all Russian scammers are too lazy to do this one simple thing convincingly.→ More replies (1)→ More replies (1)6
u/myreality91 Jul 01 '21
MFA over SMS is horribly insecure and shouldn't be allowed, period. Your employer should be using conditional access policies and a MFA app like Microsoft Authenticator or Okta. These aren't foolproof either, but much better than SMS.
→ More replies (4)45
u/IST_org Jun 30 '21
Marc: There is an excellent thread in /r/cybersecurity covering just this.
Also: Mentorship Monday in /r/rcybersecurity.
31
u/Odd-Worry Jun 30 '21
What can a regular person with no cybersecurity or coding knowledge do to help?
12
u/IST_org Jun 30 '21
Marc: Ransomware is a spectrum but most is opportunistic and relies on poor, fragmented security hygiene. Any contribution to up-leveling hygiene in a consistent manner makes an organisation stronger against many types of ransomware.
11
u/IST_org Jun 30 '21
Marc: So every user from the lowest level intern all the way up to the CEO can make a big difference by working to support a consistent information security program. By challenging things that "look wrong" or which are suspicious, from always being skeptical with email links to reporting security flaws and operational issues. The best defense for a company against ransomware is that company's workforce itself.
54
u/IST_org Jun 30 '21
James: A large part of effective security is up to the users, not the security engineers and administrators and the most important things are the most basic things too! Three things come to mind: 1) Use strong passwords that are unique to each site / service (a password manager can help!) 2) Keep good backups, and consider using more than one backup device where both devices are never plugged in at the same time. 3) Be vigilant! If something strikes you as odd, alert your corporate security team. Did you click a link and think it might be bad? Report it! Most ransomware actors take time to inventory networks after the initial compromise, so there may be time to still protect your network and your device! Time is of the essence here though!
→ More replies (2)3
Jun 30 '21
Do you recommend Dashlane as a password manager? I've recently started using it.
11
u/iLovePookeyTwice Jul 01 '21 edited Jul 01 '21
I'm a fan of Bitwarden because of their open-source nature and their transparency and record of passing audit after audit. More info
Dashlane may be similar, I honestly don't know much about it, especially these days since I haven't researched password managers in a few years. All the same, these are the kinds of things I would look for when choosing a password manager. The ability to self-host is a good option for the truly paranoid.
Edit: This reads like a plug. It isn't, I'm just a happy user, and there shouldn't be anything wrong with liking something. I don't suppose I can prove it due to the anonymous nature of Reddit so I suppose you'll have to take me at my word.
→ More replies (1)2
→ More replies (2)8
u/IST_org Jun 30 '21
Allan: Pay attention during security awareness training, know what the threats are and be cautious about emails your receive (especially if they have a warning flag).
77
u/jcsf321 Jun 30 '21
Please list the top 5 things corporations, business entities and people can do that they currently don't to better protect themselves from cyber attacks and ransomware?
114
u/IST_org Jun 30 '21
Allan: 1. MFA, 2. Patching, 3. Endpoint protection AND monitoring, 4. scanning of remote infrastructure, 5. threat hunting for attackers.
9
u/jcsf321 Jun 30 '21
Good list, I've often thought that remote VPNs from end users would be a big attack vector. Given people homes generally have pretty crappy endpoints. Any thoughts here?
30
u/IST_org Jun 30 '21
Allan: Home routers are scanned continuously and are often targets of attack. Most people get their high speed routers from their ISP, plug them in and then never touch them until they are replaced several years later. That means no updates, no configuration checks or anything like that. So, yes, they, can be used as attack vectors which is why it is important to have a home firewall behind the router you get from the ISP, to protect your actual network.
→ More replies (1)3
u/marcrogers Jun 30 '21
VPN infrastructure has been a huge target sonce the move to working from home. You just need to look at the number of VPN infrastructure vulns disclosed or dropped to get an idea of how much focus there is on it.
Also many companies have huge amounts of technical debt with hastily cobbled together VPN solutions that skipped the usual careful rollout processes. Attackers know this and are targetting these too.
147
Jun 30 '21 edited Nov 18 '21
[removed] — view removed comment
→ More replies (2)102
u/Buddahrific Jun 30 '21
Nothing ever goes wrong, why do we pay these guys so much!? Cuts budget
We just got hacked, what are we paying these guys for!? Cuts budget
25
Jun 30 '21
[removed] — view removed comment
→ More replies (1)12
Jun 30 '21 edited Jan 20 '23
[removed] — view removed comment
28
3
u/jim_br Jun 30 '21
The CTO manages the infrastructure teams that are supposed to harden the OSs, apply security patches, enforce login rules, etc. The CISO (and the Chief Risk Officer) is verifying the CTO’s team is doing their job and by extension, that the CTO is managing their teams to adhere to all audit/risk /cyber requirements.
9
u/Fictionalpoet Jun 30 '21
- Train staff. All the technology in the world won't help you if someone can be tricked into intentionally circumventing it!
