Speaker 1: You're probably swimming in information every day trying to say
Speaker 1: well informed, especially when it comes to something is well
Speaker 1: complex and critical as cybersecurity.
Speaker 2: Oh, definitely, so many buzzwords, best practices, just so much noise.
Speaker 1: Exactly, But what's really at the core of it all?
Speaker 1: Today we're trying to cut through that noise, give you
Speaker 1: a shortcut maybe to understanding cybersecurity at its most fundamental level.
Speaker 2: Yeah, we're going on a bit of a deep dive
Speaker 2: into a powerful new approach, and.
Speaker 1: To help us navigate this, we've been digging into a
Speaker 1: really fascinating new book, Cybersecurity First Principles, a reboot of
Speaker 1: strategy and tactics by Rick Howard and Steve Winterfield.
Speaker 2: And guiding us today. We have someone with a real
Speaker 2: natural curiosity, a knack for making these, let's face it,
Speaker 2: sometimes dense topics genuinely interesting.
Speaker 1: And our expert here is brilliant and synthesizing all this
Speaker 1: info and helping us understand why it actually matters. This
Speaker 1: deep dive. It comes from two real industry veterans, Rick
Speaker 1: Howard and Steve Winterfie.
Speaker 2: Yeah, Rick's the chief analyst at the Cyber Wire Stee's
Speaker 2: Advisory CISO at Akamai. These guys have decades of experience.
Speaker 1: They've literally written the book on this step, and.
Speaker 2: They joke they wrote it to satisfy mobs of learners,
Speaker 2: which is kind of fun, huh.
Speaker 1: Right, And they pose this big question, don't they. If
Speaker 1: you ask, say, one hundred cybersecurity pros what they're trying
Speaker 1: to achieve, they'.
Speaker 2: Get a hundred different answers. Easy, everyone's got their own focus.
Speaker 1: But what if Yeah, what if there was one core purpose,
Speaker 1: one atomic first principle for all of cybersecurity?
Speaker 2: Okay, yeah, let's unpack that. They lay out this foundational belief,
Speaker 2: this principle reducing the probability of material impact due to
Speaker 2: a cyber event over a finite set of time.
Speaker 1: Reducing the probability of material impact. Okay, So this idea
Speaker 1: of a first principle, it's not just like a Twitter meme.
Speaker 2: No, No, definitely not. It goes way back. I think Aristotle, Descartes,
Speaker 2: Elon Mussa talks about it a lot now too. It
Speaker 2: means breaking a really complex problem down to its it's
Speaker 2: primary essence. These fundamental, self evident truths, the basic building blocks,
Speaker 2: you know.
Speaker 1: Okay, atomic building block. So if that's the standard. Why
Speaker 1: don't a lot of the usual suspects, the common best
Speaker 1: practices make the cut.
Speaker 2: That's a great question, and the book really gets into it.
Speaker 2: They look back even to the seventies and eighties. What
Speaker 2: was the thinking then, Well, researchers back then they actually
Speaker 2: thought the ultimate goal the first principle was to build
Speaker 2: a completely secure computer, like perfectly secure.
Speaker 1: The dream, the dream.
Speaker 2: But yeah, it was largely abandoned, just seen as impractical.
Speaker 2: People still kind of lament that failure.
Speaker 1: Okay, so that didn't work out. What about the CIA
Speaker 1: triad confidentiality, integrity availability? Everyone knows that one.
Speaker 2: Everyone knows it. It's foundational thinking, absolutely, But the authors
Speaker 2: argue it's more like general best practice.
Speaker 1: Not the atomic principle.
Speaker 2: Right, it doesn't fully capture the ultimate purpose of an
Speaker 2: entire security program. Some even say it's frankly in adequate
Speaker 2: for today's threats.
Speaker 1: Okay, how about patching. I mean we hear it constantly
Speaker 1: keep your systems updated sounds pretty fundamental.
Speaker 2: It's critical, no doubt. Systematically upgrading is vital. But and
Speaker 2: this is interesting, the data shows hackers use actual code
Speaker 2: exploits in like less than ten percent of known breaches.
Speaker 1: Less than ten percent. Wow.
Speaker 2: Yeah, so the authors point out, even with decades of
Speaker 2: focusing on patching, it hasn't really abated the volume of
Speaker 2: successful cyber breaches. Important tactic, Yes, the foundational principle, they argue.
Speaker 1: No, okay, so patching is out as the core principle.
Speaker 1: What about other things people aim for, like stopping malware
Speaker 1: or instant response or following frameworks like NIST or you know,
Speaker 1: compliance stuff like GDPR.
