CyberWire Daily - US midterms conclude without cyber interference. NATO on cyber defense. New APT41 activity identified. Russia’s FSB and SVR continue cyberespionage. Trends in phishing and API risks.

Starting point is 00:00:00 You're listening to the Cyber Wire Network, powered by N2K. Air Transat presents two friends traveling in Europe for the first time and feeling some pretty big emotions. This coffee is so good. How do they make it so rich and tasty? Those paintings we saw today weren't prints. They were the actual paintings. I have never seen tomatoes like this. How are they so red? With flight deals starting at just $589, it's time for you to see what Europe has to offer.

Starting point is 00:00:31 Don't worry. You can handle it. Visit airtransat.com for details. Conditions apply. AirTransat. Travel moves us. Hey, everybody. Dave here.

Starting point is 00:00:44 Have you ever wondered where your personal information is lurking online? Like many of you, I was concerned about my data being sold by data brokers. So I decided to try Delete.me. I have to say, Delete.me is a game changer. Within days of signing up, they started removing my personal information from hundreds of data brokers. I finally have peace of mind knowing my data privacy is protected. Delete.me's team does all the work for you with detailed reports so you know exactly what's been done. Take control of your data and keep your private life private by signing up for Delete.me.

Starting point is 00:01:22 Now at a special discount for our listeners. private by signing up for Delete Me. Now at a special discount for our listeners, today get 20% off your Delete Me plan when you go to joindeleteme.com slash n2k and use promo code n2k at checkout. The only way to get 20% off is to go to joindeleteme.com slash n2k and enter code n2k at checkout. That's joindeleteme.com slash N2K, code N2K. Election Day has come and gone, and there's no sign that cyber attacks affected U.S. vote counts. NATO meets to discuss the Atlantic Alliance's cyber defense pledge. A new APT41 subgroup has been identified.

Starting point is 00:02:13 FSB phishing impersonates Ukraine's SSCIP. A look at Cozy Bear's use of credential roaming. Caleb Barlow shares tips on removing implicit bias from your hiring process. Our guests are Valerie Abend and Lisa O'Connor from Accenture with a look at the difference in how women and men pursue the top cyber leadership roles. And an update on phishing trends and API threats. From the CyberWire studios at DataTribe, I'm Dave Bittner with your CyberWire summary for Thursday, November 10th, 2022. So the U.S. midterm elections are all over. There's still some counting to be done, but it appears that no effective cyber attacks on election infrastructure materialized. Jen Easterly, director of the U.S. Cybersecurity and Infrastructure Security Agency,

Starting point is 00:03:26 said yesterday, we have seen no evidence that any voting system deleted or lost votes, changed votes, or was in any way compromised in any race in the country. Minor DDoS incidents were reported in a few jurisdictions, the PBS NewsHour reports, but these seem in no case to have affected the voting infrastructure itself. In particular, the Russian interference Yevgeny Progozhin promised at the 11th hour didn't show up. Seems the Yankees do indeed have the goods on him, to the extent that he's been sanctioned and that he's made an appearance on American Wanted posters. We trust Mr. Pogosian is taking his vacations in a nice place where there's no extradition treaty with the U.S. Representatives of NATO's member countries have been meeting in Rome yesterday and today

Starting point is 00:04:17 to review and renew the Atlantic Alliance's cyber defense pledge. Most of the proceedings have been closed to the public, but the U.S. State Department announced yesterday that cybersecurity for the energy sector is figuring prominently on the agenda, and some of this morning's keynotes are publicly available. We sat in virtually on one of them by U.S. Deputy National Security Advisor Ann Neuberger. She began by noting that NATO has remained relevant as the world and the technology in it have evolved. NATO has consistently evolved to face these forces of modern technology. Indeed, in 2016, our leaders came together and committed to ensure, and I quote, the alliance keeps pace with the fast-evolving cyber threat landscape

Starting point is 00:05:06 and that our nations will be capable of defending themselves in cyberspace as they do in air, on land, and on sea. She stressed that recent experience has highlighted the importance of cybersecurity preparedness and partnership. Through his brutal war in Ukraine, Putin sought to split NATO. But thanks to our close work around this table, he will get exactly the opposite – a more unified NATO, stronger defenses, and a more resolute transatlantic community. We have seen in Ukraine the importance of preparedness and strengthening our cyber defenses before attack. Ukraine has in many cases been able to successfully defend against sophisticated cyber attacks due to the work that was done before the Russian invasion this past February.