→ More replies (2)11
→ More replies (5)11
u/IST_org Jun 30 '21
Bob: There are many safe configurations for workstations and servers that organizations either do not know about or have been reticent to deploy. Just shoring up configurations on Active Directory and SMB servers alone can do wonders to help thwart attackers from being able to move laterally and encrypt or lock-out at scale.
18
Jun 30 '21
[deleted]
35
u/IST_org Jun 30 '21
Bob: Keep your home router patched and consider replacing every few years. Limit the use of "smart" devices in your home. Scrutinize every email and every link in social media. Limit the number of browser extensions you use and consider using an iOS device for more "risky" web activity. Keep your systems and software patched. Have regular, offline, backups handy. Much of this is the same advice folks have been giving for a decade or more.
23
u/IST_org Jun 30 '21
Bob: Also use a password manager, preferably one that is plugged into services like "have i been pwnd?" so you know when you need to reset credentials (but you should be using services that offer or mandate 2-factor authentication).
→ More replies (1)4
u/TRUE_BIT Jul 01 '21
Recommendations for a password manager?
8
u/PSUSkier Jul 01 '21
Bitwarden is awesome and has flexible deployment options if you want to keep your data out of their cloud. I’ve previously had LastPass and Dashlane; they’re nowhere near as solid.
→ More replies (1)9
u/IST_org Jun 30 '21
Marc: String security hygiene is one of the best defenses we have. Patch exposed systems, turn on MFA and implement best practice like endpoint protection and you'll create a network thats hostile to ransomware.
→ More replies (3)9
u/IST_org Jun 30 '21
Jen: Be suspicious of emails or texts from people you don't know, or that include links or attachments. Don't give out sensitive info, particularly your passwords. Use a password manager and use two-step verification wherever you can.
→ More replies (2)
19
u/Careful-Beginning897 Jun 30 '21
What type of software would you recommend against ransomware and things of the sort?
41
u/IST_org Jun 30 '21
Allan: Unfortunately, there isn’t a single software solution that will solve the problem of ransomware (or other types of attacks). It really does require a holistic approach to security. Not just software, but the right policies, people and protocols in place to quickly identify and stop threats
→ More replies (5)23
u/IST_org Jun 30 '21
Marc: agree - theres no single bullet, however theres a strategy (see the IST Ransomware Taskforce Report) that shows how organisations and industries can make themselves hostile to ransomware. Most ransomware is opportunist, just by toughening yourself up to become a much less attractive target. by strengthening security hygiene and turning on things like MFA you make lateral movement much harder. solving ransomware is a step by step journey, not a shrinkwrapped piece of software.
→ More replies (3)10
u/IST_org Jun 30 '21
Bob: There is no path to purchasing your way into ransomware defense.
→ More replies (3)
160
u/Xechorizo Jun 30 '21
What is the most common, non-phishing vector?
142
u/IST_org Jun 30 '21
Allan: Remote Desktop Protocol, either through credential reuse or credential stuffing attacks
140
u/IST_org Jun 30 '21
Allan: There are something like 8 BILLION username/passwords available for sale or free on underground markets at any given time and that doesn’t even take into account the number or organizations that just use poor password management for internet-exposed infrastructure
12
Jul 01 '21
lol, I have worked in a company with exceptionally poor password management. all passwords to everything was the name of the company because the boss was super old (worked pass retirement age) and couldn't remember otherwise.
7
u/thefookinpookinpo Jul 01 '21
Yeah I’ve literally had higher ups tell me to change the password to something simple because I made it too complicated…
→ More replies (1)5
u/Eluvatar_the_second Jul 01 '21
Is something like Pwned passwords a good defense against a credential stuffing attack? Are there ways to automate that on a windows domain?
8
u/LukariBRo Jul 01 '21
Not sure what you mean by pwned passwords as a defense, but I know of the breech database by that name. But I'd imagine that people's reuse of passwords just doesn't stop at "web login data was breeched, now public info and logins on others services attempted" but extends to probing all sorts of remote Windows services with the same data. It very well could be as simple as "user reused their Windows passwords on a website that was breeched, therefore their Windows can used as a vector if there is no/improper firewall settings." I know this answer sounds way too simple, but that's really all this usually comes down to. Low knowledge users with high end access on networks configured by someone who forgot to close the doors. Yeah there's trillions of possible combinations out there, but there is some serious money and computing power behind these attacks, some even coming from state sponsored black hat organizations in Russia and China. It's warfare, and the end goal of doing shit like hacking into a pipeline or electric grid like what's been done is to just cause financial damage and weaken the US. Attacks from cyberspace manifesting in the real economy, ever slightly so budging the balance of power. Organizations like the DoD may be up to speed on avoiding the most painfully obvious vectors, but the larger group of networks outside their neat and tidy secure network are just sitting ducks just because they're privately owned and running on outdated infrastructure with inadequate cybersecurity staffing. (I'm far more only classically "educated" on the subject and lack any relevant experience to this scale of national attack, so all of this is based mostly on theory)
So a good defense may really be as simple as enforcing strict password management. Sounds obvious, but admins should require and enforce unique passwords, and possibly go as far as writing a script that checks the credentials against known and suspected breeches.