Speaker 2: Yeah, good examples. The book argues these are often either
Speaker 2: too simple, like just stopping one type of threat, or
Speaker 2: they're too tactical. Tactical meaning meaning they're specific actions, but
Speaker 2: they don't answer the big why why are we doing
Speaker 2: all this? They don't define the overall purpose, and often
Speaker 2: they're kind of black and white. You know, did you
Speaker 2: do it or not? Right?
Speaker 1: Check the box exactly?
Speaker 2: Compliance? For instance, it might be necessary for business a
Speaker 2: ticket to ride or for brand reputation. But does ticking
Speaker 2: those boxes inherently reduce the chance of a material impact?
Speaker 2: Not necessarily?
Speaker 1: Okay, So that brings us back to that word material.
Speaker 1: What's missing from all those other approaches that this new
Speaker 1: atomic principle gives us.
Speaker 2: It's that focus on materiality. That's the absolute key insight.
Speaker 2: I think.
Speaker 1: Explain that a bit more.
Speaker 2: Well, think about it. Not everything on your network is
Speaker 2: equally important, Right If some hacker gets Luigi's lunch menu
Speaker 2: off his laptop, Yeah, probably not calling the FBI exactly.
Speaker 2: So why spend potentially infinite resources trying to protect absolutely
Speaker 2: everything equally, especially when resources are always finite?
Speaker 1: Ah? Okay, So the atomic principle forces that focus. It's
Speaker 1: reducing the probability of material.
Speaker 2: Impact to a cyber event over a finite set of time. Precisely,
Speaker 2: it forces you to identify what truly fundamentally matters to
Speaker 2: the business mission.
Speaker 1: And that's going to be different for every company.
Speaker 2: Right absolutely depends on their risk tolerance, their size, industry,
Speaker 2: you name it, and it changes over time too. Business
Speaker 2: leaders know what's material. The job of security pros is
Speaker 2: to understand that deeply and align the security effort accordingly.
Speaker 1: Okay, this makes a lot of sense. So let's dive
Speaker 1: into the strategies that actually flow from this core principle.
Speaker 1: The book lays out five right, starting with zero trust.
Speaker 2: Yep, zero trust, the never trust, always verify mindset.
Speaker 1: Before this, say, pre twenty ten, what was the main.
Speaker 2: Approach mostly perimeter defense, build big, strong electronic fences around
Speaker 2: your stuff, castle and mote thinking. But the problem was
Speaker 2: the problem was the chewy center. If a bad guy
Speaker 2: did get inside that perimeter.
Speaker 1: They could roam around pretty freely.
Speaker 2: Often. Yeah, access to way too much.
Speaker 1: And the Edward Snowden case in twenty thirteen really drove
Speaker 1: this home.
Speaker 2: Didn't there a classic textbook example. He was an IT admin,
Speaker 2: had legitimate credentials, He didn't hack his way in. He
Speaker 2: basically web served on a classified network using a crawler
Speaker 2: he bought, grabbed over a million documents, and walked out because.
Speaker 1: He was already inside the castle walls exactly.
Speaker 2: It showed the fundamental weakness of just relying on the perimeter.
Speaker 1: So that kind of thinking led to John Kindervag's white
Speaker 1: paper in twenty ten, No More Shoey Setters.
Speaker 2: That paper was huge. It really proposed the zero trust
Speaker 2: model and started changing how people thought about network security.
Speaker 1: So zero trust isn't just like buying a specific product.
Speaker 1: It's a whole strategy, a mindset.
Speaker 2: It's definitely a strategy of philosophy. Restrict access to everything
Speaker 2: based on need to know and continuously verify don't assume
Speaker 2: trust just because someone is inside the network.
Speaker 1: Okay, so how do you actually do zero trust? What
Speaker 1: are some key tactics?
Speaker 2: Well, one big one is vulnerability management, but it's more
Speaker 2: nuanced than just patch everything.
Speaker 1: Right, you mentioned patching earlier. Wasn't the whole story exactly?
Speaker 2: So NIST cattle over eighteen thousand new vulnerabilities in twenty
Speaker 2: twenty one. That's overwhelming.
Speaker 1: Yeah, how do you even start?
Speaker 2: But here's the crucial part. SISA, the US Cybersecurity Agency,
Speaker 2: found that only about eight hundred and twelve of those
Speaker 2: were actually being actively exploited by attackers in the wild.
Speaker 1: Only eight hundred and twelve out of eighteen thousand. That's manageable.
Speaker 2: Right, So, vulnerability management under zero trust means focusing intensely
Speaker 2: on those known exploited vulnerabilities. First, Patching becomes a targeted
Speaker 2: subset of this smarter approach.
Speaker 1: That's a really practical takeaway focus where the actual risk is.
Speaker 1: What else is key for zero trust?
Speaker 2: Identity knowing who is accessing what. So identity and authentication
Speaker 2: is huge.
Speaker 1: We've moved beyond just passwords thankfully.
