So you could forgive the cyber leadership cohort if they’d maybe not got much remaining bandwidth to spend time planning for notional threats that may arise a year or two down the line. But the coming post-quantum world – in which quantum chips arrive in the commercial realm, exponentially increasing the computational power available to all kinds of miscreant, and in the process obliterating the encryption that secures data, connections and identities – is the kind of existential threat that no prudent security manager can afford to ignore. Even postponing thinking about it could leave CISOs open to criticism that they’d been guilty of dereliction of a core duty.

This is no idle concern. Today’s encryption standards are not based on perfect mathematical solutions, but on making the mathematical problems encryption relies on too difficult to solve using current computing capability. Quantum chips will reduce the time that would be required to solve those problems from centuries to seconds – meaning not only that access controls cease to provide any protection, but also that encrypted documents that might have been stolen in the past can be opened and read in the future.

But the post-quantum threat is difficult enough to wrap your head around even if you’re comfortable thinking about encryption, keys and quantum computing theory. Explaining to the board why they need to devote time, internal resource, and – likely – significant money right now to addressing a problem that may not start to bite for a few years is another matter entirely.

This, though, is where startup One Intelligence have decided to park their tanks. The company, founded by mathematicians and cryptographers, reckons it has a solution that will quantum-proof businesses, with minimal downside, no new kit, and no specialist cryptographic knowledge needed. And in the process, it will also solve some of the biggest challenges that are already being faced by networked businesses, and which are already understood – and budgeted for – by responsible corporate leaderships.

After deciding they were ready to emerge from stealth mode, the newly de-cloaked One made their first public pitch to cybersecurity professionals via a RANT roundtable held in London in mid-July. The ensuing discussion proved eye-opening, sobering and – perhaps – encouraging, in more or less equal measure.

Severed Crossed Fingers

“I’d like to ask you, as we go through this tonight, that if you only remember one thing, it would be trust,” Brett Nakfoor, One’s global vice president of sales and marketing, said at the outset. “How do you solve for quantum, ransomware and AI attacks? Trust. We decided to solve the problem of quantum security – and we did, with a new class of math. We can mathematically prove that we can prevent quantum-computer and AI attacks. We are provably secure.”

Just as importantly, Nakfoor added, the solution One have come up with can be quickly and easily integrated into existing technology stacks and will not require customers to spin up new departments of specialist mathematicians, cryptographers or quantum experts to be able to successfully deploy it and manage it.

   “We found out, luckily, that with this new math we could create a solution at the transport layer,” he explained. “Instead of putting security in afterwards, we decided to invert that. You can put more information into a packet, and deliver it all the way up from the transport layer – layer 3 – up to the human layer – level 7. But we’re all adding an eighth layer now – the AI agents.”

One’s concept solves that problem, too, Nakfoor said. The solution allows the user to “embed trust objects into an interaction before it starts,” he added.

   “This opens up a whole new world of how you deliver solutions to your business,” he said. “What we’re positing is that we’ve commoditised the delivery of quantum security in our delivery of the software, and you can control all forms of AI in doing that. That’s a bold statement, but we’re happy to answer questions – and if you want to give us real-world examples, we’ll talk about how we can help fix them.”

What followed was an absorbing exercise in just that – as a high-level group of CISOs, BISOs and other senior security leaders outlined their current concerns and future fears, and, either directly or by implication, sought to discover how the One proposition might help them realign their businesses for this coming new world.

Pay Your Way In Pain

Rob Black, RANT’s host for the evening, opened up the discussion by asking attendees to describe the issues that were top-of-mind for them about post-quantum security. These early exchanges ran the gamut between immediate worries and long-term headaches, but also surfaced some scepticism over the extent to which specific companies or sectors might be exposed to certain dangers. As so often in cybersecurity, some argued, these ostensibly new and novel concerns may well just serve to remind organisations of the necessity of looking after some long-established basics.

   “We have long-lived data, and shorter-lived data,” one security leader began. “If it’s only relevant and used for a short time then that’s OK – but we don’t have a solution for securing that long-lived data. We know we have to figure it out, but we don’t know how yet. And we don’t know how to work out how long that data might be of value to somebody.”

“We’re tackling that question as well,” another attendee said. ” It’s driven out of historic issues people have around data security. Without a decent understanding of what data you hold, and the metadata associated with it, you’d have a lot of work to do.”

There was also clear interest in one class of attack that, in a way, defies the passage of time. A patient attacker, able to identify data with a long useful lifespan, could steal or copy encrypted files now, and wait until quantum technology is available, and then decrypt it. Even businesses that may consider themselves to have little information that falls into that category may still have to consider it, as a third leader, whose company manufactures specialist physical devices, noted.

   “Our own products are very cutting-edge technology – so we don’t have a massive issue [with harvest-now/decrypt-later] because the pace of change is very rapid: one of today’s blueprints, by the time you’ve figured out what to do with it, we’ve moved on,” they said. “However, our customers may take a different view. If they need to maintain their blueprints, those need to be retained securely for a very, very long time. So the data we collect for our customers is very important. And the moment you lose trust, the whole model evaporates.”

Hell Is Near

The issue of organisational or institutional awareness was also front-and-centre of mind for many in the room. Some felt the problem would be addressed in time, because a sense of urgency would emerge at corporate decision-making levels before too long, but organisations which tend to wait until they’re forced to change might struggle.

   “Constantly having to explain the complexity of cryptography to the organisation is an issue,” one CISO said. “I think it’s an ongoing thing. Post-quantum will get everyone’s attention, from the CEO down, so everyone will be interested. Education goes hand in hand with it. I’m lucky enough to have a great crypto manager who manages this for us, but not everyone does. And – not wishing to tar everyone with the same brush – quite often those people who are good at crypto aren’t good at board presentations.”

“We’ve got people whose job is post-quantum, and people who manage crypto – they understand it really well. But is the organisation ready to understand? No,” agreed another senior security leader.

Black asked those around the table where they felt post-quantum security sat in their own, and their organisation’s, list of priorities. The first answer was, perhaps, a surprise.

   “I was talking to someone from a regulator,” this security leader began. “They said it’s not a priority for them at the moment. There was a bunch of stuff they said we should be looking at, but they said that this isn’t in focus at the moment. Now, we don’t do things just because regulators tell us!” they laughed. “But it was an interesting observation.”

That good old favourite non-scientific data-gathering exercise – a quick show of hands – revealed that, among those in the room, no organisations currently viewed post-quantum security as their biggest concern, and a majority of those represented in the room worked for businesses which considered the threats posed by AI as their most urgent priority.

   “The board’s got their hair on fire about it,” groaned one CISO. “At the moment, it’s all: ‘What are you doing about Mythos?'”

“A lot of board-level individuals can’t comprehend the impact post-quantum will have, but they can comprehend what AI can do,” another leader lamented. “It’s almost a race to the bottom – you must be doing better if you’re burning more tokens. Post-quantum is still abstract for them.”

“It won’t be tangible until someone gets badly burned,” another agreed.

Digital Witness

Mo Ali, One’s CEO, was peppered with questions about what One’s proposition entailed, how it worked, and where it ought to sit in security teams’ thinking. He stressed that a key challenge has been that, to date, cryptographic standards have relied on the mathematical problems inherent in them being too difficult for current computing capabilities to crack, whereas One’s approach has been not just to make the maths difficult to solve, but to ensure there is a known solution. Some attendees expressed concerns that, perhaps, One were seeking to alter some of the fundamentals on which current cryptographic solutions are based, but Ali was quick to correct this. The company isn’t changing anything, he argued: instead, they are “gluing things together.”

   “The formal definition of ‘hardness’ is the problem,” he said. “We say, ‘This cipher can’t be broken because computing is not strong enough,’ then a couple of years later we say it can be broken. We’re defining post-quantum in a different way to what [U.S.-based standards body] NIST has done, but we’re still relying on the same fundamentals.”

Expanding on the point, he explained a little further about the approach the firm has taken. The company’s founders include people with backgrounds in quantitative trading, and some of their approach flows from that world.

   “The quants said we need to rely on math,” Ali said, “but in cryptography, we don’t have quantitative cryptography. We need to know the force required to break it. Mathematically deterministic cryptography is harder, but that’s what we do. For years we’ve been using 128-bit blocks to encrypt – that means that the more we encrypt, the larger the keys, and the larger the key-management systems you need. We can encrypt an entire object – a database, a data centre – in one go. We made a programmable handshake, and we can embed policies in that handshake. We’re calling it Generative Trust Infrastructure.”

The terminology is important. Security specialists have long been aware of the concept of Zero Trust – and how difficult (if not impossible) it is to implement in any complete way. Generative Trust, ask Nakfoor pointed out, solves the problems Zero Trust implies because the “trust” element is “generated” at the inception, and baked in to the data at the point where it is created. And this means that the solution will work for agents created by AI tools, and every other entity or process, be it human or non-human.

   “Machines have their own language, which is code,” Ali said. “Because we come from the high-frequency trading space, we really care about where information pops out for the first time. When it forms, we’re sitting there. That’s the intelligence part. You can’t solve Zero Trust because it’s assumption-based. We call it Generative Trust, because it’s generating trust across interactions.”

And by making it programmable – and easy to program – the company believes it has a solution not just to the post-quantum challenge, but to a host of current information-security problems, including securing AI systems and combatting ransomware.

   “With a Generative Trust infrastructure, you can program ‘This is what I can do with this object’,” Nakfoor said. “If you’ve sent a document to me, I either obey your instructions [embedded in the document] or it isn’t usable. We can ensure it’s sent to the right person: you think you’re sending to me, but it goes to someone else – they wouldn’t be able to open the document because they don’t have the authorisation.”

