Shawn Cordner (00:11.694)

Hey everyone and thanks for joining the Amplitude of Tech Podcast. I’m Shawn Cordner, Chief Marketing Officer of Amplix. Today I spoke to Alicia Leone and Dustin Larmier from Tier Point. They talk to us about how bad actors are using human condition against us and how to set up a cybersecurity posture that can keep them out. Everyone should listen to this, whether you’re a CIO, a CISO, or just a consumer of technology. Hope you enjoyed as much as I do.

 

Shawn Cordner (00:41.39)

All right, Dustin Larmier and Alicia Leone. Welcome to the podcast.

 

Alicia Leone (00:46.882)

Thank you. Thank you. Great to be here.

 

Shawn Cordner (00:49.282)

Great to have you both. this is only the second time we’ve done a two on one, so I’m a little nervous, but we’ll see how it goes. I feel outnumbered. let’s start off with a little bit about who both of you are and who you work for and where you come from. we’ll start with you, Alicia.

 

Alicia Leone (01:05.365)

Okay. So I work for TierPoint, as does Dustin. I’m a security overlay here. I basically support sellers and partners with conversations about customer security program goals and map them back to areas in which TierPoint can assist. I’ve been in cybersecurity for 16 years. I’ve worked as an overlay for the past eight. I’ve worked at organizations like Cisco as a dual SME, a few MDR providers, and then prior to that I worked for Radware.

 

Shawn Cordner (01:33.602)

Awesome. How about you, Dustin?

 

Dustin Larmier (01:35.672)

So I am the vice president of information security engineering at TierPoint, and I have a multidisciplined team including network security specialist, experts in AI and machine learning, as well as full stack developers and a network security specialization. We also have a team of folks that do site recovery engineering. So we have our hands dipped in many different pots, but we work a lot with big data.

 

specifically around security. And we also manage a large SIM platform that we deliver services to our clients as well as basically maintain all of the network security and infrastructure tooling that covers all forty four of our data centers nationwide.

 

Shawn Cordner (02:22.754)

Nice. So Dustin, that’s a a great way for us to start off here is that y your team covers a lot of disciplines within the cybersecurity space and that alludes to the problem that we all have, which is the breadth of threat risk that we have and threat vectors that we have today due to just the way the technology has been evolving. So may maybe let’s talk high level. What are you know some of the biggest

 

threat vectors that you’re seeing today.

 

Dustin Larmier (02:54.382)

So I think you know, as far as threat vectors are concerned, what we’re seeing is a huge ramp up in attacks that are targeting edge network infrastructure. we saw a huge ramp up d during the start of the Iranian conflict, when that kicked off our our honey pots, which we run a very large distributed network of honey pots across our data center footprints started lighting up like crazy.

 

And we noticed that there was a a huge increase in attacks targeting like Cisco infrastructure, Fortinet infrastructure, pretty much anywhere where they could get into a firewall or an edge network device. that spiked up incredibly. we also started seeing increased sophistication with phishing type attacks as well as SMS-based attacks, where they’re actually trying to fool people into clicking links and things like that. So

 

That ties really nicely into the social engineering element that we’re talking about because leveraging AI, you don’t have to have even basic language skills in order to pull off a sophisticated attack and you can use AI to also power the campaigns that you, you know, would use to target an organization more intelligently.

 

Shawn Cordner (04:03.692)

Now, before we talk about that, I want to ask a little bit more about, you know, the the risks that you’re seeing related to the Iranian conflict. what is driving that? Is it you know, they’re seeking to disrupt infrastructure? Are they trying to generate funds you know, to help fund the war? I mean, what what are the reasons that you think that we’re seeing an increase in activity?

 

Dustin Larmier (04:31.406)

I think it’s really retaliation and you know making us feel pain. what we see is attacks going towards the water system, for example. I know that’s been in the news quite a bit. that’s not new, but it’s something that they’re actually actively doing. because they’ve been attacking infrastructure and and you know, kind of getting implanted into infrastructure elements for many years.

 

And I think you know, the war just kind of showcases that the threats towards, you know, things that you typically wouldn’t think about on a day to day basis, like your drinking water. And you know, it had happened sporadically before the conflict. Obviously it ramped up quite a bit. And we’re just seeing, you know, a desire to to inflict pain, to bring awareness to what’s going on, you know, as far as the the battle space is concerned.

 

And I think one one way to make, you know, folks in America actually feel that pain would be to target, you know, critical national infrastructure and things like that. So that way it feels close to home. So I believe it’s more of a psychological campaign meant to create, you know, terror and and make us all scared and and make us uncomfortable. And I believe that’s their end goal in this case.

 

Shawn Cordner (05:38.348)

Now, do you think that the risk lies mainly in say the the public infrastructure or are you seeing private enterprises being targeted as well?

 

Dustin Larmier (05:48.854)

it’s it’s targeting everyone. So there’s there’s a lot going on every day. The the average, you know, citizen has no idea what’s going on on the internet, quite honestly, you know. We we go about our days and you know, we’re on our Facebook or we’re doing whatever we do daily or work. but behind the scenes, the alarms and alerts are constantly going off. the attacks are relentless, you know, you’re dealing with nonstop bot attacks that are unintelligent.

 

And then you’re dealing with more intelligent campaigns where people put thought into it, to create harm and or to, you know, gain money or to you know, gain power over someone or blackmail or any number of different techniques that these threat actors use. And that stuff is happening on on a constant basis. Most of it never hits the news headlines, because it’s happening behind the scenes, but it’s very, very active for sure.

 

Shawn Cordner (06:41.462)

There’s a long history of these two superpowers or us I guess we’re the superpower, but of these two powers fighting each other you know, in the the cyber battlefield. I can remember the Stuxnet, is that how you pronounce it? Do you remember that? do you do you remember it enough to tell people what it was?

 

Dustin Larmier (07:00.962)

Yeah, so the Stuxnet was a attack on Iranian nuclear power infrastructure where they were able to successfully implant a malware payload to disrupt the enrichment processes and ultimately cause the system to damage itself. And that that is a a great example of a covert operation where somebody was militarizing cyber attacks in order to achieve an end goal. And that type of thing is really not that uncommon. I think it happens a lot more than we

 

We realize that it does, but it is largely under reported. But those type of attacks are are very common.

 

Shawn Cordner (07:36.578)

That was kind of a crazy one because I I think the equipment was air gapped, wasn’t it?

 

Dustin Larmier (07:40.192)

It was, yes. And there’s some crazy things you can do. If you look at some of the different attack techniques that threat actors can use, they can use you know, things as crazy as like a sound wave or something from a hardware device to manipulate and affect a a hardware device and any number of different techniques where even air gap systems are not necessarily completely safe. There’s always a way, it seems, to bypass security controls and work your way in.

 

Which is why, from my perspective, blast containment strategies and having a proper security program in place is so important because it’s never if, it’s when somebody will target you. And when they do, how quickly can you respond? How quickly can you contain that threat is really what you need to have in place from a a process standpoint to quickly eradicate and prevent proliferation of that threat.

 

Shawn Cordner (08:30.766)

If all else fails, you can always send Tom Cruise in from the ceiling on the rope, right?

 

Dustin Larmier (08:35.47)

Exactly.

 

Shawn Cordner (08:37.23)

So,

 

Alicia Leone (08:38.83)

I was gonna add on to some of the other things that we’re we’ve been seeing are where threat actors are not necessarily breaking in, they’re logging in and they’re going in in stealth mode. I think a lot of the customers that we talk to are worried about you know, those longer dwell times with when it comes to visibility, not having visibility over, you know, all of their environments and not having a way to pull all the alerts together in a manner that makes sense so you can detect something that has bypassed security tools.

