Threat Horizons With Google Cloud's Charles DeBeck

at Google Cloud. So we'll be talking about the most recent report that Google Cloud put out on Threat Horizons and we'll also go into some of the more general questions around cloud security resilience and what's over the horizon for the horizon. Charles, thank you for joining us. Thank you so much for having me. Excited to

to take proactive steps on their side to better protect themselves. So that's the overarching goal and objective of the report. When we're looking at cloud environments. What are cloud environments? What is serverless architecture? The concept here is convironances. They allow for abstraction. It's all about abstracting out from a base layer and removing a lot of the concerns or organization around some of those lower level functions by allowing a third party to

help augment that for you. So that's, that's fundamentally what I would argue a cloud environment is used for. And then serverless is just sort of the next step in this process where if you have a site that you're running or if you have a service that you're running, if you don't want to have to worry about maintaining a server at all times and having that consistent uptime and runtime available, you can use serverless architecture to help spin up activity and spin up capability when you need

it, but when you don't need it, then it just spins back down again. So it can reduce your costs, reduce your burden both organizationally as well as technologically. And it just makes things a little bit easier for organizations who are trying to want to stand something up but don't want to have to really invest heavily and having their own server farm set up to do so. Excellent. Thank you. And clearly it

wherewithal and the resources and the technical expertise to do so. So I might want to pull on that thread a little bit, but I don't want to get too far away from your report because what I find great about this is that it's bringing empirically based evidence, it's bringing some science to the art of cybersecurity decision making. And I mean Google Cloud clearly has a lot of data to be able to

tease out. Do you want to maybe start sort of premise in terms of some of the key findings in terms of the threat environment and basically the exact summary of the report, if you wouldn't mind jumping into that. I think if I summarize

or services. When threat actors are in these environments, once they break into a cloud environment that organization is using, we see them doing one of two things primarily. First is sort of what I call smash and grab, which is crypto mining activity. They go in, make a bunch of noise, just take whatever money they can get and leave. The other option being more of the low and slow, taking advantage of having

that environment access to engage in lateral movement into other organizations subsequently. So I think those are kind of the main things that we see them doing once they're there and once they get on the inside otherwise. For the exact summary, I think the key things I'd cover is for this particular issue we looked really hard at what threats were seen to serverless environments and how threat actors are taking advantage of serverless

architecture to leverage that for their malicious activities. And this is definitely a space that we see threat actors moving into. Across the board, though, I think the big takeaway is that threat actors are very much aware the cloud environments are where things are

going. I think this trend has been going on for the last three to five years and as organizations, as companies and larger organizations have started shifting more of their resources into cloud environments, threat actors have followed that and have seen that shift and are doing the same shift at this time. Awesome. Thank you. So let's pull the

and frequent. So seeing that this credentialing issue still remains a problem to me as a security professional, it's pretty frustrating. But that said, I think the time to retendency issues here are not necessarily because organizations don't want to do what's right, but simply

because somebody wants to do something quickly or easily. They'll just, they say to themselves, I'm just going to quickly spin up an instance, a quick testbed instance to try this thing out, and then I'll spin it back down again, not realizing that even in that very short time of life, that's enough time for threat actors to break in and take advantage of that environment before it gets spun back down. And that

could lead to potential negative impacts to the broader organization. And so I think it really comes down to well meaning folks who are trying to get the job done as effectively as possible, unfortunately opening the door to these potential attacks. I don't think these days, whereas historically five years ago it might have been because organizations weren't instituting

protections, I think today it's more so because organizations, our institution's protections. But folks just make mistakes in the moment and it's that momentary mistake that can really cost an organization. Roger that. And I mean the old ADAGE it's always too much until the

organizations compared to the much more simple version of credential challenges. So I think the misconfiguration having such a high ranking to me makes sense. And again, this is one we've seen for a long time. But I feel at least that this level of activity is more justifiable just due to the cost and challenge of being able to

effectively stamp out misconfiguration challenges. Roger that. And crypto mining. Crypto mining remains one of the top ways for organization for threat actors to take advantage of access to cloud environments. It frankly makes sense if you're a threat actor and you break into a cloud environment, you have access to a giant pool of resources that could be used

