Perpetual IT

[FX: MORSE CODE GREETING AND SYNTH VOICE]

PD. Hello, everybody – welcome to the Security SOS 2021 webinar series.

My name is Paul Ducklin, and today I am joined by Dr Jason Nurse.

Jason is an Associate Professor in Cybersecurity at the University of Kent.

And as you can see, today’s topic is the intriguing sounding “Cyberinsurance, does it help or hinder cybercrime?”

Tricky question!

So, Jason, to kick off, explain to us what cyberinsurance is, and most importantly, how is it similar and how is it different from the insurance we’ve all got used to on things like cars and houses?

---

JN. Thanks Paul, and thanks for those joining in to listen today.

So, cyberinsurance has jumped onto the scene for a few years now, but it’s actually existed for quite a while.

The general aim behind cyberinsurance is that it is insurance that covers things like IT incidents – in particular, things like security incidents.

That is how it’s probably much more well known these days.

But it can also cover things such as human error, loss of data and different things like this.

The general idea is just like with car insurance.

So, if you have car insurance or house insurance, you purchase this so that in scenarios where something bad happens, for example, you get into a car accident or, with the house, someone breaks into your home, or if there’s a flood or leak…

…the point is that the insurance provider is this party whom you pay premium amounts to, let’s say once every year or once every month, depending on your setup, and it allows you to call them up in the case of an incident and say, “Hey, this has happened. Can you support me through this?”

Support could happen in various different ways: for example, it could be financial support, so they help you to get back up on your feet in case of a cyberincident.

Let’s say there has been a break-in or loss of data – your insurance provider can put you in contact with, for example, forensics teams and incident response teams, and they can also help cover some of that cost around the incident.

So, the real aim and the real parallel is, you can think of it, businesses can think of it, as very, very similar to normal insurance that they might have.

And it really tends to be, or it tries to be, this one-stop shop, where if something happens, then someone can call up the insurer and the insurer can connect the business to the right parties to get the incident resolved and to get the company back up on its feet as quickly as possible.

But cyberinsurance – and this is where it’s probably one of the new novelty bits… it really tries to address the prominence these days of cyberattacks.

Where we’ve seen cyberinsurance grow and grow recently is in situations where there are cyberattacks where companies have lost data, they’ve been offline.

Their insurance provider is really going to help them get back up on their feet as quickly as possible – assuming that you have a relevant provider, you’re paying your premiums, and so on.

---

PD. I guess one of the most significant differences to think about from something like, say, car insurance… well, let’s say your car gets trashed. (Let’s hope you’re not injured.)

Then, in theory, if it’s a reasonably popular model, there’s a pretty good chance that if the car can’t be repaired, that the insurance company can find somewhere to buy the same model, with similar mileage, and basically put it in your driveway.

And you get the same car again as, it were.

But if you’ve lost your data, if it’s genuinely been deleted and can’t be recovered, then cyberinsurance can never have that result, can it?

It can’t magic your data back out of thin air…

---

JN. Yes, that’s completely true.

I think there are definitely a few different misconceptions around it.

And I think, in the context of situations such as the one you to described, Paul… the reality is that cyber nsurance can’t help you very much in those situations.

And it’s really important, when people are thinking about cyber insurance, to try to understand a bit more about what are the appropriate limits of what it can cover and what it can’t cover – for example, in some countries cyberinsurance doesn’t cover things like fines or regulatory penalties.

There are lots of ethical discussions around that and for good reason…

---

PD. …so that would be, if you had a data breach and you went to your insurance said, “All right, I just had to pay four million Euros.”

They’d go, “Well, bad luck, shouldn’t have broken the law!’

---

JN. [LAUGHS] Yes.

In some scenarios, yes, because some countries have basically said, in situations where you have been fined, let’s say GDPR fines or regulatory fines, if there’s been good reason or good evidence to show that, well, you did not do the things that you should be doing in terms of protecting people’s data, and therefore this resulted in the government or industry body fining you…

…then the insurer can turn around and say, “No, we’re not going to cover that because you should have had X, Y, and Z in place.”

So there are all types of discussion around cyberinsurance.

And really, in many ways, there is no “standardized” cover, so you can go to different parties and find different things available.

One key difference that I’ll mention, for those of you who are actually interested in cyberinsurance, is that there are two general types of policy.

One policy is what we call a “standalone policy”, nd the thing about this policy is that it is very much a separate policy.

So it’s very much like a house insurance policy or a property policy where it’s completely separate.

You go to a provider and you say, “I want to buy a standalone policy,” and the good thing about this policy is that it will tend to have more things included.

So, it’ll have more support in the case of a breach, and more things that they might give you, even as soon as you sign up to the policy.

But there are also “package policies”, and package policies are very much – if you know your house insurance policy – when you buy house insurance and the provider might say, “Oh, do you want to pay an extra five pounds a month, or five pounds a year, to cover your mobile phone as well?”

With package policies, you might have, say, a professional indemnity policy, and they say, “Oh, well, do you want to tack on a cyberinsurance add-on for this amount per year additionally?”

And the key thing about that is even though it has benefits, it does traditionally not cover as much as a standalone policy.

