All right, we are recording the second episode of the Security Podcast, which is
part of the State of Enterprise IT show.
Okay, we are recording the second episode of the State of Enterprise IT Security
Edition with Brad Bussie.
All right, Brad, take it away.
All right, hi everybody.
I'm Brad Bussie Chief Information Security Officer here at e360 Thanks again for
joining me for the State of Enterprise IT Security Edition.
This is the show that makes IT security approachable and actionable for technology
leaders.
I'm happy to bring you three topics this week.
The first one is can cybersecurity experts safely use TikTok?
The second is will breaches be worse this year?
And the third is MITRE ATT&CK really that influential?
So with that, let's get started.
So can cybersecurity experts safely use TikTok?
And I look at this whether, you know, cybersecurity experts can use TikTok.
And I think it depends on several factors.
Part of it is what's your risk tolerance, really what's the purpose of your usage
and what precautions are you taking?
So if I were to break it down into a couple of considerations, I would start
with what are the potential risks.
So for the, I'd say since the inception of the application or website, depends on how
you consume it, data collection and privacy concerns are paramount.
TikTok collects considerable user data.
There's been argument that Google collects it the same, that YouTube also does it,
Instagram, kind of the whole Facebook family.
But I think what's being done with it is more
of the concern.
So it's collecting user data.
It includes the location, the device information, the viewing habits of the
user.
The app owner is a Chinese company, which raises some concerns about potential data
access by the Chinese government.
It's interesting though, because TikTok denies those claims.
There are...
Security vulnerabilities and while vulnerabilities are inherent in any
software, like we've hit on that a few times before, TikTok's faced some pretty
harsh criticism in the past for the security flaws that could again,
potentially expose user data.
So we're still talking about data, we're still talking about privacy.
But I think even more dangerous is misinformation and propaganda.
So TikTok's algorithm, they can expose users to misinformation, propaganda,
especially if it's coming from a quote unquote verified source.
Those are things that are a little more controlled on other platforms, but not so
much on TikTok.
So this could be pretty concerning for me as a cybersecurity practitioner when it
comes to dealing with sensitive information.
So let's say I decide to accept the risk.
What are some of the things that I could do to use TikTok?
And I'll also talk a little bit about how I feel about security experts leveraging
the platform to reach an audience.
So for me, it all comes down to limiting engagement.
So if an expert does choose to use TikTok, they should limit the engagement to very
specific purposes, like following education, specific content, industry
trends, and really the goal is to minimize any data exposure.
I'd say making sure your privacy settings, utilizing all the available privacy
settings and restricting data sharing can offer some protection, but it doesn't
offer you protection from the main thing we're concerned about, which is the owners
and operators of TikTok and what they would do with the information.
I always encourage device separation.
So use a separate device strictly for TikTok.
and this can isolate potential risks from work or personal devices.
But again, TikTok learns from where you're visiting, what you're watching, how long
you stay on something, where you are.
I mean, it looks at all of those things.
So keep in mind that device could be exposed.
So be very cognizant of what is actually on that device in addition to TikTok.
And I would say have some critical awareness, maintain a critical eye on all
the content that's encountered and verify the information.
Make sure it's coming from a credible source.
I mean, that's pretty important.
So alternately, there's some industry specific platforms.
So you could go to what I would consider more secure platforms that
that specifically cater to cybersecurity professionals.
But that's if you're interested in using it for that purpose.
I think what I see is a lot of people use TikTok for relaxation or they use it for
entertainment.
But just observing my family members, I actually don't let my children install or
leverage TikTok.
for a lot of the reasons that I discussed.
So I think just being aware of what you're after.
So if it is entertainment, I think there's a lot of other options.
I actually see a lot of the things that make it to TikTok, they show up on other
platforms now.
Maybe it's not as fast, but it does happen.
And then, if I'm looking for an alternative, let's say I'm...
researching something, I don't necessarily think TikTok's the place because you're
never quite sure about the authenticity of the information.
