The Exchanges

Q So if they are going for it, and hence, ah, the attacks that you see from these most powerful models are fairly detectable, what's the big deal?

A That is the, uh, nine hundred and sixty eight billion dollar question or whatever the latest valuation was for some of these companies. So that's why I think there's this really big chasm in the security community right now of all of the fear mongering and hype on socials and in the media versus the reality. And now there are some fundamental things to go off and do. So in a, in a post kind of, uh, mythos, LLM, cyber, uh, AI world, There are a couple of fun, uh, problems. So if you assume for a moment that Palo Alto Networks, which was part of the Glasswing project, if you assume that Palo used these LLMs to, uh, find, uh, vulnerabilities in their firewall code, and they're gonna spend all summer fixing those vulnerabilities, good on them. Sometime in September, they're going to issue a patch Tuesday. And when they issue that patch Tuesday, they're gonna ship a patch that fix, I don't know, a thousand security flaws. Once again, congratulations. Good on Palo. What is the first thing an attacker is going to do? They're going to take that patch with all those fixes. They're going to, uh, do a, what's called a binary comparison. They're going to compare that patch with the previous patch. They're going to see every line of code that changed, and then they're going to go through and try to figure out was that change fixing a security flaw or not. Suddenly they're basically going to…

AI assessment note: “with LLMs, uh, you're able to reverse engineer that patch in a fraction”

Q with you about the reverse engineering, the, the potential vulnerabilities in a software codebase. Where does that get you, right? Because if you're able to reverse engineer fixed problems in the software, well, you've just effectively gotten to something that might be very valuable to you two weeks ago, but if it's, you know, supposedly patched, it's not very valuable to you today. So why does that make a difference?

A So just because the patch is available doesn't mean a company hasn't, has applied it. So what we actually found in, uh, Verizon DBIR did this in their report, I think last year or this year, Um, CISA KEVs, these known exploitable vulnerabilities, if a vulnerability becomes a KEV, like, that's a five alarm fire, and you better do something about it. It is the strongest signal that there's a problem. Well, 50% of CISA KEVs are still unpatched two months after notification. Now, what happens is, the patch came out, but it still takes companies A day, a week, a month, two months, or whatever, to apply that patch. And so that becomes the window of exploitation that the attackers are taking advantage of. So they're able to immediate, they're able to weaponize the exploit faster than you can patch. Now, what that means for you as a defender is, one, you better get really good at patching quickly. Number two is you better get good at virtually patching, which you may not have to apply the full patch, but at least you can make a A firewall rule change or, uh, improve a detection in your EDR or something to, to stop the attacker from coming in. And number three, you better get really good at containment and eradication, because if you can't patch fast enough, the attacker is going to be in your environment very quickly. Now you need those decoys. Now you need net micro segmentation, zero…

AI assessment note: “just because the patch is available doesn't mean a company has applied it”

Q say a, someone who's trying to cyber attack you, you might add some traps. What are those traps look like? And why do you think, I mean, they must have been trained on the notion that there's going to be some traps there. In fact, as you said, they identify them. So how is it possible then that even after they identify them, they still click on them? That's crazy.

A Yeah, uh, and not even at a, at a, at a, at a acceptable failure rate, but at 92, 9500% of the time, they still click on them. So one, what's a trap? Um, as an attacker, you are going to inevitably find a way in. There are just so many doors and windows in an organization, they're gonna get in somehow. Once they're in, a key tactic that an attacker does is live off the land, meaning it will, an attacker will start to Look at share drives, look at file systems, look for interesting pieces of information like a password.txt file, or a .keystore file, which has the login for your cloud environment, and so on, or a database dump file that could have sensitive business data within it. So as the attacker starts to rummage through the network, it's going to come across artifacts that look extremely interesting to the attacker. A decoy, Is an, is an artifact that is intended to look interesting. A honey token is what we call it, is intended to look interesting, but when it is interacted with, if somebody tries to open that honey token, it will fire off an alarm that says, hey, somebody just tried to open me and they shouldn't. Uh, it must be a bad guy. Almost like, uh, installing ring cameras in your house with a motion sensor. As soon as somebody comes by that section of house, the sensor is going to go off. And so this is one of the most effective ways at catching attackers that are …

AI assessment note: “So one, what's a trap? Um, as an attacker, you are going to inevitably”