“What we’re doing is building the world’s first foundational crypto model at the transport layer,” Ali explained. “It’s almost like an LLM – you can communicate with it using a prompt. You can write a command in plain English. If you have an AI at the application layer, and you want to encrypt all your databases, while leaving one cluster alone – just writing that prompt does it. You can create your own instructions. It controls LLMs in a formal, proofed way. It doesn’t hallucinate, or have the limits LLMs have. You can use version controlling, and encrypt infrastructure in real time.”

The post Don’t Fear The Future: How To Prepare For The Post-Quantum World appeared first on RANT Community.

But still, sometimes the community can surprise us. Such was the case with one – notably droll – contributor to a discussion convened in Manchester by Cisco, who were keen to hear about the challenges organisations are dealing with around adoption of so-called artificial intelligence. It was very early in the evening, and RANT’s guest host – Nnamdi Ozonma, information security officer for the UK and Nordic regions at Bilfinger – had asked what seemed a fairly innocuous, get-the-ball-rolling question. Among those businesses represented around the table that had chosen to adopt AI tools, did their security leaders feel that the organisation had also adopted suitable controls?

   “We’re currently in a phase we call ‘f—ing around and finding out’,” our admirably relaxed CISO reported. There was, of course, a chorus of barking laughter – but, just as evident, a widespread sense of rueful identification with the sentiment, even if the rest of the attendees may have phrased the response somewhat differently.

“It’s moving so fast, and it’s so new, that the only way to know how to secure it is to use it and work it out,” the f-bomb detonator continued. They represented a company with a series of semi-autonomous internal divisions, each able to set its own individual risk-acceptance/risk-avoidance levels, but with one shared security team and a single board overseeing everything. This puts our friend in a somewhat invidious position.

“The mandate across everything is ‘We should use AI and we have to adopt it’,” they said of the edicts issued across the organisation by the board. “It’s measured, and we’re trying to put guardrails in place. We’re letting staff use AI to help with their jobs, but not to export files. To find out how we can benefit, we have to use it.”

This early insight proved to be a key theme of an involving and wide-ranging hour of robust dialogue. How do you securely deploy a technology you can’t understand the security implications of until after you deploy it? But – spoiler alert! – it will come as little surprise to anyone who’s been watching the AI security picture evolve that even as high-level and highly experienced a group as the baker’s dozen CISOs, BISOs and other senior security leaders were unable to unpick this particular Gordian knot.

Who’s Gonna Take The Weight?

“There’s so much enthusiasm from the higher echelons to use it and benefit from it, so experimentation is what we’re all having to do,” another security leader agreed. “But has anyone actually done what you would do if you were carrying out a scientific experiment, which would be to set a hypothesis and then test it?”

Not yet, was the widespread answer. And this revealed another, underlying, potentially more subtly disturbing, conundrum: the benefits of AI deployment are assumed to be so significant that those deployments are not only arriving without tested hypotheses to confirm security, but without even any metrics by which to assess the expected benefits. Board-level FOMO means staff are being encouraged to use AI tools to develop agents to carry out tasks in the hope that benefits will accrue – but without being given a framework against which success can be measured.

   “I think  the issue at the moment is people have a solution but not a problem,” another CISO argued. “There’s the drive, the push, but the use case isn’t there. What are we building these agents for? What are the guardrails? What are the outcomes?”

It isn’t just the benefits that aren’t quantified yet, either – the risks, crucially, are often yet to be adequately assessed, or limits placed on their acceptability.

   “How are we quantifying what’s going wrong? Ozonma asked. “Is it security incidents? Operational value is tangible,” he added, but the implication of the opposite was clear: if security’s success is measured by absence of incidents, then it’s not provable or demonstrable. And when the tools are changing and evolving at such rapid pace, even a successful attempt at conducting such measurements risks being out of date before it’s ready to report internally.

Another option, one CISO argued, is to take a step back from trying to implement technical controls, and to look instead to shore up the organisation on  a more deeply embedded, cerebral level.

   “I wouldn’t go for technical controls,” they said. “I’d want to enhance our culture around use of AI. If you can build a secure culture in how your staff engage with AI, then when things move and change, the culture should give you some measure of protection. It’s harder to build a culture than to write a policy, but that’s where I’d want to spend the money. If you build a culture, you’ll get much more benefit and far fewer problems.”

Soliloquy Of Chaos

Technical controls and pragmatic, use-case-specific restrictions can, of course, be put in place by individual businesses, divisions or departments. These may help to limit risk, although they may also restrict benefits. The trouble, attendees seemed to mostly agree, is there’s no way of knowing in advance where the most prudent place to draw those lines might be. A lack of advice from governments, regulators and other central sources of knowledge and expertise was cited as an issue here – only for one CISO to push back on the assertion.

   “I’m going to disagree that there’s no standard advice,” they argued. “There is: there’s governance. It’s not perfect, and people are often fumbling in the dark. Two years ago it was true that there were no guardrails, but we’ve come a long way since then.

“We’ve got standards we’ve been working with for decades that will work with this,” they continued. “We just have to find out where the gaps are. If we focus on those deltas we’ll get value from our human decision-making.”

“There’s some frameworks, and there are some flaws,” another security leader (partly) agreed. The problem, they suggested, was making sure those frameworks were understood throughout the business, and could be applied uniformly and consistently. The reason this rarely happens is no real surprise: it’s because this technology has users – who, being human, tend to resist being shoved into a limited number of restrictive categories.

“We think we’ve got three types of users,” this leader continued. “There are ones who go, ‘We’ve got to use AI now!’ And then you ask them, ‘What do you want to use it for? And they say, ‘Don’t know!’ Then there’s those who want to use it to speed up their basic daily tasks. But it’s the third type that are the big headache. We used to have colleagues making bonkers decisions but having to go through gatekeepers – and now they’ve got tools they can use to go out and do those bonkers things invisibly.”

Regulations, frameworks and best-practice guidance do exist, Cisco’s solutions engineering manager, Bradley Rossi, noted: but they don’t apply in all instances, and even in the scenarios where they do notionally have an impact, there are gaps.

   “There are things like the European Union AI Act,” he acknowledged, “but there are complete sectors where it doesn’t apply – like healthcare. It’s scary. People want to use AI because it’ll cut waiting lists and get faster first opinions on the results of CT scans – so there’s a push from the public to use it, but no set framework to specify what you’re allowed to do.”

“It’s true,” another veteran security leader lamented. “People have had the opportunity to learn, but in my experience, a lot of them haven’t.”

“A lot of people who are in positions where they could show leadership haven’t learned,” another CISO said. “They’re saying, ‘We must use AI’ and have charged ahead because of what it might deliver, without clearly defining anything, and whilst often shutting down discussion of possible risks.

“Virtually everyone I know who works in a private company who has engaged with AI has a story of someone in their organisation who has done something really bad with it,” they added. “Often it gets caught; sometimes it doesn’t, but things get smoothed over. But everyone I know in a private company knows someone in that position – and that tells me this problem is widespread.”

Moment Of Truth

Cisco doesn’t have a whizz-bang AI-security solution it’s trying to sell. Rossi and his colleague, technical solutions specialist Regan Newman, were keen to highlight the operating concept they call UZTNA – universal zero-trust network access. The last four letters of that acronym – what Rossi calls “the low-hanging fruit” – is stuff that most businesses already do, or try to do. Universalising it, though, “really does change the game,” he argued.

   “With non-human identities involved, and with nation-state interest in some of your intellectual property, you need to be really sure what permissions you’re giving these agents,” Rossi said.

“The whole idea isn’t new,” Newman added. “ZTNA isn’t one thing you can achieve – you don’t suddenly say, ‘Hey, I’m ZTNA-compliant.’ You need to work out what zero-trust means in your environment, and what your priorities are.”

Several businesses represented in the room were somewhere on their ZTNA journey, but the zero-trust element appeared to be tripping some of them up.

   “I think it’s an impossible target,” one leader said. “We can’t get over the line on being perfectly zero-trust. We have very tight controls and we’ve done pretty well in red-team exercises, but it’s not perfect.”

“It’s a myth that you can every achieve 100% perfect zero trust,” another leader agreed. A short discussion followed about what achieving perfect zero trust actually means.

“I think it means that we have a fair level of trust that in most situations, zero trust is going to be effective,” one leader said, carefully. “We have mostly effective controls – by which I mean, our controls are fully effective in most situations. We rely on technological, governance and cultural controls. But there’ll always be things that slip between those.”

“It’s best endeavours, isn’t it?” another CISO suggested.

“Exactly,” Ozonma agreed. “It’s based on the risk tolerance within your organisation. Tomorrow it’s going to change. As security professionals, our job is to consistently make sure we’re providing that level of assurance. Fundamentally, everything we do is based on risk management. Is it acceptable, tolerable, or a flat-out ‘No’?”

Which seemed to bring us back to where we came in, and the need to experiment. Also, Newman suggested, the need to share the results of those experiments.

   “Don’t let this knowledge be kept exclusive,” he said. “Leverage each others’ experience: there’s lots of lessons to learn. That f—ing around and finding out? There’s plenty that can be learned from that experience.”

The post Speak Ya Clout: Straight-Shooting CISOs Trade Real Talk On AI Security With Cisco appeared first on RANT Community.

At a recent roundtable held in Manchester on the hottest day of the year, attendees were asked why they had come along, and the responses reflected the wide range of concerns organisations currently have around AI:

• See use of AI across estates, do assurance and help people understand risks
• Squeeze AI into everything, consider what to give access to
• Everyone wants to use AI, but have optimistic dread
• We are implementing it
• Worried AI will replace jobs; my job is to make sure there is assurance
• Concerned about what employees and contractors do with AI
• How can I use AI for what I do, while managing, protecting and defending against AI threats?
• How everyone else approaches AI adoption and deals with access requests

Opening the discussion, Merlin Gillespie, director at Cybanetix, said there is a vested interest in securing technology, which is difficult enough, while also developing policies that encourage innovation. Meanwhile, Tim Gibbs, director of sales for EMEA at Noma Security, said he was relatively new to the security space but had spoken to hundreds of organisations about AI adoption and the security challenges they face every day. “We strive to keep up with the agents of change,” he said.