Starting point is 00:06:00 Ukraine took to heart the lessons it learned in 2014 about the power of cyber attacks in modern conflict. Through partnerships with many of the countries in the room, as well as with the private sector, Ukraine has been able to continue to improve its cyber capability, and the world has been reminded of the importance of standing in support of partners when they are victims of cyber This is not only a wartime lesson. As Neuberger went on to say, effective international partnerships are necessary to defend against transnational threats, and such threats are endemic in cyberspace. We committed to developing a NATO capability to more effectively enable allies to help other

Starting point is 00:06:47 allies in their times of need. NATO, as Ms. Neuberger said this morning, is getting ready to welcome two new members, Sweden and Finland, but the Atlantic Alliance is also working closely with friendly nations who are well outside NATO's original geographical scope. Prominent among those friendly nations is Japan, which last Friday announced that it would be joining NATO's Cooperative Cyber Defense Center of Excellence. Beijing has taken note and isn't particularly happy with the development, seeing it as a fundamentally unfriendly gesture aimed at China. The South China Morning Post quotes a spokesman for the People's Republic's Foreign Ministry

Starting point is 00:07:30 who complained, The Asia-Pacific region is not the geographic domain of the North Atlantic, and there is no need to establish an Asia-Pacific version of NATO. The spokesman Zhao Lishan added, What we have seen is that in recent years NATO has continuously strengthened its ties with Asia-Pacific countries. What is NATO's intention? The international community, especially countries in the Asia-Pacific region, should maintain a high degree of vigilance. Researchers at Trend Micro have identified a

Starting point is 00:08:04 new subgroup of ABT41, the threat actor associated with the Chinese government. They're calling the group Earth Long Xi and attribute two long-running campaigns to it, stating, since it first started being active in 2020, Earth Long Xi's long-running campaign can be divided into two based on the range of time and toolset. During its first campaign, deployed from 2020 to 2021, Earth Longji targeted the government, infrastructure, and health industries in Taiwan and the banking sector in China. In its second campaign, from 2021 to 2022, the group targeted high-profile victims in the defense, aviation, insurance, and urban development industries in Taiwan, China, Thailand, Malaysia, Indonesia, Pakistan,

Starting point is 00:08:53 and Ukraine. Spear phishing has been the primary attack vector. Ukraine's State Service of Special Communications and Information Protection warned yesterday of a phishing campaign that's sending malicious emails impersonating the SSCIP. They stated, specialists from the government's computer emergency response team of Ukraine have recorded a mass distribution of emails with malicious links allegedly under the name of the State Service of Special Communications and Information Protection of Ukraine. This activity is associated with the hacker group UAC-0010, Armageddon. As the warning goes on to note, Armageddon is associated with Russia's FSB. They are among the most active groups that have

Starting point is 00:09:38 been attacking Ukraine since the beginning of Russia's full-scale military invasion. Criminals are usually exploiting topics that are sensitive and important for Ukrainians. The most common payload the campaign delivers is an information stealer. Mandiant describes a cyber espionage campaign carried out earlier this year by APT29, Cozy Bear, a unit of Russia's SVR Foreign Intelligence Service. CozyBear fished its way into a European diplomatic organization's networks and subsequently abused Windows credential roaming feature. Mandiant says, the use of credential roaming in an organization allows attackers and red teams to abuse the saved credentials for the purposes of privilege escalation.

Starting point is 00:10:25 Two noteworthy trend studies appeared this morning. In the first, a study of phishing, security firm Tessian has found that 94% of organizations in the U.S. reported being targeted by spear phishing attacks in 2022. The majority of phishing attacks involved attempts to impersonate legitimate email addresses. And ransomware remains high on the list of what the spear phishing delivers. 92% of organizations reported that they'd been targeted by phishing emails that attempted to launch ransomware attacks, and 10% of respondents said their organizations had received over 450 email-based ransomware attacks since January 2022. In the second study, security researchers at Wallarm released their

Starting point is 00:11:13 Quarter 3 2022 API Threat Stats Report this morning, giving a look into this quarter's API vulnerabilities and exploits. Among the more interesting findings was how compressed the timeline has become between CVE disclosure and proof-of-concept exploit publication. They now tend to occur, the report says, on the same day, which should affect organizations' mitigation planning. That is, don't sleep on applying patches. And a final note for our listeners. Tomorrow is Veterans Day in the U.S., and a day marked for special remembrance in many other countries around the world.