for crypto mining. It's the easiest way to turn illicit access into money. And at the end of the day, if you can't buy a PS4, why are you even doing cybercrime anyways? The whole point of criminal activity is to return a profit. And so crypto mining is a very practical, quick and easy way for an actor of any sophistication level to turn access into money. So I think we're going to continue to see this in the future. And before jumping sort of to the threats to

understand what security capabilities or protocols are already in place within that environment. You know, cloud service organizations like Google and like others invest a lot of time, effort and money in making sure that people are able to take advantage of the different, of the different capabilities that are there and have security tools already built into the environment

which can allow for very effective defense in place. Additionally, one very easy thing that I always recommend to organizations is to make sure you have alerting in place based

on resource usage. So if a crypto miner gets spun up and suddenly you're using a whole bunch of resources that should trigger something somewhere in your environment that shouldn't be happening for a week and then you find out about it that should be happening for an hour and then you get an alert, especially if it's way more resource usage than you've ever used historically. So there's some really basic steps that can

be taken, I think to help provide those sorts of levels of protection. But that again, I'd reference the report here. There's a lot of good information in there. Great.

held secret. Obviously. And the concern that we had when we were doing this research investigation was that if organizations weren't looking for this sort of hard coded secret information, it would be easy to overlook. But from a threat action perspective provided a very effective key for them to use to take significant advantage of the organization. So this is something that we're really trying to draw attention to for organizations to look into

as a way for them to better protect themselves. And how often are you seeing

in particular there that you think is worth discussing? And unrelated to the report, I would like to add a question around bulletproof hosting and what some of your concerns are there. If you'd be willing to share your thoughts. Sure. I'll talk briefly about

whatever level of malicious activity they want to engage in. As you were talking about bulletproof hosting as well, I will say as a threat intelligence practitioner, one of my it's a consistent thorn in our side where we see threat actors using these sorts of servers that are outside of any effective jurisdiction of law enforcement for any variety

of reasons. And that sort of activity can be really challenging and frustrating because you can see where all the bad stuff is happening and you can point directly to it and say, look, there's a bunch of bad stuff happening right over here, but at the end of the day, nothing can be done about it. There's just not

a lot more that you can do for that. The one advantage to studying and researching bulletproof hosting services is I do think when we shed light on that sort of activity, it does help reduce its effectiveness and efficacy as a threat actor, tool or infrastructure. But due to its very ephemeral nature, there's also a challenge that it's constantly shifting and moving, which makes everything more challenging overall. And I'm not going to

and consequence to our global economy, security and the like. So do think that, that the bulletproof hosting issue is an issue we'll be coming back to in sort of the days ahead. But how about best practices for security around some of this? And I know you captured some of those in your report and again we'll point people to read the report, but to sort of take some of the top waves of that. What's your thinking there? Well, I'd say some of my top recommendations when it

these policies well defined and enforceable? And are there actually teeth on these enforcements or is it, you know, just a nasty email that you get, which may. Which could just be summarily ignored. So making sure that there's effective organizational policies in place I

think is a good first step. Additionally, from sort of a technical perspective, making sure that you're doing a good job leveraging the existing security tooling in place within the cloud environments that you might be using is a good way for you to be able to take advantage of all the technical resources that were invested in creating that tooling so that you don't have to reinvent the wheel. That's part of the reason why you go with a big provider if they allow you to take advantage of

a lot of their tooling sort of natively, which is nice. Otherwise, I guess my other big suggestion would be to make sure that organizations are engaging in effective detective controls for malicious activity and saying if something bad were to happen, if a threat actor were to leverage our environment for subsequent malicious activity, or if a threat actor were to break into our environment and try to exfiltrate our valuable data, do we

have detections in place for that? How would we at least see that this is happening? Because the worst case scenario is that something bad happens and you have no idea until you read about it in the newspaper. I think that's what we want to avoid the most. And so figuring out a way to make sure detections are in place I think is absolutely critical. I'm really glad you brought that point, all