He noted that AI adoption continues to rise, although organisations are at very different stages of maturity. Some are well advanced, while others are only beginning their AI journey, yet all are faced with managing hundreds, if not thousands, of AI agents.

Chair Rob Black asked the table where they were with AI adoption. One attendee said they were trying to “wrap guardrails” around AI while running at “1,000mph”, while others commented that they did not want to stifle innovation but instead wanted to understand how to control AI while continuing to use the models available.

Others observed that some organisations simply “want to be the first to do everything and implement it”, while another attendee questioned who is responsible when AI does something unexpected.

The discussion centred on the theme that AI is moving from experimentation to enterprise-wide adoption at pace, but security strategies are struggling to keep up, with many organisations still grappling with what that means in practice.

Restrict and Manage Risk

Moving the discussion on, Black asked how organisations can define and manage their risk appetite without simply restricting AI altogether.

The conversation quickly turned to how AI is being used, whether internally or externally, and the implications of what external tools can ingest and what internal tools may inadvertently disclose. One attendee described AI as “the Wild West”, suggesting that some organisations are willing to be first movers, while others are happy to accept the associated risks.

Another attendee argued that business leaders are under pressure but are not necessarily discussing AI strategically. Instead, CIOs and CTOs are expected to improve productivity, while CISOs are expected to remain cautious, restrictive and sensible.

Others noted that developers are already downloading and training models, with several admitting to using tools such as Claude and Gemini. One attendee explained that AI had already helped respond to client audit requests and could “chop time from the process”.

The discussion highlighted a familiar dilemma: restrict AI and risk falling behind, or open the floodgates and attempt to retrofit controls later. Alongside this are the practical challenges of preventing sensitive data leakage, securing AI models themselves and enforcing policy-driven controls.

This is why there needs to be a broader conversation about the real challenges behind AI security in modern enterprises, cutting through market noise to explore practical approaches that enable organisations to use public AI securely.

Another attendee argued that organisations should learn from history. They pointed out that industries have successfully introduced controls around mobile banking, cloud computing and internet usage, so there is no need to overcomplicate AI governance. Instead, organisations should build on the controls and lessons that already exist.

Gillespie added that the pace of change has accelerated dramatically over the past five years and that AI is now approaching a tipping point. Organisations can almost guarantee they are using AI every day, yet the speed of adoption remains difficult to measure.

Others described AI as “more of a black box”, questioning what happens inside the models and whether they can truly be trusted.

How Do You Use It?

Asked by Black how organisations are using AI today, one attendee said behavioural AI can monitor business activity, identify anomalies and alert users. AI can then summarise those alerts, providing context around what constitutes normal behaviour.

Another attendee said AI can provide an overview of key information and help pull together sources, allowing users to generate an initial statement or draft much more quickly. However, everyone agreed that there must always be a human element involved.

On the subject of trust, Black asked where attendees were in their AI journey. One participant said they had no inherent trust in AI and instead approached it with a “zero trust” mindset, reviewing and understanding each tool before deployment. Without properly assessing and accepting the risks, they argued, users would inevitably find ways around the controls.

Another attendee said the situation is made more complicated because every AI platform is different, with no standardised set of effective controls that organisations can consistently apply.

Others noted that mapping AI outputs back to existing security controls requires considerable time and effort. While AI can often complete tasks faster than an individual, it is only trustworthy when organisations understand how it arrived at its conclusions and can validate the results.

Another attendee said AI often falls down on explainability. Organisations need to be able to ask why an AI made a particular decision and determine whether its reasoning can be trusted. AI models require tuning, and anyone expecting immediate results should instead expect improvements over several months.

Ultimately, one attendee concluded that organisations should embrace AI and innovate with it, but treat anyone using generative AI as if they were a developer.

Who Owns AI?

In the final section, Black asked who is driving AI adoption within organisations.

The discussion focused on how organisations are structuring ownership, including whether responsibility for AI security should sit with the CISO or whether new roles, such as Chief AI Officer, are beginning to emerge.

One attendee said the pressure comes from two directions: CEOs looking to improve workflows and software developers eager to adopt AI as quickly as possible.

Another argued that organisations should first identify where AI genuinely delivers efficiencies and assess whether it is appropriate for each team. They also stressed the importance of understanding where AI provides value, where it does not, and communicating those decisions in business language.

Others said organisations must determine who the users are, how AI will improve their work and why it should be used in the first place. One attendee suggested that many boards see AI as a panacea, failing to understand its limitations and associated risks. Instead, there is an expectation that AI will simply make everything better, and organisations are often expected to deliver on that belief.

Concluding the discussion, Gillespie said there is ultimately a question of trust: organisations need to get more value out of AI than they put into it, while ensuring a human remains involved. He admitted that “the world moves on” and described this as “the most interesting time in the technology landscape”. Regardless of whether AI proves to be wholly good or bad, he said, it is certainly interesting.

Gibbs said he had listened closely to the discussion around leveraging AI within the SOC, particularly the points raised around trust, data security and the rise of agentic AI. He stressed that he was not dismissing the technology, but organisations need to understand which AI agents are legitimate, what capabilities they have and how they are being used.

“The only thing is no one knows where we’re going,” he said. Although he personally vets everything AI produces, he concluded that it is “fantastic” and that he “cannot live without it”.

The post AI Security: Control, Chaos, or Catch-Up? appeared first on RANT Community.

One veteran security leader at the table thought it was important to go back beyond not just the growth of cloud computing, the work-from-home revolution kick-started by COVID, or even the birth of digital networks entirely. No: there are things that haven’t changed since at least the year 1170, when one senior executive who viewed their job as being to warn those at the top of the enterprise of when too much risk was being accepted paid the ultimate price.

“In Canterbury Cathedral there’s a shrine to Thomas Becket,” our beleaguered CISO friend said, initially to some bemusement around the room. “He told the king – his C-suite – that something wasn’t a good thing to do. Then the king said, ‘Can someone please get rid of him’? so a bunch of knights martyred him. And that’s what’s happening to security people.”

Tellingly, while many around the table smiled, perhaps in recognition that the analogy was rather extreme – after all, we’ve not heard of any security leaders being hacked to death on the orders of their CEOs (well, not yet, anyway) – nobody took issue with the basic truth outlined. When it comes to generative AI, the kings of the business – the executives, the board, the elites at the top of the organisation – are gung-ho for these new tools to be deployed within the organisation, so place implied or sometimes explicit pressure on the senior leadership who report to them to get things moving, and fast. But when the security specialists point out the risks involved, and advocate for taking time to get the deployment right so they can ensure that the business can remain as secure as possible – or, failing that, to at least be demonstrably resilient when the eventual attacks hit – the kings just don’t want to know.

“The C-suite are saying, ‘I’ve read about all this in the FT or Forbes’,” our student of the medieval world continued. “It’s FOMO,” they added, demonstrating their linguistic and conceptual agility by switching from 12th century history to 21st century vernacular in a heartbeat. “A huge amount of FOMO from executives. There are senior members of management who are going backwards.”

When Will We Learn

This contribution came nearer the end of the discussion than the start, but – despite how striking and unexpected the imagery may have been – it tapped in to one of the key themes of the evening. That was that the pace of adoption of AI is not being matched by growth in maturity of organisations when it comes to understanding and managing the risks that potentially transformative new technologies introduce. And, while nobody in the room seemed to have made a conscious decision to pile in on Microsoft, a lot of this part of the discussion came out in the form of complaints about the software giant’s chatbot, Copilot.

“I have friends,” one leader with a particular animus against this particular Redmond product recalled, “who say that Microsoft gives you access to the Foot Gun – Copilot; then they give you a bulletproof shield, called Purview, to stop yourself shooting yourself in the foot.”

It is, many attendees acknowledged, a powerful tool. “Prior to Copilot, finding information was difficult – but now, if you want to find something on your own corporate environment, Copilot will find it,” one leader said. But, many also agreed, it will find things that, on balance, you would probably prefer that no tool could.

“We’ve enabled Copilot for corporate access – [it can access] Sharepoint, emails and so on,” one senior security leader said. “But we realised that, in Sharepoint, it’ll have access to…” They paused, working out how best to explain the situation.

“My boss, the CTO, asked Copilot, ‘What’s the salary for everyone in the C-suite?’, and they got it,” they said. “We’re now looking at a technology where you create a digital twin – you get your own personal assistant living in the cloud. It copies all the documents you’ve access to in Sharepoint. We can put in restrictions on Sharepoint , but the twin can bypass them. It takes one copy of everything you’ve got access to. We all know that the attacker just has to be right once, and we have to be right all the time – but we now have to be right all the time on multiple fronts. If it was easy we’d do it ourselves and there’d be no risk – but the balance of power has shifted.”

Profits Paradise

Optimism has been expressed that generative AI will help defenders, and to a degree this sentiment was shared by attendees during the discussion – despite the view expressed by one CISO that AI “is like a four-year-old child: all it wants to do is please”. But the focus was very much on the risks that these technologies are adding to the enterprise. And, in large part, these risks are mounting because of the pressure being exerted by business leaders on the rest of the staff to leverage the productivity gains and work-speed improvements LLMs appear to offer.

“I’m hearing you say that Copilot is the problem,” Cisco’s global security technologist, Ant Ducker, said. “But we’re also being asked to be creative with AI. Is that the problem? [Business leaders say] ‘Here’s Copilot – we’re not going to give you any definitions, we’re asking you to figure out how to use it.’ Shouldn’t the business be saying, ‘Here are the things you should be looking to use it for, to increase productivity’?”

“We’re playful animals, and we learn by playing,” one security leader replied. “You don’t read documentation or worry about obeying rules – you just play with it.”

