When it comes to malware, what is the gap between infection and detection? Hi, this is Tom Field, Vice President of editorial with Information Security Media Group. I'm discussing this topic today with Paul Martini, CEO of iBoss Cybersecurity. Paul, thank you so much for joining me.
Absolutely, I'd like to be here. So Paul, security leaders often have what we might call an inflated sense of their own organization's ability to detect malware infection and data exfiltration. In your experience, what are they really overlooking? You know, most organizations are focused on building thicker walls, new mouse traps.
Every time new technology comes out, that allows them to detect malware in a different way. They jump to that right away. But at the end of the day, even the Great Wall in China doesn't compromise. You can build a really thick wall, but you can't neglect that at the end of the day, you will be compromised at some point.
And really looking at that situation and asking yourself the right questions. Things like, what do I have in place, not only to detect the malware, but the data that it's trying to hijack, which is a more important question. You know, there's a lot of technology out there and a lot of solutions and algorithms that focus on malware. You know, you're looking at Command and Control Center callbacks, intrusion prevention systems.
But if you take us back and ask yourself the obvious question, what about the data? Data that doesn't have a Command and Control Center type callback, a destination that's obvious. You know, something like cloud storage, solutions like Dropbox where they can host people's data and actually it can host your data as a company. So with all the attention is given to cyber attacks now, why do you find that there remains such a wide gap between the time of malware infection and ultimate detection?
You know, I think the real answer to that is no different than the fact that you'll always have the possibility of getting infected. There's no such thing as a 100% certainty in anything in life, including the fact that if there's going to be a time where you do get compromised, the time from infection to detection will never go to zero. So there's always going to be that time. I think asking the right question, which is what about the data?
What about proactively monitoring the data, directional in the outbound direction, for example, high risk countries, data moving to high risk countries or regions? That's really the question you want to answer. And if there really is no answer around that, it allows for such a big opportunity for hackers that are sitting in any part of the world and really targeting that data. That's really where their focus is and what they're looking to do.
So really, in a very legacy type of approach, you have some organizations that just continually build bigger armor. And then on the more progressive types of security postures, you see organizations that focus on command and control center, callbacks, they focus on finding the malware. Where is that malware in my network right now? Who downloaded the malware and things of that nature?
But still, the most progressive organizations are looking at the data itself. Data that doesn't have a fingerprint, it doesn't have any sort of type of key that you can key off of to detect malware. And that's really where it allows the dwell time to go on much longer than it usually should in reality. If you can shorten that dwell time by looking at the anomalous behavior of data that moves out of the network, that actually will get you to a better place in a more effective manner.
So Paul, let's make this real to an organization. Within that wide gap between infection and detection, what do you find to be the value of lost hours, lost days, and the potential business impacts of that downtime? We're talking about permanent data here. And I think the fact that it's permanent, there really is no value you can put on the data.
People look at the direct victims, which are the consumers, the users of the product, the people that the company sells to in services. But there's actually a lot of other victims as well. There's jobs, there's the CIOs job, the CISO's job, the board, the organization. And you also look at shift embarrassment that comes with it.
So what are the costs involved in a breach that not only affected consumers and they do a confidence to purchase or use the services? And in a case where you're a business type of organization, where other businesses do not trust you. But even more further than that, look at a case like Sony, where you have an organization that was so impacted by the breach that they had to actually sell assets and departments that were completely unrelated to the breach or to making movies in order to cover those losses. So there really isn't a value you can put on the data because it's permanent.
And I think that's what's important. How organizations have made significant investments in security tools and personnel, but something's not working. Where do you see the biggest shortfalls in the traditional security tools and skills of organizations have deployed? It's absolutely in their ability to proactively monitor data.
The focus has always been on the malware, which is absolutely important as well. But to completely neglect the data, the data that's being hijacked is actually not only negligent. They allow for such a gap in security, which the attackers are taking advantage of. So they realize that if I can get a very sophisticated targeted base of attack onto your network, the very first thing I'm going to do without malware is have it hijacked data.
I'm not going to phone home. I'm not going to do anything out of the ordinary in terms of presenting myself as malware. I'm just going to start transferring data right away. And those are things you saw with companies like Anthem, where a database query led to millions of records being uploaded to cloud storage.
So really, there's where the critical gap lies, is that there's a lot of focus in one area which causes a diversion to create a very balanced security posture. I think that as we take a step, we need to take one step back to look at the overall security posture and say, where am I the most efficient and invest into those areas? What do you find to be today's must-have tools and skills to help reduce the gap between infection and detection? Tools like in algorithms, techniques like network anomaly detection and data exaltration containment, those types of techniques that focus on data proactively are absolute essentials for any organization.