 

I know when I talk to customers that’s really top of mind too, in addition to what Dustin mentioned.

 

Shawn Cordner (09:12.364)

So they’re getting a hold of credentials, they’re logging in, then they’re just kind of laying low. So I guess seeing what they can access, seeing what they can scrape from it without being found out, or are they waiting for the right time to strike, maybe?

 

Alicia Leone (09:23.808)

A c I think a combination. I think they look, they see how mu where they can get to and how much privilege they can escalate and then what kind of sensitive information that they can data exfil from the environment. And when they have something that they feel is worth value to the company, then that’s when they typically declare, Hey, just so you know, we’ve got all this data, I’m gonna let you know that we’ve been in your environment for however long and you owe us h however many bitcoins. So

 

Shawn Cordner (09:54.254)

What level of defense for state sponsored attacks like this should the average enterprise have? I mean, let’s let’s leave out anyone that’s in infrastructure or aerospace or the defense industry, right? But just your average, you know, we’re a big retail operation. How much do they need to worry about these type of attacks?

 

Dustin Larmier (10:17.944)

they they need to worry about it a lot. now, like when it comes to nation state, usually there’s an end goal and a mission. So it’s little bit different than like, you know, the criminals that are out there just trying to make a buck and, you know, make money off of the situation. Well with state actors, they they have a very defined goal. it’s their mission. And so understanding that if you are potentially going to be in the crosshairs of one of those missions is important.

 

And so if you think about like a big retailer, maybe there’s a retailer that provides lots of groceries to the average US citizen, for example. disrupting that supply chain, disrupting the transportation and logistics systems that delivers food to the marketplace, for example, would be a really great attack vector for a a nation state to disrupt, you know, the ability for people to get food. And as we know,

 

psychologically people get very scared, they get fearful, they start to act, you know, unusual when those type of events occur. And so those are the type of things I would be looking for. is anything that’s meant to just create chaos and the food supply, the water supply, like we talked about earlier, electrical grids, things like that, those are all legitimate targets. And you know, even something as simple as shipping that’s transporting goods across the ocean is also another attack vector.

 

because you can disrupt, you know, critical supplies going to an island or something like that. So there’s a number of ways that these attacks could be carried off to create chaos for for individuals.

 

Shawn Cordner (11:51.852)

Yeah, you we’re only a week away without electricity or without, you know, food distribution from complete chaos, right? I mean, I I think the the the underpinnings of society starts to crack and fall apart pretty quickly if we’re not delivering food and if we’re not able to you know, power up our devices and go to work and we’re not able to access the things that we need to live. So I could see how they would disrupt that.

 

totally makes sense that these, you know, enterprises need to be elevated in in their concern. But I mean is is there a a is there a big difference between how their defense posture should be thought about, you know, now that we’re in this conflict versus prior to or once it finally cools down?

 

Dustin Larmier (12:39.726)

I don’t think it’s ever changed. So I think the there’s a heightened awareness because there’s a lot more activity and, you know, media buzz going around related to cyber attacks and things that are happening. But I don’t think the risk levels have changed. I think the focus of the attackers has changed and what their aim and end goal would be has changed. And that’ll pivot based on what’s going on geopolitically across the world and the, you know, other factors that may affect, you know, their decision making. So

 

You know, I think it’s more or less, you know, a tactics change based on what the, you know, climate looks like out there.

 

Shawn Cordner (13:15.838)

I’m gonna move past this in a second, but I have just one last question on the topic. there used to be a gap, I presume, between what a nation state could do versus what your average cyber criminal would be able to do. And I I know that historically, let’s say Russia, for example, the lines are very, very blurred between nation state and you know these these smaller actors. but

 

That gap did exist nonetheless. Do you find that AI has now brought kind of the average level of sophistication of the smaller attackers up to the level of nation state, or is there still a big disparity in the tools?

 

Dustin Larmier (13:57.71)

I think as far as technical payloads are concerned, I think they’re getting closer. But as far as methodologies are concerned, you still have to be able to influence AI to your end goal. And nation state actors, this is all they do, right? They’re professionally trained military units. I’m sure they get all kinds of rewards for, you know, completing their campaigns and they’re very incentivized to to have victories there. Yeah. So I’m pretty sure tactics wise they’re more advanced, but

 

Technically speaking, when you’re talking about malware payloads, the ability to break into a network, the ability to craft new novel types of malware, those type of things, I think we’re coming much closer with the advent of AI. But AI itself has introduced a a new risk in that the AI tooling itself can be targeted.

 

So now if you have like an agentic workflow that’s running within your organization, somebody could break and hijack that agenc workflow and use AI to work against you and break into your infrastructure or your systems in a way that’s never really been done before. So it’s a it’s a new threat landscape that we have to look out for and watch for.

 

Shawn Cordner (15:09.748)

And I presume I’m right in saying that the biggest risk that any enterprise has is still its people and not necessarily its technological defenses. Is that right?

 

Dustin Larmier (15:21.43)

Absolutely. You can have the best technology in place. You can have all the tools, the processes, incident response plans, all those things in place. But it one human mistake can impact all of those things. And you find yourself in a reactive posture versus, you know, proactively putting security controls in place. And you know, I refer to it as the layer eight problem. It’s not adequately represented on the OSI model. the the layer eight issue is real.

 

And you know, you’re one click away from an email or one phone call away where somebody has fooled somebody into thinking you’re an IT, for example, and they give out a password, to having somebody potentially try to compromise your network and and cause damage.

 

Shawn Cordner (16:06.574)

for example, the Caesars MGM incident that happened a couple of years ago, right? And that’s a a example of social engineering. And so that that brings us full circle into what I really wanted to talk about today. I definitely didn’t expect to take that diversion into the Middle East there, but I think it’s an interesting topic and one that certainly people need to consider. But social engineering is interesting to me because I just being in marketing and

 

I don’t know, but I’m just interested in human psychology and there this is very much about human psychology. the reason that I wanted to have this conversation with you both is I had met Alicia at an event, an Amplix event, and she was a speaker and she was fantastic. And we had a conversation afterwards at the bar as one does, and we were talking about how she had mentioned in her talk that she had signed up for an experiment.

 

And you didn’t end up getting to do the experiment, right, Alicia? But maybe just tell everyone that story.

 

Alicia Leone (17:13.048)

Yeah, absolutely. So that’s how I ended up falling in love with cybersecurity. I was invited to participate in a social engineering engagement that was part of a pen test exercise that was commissioned by a customer of ours. And the reason why I was selected because was because I was pregnant and who says no to a pregnant woman. And the goal was to get me past the teller. I had a get out of jail free car just in case I got trapped and you know, was just to get as far as I possibly could.

 

I thought it was fascinating and I was like line and sinker from there. Unfortunately for me and for the engagement, my son was born three and a half weeks early. So was I no longer pregnant, I also was out on maternity leave. But I just I loved it. I as a parent, I think about our kids are some of the best social engineers out there. and just watching my kids grow up and see how that morphs and sophisticates as time goes on, and being able to call them out on it when I can.

 

I think that social engineering, I I’m with you, it’s completely fascinating ’cause it does prey upon some of the human conditions that are completely natural to want to be helpful, to respond well to authority, and when there’s some type s type of urgency to respond quickly.