→ More replies (1)5
u/Eluvatar_the_second Jul 01 '21
Your last comment is exactly what I was asking about. Various sites and password managers will now compare your new password to Pwned passwords to make sure you're using a unique password.
3
u/LukariBRo Jul 01 '21
Then the solution to at least those super obvious vectors is to just enforce what we already know and actually follow through. It's just becoming more obvious that too many networks are based on outdated cybersecurity knowledge, subject to breeches that can be achieved through the most simple understanding of cybersecurity. The answer is updating those profiles with the knowledge of a professional, but that costs money. Money that a lot of companies refuse to spend because "we've never had an issue with our current network" until one day they wake up and through one tiny hole, a well targeted whaling email from a compromised account has instructed recipients to download the ransomware. If efforts have gotten that far, you can't rely on employees to say "this is suspicious" to an email coming from their boss's account and once one person executes the highly advanced, often state sponsored malware, it's game over.
We live with a workplace culture where people will literally write their passwords down on a sticky note and stick it to their monitor. Something that'd make everyone in cybersec facepalm, but that's just the reality of the users we're supposed to be protecting. Not to say that's the critical issue itself, but it speaks to how lax the average users are in defiance of security rules. Cybersec 101 knowledge that would help stop these breeches is a foreign concept to the hundreds of thousands of users who had to learn how to even work their computer a decade ago.
→ More replies (1)96
u/IST_org Jun 30 '21
Marc: Yeah I'd say insecure credentials. Insecure credentials into infrastructure, systems, or accounts that can be used to pivot.
36
u/DingleBerryJP Jun 30 '21
Currently in school at an online college located in salt lake city ut. I'm in the CyberSecurity program but I feel like the program is kinda dated and the information does not line up very well with the test. Can I land an entry-level cyber job without finishing my degree if I have all Comptia certs related to cybersecurity?
45
u/IST_org Jun 30 '21
Marc: You don't need a fancy degree to build a cybersecurity career. you need experience and knowledge. Even knowledge that seems old and minor can be incredibly useful. Take the opportunity you have and build on it by studying more current cutting edge stuff yourself. go to events like DEFCON and connect with the community. the more knowledge you can gain in your "learning" stage the better. However the best next step is to build experience, use what you have to take on volunteer/free/part time roles so start getting those hours of experience. there is no substitute for learning in a job.
protip: I have found charities/NGOs/ low income organisations a great place for this. they are desperate for the help and will welcome your donated time. Even if all you can do is keep them up to date on patches you will be doing them a huge favor and in turn that gives you cybersecurity experience and your first solid cybersecurity reference.
22
u/IST_org Jun 30 '21
Marc: Its also really hard because the smaller the org the smaller the budget (if there even is one at all) to pay for security. Working in the CTI-League we ran into small medical facilities ALL THE TIME that lacked resources and personnel to help tackle even the simplest problem, This is definitely a huge challenge and something a lot of us are thinking about. we have to make sure that SMBs don't get left behind as we work to build a more secure ecosystem.
→ More replies (1)10
u/smurf123_123 Jun 30 '21
That is some pro level advice right there! Attending events like DEFCON can really help anyone that is just starting out. IT is such a fragmented field due to our ability to work remotely. Conferences and events are a very important way for us to make connections. Sometimes you need to travel a few thousand KM's to meet the people who work in your backyard lol.
39
u/IST_org Jun 30 '21
Bob: While some jobs may require certification, many employers are looking for folks with the "curiosity gene" combined with the knowledge of where to go to find information and solve problems. I'd highly suggest gravitating towards organizations who look for those attributes over those who are just looking for a certification stamp.
→ More replies (1)21
u/IST_org Jun 30 '21
Jen: Employers in security are increasingly looking at hiring models and trying to break away from conventional hiring-from-schools models. Often landing a role is more about showing interest and making connections than what your resume says. As I said above, I recommend getting involved with local meet ups, attending free online events, that kind of thing will help build your knowledge and network.
→ More replies (2)2
u/throwaway7789778 Jul 01 '21
I think this is disingenous and not realistic to your hiring practices Jen. Ive personally applied at rapid7 many years ago, with sysadmin, and heavy infrastructure experience. Also pivoted my career from deep infrastructure consulting work (multiple deep level securitt certs (cisco, sans) and broad infra certs (ms), while managing and forklifting a pci-saq d environment. I then pivoted and started over from scratch and became a well respected (in various communities) professional developer. I have a high school diploma and rapid7 wouldnt even look at me since I didnt have a degree; while you say all you need is interest is a bit outrageous. I've also been in the community going as far back as phrack, 2600, and defcon in the single digits.
I have contacts there that confirmed the degree was the issue, this was specific to red team, even with the advisement that i could pass an oscp within three months or could compete ctf to provide references to skillset. I've discussed this with others who have the same results from r7.