So there's other places that I could get cyber information.
There's a bunch of blogs, there's a bunch of websites, and we'll talk about some of
those throughout the podcast because I think it's important that we're all armed
with some good information.
So if I'm going to conclude.
this segment, I would say, whether cybersecurity experts can safely use
TikTok, it ultimately depends on their individual risk assessment, risk
tolerance, and their mitigation strategies.
So while potential risks do exist, I think careful engagement, utilizing the privacy
settings,
alternate sources, that can help manage some of the risk.
And I would say, if I'm after specific information, there's other places that I
could go for it.
So again, it's up to the individual.
And if I am a influencer, let's say I'm a cybersecurity influencer, I don't know if
I've hit that status quite yet, but once I do, are you gonna find me on TikTok?
you won't.
But I feel that there are other platforms that are more appropriate for that
outreach.
So I'll just leave it there.
I think there's going to be some heated debate about this one.
And I'd love to I'd love to chat more about it.
So let's move on to the second of our topics for this week.
Will cybersecurity breaches be worse this year?
And I see several factors that suggest a very high likelihood of a continued or
even an increase in the threats as well as the breaches.
So if I'm looking at it, I mean, we really have a growing attack landscape.
There's evolving tactics.
Attackers are constantly innovating.
They're exploiting new vulnerabilities.
they're developing more sophisticated techniques.
And as we talked about in previous shows, those attacks are now AI powered.
You can put together a much easier social engineering scam.
I see a lot of this with help desks where they're getting socially engineered and
saying that someone is a user, they're unlocking accounts, they're reissuing
keys, they're just doing un...
natural things the way we would consider it unnatural but to them they don't
actually know what they are dealing with they think it's a real person so I think
we're going to continue to see ransomware being a significant concern because of the
money aspect I also see an increased attack surface so there's a growing
reliance on digital technologies
cloud computing, interconnected devices, and that just expands the potential entry
points for attackers.
I think another one is geopolitical tensions.
There is a lot going on, and I think cyber warfare, state-sponsored attacks, they're
on the rise.
And I'd say adding another layer of complexity to
the threat landscape is just all of the different conflicts that are, I think,
starting to spill over into allied countries with what's happening with
Russia and Ukraine, with what's happening in Israel.
There's a couple of others that I would mention, but I think these are the ones
that are of most interest for this year.
I continue to see vulnerable infrastructure.
all over the place.
Outdated software and systems, a lot of organizations, they still rely on outdated
technology with known vulnerabilities.
And that makes them easy targets for attackers.
And I know you're thinking, well, why don't they just patch their stuff?
Why don't they just do, why don't, why don't?
Well, I ask that question every day and I still don't have a good answer because
it's different for everyone that I talk to.
Human error, I mean, fishing attacks, social engineering scams, they continue to
exploit, I would say, the most vulnerable, which is the human.
And that is a significant risk.
Lack of cybersecurity awareness, I mean, insufficient awareness and training in an
organization, it can leave them completely unprepared to handle cyber threats.
And then...
the rising financial incentives.
I mean, cryptocurrency popularity, that was a big boom, 21, 22.
I think 2023, we saw a bit of a dip as far as how lucrative it is.
However, that's still the currency of the cybersecurity attackers.
And I think it will continue to be, and we'll see a resurgence of crypto.
I think it's just where it's, it's where finances are going.
How long it takes us to get there.
I think that remains to be seen, but monetizing data I'd say is another area of
that rising financial incentive.
So it could be personal data.
Could be corporate data.
It it's valuable.
It's a commodity now and attackers steal it so that they can sell it because
someone on the dark web is going to buy it for whatever purpose.
And those purposes are typically nefarious.
And then I'd say the crown jewel of all of this is ransomware, the ransomware
payouts.
It continues to be successful.
Ransomware attacks.
and the incentives, they further develop, and the deployment of the tactics keep
getting better.
