Meet the experts who power Synack’s strategic security testing platform. Our Synack Red Team unites over 1,500 of the world’s most skilled and trusted security researchers, who work with patented technology to deliver best-in-class offensive security testing on a continuous basis.
Selena Larson on cyber intelligence, “evil” threat actors and TOAD attacks
Guest:
Selena Larson
Published:
Updated:
Duration:
41 min
Episode summary
In the latest episode of WE’RE IN!, Selena Larson shares insights into malicious hackers and scammers she’s tracking as senior threat intelligence analyst for Proofpoint. Business email compromise, ransomware, sextortion, multi-factor authentication bypass techniques – dealing with the onslaught of modern cyberthreats “is very much like playing whack-a-mole,” she said. By unpacking attackers’ motivations and psychological profiles, defenders can train themselves and their teams to avoid falling into common traps.
More reasons you should listen:
Hear Selena discuss what makes threat intelligence actionable, versus extra noise for a SOC
Find out about an alarming cyber espionage campaign that recently targeted journalists
Nobody can track every threat Selena focuses on targeted cybercrime and relies on public reporting, researchers on Twitter, and information-sharing Slacks. Customers of threat intelligence depend on vendors to prioritize for them.
Journalism is both target and disguise Proofpoint research found APT groups targeting journalists for their nonpublic information, while TA453, also known as Charming Kitten, posed as journalists to approach academics and policy experts.
Benign lures sidestep user training TOAD emails contain no links or attachments, only a phone number, so people trained not to click still call. Other actors start harmless conversations to build trust before sending anything malicious.
Actionable depends on the audience A SOC analyst can block indicators, while a business leader may change where to open an office. Analysts should state the potential impact so readers know why it matters.
Attackers adapt to defenses When Microsoft blocked macros by default, actors began testing new attachment types, which Selena describes as an ecosystem changing in response to its organisms.
Notable quotes
At the end of it, there is a person on the other side of the computer that is experiencing a crappy thing happening to them.
I know it's very much like playing whack a mole…
…the ecosystem changes in response to the organisms that are living in it.
But so often, people don't really know why they need to know something.
Questions this episode answers
What is a TOAD attack?
Telephone-oriented attack delivery uses emails with no malicious links or attachments, only a phone number, often about a charge you did not make. Victims who call are then told to download malware or give remote control of their computer. Read this section
Why do threat actors target or impersonate journalists?
Journalists hold a lot of nonpublic information from sources, which is valuable for intelligence collection. Posing as a journalist is also a compelling persona that gets targets to talk, engage, or click. Read this section
What makes threat intelligence actionable?
Selena says it depends on who receives it: a SOC analyst may block indicators, while a business leader may change a decision based on geopolitical threats. Reports should explain the potential impact to drive decisions. Read this section
How do threat intelligence analysts keep up with new threats?
She says it is impossible to track everything, so she focuses on what she needs for her job and customers, and follows public reporting, researchers on Twitter, and information-sharing Slack groups. Read this section
Is cybersecurity getting better?
Selena believes it is. Events like the Colonial Pipeline ransomware attack raised public awareness, governments are discussing regulation, and more journalists now cover cybersecurity. Read this section
About the guest
Selena Larson is, at the time of recording, a senior threat intelligence analyst at Proofpoint, where she focuses on e-crime and targeted cybercrime. She has a background in cybersecurity and technology journalism and hosts Proofpoint's Discarded podcast. Based in Washington, DC, she volunteers with Achilles International as a guide runner for visually impaired athletes.
WE'RE IN is brought to you by Synack, the premier crowdsourced platform for on demand security expertise. Synack delivers twenty four seven pen testing, intelligence, and vulnerability management from a global network of vetted and trusted researchers. Their work is enhanced by smart technologies to accelerate your critical cybersecurity missions. Synack gives businesses the best chance of finding every vulnerability that matters. Find out more at synack.com. That's synack.com.
So first of all, Selena, it is great to have you here. We're really excited to talk to you. Talking about the Threat Intel community, you once said that being kind is more important than being technically correct. I was wondering if you could sort of unpack that quote, give us a little context, and kind of explain what you mean by that.