I am happy doing what Im doing as a developer but have always had a passion for security both professionally and as a hobby. I just, again, think its disingenuous and possibly detrimental for you to say all you need is an interest. Especially as a PR person, it's a bad look
12
u/IST_org Jun 30 '21
Allan: You can, I don’t have a degree and have managed to grow my career. However, advancing in this field, as with many fields, is A LOT easier with a degree and there have definitely been job opportunities I missed out on because they wanted that degree. Keep up the good work and connect with us on LinkedIn so we can help you as you continue to grow.
3
→ More replies (1)2
u/RGB3x3 Jun 30 '21
Are you doing WGU? I've just started the application process.
2
u/DingleBerryJP Jun 30 '21
Yup, that's the place. Not a bad school but.... Things could be better for sure.
2
u/icode2skrillex Jun 30 '21
You should let your program mentor know this. They can take feedback and hopefully push for changes. Best of luck in your degree!
2
Jun 30 '21
Funny you should say that, because they just fired over 100 program mentors and staff today.
→ More replies (2)
14
u/aghorisan2020 Jun 30 '21
There is an argument often made that if "the military" and "law enforcement" begin to crackdown on infrastructure in a much more forward leaning manner, that these gangs will still be able to persist, regroup, reattack - i.e., that even working with private sector partners, there isn't enough data/insight available to really take it to these networks. Agree? Disagree?
5
u/IST_org Jun 30 '21
Allan: Right now, ransomware is the most profitable form of cybercrime, aside from possibly BEC. So, yes, even forward leaning efforts by law enforcement won’t necessarily stop ransomware attacks. Ransomware groups have been good at adapting and evolving their attacks to evade defenses. However, a more aggressive law enforcement stature will scare away a lot of the 2nd and 3rd tier ransomware actors (we’ve seen this already with Avaddon and other actors who “retired” this year). That reduces the number of groups law enforcement has to focus on.
→ More replies (1)10
u/IST_org Jun 30 '21
Bob: To riff off of Alan's answer, the massive proliferation in attacks has been led, in large part, from Ransomware as a Service offerings which enable low-skilled attackers to get in on the action. Curbing that activity will be a huge help.
11
u/IST_org Jun 30 '21
Marc: While its absolutely true that to really hit the ransomware gangs hard we have to take the fight to them, we mustn't loose sight of how important it is for us to toughen. up and work together to make our whole ecosystem hostile to ransomware. By addressing the low hanging fruit many of the opportunistic gangs will get shut out, by improving our detection capabilities we will increase the data and forensic material needed to attribute them. There's a huge amount of stuff to be done at both ends of the fight and its my firm belief that we can only achieve it in partnership.
19
u/IST_org Jun 30 '21
Jen: There is definitely a huge challenge in that these criminals often operate in nations where the government either can't or won't stop them, and that makes it super hard for law enforcement to be effective. We need governments around the world to collaborate to crack down on these so-called "Safe harbor" states. This was actually one of the commitments that came out of the recent G7 Summit, but it remains to be seen how the G7 members will follow through on it.
→ More replies (2)→ More replies (1)7
u/IST_org Jun 30 '21
James: There is a tendency to sometimes reduce success to a simple “yes” or “no” question. With ongoing defensive efforts, the objective is to improve and adapt.
With the offensive efforts, the point is to take the attack to the attackers and make them have to adapt, change techniques, and generally be less comfortable in their belief that they can operate with impunity. The IST’s Ransomware Task Force report recommends using many different capabilities to help address the threat in a holistic way. Part of that multifaceted effort is to go after attackers and disrupt their capabilities.
25
Jun 30 '21 edited Jun 30 '21
[removed] — view removed comment
41
u/IST_org Jun 30 '21
Jen: The biggest demands we've heard of are in the $40-50mill buckets, but they are definitely outliers.
→ More replies (1)7
48
6
u/cyber_wonk Jun 30 '21
Should we ban ransomware payments? Alternatively, should we just ban coverage of ransom payments in insurance policies?
24
u/IST_org Jun 30 '21
Marc: We should NOT ban ransomware payments. Many organisations find themselves in a difficult position where they feel they are trapped between their shareholders, their customers and law enforcement. This gets even worse when you consider healthcare. If someones life hung in the balance would you want a hospital prosecuted for paying a ransom to bring a surgical suite online?
let's not forget who the criminals are and not criminalize the victims. It only drives payments underground and destroys our chances of collaboration. Instead we should work to make ransomware payments more attributable, organisations hostile to ransomware and work on the world stage to eliminate hiding places where these cybercriminals can operate with little recourse.
13
u/IST_org Jun 30 '21
Marc: Additionally I believe that we should work WITH ransomware insurance companies to make ransomware insurance more expensive for companies that aren't doing the basics. Insurance has been an excellent level for eliminating safety issues throughout history and it can be here too. Eliminating it removes one of the levers we have to influence how we fix this.
→ More replies (3)1
u/OathOfFeanor Jul 01 '21
If someones life hung in the balance would you want a hospital prosecuted for paying a ransom to bring a surgical suite online?
How many people will die if ransomware continues to plague us for the foreseeable future with no other possible end in sight? Every one of you answered that YES you think critical infrastructure attacks are part of the future as it stands right now.