Starting point is 00:11:53 We won't be publishing on the holiday, but we invite you, wherever you are, to spare a thought for all the veterans of all nations who've served with honor and bravery and in good faith. Coming up after the break, Caleb Barlow shares tips on removing implicit bias from your hiring process. And our guests, Valerie Abend and Lisa O'Connor from Accenture, have a look at the difference in how women and men pursue the top cyber leadership roles. Stay with us.

Starting point is 00:12:44 Do you know the status of your compliance controls right now? Like, right now? We know that real-time visibility is critical for security, but when it comes to our GRC programs, we rely on point-in-time checks. But get this, more than 8,000 companies like Atlassian and Quora have continuous visibility into their controls with Vanta. Here's the gist. Vanta brings automation to evidence collection across 30 frameworks, like SOC 2 and ISO 27001. They also centralize key workflows like policies, access reviews, and reporting, and helps you get security questionnaires done five times faster with AI. Now that's a new way to GRC.

Starting point is 00:13:27 Get $1,000 off Vanta when you go to vanta.com slash cyber. That's vanta.com slash cyber for $1,000 off. And now, a message from Black Cloak. Did you know the easiest way for cybercriminals to bypass your company's defenses is by targeting your executives and their families at home? Black Cloak's award-winning digital executive protection platform secures their personal devices, home networks, and connected lives. Because when executives are compromised at home, your company is at risk. In fact, over one-third of new members discover they've already been breached. Protect your executives and their families 24-7, 365 with Black Cloak. Learn more

Starting point is 00:14:23 at blackcloak.io. The team at Accenture recently published a report called Rising to the Top, which examines the difference in how women and men pursue the top cyber leadership roles and some hurdles to overcome. Joining me to discuss the report are two women in leadership positions at Accenture, Valerie Abend, Global Cyber Strategy Lead and Senior Managing Director at Accenture, and Lisa O'Connor, Global Lead of Cybersecurity R&D at Accenture. Valerie Abend is up first. As the Accenture Cybersecurity Forum Women's Council, our mission, and as we point out, there's a real challenge, particularly with these women in cyber,

Starting point is 00:15:13 at getting them to the top of the field and making sure that we have equal representation at that top level. Lisa, what's your perspective? Yeah, so it's funny because women are 50% of the workforce, yet in cybersecurity, we're 25% of the workforce. And if you really look at the women in leadership roles, we're going down to 17%. And so we have a talent problem in keeping diverse talent in cybersecurity. keeping diverse talent in cybersecurity. And that has a real impact for us in terms of innovation, in terms of creative teams and creative teams that can keep up with the adversary. So this is a real intrinsic problem to cybersecurity talent at large and how we're ready for national defense and for defending our companies. I think it's fair to say there's recognition that this is an issue. And as Valerie

Starting point is 00:16:06 mentioned, there have been efforts to address this. I mean, is this a matter of sometimes things just take time or is that an excuse? Well, I'll say that I think everybody has good intent, but what they need is more information about how to make this intentional and how that becomes part of the fabric of not just their talent recruitment and retention, but intentional on how they programmatically actually help them grow and get into the top spot. actually help them grow and get into the top spot. And that doesn't just happen by accident. That happens with really strong support,

Starting point is 00:16:55 sponsorship at the top of the house across the C-suite. And it happens by actually looking at what makes these programs successful and how you position diverse talent to actually get the visibility, get the mentorship, and actually get the opportunity to apply for, be recruited for, promote themselves into, voice their interest in being at that top layer of cybersecurity in the chief information security officer role. Lisa, why do you suppose that we're seeing this filtering happen? That even when women are taking their place in organizations, they're not making it all the way to the top. Right. That's exactly what we wanted to answer in this latest piece of research,

Starting point is 00:17:41 Rise to the Top. And that is really looking at how people, men and women, rise to the top position of CISO. So we studied that. We asked men and women about their journey to CISO. How did they announce their candidacy? How did they put their hat into the ring? What were the tactics that they used to go after those positions and to make their intentions known? And also, how did they get the CISO position? So tapping into the success of our ACF CISOs, men and women, we learned about some differences between how they rise and what tactics they use and what they overestimated and underestimated the importance of in that journey. And some of the insights from that are pretty startling.

