It’s that time of year to read countless reviews of the RSA conference. To read the view of someone who has attended many years in a row and is greatly respected for his contributions to the cybersecurity industry, you can read spaf’s post. If you want to know what an RSA first-timer thought of it, you can keep reading (or browse my twitter feed).

Let me start by saying the opening keynote on Tuesday was a spectacle of trolling proportions. A surprise opening speech by the great, no connection to cybersecurity to speak of, Helen Mirren, was followed by a cybersecurity-themed choir song (I wish I was joking). And when one later keynote panelist suggested that developers putting in backdoors should be put into prison (15:30 minutes in on this panel), it was somewhat cringeworthy for, um, well, reasons, but still resulted in a round of applause.

I’m looking forward to some great sessions at #rsac and the level of organization is flawless. But when Helen Mirren gives us an inspirational speech, a cybersec gospel follows, and the first talk is about a utopian future thanks to me, I start to wonder if I’m being trolled. 😂 pic.twitter.com/2QwZR3C4Gg

— Matt Nappi (@mattnappiciso) March 5, 2019

But things got better as I attended other sessions and had the opportunity to hear from legendary cybersecurity contributors and experts. It was an absolute treat to hear Bruce Schneier, cybersecurity royalty and Harvard Kennedy School Lecturer, talk about the role of security technologists in public policy. His keynote was thought-provoking and engaging.

I had the opportunity to attend a two hour incident response (IR) tabletop workshop and I quickly volunteered to facilitate the experience for our table of eight, under the guidance and leadership of the session organizers. Our team of “experts” did some great things along our virtual incident, but in the end we did not apologize enough upfront and paid the hard price of our ‘choose your own adventure’ cyber incident and our CEO was force to resign after a hard hitting television interview (well, he was kind of happy to do so, actually). It was challenging as a facilitator not to jump in with my own advice and opinions, but perhaps the most important lesson I learned was the difference between facilitating and participating in an IR tabletop exercise.

I just participated in a fantastic IR tabletop exercise at #rsac thanks to @withoutfire and author Tom Wiseman. Our rockstar team made some mistakes, but owned them in the end. pic.twitter.com/gAS9lRym62

— Matt Nappi (@mattnappiciso) March 6, 2019

There were many others I got to rub shoulders with, meet and learn from throughout the week. RSA was attended by many industry thought leaders, including the likes of Ed Skoudis, Larry Poneman, Johannes Ulrich, Ron Rivest, John Strand, Alan Paller, Stephen Sims, James Lyne and Paul Asadoorian. I have to plug Strand’s awesome, free threat hunting tool here, named after his awesome, late mother who ensured it will be free forever, RITA. Did I mention that it was awesome and free?

This guy represents everything right about the cybersecurity industry today. @strandjs #rsac pic.twitter.com/eKIedHOWd8

— Matt Nappi (@mattnappiciso) March 8, 2019

The smaller sessions were truly the gems in my opinion, aside from the always noteworthy 5 Most Dangerous New Attack Techniques Keynote. My advice is to spend a couple hours before you attend and create a schedule, pre-register for the sessions you don’t want to miss, but stay flexible throughout the week. One of my favorite sessions was a “fireside” chat between a CISO and published author focused on communicating with the board, which I had no intention of attending. I followed along a fellow CISO colleague (Hi Okey!) and I’m glad I did because some of the unfiltered conversation that ensued during that session resulted in nuggets of wisdom possessed only by extremely experienced professionals (and those who were eavesdropping in on the conversation)! This resulted in my most controversial tweet of the week…

What % of IT budget is spent on security? Most are somewhere between 3%-17%. 3% = hacked and don’t know it. 5-8% = solid program. 17% = big banks that have never been hacked. 10-12% range are companies that were recently hacked. @richardclarke & @aflac SVP Tim Callahan #rsac

— Matt Nappi (@mattnappiciso) March 7, 2019

There was also plenty of sessions that discussed the importance of a diverse and growing workforce within cybersecurity. I had the chance to reflect on how I can personally make an impact in this area, and was able to hear from and meet many others trying to do the same thing on a much larger scale, like 16 year old Kyla Guru.

School age girls are motivated by the potential of making a difference more than “winning” and “money”. But recognition and community membership is vital! @MrsG_Cyber and @MicheleDGuel are killing it at #RSAC on the topic of women in cybersecurity. pic.twitter.com/OqfzWPASCh

— Matt Nappi (@mattnappiciso) March 7, 2019

In summary, San Francisco was a good experience. RSA was a good experience, but I’m sure the excitement of rubbing shoulders with the who’s who of cybersecurity will be gone the second time I go. And the vendors? Noticed I haven’t mentioned them? They weren’t there. SIKE. They were everywhere and working HARD to be noticed. Surprisingly, though, you can spend as much or as little time as you wanted with them because they had over 40,000 targets and droves of folks that were lining up to talk to them. So, I spent some time talking to the vendors I cared about at this moment in time, spent an hour or two learning about new vendors, and now I’m all set to ignore their phone calls for at least another 6 months.