Fortunately, there are a few businesses where limits are imposed amid what otherwise appears to be a headlong dash toward AI adoption. But even in those organisations, security leaders are being put under pressure to do more, and do it faster.

“We’ve got a very well-defined process for cloud services and new emergent technologies,” one CISO said. “Our average time from the business saying ‘I want to use this new service’ to getting something in production is probably a couple of weeks. But for anything involving AI…? Copilot took us 18 months. We needed to put a harness around the harness – we have to put controls around it, and figure out how to make sure that all the regulations and expectations are met if we’re going to let it into the wild and have our population use it.”

It’s A Gamble

This talk of an additional harness raised some questions around the guardrails supposedly built into Copilot, and other LLMs, and to what extent they are effective or reliable (general consensus: not very). All of this means that internal policies and controls become ever more vital – as does having a maturity within the organisation when it comes to considering risk.

“We all seek to gain advantage,” one security leader said. “We’re all risk advisors. And certainly, in my experience, that means a whole host of different risks, including risk to life. We do a layered approach: it’s not risk removal, it’s risk reduction. And this is down to the CEO. This is what we need to realise – what and who we are. We’re risk advisors in a risk environment, and what we do is risk reduction, not risk removal.”

There was agreement with this point of view, but also some additional nuance that another leader wanted to inject into the conversation. Most risks, they argued, could be mitigated with some element of care around introduction of the new product, service or tool. The additional risk with generative AI tools seems to come, they argued, from the pace at which business leaders want to introduce them, and the circumvention of normal processes that meeting these aggressive timetables requires.

“I’ve worked in a hazardous environment,” they said, “and when you’re working in an environment where there’s extremely high risk, the idea that you’d go along with vibecoding, or would say ‘Well, there’s going to be vulnerabilities, we might as well just go with it’…” They stopped and shook their head at the sheer folly of such a notion. “No, that’s a really bad idea. You need to choose an environment – sandboxing or whatever – where you have an ability to control things and test things.

“This is the worst thing about AI being pushed in so fast,” they continued. “Dev environments have been around a long time, but at the moment they’re being short-cut. Things go straight into production.”

Heavy Mental

Ultimately, everyone seemed to agree, the only thing that’s changed thanks to LLMs is the pace with which everything happens. That covers not just the alacrity that senior corporate management seems to have for deploying the technology, but the speed with which it can wreak havoc in businesses that have failed to prepare for its arrival.

“I deal with simulation – redteaming, threat intel,” another senior practitioner said. Throughout their time in this role, they pointed out, “none of that has ever touched a vulnerability – it’s always touched a human. Can I find the human who can get me in to whatever it is I’m trying to get? With AI, now we’re going at speed. We all need to be cognisant. In organisations we’re going to see a lot of collateral damage. As people who convey risk, we need to convey it in a balanced way.”

“We need a central management pane – one pane of glass to manage everything,” Cisco’s Ducker suggested. “And in that place, that’s where we use AI for good. We create an army of agents that are network security specialists, identity specialists: we can monitor what’s happening across all the domains in our infrastructure, and we can collaborate. Rather than having four teams using their own UI [user interface], they’re all running from a dynamically generated UI.”

These capabilities, Ducker said – almost apologetically, as, he stressed, the company were not hosting the conversation as an opportunity to push a product or service, but to hear from senior practitioners about the challenges they were facing and how they were tackling them – fall within the bounds of the Hybrid Mesh Firewall concept that Cisco have adopted. A term coined in 2024 by Gartner, it “describes a central management pane that can manage a consistent security policy across multiple platforms,” he added. Cisco’s implementation of it goes further, “using the network as security fabric, and blending different kinds of security and enforcement capabilities right across the stack.”

“Listening to this, we still get back to – if you get the fundamentals right, you’re in a really, really good position,” one of the attendees said. “That hasn’t changed since the Orange Book,” they added, referring to the U.S. Department of Defense’s Trusted Computer System Evaluation Criteria standard, published in 1983. “Although it does look scary, I’m starting to think more and more – what does it change?”

The post Impatient Leaders And Troublesome Priests: Why Security Leaders Really Worry About AI appeared first on RANT Community.

“I don’t want to dismiss prevention,” one CISO said early during a RANT roundtable hosted by Halcyon in London in early June, convened to discuss responses to the deepening ransomware epidemic. “But the biggest thing to focus on is recovery.”

The sentiment proved to be something of a lodestar for the evening, as a group of senior cybersecurity leaders and practitioners dug deep into the topic of ransomware response – with resilience clearly front of mind for businesses of all shapes, sizes and sectors. A high-level delegation from Halcyon – including director of solution architecture Ross Asquith, regional director of enterprise sales Chris Lewis, and the director of the firm’s Ransomware Research Centre, the former FBI cyber division deputy assistant director Cynthia Kaiser – contributed occasionally, but for the most part sat back and listened as those on the front line of these digital battles traded war stories and drilled down into the detail of how best to configure companies to tackle the ever-changing and existential threat of a complete loss of access to data and networks.

Step Into The Realm

An early topic for discussion turned out – perhaps surprisingly – to be hardware. There were two reasons for this. Many large enterprises – and probably quite a few smaller ones – will have built around and on top of predecessor systems, as the business has evolved over time, needing to retain existing capacity and capability while acquiring new tools and technologies. This means that the business will have some degree of reliance on old and partially obsolete systems – and staff who mainly work with newer tools may lack awareness of them, never mind the skills to solve problems that may crop up inside them. Second, ransomware by its very nature poses questions about hardware inside the enterprise: if an attacker can move laterally and paralyse all systems, then not only do backups need to be offline or airgapped from the network: but any attempt at restoring services after a successful attack could make greater demands on IT capacity. Then there’s the investigative element.

“If we suffered a ransomware incident, and we needed to keep all the encrypted servers for forensic analysis, do we have the hardware to keep the encrypted stuff and restore somewhere else?” the CISO who’d rated recovery as the prime concern said. The business, he suggested, might even require a separate, mirrored, hardware laydown, ready to spin up a new network using backups, allowing the contaminated systems to be pored over. This question had preoccupied their enterprise, they said – and that had been helpful. “For us, that spurred more investment, and a lot of changes in how we did things,” they said. “Would we have capacity to restore all the servers again, while keeping what was there?”

“In terms of ransomware, I’ve prioritised identifying the really old legacy stuff, that we have no ability to redo,” another CISO said. “I read the reports on the British Library hack, and the biggest thing was the legacy systems. They had bespoke code that was old and out of date. They could recover a lot of the modern systems, but it was those old code bases they couldn’t fix. So we have a lot of backup procedures. Ransomware is not our main problem – but the responses to those main problems will fit ransomware.”

You Got Me

These questions, of course, presuppose that the enterprise has correctly identified what constitutes its key critical systems.

“Technical recovery is pretty straightforward, but identifying the three pieces of tech that would hurt you the most…? That may not be,” one senior security leader suggested. “DNS isn’t going to make your top three – but if it isn’t there, everything dies.”

“We looked at what was the minimum viable product that keeps us trading,” another CISO said. “What are those products? What are the interdependencies? And which ones have to come back up first?”

An important point, all agreed, given that certain services will rely on other, underlying, capabilities, and so will not operate correctly if restarted in the wrong sequence.

And then there’s the nature of such analyses. It’s all well and good knowing what’s important to the business, understanding the sequence for re-establishing the service, and having these processes and procedures mapped out and promulgated around the workforce: but if people aren’t well practiced in carrying out these often complicated tasks, and are practiced at doing so under the kind of pressure that would attend a real incident, true resiliency will be impossible to achieve.

“There’s no point just having it on paper,” one veteran security staffer said. “How many times a year do you test? And do you always test the same people? You shouldn’t.” Their business, they said, runs tests several times per year, using different staff, to see if they can recover the business from the documentation that exists. If they can’t do it, the exercise is marked as a fail, and would need to be re-run.

“That scares me,” another leader admitted. “I’m down to one person on a lot of key systems. I know that the person who knows how to get it all back up is Mike – but if Mike’s not there, how do we do it?”

Double Trouble

As had been previously touched on, sometimes, resiliency will mean having a completely separate alternative ready to go if the worst comes to pass. This need not be as prohibitively expensive as permanently maintaining a complete replica of the existing systems.

“We have a waterproof case with a phone in it and a flash key. We’ve worked out, on our business-continuity plan, that that’s what we need,” one pragmatic CISO said. “We’re having to put in whole systems on standby – full email, and other systems, that we can switch to – because with the cloud, the extraction cost of data is massive; that won’t work for us as we can’t afford it.”

That CISO’s enterprise had reached this conclusion after realising that, due to specific concerns with the nature of the threat they were exposed to, and how their business was organised and its data stored, a strategy built around even the most frequent and diligently executed of backups simply would not work. There are dangers in relying on backups, particularly as ransomware groups evolve their tactics and procedures. One recent example Halcyon had dealt with proved instructive, where a patient adversary used a company’s well-implemented backup strategy against it.

“This blew my mind – and it takes a lot to shock me,” Kaiser said. “We’ve seen an actor recently who sat on a network for 31 days. They gained access to the systems, and saw that the backups were done on a 31-day cycle – cancelled the backup services, waited, then attacked. And the organisation didn’t know.”

“We had to develop an out-of-band – out of current systems – means of comms and co-ordination to bring every office up to a standard where they can operate,” another security manager said. “It’s meant putting in almost a full shadow IT, because there’s no other way we’ve currently found, within our budget. We’ve contracted for shadow IT services we can put data into.”

While this option, as they explained, was adopted for budgetary reasons, it is still by no means a low-cost solution. It will only work if all the necessary staff are trained and ready; and achieving and maintaining that level of readiness places significant demands on internal resources.

Dynamite!