Speaker 2: Oh yeah, passwords from the sixties were obviously weak. We
Speaker 2: moved to things like hardware tokens in the eighties than
Speaker 2: two factor authentications something you have are or no got
Speaker 2: patented in the nineties, and.
Speaker 1: Smartphones really made that mainstream, right, authenticator apps, push notifications.
Speaker 2: Totally, and things like U two F security keys. Now
Speaker 2: the big goal here is shifting from site centric identity,
Speaker 2: where every website holds your password, to user centric.
Speaker 1: Identity, where I control my identity credentials.
Speaker 2: Exactly makes it much harder for one breach to compromise everything.
Speaker 1: And the Solar Winds attack in twenty twenty is a
Speaker 1: scary example of why identity systems themselves are critical.
Speaker 2: Absolutely terrifying. The Cozy Bear hackers got admin rights compromise
Speaker 2: this SAM authentication system.
Speaker 1: SAML being this system that lets you log in once
Speaker 1: for multiple services.
Speaker 2: Right, and they could then forge tokens to impersonate any user,
Speaker 2: even the highest privileged admins. It shows your identity and
Speaker 2: access management. Your IAM system is itself a material system.
Speaker 2: You have to protect it fiercely. Single sign on SSO
Speaker 2: is a key tactic, but securing the SSO system is paramount, okay.
Speaker 1: Another tactic mentioned is the software defined perimeter or FDP.
Speaker 1: Sounds kind of techy.
Speaker 2: It is a bit, but the concept is powerful. It
Speaker 2: came out of US military thinking in the early two thousands.
Speaker 2: They called it deeperization, getting rid of the perimeter. Essentially, Yeah,
Speaker 2: instead of connecting to the whole network, you first authenticate
Speaker 2: to a separate controller outside the firewall.
Speaker 1: Okay, if you're.
Speaker 2: Authorized for say one specific application, the controller creates a secure,
Speaker 2: encrypted tunnel only to that one application. Everything else on
Speaker 2: the network stays hidden, like it's in a black cloud.
Speaker 1: Ah, So it drastically shrinks the attack surface. You can
Speaker 1: only see what you're explicitly allowed to see.
Speaker 2: Precisely, Google did something similar with their Beyond COREP initiative
Speaker 2: after a big Chinese hack in twenty ten. The name
Speaker 2: STP is actually kind of ironic because it's about eliminating
Speaker 2: the traditional perimeter, not defining it.
Speaker 1: So zero trust sounds like the way to go. Why
Speaker 1: do these projects sometimes fail or stall out?
Speaker 2: Well, they can look really big and expensive upfront, that's true,
Speaker 2: but the authors argue it's often less about the tech
Speaker 2: and more about people and process problems getting buy in
Speaker 2: changing habits. It's really a journey continuous improvement, not a
Speaker 2: one and done project. You can often start with the
Speaker 2: tools you already have.
Speaker 1: That's encouraging. Yeah, okay, let's shift to the second big strategy,
Speaker 1: intrusion kill chain prevention, breaking the attackers steps right.
Speaker 2: This was another huge paradigm shift around twenty ten, thanks
Speaker 2: to a paper from Lockheed Martin. What was the shift
Speaker 2: before that? Defenders were mostly focused on blocking individual tools,
Speaker 2: specific malware, specific exploits. Whack them mold, Yeah, it feels impossible.
Speaker 2: The Locky paper flipped it. It said, Look, attackers have
Speaker 2: to succeed at a series of actions to reach their
Speaker 2: goal recon weaponization, delivery, exploitation installations. See two actions on objectives.
Speaker 1: The kill chain.
Speaker 2: The kill chain, You the defender, only need to break
Speaker 2: one link in that chain to stop the entire attack.
Speaker 2: Much more strategic, and this.
Speaker 1: Is super relevant in what some call continuous low level
Speaker 1: cyber conflict right like nation.
Speaker 2: State stuff exactly David Sanger's term. It describes how countries
Speaker 2: use cyber operations just short of war. Think Stuck's net
Speaker 2: targeting around on centrifuges or Russia's not Petya attack devastating
Speaker 2: Ukrainian systems.
Speaker 1: Destructive but not triggering a shooting war.
Speaker 2: Precisely, it's a calculated level of conflict, and defending against
Speaker 2: it requires understanding and disrupting that multi step process.
Speaker 1: So what are the key tactics for breaking the kill chain?
Speaker 2: Intelligence is paramount? The book talks about the adversary model trifecta.
Speaker 1: Okay, sounds important. What's in the trifecta?
Speaker 2: First, the Lockheed Martin kilchain itself. That's the high level
Speaker 2: strategic map of an attack.
Speaker 1: Okay, the overall phases.
Speaker 2: Second, and this is where it gets really practical for defenders,
Speaker 2: is the Miter EATT and CK framework.