It's always easier, but keeping in mind it's never going to be foolproof. But I'm glad you brought those points up. And on the exfil side, what are you thinking there in particular that could trigger alarms? What I think is interesting here is when

could help with that sort of thing. But there's also solutions or policies in place that look not just for prevention of potential sensitive data leakage but, but just looking for different signs or indications of attempted exfiltration, whether that's at a network level, looking at where is this information being sent to and why it's being sent to a

server that's located outside of our geographic area. Or it could be something more application layer looking at, well, wait a second, why is this application requesting this data over here and sending it to that area over there that doesn't seem to track with

previous activity or sort of heuristics that we've developed. There's a lot of different ways that organization can try and detect exfiltration, but I do think it is critical because I think that's the direction we see threat actors moving in terms of what they're going to attempt to do once they're inside organizations. Roger that. You know, you can't

of the house. There's a lot of ways that we can leverage artificial intelligence to more quickly and effectively parse through large amounts of data and use that large data set to be able to draw conclusions and sort of bubble up the valuable security insights that we need to be effective. That's something that AI is inherently good at, is looking at big chunks of data and really distilling it into what. You need

produce phishing emails that are higher quality than you might have seen otherwise. So we're seeing some bits and bobs in terms of how threat actors could leverage AI in an adversarial way. But I don't think we've seen the fundamental tectonic shift that I think that we expected in terms of adversarial activity with AI just yet. I think that might still be down the line where we see something that really shifts the landscape in a real underlying way. But so far I don't think we've come across

that. And that's a great point. And as much as we can, we want to.

to exploit that. So you don't always know how to disprove double negatives and demonstrate success. But I'm glad you're thinking some of those issues through. Let's talk sort of serverless and distribution of malware and phishing campaigns. And I was surprised and actually pleasantly surprised that you actually named some names in terms of some of the activities Google Cloud has identified. So we can get into some of those. But generally speaking, I'd

be curious what your thinking is. And then if you wouldn't be willing to sort of get into whether it's info stealers or some of the other major incidents you saw. Yeah, so I guess going into that last question first here, I think when

they get their hands on. And partially due to the success, we've seen more and more threat actors get into this same game. Trying to figure out a way for them to make some quick money. I think that's really resulted in a significant shift in the overall landscape in terms of where threat actors are targeting. And as we've seen, that sort of focus shift from on prem to cloud targeting by threat actors that I mentioned before, the fact that a lot of these threat actors are engaging

in ransomware attacks has subsequently also made it so. The cloud. Cloud environments are heavily targeted by ransomware actors because the theory is that's where they can get the valuable data that they're looking to steal and use. I want to go back briefly and talk about something I mentioned before, which I think is an interesting trend in ransomware

of moving from an encryption model to an exfiltration model. Two, three years ago, if we were talking ransomware, we would have said that ransomware looks like you break into an organization, you encrypt all their stuff, and then you leave and you sell them the decryption key. That was sort of the business model, but that ran into a couple key issues. First off, it was decryption keys didn't always work, so that lost

a lot of reputation for them for threat actors. Second, it was really tough to convince people to buy this when they had good reconstitution plans because they just say, no, thank you, we'll just go back from backup. Thank you very much. And so I think that for a few different reasons, this became a very ineffective methodology. But what is still very effective from a threat actor perspective is exfiltrating valuable data and

then holding that for ransom on risk of public release. And that's, I think, where we're seeing threat actors really get good money and good payouts. And as a result, we're seeing that much more frequently. And I think that's the direction we're going to see ransomware go in the future is more toward an exfiltration model rather than an encryption model. So they're still being ransomed, but. But what's being held for ransom has

changed over the last few years, which I just think is kind of interesting. Yeah.