Yes. First of all, thank you so much for having me. Stoked to be here. Second of all, great question, and I had forgotten that I said that, so I had to go I had to go search myself on Twitter. I'm like, I I remember tweeting that. So in my opinion, the, threat intelligence and cybersecurity community in general can be very opinionated and often, snippy or maybe not very nice on the Internet, especially when people write something or tweet something that someone disagrees with. In my opinion, as an outsider kind of following these conversations, it creates a very toxic environment if the conversation and interactions aren't really nice. Right? Like, if we're trying to encourage people to come into this community, encourage people to speak up and share information and really recruit and bring in diverse people from different backgrounds with different experience levels, then I think it's really important to cultivate a community of inclusion, of kindness.
And whether or not information is correct or incorrect, there's a way of communicating information, or really just communicating anything in general that is positive and reinforces good vibes in the community. And I just think that, you know, the world in general needs more good vibes, and CTI and cybersecurity overall definitely needs more good vibes. So that was kind of one of my hot takes. I think Katie Nickels had tweeted something like, what are your hot takes? What are your complaints about the CTI community? And mine was like, everyone should just be nice.
I think like I have... Yeah. I have a background in penetration testing. And one of the things that I like, one of the first, I think, lessons that I learned working as a pentester interacting with customers is that like if you are not communicating with like empathy and kindness, no one's going to hear what you're saying. And I think like that quote is really interesting to me because I think it goes beyond just the threat intel community, of course, but it is so important in cybersecurity because we're talking about like, I don't know, sometimes hurtful and difficult conversations. And I think, I don't know, it really spoke to me. I think I read that and was like, Oh, I've I've been there. I've experienced this.
For sure. Yeah, I think you hit on a really important note that empathy is so important, right? Like in the industry that we work on, at the end of this, it doesn't matter what the malware is, who the threat actor is. At the end of it, there is a person on the other side of the computer that is experiencing a crappy thing happening to them. And it's so important to be mindful of that and think about that even as we are focused on malware or TTPs or whatever. But at the end of it, there's always a person.
When you talk about vibes, I do think it's so difficult sometimes in Twitter to reflect that we are all people. I think sometimes people hide behind anonymity and maybe take snipes at each other, and it's a little bit of a difficult platform. That's why, honestly, it's so impressive that you're able to maintain such a positive Twitter presence. One thing that I wanted to pivot into threat intelligence a little bit from Twitter, I feel like it's such an important tool. I've heard that many threat intelligence researchers, often Twitter is the first place where they find out about some new thing happening, whatever it may be. Guess stepping back a sec, I was wondering if you could just help us understand how you keep track of the latest threats. I feel like there are so many different threat actors flying around and names and just vegetable soup of cybersecurity. How do you stay on top of it?
Yes. That is a great question. To be honest, I don't stay on top of everything. It's impossible to. There's so much going on that one human being cannot be an expert on everything. So certainly, in my role at Proofpoint, I'm very focused on e crime, cybercriminal threat actors. And then even within that scope, I'm much more focused on targeted cybercrime. So while we do track, you know, like the researchers and analysts on my team will track, for example, like Qbot, IcedID, Emotet, these large malware families. I try and keep up as best I can. Right? Like, I read public reporting. I follow researchers on Twitter. I'm in a variety of different information sharing Slacks. But it's... It is really a lot to to try and track and take in.
And I think that knowing your limits and understanding, like, what do I need to know to do my job and to inform my customers, then you kind of focus on that and maybe deprioritize the rest. I think it's naive to think that we could keep the pulse on everything. Certainly, you're thinking about it from a customer perspective, right? So if you are a recipient of Threat Intelligence, you kind of rely on whatever vendor or whatever people that you kind of follow to say, hey, you know, this is the stuff that you should care about. We've collected it and prioritized it for you and packaged it in this nice, you know, readable format. But, yeah, there is so much, and it is really hard. And, I'm impressed by people who seem to keep track of every single thing that goes on.
I did want to ask, mentioned a couple of specific names that I think Emotet, Qbot. Do you have any favorite and I'm putting favorite in quotes here because, of course, all of these malicious actors are bad favorite threat groups that you keep tabs on, maybe the most intriguing or the most dangerous or some other thing that I'm not thinking of?