---

PD. I guess that’s because it’s a “one size fits all”, in the same way that if you wanted to insure your mobile phone against absolutely everything that could possibly happen to it, that’s unlikely to be done in a “just tack it on for five quid a year to your regular insurance.”

---

JN. Yes, that’s exactly it.

In scenarios where you’re just getting the add-on, you’re clearly not paying as much, and the reality is that you don’t get as much back from it.

You don’t get as much in terms of the claim amounts that you can make, the limits and so on.

Some package policies might not even cover popular attacks such as ransomware, which is rife at this point in time.

---

PD. Jason, I think that’s an opportune moment to move on to the second question about cyberinsurance.

That question: “Is it actually bringing with it, is it essentially the cause of, some cybersecurity related problems?”

The big criticism you hear indeed relates to ransomware, where your data’s gone, so if you don’t have backup then there is essentially no way of recovering files except by buying the decryption key from the crooks, assuming they haven’t made a blunder in their programming.

And there are many cases where cyberinsurance companies – presumably because their job is to get you back on the road again… where the only solution is to pay, so they do come up with the money.

So, some people are saying, “Well, that’s a real problem because that’s what’s making the ransomware demands so high. The crooks know that the insurance company *does* have $2 million, whereas you probably don’t – and therefore cybersecurity should never cover ransomware. That’s unethical and almost immoral.”

What do you say to that?

---

JN. Yes, it’s a hotly content topic and there are lots of different sides to it.

Let’s look at the pros and cons of insurance, for example, in these scenarios.

In cases where cyberinsurance was not allowed to pay ransom, and those same insurance providers didn’t cover ransoms, what we would have is a number of cases where companies went bust.

And the reality is here that attackers know, the attackers are very aware of, the pressure points in society.

During the COVID pandemic the pressure points have been things like healthcare, and they have been things like hospitals, they have been research facilities working on vaccines, they have been schools.

And the reality is that, yes, in many of these scenarios, organizations might not have been able to pay on their own.

Cyberinsurance basically comes in and allows, in some of these scenarios… basically a way out in terms of allowing companies to bounce back in terms of paying ransoms.

Now, in the case where these ransom payments were not allowed, these companies either would have had to shut down, or would have stopped functioning.

It could have impacted people’s lives; people could have died; a number of general services could have been impacted.

So that’s one of the pros in having cyberinsurance, in that it can support scenarios where payments maybe can be made… though whether they should be made is another thing.

I completely understand the argument that many people are arguing that cyberinsurance is leading, or is one of the big pushes, for this increase in ransomware attacks that we’re seeing.

But I think it’s much more complicated, simply because attackers will attack organizations whether they have insurance or not, and they will basically try to push companies as far as possible, to see whether they pay out or not.

So, it’s really a very, very complex issue in terms of, “Should companies pay, shouldn’t they pay?”

Is paying funding things like organized crime; are payments covering things like child trafficking; and terrorism even?

And these are all very complex problems, which I think we’re only at the tip of actually properly investigating.

---

PD. Yes, I think I agree with you there…

My advice to people is, “Don’t pay.”

But I also like to say, “If you decide that you have to do a deal with the devil, and you have to pay, I’m not going to stand in judgment of you.”

Because it’s easy for me to say “don’t pay” when it’s not my business, and my 200 staff who depend on their work for their living, looking down the wrong end of the barrel.

---

JN. Another thing which I think is actually really important to this current discussion is, let’s say payments were banned completely…

This is just picking up on one of the points that you mentioned: what’s going to happen, is that attackers are going to really try to test the resolve of businesses and test the resolve of which businesses will actually not pay.

And what will happen is that some businesses will be forced to pay – and they won’t tell anyone that they paid…

So, the attacker will now have them twice: one, they’ll have their data; and then, two, they’ll have the fact that they paid, which is breaking the law.

So they’re going to be even deeper in debt to the attacker.

And that becomes an even more complex and risky situation for these businesses.

I think that’s another key point as well: I don’t think banning payments is as simple as, “Payments are banned and no one is going to do it.”

It’s just going to push this reality underground, for probably quite a while, and we won’t have transparency around what’s actually happening, what type of attacks are we seeing, and what type of payments are being made.

So not banning payments, at least at this point in time, does also allow some form of transparency, such that we can better understand what’s going on with ransomware, hopefully track it to the extent we can try to better deal with it.

---

PD. Yes!

That’s a really good point, that by driving things like the payments underground, you actually make it worse.

The flip side of that is that cyberinsurance companies – and I know this from talking to someone who works for a cyberinsurance company – they don’t like paying those ransoms any more than any company does.

It’s not like they’re doing it because they want to… they’re doing it because it’s written into the policy that they’re meant to get your business running again.

So, I imagine that what we will see is increasingly strict exclusions, in the same way that maybe some car insurers these days are saying, “You know what? We will drop your premiums if you allow us to monitor your driving in real time, and if you’re prepared to let us have your driving history based on engine monitoring, for example, then the kickback to you is that we will trust you more.”

---

JN. Some insurers actually try to nudge companies towards this… “Yes, we’re happy to lower your premium if you let us put a black box on your network where we can monitor and see what’s going on, and basically have a better idea of your risk exposure.”

Companies are not keen, based on what we’ve seen, because of the insight that that gives the insurer into their internal systems.