companies multiple times, either by the same perpetrator or those piggybacking them. So, yeah, I'd be curious if you Think if you think that's the case, or if I'm just cherry picking my findings there, I think it's a little. Bit tough because there's so

of criminal actors in this space. And if one person is able to effectively gain access to an organization, others sometimes try to pile on the same organization simply because they think, well, it seems like it's an easy enough target, we might as well

go for it and see if we get lucky. So I can't say definitively with statistics, but it wouldn't surprise me at all if there was a pretty decent stat around the number of repeat impacts we had, which should be a good wake of call to organizations that just because you're in the middle of an incident doesn't mean that you're not also potentially in the middle of your next incident as well if you're not putting up defenses as quickly as possible. That was exactly my point. Well

is the cultures are still very different in terms of our defenders. But anything you're seeing there that is worth sort of discussing on the OT environment and cloud in particular. Yeah, I think the interesting thing with OT IT is that the relevance and

we see in the OT space. And I think that it ot overlap and the transversal between IT and OT systems is going to continue to make it so that threat actors see potential value in targeting these systems because they'll be able to take advantage of, of the critical uptime and availability requirements that most OT systems have. Usually you can't just, you know, shut off a water pump for a little while and say, oh, that's fine, it'll get back on later. It's pretty, it's pretty time critical.

So it's. I think that we will continue to see this be an area of interest for threat actors. Similar though with some things we talked about previously. I don't think we've had a watershed moment in this space just yet where there's been a major incident that's led to significant profit for a threat actor. So from a criminal perspective, I think the one bright side in this realm is that we're not seeing a lot of threat actors engaged in targeting of these systems. I think primarily because

we're not seeing the profit motivation really panning out. But it will just take one. And then suddenly, after a successful ITOT breach that led to a lot of money, we could see a pretty significant run on this by threat actors across the board.

there. I thought that was a fascinating case study. Anything you'd like to share with the audience around that? Yeah, I think what's interesting about this was that it gets

be sent a link to as part of a phishing email. And then they would click on the link, go there, put their credentials in, and it was a credential stealing website that would then send that back to the threat actor after the users

put in their creds. Pretty standard stuff. But the twist here is since the threat actors were using a cloud environment as part of their infrastructural component, from a network perspective, this could have easily appeared as a legitimate set of activity for organization as expected, if your organization uses that particular cloud provider and there's a lot of interactions between your organization and that cloud provider on a day in, day out basis and

you're going back and forth doing stuff all the time. One more set of connections here wouldn't look particularly suspicious or malicious even to a URL you hadn't seen before. Your detection heuristics might not notice it because the cloud provides this veneer of legitimacy

to the malicious activity. And I think that was as partially the rationale for what happened here is the threat actors got into a cloud environment and then said, well, since we have this, this sort of fake appearance of being a legitimate hosting provider, because we're on a legitimate cloud environment, we can put up this malicious URL, we can take advantage of that, of this access to be able to take it, to

get access to other systems by using this veneer to their advantage. I think that's a big takeaway from a security perspective is understanding what the implications are from why a threat actor would use cloud environments and also what you might need to be considering when you're looking at your detective controls. It can't just be saying, oh well, if it connects out someplace bad, then it's bad. You're going to have to have

more in depth heuristics to look at. And I think you underscore the point and

to make smart decisions. Right? And, and I think that is why Google Cloud is, is putting out these sorts of reports because it is based on good information, good intelligence, and as much as we can have intelligence or empirically led decisions, the more the better in my eyes. Which is, which is great. Let me ask the unfair question and in the words of the late and great Yogi Berra, the future ain't what, what it used to be. Where do you see things going and looking over

the horizon for the threat horizon report? What do you, what do you think comes next? Well, I think we have an exciting, you know, six 12 months ahead of

these events as they occur, occur to further their criminal activities. I think from a nation state perspective, similarly, a lot of big events happening will mean that we'll see a real ramp up in nation state activity sort of across the board as part

of that, as part of their needs for intelligence organizations or what have you. And then I think we'll continue to see this weird blending of criminal activity targeting public and private sectors and really diminishing that seeming wall between historically targets that were just targeted by criminals versus targets that were just targeted by nation state actors. And I think we'll see that really continue to blend and merge into all organizations being targeted

by all for different reasons or different rationales. And I think that'll have a lot of impacts in terms of the security posture for organizations both in public and private sectors. That's a great point. In terms of proxies, in terms of understanding, you can't

more information. Hey Charles, thank you for not only spending so much time with us