An interesting side-discussion blew up around insurance – with some leaders arguing it was a pointless waste of money, impossible to be sure that coverage would work until after an attack, and that being the worst time to find out that some loophole or other had been found in the coverage; while others strongly advocated for the forensic capability and expertise that cyberinsurance providers are able to deploy, at no cost to the business, in the aftermath of an attack. But another topic that provoked lively exchanges was on when, and to what extent, ransomware attacks could stray from being a threat to businesses, and into territory where states may start to think about designating them as terrorism.

“All ransomware is a crime, and some of it is terrorism,” Kaiser said. “In U.S. law, and the definitions there, we believe it would meet the threshold for terrorism if ransomware was targeting a hospital.”

But designating ransomware as terrorism – even if it was something that cybersecurity leaders were in a position to do; which, of course, they are not – is by no means a straightforwardly beneficial proposition. As Kaiser noted, doing so might well provoke attack groups to “change their calculus.”

If a ransomware attack on a particular industry or sector were to be considered terrorism, and the individuals who carried it out were to be charged with that crime, perhaps the efforts put in to identifying and apprehending suspects would be intensified, cross-border law-enforcement collaboration might be given a higher priority, and the penalties for those caught and tried would be significantly increased. But it is unlikely that a threat actor would respond to that by ceasing operations completely: more likely, they would redirect their efforts onto sectors where an attack would not be considered terrorism. So while there would be clear social benefits, there would also be considerable costs – which would fall on businesses operating outside critical services and infrastructure.

Additionally, as other attendees argued, the detail of any such designation would be key – both for any deterrent effect to prove meaningful, and to ensure that increased risk outside critical sectors wouldn’t end up having knock-on effects that were just as disruptive.

“We’ve designated more and more operators as being ‘essential services’,” one security leader said, referring to consideration given to what constitutes critical national infrastructure in the UK.

“There used to be a line that was clear – ‘We are CNI, you aren’t,’,” another leader said. “Smaller organisations would wonder, ‘Why would anybody attack us?'”

The answer, a third leader suggested, was pretty obvious:

“If you’re very well hardened, the attackers go a level down.”

Then risk there may well be greater, even if the initial reward in cash terms for the ransomware gangs is going to be smaller. But one of the big changes Kaiser says Halcyon are seeing is that threat actors are targeting small and medium-sized firms more often than they once were – four times as many SMEs are getting hit now compared to large businesses, she said. And if a sub-supplier to a CNI entity gets taken down, the ripple effects on their CNI customer could be just as damaging as if the critical industry had been targeted in the first place.

Livin’ In A New World

If the considerations that need to be assessed before a nation decides to designate ransomware attacks as terrorism are complicated, so too are the decisions each of us make in how we talk about the topic. One CISO spoke about how their enterprise has benefitted hugely from having internal presentations made by a few brave souls whose companies were hit by ransomware, and who have chosen to share their experiences with others as a means to – hopefully – helping ensure what happened to them is not repeated elsewhere. That kind of behaviour should be considered heroic: yet, as the CISO noted, so often the response towards victims of ransomware is very different. “When people get mugged, everyone is sympathetic,” they pointed out. “But when you get hit by ransomware, they’re not.”

“It’s important to treat victims as victims,” Kaiser agreed, her years in law-enforcement adding considerable weight to the observation. “It’s a really hard conversation, though,” she continued. “Some boards and C-suites ignore security advice – so perhaps it’s a reasonable feeling in those cases. We know adversaries are relentless, so if they want to get in, they will do eventually. But it’s up to us to hold people responsible if they haven’t done the easy things.”

Other leaders recognised that the tone of these conversations is very important, and can make a big difference – not just to managing relationships in the supply chain, but to achieving the best possible security for the business itself.

“We’ve spoken to our vendors on resilience quite a lot, and we keep saying we don’t want to blame anyone, but that we want to know what happened so we can fix it and prevent it happening again,” another security leader said. “With suppliers, this usually is OK: but if their business culture is different, it may not roll down the rest of the supply chain the way you would want it to.”

Use of language is important, too. Returning to the conundrum of whether or not to designate ransomware as a form of terrorism, one CISO noted that, particularly in sectors such as healthcare or social services, terrorism may be received as “an angry, noisy word” which would perhaps end up closing conversations rather than causing people outside the SOC to think more about their physical and digital security.

“It’s very similar in the U.S.,” Kaiser acknowledged. “If I start talking about threat actors as terrorists, some people think it absolves them from doing better. We should dissuade ransomware groups from targeting life-critical entities, but it’s impossible to separate physical risk from cyber risk. To me, you have to make sure that if you’re using these words, it’s not going to allow anyone to think it lets them off from doing the basics.”

The post Respond/React: Resilience And Recovery Dominate RANT’s Ransomware Roundtable appeared first on RANT Community.

“Who still relies on spreadsheets to manage their suppliers? Who only performs third-party risk management once a year? And who finds it challenging to engage business stakeholders throughout the process?”

These three questions from Diligent’s Jelle Groenendaal, Co-founder of the firm’s 3rdRisk business, elicited raised hands and nods all round during another fascinating RANT roundtable. No one likes managing suppliers. But it’s an increasingly critical endeavour. An estimated 97% of global organisations experienced at least one supply chain breach in 2025  up from 81% the prior year.

Managing nuclear-grade risk

The stakes don’t come much higher than the supply chain of a nuclear submarine. That’s the world that guest speaker Helen Quinlan, Head of Cyber Risk at BAE Systems, lives in. She admitted that it can be “mind bogglingly” complex.

“We have a large and complex supply chain. One of the main complexities is around the continuous monitoring of suppliers,” she said. It would be a matter of national security if the ownership of a key supplier was transferred to a hostile nation, for example, Quinlan explained.

It’s not just about the ownership of vendor partners but also access to critical services that security leaders must consider when evaluating suppliers, suggested another attendee.

“There’s a lot more geopolitical instability than we’ve had in my lifetime; so every company from a resilience perspective has an interest in considering what happens if a critical service or resource or component is suddenly denied for geopolitical reasons,” he argued. “The supply chain plays a significant part in an organisation’s resilience.”

The security leaders around the table shared various approaches to TPRM. One said he builds disclosure rules regarding “material changes” into contracts – which meant that, when a legal supplier was hit by ransomware, they had to disclose.

Another advocated “defence in depth”, including questionnaires, continuous monitoring, contractual clauses and incident response testing. Diligent GRC Sales Director, Tom Ryan, added that sentiment analysis is useful because scorecard-based systems often don’t pick up the reality of what’s happening inside a supplier.

“Everything looked really good, but our AI monitoring found employees complaining about the culture, about the practices of their information security team, on a forum,” he explained of one customer engagement. “That’s not what the company is showing to the world.”

Another CISO sat around the table bemoaned the “scorecard complacency” of many organisations. “Scorecards look wonderfully green until you cut through and they’re red in the middle,” he said.

Most attendees agreed that questionnaires should just be the starting point; a first stage in a multi-layered TPRM process. But they can be made more insightful with the additional of AI tooling to analyse not just the answers themselves but also how questions were answered to flag risk indicators.

“It’s not perfect, but if you’re able to capture the data there are ways to be able to spot indications of misinformation and fake evidence,” said one CISO.

Get out of the cupboard and talk to the business

Engagement was a recurring theme on the night – both in terms of communicating with the business and reaching out to suppliers. One security leader complained that his suppliers are mainly “one-man bands” with limited cyber awareness, which makes it difficult to gain true visibility into risk. Another, who works in manufacturing, said it’s also challenging to engage when faced with a culture of “I know how to run my factory”.

A third CISO argued that collaboration with business leaders internally is essential.

 “You can’t do it if you’re locked in a cupboard all day. They’re the only ones who can assess how critical a supplier is,” he said.

However, sometimes suppliers are so big that they refuse to engage with questionnaire-led TPRM efforts. Several security leaders bemoaned the larger SaaS players that simply direct such requests to their “trust centre”. “It’s hard to get the nuanced answers I need this way,” said one. Another suggested “It’s not necessarily the big [SaaS] suppliers I worry about, it’s the next tier down.”

Testing times for risk managers

However, if the big SaaS players don’t answer, you can always work out a backup plan, suggested one senior security leader, explaining that IR tabletop and real-time simulation exercises are often offered as part of their engagement. Among other things, this can help find the gaps between what a supplier expects a partner will do during an incident and vice versa, one attendee said.

However, another bemoaned tabletop exercises featuring overzealous participants with a “Tom Clancy complex” that try to create impossible series of events to wargame. This ultimately undermines business confidence in the exercise, he argued, adding: “It has to be within the realms of possibility. It has to have value.”

Another said that, partly for these reasons, the security team clearly establishes up front an important rule: “Don’t challenge the scenario, take it as real.”

Yet most seemed to approve of the idea of incident response testing as a way to lower third-party risk.

“The problem is we’re never going to solve this problem because we’ll never have anything other than an opaque boundary with our suppliers. It comes down to trust, and the fact is we trust our suppliers far too much,” argued one CISO. “When we’re looking at our resilience, we don’t look at the ‘what-ifs’ and contingencies that we need to be able to deal with enough, particularly for the minimum viable business.”

Getting the board on board

Perhaps most important to effective TPRM is getting engagement from senior management, because if the board isn’t on board, money simply will not be made available for these initiatives. BAE Systems’ Quinlan asked how those around the table approach this.

One lesson that emerged from the discussion is that visibility must be the first step to driving this type of engagement. “We see near misses every other day,” shared one CISO. “We collect a lot of data which goes up to the board, so they are throwing money at it.”

Another argued that regulators make it important for the board, as does “brand reputation and “how seriously the entity takes its business”. A £30m bank that “can’t afford to go down” is more likely to have a boards receptive to TPRM as a critical exercise than smaller players, he suggested.

However, this isn’t always easy in larger conglomerates. One complained of “mixed signals” from the corporate group leadership and at the individual company level.