And it’s probably very similar to black boxes in our cars, in that maybe the average person doesn’t want their insurer to know exactly what they’re doing, and where they’re going, and how they’re driving, and so on.

So I understand your point, and I completely agree that insurers don’t want to pay ransoms – we’ve actually seen some insurers actually exclude ransomware in particular, because they recognize how significant a threat it is.

And for other insurers, we’ve seen, over the last year – this is of course linked to COVID, but also into boom in ransomware and a boom in ransomware payouts…

We’ve seen what was a very large cyberinsurance market before actually shrink gradually towards what we call a “hard market”, where there are less insurers.

And the good thing about this is that, because there are less insurers, cyberinsurers can be a bit more demanding in what they request from individuals.

In a soft market, what happens is that you have so many providers that if a company goes to Insurer A and says, “I want to buy a cyber policy, ” and Insurer A says, “OK, sure, but you have to have ISO 27000”, then the company might say, “Oh, well, I’m not sure about that.”

And they go to Insurer B and Insurer B just says, “Oh, you just have to have this one control and we’ll underwrite it.”

What you’ll see, therefore, is that insurers don’t really have this power to nudge companies towards better security – that’s in the soft market where there are many, many providers.

What we’re seeing now is that, because a number of providers have actually had to leave the market because of increasing ransomware payouts, and, of course, the impact of large COVID payouts… what we see now is a bit of a harder market where there are less insurers.

They’re insurers that have really heavily invested in understanding cyberrisk, and in writing strong, robust policies.

Insurers now, probably more than they’ve ever been before, are in a much better position to nudge companies towards saying, “Yes, if you want to buy this cyberinsurance policy, that’s fine, but you have to have controls X, Y, and Z in place.”

And it’s not a case of just going to the next insurer and hoping that they won’t request those controls.

Insurers are much more cautious these days about the policies that they underwrite.

---

PD. I guess the good side of that is it means that cyberinsurance won’t end up being that “thing where you put your money”, instead of investing in actual cybersecurity that could prevent attacks in the first place.

---

JN. There’s a lot of value for businesses in cyberinsurance, because it starts to nudge them towards thinking about what they should put in place or what they shouldn’t put in place.

And some insurance can provide – I like to think of them as an aggregator, where they can actually provide a broader understanding of the security within companies and across different sectors and so on.

So we’ve traditionally relied on security companies quite a bit for providing good understanding in terms of cybersecurity attacks and stuff like that, and I do think that there’s a strong position for them there.

For cyberinsurers, I think that where there’s a big benefit is around understanding the impact of attacks, especially the financial impact of attacks.

I’ve seen, over the last few years, that more and more cyberinsurance providers have started to partner with and in some scenarios acquire, security companies – and the big push for them there is to try to better understand cyberrisk.

I think that’s where the insurance companies are actually providing a bit more insight into industry in general, in terms of how things actually work, and what’s the actual, tangible, real-world impact of cyber attacks.

---

PD. Indeed.

It’s my understanding that some, most, probably all cyberinsurance companies insist that if you are going to call them in to help, claim on your policy, that everything does have to be done by the book.

So they will insist that the regulator is correctly informed; they will insist that law enforcement is brought in if that is necessary or appropriate; and they will essentially go by the book in a way that helps the rest of us learn how not to be a victim in future.

I’m not trying to victim blame… I’m just saying that’s a great way of us collectively pushing back against the crooks.

---

JN. I completely agree.

And I think the reality is, with the cyber insurance industry, as with many financial service industries, they’re heavily, heavily regulated.

And because the fact that you mention Paul… there is this nudge towards everything being done by the book; things being very clearly laid out; things being very well documented.

For example, we traditionally talk about incident response providers and breach counsel and general counsel and so on.

But insurance providers also actively engage with people like forensic accountants, because the idea is that they can have a really good understanding of, “What’s the financial impact of an attack? What does this mean for the business? How much will this cost the business?”

Because, of course, all this information feeds into how much the insurance provider actually pays out in terms of when a claim is made.

---

PD. So let’s move on, then, to the final question that I wanted to cover, which is how, as a community, both as cyberinsurance providers but also as a companies buying insurance… how can we make this work best for us?

Because, clearly, there are going to be some cases where even a well-defended, well-intentioned, on-the-ball company suffers a cyber incident – and it doesn’t have to be ransomware; it could just be something that causes their business to stumble really badly.

How can we make cyberinsurance work for us best, rather than just going, “Oh, well, I’ve got 20,000 pounds to spend on cybersecurity… do I spend it on actually trying to keep the crooks out, or do I just buy an insurance policy and hope for the best?”

---

JN. This is a really good question.

I do think that the answer to the question is in thinking about a comprehensive risk management strategy.

So, a bit of research that I co-led, funded by the National Cyber Security Center (NCSC) in the UK, was trying to explore the reality of how the cyberinsurance fits with the broader question of cybersecurity.

And I think the answer to your question, Paul, is grounded in the fact that cyberinsurance is a part of cybersecurity risk management, and companies should never view cyberinsurance as “this thing that you buy so you can forget about cyber security.”

What you should think about, instead, is that, in trying to do comprehensive risk management, you will try to put things in place.

You go through your risk analysis, and then you identify that, “OK, well, there’s a certain amount of risk that we want specifically to control.”