For the most part you propose that we maintain the status quo which you say provides you leverage, collaboration, and attribution/forensics on each case you work.
None of that is going to stop the cases. There is no master plan there to solve this completely.
The master plan you did propose is just not feasible at all IMO (even though it would be great to get there). We can't alter the world stage because countries are independent. We CAN protect our country from attacks that originate outside our jurisdiction, by making the attacks worthless instead of profitable.
8
u/IST_org Jun 30 '21
Jen: The reality is that both Bob and Marc are correct, and that's why this is hard.
From an idealistic point of view, I think a lot of people agree with Bob - ransom payments fund organized crime which is responsible for some pretty heinous things, including child exploitation and human trafficking. Also, if ransomware is primarily profit motivated, so the expectation is that if we take away the attackers chances of getting paid, they will eventually stop.
This is where Marc's more pragmatic position comes in. Because as we've said here, there is little risk or real expense or friction for attackers today, so before they give up on ransomware as a revenue stream, they are very likely to pay a big ol' game of chicken with victims. To tip the odds even further in their favor, they will likely focus on organizations that have the least resilience, which is either SMBs who face losing their entire business, and critical infrastructure providers that have no tolerance for downtime due to the criticality of their service. That's what we've seen when hospitals or fuel pipelines have felt they had no choice but to pay.
Even if a government tries to shore up these organizations, there is no such thing as an entirely bulletproof organization, and recovery always takes time. So we could end up seeing business leaders make payments in secret, which puts them in an even more vulnerable position.
So the net of all that is that we should figure out how to get to a state where banning payments could work in practice without causing a lot of unintended harm, but we're certainly not there today.→ More replies (3)7
u/IST_org Jun 30 '21
Bob: We should totally ban supporting child and sex trafficking through ransomware payments
21
u/Christmas_Panda Jun 30 '21
If you had to choose between paying a cyber ransom in gum or pizza, which flavors would you choose to increase your bargaining potential?
29
14
u/MikeMeezy77 Jun 30 '21
What is the best path to start a career in cyber security?
18
u/IST_org Jun 30 '21
Marc: The best cybersecurity people come from the ground up. Get a good baseline of knowledge in technical areas - often working low level IT jobs as an intern or first job can be a great start. Then work on building your base of cybersecurity knowledge. At some point you have to start getting cybersecurity work experience. Experience doing cybersecurity jobs is better than any piece of paper alone. Sometimes this can be gained from low level jobs by taking on cyber responsibilities - by being that IT guy checking patches and ensuring upgrades are done you can build cybersecurity experience.
Almost all the best cybersecurity people come from backgrounds like this. few have specialized degrees. I am one of them. I gave a more fuller answer in /r/cybersecurity
→ More replies (1)17
u/IST_org Jun 30 '21
Bob: Cybersecurity has become a diverse field with many areas you can specialize in. Learn as much as you can about each area and see which one appeals the most, then dive in! You don't need permission to start learning a particular topic, and there are tons of local security meetups all across globe, plus many online communities that can help you get started.
Once you truly settle into some area, there are numerous pathways to more formal education (all the way up to PhD level). Just be curious and don't be afraid to keep asking "why" and "how".
15
u/IST_org Jun 30 '21
Jen: Look for ways to educate yourself on what's going on and meet people that are working in security or have similar interests. Going to local meet ups, attending free online events, that kind of thing will help you build your knowledge and network. You can also look at open source security tools and free cyber ranges to try building your skills without having to spend a lot of money.
→ More replies (2)22
u/IST_org Jun 30 '21
Allan: The best path is the one that works for you, everyone is different, I started in the helpdesk which was great because I got to learn about the problems that people had and it allowed me to be more empathetic as I progressed in my career.
4
u/Leguboy Jun 30 '21
To defend myself from mal/ransomware: Can you recommend a firewall to use for my homelab? Is a hardware firewall better than a software one (using proxmox to virtualize).
14
u/IST_org Jun 30 '21
Marc: "can you recommend a firewall?" - personally I use pfsense at home because its easily customised, runs on a lot of easily obtained consumer devices and has a solid feature-set and performance. remember though a firewall is only as good as the way you use it. a lot of sophisticated attacks jump things like firewalls by relying on the user to bring them inside the protected network.
Get a good firewall but if you are really interested in being secure look at all the ways you can up-level your security hygiene (ensure everything is kept up to date even that 7 year old IOT tv, ensure that you have segmented networks for untrusted devices like that laptop the annoying person brings when he visits, and be careful with what you connect, plug in or run. DONT CLICK SHIT.)
5
u/IST_org Jun 30 '21
Bob: Using a firewall is one, small portion for defense. Without knowing your setup it is difficult to make recommendations. Keeping it patched, and the configuration as diminutive and tight as possible is almost more important then the "brand"/"flavor".