From my own personal perspective, one of my favorite actors is TA2722. This is an actor that regularly spoofs Philippine government entities, whether that's the Department of Health or the customs department, And they send out emails to a small kind of number of entities, but largely focused in East Asia, Europe, North America, lots of manufacturing, food and bev, shipping and logistics. But they are regularly spoofing the Philippines government and they send malware. It's very much commodity malware, right? So it's nothing super tricky. Their TTPs aren't necessarily all that sophisticated. They sometimes switch it up with credential phishing. But I've been tracking this actor for for a bit, and I find them to be very interesting. Another actor that I think is pretty cool is TA558. It's a actor that targets hospitality and hotels, largely Portuguese, Spanish speaking lures.
And they have actually switched up their TTPs a ton, but they always kind of fall back on this theme of, like, reserva and reservations, and I'm trying to change my hotel booking, and I think they're pretty fun. So both of those we've actually published details on through our blog, but I find these kind of oddball targeted cybercrime threat actors to be really fun to track.
Currently, no. I wish. That, like, I'm going through my mind right now, like, what what emails have I, like, just mindlessly clicked related to, upcoming travel, upcoming whatever?
Well, yeah, it's really great. I mean, that's that's why I think it's kind of interesting, like their lures, they have maintained it since 2018, this reserve a theme because it's like, you know, it's it blends in with legitimate traffic. Like, what do, you know, the hospitality industry usually receive, like booking related emails and blend in, you're like, All right, I'm just going to click on this. I expect this to be relevant to my job. But yeah, they're consistent in terms of their rewards, but their TTPs change up quite a bit.
When you say targeted, how targeted are we talking here? This like, should I be worried or is it casting a, you know, thousands of people or just like a couple people that they wanna go after? Does it... I suppose it varies.
Yeah. It really varies, but we're talking like, you know, thousands of messages per campaign. So it isn't necessarily targeted to individuals. Like if we're talking about like APT targeted, that is like, you know, they they tend to be very highly targeted to certain individuals for a specific purpose. But if we're speaking about like industry targeted, like right, like so in a specific industry, they will focus on that as opposed to the very highly targeted, like four or five people type of target.
So you mentioned earlier, like when we were talking about kind of how you stay up to date and that there's an element of, you know, prioritizing things. And I'm wondering how do you balance prioritization in terms of, you know, looking for things that are potentially most harmful or most negatively impactful versus like what we've just been talking about, the things that are most interesting to you or, you know, like what's the magic secret, like, you know, formula for prioritizing things?
I don't think there is a magic secret. So on Threat Research in particular, we're very much told to do stuff that interests us and to kind of follow our noses and follow our guts and find things that are very interesting. Certainly, do have intelligence requirements from whoever your customer base is. Right? So we obviously have to keep the pulse on a lot of the priority threat actors. Right? So if it's Qbot, right, or TA five seventy, certainly the IcedID, the emotets, like the big malware campaigns that we see on a regular basis. Certainly initial access brokers, So you have a lot of very large crime threat actors that are distributing malware via email that could potentially lead to, for example, ransomware infections as they are sold or facilitated. Infections are sold or facilitated to other actors for follow on exploitation.
So we definitely want to make sure that we are covering down on those key threats. But their threat landscape is so big, so we are very much empowered to be like, what do you think is interesting? What is weird? Like, what is this malware doing that you've never seen before and why? And I think a lot of times you can proactively identify new threats that will become prevalent on the threat landscape if you are curious and if you are sort of given the ability and flexibility to to kind of... I... This is gonna sound so funny because I'm quoting my yoga instructor, but, like, find what feels good. You know? Like like, find that, and it'll kind of help you sort of navigate and prioritize in that direction.
But, yeah, it's it's a mix of, like, intelligence requirements from your customers, certainly covering down on what is big in the threat landscape, but also making time to find and follow stuff that you think is
most interesting. Love that drawing cybersecurity lessons from the real world experiences, whether it's whether it's yoga, whether it's, you know... I I feel like a lot of ideas come to us in those moments, you know, out on a run, perhaps. I did want to talk...
Yes. Exactly. I did want to talk about an episode of your Discarded podcast, which, by the way, is a really helpful way for any listeners to stay on top of a lot of the threats that we're talking about today. But there was a really interesting one that definitely caught my attention, where you talked about some APT threat actors posing as journalists. I know you discussed that with a few Proofpoint subject matter experts, but can you share a little bit more about what happened in that case and why threat actors are bothering to target journalists?