Starting point is 00:18:27 We found that men were much more likely, 57% more likely to rise within the organization that they were already in, where women were much more likely to gain a CISO role outside of their organization and make their candidacy known outside. And that was kind of surprising. So we double-clicked on that and we looked at some of the other behaviors. Well, let's dig into that. I mean, what are some of the other insights that

Starting point is 00:18:53 you all discovered? Yeah. So one of the things, while men rose quickly, more directly, I should say, in their organizations, they did not rise more quickly. Women actually moved forward quickly within six months, secured a position where for men, it was more likely 12 months, which made us think and kind of said, well, why is that? These women are clearly very qualified. They're getting positions right away. What is it about their behavior or maybe how they're announcing their candidacy that they're overthinking this potentially and going through and looking to meet all the qualifications in those roles. So we have tremendously ready candidates, but they're making their candidacy known much later. Valerie, speaking about mentorship, I mean, what can some of the folks who have risen to those top levels, how do they make sure that they're not closing the door behind themselves?

Starting point is 00:20:07 attention, actually put it in your performance achievement goals that you are not only sponsoring somebody, which means giving them voice about how great they are in rooms that that person doesn't have access to, but also putting it into your succession plan. And that should actually be part of how we hold our senior executives accountable. Who is going to be the next you and how are you helping to sponsor and mentor that person and get support just even beyond you? I spent, as does Lisa, a lot of time not just with women and helping them get a visibility and understanding of what it takes to next level, but I actually introduced them to an awful lot of people who can also help them.

Starting point is 00:20:47 And I think that's incredibly important that they have a council of people who advise them as they get to the top. And that was actually one of our recommendations to the women is that you actually don't just depend on one person. You have essentially your own council of advisors. Lisa, where does this begin? I mean, is this a matter of, do we need to do better with outreach to young women who are

Starting point is 00:21:13 growing up or coming up through school to make sure they're exposed to role models, that they see this as a possibility? Absolutely. The sooner we are inclusive in our language and how we talk about these roles, how we talk about the cybersecurity industry, more people are going to see themselves in cyber. And that's so important for younger girls. Women, I remember when I was going through school, I was one of six women in a class of 120 engineers. And that we'd love to change, right? And we change that by really making sure our language is inclusive. We have leadership representation. We're showing

Starting point is 00:21:53 young girls and women what leadership looks like and showing that we're out there. The other part of it too, is we think about position descriptions. This is a simple one companies can do. When we're writing position descriptions, those should also be gender neutral without bias and putting the essential things in there that we need from a CISO. One of the things that we found in what women overestimated was the amount of technical skills knowledge that were needed for the role. Because what got you to this point may have been the technical, but what's valued in the CISO role is that problem solving, the communication skills,

Starting point is 00:22:33 the other things that are so relevant to the C-level and to the board. And so how we're writing those position descriptions is really important that we are able to align to the criteria and say, we got that and put our hat in the ring. That's Lisa O'Connor from Accenture, joined by her colleague, Valerie Aben. The report is titled Rising to the Top.

Starting point is 00:23:11 And joining me once again is Caleb Barlow. He is the founder and CEO at Silete. Caleb, it's always great to welcome you back. You know, we have this ongoing conversation about the challenges when it comes to hiring good folks in cybersecurity. And I know this is something that you've had your eye on lately. What do you want to share with us today? Well, you know, if we look at kind of the numbers here, we had, you know, 1 million open security jobs here in the U.S.