 

Shawn Cordner (18:27.682)

Yeah, there’s so many examples of this in social science and we can, you know, probably talk about them later, but there are plenty of experiments that demonstrate that, you know, people it’s it’s called default to trust, right? So it’s it’s a human cognitive bias and it has evolutionary an evolutionary purpose, which is group cohesion, right? So we evolve to live in groups.

 

Groups at the time were about 150 people, usually no more no more. That’s called Dunbar’s number. And within that group, we relied on each other for survival. And so you really had to be in a position where you trusted the people that you encountered implicitly without having a lot of friction, because your survival really depended on them, versus another dynamic that we see today in in our society and on social media, which is in group outgroup bias, which

 

is basically your bias towards your group versus your biased against other groups, right? So I think those are two things that are really the the aperture which I look at social engineering through, which is that’s why, you know, ca con men that always, you know, that that’s the way that they do things is they they assume that you’re gonna give them trust. You will give them trust. And so you’re not gonna be on the defenses when they start

 

asking you questions or when they start manipulating you, right? You’re just not looking for it. so how do you see this showing up in the cybersecurity landscape?

 

Dustin Larmier (20:05.934)

Sure. So you know, from an in person like from a actual person who’s being targeted standpoint, this is why trust but verify is so important. That goes back to one of the biggest security principles ever, trust but verify. when you’re working with somebody. So even if it’s somebody that you inherently trust, you need to verify whether or not their intent is legitimately, you know, good intent or bad intent. And threat actors love to play on the motions.

 

That is that is their tactic. So, you know, the common example of an executive assistant for an executive gets a text message, and that text message appears to be from their executive that they report to that says, I need you to take care of this now. This is urgent, wire money to so and so location, get on this now. Your your human instinct as somebody who’s in that position is to say,

 

You know, I need to take care of this right away. This is someone in authority asking me to take this action. So immediately your your emotions start to actually overcome your ability to make rational decisions. And a lot of the times when we see these social engineering attacks occurring, it’s it’s a play on emotions. It’s a play on fear. It’s a play on

 

you know, your your position, how can we exert power over you to make you not necessarily dig in too deeply to understand is this a legitimate intent? Is there any red flags associated with it? And human nature is one of, I need to get on this right now. Right. And I think that that’s one big tactic they play on. The other part is, you know, we’re somewhat trained to recognize certain roles that reach out to us in in a business. So for example, an IT person.

 

An IT person calls you on the phone and says, Hey, you know, we noticed an issue with your system. We need to get some more information from you. And your immediate reaction is typically going to be, this is a trusted individual. And then you engage in that conversation. They start subtly asking you questions that aren’t immediately a huge red flag, but they’re using those little indicators to build up the case that they need in order to leverage a larger attack campaign. And ultimately

 

Dustin Larmier (22:25.708)

work their way not only to total trust, but to, you know, and having that user actually expose all of that data that they’re looking for, whether it be a username, a password, or some information about a system, an IP address and whatever. So it it is something that threat actors leverage a lot is the concept of trust and working their way through individuals based on role. think back to

 

Tools like Maltigo, right? The entire concept of Maltigo is to build up a tech campaign from a social engineering perspective, plug in all these different data points, and essentially project manage your way to an end result of compromising an organization. And it’s it and it’s actually amazing at what it can do. And a skilled threat actor is essentially using these conversations, these trusted roles and working their way through these individuals, knowing

 

the LinkedIn connections, knowing who works with who, all these different data points and piecing that together in such a way where they can leverage a very effective attack against an organization and ultimately, get the keys to the kingdom of whatever aim it is that they’re trying to reach.

 

Shawn Cordner (23:35.918)

It’s a perfect example, right? Because it’s the default to trust in action, right? We just assume the best in people, but also it’s the in-group, out group. That person is reaching out to me from my IT team. I feel safe. I feel that’s a trusted individual because it appears to be someone that’s on my side, on my team, right? But I because I default to trust, I’m not gonna dig a little deeper and double check.

 

that it’s actually someone from my IT team. I’m not gonna pull up the org chart or, you know, validate it in any sort of way. And then you’re right, you know, adding some of the the pressure of it being someone that’s above you or there being some sort of time constraint or urgency that needs to be addressed. These are all factors that that play into it. Alicia, you do you see the same thing when you’re dealing with your clients?

 

Alicia Leone (24:25.878)

Yeah, absolutely. I was gonna say some examples. I I think IT is a perfect because that’s that can be really challenging. I’ve seen examples where it’s IT calling the end user and asking them to accept the MFA push request because they need to make a change on the machine. That’s very, very common. And sometimes even within like they say MFA fatigue, so if the attacker sends enough push messages to you, you finally hit the accept button just to make the person go away.

 

I can think I actually work for a company where that happens. And it was I remember being there as a large company and getting the email that we needed to do a password reset and being really surprised because I knew really well how they manage credentials and things of that nature. And then when we were asked to do a second password reset another week a week later, I was like, Okay, this is definitely something bad. other things too that I think are also equally challenging for organizations themselves.

 

is someone calling into IT and use MFA again and saying, I’m I don’t have my phone with me. I can’t I don’t have a second way to verify or have a new phone that I haven’t downloaded the MFA app on it and I need access to this critical system. If it’s compromised credentials, like how do you you basically normally what most companies do is they’ll give the the person a temporary code to use. And then that that threat actor is in and they’re high fiving their friends next to them. So

 

I think it’s it’s it’s it’s interesting. I think that’s there’s a story that I read about from a group a threat actor group called Silent Ransom Group, or they’re also known as Lunamoth, and they target the legal industry. And what made me giggle and it probably shouldn’t have giggled was the fact that, you know, with everyone being remote, people going into an office to perform a social engineering attack felt like

 

twenty twelve to me, or ad even like two thousand and eight. Like like who does that anymore, right? but where they’re targeting law firms and the way that they’re doing is they’re actually walking in and pretending like they’re IT with USB drives that they then plug into laptops and, you know, exfil data from it. Or then there’s also the the calling in and pretending like they’re IT and doing R VP. But the the fact that they actually go physically down at the

 

Alicia Leone (26:48.36)

on the location, ’cause it’s common for law firms to have an IT guy that’s actually a a company. and that being a successful attack vector, I just like I had to shake my head. Like I like I feel like, you know, we’ve gone like back inside.

 

Shawn Cordner (27:03.746)

It it’s shocking what you can get away with if you just act like you belong. Like I just this past weekend, my girlfriend and I were in Asbury Park, New Jersey. There’s a new restaurant that’s opening up and it’s like this big fancy restaurant and all these, you know, wealthy people are gonna be going there. And we decided just to pop in and we got to the front door and and the guy asked if we had reservations, and I said no, and I just kinda talked my way through and he said, Well

 

I was told not to let anyone in that doesn’t have reservations, but somehow I sweet talked my way past this guy. I got in. I had the same confrontation with the people at the you know, where you check in. I don’t know why I’m blanking on the name of that role there, but the the hostess stand. And so I’m talking to the the hostess and I talk my way past her and just to come to find out, we I didn’t know. I didn’t like I wasn’t trying to do something I shouldn’t do, but it turns out that this was a

 

private friends and family night. So everyone in there intimately knew the owners of the place and intimately knew each other. And we spent almost, you know, three hours there before we found out that we didn’t belong. And it was just because we acted like we belonged there.

 

Alicia Leone (28:14.656)

Yeah. That acts as if that’s helped me get into some New York nightclubs over the course of my life.