Yes. That was really fun research that was published by our APT Advanced Persistent Threat Team. So they focus on actors that are, state associated, sponsored by by a variety of different countries. For example, China, The DPRK, Iran, Russia, etcetera. But that research was actually really fun because it looked at a bunch of different actors across the APT threat landscape. So one of the ones that I thought was pretty interesting only because I have an unhealthy addiction to Twitter, like many journalists, was TA482. So this is an actor that, targets, like Twitter and social media accounts. They're likely aligned with the Turkish state. They very much target social media, so that was really interesting. There was a TA four zero four, which is a North Korean threat actor that was targeting US based media with this But that TA wasn't found.
You know what? I've never heard that joke before, and I have written slash tweeted slash talked about TA four zero four, and that is the first time that anyone has said this to me. So thank you.
It's not often I hear a new pun. So well done. Yeah. So so this actor targeted U. Based media organizations with this sort of like job opportunity, very much phishing, benign conversation starter type of thing. And then we had some China aligned APTs as well that we reported on TA four twelve, for example, which is broadly more known as zirconium. Throughout '21 and 2022, we did see a lot of these campaigns that were kind of benign or including web bugs to, essentially validate the targeted emails were active. And again, this was, targeting, a lot of US based journalists, certainly in political, national security, White House privacy security space. Another one was TA453. This is, you know, publicly known or tracked as...
Other security organizations as Charming Kitten. This actor is pretty interesting. We actually assess with high confidence that they support the Islamic Revolutionary Guard Corps Intelligence Collection efforts. And these examples that we shared in the reporting, they were actually posing as journalists. Right? So we have both the targeting journalists for intelligence collection as well as pretending to be journalists that were, in this case, targeting journalists really around the world, but with a large focus on academics and policy experts that were working on Middle Eastern foreign affairs. So you have this really interesting theme, right, of journalism that is both, you know, an area of interest in intelligence collection, but also a sort of masquerade that threat actors might adopt in order to gather information from additional targets.
I have to imagine that this particular threat was interesting to you because I know you have a background in cybersecurity and technology journalism. Was it like how did kind of learning about this, how did it make you feel maybe reflecting on your background?
I think it's interesting, but not surprising. Journalists have access to a lot of information, a lot of sources because, you know, while the things that are published kind of represent the tip of the iceberg, there's also, you know, all of this nonpublic information that's just kind of under the surface that they have collected in the conversations that they've been having and the things that they know. Off the record. Off the record. Yes. Yes. On background even. Right? So that doesn't always make it into the into the publication. So you have a lot of of, you know, interesting conversations and things that that journalists know. Right? So from an intelligence gathering perspective, that definitely makes sense. From a posing as journalist perspective, that is... I wasn't... Wouldn't necessarily say I was surprised, but I was definitely, you know, intrigued that they recognize that the persona of a journalist is compelling to a target to get them to talk or to get them to engage with something or to get them to click on something.
Right. Like say you're an academic and you just published something and you want people to read about it, you want to talk about it, right? It's like, oh, great. This journalist is interested in talking to me. So it's really that kind of rapport building and that trust building that could potentially increase the likelihood of someone engaging with something malicious. So it's an interesting character, right, of of journalism, and it's not exclusive to a specific subject either. Right? Like, we we really talked about all of the different targeting in the different subject areas, whether it's politics, cybersecurity, academia, you know, world news. So it is, I definitely recommend checking it out, and it does kind of show the different ways that threat actors will socially engineer both intended recipients as well as pretend to be those journalists in their activities.
It's so fascinating. I just find that so pernicious. Also coming from a journalistic background, there's already been such an erosion of trust in media institutions. To have bad actors latch on to this persona and start targeting people, either targeting journalists who already, frankly, let's be honest, have enough to worry about these days, or impersonating them. Do you ever just sit back in your desk and go like, this is, you know, outrageous and just shake your fist or what? How do you navigate the emotional side of some of this work?
Well, we talked about good vibes at the beginning of the podcast, and nothing harsh is good vibes like Threat Actors. True. And from from my perspective, so I don't actually work on tracking APT Actors. I think that there are for certainly like the journalist thing was very, you know, kind of rubbed... Obviously, rubbed me the wrong way. Right? Like, oh my gosh. Like, this is, like... I'm fine. This is personally offensive. Right? Like, my friends aren't journalists.
It's upsetting. Like like, what the heck? But I have to say that the some of the threats that make me the most like upset and angry are very much like fraud focused, business email compromise. People use just really cruel things in their messages. Things like, you know, death threats, things like, know that you have illegal content on your computer, and I'm not gonna describe what they say on this podcast. And these very, like, just evil things that these actors will will say and write to people and to get them to try and send them money.