“At a group level it’s a huge focus. But the people that are paying for it on the ground say ‘we know it’s really important, but we don’t have any money’,” he explained.

The good news is that tooling is improving to the point where AI can do much of the heavy lifting for teams, concluded Diligent’s Groenendaal. The right tools can remove the pain of spreadsheets, help risk leaders engage business executives through things like customised chatbots, and benefit from a “continuous multi-disciplinary overview of risk”, he said.

“I’ve worked with many systems myself and they’re all boring. You feel like you’re going back to the 90s,” he added. “But with AI there are so many things we can improve.”

The post Supplier risk management can be “mind bogglingly” complicated: where do we go from here? appeared first on RANT Community.

Inevitably, and quite correctly, vast arrays of technology are brought to bear on security modern businesses, their valuable data and systems, and their functions and financial viability. And of course, the systems that contain the vulnerabilities and weaknesses that attackers seek to exploit are technologies in and of themselves. So the ways many of these problems arise, and the ways in which they get solved, involve technology intimately and necessarily. But at the heart of every business, every system, and every security incident, there are people – and it is their capabilities, motivations, mindsets and split-second decisions that make all the difference.

A RANT roundtable held in London, and convened by the email-security-provider-turned-risk-reduction-specialist Mimecast, found a high-level group of CISOs, BISOs and senior cybersecurity practitioners sharing thoughts, ideas and experiences around human risk. It was noted at the outset by both Alastair Dickson, Mimecast’s enterprise sales director, and Jhetan Gaijar, the firm’s field CTO for the EMEA region, that even in the few weeks between the discussion topic being circulated to RANT community members and the event taking place, ideas had shifted: instead of businesses concentrating on risky users, more seemed to be focusing on the risks posed by non-human identities, particularly agents created by or with generative AI systems.

Yet even with that idea flagged up at the start, the attendees spent the vast majority of the roundtable talking about humans rather than agents. For many, the question about who their riskiest users are was fairly straightforward to answer – even if doing anything to limit that risk would be incredibly difficult, again for reasons that are usually very little to do with technology and largely based around personality, seniority and interpersonal politics.

The Dream Is Always The Same

“I know who my riskiest user is,” one CISO said without hesitation. “He’s very clever, very bright – speaks in binary. He turned off MS Defender because he didn’t think he needed it, and was running all kinds of software. He can never remember his password, so he’s got it written on a yellow sticky note on his workstation, and he’s texted it to his wife just in case. He’s an admin.”

“We have a similar situation,” another senior leader said. “Our cyber team are very clever and very technical, and they think the rules don’t apply to them. They’re that good, that they reckon they’d never fall for anything. But by the very nature of the work they do, they’re a much greater risk to the organisation.”

“When the average person clicks on something, it causes a headache,” a third embattled security leader agreed. “But in an organisation of thousands of people, if you’ve 10 super-admins with God-level privileges and one of them clicks on something, then you’re in a world of pain.”

Dealing with the threat posed by the expert user can be tricky. It’s certainly not a problem that can be solved by the business investing in a new tool or technology – though you may only find out that the threat exists by deploying some software that will surface the combination of high-level privilege and disdain for established enterprise-wide usage rules. Ultimately, the only way to successfully address this involves having a difficult conversation with the individual in question, and then keeping them under a watchful eye thereafter.

“That guy was given a written warning,” the CISO with the sticky-note-writing colleague recalled. “We weren’t officious, and he understood so there was no need to get nasty. His manager explained why he had to follow the rules too. But it’s very hard, across an organisation, where different IT admins are doing their own thing, to have a completely locked-down system. Privileges migrate over time; there’s shadow IT. People aren’t careless. But understanding every variable is not really viable.”

After The Fall

If a business has managed to rein in the “it won’t affect us” behaviour among its admins and cybersecurity teams, there’s another category of user who are likely giving headaches to the security leadership: the board and the senior executives. In their case, this is because their intimate knowledge of – and largely unfettered access to – all of the enterprise’s crown-jewels data is accompanied by a tight timetable and a high salary; and, often, these are connected to a significantly enlarged ego.

“The cyber teams often feel like they’re the experts, so they won’t get caught out,” one CISO moaned, “and the board and the execs don’t do the training because it takes up too much time. It’s like they think the rules don’t apply to them.”

This combination means, all too often, that board members or high-level executives are unwilling to lower themselves to do the drudge work vital to keep the business secure, and believe, like the admins, that they can pull rank when it comes to personal behaviours – because their value to the business shouldn’t be restrained by all that security red tape. Unhelpfully for the security teams, their identities are usually plastered all over the public website and the financial pages of the news media, so the risk of them being targeted by a phishing campaign is higher than the average lower-level drone.

“At a previous organisation I worked in, the CFO failed a phishing test,” one security leader recalled. “He’d turned off Defender because he found it was a pain. It’s often that very privileged user who thinks differently and bypasses the controls who becomes the biggest risk.”

Other attendees chimed in with examples from their businesses where senior corporate leaders had either been caught by a phishing simulation, or had clicked on a link in an actual phishing email. Encouragingly, some of them had chosen to “out” themselves within the business afterwards – using their mistake as a teachable moment, reminding the rest of the business that this can happen to anyone, and encouraging the entire workforce to be on their guard. But still…

In The Air Tonight

Of course, after an exchange of tales of woe, the talk turned to how – if at all – such problems could be contained, minimised, or even, possibly, eradicated. For all that a high-profile staffer issuing a company wide mea-culpa can help focus the wider workforce’s attention for a while, that doesn’t count as solving the problem: as one CISO noted wearily after their company had scored a perfect zero click-rate in a company-wide phishing exercise following an uncomfortable incident, the one they carried out a few weeks later saw rates back up around 20%.

This is where the discussion hit upon the theme that came to define it: dialogue. The challenge, several leaders all agreed, is not so much about getting those click rates down, it’s about understanding why people click in the first place. If you can do that, there’s a chance you can build an environment and a culture within your workplace where people won’t click, because they’re no longer put in a position where doing so is even slightly tempting.

“I’ll go and talk to people who’ve clicked, and I’ll ask, ‘Why are you doing that?’,” one leader said. “If it’s because they have to go from one account to another, then OK – I get that. It’s not my job to make their job more difficult…”

“It is!” another CISO interrupted, jocularly but pointedly. “Because the consequence for you when they do something stupid is months of hard work.”

“The reality is that pretty much everyone in the organisation will make a mistake at some time,” another security leader said. “Humans live incredibly complex lives, and get themselves into all kinds of muddles. Even in an ordinary life, people are subject to a lot of stresses, and can easily get caught out by a timely – or, for them, mis-timed – social-engineering attack that gets them when their defences are at their weakest.”

Tackling this problem can be conceptually challenging, and perhaps difficult for businesses to implement within a hierarchical and strictly role-based corporate structure (is it really security’s job? Is it HR? IT?). But in those companies where it has been tried, the effects can range from the healthy to the transformational.

“In our company’s history, nobody had ever talked to the user,” one CISO said. “We put out two queries every day to our users, and they have to answer them. We found that some users don’t even have the ability to do certain things on certain browsers, and the things we were asking them to do weren’t compatible with how they work.”

The Pump

And then there are the businesses where the instinctive behaviour is less about receiving than it is about transmitting: where, when employees are heard from, they’re hopefully reporting back with news of enhanced productivity and big wins – not being canvassed about new problems the enterprise has to allocate additional resources to fixing.

And it is here where the dread spectre of generative AI looms largest. Not only are these powerful tools in the hands of adversaries who are using them to help craft ever-more convincing phishing emails or to carry out more successful social-engineering attacks, but business leaders are obsessed with them to the point of pushing their adoption via some not-entirely-helpful new corporate initiatives.

One senior security leader described a situation that has come about in their company, where staff are given a target of a minimum number of tasks they should carry out per day that involve use of an AI tool. They made the point that, whatever the benefits the company will see from greater use of genAI, such a policy adds risk.

“Everyone’s trying to do things just to put ticks in boxes,” they said. “If I get an email that says, ‘Your scheduled Copilot task has just run’, and I click on it, then great! That’s just upped my score. But it was a phishing email – oh, you just got phished.”

“There are psychological characteristics that mean people are being rational and wanting to be productive, and those are the things attackers exploit,” Mimecast’s Gaijar noted. “One thing we’re not indexing properly is that AI is accelerating that. Not from a technology perspective – now I’m worrying about whether I’m being more productive than my colleague. I have to be at least as productive, if not more so, in order to keep up. So all those cycles are speeding up.”

Gaijar went on to outline one way in which some of these competing imperatives could be balanced, though it would not be without significant challenges for businesses based in all but a handful of the world’s nations.

“The problem is, email was intrinsically designed as an open standard,” he said. “There are a variety of technologies that can give you a high degree of confidence [that an email is legitimate] but that doesn’t help if the sender’s account has been taken over. One area we’re looking at is called intent-based analysis: we’ll try to look at what the intent is that lies behind an email. But implementing that doesn’t raise a technical problem: it’s a privacy problem – because, in order to do that, I have to read your email.”

In the mean time, attendees seemed to agree, one of the best things that security teams can do is to open, and maintain, ongoing and blame-free dialogue with the users. Understanding why they do what they do will help to minimise the number of times where they engage in risky behaviours. And if the users feel that the security teams are actively trying to help, and are encouraged to understand why different security measures are necessary, there is less likelihood they will adopt covert workarounds.

The post Risky Business: How To Avoid Paying The Security Price For Not Understanding Your Users appeared first on RANT Community.

