I'm Mary Ann Kolbasak, the executive editor at Information Security Media Group. Today, I'm speaking with Taylor Lehman, who is director of the Office of the SISO at Google Cloud. We're going to be discussing a new report from Google about attack trends targeting cloud environments used by healthcare sector organizations. So, Taylor for starters, briefly describe how Google conducted this research.
What did you examine? Yes, we leveraged a variety of open source or public datasets that got into successful attacks, and how they happened, as well as look at other information that we gathered through normal sort of incident response, and threat intelligence that we gather, and tried to pull some interesting insights of what we saw in the last two years or so of trends in both use of cloud as a platform to conduct attacks, as well as analyze attacks on cloud. So, we can come at this research from two interesting perspectives, but really focus on what does this really mean for healthcare organizations? Taylor, with that said, what did you find?
What are the most common cloud security incidents that you're seeing in healthcare these days? And how are those trends changing? So, it's interesting. I think it's more supportive of what we've been saying for quite a while.
Ransomware continues to be used very often, but we're starting to see an increase in extortion, a test to ransomware events. So, this is the, not just ransom, sort of the availability of a platform, but, you know, sort of, you know, sort of external organizations for really some information that might be acquired in those attacks. We're starting to see, obviously, sort of more of that. Most common interest of the party's conducting attacks, both using cloud as a tool or taking organizations on cloud is for financial gain.
Most organizations are in North America, Asia, Western Europe. The most popular, and we've been saying this for years now, I actually think this was part of our in-wise report. This is now showing up again in this latest theorizations is the use of stolen credentials. And I feel like I spent a lot of time talking to folks about credential hygiene, how important it is, and it really is, you know, in this report, like proof that just one poorly managed credential in cloud could be the difference between a good day and a bad day.
So, when it comes to managing credentials, you mentioned that you talk about this a lot, what sort of mistakes do you still see organizations making or things that they're not doing that are leading to somebody's incidence or seeing? Yeah, I don't think that like any one cloud is better at this or not. I think for the most part, many have the same sort of constructs that lend themselves easy to abuse. And the first and sort of most obvious is credentials that are sort of highly privileged or overly privileged, in general, if you're using credentials with that, excuse me, accounts that have weak passwords or do not deploy multi-factor authentication, for example, and also have powerful privileges, you're seeing abuse of the credentials to get those accounts and then, unfortunately, the poor hygiene attached to an account, say, for example, an administrator account with lots of privileges, you're seeing those being increasingly used to have more and more catastrophic impacts, where it really becomes problematic is when those sort of accounts can be sort of downloaded into keys that can be reused.
So, instead of thinking, logging into a system of these, when you pass forward, you're actually downloading a key pair. And we see this commonly. It's not good from a security perspective. We always recommend organizations don't do this.
But when you download, say, service account keys, and you use those keys to, say, connect an on-prem or an on-premise workload to a cloud workload, or you connect an on-premise developer working off their laptop to an on-cloud workspace, unfortunately, those keys are not really, really tightly managed. They can turn up into the hands of a bad guy, and the bad guy can, you know, effectively impersonate either a workload or developer and do damage. So, really serious, really important, obviously, maintaining credential hygiene and account hygiene, but also making sure that we're not doing things like downloading service account keys and using them. And if we do, we've got really strong controls over that, and we're rotating things and doing all the things that we should do with staff credentials.
So, if you drill down into some of the hygiene that these entities should be doing, but maybe they're not, you know, what are some of the key things that you advise healthcare sector entities to really be paying closer attention to, to avoid, you know, these sort of situations that we just described? Yeah, I think, you know, with cloud now that hopefully been at this long enough, where we understand the power that, you know, using code to define and deploy technology, the power that gives us, the capability that gives us. Now we can use code to define, you know, access patterns that users might get signed or how we restrict access to certain resources or how we implement resources with security profiles that are strong. So, we can now do this really consistently and well with code, because, you know, the code will only do what the code is told to do.
So, if we've made, my argument is we've made that easier to do, to deploy software securely and manage credential to scale. We now have the responsibility of looking at the residual risks that we still have to manage. And I think one area that I'm seeing a lot of uptick in, and we're going to write about this in subsequent report, is this like this new set of skills that we need to start looking at more seriously and adopting. And I like to call it like least privilege engineering.