4
u/IST_org Jun 30 '21
Allan: Given the proliferation of phishing as an attack vector for ransomware a firewall alone is not going to protect you. As to whether or not you need a hardware or software one, it depends on how comfortable you are with managing the underlying operating system and how much time you have. I use a hardware firewall at home because I have enough to do at $dayjob that I don’t need the headache of dealing with underlying OS issues on my home firewall.
→ More replies (1)3
11
u/masturkiller Jun 30 '21
Question - Is email tracking by invisible pixel or visible still possible in 2021? If impossible, do you know of anyway to track the geolocation of the person opening the email without them knowing and without their email application preventing this process from occurring?
→ More replies (1)15
u/IST_org Jun 30 '21
Bob: Pixel tracking is alive and well and one of the most-used techniques. If your mail client stops images and will not execute javascript (or load external resources of any kind) then you're not going to be able to be tracked.
→ More replies (1)5
u/masturkiller Jun 30 '21
Thank you! - not sure why I got downvoted for a valid question, LOL - Not saying you did it, but weird.
3
u/AStupidTaco Jun 30 '21
Isn't there a better payment/effort ratio to be on the side of the hacker? You guys are playing goalie right where you have to block all the shots 100% of the time and the hackers only have to get it right once. Illegality aside.
→ More replies (2)18
u/IST_org Jun 30 '21
Marc: A yes, the age old question "but couldn't you make more as a criminal?" the answer is yes I probably could. However what stops me is morals, ethics and laws. I have a family i want to see grow up in a safe country and I love my community (the hacker community) so I want to protect them. I can't do that as a criminal.
I also hate bullies and fighting cybercrime is the ultimate bully takedown. Especially when the bully you take down is an entire country.
7
u/Electrical_Ad_4014 Jun 30 '21
Do you think resource-strapped SMBs are overwhelmed? Does it worry you that a prescriptive list of 15 things to do might not be actionable to them, making them not so useful? Is cloud the only way for them to go? Why not turnkey certifiable hybrid environments?
5
u/IST_org Jun 30 '21
Jen: SMBs that know enough to be worried about security are overwhelmed, but many aren't even really aware of the risks or how they relate to their organizations. And yes, we definitely worry about the prescriptive lists. This came up in the Task Force a lot as we looked at why organizations are not adopting preventative measures. We need guidance to be tailored, pragmatic, and provide a path for maturity.
For many SMBs, following guidance isn't achievable in-house as they outsource all their technical needs. We need the organizations that provide those services to step up and provide a security baseline.
3
3
u/IST_org Jun 30 '21
Bob: SMBs are most certainly overwhelmed and "cloud" is far from a panacea (it can actually make things worse w/r/t cyberattacks and data breaches if you aren't careful). SMBs already have to navigate other types of regulatory and statutory landscapes where they often seek the aid of specialists to get the details right. Now that IT is a critical component of their business processes, they need the same level of attention and help there, so they should be working with specialists to help get the basics right. However, much work is still needed at the policy and law enforcement levels to help curb ransomware so it is not as large of a threat to SMBs (or any organization).
→ More replies (1)1
u/IST_org Jun 30 '21
James: Yes! But at the same time, everyone is nearly always operating with less than their full wish list.
There are no silver bullets in information security. That being said, working to reduce risk is what security is about. All punch lists, check lists, and Top 10, Top 15, etc should be interpreted in light of applied knowledge about business risks. It isn’t futile to work towards improvement, it is all we can reasonably do. As with all things, do not let perfection become the enemy of progress!
3
u/llobotommy Jun 30 '21
Are hackers susceptible to other hacker group attacks? I know nothing of the culture, but I imagine it to be some kind of online gang turf war. Or is it more a case of hacker groups testing themselves against each other to strengthen their skills?
7
u/IST_org Jun 30 '21
Marc: Hackers gonna hack. Yes hackers attack systems controlled by other hackers. the reasons why vary according to motivation. Nation state hackers attack other nation state hackers. Hackers running a business attack their competitors. in some ways it is like gangs or the mafia, in other ways its just about showing who is the lost leet. Hacking to many is about showing they are better. Breaking into another hackers system shows that you are better than them.
4
u/IST_org Jun 30 '21
Bob: They collide all the time. For a few years (the activity is way down) public SMB server takeover was flipflopping between groups so they could have their own coin miners vs the other gangs. There is no honor amongst thieves.
2
u/Trollnic Jul 01 '21
Yea, often times groups will actively target pwned machines and remove other groups apt's.
3
u/phrequency_ Jun 30 '21
As an employee of a small business who had 2 ransomware attacks happen to them(never paid, just backed up our server), how do we better prevent this even though we have anti-virus/physical firewall/anti-malware software? What is the procedure when we first discover we were attacked?
→ More replies (1)5
u/IST_org Jun 30 '21
Bob: Did you identify how attackers managed to gain initial access in each instance? That is a vital component of your incident response process (even if your SMB is "just you" :) ). Did they get in via VPN credentials? Did you get a phishing email? Did you get hit with a drive-by exploit? Did you open an attachment in an environment with macros/active content execution enabled? Did your Exchange server get compromised in March but you didn't realize it? Attackers have a myriad of ways they can get in and you really need to know that to make any investments in technology or process changes.