 

Shawn Cordner (28:20.184)

Alicia, there was something that you said that I wanted to circle back to, which was you called it MFA fatigue, but I think in a broader sense, there’s just security defenses fatigue, right? There’s so many different layers of authentication and passwords you have to remember and complexity around passwords and there’s no unification of these platforms. So there’s a different way to verify yourself for every different application that you’re using in a business environment.

 

I know SSO is supposed to solve some of that, but it it certainly doesn’t. Like we have single sign on, but I still have, you know, ten different applications that aren’t a s a part of that that I have to remember how to get into and I have different methods. So wait, what is the cost to businesses in terms of productivity and just introducing friction, but but also in terms of that fatigue and and maybe people’s defenses start to get lower over time?

 

Alicia Leone (29:14.518)

Yeah, so it’s interesting that you say that. There’s a flip side to that. I understand you know working at Cisco as a dual SME, like we that was one of the biggest pushbacks. Like we want to roll out d zero trust, we wanna deploy zero trust and you know, have everything behind SSO. We know we need to MFA more frequently, not just like, okay, we dump a c cert on the laptop or the workstation and every time you use that workstation you’re known and and trusted.

 

Which is kind of crazy, but where there was like the user experience was so much of a factor in the decision as far as how the co how far the company was gonna go within their zero trust program, that fast forward to today, where you’ve got things like AI and what’s you know, the the doors that AI unintentionally opens within organizations.

 

you’ve got, you know, with zero trust, the least privilege, many organizations give their employees access to way too much and without even realizing the ramifications. Now, if you start working with a frontier model that you’re allowed to have access to SharePoint and other systems internally, if that gets compromised, that threat actor has access to a whole wealth of information that they never should very easily. So even though it does get frustrating with

 

having to MFA, I actually think that we kn might need to do that more often. I think that those zero trust projects that we’re pr they press pause on need to be revisited because we’re better off or customers are better off from a threat detection I’m sorry for threat protection perspective by really locking down and hardening their environment to include lease trust privileges as well as as well as making sure

 

The validate that that person is truly who they say they are, not something that’s beyond just the username and password, which can get compromised really easily. I’ve got another story about a company where the end users c credentials were compromised and for where the actually the point of first infiltration for the bat Fed actor was Google Chrome. So the employee had cashed their work.

 

Alicia Leone (31:34.126)

credentials in Google Chrome, which is another common thing that happens. The Google account was compromised because it was a a repurposed password. So then every time they did a password resess for the passwords after the the enterprise realized that they had been compromised, the threat actors still could get back in. So I I think that we just live in a world of password and MFA complexity. I wish that there would be one company that was like the standard, the universal standard.

 

for MFA so you didn’t have multiple authenticators, but you know, the that obviously is improbable.

 

Shawn Cordner (32:10.734)

That’s scary. hang on, I need to go change a password on

 

Alicia Leone (32:14.846)

Yeah. Exactly. It’s only that it only takes one time where you repurpose the password and then that you know, if that system gets compromised, you’re like, Well, how many times have I used that password over and over again? Even though I’ve been told not to, but I have a running list of a hundred passwords for the different systems that I have.

 

Shawn Cordner (32:36.31)

Yeah, the truth is my my Gmail account that I attach to work stuff because, you know, being in the marketing department, Google has a lot of marketing tools that we use, like Google Analytics, for example. And the best way to do that is to have a a Gmail account that’s associated with the business. It’s just a little smoother. so that one has a completely different password. I don’t reuse that. It’s a you know, it’s a solid password, strong password, but

 

In my personal life, I’m probably not as diligent and I definitely have some notifications from Apple that I’ve got passwords that are exposed in a data breach that I haven’t gone in and updated. So I I’m bad and I’m I’m gonna admit just how bad I am. you know, I’m no cybersecurity expert. Anyone listening to this can tell that I’m I’m just a marketing dude that’s trying to have a good conversation with smart, interesting people about topics that are relevant to our audience.

 

but I you know, I know more than your average bear, right? Like I’m exposed to this stuff quite a bit. And I speak to experts like yourselves quite a bit, and I know there are things I shouldn’t shouldn’t do. but I I fell for one of our company’s fishing attempts that they send out to test us. And the reason that I fell for it was number one, I opened the email on my phone. I was not in work mode, I was in personal life mode, and I just happened to check

 

my email for something else. And so I wasn’t my defenses weren’t up, right? Number two is the email came from my boss. So that’s authority. He’s also someone that I trust, right? And he sent it with urgency. And it just said, hey, I need you to take a look at the meeting notes right away. I’m like, what meeting notes? Did I miss a meeting? Shit. So of course

 

I click on the meeting notes and then I get the email two minutes later, you fell for the phishing thing, and then you you get tortured having to watch the 20 minute video about why you shouldn’t fall for phishing attempts, right? So so if I’m doing it, your average employee is definitely going to fall for stuff. And I’m not saying that I’m perfect by any means, but like I said, I think I’m a little bit more aware than anybody else. So it how do you train this out of your employees? Like

 

Shawn Cordner (34:59.384)

How do you how do you design for that particular instance where someone’s distracted, someone’s not paying attention, someone’s out of their normal routine, their defenses aren’t up, and they they slip one through?

 

Alicia Leone (35:12.43)

Yeah, so you’re asking how you secure layer eight, basically. It’s a great dusting question.

 

Shawn Cordner (35:15.454)

Yes, how do you secure a layer eight?

 

Dustin Larmier (35:19.562)

Well yeah, I mean there there’s the the obvious part of it, which is training, you know, your employees as best as you possibly can. And you know, to a to a point, you know, you could get training fatigue as well. If they hear it every day, you know, then they’re like, Okay, I’m not really paying attention anymore. So you got that aspect of it. The other part too is putting systems in place that, you know, will go a little bit deeper and inspecting something like an email. so, you know, for example

 

having the URLs sandboxed and analyzed and it you know evaluated for threats before they ever land into a user’s inbox. You know, there’s some stuff you can do from an infrastructure standpoint that lessens the risk, but it never eliminates the risk. So at the end of the day, the it all goes back to that layer eight issue of, you know, the human who actually makes the decision whether or not to click the link. And all you can do is really try to drive home that, you know, you need to look very carefully.

 

If you’re gonna look at a a work email. And you know, there’s the personal life stuff too, but specifically for work, it’s a different scope, a different level of risk versus kind of your personal email. if it looks funny or it feels funny, or there’s something that’s not quite right, don’t even click it, right? Don’t you have always second guess what you receive because there’s a possibility that something does slip through the defensive perimeter, no matter how great your security is.

 

And if you do make the mistake, which is going to happen, it’s you know, there are it’s almost impossible not to have users make mistakes. I mean, we’re human beings, right? We’re we’re just programmed inherently to make mistakes. If you do make a mistake, report it quickly, let people know quickly so that way they can take action before it becomes a bigger problem. That’s the other part is

 

you know, education on what the threat is, but also education on the incident response process within your organization where if you did make a mistake, own it and escalate it immediately. If you sit on it and you try to be embarrassed about it, it’s just gonna create more problems. It’s better to just be open, honest. most organizations will appreciate that and also

 

Dustin Larmier (37:34.936)

The security teams that are investigating will appreciate that because now they can get ahead of the threat before it actually starts to become a a larger scale problem.