And it's interesting, because this is a polarizing topic when I talk to people
about, hey, should we pay the ransom?
And that is a very personal question, because I listen to enough cybersecurity
practitioners that say no.
because if we stop paying the ransoms, then it's not lucrative anymore.
And those types of attacks will go away.
We'll essentially starve them out.
But the challenge with that is in some instances, a business would cease to exist
because they didn't do enough upfront to protect themselves or to recover from that
type of an attack.
So I think we could.
go pretty deep on that.
I think we'll have another show where we'll do that, where we'll talk about
resiliency and what organizations can do.
Because I think if enough of us are prepared, then we can wage an offensive by
being defensive.
And the next thing you know, ransomware will be a thing of the past because
granted we will have an impact, but should we pay the ransom at that point?
because we're ready for it.
So I think some of the things that we can do this year as potential countermeasures,
because I never liked doom and gloom anything, I think three things, improve
cybersecurity awareness.
So increase the awareness and training.
I know we all look at it all the time and say, oh, my users just don't get it,
they're not doing it.
Keep at it.
I think we can significantly reduce the human error and how susceptible we are to
social engineering attacks.
We just have to stay consistent.
And there are statistics of how many times somebody has to see something before it
really sticks.
And it's a lot.
And our attention spans are getting shorter and shorter.
So what I've done with our own program is I've made it more bite-sized.
So instead of the 45 to an hour training, I'm trying to do the fives, the tens, the
15 minute trainings, that I just do it more often.
And that's been well received by my users.
Investing in cybersecurity tools and infrastructure.
I mean, organizations that prioritize cybersecurity and invest in tools, and you
can look at it as still firewalls,
intrusion detection, endpoint detection response, those types of systems, I mean,
they still strengthen the overall defenses.
Now, you'll hear me talk a lot and am I still a big fan of firewalls if it's a
perimeter implementation?
Not so much.
I'm more of bringing security closer to the endpoint, closer to the application
and closer to the user, but there are still firewalls in play.
It's just how they're-
And then I'd say the third countermeasure this year would be collaboration and
information sharing.
So threat intelligence is still one of the best practices within the cybersecurity
community.
Because if we're all being attacked and we stay silent and we're not sharing the
information, how we mitigated it, how we detected it, then the attackers are going
to win.
So making sure we share amongst ourselves and we have that good threat intelligence,
everyone needs to invest in Threat Intel.
So however you're getting that information, we could again have a whole
show about that, but there's a lot of options and happy to discuss any of those
with listeners.
So speaking of Threat Intel, let's wrap up this show with our third topic.
which is the MITRE ATT&CK framework, and is it really that influential?
So for those of you that are new to MITRE ATT&CK, let's kind of look at it from the
lens of just the simple high level.
So MITRE ATT&CK is like a cybersecurity map of attacker tactics.
So...
It outlines the common ways attackers operate, and that could be sneaky
reconnaissance to deploying malware.
And it makes it easier for defenders to understand their potential opponents.
So think of it as a shared language and playbook for cybersecurity.
It's helping everyone speak the language against cyber threats, and it's really the
same language.
So we all kind of understand where it's coming from.
It's constantly updated, just like maps when they get a new road or a new
landmark.
And what it does is it reflects new attacker tricks and it helps keep our
defenders up to date and you could say on their toes.
Now, I would say MITRE attacks influence in the cybersecurity world, it's
undeniable.
48% of organizations use MITRE ATT&CK and they use it extensively.
And that's for security operations.
And a lot of that has to do with the endpoint detection response platforms.
They're basing a lot of the way they do things on MITRE ATT&CK.
And then there's another 41% of organizations that are using it to some
degree.
So if I'm looking at that from influence, that's a lot of percent.
I mean, that's pretty close to 100.
But 19% consider it critical to their future security strategy.
And 62% see it as very important.
So if I'm reading the statistics, it's a good base level framework, but not enough
for seeing it as a critical component to their future security strategy.