And then there are residual risks, where maybe it costs too much to protect against those risks, or the risks are very, very low likelihood, or or very low impact.

And then you would decide as organization, “OK, well, these risks… you know what: these risks, we want to buy cyberinsurance for.”

And I think that’s probably the way a company should looking at this, in that it’s not a scenario of “You have 30,000 pounds or 100,000 pounds or whatever, that’s your security budget”, and then you’re thinking, “Oh, well, I’ll just spend all that budget to buy a nice, shiny cyberinsurance policy.”

It shouldn’t be like that.

Cyberinsurance should be looked at as this vehicle that can actually tackle, or help address, residual risk.

And the reality is that, in cases where a cyberattack happens and your controls fail, or your controls don’t address the risk to the extent to which you expected, then cyberinsurance can kick in, and, like I mentioned before, it can provide these instant response services, and so forth.

You made the point yourself, Paul, that cyberinsurance providers aren’t here to just pay out.

We shouldn’t look at them as that, and they’ll tell you that they aren’t here just to pay out on incidents.

Cyberinsurance providers will all have a portfolio of risks that they’re looking at, and they’ll be looking at managing their risk as best as possible.

And the insurance providers are not going to take on a bad risk; that’s not in their best interest.

So, they will be trying to engage with organizations to try to reduce risks to a reasonable extent, and then, from that point, then they’ll be willing to underwrite the policy.

---

PD. Yes, that reminds me of a conversation I had with a cyber insurance person…

Now, this is going back a couple of years, so it’s before the shakeout in the market… he made the point that if you are going to invest in cyber insurance, then you should be prepared to do more work, sitting down with the cyberinsurance company that you’re thinking of going with, to try and work out what you want.

Not because cyberinsurance companies are incompetent or expect you to do the work, but because this is all so new!

He made the point that if you’re looking at something like life insurance, or insuring ships at sea, there are statistical and actuarial tables for those risks literally going back centuries, so we have a good idea of how those work and what influences them over time.

Collectively, nobody really has that with cyberinsurance and cybersecurity because: [A] it’s so new, and [B] it is so volatile, because the cooks find it, sadly, rather easy to adapt their attacks as we put up new defenses.

So I think part of the answer here is that it’s not just a question of going, “Oh, let’s find a provider that fits our price point.”

It’s also making sure that you’re getting, that you’re actually buying, the right cover for the things that are genuinely likely to be a problem for you.

---

JN. Yes, I completely agree.

And this is another key point, when it comes to thinking about policies and thinking about which policy you want to get.

It’s really, really important to sit down with either your insurance provider or your broker, and try to figure out and get to the bottom of what’s the best policy for you, or for your organization.

Another big difference with cyber compared to some of these other domains – maritime and so on – is that the risk is so dynamic, and people can upscale.

A criminal could not exist today, yet a massive criminal group could just exist tomorrow.

We have things like ransomware-as-a-service, denial-of-service attacks, botnets-as-a-service….

And one of the things that actually worries cyberinsurers the most, is that we know, from historic records, when it comes to natural disasters, we know what’s the maximum impact; we know what the catastrophic event is – so, you know what’s the worst things can get.

With cyber, I don’t think anyone knows what’s the worst, what’s the absolute worst case, event.

There’s still a lot of apprehension from security providers and from insurers about, “What is the catastrophic attack? What is the attack that is the mother of all attacks?”

And that really worries insurers, because insurers like to know what is the maximum, how bad could things get… because they featured that in all sorts of their actuarial models.

---

PD. Excellent!

Jason, I think that’s a fantastic point on which to end, and just to conclude by saying that cyberinsurance can really help your business.

It could be the difference between failing completely and having to go out of business, and being able to survive, if cooks do get the better of you.

But that it’s not just, at the moment, something you can tick a box on a screen and go, “Yes, I’ll add that.”

It’s something that you need to do: sit down with your proposed cyberinsurer, make sure you’re getting the right cove, and that you’re doing the right things in the first place to justify the sort of low premium that you want…

…which makes it correspondingly much less likely that you would ever need to claim in the first place.

So, Jason, thank you so much for joining us – it has been very insightful indeed.

And to everybody who tuned into this webinar, thank you so much for taking part.

All that remains for me, apart from thanking Jason, is to say, “Until next time, stay secure.”

---

JN. “Stay secure.”

[FX: MORSE CODE SIGNOFF]

Optimizing cyber insurance: how cybersecurity can help

Learn more about Sophos Managed Threat Response:
Sophos MTR – Expert Led Response  ▶
24/7 threat hunting, detection, and response  ▶

[FX: MORSE CODE GREETING AND SYNTH VOICE]

PD. Hello, everybody – welcome to the Security SOS 2021 webinar series.

I’m Paul Ducklin, and today my guest is Fraser Howard, whom I always like to describe as “The Malware Specialist in Everything.”

Fraser, welcome back to the SOS series!

---

FH. Hi, Duck, good to be here.

---

PD. Today’s topic, as you can see, is the intriguing sounding: “Malware – the never-ending story.”

Why we chose that topic – that was actually me remembering… this is going back to the late Eighties or the early Nineties.

It was a year when I think we were only in March and [DRAMATIC VOICE] we’d already had 28 viruses.