RS-YAY or RS-MEH? I would say…RS-OKAY. I will be back. But not next year. Once every 2-3 years would be perfect in my book.

Thanks for reading and don’t forget to subscribe.

The Public Theater, NY

Earlier this week I had to opportunity to attend the Business E-mail Compromise (BEC) workshop, which is being made available in various cities around the country. Law enforcement, Symantec and various ISACs teamed up to bring awareness to this very expensive attack. For theater buffs, there was an added bonus to the NY workshop because it was held in The Public Theater, which is where Hamilton and many other famous shows first broke ground.

The Public Theater Lobby

What is a business e-mail compromise attack? Put simply, it’s a fake e-mail sent to someone in the business, usually accounting or finance, with the goal of initiating a wire transfer or some other transfer of funds. It is often spoofed so that the e-mail appears to come from the victim’s boss or another executive in the company, and commonly starts with a simple, less suspicious request. If the victim engages in a conversation and replies to the initial e-mail, the conversation escalates quickly and usually ends with a large wire transfer to an external account. The most recent attacks even include a “Sent From My iPhone” signature in the bottom of the message in an apparent attempt to excuse sloppy grammar and typos.

The first part of the workshop consisted of a discussion led by an FBI and Secret Service agent. Admittedly, watching them stand on the blue tinted stage with cafe tables in the audience first made me wonder if they were going to sing the blues of cyber security, but the tone of their session was positive and informative. They are often involved in responding to these crimes, and the dollar amounts vary greatly from thousands to millions of dollars. The insight they provided was valuable, and they stressed the need to involve law enforcement quickly. After 72 hours, it becomes highly unlikely that the funds can be frozen or will ever be recovered. The goal should be to involve law enforcement as early as possible. Interestingly, they have not seen the sophistication of these attacks increase much, which means we have a window of opportunity to bring awareness to common attack methods. But it can also mean that the bad guys have not needed to adapt because they are continuing to have success. Both agents stressed that if we are not sure which agency to teach out to, contact them both (FBI & SS) and they will coordinate the response between themselves. The Internet Crime Complaint Center at www.ic3.gov is a good place to start.

Symantec highlighted an e-mail threat report they published which also provided some valuable insight. For example, they estimate that 8,000 business are a BEC target each year, and as a target you can expect to receive about 5 e-mails. I can confirm that when we received notice of one of these attacks from a single user and investigated further, we found that the same sender targeted a second user in the exact same manner, and then sent a blast phish attempt to a double digit population in our community. So it’s important that phishing incident response procedures include a step that identifies the scope of a particular attack. Predictably, the Symantec talk and report included a highlight of the many solutions they offer commercially to help detect and prevent BEC attacks.

The final session was led by local ISACs, or Information Sharing and Analysis Centers. I am a strong advocate for participation in these groups. They are basically sector-specific groups that focus on cyber security and information sharing to enable better response and intelligence. In other words, they help competing organizations in the same sector work together. Think about that for a minute. Cyber security is such a challenging problem, that competing companies are working together to help each other be successful in dealing with it! We need to do more of that across the industry, and the session really helped highlight some of the services that these ISACs offer. I’ll make a special mention of REN-ISAC and MS-ISAC, both of which I have great things to say about. If you qualify, sign up today. If you’re not sure which ISAC to join, check the National Council of ISACs Registry.

If you have an opportunity to attend one of these workshops I would recommend it. The attendees were a mixture of private and public entity business and technical professionals. The social networking aspect was valuable as well. Those conversations can prove to be more informative than some of the sessions, so take time to linger.

Thanks for reading and don’t forget to subscribe.

I had the opportunity to hear Kevin Poulsen speak recently and it was a real treat. Kevin is a recovered black hat, now working as a writer and journalist. I hereby pronounce his book mandatory reading for anyone working in cyber security.

Kingpin: How One Hacker Took Over the Billion-Dollar Cybercrime Underground

It’s a great read and beyond the entertainment factor, it gives tremendous insight into how stolen credit cards have evolved from being just an edgy hobby into big, very big, business.

In the talk I attended, Kevin gave his own story and even showed us a clip of himself, troubled and devious youth hacker, as depicted on Unsolved Mysteries. But the heart of his talk summarized the story told in his book, Kingpin. This book tells the story of since captured hacker, Max Butler, who in his own mind had only the purest intentions. Hack the hackers and make money along the way. That slippery slope ended abruptly and Kevin does a terrific job of capturing the facts and the personalities involved, which are often overlooked when simply reading the headlines. Another version of his talk was recorded at Stanford Law School when he gave it in 2011. Check it out here:

After the talk, I asked him if he agreed with most security analysts who predict that criminal hacking focus will shift from stolen credit cards to medical records. He replied, in part, “I’m not convinced yet.”

He explained in his talk that although chip and pin/sig will not stop all credit card theft, it will hamper the appeal and availability of large payloads we have seen in recent years.

Whether the focus shifts or not, one thing is for sure…bad guys are good at multitasking.

What do you think the next big thing will be? Let me know it in the comments below.

Thanks for reading and don’t forget to subscribe.