\u201cWhat are you talking about now in cybersecurity that you weren\u2019t talking about six months ago?\u201d<\/p>\n\n\n\n
Fifth Domain posed this question to cybersecurity experts at Black Hat, a cybersecurity conference in Las Vegas, Nevada, that ran from Aug. 3-8. With the cyber domain rapidly evolving, we wanted to know how conversations within the cyber community are changing.<\/p>\n\n\n\n
Some pointed to a new focus on utility systems and web-connected devices that sit on critical infrastructure.<\/p>\n\n\n\n
\u201cIt\u2019s only a matter of time until there\u2019s another major disruption in an electric utility somewhere in the world, probably not in the U.S., but elsewhere,\u201d Sergio Caltagirone, threat intelligence director at Dragos, said at the conference Aug. 5. \u201cBut oil and gas has the higher likelihood of a major destructive and loss-of-life event. And I think most people did not realize how close to that we actually were.\u201d<\/p>\n\n\n\n
Caltagirone was referring to the TRISIS event, malware that struck industrial control systems at a Saudi Arabian petrochemical plant and could\u2019ve caused physical harm. He said that in the aftermath of that attack, threat researchers diving into the details realized just how bad it could\u2019ve been.<\/p>\n\n\n\n
\u201cWe started finding a lot of stuff which hadn\u2019t been found before,\u201d Caltagirone said. \u201cWhich made us realize very quickly how close that space is to a major event.\u201d<\/p>\n\n\n\n
Dave Weinstein, chief security officer at Claroty, pointed to an \u201cexplosion\u201d of devices connected to the internet of things..<\/p>\n\n\n\n
\u201cIt\u2019s really a product of this general consensus among industrial organizations that the benefits exceed the costs in terms of embracing this type of digital transformation,” Weinstein said Aug. 8, adding that organizations must be \u201cmindful\u201d of these devices and have a plan to mitigate their potential vulnerabilities.<\/p>\n\n\n\n
Brian Costello, a senior vice president at Flashpoint, told Fifth Domain on Aug. 8 that he is more often than before focusing on targeted cyberattacks from bad actors. That\u2019s a shift away from \u201ccampaign-based\u201d attacks that tracked.<\/p>\n\n\n\n
There\u2019s \u201cmore planning out, more scoping out of targets and taking long-term planning to go after [a] particular target with a specific asset in mind,\u201d Costello said.<\/p>\n\n\n\n
Along that same vein, Julian Zottl, a senior cyber architect at Raytheon, said he\u2019s noticing more inclusion of all-source intelligence in threat analysis.<\/p>\n\n\n\n
\u201cWe\u2019re looking at \u2026 all the sources and trying to figure out indicators,\u201d Zottl said Aug. 7. \u201c[We\u2019re] even trying to do predictive analytics now, where it\u2019s like, \u2018Oh, we see this threat might be coming.\u2019 I think that\u2019s something that we\u2019re starting to talk about more and more.\u201d<\/p>\n\n\n\n
Several cybersecurity professionals interviewed by Fifth Domain said the U.S. government is moving away from the classic cyber kill chain and over to the MITRE ATT&CK framework, which dives deeper into potential threats to information security.<\/p>\n\n\n\n
\u201cThey used to think the hackers would just come in to steal secrets, conduct espionage and then leave,\u201d said Tom Kellermann, chief cybersecurity officer at Carbon Black and a former commissioner on the Commission on Cyber Security for then-President Barack Obama.<\/p>\n\n\n\n
\u201cIn fact, they\u2019re maintaining persistence in these systems. They\u2019re manipulating the integrity of data and then they\u2019re using federal government agencies themselves and personnel\u2019s devices themselves to target anyone who implicitly trusts that person, that agency, that department.\u201d he told Fifth Domain on Aug. 6.<\/p>\n\n\n\n
Chris Kennedy, chief information security officer at AttackIQ and a former official with the Treasury Department and the Marine Corps, said these new frameworks in use along with federal continuous monitoring programs allow for more attacker emulation, essentially simulating the attack agencies could face.<\/p>\n\n\n\n
\u201cAgencies are starting to realize the value of attacker emulation as a way to measure and benchmark the effectiveness of their security controls,\u201d Kennedy said on Aug. 7.<\/p>\n\n\n\n
And with government agencies in different stages of cloud migration, agencies will need to learn how that fits into their cybersecurity posture. Marten Mickos, CEO of white hat hacking company HackerOne, said this a new discussion. He also said the conversation surrounding the use of ethical hackers in government environments has evolved: The word \u201chacker\u201d is becoming more accepted.<\/p>\n\n\n\n
\u201cI do think it signals a shift in mindset,” Michos said. There\u2019s a realization that “those people who portray themselves as hackers are actually those who will rescue us, not those who will destroy us.\u201d<\/p>\n\n\n\n
Despite all the changing technology and evolving threats, one aspect of cybersecurity remains set in stone, said M. K. Palmore, a field chief security officer for the Americas at Palo Alto Networks and a recently retired FBI cyber agent.<\/p>\n\n\n\n
\u201cIt\u2019s about adhering to cybersecurity fundamentals,\u201d Palmore said. \u201cThat message hasn\u2019t changed regardless of my position or where I\u2019m located.\u201d<\/p>\n","protected":false},"excerpt":{"rendered":"
Fifth Domain asks several cybersecurity experts about what’s changed in their field in the last six months.<\/p>\n","protected":false},"author":7,"featured_media":32950,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_canonical":"","_acf":"","_yoast_wpseo_primary_category":14,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","_smg_distribution_targets":[]},"categories":[106,110,14,33],"tags":[],"coauthors":[3242],"class_list":["post-32512","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-daily-brief","category-it-cloud-report","category-it-networks","category-newsletters"],"acf":{"subheadline":"","legacy_arc_id":"KTI2K2ORC5BMVAZ3KM6IUR3IC4","arc_canonical_url":"\/show-reporters\/black-hat\/2019\/08\/30\/whats-changing-in-the-cyber-domain-we-ask-industry-experts\/","remove_feature_photo":false,"is_sponsored":false,"subtype":"","redirect_url":"","disable_inline_ads":false,"native_logo_pretext":"Presented By:"},"yoast_head":"\n