 

Shawn Cordner (37:43.982)

Yeah. I in my defense, I realized it immediately as soon as I clicked on that file. I was like, What did I just do? And then I reached out to IT, I hit the report fishing button in Outlook, and then I also messaged everyone that’s it, you know, on my team, my the other go to market leaders to let them know that they’re I just got something that I suspected to be fishing, you know, from Adam, our boss. So i

 

I failed but maybe I also succeeded in in some way and and also in my defense I will say it was sent from an Amplix domain. So felt like that was a little bit safe, but I guess that’s not the case either.

 

Dustin Larmier (38:25.442)

It’s also very hard to look at the contents of a URL from a phone. Right. So I feel like if you’re going to make a mistake, more than likely it’s going to happen on your phone versus your desktop computer where you can hover over the link and kind of take a look at it more closely. You can pull up the email headers if you know how to do that in your email client and you can actually look at the full life cycle of the mail message. if you’re familiar with how to do that. But on the phone, it’s a little easier for you to kind of get stuck with those type of attacks because you know.

 

Those techniques, those capabilities aren’t easily accessible.

 

Shawn Cordner (38:59.15)

I mean the the phone’s a a big weak weak point as well in defenses and so is the person attached to the phone for that matter. maybe maybe businesses need to start to think about the trade offs between productivity and cybersecurity about how much they let people do from their phones. Yeah. I mean, is anyone, you know, thinking about that paradigm of maybe we need to be less technologically enabled to reduce the footprint?

 

Dustin Larmier (39:28.93)

I I feel like it’s going the other way. I feel like businesses are driving more and more into the phone, into the mobile world. Yeah. And you know, by by virtue of the world kind of become powered by SaaS platforms and apps and things like that, it’s actually doubling down on the adoption of of mobile usage, I believe. And you know, I I I see a world potentially where thin clients become even more common, because a lot of the applications are running up in the cloud or

 

you know, something like that. So I do think that mobile phones, you know, are a a really bad threat vector for organizations. And, you know, they have platforms out there like MDM and other things where you can put additional controls in place. But most organizations don’t have them because they’re complex and they’re also you require expertise to administrate. And so I think that slows down the adoption of some of the security platforms that you can put on mobile devices. And then you got the challenge of

 

you know, bring your own device policies where, you know, somebody brings their own device, they tie it in. over time, I I’ve seen like, you know, Microsoft, for example, introduce some really cool security capabilities into, you know, how you’re hooked into exchange and things like that that help lessen risk. But overall, I still think mobile phones are something where, you know, you really have to pay attention to what your end users are doing and

 

and evaluate security controls and I think there’s a lot of room for improvement with mobile devices to be quite transparent.

 

Shawn Cordner (41:00.578)

Yeah. I mean we have an DM solution and it didn’t stop me from being stupid. So clearly we need to work on that a little bit. me being stupid and the technology.

 

Alicia Leone (41:14.214)

It happens. I think having the no-shame policy for reporting is really important too. And making sure that people understand that there’s no shaming to be done thereafter. In fact, you know, like you get a high five for doing it. Other areas where I see bad actors taking advantage of social media information that as a seller is a helpful tool for me, but every time I find this on LinkedIn, I always gasp.

 

So in many cases, and I’m surprised employers don’t have a method for scanning their employees’ LinkedIn profiles to see what’s disclosed in those profiles. So there are times where people will build out their whole resume to include all the projects that they’ve been working on and all the security tools that they are currently administrating and implementing. And you basically have someone who has drawn out the environments for a threat actor.

 

to take advantage of and I’m blown away. Like as a seller, then I could say, well, you know, here’s how we could leverage this in a conversation. But at the same time, like I’m kind of social engineering my way into a call. so I I I’m not sure why this isn’t something that people discuss more of, including like as part of you know, your security awareness trading to say, hey, don’t talk about the security tooling or aspects of our infrastructure.

 

that, you know, in a a a great depth of deep of detail. you know, you don’t have to you can kinda summarize what you’re doing high level. and so yeah, I I think about it every time I go and try to strategically help my sellers find ways to have conversations about security.

 

Shawn Cordner (42:57.282)

Yeah, I think there’s two things to pick apart there. One is

 

kind of think of it like sonar, right? So sonar sends a ping out and it bounces off of something and it sends that ping back and it’s received. And the process of continually doing that paints a picture. It paints picture of something or like echolocation, right? It’s it’s you’re you’re sending something out, bounces back and and that is telling you what the landscape looks like. It’s the same thing with how they’re building maps of networks is they’re they’re

 

They’re not doing it all at once. This is something that’s done over time. It’s done in in discrete tasks, but they they start to build a picture. And then the the other thing to tease apart from this, but obviously is connected, is the availability of data. We put tons of data out there. So you’re talking about disclosing what defenses might be in there. And that seems obvious to me, but like we for example, like we do a lot of cybersecurity work. We have a whole cybersecurity practice, but we

 

When we do case studies, we don’t disclose the names because we don’t want n nobody wants any information being leaked out about what their defenses are because that’s a starting point. That’s a ping. That starts that’s just one more piece of the picture that they need in order to be able to beat those defenses. And but we willingly put our personal information out there. We put work information out there. We’re on a work trip. We’re here doing this, we’re going to this event. and and

 

There’s data brokers out there that have all sorts of information about us, behavioral data and demographic data and technographic data. from a a technology perspective at least. And then you have, you know, dark web data, stuff that’s been stolen in in data leaks and hacks and and ransomware attacks that have been released. And so it the combination of these three things is

 

Shawn Cordner (44:59.106)

That’s how they’re painting the picture. That’s the sonar, right?

 

Alicia Leone (45:03.758)

I agree. Yeah. I mean, how many times have you opened Chrome to search for something that you were just talking to your significant other about and you’re like, how did a prompt so easily for this?

 

Dustin Larmier (45:15.362)

Yeah, you actually struck a co chord with me as well. So when we were thinking about all this information being gathered and talking about sales and all of this, one of the things that I’ve I’ve personally had happen to me is CRM attacks, where, you know, I was engaged in a sales process, the CRM got attacked, and next thing you know, all kinds of details about you know, me as an individual that a salesperson collected actually ended up in the dark web and then accessible. So they got a profile on me.

 

And you know, it happens to everyone, right? Not just your average end user, cybersecurity people get targeted as well. And I’ve had advanced attacks from social engineering style attacks actually leveraged towards me on my mobile phone. there was one particular instance where a actual threat actor group discovered that I was doing business with an entity and literally attacked me because of it. And that kind of thing is is very real. And so

 

As much as the end users have to be vigilant, we have to be vigilant as well because we’re equally as targeted, if not sometimes more targeted, depending on different factors that are going on out there in the cybersecurity landscape.

 

Shawn Cordner (46:26.722)

Yeah, that’s a great point. I mean, any any business that’s doing business, you know, in a B2B environment, they’re collecting data on that business. In the technology space, you’re you’re getting an inventory of their infrastructure and you know what solutions that they have in place. And I mean that that data is usable. It’s actionable. Mm-hmm. there there’s a guy that I follow on Instagram, he’s a a Somalier at Guise Savoie in Las Vegas.

 

And I’d shared with Dustin. I’m I’m I’m a wino. I I’ve been drinking a lot of champagne because I I I pronounced instead of I pronounced his name instead of Armir Lamier, because that is my my French wine proclivities showing up in in my bias. But anyway, so this guy he shared a post today about how he got attacked. It was a cyber attack.