Speaker 1: Ayah ATT and CK. You hear that everywhere.
Speaker 2: Now and for good reason. Launched in twenty thirteen, it
Speaker 2: catalogs the specific techniques and tactics used by known threat
Speaker 2: groups the apts. But the most important thing MITER did
Speaker 2: was create a standardized vocabulary.
Speaker 1: Why was that so crucial?
Speaker 2: Before miter AT and CK everyone described attacks differently. Sharing
Speaker 2: intelligence was a nightmare, just pure grunt work trying to translate.
Speaker 2: MITER gave everyone a common language. Huge step forward.
Speaker 1: Okay, kill chain, mi ATP and c K. What's the
Speaker 1: third part of the trifecta?
Speaker 2: The DoD diamond model developed around twenty eleven. It helps
Speaker 2: analysts map the relationships between four key aspects of an attack,
Speaker 2: the adversary, their capabilities, the infrastructure they use, and the victim.
Speaker 2: It helps connect the dots.
Speaker 1: Connecting the dots. You had a story about that with
Speaker 1: the French police.
Speaker 2: Ah. Yeah, I was meeting with the Gendarmeris cybercrime unit captain.
Speaker 2: He was frustrated, saying, I don't need lectures on firewalls.
Speaker 2: I need actionable intelligence IP addresses. I can block domains,
Speaker 2: I can take down What what did you do? I
Speaker 2: texted my intel director basically saying, need French ctwips now.
Speaker 2: Within minutes, I got back a list. I showed it
Speaker 2: to the captain. His eyes lit up and he immediately
Speaker 2: got on the phone to start shutting those nodes down.
Speaker 2: That's actionable intelligence.
Speaker 1: Wow. Okay, So that perfectly leads into the next tactic,
Speaker 1: cyber threat intelligence or at CTI.
Speaker 2: Right, and CTI isn't just read security news headlines. It's
Speaker 2: a formal process, hope. It's about systematically collecting, processing, analyzing
Speaker 2: information about adversaries, their capabilities, intentions, and then producing intelligence
Speaker 2: products that help leadership make actual decisions. It follows a
Speaker 2: cycle planning, What do we need to know? Collection, processing, analysis,
Speaker 2: and production, dissemination feedback.
Speaker 1: So it's not just here's the latest vulnerability exactly.
Speaker 2: We learned that early on. Commanders tune out if you
Speaker 2: just give them news. They need intelligence tailored to the
Speaker 2: decisions they have to make.
Speaker 1: And since no single company can see everything, intelligence sharing becomes.
Speaker 2: Vital, absolutely critical. The Morris worm back in nineteen eighty
Speaker 2: eight was a wake up call that led to things
Speaker 2: like ISx information sharing and analysis centers like the FSIS
Speaker 2: for the financial.
Speaker 1: Sector, how do they manage sharing sensitive info safely?
Speaker 2: A key innovation was the Traffic Light Protocol TOLP, develop
Speaker 2: in the UK. It uses simple color codes red, amber, green,
Speaker 2: white to label how widely information can be shared, builds
Speaker 2: trust and.
Speaker 1: The future vision is even more automated sharing.
Speaker 2: Yeah, ideally an API driven database, maybe government provided, covering
Speaker 2: all sorts of adversaries, not just nation states. We're not
Speaker 2: there yet, but that's the direction.
Speaker 1: Speaking of adversaries, we hear all these cool, sometimes scary names,
Speaker 1: cozy bear, fancy bear, lazarrisk group. How much weight should
Speaker 1: we put on attributing attacks to these specific groups?
Speaker 2: That's a really good question. And there's nuance. When security
Speaker 2: companies talk about Cozy Bear did this, they usually mean
Speaker 2: a tax sequence attribution. They've identified a pattern of tactics, techniques,
Speaker 2: and procedures a playbook that matches what that group usually does.
Speaker 1: So it's matching the how, not necessarily knowing the who
Speaker 1: behind the keyboard exactly.
Speaker 2: Pinpointing the actual humans involved. Hacker identity attribution is incredibly hard.
Speaker 2: Spy agencies can sometimes do it, but they rarely share
Speaker 2: that publicly. For most defenders, obsessing over the specific group
Speaker 2: name is less important than understanding their playbook and how
Speaker 2: to counter it.
Speaker 1: Okay, that makes sense. Focus on the meta. Now, with
Speaker 1: kill chain, mitre at T, and ck CTI, it sounds
Speaker 1: like a lot of different tools and data feeds. How
Speaker 1: do you manage all that?
Speaker 2: Orchestration becomes key. It's just not feasible manually anymore. Back
Speaker 2: in the late nineties, maybe you had three security tools.
Speaker 2: By twenty twenty two the average was seventy six.