And what least privilege engineering is, is looking constantly at what resources or users are running within an environment, what privileges are they using? So, not just like what roles are they assigned, but what privileges is a user using, like update database or delete row or deploy application. Look at the privileges they're using, and continuously strip privileges that are conflicting with other privileges they might have. So, making sure that one user can't unilaterally process a transaction without oversight.
So, making sure that one person can't have a catastrophic effect on the entire organization, but also making sure that we're stripping privileges that they just don't use. Or, if they do use them, but very infrequently, setting up the mechanism that gives them temporary access to say a set of credentials and search situations, but when that scenario was over with, they pulled them back. So, this concept of like least privilege engineering is something that, you know, I think we're going to see more and more of. It's more advanced, sort of less talked about set of skill sets that are needed, but because we're deploying software now at scale using code, we can certainly build on that with things like least privilege engineering.
And I think that's an area that I think a lot of organizations would benefit, maybe shifting how they manage access today, which is setting up and removing user access to really getting more fine or grained. What can people do and make sure that they can only do the things that they need to do, and nothing more. So, with that said, how easy would it be for a healthcare organization to take that least privileged approach? Who's watching you here?
Oh, the doctors need access to this. The clinicians need access to that. Never know where they're going to be assigned. There's all sorts of issues when it even comes just to the clinicians.
Does that sort of interfere with the strategy of least privileged? No, it doesn't. I actually think they complement one another. There's an angle that least privileged that we didn't get into in my remarks earlier, which is that is not to say that monitoring goes away either, as a valuable control.
And so, let's make the argument that, yes, you could implement least privilege engineering patterns, and Google has a couple of capabilities on the platform that make that easy, one of which is I am policy intelligence. And these are tools that users and organizations can use to sort of monitor privileges and remove them, or make recommendations to how to adjust them to reduce risk. And those are really powerful. And I probably spend more time talking about implementing those tools as a first priority.
But then there's also this concept of just-in-time access, which is another set of mechanisms that provide, say, like that, hey, we've got an emergency. Marianne needs access to these records, but just temporarily because we've got a problem. So, building in mechanisms that allow that just-in-time access. And so, again, that's a different set of features and capabilities that most clause offer, but the idea there would be to implement those when you've got these sort of risky scenarios like you're talking about, they have a timing, sort of an important timing element to them.
And then there's, of course, monitoring as a sort of third leg of the stool to make sure that whatever's happening in the day-to-day use and least privilege engineering use case and whatever's happening on the chest-in-time access, we have a firm understanding of what's going on, what that access is being used, and we can use things like machine learning to detect unacceptable patterns of behavior involved. And it's really a combination of those three that I think when working together, sort of answer the news when it comes to arguments against them, like the one you're using, which is very common in like medical record systems, where people make arguments, whoa, any patient could show up any day with any affliction, and I might need to treat them. And so, we're going to adopt a very open access model. I think more and more of the industry is moving away from believing that it actually is true, and that is a day-to-day issue because they're adopting more of these mechanisms where we're saying, look, we'll set you up with access.
We'll make sure you adjust what you need buttons. In cases where you might need more, we have a safe way of getting you more that doesn't take time. And regardless of what you might do, we've got to control for anything's go wrong or you make mistake or something like that. But those are the three sort of pillars to addressing issues like that, that I think work really well.
So, Taylor, how are the attackers utilizing the cloud to carry out the various attacks against healthcare sector organizations? We were talking about sort of the security risks of the healthcare organizations that use the cloud face, but how about the attackers who are benefiting from the cloud? Well, I mean, I think cloud is a set of infrastructure that once compromised can be used by a threat actor to attack others. It's a very common pattern that we see effectively using somebody else's gear to attack someone else.
And there's benefits to that. From an attacker's perspective, the first being it's really hard for the attacker organization to figure out who's attacking them. If the person attacking them is actually somebody using somebody else's identity to do so. But we see a lot of that.
And we see a lot of organizations reselling access to compromised equipment for that purpose. So we see this in sort of the ransomware as a service space where without going through fully in detail on how that works. But you've got groups now that'll compromise assets in the cloud around premise and then sell the access that they've acquired to another party to then execute sort of a variety of attacks. It might be interested in whether it be on the organizations that have been compromised or organizations that other entity itself is connected to.