 

And it was social engineering and and the premise was podcasts. So this is a guy that’s got a pretty big following, but not huge. He’s obviously trying to build up that following. He wants to get more exposure. This is how he makes his money in addition to his job, right? And and they prayed on that. They prayed on his ego. They pretended to be a podcast and they reached out to him about how much they wanted to have him on, and all these people are gonna listen to it. And they had the planning meeting and they were going through it, and then they had a a technical check.

 

And in the technical check, they made him click a link and go to a website and then download an extension and then kick you know use that extension to do something and then log into your Facebook. And then he explained the whole process and sure enough, he fell for it and it was a ransomware attack. And then on top of that, he had another one that was even more sophisticated where they took an actual real podcast that really might reach out to a guy like this to have him on as a guest.

 

And they they pretended to be the real people that are involved in that podcast. So like they went on LinkedIn, find out who’s the podcast producer, and then they created accounts that made it look like that. They got a domain name that’s really, really close to the one that the real podcasts use, right? They had real podcast assets that they sent that were branded for this podcast. I mean, that is super sophisticated. And I I think this is a good time to make the turn towards AI because something like that.

 

Shawn Cordner (48:49.696)

is a level of sophistication that I think in the past would have made it difficult to scale. But now it’s really easy to do that and it’s really easy to scale that. So how has AI changed social engineering as a risk?

 

Dustin Larmier (49:04.866)

Woof, that’s a big one. in so many different ways. So you know, you can take a a POC of an attack and you can run it through AI and validate it. there, you know, just to start, the advent of AI has introduced a whole bunch of really crazy variables into how you manage attack surface landscapes, how you actually

 

handle security investigations and also the the the techniques that the threat actors are using. So take for example a phishing campaign you can use AI now to respond to emails right you use the right platform and AI can respond to emails on your behalf. If you’re using obliterated models or unfiltered models, you can actually use models that have no guardrails and you can feed those models through RAG all kinds of information about

 

what you want them to do or how you influence them. And you know, I I have a open claw deployment that I I play around with in my home lab and I refer to it as evil claw. And it’s kind of a joke because I’ve kind of manipulated it to be a threat actor. And I use it for different threat simulations and different attack simulations where I’m trying to test things like you know, signatures for a sim or if I’m trying to, you know, come up with some novel attacks.

 

But something like that could easily be tied into an automated workflow where if you’re engaged with an end user and they ask a question, it can provide an intelligent response. And that intelligent response can continue down the rabbit hole to the point where they really feel like they’re talking to a person, but the person really is a trained model that is doing malicious things and working to to gather information. So I think we’re gonna see a lot more of that coming out of the woodwork.

 

The other thing too is correcting language, grammar problems, things like that. Things we use these tools for that make them wonderful, but threat actors are equally as active with them. So, you know, basic language skills, you know, you can have those or or maybe not even the greatest language skills, and it can improve your ability to communicate exponentially. that’s another one. And and then obviously there’s like this concept of, you know.

 

Dustin Larmier (51:28.32)

chats and and things like that, chat bots, other things that could potentially be manipulated or intercepted. somebody could go to a chat bot and maybe somebody’s actually compromised the web app and, you know, kind of put their own flavor of AI communication back into that chat bot so that conversation could be manipulated. And with chat and with AI, a lot of it is driven by the the prompt. And the prompt is how does this respond?

 

So when you think about that attack campaign you mentioned earlier about that poor person who is targeted on so many levels, AI, you can actually use the chat prompt to manipulate how those conversations take place and the different data points that they gather. And with tools, which is another fun thing that’s, you know, being heavily adopted in the AI landscape, you can actually go out and fetch this data for you.

 

Bring it into your AI platform and help AI plan out a cyber attack for you. So for example, with an open claustyle deployment, you can actually configure a an HTTP tool that goes out and fetches results from a search engine or from a blog or from RSS feeds, all kinds of different data sources. You can pull that in and then have that gather information that you need in order to ask your your AI.

 

To help you formulate a more advanced strategy on how to compromise an organization. And I actually have been doing some red team exercises directly towards our own organization using AI as part of a, you know, kind of like a pen test routine. And you know, it comes up with some very creative ways to go about attacking our organization when you feed it data points about the organization itself. You pull in additional data sources. So it it does.

 

add a layer of complexity now where you know AI is doing a lot of what would traditionally be deep level research and you know work that you would do as an independent threat actor. Now it’s just making it super simple and it does a lot of the heavy lifting for you. So you can actually focus more on strategy and not necessarily content of the attack. And it is really changed things quite a bit. And I think it’s gonna get exponentially worse.

 

Dustin Larmier (53:44.808)

as the tools continue to develop.

 

Alicia Leone (53:47.79)

And you also see Dustin that it also increases the scale in which the threat actors can launch attacks too, because I know that you know historically working with companies, let’s say, I don’t know, eight years ago, there was a point in time where an organization could say, I really I’m not going to be a target of an attacker. Like it’s too much work and the the juice isn’t worth the squeeze essentially, just because the time it would take to do to, you know, do the reconnaissance and to develop the attack trap.

 

tactic and pathway and do all of the strategy. But now when it can be done via AI and at mass, then it’s just a matter of the AI doing the reconnaissance and then assisting with building and launching the attack and seeing what actually makes its way through. And anyone can be a target because it’s all being automated.

 

Dustin Larmier (54:36.558)

Yeah, and the personas aspect of AI is also an interesting thing. So when you build out a prompt and you’re, you know, trying to use AI to formulate an attack strategy or to to build something for you, like a campaign, you can actually use personas to have multiple points of view in that AI discussion. So you could, you know, be the the bad guy, but then also have the help desk agent that maybe you’re targeting as part of that prompt.

 

And you can actually use AI to essentially model communications that would happen between a legitimate source and a threat actor and actually kind of plan that out. So it’s pr it’s pretty crazy like that.

 

Shawn Cordner (55:17.654)

It so I’ve noticed that the Nigerian prince that I’ve been talking to has his English has better over time. And I thought maybe he just got into you know, adult learning or something. But I mean that’s a that’s a a a funny but like real example, I think, where the Nigerian Prince scam, they would often intentionally use broken English because they’re sending out an email blast to many, many people, and that was kind of a filter.

 

So the more gullible people, or at least the people that their defenses weren’t up as high, were the ones that would respond even though a prince was using broken English with them and making silly mistakes. and that’s because they only had so much bandwidth to respond, right? But now with AI, they can engage with every single person that responds. So they don’t have to filter, they don’t have to be as selective, right? Because they’re not doing the work. It’s just the the scale is infinite with AI.

 

Dustin Larmier (56:17.248)

It really is. And you know, people can run AI on their desktop, right? So you can use a a platform like LM Studio or maybe you have a Linux device and you use OLAMA. There’s open source tools and freely available tools now too, where you don’t have to rely on things like Chat GPT, which you know, Chat GPT, Cloud Code, all those have safety guardrails in place where, you know, it won’t allow you to ask certain questions without

 

you know, trying to do a prompt manipulation or injection to try to bypass the security. Whereas these local models, you don’t have any of that. You find the right model that you want to use. And there are models that specialize on hacking techniques, red teaming techniques, you know, unfiltered models where literally you can ask it anything and it’ll give you a response. So the power of AI and the ability to misuse it, it it’s a it it’s it’s becoming

 

more prevalent in the advent of moving AI more closer to the user, which if you’ve heard it, you know, in the news lately, yeah, you’ve talked heard about these systems like I think the NVIDIA CEO, for example, mentioned that they’re trying to push AI directly into user laptops and have AI there locally and a lot of that processing happening on the devices themselves.