---

FH. [LAUGHS]

---

PD. And colleagues said, “Wow, you’re really busy at the moment, but what do you think you’ll do when this fad burns out?”

And I’m still wondering [LAUGHS] what the answer is to that question, because it really has turned into a never-ending story, hasn’t it, Fraser?

---

FH. It has!

I mean, I can’t even imagine… I think even 10 or 15 years ago, we still counted things…

---

PD. Yes!

---

FH. …and things then were in the tens, if not hundreds of thousands.

I think nowadays I’ve stopped counting, there’s just too much.

---

PD. Particularly when the crooks are often not delivering those malware samples by themselves, are they?

They’re working in an environment where there’s an affiliate network, if you like.

The core malware creators, the crooks at the core – if you look at the ransomware gangs – write the malware, and then they recruit a whole load of affiliates to go out and do the dirty work with it.

---

FH. Yes, exactly that.

And people build all sorts of services around this whole ecosystem that provide them additional capabilities, from simple capabilities like using obfuscation and packing techniques to try and make their creation less easy to detect…

---

PD. And even worse, some of the packing technologies that the malware authors use, the first time you see them, or if you show them to someone who’s technical but hasn’t looked at them before, they’ll go, “Well, that’s easy to detect. It’s so suspicious!”

But yet some of the tools they use are also used for packing and copy protection on legitimate software.

---

FH. Yes.

That’s the annoying part, when benign, legitimate software that uses those very same tools.

This makes it hard – hard for humans and also hard for technology like deep learning.

It makes it harder to train automation when the legitimate and the malicious files have very similar characteristics.

---

PD. In terms of Malware-as-a-Service, where affiliates are being recruited, it’s way more than just ransomware, isn’t it?

There are whole market niches in the cybercrime ecosystem where different malware service providers provide different sorts of tools.

---

FH. Yes, definitely.

And in many senses, if you’re a cybercriminal looking to maybe steal data, you probably like the fact that ransomware has taken all the headlines.

Cybercrime history is full of cases where one or a few kind of notorious criminal groups, or a few notorious threats, have the sole focus of law enforcement and press.

And the reality is, behind that, under the radar if you like, there has always been a whole bunch of other threats that, in many cases, might be more important and more of a risk to lots of people out there.

---

PD. The crooks that unleashed that ransomware attack, and finally lit the blue touch paper in July – they may have been in your network since April, March…

---

FH. Yes.

---

PD. …or even December of the year before.

---

FH. Yes.

---

PD. And who knows what else they’ve done?

They’ve almost certainly created new accounts so they can get back in later; they’ve probably stolen all your trophy data; they’ve almost certainly wiped out all the backups they can, in case you think you can recover without paying.

And who knows how many keystrokes they’ve logged and how many passwords they’ve captured during that time?

It can be very hard to tell after the fact, can’t it?

---

FH. So, you mentioned keystrokes there…

It’s funny, because I remember, a few years ago, doing a demo on what was at that time was some notorious piece of malware.

Actually, we then got into conversation about simplistic keylogging trojans, and how that type of malware is one of those insidious kind of threats that you can have in your network.

And if you think of the type of data that you type, and if someone’s harvesting that data on a continual basis… it’s very easy to see how you can lose credentials, lots of sensitive IP data.

And lots of threats today, and lots of ransomware attacks, they get onto a network at some point, and from there, they co-ordinate the rest of the attack…

…in many cases, that initial access is through stolen credentials, essentially credentials that have been stolen by one cybercriminal and then sold online to facilitate crime from others.

And on that same topic, things that just take simple screenshots, and take a screenshot every few minutes or every hour… again, lots of very sensitive data can be stolen.

Maybe that data then enables a second attacker to access those systems, or realize there’s some kind of highly prized data that could be available.

---

PD. Fraser, I just want to jump back to something you mentioned earlier about these criminal operations where there’s a service that’s provided.

Talk to us a little bit about perhaps one of the more infamous malware-as-a-service groups, namely: Emotet.

---

FH. Yes, the notorious Emotet!

So, that was one of the good stories that came out of this year.

In January of this year, multiple law enforcement organizations worked together to take out a lot of the infrastructure that was being used by Emotet.

And as weeks, months have ticked on since then, they essentially took out that particular threat family.

Emotet itself has been… I said notorious – that’s an understatement – for probably 12, 18, 24 months.

It was certainly the number one non-ransomware threat family that was regularly discussed by law enforcement, by various kinds of news articles, and the like.

That was primarily due to the aggressive nature in which the attackers sought to maintain their presence, and the size of their botnet, through things like aggressive spam campaigns to continually infect new victims and essentially conscript new victims into their botnet.

And also the way in which Emotet itself was used as a malware delivery service, basically infected machines had other malware pushed to them.

So, the bad guys were essentially using that network as a means to distribute other malware.

Other people would pay them money to push malware through their botnet.

---

PD. Yes, because for many attacks, the Emotet malware family and the Emotet service, that was the beginning of an attack that may have led to ransomware, wasn’t it?

Because Emotet wasn’t about ransomware, it was… how would you describe it?

It’s “malware delivery malware”, basically.

---

FH. Essentially, yes.

Once part of that botnet, you as the victim would be completely unaware that your machine was infected.