And so we talk about supply chain being also really important places to consider who your organizations are connected to. But you're seeing cloud as an entry point into some of these organizations due to a lack of privilege management and lack of account hygiene and lack of other best practices that, again, while some of those may be things that we see more in cloud, there are issues that exist across all the cloud providers and there are issues that many respects have on premise adjacent issues. So I'd say it's kind of in that space. It's reusing access to infrastructure, which we're selling and then using access to infrastructure that attackers are using more and more.
And that's sort of what some of the data that thrizes before it highlights how that's exactly working. And so now, Taylor, I know that you focus on health care sector sort of organizations, but based on the research, what's your sense in terms of how health care sector entities kind of stack up with other sectors involving these kinds of challenges with the security of cloud and the incidents that everyone's seen? Is the posture of health care worse? Or how do they kind of stack up?
So I'm optimistic. Things are getting better. They may not feel like they're getting better, but we're seeing more and more organizations adopt like get used to understand about best practices more and more and more. And so we're seeing fewer and fewer of simple, super simple attacks happening.
And that's a good thing. Health care still has a variety of legacy challenges that I think are made sort of maybe not made as being unique for health care, but we've talked about previously on this podcast. Again, health care is one of the only industries where human life is directly at risk. And that is often used as a negotiating lever for bad guys to acquire payment or use to further store for outcomes that are interested in.
Health care data is also really valuable for research purposes. It's really valuable for nation states to understand adversaries to understand particular individuals that are looking to recruit. You're starting to even see increased attacks on the availability of health systems because they create societal chaos to take them down. But most of this is largely aligned to the fact that these organizations provide critical life safety services.
And that makes them interestingly valuable for a variety of reasons. And I don't think that's going to change. And so I do think our job is to really make it much more expensive and much more difficult for organizations to exploit those characteristics of health organizations. And that's where I think things are getting better.
I think we're getting better at understanding what needs to happen to maintain availability of these systems. I think people are getting better at using cloud. I think people are getting a lot better at using threat intelligence. I think I'm seeing improvements in automation and some of the work we're doing at Google with bringing scale and speed to security operations that I see a lot of health care organizations starting to do.
We're seeing dramatically improved benefits from start to finish in the organizations like really thinking through how they how they defend themselves. So I think I think it's still we have a lot of work to do. I really don't want to see identity and access management issues being the top top issue that we see next year when we study the trends again because it's all too common and we know what we need to do. But I do think and feel things are getting better and I'm optimistic about the future.
Taylor, any other top recommendations you have for health care or sector entities to up their game in cloud security that you haven't already mentioned? I think in general getting really strong at the basics is important. I don't think it ever really goes away and sometimes it doesn't feel like the sexiest thing to be working on. But the ROI is there and as long as organizations adopt the mindset that humans are always going to never going to operate perfectly and consistently.
And so our job is to understand what is what works and then automate it and do it at scale and have that mindset that we're going to automate everything we possibly can to keep up with the threats and and to reduce the impact of human error. I think we're going to keep improving. I also think AI in particular has a really interesting role to play in helping organizations level up quickly. Now AI comes with its own risks and we should be spending about as much time talking about how we use AI to defend our organizations to also making sure that we secure the use of AI in our organizations.
And as long as we're focused on both those things, I think AI is going to make a big difference in the coming future. But I would say keeping a focus on automation and then really fully understanding the opportunity we have AI from AI. I think those are interesting things that I'm going to be thinking about in talking about over the next couple of years. And Taylor, I'm not sure if you had a chance yet to look at the Biden administration's executive order for AI, some of the touches upon the healthcare sector, but also HHS, the department that oversees health issues there from the government perspective.
I don't know if you, again, if you had a chance to look at anything that kind of stands out to you about that order for health care? I'm sure well when I read it. Kimberly, you haven't had a chance to really closely examine it. But I do think it's promising that we've got government organizations really leaning in on making sure that responsible use of AI is a first priority.
So seeing the fact that the US government and other governments around the world are getting involved this early, I think it's a positive thing. And I'm just, you know, I'm personally curious to see how it comes together and I'll be paying close attention. Once I have a little bit more time to really sit down and digest the order that was signed earlier this week, you know, I should have an opinion that we can share. Thank you so much, Taylor.
I've been speaking to Taylor Reiman of Google, I'm Mary and Colby's Equity of Information Security Media Group. Thanks for joining us.