I'll give you an example. If you do a credit card charge that's 200 or 300 miles away and it's not normally a city that you visit, you're going to get an alert from your credit company. They'll call you to ask you if that's your charge and then you have the opportunity proactively to stop the charge and prevent it from going through. Now, if the credit card company called you and said, last year we noticed that a few thousand dollars were left to account, but by the way, it was a year ago and it's too late.
That's really the situation that we were in when it comes to data. We look at situations where there's large losses of data and records and there's a lot of enthusiasm around finding the malware, which is the same as finding the criminal. But the reality is that the data itself is gone. That really doesn't do me any good if I have millions of records gone, no different than if I have thousands of dollars gone from my bank account a year ago.
So the reality is the tools that proactively monitor data such as network anomaly detection, which look at things like packets, bytes, connections, look for anomalies in that behavior, so they baseline the behavior. And on a normal day, this is what the traffic should look like. And then in addition, today it looks 25% different. If that has nothing to do with malware, it has to do with the actual data itself and protecting that data.
Paul, let's talk about some of your customers. How would they tackle this challenge and what do you find to be some of the key lessons learned from their experiences? You know, I'll give a good example. You know, we deal a lot with health and finance.
Now the particular system manages accounting on the East Coast. And he, you know, he, we were discussing a lot of the solutions and technology in architecture. No, this is a sophisticated network. So John had about 14 different systems covering the data, anything from the typical endpoint protection to intrusion, the obvious firewalls, all the application type monitoring and that sort of thing.
And what happened was, you know, as we talked about monitoring, like, what do we have in place in terms of monitoring the data and the direction of the data? What we found was the closest thing that we can find out of the whole, you know, buffet of solutions was performance monitoring software. It would monitor performance on his server and monitor data on a particular server. But it didn't have context.
It didn't have direction. It didn't have a notion of data moving from an untrusted network to an untrusted network. And so what we did was we set up in a discovery mode, network anomaly, and network anomaly detection and data filtration containment. Just literally just a look at, you know, is there anything anomalous going on in this network with respect to the data itself?
And surprisingly, within 24 hours, what we found was it was over 18 different transfers, very large transfers. One of them actually turned out to be, as it was tracked back, it turned out to be a user that was using AOL chat to upload files to China. And, you know, I never got into the details of what those files were, but they definitely weren't a good thing. And I think that the great part of the story in this example was that in this particular case, it actually wasn't malware that was doing this.
So there would never have been a flag or an alert or anything like that, no command and control center call back. However, because it was still focused on the data itself, the flags went off immediately within those 24 hours to alert John that, hey, there's something that's just not right, and then track that down to the actual user. Now, there was a bunch of other transfers as well. Some were good.
Others weren't. But the good ones, what he liked about it as well is even the good transfers, it actually gave him the peace of mind that if someone were to ask me, where are all my transfers going to, the bulk transfers, the risky transfers, I felt very confident that I can answer that question. And the last thing you want to do is be in a situation where you're in the dark. You know, you want to get caught with your pants down because you don't know where all your data is going.
And when you get asked whether it's through an audit or after a breach, you can even tell someone where the majority of the data in a massive amount, you know, things like data going to high risk countries, you know, what does that look like? What does it look like on a typical day on a typical month? I think being able to answer that question is ultimately what's the most important. So Paul, we've thrown an awful lot at people today.
We've talked about the gap between infection and detection and talked about shortfalls and technology and skills. Bottom line for an organization that wants to turn this around, where is the place to start to address this gap? So address and fill where you're the most efficient. And today, most organizations are deficient at technology that monitors the data itself, not just the malware.
You know, if you're, if you're very progressive, there might be technology around finding infections on a network, identifying where they're located, finding out where they're, when and why that happens. But you need to take it a step further and become even more progressive and focus on the data itself, proactively monitoring the data, monitoring it in a directional way by region, by amount. And once you do that, you'll come to the realization that, you know, even though there's not one silver bullet that's going to solve this problem, at least it'll put you in a better position, in a better security posture, so that you're not caught in the same situation as the large recent breaches, such as Anthem and Sony. Well, Paul, it's great insight.
I appreciate your time and your thoughts tonight. Yeah, thank you very much. It's great to hear. The topic has been malware, the gap between infection and detection, that is speaking with Paul Martini, CEO of IBoss, Cybersecurity.
For Information Security Media Group, I'm Tom Field. Thank you very much.