The malware was designed to run in the background; there was nothing visible; no visible damage in terms of file encryption or in terms of messages.

It was simply a service that was running alongside all the other hundreds of Windows services in the background, but this particular service was used by the Bad Guys to push other malicious activity later on…

---

PD. …waiting for some other gang of crooks to come along, say to the Emotet guys, “I need a thousand infected computers by tomorrow, all in one network. What have you got?”

And they’d say, “Yeah, we can do that. We can do that, how much are you willing to pay?”

Then they’d use their botnet (in case you’re wondering, that’s short for “robot network”), and the Emotet guys would just deliver pre-infected computers to paying “customers”.

---

FH. Yes.

Emotet certainly was not the first kind of malware family to do this, far from it, but it was just one of the more recent ones, and they did it in a way where they did it very effectively.

And so they were individually responsible for quite a lot of victims being hit with a whole variety of different threats.

---

PD. Just to be clear, for those of our listeners who are wondering, “Well, how can botnets be controlled through a firewall?”

Because, particularly if you’re in a small network or a home network, you’ve probably got a router that doesn’t allow incoming connections – many ISPs even prohibit that, you can’t set it up even if you want.

Modern zombies or bots, in fact, for years, they just don’t work that way, do they?

They don’t wait for the crooks to send them instructions, they just regularly and gently call home, possibly to one of thousands of ever-varying servers, so it’s not obvious where they’re going.

Then they download the instructions on, “Dear Boss, what should I do next?”

---

FH. Yes.

And they typically use HTTPS, so it just blends in with other web traffic that’s also using HTTPS from the victim machine, so it can be very hard to spot.

---

PD. So the Emotet guys, the “malware delivery malware” experts, they got taken down…

What happened next?

Because often you see that almost as soon as one gang gets taken out, either they don’t get arrested and they just pop up with a new name somewhere else, or somebody else figures, “Woo hoo, that’s my competitive advantage,” and new crooks fill the vacuum.

What happened after the Emotet takedown?

---

FH. Yes, the next chapter in this story, and the one that people expect to hear, is, “What threat family fills that void as soon as Emotet has gone?”

And the reality is that there are multiple threat families that are already doing something similar to Emotet, even whilst Emotet is active.

And, no doubt, those same families have, to whatever extent, filled that void.

To date, there isn’t a single one that stands out as having replaced Emotet, but there are a few notorious families, several of which have been spoken about and posted about on Naked Security, families like BuerLoader, Dridex, BazarLoader…

These families are getting used, and some of their functionality enables the bad guys to use them as a service to distribute other components of malware and other parts of an attack.

---

PD. I guess that’s an important reminder that malware detection and prevention is not all about the shiny visible stuff!

For example, let’s say we got rid of all ransomware… we’d still have to worry about all the other malware of the past.

The problem really retains the cumulative history of all the malware that went before…

---

FH. It does.

And actually, that’s an interesting example you just brought up there.

So in some senses, for a well-protected network, using some of the technologies that are available in today’s security products, actually ransomware is quite hard – technologies like CryptoGuard can make it really hard for the Bad Guys to actually encrypt your data.

Partly for that reason, ransomware authors, the attackers, have already shifted to what we call “double extortion” type models, where rather than just encrypting the data, actually they’re siphoning it off your network, they’re copying it off your network, somewhere up into the cloud.

And they’re still looking to blackmail you, they’re still looking to extort money from you… not to get your data back after having been encrypted, but to stop the attacker publicly exposing your data because they’ve already stolen it.

---

PD. So Fraser, we’ve spoken about Emotet, the “malware delivery malware” guys.

But there’s… not exactly a new kid on the block, but perhaps a new term for many people: the so-called “supply chain attack”, where you fetch software from what you think is a trusted source, but instead of attacking you, the crooks have attacked the person upstream from you.

How’s that panning out?

---

FH. Again, it’s a technique that’s been around for a long time, and over the last few months, we’ve seen two major attacks that have used it.

First one, just before Christmas, was the SolarWinds attack, where criminals who had managed to compromise that software chain were able to subsequently hit people that were already using the software.

And more recently, just a couple of a few weeks ago in fact, the Kaseya ransomware attack, where people who were using Kaseya software… that software was used to distribute malicious commands, which initiated a ransomware attack.

So from the Gad Guys’ point of view, you can see why it’s so attractive.

Earlier on, we spoke about “initial access”.

How does the attack get onto a network and potentially laterally move across that network in order to deliver the attack?

Actually, the supply chain can solve that problem for them entirely.

So, in the case of the Kaseya attack, this Kaseya agent was already running on lots of these endpoints, and by compromising higher up the chain, the bad guys are able to issue their malicious commands across all of the machines that were running that particular software.

So, that solves the problem for the attacker of that initial access, gives them it for free.

---

PD. So, loosely speaking, from a software point of view, a supply chain attack simply means that instead of attacking you directly, the crooks just attack someone one or two or three steps up the chain…

Where you fetch stuff that you assume you can trust because you’re not downloading it from some weird link that someone just sent you in an email.

---

FH. Yes, exactly.

And, essentially, that software is backdoored.

You’re using legitimate software, but there’s essentially a backdoor in that software that allows cybercriminals to use that software to deliver something bad.