And I think that's a bit of a miss.
because it really is a great map and way of understanding attackers.
And there's a concept of the kill chain.
And if you look at how attacks are started and how they end, you can follow it just
like a playbook.
These things are real and attackers do follow step by step because it is a chain,
it is a process.
It's typically a nefarious process, but it is something that we can still understand.
Now, if I look at the impact on the industry, what has MITRE done for us?
It's done one of the best things, which is standardizing the language.
So we can all look at it.
We can all see it.
It's a common framework.
And it describes the attacker tactics and the techniques.
It fosters better communication.
And really that whole collaboration across the cybersecurity community.
There's improved threat detection because of it.
And that's because we understand how the attackers operate.
And we can develop more effective defenses and detection mechanisms because of that.
And I mentioned this before, but it's really having informed security tooling.
So the vendors that
are creating cybersecurity tools and defense software, they're aligning their
products and their services with MITRE ATT&CK and the MITRE ATT&CK framework.
So really it makes them more relevant and effective.
And I would also argue that MITRE is driving innovation.
So there's continuous updates to the framework and that's key because
Our attackers are evolving, MITRE is evolving.
And that's what we want.
We want a parity and to keep pace with each other because it's not going away.
Benchmarking and testing.
So this is something that I was really missing.
If you all remember NTT back in the day, they would test a lot of different
software and we could get some scoring based on how the...
cybersecurity tooling performed in the real world.
Well, MITRE has put on that superhero cape and they're doing something very similar,
if not a little bit better.
They're doing benchmarking and testing.
So it provides a way to measure an organization's security posture against
known threats, but they are also testing in an environment a lot of different
tools, and then they're giving us scores, which is great.
So.
If you're interested in that, hit the MITRE website, take a look at it.
And I think the way that we are going to survive this new age of AI is how MITRE is
open source and collaborative.
So it's freely available, it's openly developed, and its goal is to foster that
collective spirit in the cybersecurity community.
So I've always looked at it as we are better together.
I'm a big fan of the crowd movement.
That's a little old now by the standards, but still it is our best chance against
attackers.
So overall, MITRE ATT&CK, it's become a cornerstone of modern cybersecurity.
I think its influence can be seen in its widespread adoption.
The impact that it's had on the industry
and the ongoing innovation that it drives.
So I would give you a counterpoint to, it is highly influential, but it's not a one
size fits all solution.
I mean, you need to look at it and adapt it to your specific needs.
And I think that some organizations struggle because of their particular
threat landscape.
It may not be fully compatible, but I think you're still...
You're still doing something which is better than nothing.
I would say some critics, they argue that MITRE ATT&CK focuses too much, I don't
know if you can possibly do that, but they say too much on advanced persistent
threats.
And that is something that may not be as relevant to smaller organizations because
they're getting hit by more of the drive-by, the botnet, because...
advanced persistent threats typically need resources and are very targeted and
directed so they go after what we call the bigger fish or their wailing a lot of
smaller organizations they just get hit by kind of more of the automated stuff and
it's like casting a wide net and seeing what you get that's more of how those
attacks are and miters is good but not amazing for that
there's other frameworks that I think are a little bit better.
And I think some of the smaller organizations should be focused just on
the basics, which is like a CIS 18 or a NIST CSF type of an approach, but we could
talk about that later.
And then I would say, you know, despite some of the limitations that you could
mention, it's still, Mitre ATT&CK is still valuable.
and it's a great tool for any organization.
And I'll say this in quotes, that is serious about cybersecurity.
So I hope this information gives you a good understanding of MITRE ATT&CK and the
influence in the cybersecurity world overall.
Well, thanks everybody for spending some time with me and e360 Security.
Have a great rest of your day.
Good stuff.
Knocked that out in about 26 minutes.
I think it's a good digestible length.
Okay, I'm gonna stop this recording, but while I have you, I think we should do.