So it was in Edinburgh recently, when a room full of senior cybersecurity practitioners gathered – alongside members of staff from event sponsors SpecterOps – to discuss attack-path mapping. Credit for the orderly way the ensuing discussion proceeded must go, in the main, to RANT’s guest host for the evening – Harry McLaren, head of cyber defence at Tesco – who had clearly mapped out his own path through the discussion beforehand, ensuring each and every expert at the table had an opportunity to contribute. But in part, too, the topic seemed to demand a well-planned and logically structured approach: not least because, with attendees coming from a wide range of industries and representing companies of differing sizes, structures and marketplaces, it was only by creating space within which subtle differences could be explored that each person present could learn something from their peers.

Money-Go-Round

After introductory remarks from SpecterOps’ director for Europe, the Middle East and Africa, Tony Sheldrake – who outlined the firm’s concept of identifying and neutralising “choke points”, the nodes within the digital estate where the majority of attacks need to pass through in order to succeed – and the company’s solution architect, Kay Daskalakis – who noted that attackers “don’t have to go down the noisy roads; they don’t have to compromise anything, use any exploits. There is no perimeter – that’s a misconception” – McLaren kicked the discussion off with a thoughtful outline of the point and the purpose of attack-path mapping. Anyone wondering why they should bother with what might, at first glance, look like a somewhat academic or self-sustaining exercise should consider how closely aligned it is with so many other parts of the security professional’s remit, he argued.

“What is the ultimate purpose of many of our roles? To help businesses manage risk,” he said. “Fundamentally, that’s about taking action to bring risk into tolerance. Being threat-led helps us do that. And to be threat-led you have to understand the adversary, and how they understand you. Then you need to understand yourself, your attack surface – all the things that make up your business in the digital world, and in OT and IT. And then the state of your controls: the things that are there to interact with your adversaries.

“This is all theoretical, and none of this is easy,” he continued, “It’s not a new concept, but it matters now more then ever because of prioritisation. As professionals, the one thing we can do is sort our to-do list. We can’t flood dev teams with hundreds of vulnerabilities; we can’t check for compliance across every endpoint. So understanding the reality of our environments becomes the means by which we can prioritise. Attack path mapping is all about prioritisation: Where can I make the smallest investment that has the biggest impact? Choke points are the same concept. You want to stop them early, but not at high cost or with high friction. When we’re talking about choke points and attack paths, it’s identifying the biggest bang for the buck – which baskets to put your eggs in. Nine out of 10 Red Teams would take this path, 10 out of 10 adversaries use it, and we just took it off the board.”

McLaren ended his round-up by posing a question to those around the table: does attack mapping matter to you, and if not, how do you prioritise?

Walls Come Tumbling Down!

“It feels, from my perspective, that it’s a good time to bring in solutions like this,” one CISO said, referring both to attack-path mapping in general and SpecterOps’ Bloodhound Enterprise system in particular. This was the case, they said, given conceptual changes such as the very welcome “push from the NCSC to describe this as ‘cyber resilience’, not ‘cyber security’ – that we need to use ‘resilience’ because we’re talking about constant attacks.”

As the discussion progressed, the consensus that mapping attack paths was a sensible and useful thing to do was never questioned. However, not every business is necessarily ready – or able – to take what can feel like quite so significant a step. Sheldrake had explained that Bloodhound Enterprise can carry out its initial mapping exercise and identify potential attack pathways within as little as 30 minutes, often flagging up hundreds of thousands of pathways. McLaren had pointed out that this can be a huge help when it comes to prioritising security work within the business, but even so, the sheer scale of the likely results poses problems to security teams who are already finding it impossible to deal with the incidents the enterprise is currently facing.

“Attack-mapping is on the to-do list perennially – but it either means bringing someone in, at a cost; or getting people to do it who are already doing other things,” one security leader said. “Sometimes we know where the big weaknesses are. The buzz phrase is ‘identity is the new perimeter’, and it’s kind of true: we know that’s a priority, so we’re working on it.

“I’d love to drill the Blue Team every month, but they’re always on incidents,” this leader continued. “We had more incidents in March than in the whole of last year. AI has helped attacks explode, but the agents on the defensive side aren’t there yet. Defence is always behind, but what do we do when we know [attackers] have access to tools we don’t know about yet? That’s the world that’s coming. We expected to have vulnerability scanning at scale, and it’s about to happen – but we’re not ready for it.”

Shout To The Top

Despite the appreciation of the huge help attack-path mapping can deliver, some other attendees flagged up problems that carrying it out could cause.

One CISO – their organisation’s sole cybersecurity practitioner – was finding that the board were being of great help, and had responded to mapping already done with great willingness and a ready supply of resources: “They know what the crown jewels are, but they’ve never known what paths can get there,” they said. “It’s a terrifying place to be! But it’s in the forefront of my organisation’s thinking.” Others argued that it would be difficult, perhaps impossible, to map when, where and how data may be being moved around inside the business through processes and tools that security teams didn’t have detailed insight into. Another leader argued that “traditional attack paths don’t apply” in their business, because of the nature of the business, and that their primary present concern was third-party and software supply-chain attacks.

Another concern was raised over the effect an attack-path mapping exercise may have on people inside the business, and their attitudes to risk going forward – particularly the board.

“We did attack-path identification six months ago with a vendor,” one leader recalled, “and the downside is the false sense of assurance. For a week or two, the Red Team tried to get in, and they couldn’t – so the CEO took huge assurance from that. But a persistent attacker wouldn’t give up after two weeks. So it’s not a really relevant metric to judge yourself by.”

This leader also raised a second concern, which spoke to the point raised earlier by one of the other attendees.

“In terms of our crown jewels, we don’t really know where they are,” they said. “We’ve got data here, a system there – we know they’re important, but are they that important? It’s difficult to arrange your defences appropriately.”

Another concern was raised by a CISO whose board have fully bought in to the security mission. In a way, it seemed related to the questions posed around the scale of discoveries uncovered by a mapping exercise: what if all that they reveal is a problem too vast to tackle?

“Our c-suite have been really supportive of Red Teams and tabletops, to the extent that they’re happy to be targeted by social engineering,” they said. “When you see the level that the Red Team goes to… in one case, they identified a particular executive was into support for the armed forces, they found an event in that space, got in touch with the executive and asked them to speak at the event. It’s so targeted. Being realistic means saying that they’re going to get in. And when you get to that level of targeting, and it becomes automatable, then that human line of defence has gone.”

The Whole Point Of No Return

As the discussion circled the table, these questions of scale kept bubbling back to the surface. It was clear that, while everyone agreed that it’s better to know where the potential problem may lie – and everyone in the room fully understood the choke-point concept, and how identifying a key node through which an attacker has to pass, and denying them the ability to do that, would dramatically reduce the number of pathways left open to them – surfacing a huge number of what the board would surely view as new security risks would be problematic given the personalities and the interpersonal dynamics at play inside their companies. This was an argument SpecterOps had heard before, and they have found instances where businesses have been able to adopt a different mindset which can help reframe the discussions at board level.

“Getting visibility into the sheer amount of attack pathways generally helps to prioritise attack path mapping as a project,” Sheldrake said. “And that then helps you sell that up the chain, and build it into a business case. Generally it’s hundreds of thousands, and sometimes we’ve found billions. At the end of the trial you’ve then got that ‘Oh shit’ realisation: ‘We’ve found all this, we’ve got to get other teams in; who’s going to own it and who’s going to do the remediation?’ But it certainly helps you to build an internal business case around the risk.”

As if implicitly using the same methodology to flag up a related challenge, another senior security leader identified a different pathway by which a similarly daunting amount of work could be surfaced in the enterprise – and noted the difficulties that come with that.

“We had a new CISO join at the beginning of last year,” they said, “and the first thing they wanted to do was a Red Team exercise. We’re still remediating! It gave us a massive list, which we prioritised, and then followed that with a risk assessment. But we’re still flooded with requests. A lot’s been done, but there’s a lot still to be done. Many of the records were very vague – we didn’t get the detail that we’d hoped to see. It’s going to be next year, realistically, before we can re-test.”

“It’s about appropriate defence in depth as well,” another CISO argued. “Assuming something is going to happen, how do you contain it and respond? You’ve got network segmentation; you can remove privileges; you can have just-in-time access – but it’s getting visibility of what’s the biggest risk, and knowing what you have to tackle first. That’s probably where the focus has to be.”

“Nothing’s new here,” said one of the other attendees. “We were having these discussions 20 years ago. All that’s changed is the pace. I really like the idea of the tool – it could make my life easier. But it isn’t going to fix anything. It’ll show you what needs to be done, which will help. But you’ve got to be doing the basics to reap the rewards of using tools like this.”

“I agree,” McLaren said. “Fundamental security best practices have always been the thing to solve first.”

The World Must Come Together

A RANT roundtable always ends with a summing-up from the host, and from the sponsor – but, just as this evening had proceeded rather differently to the norm, so the final contribution from Daskalakis stepped beyond what RANT’s “frequent flyer” attendees might have expected. After explaining that he’d had to rein himself in for the duration to make sure he was able to listen to, absorb and fully understand all the points being raised, Daskalakis opened with an admission.

“This has, honestly, been like therapy,” he said. “For far too long we’ve focused on protecting the attack surface outside the organisation, and the outcome is the conversation we’ve had tonight – which is problems, problems, problems, rather than solutions. But then the conversation shifts naturally.

“In different environments of different organisations in different verticals, in any industry – it doesn’t matter: it’s the same story,” he continued. “If you have AD [active directory], you are pre-compromised. Let me explain what I mean. There are structural and defensive impositions of AD that made it a fantastic solution for the ’90s. But attackers don’t care about the entry point – they care about the reach of the account. There are unlimited options. ‘One attack path is all that I need – then I’m moving from the perimeter to the calendar of the CEO’.”

And, he noted, when attackers are willing to buy credentials from disgruntled or cash-strapped employees – and when they are then able to identify and use pathways to move inside the business which weren’t envisaged by network defenders – the challenges only multiply. And while defence in depth can be helped by prioritisation, even that doesn’t go far enough. The challenge, ultimately, he argued, is to try to think like an attacker.