---

PD. And this is a particular problem for software development teams, isn’t it, in the modern era, if you’re using languages like Python, or JavaScript, or Ruby or something like that?

---

FH. Yes.

---

PD. And you’ve got RubyGems, NPM, PyPI… these package manager tools that go out to the public cloud and download often open source packages that are meant to be open to everybody.

So, it actually requires quite a big attention to detail by development, quality assurance, and build engineering teams inside software companies.

---

FH. If you’re a cybercriminal group looking to attack a very high profile organization… we already know that those groups invest months, years; they invest hundreds of thousands, probably millions of pounds, in looking to target those particular organizations.

Actually, if you think about it, a supply-chain type attack is a very powerful way of hitting those various organizations.

So, rather than dedicating all that effort into building up your attack weaponry, you could invest that same effort into building up developers with high reputation on some of these open source projects, contributing positively…

…only at some point in time to drop a backdoor in somewhere.

It’s a perfectly plausible scenario in terms of how these attacks might go in the future.

---

PD. So, one way to attack a single business is to find some software module that’s used by a *million* businesses that have no reason to distrust it, attack all the million businesses, and one of them just happens to be the victim you really wanted.

And the flip side of that is, if you’re the kind of crook that wants to attack a million businesses, you can either attack them one at a time like the CryptoLocker ransomware guys used to do back in what was it, 2013?

Or you can go, “OK, let’s find the common watering hole and let’s go and poison that.”

So, supply chain attacks can actually be used for broadening and deepening attacks, possibly even at the same time.

---

FH. Yes.

And as you said at the start, they’re very, very hard for the good guys to defend against.

Common sense; good practice in terms of what extensions you trust and what tools you merge into your projects, or even the actual tooling that you use; maybe your development environment; what extensions you might choose to use; all of those considerations become important…

Because, when you choose to kind of use one of those extensions, as you said, it’s probably doing exactly what you described: it’s connecting out to the internet, pulling down some third-party code…

…but how could it be abused by an attacker as well?

---

PD.Yes!

And it’s not just the case that the crooks will poison the code that you download to build into your own software.

They can poison the package that you download so that the malware runs when you install or update the package.

---

FH. Yes.

---

PD. And now the crooks haven’t poisoned one particular build you’ve made, they’ve poisoned your whole build environment for next time as well.

---

FH. Yes, and we’ve seen attacks like that in the past where they’ve targeted certain build environments or certain high-level languages, in a way to hit organizations that build and ship packages to customers.

---

PD. Fraser, perhaps this is a good time, given that we’ve just opened up this huge number of ways you can deliver the malware…

Maybe this is a good time to talk about something that’s getting a lot of popularity these days, and that is an attempt to codify all this, namely the MITRE ATT&CK framework, which is A-T-T-ampersand-C-K.

Tell us something about that, because I know you’ve been doing a lot of work lately with the so-called ATT&CK framework… which is a framework for defense, not actually for attack.

---

FH. So, we talk about attacks, and we talk about how threats work and then inevitably these conversations become quite detailed quite quickly, and quite technical quite quickly.

To lots of people that aren’t involved in cybersecurity, it can be hard to follow and hard to properly characterize, “What exactly are you talking about?”

And so the MITRE ATT&CK framework is essentially a knowledge base.

---

PD. Now MITRE is run by the US public service – it’s a US government thing, isn’t it?

---

FH. Correct, yes.

And the framework provides tactics and techniques based on real world observations.

So, observations into how attacks actually happen, what different techniques the attackers use, and trying to basically break that down and providing a structure by which we can label things.

You have, for example, tactics like: execution; initial access; lateral movement; discovery; command-and-control; and there’s a variety of other ones as well.

And within each one of these tactics, you have a whole variety of different techniques, as well.

For example, brute forcing would be one particular tactic…

---

PD. That’s where you try every possible password rather than just guessing the most likely eight?

---

FH. …yes.

Sniffing network traffic; using Windows management instrumentation… there are literally hundreds of different techniques.

Basically, the matrix provides a labelling structure so when we, for example, block some malicious activity on a machine, we make an effort to try and associate that block with the most appropriate technique.

That can be useful for the customer that has that protection event firing within their organization, because they can then use that technique reference to better understand what type of activity is being blocked in this particular instance.

---

PD. Which also tells them, if they want to do threat hunting, where’s the right place to look…

---

FH. Yes.

And perhaps most crucially, as well, by adopting the ATT&CK kind of matrix framework, it’s a common language across different security products.

And so “Technique ABC” is “Technique ABC”, regardless of which particular security product might have referred to it.

So, it provides that common language, which makes it easier for customers, for security teams, and incident response teams to talk the same language when they’re trying to identify the characteristics of an attack.

---

PD. Yes, because malware and threat vocabulary, for want of a better word, has always been a bit of a problem, hasn’t it?

Right back to the 1980s: “Is it the Italian virus? Is it the Bouncing Ball virus, or is it the Ping Pong virus?”

---

FH. [LAUGHS] Yes.

---

PD. Is it the Stoned virus, or the New Zealand virus?

---

FH. The way we see MITRE-related labeling and classification being used will change drastically in the next 12, 24 months and it will become a much more integral part of how organizations manage their protection.

But more importantly, as you just touched on, how they manage their response to malware incidents, or even just user activity – users doing unusual or inappropriate actions on their machines, even without malicious intent.