And like from what I've heard, lot of the folks and maybe you can tell me if this is correct because I do not know a lot about this area. But from what I've heard, the folks that often fall for this kind of stuff are folks that are like older or not familiar with technology. And like that to me is so heartbreaking imagining like my grandparents receiving this kind of email. Mhmm.
Yeah. Well, so for sure. But I've gotten text messages from my friends. Right? Like, I'm in my thirties. I've had a girlfriend text me be like, oh my gosh, some guy is saying that he has compromising photos of me. And if I don't send him this, like, Bitcoin, then, you know, he's gonna publish them and leak them. And it's like
And she... I mean, and she's, like, texting me, like, freaking out, being like, please tell me this is a scam. Right? Like, so it's not even that it's just sort of like uneducated or people that are not digital natives that are getting targeted or falling for this stuff. It's like people... It's just anywhere. Right? Because fundamentally, the point of social engineering... Well, not the point, but one component of social engineering is to get your target to have a certain frame of mind so that they are increased the chances of engaging with the threat actor. Clicking on something, sending them money, like downloading something bad. Right? And if they put you in a frame of mind that's scared or concerned or like, you know, afraid for yourself or your family, then the human response, right? Like your body's response or mental responses to be like, Oh my gosh, I have to care about this.
This is important. Like, how do I fix this? And oftentimes, right, you have the sort of like big bots like like, you know, like Q bot does thread hijacking, right? There's no sort of like emotion like not a lot of emotional manipulation there, right? It's like, Okay, we're going to pretend that this is coming from a trusted email and that you the conversation that you already had. And that's like uncool. But in my my opinion, the things that, like, make me the most mad are these really just malicious, evil messages that people try and send to people to get them. It's mostly, like, fraud. Right? Like, send them money. But we've seen, for example, telephone oriented attack delivery, we call them TOADS. People being like, did you buy this? If you didn't buy this, call me. And to like to to refute this, like, charge. And then it's like, okay, oh, no, you didn't spend all this money? Like, oh, here, like, click on this and download this malware or give me remote control of your computer.
I didn't think about the fact that, like, even... I think like sometimes I I like to imagine myself as very like able to recognize these types of issues because I work in cybersecurity. Mhmm. But like, I'm thinking about it now and like there are definitely... And I won't admit to what they are, but there are definitely things where like if someone said certain things to me, I don't know. It would be really difficult to quickly work through that emotional instant fear response and get to like, Wait, wait, wait, let me logically pick this apart. Everyone has stuff like
I'll admit to one being in cybersecurity still. I will say, if somebody were to pray and I know this happens on, for instance, natural disasters. My childhood home, Sanibel Island, was hit hard by Hurricane Ian. I think if a carefully crafted phishing message or new video in from the Ian's devastation or whatever, I would have been very tempted to click on that at the time in the immediate aftermath when we're all just hungry for this information.
Threat actors who do that sort of thing I'm with you, Selena. It is evil. You're up against some really no holds barred, leave everything, just do whatever it takes to get to your target, and it's really
The losses that people suffer, tons of thousands, millions of dollars, like like individual losses for these types of things. Sextortion is another one. Right? These, like, love scams where they're, like, pretending to to to fall in love with you and and saying all these things that you wanna hear and then just cutting and running and taking all your money. Like, it's just, you know, there's there's different sort of like psychological behaviors that thrift actors like show. And I mean, they're criminals, right? It's crime. They're they're criminals. And it's it's like sometimes I'm like, you know, our our our BEC, our fraud researcher, I... He sends me these things. I'm just like, how do you, like, every day these things, it's just like, oh gosh, just really bums me out. I think that, you know, that's part of why I do this job, right?
Is because like I want to be able to protect people from receiving those horrible things and I want to make the space better and I want to make it better to exist online and be a human being with an email that like, you know, you're not like not having to suffer these fools constantly. It just, oh, yeah, some some of the stuff I'm just like, oh, why?