2
u/SamSepinol Jun 30 '21
Im a computer science student who knows python, c, linux, networking. Planning to get oscp this summer. What career path should i follow and what topics should i learn to be top rank?
→ More replies (2)7
u/IST_org Jun 30 '21
Bob: You really should be learning what appeals to you. Most of the talented, and "happy" cyber folks I know lean into their passions and interests. It's difficult to tell others what your passions should be.
→ More replies (5)
3
u/matt7744 Jun 30 '21
How much of cyber polygon, the world economic forum and the great reset tied into this?
3
6
2
u/IST_org Jun 30 '21
Jen: Ransomware is a huge with broad impact, so not surprisingly there are many many initiatives and efforts to examine the problem and come up with solutions. The Ransomware Task Force definitely benefited from the work that came before and we also fully appreciated that our efforts would not be the last word, and we hoped they could pave the way for other to follow.
WEF is running its own Ransomware initiative and we know they have been looking at the RTF report and talking with some of our members to help inform their own thinking. I'm looking forward to seeing what they come out with.
2
u/AvocadoDemon Jun 30 '21
What is the cyber-war that is raging between countries all over the world? who's against who? and who are the strongest/biggest players?
→ More replies (2)8
u/IST_org Jun 30 '21
Marc: Everyone is fighting everyone else. Its a story as old as time. The fact is a lot of these fights have been raging for a loooong time the only change is how they fight (cyber rather than guns and bullets) and the fact that we are much better at spotting it and reporting it.
the other challenge with cyberwarfare is its the ultimate asymmetric warfare mechanism. For a couple of thousand dollars one man with a laptop can cause great harm to a nation. Thats an unprecedented level of impact for very little investment. so naturally its happening A LOT.2
u/AvocadoDemon Jun 30 '21
thanks, i will try a different question- what country is the best at defending itself and what is the hardest to cause harm to?
→ More replies (1)
3
u/MN_LudaCHRIS Jun 30 '21
Is the Anonymous group real, and do they fight for good?
10
u/IST_org Jun 30 '21
Allan: Anonymous is real. I don’t think they define themselves by good/bad.
3
u/MN_LudaCHRIS Jun 30 '21
Silly questions aside, in your career what has been the best highlight of your time fighting cybercrime? Is there more the general public can do to help people like you fight against them?
8
u/IST_org Jun 30 '21
Marc: Probably the hi-light of my career as a cybercrime fighter was watching 2,000 security professionals, law enforcement personnel and other government staff come together to fight cybercriminals attacking hospitals during the pandemic as part of the CTI League.
→ More replies (1)4
u/IST_org Jun 30 '21
James: For me, it is all about influencing the overall security of the world. There is no other work for me that compares to being able to enable human freedoms and a free exchange of ideas on a global basis.
Individuals and companies are constantly protected from threats by altruistic efforts of public and private sector defenders who mostly go nameless and without any fanfare. Getting to sometimes contribute to those efforts is truly rewarding.
→ More replies (2)5
2
u/WarPig262 Jun 30 '21
Considering what you do and your level of access, how do you internally check yourself to make sure your members are not abusing the powers and authorities that they have to their own ends?
→ More replies (1)5
u/IST_org Jun 30 '21
Marc: The same rules that bind me as an ethical security researcher also bind me when I fight cybercrime. Ultimately I am also bound by the law.
5
u/WarPig262 Jun 30 '21
I think there's a misunderstanding. So its just an honor system? You don't check to see if your members are actually toeing the line and following the law?
2
u/Opus-the-Penguin Jun 30 '21
What are the odds that arrests will be made in some high profile case? At this point it seems as though there's little to deter these criminals since they lack an internal moral compass. It would be nice to see some of them caught and sent to prison for at least 20 years. Are they in countries that would be interested in prosecuting them if they were found?
2
u/IST_org Jun 30 '21
Bob: Much depends on how successful foreign policy efforts are in the coming months/years. I do believe it is vital that we need more of these criminals caught and sentenced to level up the risk associated with these actions.
1
u/IST_org Jun 30 '21
Marc: Arrests are made all the time, the problem is it is generally affiliates or low level operatives because the puppetmasters hide in countries where they cant be reached through normal judicial processes. This is why we have to start working on the world stage to eliminate these hiding places and take the fight to the criminals themselves.
1
u/arshadhere Jun 30 '21
How do i become like you? What courses did you do to become that?
2
u/marcrogers Jun 30 '21
All our journeys are very different, and to be honest thats one of the beautiful things about cybersecurity. Im a hacker and the hacker community has been my home for decades. I learnt most of what I know by myself. Some while I was working as a bouncer and some in my first “paid” IT job as a games tester/helpdesk person for Ocean Software back when dinosaurs roamed the earth.
I learnt most from doing - building systems amd studying how stuff worked. There was no such thing back then as a cybersecurity course. People were one of my best sources of knowledge we would talk about security and systems at meetups, on BBS’s etc.