Speaker 1: Seventy six.
Speaker 2: Wow, Yeah, so you need tools to manage the tools,
Speaker 2: things like the big all in one platforms from firewall
Speaker 2: vendors or sr tool Security orchestration, Automation and response. They
Speaker 2: help automate workflows, connect different systems.
Speaker 1: And newer concepts like SASSE or SSE fit in here too.
Speaker 2: Right, Secure Access Service Edge or Security Service Edge. They
Speaker 2: kind of flip the model routing traffic through a cloud
Speaker 2: provider security stack. It's all about finding ways to manage
Speaker 2: that complexity and make the different parts work together effectively.
Speaker 2: Mastering orchestration is vital and.
Speaker 1: One more tactic for the kill chain strategy red Blue
Speaker 1: and Purple teaming.
Speaker 2: Yeah, this is about testing your defenses proactively. The Red
Speaker 2: team acts like the adversary, trying to break.
Speaker 1: In the attackers.
Speaker 2: The Blue team defends using all those tools and intelligence
Speaker 2: we just talked about, and Purple team brings them together,
Speaker 2: fostering collaboration and feedback loops, so the Blue team learns
Speaker 2: directly from what the Red team finds, and vice versa.
Speaker 2: It's incredibly valuable for continuous improvement and for training your analysts.
Speaker 2: Gives them real hands on experience.
Speaker 1: Okay, excellent, Let's move to the third strategy, Resilience. This
Speaker 1: one feels different. It's not about preventing the breach exactly.
Speaker 2: Resilience starts with the assumption that breaches will happen eventually,
Speaker 2: So the question becomes, what do we need to do
Speaker 2: to continue our mission after the fact.
Speaker 1: So it's about bouncing back.
Speaker 2: Bouncing back, yes, But even more it's about continuous delivery.
Speaker 2: The book uses a great definition, the ability to continuously
Speaker 2: deliver the intended outcome despite adverse cyber events.
Speaker 1: Continuously deliver. Yeah, like the Terminator.
Speaker 2: Hah Yeah, the T one thousand and T two is
Speaker 2: a pretty good analogy. He wasn't just built to survive damage.
Speaker 2: He adapted, reformed, kept coming, always focused on the mission.
Speaker 2: That's resilience.
Speaker 1: Are there real world examples of companies doing this?
Speaker 2: Oh?
Speaker 1: Yeah.
Speaker 2: Netflix is famous for its chaos engineering chaos Monkey, that's
Speaker 2: the one. After some big outages years ago, they built tools,
Speaker 2: starting with chaos Monkey in twenty eleven, that intentionally and
Speaker 2: randomly disable parts of their production.
Speaker 1: System on purpose. That sounds terrifying.
Speaker 2: It forces their engineers to build systems that can withstand
Speaker 2: failure to bick resilience in from the start. They have
Speaker 2: a whole Simian army of tools that inject latency kill processes.
Speaker 1: Wow, okay, who else?
Speaker 2: Google Site Reliability Engineering SRI is another classic example. Back
Speaker 2: in two thousand and four, they basically gave network management
Speaker 2: to software developers as the traditional ITOps right, and these
Speaker 2: sres focused on automating everything, eliminating manual tasks what they
Speaker 2: call toil, and building self healing autonomous systems. You almost
Speaker 2: never see a major Google service go down right, very rarely,
Speaker 2: but internally the esries will tell you stuff is failing
Speaker 2: all the time. The system is just designed to handle
Speaker 2: it gracefully, reroute, recover. That's resilience in action.
Speaker 1: So how does this relate to, say, disaster recovery or
Speaker 1: business continuity plans? Are they the same thing?
Speaker 2: They're related but distinct. Business continuity is usually broader, covering
Speaker 2: things like fires, floods, pandemics, force measure events. Disaster recovery
Speaker 2: is typically focused on recovering IT systems after a major.
Speaker 1: Outage, and resilience.
Speaker 2: Resilience is maybe a blend, but with that specific focus
Speaker 2: on continuously delivering the intended outcome. The author's stress getting
Speaker 2: the names right is important because confusion here has led
Speaker 2: to problems in the past.
Speaker 1: Okay, so what are the key tactics to build resilience.
Speaker 1: Crisis handling seems.
Speaker 2: Like a big one definitely, and practices everything. One of
Speaker 2: the authors shares a really painful personal story about his
Speaker 2: backup plan.
Speaker 1: Oh what happened?
Speaker 2: He thought he had this great system backing up all
Speaker 2: his precious family photos and digital days data. He configured it,
Speaker 2: checked it regularly. It always said a okay, sounds good
Speaker 2: so far, until his hard drive died. He went to
Speaker 2: restore and found out he'd accidentally configured the backup to
Speaker 2: copy an empty directory every day.