So we've talked about a lot of different kind of examples of some of the online threats that you're seeing or that you have seen a lot of. Is there some sort of emerging threat that you see in cybersecurity that we should
be thinking about? So I think benign conversations is something that more and more threat actors are using. It seems benign, but it really isn't, right? Like, it's coming from a place of malicious intent, but the actual content of the conversation itself doesn't have anything, that's that's outwardly, explicitly malicious. We see that with, I mentioned TOAD threat actors. Right? So they these emails are in quotations benign, right? Because they don't have any malicious links or attachments, but they do have this bad phone number, right? Like this is an indicator that's very clearly malicious, but it isn't anything like, oh, I should be, you know, cautious of this. For example, my mom's neighbor fell for one of these because she's like, knew that I shouldn't click on a link. I knew I shouldn't click on an attachment, but it was a phone number. Like, you're always told to call the number. And I think that's something that's pretty interesting.
We see it increasingly with e crime, cybercrime actors too, where they'll try and start a conversation with the subject before sending something bad. This sort of builds trust. It increases the social contract between the recipient and the sender and increases the likelihood that they'll engage with something malicious.
I was just thinking, especially lately, we're in a pandemic. There are people that are making friendships where their first and maybe only interactions are all happening online. And I can't imagine, like, how do you tell the difference?
Yeah. I mean, so that's the thing, right? Like, we as a security community have basically have to educate people on the tactics and techniques that these threat actors are using. Very similar to, for example, MFA, right? Like if we're telling people to use multifactor authentication because the threat actors are trying to steal your password and if there is no second factor that they need to be using, then it's a lot easier to gain access to your account. And so we have basically trained people be suspicious of things. Don't click on links. Don't click on attachments like you know, and in response, the threat actors are like, Okay, I have to set a baseline. Maybe I have to try a little bit harder to get somebody to engage with this. BEC actors do it as well. Like, oh, hey, I have a request. Can you ping me back? Like, you know, it's your boss. Can you can you hit me back on this?
So it's very much like, you know, I have this thing. Can you like? Can you give me a call? Can you can you shoot me an email back? It's and it's, you know, they're they're in my opinion, right? They're responding to the growing education of the generic, you know, Internet user base. And so I think it's, you know, all on us as security practitioners to ensure that we're informing people about these new techniques that that threat actors are using. And also, like, I don't know, like platforms that are are like social platforms, email platforms, like, you know, there's there's a lot of tools and technologies out there as well that have to kind of respond to and try and keep up with that. I know it's very much like playing whack a mole, but it's also the same with playing whack a mole with domain registrations, right? Like, it's like very much like it's always this constant like back and forth between like, oh, you know, the...
Like, people are are increasingly secure, so how do we respond to that? Like, how can we change our behavior? And it's it's like... I don't know. I think it's interesting from, like, a like a psychological or sociological perspective of, the ecosystem changes in response to the organisms that are living in it. And I think that we're seeing that a little bit with Benign Conversations. We're seeing that a little bit with macros, for example, like Microsoft blocking macros by default. That Actors are like, oh, okay, you have to figure out what to do now. What am I going to use as an attachment instead of macros? Like, got to test out these new, like, TTPs to sort of bypass these security protections. So it's very much like a constantly evolving ecosystem that we have to just try our best to make people secure and aware of.
I want to draw sort of like parallel between threat intelligence and pentesting. I think like a sort of maybe critique, but also like an important thing that I've often seen in pentesting is this idea of like reporting or information being actionable. Like something that I've run into a lot is like in pentesting, when we're giving information to a customer or whoever, if we're not giving kind of like next steps or why this is important or what to do about it, it feels kind of pointless. And I'm wondering, I know that that's something that has been talked about with threat intelligence as well. And I'm wondering what your take is on like what makes threat intelligence information actionable? And is that important?
Yeah. So that's a great question. It 100% is very, very important. And it really depends on who the audience is, right? Like, if threat intelligence is actionable because I can block all these indicators of compromise, I'm a SOC analyst, I can I can, you know, put this in and block it on my network, I took an action based on this report? It could potentially be from a, someone who is on the business side, and they're like, I'm trying to grow our company. I'm thinking about opening an office in some country, Russia or something, right, like, for example. And, you know, I received this report that is talking about specific threats that are geopolitically focused, and this might change the business decision that I have to make for my organization. It really depends like being able to take action on something really depends on who the recipient of the information is.