Starting point is 00:23:34 It's now down to about 700,000. And that's a stat from CyberSeek.org, right? Which, you know, we've mentioned that site before. It's a great site to go check things out. Well, okay, 700,000 open jobs. There's 1 million employed people in the United States in cybersecurity. So you can go run the ratios here. We can't fill the jobs. But here's what's also interesting, Dave. We talk about problems like diversity. We need to bring more women into the workplace. We need to bring more underrepresented minorities in the workplace. And I think we're doing a better job. We're

Starting point is 00:24:07 certainly not there yet, but we really have an accessibility problem in cybersecurity. You know, if I get calls from recruiters all the time, we're like, hey, Caleb, I've got a tough role I'm trying to fill. Do you know anyone in your network that meets this criteria? And I'm like, well, what's the company looking for? And they'll go down this list that is almost comical. Hey, I'm looking for a threat hunter. I want him to have 20 years of experience. Okay, first of all, no threat hunter has 20 years of experience. I'd like to have worked for a Silicon Valley company before, like a Facebook or a Twitter or someplace where they really understand growth. And, oh, and it'd be great also if, you know, they're a diverse candidate.

Starting point is 00:24:50 And you sit back and kind of laugh and you're like, you are never going to find that person. And if you do, it's going to cost you a fortune, right? What I don't hear happening is people going out and saying, hey, you know, I need someone that has this type of background, this type of experience, you know, like a threat hunter. I need someone with really good investigative skills that's really good at repetitive tasks and, you know, is a self-starter and self-motivator. Okay, that's probably looking for somebody you're going to find that's going to be very successful in the role. And the issue here is often implicit bias, right? We have this idea of what the ideal candidate looks like. And I would argue that we could fill those 700,000 open jobs if we started

Starting point is 00:25:35 thinking as companies about accessibility. How accessible are we to looking at people that might be one degree of separation from perfect? How accessible are we to say, hey, let's go hire somebody that maybe is going to need three months of training? And part of the problem here is we arm up recruiters in the words we use. So if you say something like, if you pitch to a recruiter, hey, I want a high energy individual with that Silicon Valley experience, what they hear, if they hear high energy, they hear, oh, it's got to be under 30. They hear Silicon Valley experience, you know, what they hear, if they hear high energy, they hear, oh, it's got to be under 30. They hear Silicon Valley experience,

Starting point is 00:26:09 they limit it to a few companies, right? And unfortunately, what happens is the person doing that sorting of resumes often doesn't have cybersecurity experience. They're not the partner you talk to on the phone. Or it's even automated, you know? And so people don't even make it to having a human being look at the candidate. And what's happening here is the implicit bias that you unwittingly have forced into the system is sorting resumes.

Starting point is 00:26:40 So here's a couple of things that I've been trying lately that seem to really work. And these are going to sound a little bold. First of all, take your pool of resumes, however you get it, and remove all photos from the resumes. The minute you remove photos, you remove so much implicit bias because you don't see age. You don't see, you know, ethnicity. You don't see, you know, whether somebody's male or female. Also remove the names from the resume.

Starting point is 00:27:07 Do you really care what somebody's name is when you're hiring them? No. But again, you remove the ethnic or, you know, kind of whether someone's male or female the minute you remove the names. Now, add them back later in the process because you need to know who to call. But in that first sort, get rid of the pictures, get rid of the names, and remove all experience over 10 years old. And honestly, do I really care where you worked 10 years ago? But what happens again is whoever's doing that sort picks up the resume, looks at the experience and goes, oh my gosh, this person's in their 60s. Or maybe this person's even in their 40s. Forget it, right? Look at the last 10 years. What has the person's in their 60s or, you know, maybe this person's even in their 40s. Forget it, right?

Starting point is 00:27:51 Look at the last 10 years. What has the person done in the last 10 years? And, you know, if you really want to get into this too, remove, you know, remove school and degree. I mean, and this one's a little more controversial because some people will tell you, hey, look, you know, we know that there's certain backgrounds, certain degrees that are going to really empower people. But again, I think if you think about accessibility, I don't really care whether someone has a degree in electrical engineering, computer science, or they figured it out after five years of working at the FBI and they figured cybersecurity out and they've only got a GED. I don't know if I really care. So if you remove those things from the resume, what you have is someone's capabilities and experience and use that for your first sort

Starting point is 00:28:32 to get rid of that implicit bias. You know, I remember speaking with someone who had a whole lot of success recruiting folks who had a background as a jazz musician. And he said, because they are used to collaborating in real time with a group of like-minded people with a varied set of skills, right? And they have great improvisational problem-solving skills. And they have imagination. Right. Yes, they are creative people. And it doesn't take as long to train people up as I think a lot of people think.