 

that introduces a whole nother level to this because the threat actors are gonna do the same thing. They’re gonna use that local AI capability to do all kinds of of bad things with it.

 

Shawn Cordner (57:44.876)

Yeah, two years ago we had a an Amplix event and the topic was cybersecurity. We had a a guy, Adam Winston, come on and everyone else had PowerPoints, but not Adam. He just pulls up his his computer and he star he goes to ChatGPT and he he talked his way past its defenses and got it to write ransomware code right in front of everybody. got it to give them the recipe for meth, like all all this crazy stuff. And

 

I know that’s two years ago and they probably tightened it up, but I mean the ease with which he was able to bypass the security was it it was really scary. Everyone left that room kind of shaking their head like, wow, we’re we’re in trouble. and it’s only gotten worse. And I you know, I think you mentioned it like so w you know, we talked about the the big data sets that are available on people, right? So AI makes that those big data sets more important. It’s it’s leverage, it’s something that

 

you know, the AI can use to highly personalize things, highly engage, find white space or find, you know, weaknesses that they can exploit, right? And this is all happening without a a human being. And then you’ve got like data poisoning and and prompt injection attacks where, you know, someone could conceivably get into an enterprise’s chatbot like you were talking about before.

 

And start taking advantage of of customers that are engaging with it and that trust that chatbot because it’s it’s got the brand’s logo and it’s embedded in their website, right? So it’s it’s getting to be scary and I just I don’t know how I don’t know how people, consumers but also employees at enterprises, I just don’t know how people are gonna be able to navigate this. And in six months, a year, it’s you know, we’re gonna be that that’s like

 

Ten years in AI land, right? So what’s it gonna look like? How hard is it gonna be? Like you you’ve got deep fakes, voice and video now. I mean, we we get what we do a lot of acquisitions, and every time we acquire a company, we have to warn their employees, they’re gonna start getting text messages from you know bad actors that are pretending to be our CEO asking for gift cards.

 

Shawn Cordner (01:00:03.296)

I I mean it’s it’s just every single time it happens. most people are not gonna fall for that at this point, but you know, what what if they spoof Dan’s number? What if they f make a phone call and it sounds like Dan? Because Dan’s on you know, there’s video of Dan out there online, right? He’s been on this podcast. you could easily fake Dan’s voice and spoof his number and call somebody and ask them to make a wire transfer. How do you deal with this?

 

Dustin Larmier (01:00:33.1)

Yeah, it’s it’s it’s all about fingerprinting technology. So there’s a lot of companies, or at least not maybe not a lot, but there’s a few companies out there that are on the cutting edge of being able to detect AI manipulation, especially as it pertains to images and videos and deep fake detection and things like that. So

 

Where I see our where I see ourselves going is having to rely on more of those technologies to give us a validated fingerprint. Is this really our CEO or is this video legitimate? And, you know, it it it’s it’s a much bigger issue even than just what’s going on in an organization, right? This is a a national security problem because, you know, for going back to the nation state actors, they are working aggressively on doing these campaigns with deep fakes and everything to influence everything from

 

popular opinion to, you know, creating divisiveness and all kinds of problems. So it’s it’s a very deep problem that you know, it’s kind of the Wild West out there. And there’s, you know, it’s really up to the individual person to figure out w if they believe it or not, which, you know, being going back to the layer eight problem again, right? We have biases, we have ways that we interpret data.

 

And so it’s easy to fall prey to some of these fake campaigns that are out there. And much in the same way when you’re in business, if you saw a video from your CEO or or some executive saying something that just never happened or wasn’t true, it can just create chaos and, you know, fear and all kinds of other things. So I think we live in a day and age now where educating the the end user that it’s okay to question something. It’s okay to not necessarily believe what you see.

 

and validate. I think that’s key because there is a lot of fake stuff out there now. And AI continues to to build on that and generate more and more fake content and it encompasses every part of our life. And it’s just gonna continue to skyrocket in popularity. And I think these fingerprinting technologies are going to become

 

Dustin Larmier (01:02:42.822)

I I would probably invest in them because I think they’re going to become very critical to protecting us from these type of threats in the future. And many different platforms and software stacks and and and things like that are going to need to adopt them at some point.

 

Shawn Cordner (01:03:01.356)

You had mentioned before one of the best lines of defense is training, right? But everyone makes fun of these security training modules because they’re they’re goofy. I mean, let’s be honest, right? They’re like the ninth grade health class video on, you know, sex ed and it’s just awkward and and weird and I don’t know. Everyone makes fun of it. And people don’t maybe don’t take it as seriously as they should. I I do think that the point

 

gets driven home like we the day that I got that fooled, I started getting emails from a bunch of people that, you know, are are in my organization and at attached to my organization saying, Did you send me this email? So everyone was or a bunch of people were getting them. I’m the only idiot that fell for it apparently because everyone else was checking. My mom will text me all the time, is this legit? This doesn’t seem you know, so like awareness is up, but I don’t know if

 

Vigilance is necessarily up. Like you can’t keep vigilant constantly. Like that’s actually the definition of PTSD, right? So you’re not always going to be able to be vigilant. So I think there’s a human capacity that once you exceed that, you’re just your your attention span, your discipline, whatever, it it starts to wing.

 

Dustin Larmier (01:04:23.416)

Yeah, I I agree. I think we live in a world where sensory overload is real. I mean, we’re constantly surrounded with information, constantly noise, sights, sounds. I mean, the the world is so fast, everything is, you know, buzzing around us. And you know, then we’re having to be hyper vigilant. It it it results in fatigue, right? I mean, that’s really what it what it does. So you end up getting fatigued and now you’re tired.

 

And you let your guard down, maybe you have a glass of wine, you know, and next thing you know, you accidentally find yourself in in hot water. So it it is a real problem. kind of like, you know, security operations will have issues with alert fatigue. It’s the same thing for the end user. They’re the, you know, vigilance fatigue and constantly being on alert, making sure they’re not making a mistake or clicking that wrong thing. And, you know, humans are are just gonna make mistakes. I mean, that it it’s just it’s part of who we are and

 

staying in hypervigilant state when you finally kind of come down from that and you’re going to make a mistake. It’s it’s inevitable. So I think that is a very real problem. I don’t know that there’s a really great answer out there to to being in this constant state of hypervigilance, but I do believe the security technologies and the different things that are coming out there in the industry to protect us from these things are slowly kind of catching up to this.

 

But I don’t think it’s gonna happen, you know, anytime soon. I think, you know, still it’s gonna heavily depend on people and good decision making to prevent the incident. And then it goes back to kind of what I said earlier. If something does happen, how quickly can you respond? How quickly can you contain it? Having a very solid security program behind you will protect you from those mistakes that people inevitably will make.

 

Shawn Cordner (01:06:12.935)

Well, we’re not gonna stop drinking wine, so

 

Alicia Leone (01:06:18.242)

Yeah, I was actually gonna d circle back. Dustin took the words out of my mouth, particularly with the last part. I mean, you just kind of assume that something’s gonna happen, you know, and really getting good at how quickly can we detect that something and how quickly can we contain and then being able to go through tabletop exercises for when that something’s really big and like how do we respond from there? just being prepared for almost like you have to say at this point in time, the in inevitable.