Speaker 1: Oh no, all gone.
Speaker 2: The lesson he learned the hard way. If a plan
Speaker 2: is not exercised, it is almost guaranteed to fail. You
Speaker 2: have to really test it ouch.
Speaker 1: That's a visceral lesson. How does resilient apply to something
Speaker 1: like ransomware? Backups are key there right, absolutely central.
Speaker 2: Ransomware has gotten so nasty, moving from hitting individuals to
Speaker 2: demanding millions from corporations, and just encrypting your data isn't
Speaker 2: enough protection anymore. Why not, because some ransomware will happily
Speaker 2: encrypt you're already encrypted backups, or just steal your data
Speaker 2: first and threaten to leak it. So the only real
Speaker 2: defense against the threat of having your data rendered unusable
Speaker 2: or exposed is a rock solid, tested backup and restore
Speaker 2: process for your material.
Speaker 1: Data again, focusing on the material stock.
Speaker 2: It makes the problem manageable. You don't necessarily need to
Speaker 2: back up everything instantly, just the stuff that's truly critical
Speaker 2: to delivering that intended outcome.
Speaker 1: Okay. Encryption itself is another tactic listed under resilience.
Speaker 2: Yes, though it's more of a passive tactic. You apply
Speaker 2: it beforehand to protect data at rest on discs or
Speaker 2: in motion over networks.
Speaker 1: Ancient history right, codes and cipher's.
Speaker 2: Goes way back. Spartans, romans, big leaps came with mechanical
Speaker 2: devices like the Enigma machine and then modern asymmetric crypto
Speaker 2: in the seventies Diffie Hellman RSA that allowed secure communication
Speaker 2: without pre sharing a secret key.
Speaker 1: But managing all those encryption key seems like a huge challenge.
Speaker 2: Now, it's incredibly complex, intricate, naughty, and labyrinthine, as the
Speaker 2: book puts it. You have keys for data centers, cloud
Speaker 2: mobile apps, and attackers know this. The Solarman's hackers remember,
Speaker 2: they compromise the authorization system to generate their own valid keys.
Speaker 2: So key management is critical.
Speaker 1: Okay, So encryption is passive protection. What about when an
Speaker 1: attack is actively happening? That's incident response.
Speaker 2: Right, exactly. IR is about dealing with the boom. It
Speaker 2: really started as a field back in eighty six with
Speaker 2: Clifford Stole tracking down those Russian hackers.
Speaker 1: The cuckoos egg.
Speaker 2: That's the one. A key part of IR is distinguishing
Speaker 2: a minor cyber event, maybe one miteror technique spotted from
Speaker 2: a major cyber incident, maybe a whole attack or playbook unfolded.
Speaker 1: And when it becomes an incident.
Speaker 2: Then it escalates beyond just the security operations center the
Speaker 2: SoC It triggers the wider organizational crisis plan involving legal,
Speaker 2: comms leadership. IR is a vital tactic, absolutely, but again
Speaker 2: the authors argue it's not the overarching first principle strategy itself.
Speaker 1: And how an organization communicates during a crisis is make
Speaker 1: or break. The book contrasts RSA Security and Equifax.
Speaker 2: Yeah, two starkly different examples. RSA and twenty eleven after
Speaker 2: their secured seeds were stolen a really bad breach, but
Speaker 2: their CEO took charge, communicated transparently, set a clear recovery plan,
Speaker 2: Project Apollo customers mostly stuck by them.
Speaker 1: And Equifax in twenty seventeen.
Speaker 2: A masterclass in what not to do confusing messages, blaming individuals,
Speaker 2: offering free monitoring that required victims to waive legal rights,
Speaker 2: just a mess.
Speaker 1: They lost one point four billion dollars, but they survived.
Speaker 2: They did, but largely because of they're victims. The consumers weren't.
Speaker 2: Actually they're paying customers. We didn't have a choice, a
Speaker 2: different dynamic.
Speaker 1: So the big lessons seemed to be practice, practice, practice,
Speaker 1: not just the technical stuff. But the leadership responds.
Speaker 2: To absolutely exercise. The leadership team run tabletop scenarios, focus
Speaker 2: on the desired outcomes, not just rigidly following a plan
Speaker 2: that might not fit the real situation. Even informal lunch
Speaker 2: and learns can.
Speaker 1: Help and build relationships before you need them.
Speaker 2: Crucial Invite the local FBI field office. Invite your auditors.
Speaker 2: Get to know them. When things are calm, It makes
Speaker 2: a world of difference when a real crisis hits.
Speaker 1: Okay. Strategy four risk forecasting quantifying uncertainty. This sounds hard.
Speaker 2: It is hard. Network defenders often struggle with calculating cyber
Speaker 2: risk precisely. But the key insight here is you don't
Speaker 2: necessarily need perfect precision. You need good enough answers to
Speaker 2: make good decisions like the.