Starting point is 00:29:07 Would you agree with that? Well, here's a good example. Let's take a sales manager, right? Yeah. You know, I get this one all the time. Hey, I'm looking for a sales executive. They need to have, you know, they've got to be a great team builder and mentor. They've got to understand the sales process.

Starting point is 00:29:24 They've got to be great at cadencing their people and teaching them. And they need to have all this cybersecurity experience. And I'm like, really? Because the problem is, you just limited your scope of people to a very narrow pool the minute you told me that they've got to have, and most people say, well, they've got to have cybersecurity experience on Threat Intel. I'm like, okay, that probably limits it down to about five people in the universe. Really, maybe we should go with this and say, go find me an exceptional sales leader

Starting point is 00:29:55 that's maybe worked on some other technology product and let me onboard them over the course of four or five months where they're going to learn the cyber piece of this. And if you go hire the right kind of skill that knows how to learn new things, that's probably going to be an exceptional sales leader. But what do people do? They go out and hire that person that has the skill. They pay twice as much money for them. And they leave in a year and a half because your buddy down the street at the other company is after the same thing and they go recruit them away for you and everybody just keeps paying them more money.

Starting point is 00:30:28 Yeah. We need to move away from that rockstar mentality, I think, in a lot of areas. Well, again, it comes back to accessibility. And maybe we need to retool the metrics where, you know, the metric today is we're often looking at underrepresented minorities when we look at hiring. And we should still look at that. But maybe the bigger metric needs to be, let's look at how many people we've moved into the field in our hiring. And my guess is, if you focus on that, you're also going to fix your personal problem. All right. Well, Kayla Barlow, thanks for joining us. Cyber threats are evolving every second, and staying ahead is more than just a challenge.

Starting point is 00:31:24 It's a necessity. That's why we're thrilled to partner with ThreatLocker, a cybersecurity solution trusted by businesses worldwide. ThreatLocker is a full suite of solutions designed to give you total control, stopping unauthorized applications, securing sensitive data, and ensuring your organization runs smoothly and securely. Visit ThreatLocker.com today to see how a default deny approach can keep your company safe and compliant. Clear your schedule for you time with a handcrafted espresso beverage from Starbucks.

Starting point is 00:32:04 Clear your schedule for you time with a handcrafted espresso beverage from Starbucks. Savor the new small and mighty Cortado. Cozy up with the familiar flavors of pistachio. Or shake up your mood with an iced brown sugar oat shaken espresso. Whatever you choose, your espresso will be handcrafted with care at Starbucks. And that's The Cyber Wire. produced in Maryland out of the startup studios of DataTribe, where they're co-building the next generation of cybersecurity teams and technologies. Our amazing CyberWire team is Elliot Peltzman, Trey Hester, Brandon Karp, Eliana White, Puru Prakash, Liz Ervin, Rachel Gelfand, Tim Nodar, Joe Kerrigan, Carol Terrio, Maria Vermatsis, Ben Yellen, Nick Bilecki, Gina Johnson, Bennett Moe, Catherine Murphy, Janine Daly, Chris Russell, John Petrick, Jennifer Iben, Rick Howard, Peter Kilpie, Simone Petrella, and I'm Dave Bittner.

Starting point is 00:33:12 Thanks for listening. We'll see you back here tomorrow. Thank you. AI and data products platform comes in. With Domo, you can channel AI and data into innovative uses that deliver measurable impact. Secure AI agents connect, prepare, and automate your data workflows, helping you gain insights, receive alerts, and act with ease through guided apps tailored to your role. Data is hard.

Starting point is 00:34:01 Domo is easy. Learn more at ai.domo.com Learn more at ai.domo.com. That's ai.domo.com.

CyberWire Daily - US midterms conclude without cyber interference. NATO on cyber defense. New APT41 activity identified. Russia’s FSB and SVR continue cyberespionage. Trends in phishing and API risks.

There aren't comments yet for this episode. Click on any sentence in the transcript to leave a comment.