---

PD. Yes, things that could open up a hole that they never intended, but didn’t think of.

So, Fraser to finish up, because I’m conscious of time, I’d actually like to look at this whole threat response idea.

These days, just relying on “find the malware – detect the malware – block the malware – remediate the malware – print a lo -, pat yourself on the back – get ready for next week’s attacks”… that doesn’t work anymore, does it?

Because, often, attacks may be done deliberately by the crooks, just so they can sound out your defenses.

So, even if you successfully defend today, what you could be looking at is actually a little bit of a hint that something much worse is likely to happen tomorrow!

---

FH. Yes, and that’s actually a very, very common scenario.

The biggest change between those times you talk about and today is actually human-led attacks.

So, we talk about “human adversaries”, and what we’re really talking about is one or more cybercriminals who already have presence within your network – they’ve already got in.

Maybe it’s an unmanaged machine; maybe it’s a machine without security patches; maybe it’s a machine where the security has been disabled.

Regardless of any of that, the attacker is already on the network.

They’re going to then use that persistence, use that presence, to map out the network, to laterally move across the network, and ultimately to deliver their attack.

---

PD. And let’s be clear, at this point, there are no flaming skulls on your website homepage…

---

FH. Correct!

---

PD. … to give away that the crooks are in your network. [LAUGHS]

---

FH. Yes.

---

PD. Because it’s a human-led attack, it’s not like software pretending to a sysadmin.

If they’ve managed to promote themselves to an administrator account, they basically *are* sysadmins…

---

FH. Yes.

---

PD. …they’re not *your* sysadmins, unfortunately.

---

FH. Yes.

So, you tend to find that they try and initiate an attack, and a good security product will block that attack, but they’re still on the network.

And so they try something different, and they can continually repeat this whole process until, eventually, they win.

And so, whatever security product you have has to succeed 100% of the time to prevent that particular attack succeeding.

This is where services like Managed Threat Response (MTR) can help, because they can recognize these early signs of that type of attack, and they can boot that person off the network and remediate the attack before the truly malicious part is delivered, be it ransomware, data theft or whatever.

---

PD. Just booting them off the network… even that’s not enough, is it?

---

FH. No.

---

PD. Because you have to get in your… what I like to call the “Network Time Machine”, and go backwards…

When these guys were making themselves sysadmins, they probably created a few other accounts…

---

FH. Yes.

---

PD. …and they probably spent the time to learn what your network and account naming system looks like.

So, if they’ve created fake accounts, they’re not going to have weird or outrageous names – they’re going to look like somebody else on the network.

They really do try to blend in, don’t they?

That’s what we call “living off the land”, isn’t it?

---

FH. It is.

Using tools ideally that are already present on these systems, or if they aren’t, minimizing the amount of new tools that they’re introducing to the victim machines.

And it’s all to stay sub-radar.

As you said, any good Managed Threat Response service, aside from just kind of getting these criminals off your network, will then try to work out, “OK, well, well, what did they do?”

“What do we need to undo?”

And also, perhaps most crucially, “How did they get onto the network in the first place?”

---

PD. Exactly.

---

FH. What was it about your security posture that made it easy, or made it possible, for them to get on the network?

The case is not really closed until all of those ducks are lined up, if you like.

---

PD. Fraser, let’s finish up, then, by me asking you…

If you’re a business, and you don’t have a huge amount of time and money leftover, but you figure, “I actually want to get into this modern threat hunting mindset, rather than just thinking of security as a sort of set and forget thing,” which never really worked well, but definitely doesn’t now…

…what would your primary advice be?

---

FH. If the budget allowed, I would use a Managed Threat Response type service.

Use people with the skillset to manage all these indicators that are flowing from your network, and give you a heads-up warning to potential or imminent attacks.

---

PD. It is *not* an admission of defeat, is it?

---

FH. Not at all, no!

It’s essentially acknowledging the real threat that pretty much all businesses face today.

If that isn’t in budget, my focus would be on using the security product that you deploy effectively.

So: visibility – maintaining visibility of what’s happening in the network.

Make somebody in IT responsible for keeping track of what’s going on in your dashboard.

Don’t live with a security environment where 20, 30, 40 alerts are going through each day, each week, and no one’s really following up.

In any well-managed environment, you will have a good handle of what is normal.

And finally: control.

Use some of the tools that your security application almost certainly already offers that you might not yet use.

Use the control features that, for example, your operating system might provide to help lock down systems, and help empower your employees to get their work done, but actually to treat your systems with respect.

---

PD. Because, as we like to say on the Naked Security podcast: “When it comes to cybersecurity, sometimes an injury to one really can be an injury to all.”

---

FH. Yes.

---

PD. Fraser, I think that’s a great place on which to end.

Thank you so much for your time.

Thanks to everybody who tuned in.

And it remains for me only to say: “Until next time, stay secure.”

---

FH. Stay secure!

[FX: MORSE CODE SIGNOFF]

Learn more about Sophos Managed Threat Response here:
Sophos MTR – Expert Led Response  ▶
24/7 threat hunting, detection, and response  ▶

LISTEN NOW

Click-and-drag on the soundwaves below to skip to any point in the podcast. You can also listen directly on Soundcloud.