Hi, I'm Tom Field, Senior Vice President of Editorial with Information Security Media Group. In the wake of the U.S. strike, there have been concerns about the potential of an Iranian cyber response to the U.S. I'm here today to talk about the nation-state threat with Phil Riddinger.
Today, he's President and CEO of the Global Cyber Alliance, but in the past, he's worked with multiple organizations, including the U.S. Department of Homeland Security, Microsoft, and Sony. Phil, thank you so much for taking time to speak with me today. Tom, good to talk with you.
So, as I said up front, you've got unique perspective. You've been in federal government. You've been in global enterprise. When you look at this topic of the nation-state threat, what do you find to be most overlooked by organizations and security leaders?
Tom, I think the most important thing for people to think about is that while we are definitely in a heightened threat environment right now because of some of the global tensions that we've all seen, that the same way that nation-state bad guys, if you will, get into your systems are the same ways that corporate espionage might, standard criminal actors and high-order criminal threat actors. You know, the things like phishing and watering holes are going to be used by all of them. And so, the most overlooked thing is not that you need to be super aware of the APTs used by the specific threat actor groups that may be targeting you. You do.
If you're a significant company, you do need to look at those. But everybody needs to really double down on the basic stuff, getting their systems patched, ensuring vigilance, monitoring their systems, all the stuff that you want to do just for cyber healthfulness normally, you want to do with extra vigilance and strength during a heightened threat environment. So, how have you seen the threats and the threat actors evolve just since the advent of the Global Cyber Alliance? So, Tom, I'd say, really, it's not significantly different than what we saw before.
So, every day, the bad guys get better. They develop new tools and techniques. New vulnerabilities are discovered. You know, the threat marketplace grows, so it's even easier to buy threat capabilities.
So, you know, if you're an ankle biter, if you're a script kiddie hacker or a low-capability hacker, you have a lot more capability now than you had two or three years ago, and certainly more than you had five or ten years ago. So, the environment continues to get more challenging from a threat perspective. You know, at the same time, the defense technology is getting better. You just have to make sure that you use the stuff that's out there.
You need to collaborate with your colleagues to make sure you're sharing information. The last piece is that there are new vulnerabilities and things that are significantly changing how much at risk you are. Probably the biggest change we've seen over the past few years is the growth of the Internet of Things. And so, you know, ten years ago, you had your phone and your computer.
And, you know, maybe there was some intelligence built into your TV. Now you've got a smart doorbell, a smart refrigerator, a smart thermostat, a smart toaster. And all of these things are talking to the Internet. And your TV is, you know, it would have been a supercomputer 20 years ago.
So, the ability for hackers to get into those things and cause more damage, even if it just means bricking a device, is much more significant than it was a few years ago. Well, you make a great point, Phil. There's a greater threat landscape than we've ever seen before. We've seen the rise of destructive malware.
We're seeing the deployment of 5G technologies. In this 2020 landscape, what are the specific types of threats that really give you the most concern? I think the thing that scares me the most, Tom, is what I just talked about. The risk and parameters that come from the Internet of Things.
And typically the lack of security that's built into those. You know, when you've got a traffic light, and the traffic light is controlled by a fairly complicated set of custom switches, you know, it's probably a little bit harder to attack. When your traffic light is controlled by Raspberry Pi running Linux software and it's remotely accessible to the Internet, then you can cause a lot more damage. And from a harassment and actual threats to the economy and to people, the broad threat from the Internet of Things remains the thing that keeps me up the most.
I still do worry about things like attacks on the financial system or on the power grid. Those are huge existential threats, but they're, I think, much less likely than the sort of attacks that could cause mass economic damage and adversely affect people's lives through the Internet of Things. Do you see that then as how a cyber response from Iran might likely take shape through connected devices? It's really hard for me to judge, Tom, on that particular point.
I've been out of a government role since 2011, so I don't see access to the intentions. What I will say is that, you know, all of these different things are at risk. And the advantage of focusing on hygiene and basic protections while doing more if you can, means that you're protecting against this broad spectrum of attacks. So it matters less if you're phished, whether a foreign hostile government phishes you or a criminal organization phishes you.
They're still going to try and disrupt your life and steal your money and perhaps cause other problems. And so doing the basics right protects you against everybody. So, Phil, within critical infrastructure sectors, utilities, financial services, health care, what are the types of questions their security leaders need to be asking themselves now at a time of perhaps heightened tension? Well, I think there are some things that they obviously need to be doing.
You know, one is, if you're in an organization that's sophisticated enough to have sort of alert levels, you want to be at a higher alert level. It's like if a threat organization went out there, you know, maybe anonymous or somebody else and said, we're going to attack you. You're on notice effectively that you're a target. And so you need to watch very, very carefully.
And you need to respond to that. You need to monitor your system strongly. You need to have increased vigilance and protection. If you're doing things like automated scanning and patching, you want to ramp down the times.
Like if you see a critical vulnerability and normally you patch that within 24 hours, patch it within two so that your risk profile is lower. Make sure you've got the right relationships. Make sure everybody is aware and informed of your incident response plans and you've got ways to communicate. For example, if your email system goes down, does everybody on your team know how to communicate by text or otherwise?
So there are alternative communications channels. And do you know if, you know, things, if things really, and I won't say what things, but if things really hit the fan, do you know who you're going to talk to in government and among your partners? How are you going to respond? You don't want to, if something bad happens, be looking for that binder you put on your wall three years ago.
And it may be covered up now. You want to have that on your desk. So I'd say, you know, be a Boy Scout, right? Be prepared.
So how do you tailor your advice for mid-market organizations and enterprises that might not consider themselves traditional targets of nation-state actors? It's really sort of the same, right? The advice for big organizations is don't forget the basics. The advice for small organizations and mid-market organizations is do the basics.
A lot of those entities are really not going to be prepared to study nation-state actor tactics, techniques, and procedures, TTPs. They're going to really want to focus on doing the basics right. And I'd say there are a lot of tools out there. For example, GCA has produced and made available at gcatoolkit.org a toolkit for elections officials and then one for small businesses.
And it's really important that organizations look at resources like that GCA toolkit to get the basics done. You know, you might think about the attacks that happened with WannaCry and NotPetya. You know, I'm not sure a lot of hospitals thought that they were going to be victims from a nation-state attack. Why would a nation-state want to attack them?
It didn't help them, right? You know, a worm was loose. It was attacking a lot of people and they got hit. So your status as not important may not protect you at all in this environment.
So you talked about the Global Cyber Alliance. I'd like to ask you a little bit more about GCA. How are you helping your members today to improve their risk awareness and their response capabilities specifically regarding nation-state threats? So I'd say the following, Tom.
We don't just help our members. You know, GCA is dedicated to helping everybody around the world. And it's our members and partners that help us do that. They help give us the capabilities we need to protect everyone at scale.
So when we've developed things, it's been like Quad 9, a global infrastructure we built with partners that makes what is real enterprise-class cybersecurity protection freely available to anyone around the world. And it takes two minutes to use it. So I'd say people need to get aware of those sorts of capabilities. We're working on solving those sorts of problems.
Broad protections like Quad 9 and our cybersecurity toolkit for small business that can really work to protect anyone. And we're helping our partners, for example, in protecting this global ecosystem because even the biggest companies are at risk from attacks that broadly affect people. You know, an attack on the National Health Service in the United Kingdom affects everybody in the United Kingdom from an individual to a small business to the largest company and government organization. So that's our goal.
Our goal is to make the Internet safe for humanity, to