“I’m sure you all play around, you’re curious; you see things, you sign up for a subscription,” he said. “Attackers are not different. That’s the problem we’re facing. We’re facing people who look like everyone around this table. We need to be safe. Increasing difficulty doesn’t work – if it worked, we’d have solved the problem. Ninety percent of attacks are identity related. Why are we focused so much on networks, on assets? Every attack I’ve seen was identity based. If we focus there then we may not end this problem, but we can at least be more resilient.”

The post The Ever-Changing Moods Of Cybersecurity: Why Mapping Attack Paths Is Vital, But Problematic appeared first on RANT Community.

Well, not quite, according to the security leaders gathered for a lively RANT roundtable, hosted by Check Point. The event surfaced some useful strategies for managing network security in a fragmented and increasingly AI-driven world.

Outside-in or inside-out?

Check Point’s Global CISO, Deryck Mitchelson, kicked things off by comparing the threat landscape of 30+ years ago with the one today. Check Point was founded in the early 90s with a mission to “protect the internet” via its security appliances.

“Today, we need to understand what we’re exposed to. AI has changed it all,” Mitchelson argued. “Real-time threats that need a real-time response is where we are now.”

The first step to managing risk is understanding where all of your assets are, attendees noted. They were also in agreement that this is almost impossible to do – especially across IT and OT environments.

One complained that their CMDB is “all over the place”, but still maintained it as vital for many activities, including rationalisation. “If you don’t have a good asset management, you’re at a low bar on where to begin,” she said.

Another shared that asset management has “always been chaotic”, especially thanks to M&A activity. “As soon as you get it together it blows up again,” he said. “But the danger is, if you sit on your hands until it’s done, you won’t get anything done.”

A useful way to start is to focus on what threat actors might be able to see from outside the network. A BISO around the table claimed this will help organisations save time and money and prioritise their defensive efforts. Another agreed. “No CISO knows what their network looks like,” he argued. “So look at what’s vulnerable first then you can start working from the inside out.”

Another option is to focus on what threat actors are actually interested in. One security leader explained that he prioritises according to threat intelligence about where and how the organisation is most likely to get hit – and “uses that as a steer”.

“It has worked to some level, but stumbles in SaaS,” he admitted. “We don’t know where they’re going to go next with SaaS.”

Levelling the playing field

The challenge, articulated by another attendee, is that threat actors are increasingly better resourced and – as always – they have the advantage of surprise. “It’s a problem as old as time,” said another. “They only need to get it right once.”

Check Point’s Mitchelson concurred, arguing that AI phishing services are available on the cybercrime underground for as little as $100. One way to level the playing field is to focus as much as possible on resilience and recovery – keeping the business running even throughout an intrusion, said another security leader.

“Deal with what you know,” he said. “We can’t spend the money the attackers are spending. We’ll always have fewer resources, so my philosophy is not to stop them, but to continue operating.”

This can actually take the pressure off teams and free up valuable resources, he said. “It means more money, time and brainpower for the other stuff.”

The (insider) risk that keeps on giving

However, these efforts will be all for naught if organisations can’t manage the threat from within, attendees agreed. One complained about employees unwittingly sharing PII and IP with public AI models. “If it’s free, you’re the product,” he fumed.

AI assistants can also expose organisations to risk if overused by DevOps teams without sufficient guardrails. One security leader at an app developer said her team is being forced to “rebuild the factory” by inserting security into critical processes. “We can’t manually triage risks anymore,” she explained. “We have to find [issues] and help fix in an automated way.”

While AI misuse could be put down to user error or negligence there are also more malicious insider threats to consider.

“We assume that they’re always a disgruntled employee, but a lot of people aren’t,” said one security leader. “It could happen at any point in their tenure. We try to understand normal behaviour to alert on anomalies. But some of the worst incidents happen with just one email.”

Another shared the ingenuity of one malicious insider who exfiltrated data outside of the organisation by copying and pasting it into LinkedIn messages to send to themselves. Check Point’s Mitchelson argued that the security industry should be doing more to support customers with behavioural security. “We need to be asking more of our security vendors: can you do more to detect these anomalies?” he said.

Turn it up to Eleven

The elephant in the room, as always during these events, was AI. “Agents are a new attack surface” which can be manipulated by both technical means and social engineering, warned CISO. AI is fuelling “accelerated risk discovery” that turns threats “up to 11”, claimed another.

The backlash appears to have begun. Several attendees said they were actively eschewing SaaS tools with AI built in. One described the level of AI governance among vendors as “shocking”. Another bemoaned: “There’s no role-based access controls, no visibility and no ability to backup and restore in the event that something goes wrong.”

The answer for many is to build layered defences. There’s value in this approach even as powerful new models like Mythos rewrite the rules for attackers and defenders.

“You need segmentation, you need identity and access management. You need to ensure your PAM is secure. All the layers need to be in place, and the effect is if one fails you can rely on the others,” she argued.

Another CISO agreed. “It’s about making things as hard as possible [for adversaries],” he said. “You can’t remove the risk, just reduce it.”

Whatever happens, “preventative, real-time and behavioural” approaches to cybersecurity will stand network defenders in good stead, Mitchelson concluded. It should be some comfort that, amid tremendous technological change, the old ways are the best.

The post Network visibility and control in a chaotic world: why defence in depth rules appeared first on RANT Community.

A lively RANT roundtable hosted by Check Point proved that there will be no easy path forward. But with a relentless focus on visibility, context and remediation, there may be an opportunity to level the playing field with adversaries.

Check Point Head of Product, Ophir Bleiberg, summed up the core challenge nicely.

“How do you minimise the time from exposure to mitigation, because you can’t patch everything? We’ve come to realise it’s not a purely technical problem, it’s an organisational problem. Everyone has a different goal and visibility.”

That provoked a combination of exasperation and fatalism from the assembled crowd of cybersecurity leaders. Many agreed that siloed, incomplete data and uncoordinated SOC, vulnerability and infrastructure teams are making the problem worse than it needs to be.

“Mythos will create even more noise,” one despaired. “How do we understand the true attack paths that will hit us?  How do we stop them getting to the crown jewels, because we can’t patch in time?”

The CMDB as friend and foe

Most agreed that visibility is the critical first step: understanding what assets there are in the enterprise in the first place. But none had any success stories to share.

“Vulnerability management or external attack surface management is increasingly difficult because of the way most organisations work these days,” said one CISO. “The [true attack surface] will always be unknown because everyone is concentrating just on what they know. How do you contextualise all that information to help you prioritise?”

Another agreed, adding that BYOD is making the problem worse – particularly devices owned by executives.

The CMDB should be a single source of truth for assets in the enterprise, and an ally in the fight against vulnerability exploitation. But there was heated debate over whether it’s fit for purpose in most organisations. One security leader argued that it’s impossible for the CMDB to ever truly reflect the full complement of IT assets in the enterprise. Another fired back that companies like RunZero can fingerprint every device in an organisation, so it is theoretically possible to identify “what they are, where they are and what they’re doing.”

However, the CMDB can also be a source of weakness if hackers go after it, suggested another attendee, who leads red team exercises at his organisation. “We all want a CMDB we can rely on, but we also need to look at it as an Achilles heel,” he warned.

You own it. No, you own it

Disagreements over who owns which asset and which risks to prioritise also contribute to inertia over vulnerability management, attendees argued. Many laid the blame on their peers.  “I’ve never met a CISO whose idea of what’s critical is aligned to what the business thinks is critical,” said one.

“We’re just not good at translating the potential impact of small things on the business,” said another. “An exposure management tool could help us to articulate and translate that risk.”

Another blamed the business users who buy kit, often without IT’s approval, and expect the security team to take care of it. “Some people look after their systems like their own children, but some don’t. And people tend to move around, which also creates issues,” he argued.

IT is often left picking up the pieces left by careless users, another shared. Systems are put into production “riddled with vulnerabilities” which can’t be patched because taking them offline would cause “risk to life”. So the whole thing “becomes a SOC problem”, he argued.

“There is a good process which people can follow. But we have an operational tempo of ‘get it done’. So we have to react to that,” he explained. “That’s how networks become messy. They’re added to over the years. You just have to adapt. I tell people attackers will always get through.”

Mind the remediation gap

The evening eventually came full circle, with guest speaker Rob Black asking the assembled crew to share their remediation tips. Not many had practical advice – hinting at the intractability of the challenge. “There are no fixes, only mitigations,” despaired one.

“If I can’t find a device owner, I go to the CIO and tell him to either empower me to turn it off or explain that he has to accept the risk,” explained another CISO. “When you do that people get very uncomfortable very quickly. So you need the right policy and governance in place first.”

However, he was immediately shot down by another attendee. “CIOs want to move fast so they’re never going to support you,” he argued. “They don’t want to wait around for security.”

One CISO suggested that many of his peers are “going about this the wrong way” in trying to protect everything. “Get to know your core systems,” he advised. “It’s not easy, but if you focus on these, it becomes an easier problem to solve than ‘let’s protect everything.’”

Another agreed. “We’re never going to win against Mythos. Things will continue to get worse,” he argued. “We need to accept we can’t protect everything, and prioritise and segment. Put controls around it. Accept the risk will not be zero. But never go into a conversation with the board saying you’ve solved the problem, because you haven’t. Have a conversation about risk appetite.”

A third attendee pointed to resilience as the best approach. “It’s not a technology problem it’s an influence problem. We have to look at the most important business services and have a way to recover quickly if they go down,” he said.

It was down to Check Point’s Bleiberg to sum up a memorable evening.

“In the short-term, Mythos will create hell. But in the long term I’m more optimistic,” he said. “Mythos will level the playing field. The number of CVEs will do down. Technology is making it easier for the right people to collaborate in the right way.”

The post There are no fixes, only mitigations: Minimising exposure in a world of risk appeared first on RANT Community.