Speaker 1: Super forecasting research from Philip Tetlock exactly.
Speaker 2: Tetlock found most experts are terrible forecasters unless they actually
Speaker 2: keep score and track their predictions. Leaders often fail by
Speaker 2: demanding certainty when reality is always probabilistic.
Speaker 1: Like trying to be one hundred percent sure about bin
Speaker 1: Laden's location.
Speaker 2: Right, It's never one hundred percent. And you also have
Speaker 2: Nassim Talib's black Swan idea. Those completely unpredictable high impact events.
Speaker 2: You can't predict them, so his advice is focus on
Speaker 2: resilience to survive them.
Speaker 1: So if we can't predict perfectly, how do we get
Speaker 1: good enough forecasts? What are the tactics?
Speaker 2: One is using Fermi estimates quick back of the envelope calculations.
Speaker 1: In Rico Fermi the physicists Yeah.
Speaker 2: One of the authors tells a story where his CEO,
Speaker 2: Peter Kilpee, use a quick Fermi estimate to decide against
Speaker 2: doing a much longer, more expensive risk analysis. This because
Speaker 2: the rough answer was good enough to make the decision.
Speaker 1: So sometimes faster and rougher is better if it leads
Speaker 1: to the same action. Interesting, what else Bayes' rule? This
Speaker 1: is a different way of thinking about probability updating your
Speaker 1: beliefs as new evidence comes.
Speaker 2: In developed way back in the seventeen hundreds.
Speaker 1: Yep, by Thomas Bays. It was kind of controversial for
Speaker 1: a long time, but it's incredibly powerful. We don't have
Speaker 1: a ton of historical data like trying to forecast a
Speaker 1: novel cyber attack.
Speaker 2: And the really cool part is Alan turn used it.
Speaker 2: Mind blowing right. Turing apparently used Bayesian methods measuring the
Speaker 2: weight of evidence updating probabilities to help crack the German
Speaker 2: Enigma codes during World War Two. Some historians think it
Speaker 2: shortened the war by years getting a good enough answer
Speaker 2: to break the code.
Speaker 1: Wow, Okay, can we walk through a practical example. How
Speaker 1: would you estimate the risk for a typical company?
Speaker 2: Sure, you can start with an outside view. Look at
Speaker 2: broad data like the FBI's IC three reports on cybercrime
Speaker 2: losses in twenty twenty one, you could estimate maybe two
Speaker 2: million material cyber events happened across the US. Okay, they're
Speaker 2: about six point three million organizations in the US, so
Speaker 2: very roughly, your initial prior belief might be that any
Speaker 2: given organization had around a thirty two percent chance facing
Speaker 2: a material.
Speaker 1: Attack that year that high thirty two percent.
Speaker 2: That's the rough starting point based on that data set.
Speaker 2: But then you refine it. That's the inside out analysis.
Speaker 1: How do you refine it?
Speaker 2: You use more specific data. Research from places like the
Speaker 2: Cyante Institute shows risk varies hugely by company size. A
Speaker 2: giant fortune two to fifty company might have a one
Speaker 2: to two chance of a material breach in a year
Speaker 2: fifty percent, but a smaller company, say under one billion
Speaker 2: dollars in revenue, might have less than a two to
Speaker 2: one hundred chance. So you adjust your thirty two percent
Speaker 2: prior based on factors like size, industry, et cetera.
Speaker 1: And then you look at the company's own defenses exactly.
Speaker 2: That's the crucial inside out part. How strong is their
Speaker 2: zero trust posture, how good are they at intrusion kill
Speaker 2: chain prevention, how resilient are they? You use your assessment
Speaker 2: of those things to adjust the probability estimate up or down.
Speaker 2: You can even test your confidence by asking would I
Speaker 2: bet one hundred dollars on this probability.
Speaker 1: So for a hypothetical company, let's call it Contoso Corporation,
Speaker 1: big global manufacture, Okay.
Speaker 2: Thirty five billion dollar revenue, you'd start maybe with the
Speaker 2: thirty two percent IC three prior adjust down based on
Speaker 2: Scientia data for their size, maybe to twenty two percent.
Speaker 2: Then you'd assess their actual security posture. Are they good
Speaker 2: at zero trust? Do they use threat intel? Well? Do
Speaker 2: they practice crisis response? Based on that, you adjust the
Speaker 2: twenty two percent figure to get your final tailored risk forecast.
Speaker 1: It's a very different way of thinking than just red, yellow,
Speaker 1: green heat maps.
Speaker 2: Totally different. It requires letting go of that need for
Speaker 2: perfect counts and embracing probability. But if Turing could use
Speaker 2: it to crack Enigma, maybe we can use it for
Speaker 2: cybersecurity risk. Those qualitative heat maps haven't really worked for
Speaker 2: twenty years, have they time for a change?