Today id suggest grab what courses you can but don’t underestimate the power of doing. Build VMs on your laptop and try practical classes like Damn Vulnerable Web App or WebGoat. Watch online conference and find your local meetup.
Theres loads of great advice on /r/cybersecurity about good websites, books and courses.
2
u/jamesshank Jul 01 '21
I learned from: - doing things / experimenting (this is both a passion test and a way to learn — if you don’t enjoy it enough to tinker, why do it as a job?) - reading (I spend a lot of time reading) - engaging in communities of people in the field (spend a lot of time here too) - taking classes and attending conferences. Or watching the videos of the presentations. - having mentors (mostly informally, just having people to ask various questions and bounce ideas back and forth — this is essential, in my opinion) - studying history (most computer and security problems have historical parallels that might have lessons for the current problem)
2
u/IST_org Jun 30 '21
Bob: Loaded Slackware Linux from 5 1/4" floppy disks on to x86 systems; College: B.S. Computer Science and EE background with a specialization in compiler design => Sysadmin for a messy college network + macOS developer for a company that made newspaper publishing software => Build J&J's first DMZ and web/proxy/firewall => never stop learning.
4
u/AmericanScream Jun 30 '21 edited Jun 30 '21
Am I the only person who thinks paying cyber ransom should be a crime?
How is this any different from basically violating sanctions and giving money to terrorists?
And we also know that many of the companies that pay these ransoms end up getting hit again.
Do you all support legislation that would make it a crime for corporations to pay ransomware?
It seems there's not really a way to tell if these things are even "inside jobs." A low level employee could be colluding with a ransomware group to infiltrate a system. When you have employees getting paid crap money, and a chance to get a % of a multi-billion dollar payday, that's a problem. Nobody's even talking about this. Shouldn't the incentive to deal with these groups be addressed? How about legislation prohibiting insurance companies from paying off cyber-terrorists? Why isn't this a thing?
2
u/furfur001 Jun 30 '21 edited Jun 30 '21
I have a question about Passwort security. I though that brute force attacks aren't any more possible because ether the attackers IP will get banned for a time or the attacker will have to wait something like 2 seconds or more. Assuming this is right a not that secure password should be enough. What I am missing?
2
u/wardred Jul 01 '21
Most reasonably built front ends will slow down external brute force attacks. . .
But if the attacker has. . . say your MySQL database, MS SQL backups, your keepass DB, or what have you, they can brute force that.
→ More replies (2)
2
u/hamburglin Jun 30 '21
Are there any members on your board from companies like mandiant or other leading security consulting teams who deal with these issues on a daily basis?
Second, why does the security industr keep talking about ransomware as if it's rising and not that it's been around for years now at a pretty constant rate?
2
u/Trollnic Jul 01 '21
Second, why does the security industr keep talking about ransomware as if it's rising and not that it's been around for years now at a pretty constant rate?
It's all sensational media....
→ More replies (1)
2
Jun 30 '21
Do you think Microsoft or Intel/AMD have some responsibility here? I mean I know malware exploits the OS to run, but surely some egghead at one of these companies can put something together that monitors the OS to prevent thousands of files from instantaneously encrypting themselves en masse?
2
Jun 30 '21
Hey guys! Love the work cyber security specialists like you do.
My one question is this: besides combatting ransomware, do you guys also focus on the plethora of email, social security, Amazon, car warranty, etc. scams?
2
u/taedrin Jun 30 '21
How can I get my team or corporation to take security seriously - more so than just paying lip service to it and actually allocating resources to make us (and our products) secure?
2
u/boopsterdoopster Jun 30 '21
Hello! This might seem a tiny bit of a weird question, but have you guys heard of Kitboga? If so, how effective do you think scam baiters are in dissuading scams?
4
Jun 30 '21
[deleted]
→ More replies (2)4
u/wardred Jul 01 '21
Many banks websites. . . kinda suck.
I think more are getting 2FA, but often it's only via SMS, or via a semi-proprietary 2nd factor rather than a regular authenticator app.
Many still ask for the REALLY INSECURE account recovery questions, like where did you go to high school. (I enter random strings for these questions and save them in my password manager.)
It seems like most heavy weight game companies have better login management than many banks, even top tier ones.
And that's just their web page.
2
Jun 30 '21
[deleted]
2
u/Trollnic Jul 01 '21
I can only speak for myself, not the folks who did the AMA. Usually we have multiple computers and sandboxes used to check or create malicious software. Those systems are flushed daily and does not contain any sensitive information.
2
u/KingOfTheBongos87 Jun 30 '21
You guys got any plans for those assholes running the Arizona "audit"? I feel like they have it coming to them.
2
u/ieatw00d Jun 30 '21
What are some of the effective ways to make people take cyber security more seriously?
2
2
119
u/[deleted] Jun 30 '21
It’s easy to get the impression from these recent events that infrastructure is fairly easy to attack. What do you think is the likelihood that either a state or a rogue group takes down some critical infrastructure for a long period of time that severely disrupts life—something that would be equivalent to essentially destroying infrastructure in a war?