 

you know, it’s funny and my fiance is in cybersecurity as well, and we trade customer stories every so often without naming the customers. And there’s some customers we talk about where I’m like, the c I kinda think that they just have to assume that they’ve already been breached and they just haven’t you know been it ha they haven’t had a chance to detect it. And i they talk about that as a security principle, just assume the attack has already taken place. which is also like puts you in a hyper vigilant place. But knowing that that is within the realm of possibility and

 

you know, really spending time on research and in terms of like what platforms you could leverage to help with the threat detection and this level of efficacy as well as on the response piece. Like do you have a team that’s capable of responding and to what extent and you know are they people that can be woken up in the middle of the night? these are all really important questions that we’ve been asking for a really long time. So you know how we continue to do that.

 

and doing things like pen testing that include social engineering engagements and the you know, targeting the executives and the IT folks. I think at least the where we’re at right now, just being prepared is kind of the best bet.

 

Shawn Cordner (01:07:55.468)

Yeah, it’s gonna happen. So know how to deal with it and test that your contingency plans are that are gonna work, right? When it when the time comes, it’s not enough to think it’s gonna work. You should probably prove that it’s gonna work. but yeah, I I have two ideas. I’m gonna I’m gonna pitch you both. And then if Tier Point decides to

 

build these solutions out, then I just won twenty percent. So okay, pitch number one is we’re gonna build personal agentic AI assistants that ride along on all of your communications and tell you when you should be cautious about something. Okay. Now I realize the riding along with all your communication stuff is itself a cyber risk, but

 

Alicia Leone (01:08:26.648)

Work for us then thereafter if you

 

Shawn Cordner (01:08:51.461)

that’s that’s my idea number one. Idea number two is user experience design in cybersecurity. So user experience design is a discipline in marketing, it’s how we design user interfaces, we use human psychology to build the principles of user experience design, and then we use the principles of the design process to create journeys that remove friction or insert friction.

 

when it should be there, but it basically is a way to nudge behavior. Okay. I think that we don’t do that in cybersecurity. a an enterprise could, in theory, look at the system of defenses holistically and architect it in a way that removes friction from doing the right th things, inserts friction when you’re about to do the wrong things, and uses human psychology as a way

 

To nudge people through the right processes and procedures that you want them to follow while limiting or removing that discipline fatigue that we’re talking about. What do you guys

 

Alicia Leone (01:10:05.324)

I love it. My first couple of comments are, I mean, when I already know there’s no such thing as privacy, particularly when it comes to work communications. so that whole like the end user feeling like their big brother is watching them, I think we pretty much can assume that that’s taking place anyways. I do I do like it. I think there’s would be some caveats that would need to be wrapped around that. Occasionally you get a personal email that comes into your work email.

 

You’re like, yeah, I said to use my personal email account, but it comes into work anyways. So things like that where that’s like, hey, if it, you know, if it I don’t know how you would even train AI on that to be like disregard. I think that’s here my top my biggest concerns, not necessarily with the assistant, but kind of maybe the second thing is AI is definitely probabilistic versus deterministic. And so bias gets inserted so easily. So

 

You know, I would be concerned about are you suddenly is the organization targeting people, consciously or unconsciously, whether or not it’s been drift as a result of drift or just how it’s been trained. So it’s unintentionally targeting people of a certain profile as being higher risk users when they might not necessarily be that way. It’s just up to interpretation on the AI side of things. Now Dustin will get into the technical pieces.

 

Shawn Cordner (01:11:24.332)

All right. Hold on. Before we go further, Alicia, I’m a I’m I’m the big idea guy, okay? These are details that you guys sort out, all right? Go ahead, Dustin. Read.

 

Alicia Leone (01:11:31.106)

Yeah.

 

Dustin Larmier (01:11:34.726)

No, I I I I think it’s actually a a a brilliant concept. but like every time you build a cool tool to do security things, now you gotta secure the tool that does security things. And so now there’s a propensity for that, like you said, that AI agent that would be on the device to to be attacked or influenced. And what Alicia said is so true. Bias is a really big problem with AI. I have done all kinds of testing with

 

both public models and private models and you will find the biases. And those biases will result in the decision being impacted in such a way that you know that that bias exists. And if you want to see a good example of of AI bias, go generate some images. generate some images and give it some criteria where biases might appear and they will appear. I’ve actually seen it myself.

 

So image generation, you’ll see it most often. if you’re like, you know, at you had a picture of somebody at a party and you’re like, hey, add this to the picture, right? It will take a look at the picture and it will assume what is best to put into that picture. And sometimes it’ll even do things that are offensive that you didn’t even intend it to do because it has a bias on what it believes should be there. So very real concern. but yeah, as far as the tooling is concerned, I think that’s actually a fantastic idea.

 

the main challenge would be is making sure that that environment is, you know, tight and locked down, that it it can’t be manipulated or changed in any way. And oftentimes what we find in cybersecurity is that we have to audit our own security tools. And you know, having that auditability and and watching those audit logs or those audit events to ensure that nobody’s abusing the tool or that the tool is not veering or or off course from where you want it to go. Those are all real concerns.

 

Shawn Cordner (01:13:33.9)

Minor details for smart people like you, just make sure I get the royalty check. So I want to wrap it up here, guys. each of you I’m gonna ask each of you, starting with you Alicia, what is one piece of actionable advice that you would tell technology leaders listening to this podcast right now they should go do to try to limit social engineering risks?

 

Alicia Leone (01:13:59.982)

I think the LinkedIn example is probably the most important one. either through awareness or, you know, sometimes organizations have sales navigator subscriptions at a enterprise level where they can actually see employees’ profiles really easily. But in some manner, at least informational, hey, this is not either create a policy that arounds, hey, we you cannot do this and then let the users make the changes.

 

Or do something of that manner that basically it a cuts back on what the LinkedIn profiles consist of. I I think it’s wild every time I look at a LinkedIn profile when I’m able to to gather and I’m not a threat actor.

 

Shawn Cordner (01:14:46.497)

You could be.

 

Alicia Leone (01:14:47.468)

I could be. It depends on how you look at sales. Some folks look at sales as threat actors. but yeah.

 

Shawn Cordner (01:14:54.998)

But he doesn’t.

 

Dustin Larmier (01:14:56.492)

Mine’s pretty simplistic. It’s trust your gut instincts. a lot of the times we second guess our own gut instincts and we follow through on something and we could have prevented it by trusting in our own gut instincts. And oftentimes if something feels funny or it seems funny, we detect it. But sometimes we just don’t listen to it. So I think listening to your own instincts and if something, you know, doesn’t smell right, it doesn’t feel right, there’s something unusual about it.

 

question it and and and and look into it and don’t assume that everything’s okay. And I think as long as you kind of follow that, that helps a lot in the social engineering world because if all of a sudden you get a random call from IT, I’d question it. If they say something funny, I’d ping my internal help desk team and say, hey, is there really something going on? Like it’s okay to question it and to make sure that what you’re who you’re talking to is legitimate.

 

Or that the questions that they’re asking are legitimate. And I think feeling comfortable and being able to do that and not feel, you know, uneasy about it or worrying about being embarrassed because you’re questioning something that’s happening, I think that’s a good thing. Much like if you had somebody turn on red and blue lights behind you and they were in an unmarked car, your instinct is probably to be to call the police station and say, Hey, is this really a police officer?

 

treat other folks the same way in an internal organization. If an IT person reaches out to you and asks for your password, that should raise a red flag immediately. And I would call in and validate. So just being comfortable with your gut instincts and and and validating and not being ashamed of it.

 

Shawn Cordner (01:16:38.392)

Good advice for cybersecurity and for life. Dustin and Alicia, thank you so much for your time and expertise today. Thank you.

 

Dustin Larmier (01:16:44.483)

Thank you.