Speaker 1: Agreed? Okay? Last strategy Automation the lynch pin of the future.
Speaker 2: Yeah, this ties everything together. Just look at how software
Speaker 2: development itself has evolved from the old waterfall model.
Speaker 1: Plan everything upfront, build it, test it at the.
Speaker 2: End, right slow rigid, then came Agile in the two thousands,
Speaker 2: much more iterative, and then DevOps in the twenty tens,
Speaker 2: breaking down walls between development and operations, focusing on speed
Speaker 2: and automation.
Speaker 1: And security got bolted on later.
Speaker 2: Initially Yeah, but then came pushes like Microsoft's Trustworthy Computing
Speaker 2: after all those worms in the early two thousands, and
Speaker 2: eventually devsekops integrating security in every stage of that fast
Speaker 2: moving DevOps pipeline, using infrastructure's code, automating security checks, etc.
Speaker 1: So the development world has really embraced automation for speed
Speaker 1: and reliability hugely.
Speaker 2: Companies like Google and Amazon basically pioneered it with their
Speaker 2: SRI approaches. But the argument in the book is that
Speaker 2: the security community has been slower to apply that same
Speaker 2: level of automation to its own core functions deploying and
Speaker 2: managing zero trust kilchain defenses, resilience measures.
Speaker 1: So automatetion isn't just a tactic within the other strategies.
Speaker 2: It's presented as a fundamental strategy itself. You need automation
Speaker 2: to effectively deploy, manage, and maintain the entire first principles
Speaker 2: security architecture at scale.
Speaker 1: What are the key tactics here? Compliance comes up again
Speaker 1: as an odd duck.
Speaker 2: Yeah, it really is. Compliance is just conforming to rules,
Speaker 2: laws like GDPR, standards like PCIDSS frameworks like NIST. It
Speaker 2: generates a huge industry lots of checklists.
Speaker 1: But compliant yet breached is a common headline.
Speaker 2: Exactly, It doesn't inherently reduce the probability of material impact.
Speaker 2: Sometimes the cost of achieving perfect compliance far outweighs the
Speaker 2: actual risk reduction or the potential fine. It's often more
Speaker 2: about that ticket to ride or brand protection.
Speaker 1: So it's a calculation to trade off.
Speaker 2: It has to be is the cost of compliance worth
Speaker 2: it compared to other investments that might more directly reduce
Speaker 2: material risk.
Speaker 1: And chaos engineering pops up again here under.
Speaker 2: Automation right, because tools like Netflix's Simian Army are all
Speaker 2: about automated testing of resilience, intentionally injecting failures automatically.
Speaker 1: And this fights against security theater.
Speaker 2: That's the idea. Security theater is work that looks like security,
Speaker 2: makes people feel safer, but doesn't actually add much real protection.
Speaker 2: Some types of generic anti phishing training might fall into
Speaker 2: this category. Chaos engineering, by contrast, forces a real adaptive response.
Speaker 2: It encourages treating security testing like a science experiment, form
Speaker 2: a hypothesis about a weakness test. It automatically find the
Speaker 2: real flaws fix them.
Speaker 1: Okay, so let's try and wrap this all up. We've
Speaker 1: taken quite the deep dive here.
Speaker 2: We definitely have.
Speaker 1: The core idea. The atomic first principle is reducing the
Speaker 1: probability of material impact due to a cyber event over
Speaker 1: a finite set of time.
Speaker 2: That's the anchor, and flowing from that are the five
Speaker 2: key strategies we discussed, zero.
Speaker 1: Trust, intrusion, killed chain prevention, resilient risk forecasting.
Speaker 2: And automation, each with its own set of crucial tactics.
Speaker 1: And this isn't just for the super technical folks, is it.
Speaker 1: It's about making better decisions overall.
Speaker 2: Absolutely, it's about allocating those finite resources effectively. It's about
Speaker 2: communicating the value of cybersecurity to business leaders in terms
Speaker 2: they understand business impact risk reduction.
Speaker 1: So final thought for everyone listening, think about your own organization.
Speaker 1: What does material impact really mean for your business? Is
Speaker 1: that where your cybersecurity effort is truly focused?
Speaker 2: Or are you mostly checking compliance boxes or just fighting
Speaker 2: the fire of the day chasing individual threats without that
Speaker 2: strategic focus on what matters most?
Speaker 1: Is it maybe time for your cybersecurity strategy to get
Speaker 1: a first principle's reboot.
Speaker 2: Hopefully this deep dive has sparked some questions. Keep exploring
Speaker 2: keep questioning that status quo.
Speaker 1: Keep learning. Thanks for joining us on this deep dive