And that's why as intelligence analysts, if you are writing reports and distributing reports, you have to think about who is the audience of this? Who is going to be reading this? Like if we're talking from a stock analyst perspective, the geopolitical analysis is like, Okay, that might be interesting to me, but how am I... Like how does that apply to me and my job if I am a network defender specifically for this organization? And so it varies like an actionable is like such a vague word, right? Like I like I hate it and I love it because it's like, yes, it should be, but then how should it be really depends on the audience and who's going to actually be like, like what action do I want you to take upon reading this information? So it is it is important. And you know, like sometimes information for the sake of information and awareness can be can be useful as well.
But so often, people don't really know why they need to know something. So kind of explaining that and being like, here's an impact that this could have on your organization, on your network, on a host, etcetera, can really help provide that initial context and insight and help drive decision making based off of intelligence. So yes, it is really important and depends on the audience.
Yeah. No, that makes a lot of sense. I think like there's this like, I think it's a buzzword. I hear it a lot, but it's a good one. This idea in cybersecurity of being like risk focused. And, you know, I think a lot of times when we're talking about cybersecurity threats, you know, in whatever realm, it's so important to talk about, like, yeah, like what the risk is. And I think that is related to whether or not a piece of information is actionable. Like if you don't know the risk or how, how, what, like, there a risk? What is the risk to me specifically? It's impossible to action on.
No, it's really true. And we do that every day of our lives. For the record, like, I think that we don't ever think about that we're living our life that we are kind of making those decisions. I think the COVID pandemic is a terrific example about how we are all living and breathing risk based decision making. Like I am changing my behavior as a result of a of an existing threat. I'm, like, being informed based on reports by experts of how I should be changing my behaviors and how I... What risk am I willing to take as a person that exists in a world that has... Like, for example, for me, I have, like, I have asthma. That increases my risk of like getting really sick from something like COVID, which side note I did not fun.
I know it was it was it was bad. So I have increased my own personal security as a result of a threat that I experienced. And so we're we're like we're doing that every day, like depending on where you are in in cybersecurity, right? Like whether you are a CISO, whether you work in HR and are managing like LinkedIn profile, like recruitment stuff, whether you are, right, the network defender or whether you're just like an intelligence analyst. Like, no matter where you are, like, things can impact you, and it's just a matter of effectively communicating how they can impact you and how you can or should change your behavior in response to the perceived threat.
We've talked a little about the need to educate people to get better at picking up on some of these threats. When you're talking about this notion of risk based decision making, I guess having been an active member of the cybersecurity community, really engaged in a lot of these conversations, I guess if we want to step back and give ourselves a little scorecard, how are we Are we getting better? Do you feel like the trajectory is there to really conquer some of these risks? Or is it Yes. Is it still just a constant threats are getting worse, worse, worse, etcetera?
I believe we are getting better. I think that there are... There's a lot more awareness, for example, of the threat landscape. I think that the Colonial Pipeline ransomware attack, for example, was a a big sort of flashpoint for general populist awareness of digital threats, specifically ransomware.
It knocked out half the fuel supplies to the East Coast, for listeners who may not remember that one. Hopefully, you do. If you were in Georgia, I'm sure you do.
Yeah. Right? Yeah. And so it's it's it's really interesting that, you know, for me personally having covered this and been in this and I'm like, yes, this has existed for years. I'm so glad it was like oil that got taken out that made people realize this and not like the hospitals and city governments and schools.
It was like the meat packing plant and oil happening in this confluence of two weeks, I was like, Oh, this is bad. But I do have to say, for example, my sister, and hopefully she'll forgive me for using her as a reference, but she... Her life has been disrupted multiple times by ransomware attacks. She works in the medical field and she has experienced, disruptions, to basically like administrative tools and stuff due to cyber attacks. She she was impacted by the Colonial Pipeline attack that she couldn't drive her car basically because she couldn't get gas. And it's like these real world impacts of threats, I think that have really created this awareness overall. But I also think too that certainly the US government, but I know global governments as well are really kind of focusing on this too, right? I know that there's been increasing conversations about regulations, right?
Like, Okay, if we are driving a car and we're not wearing a seat belt or we don't have an airbag or, you know, like these these are environmental regulations, right? Like our rivers don't have sewage in them constantly all the time anymore for a lot of The United States. And it's like we have these like regulations that are put in place to protect people from bad things happening. And I think that that conversation is becoming increasingly noisy and people are realizing like, Okay, there are very real steps that that organizations that people can take. I think from a cyber insurance perspective as well, right? Like I know that there's a lot of of consideration as like should a is cyber insurance like a thing that should happen? B should people have like baseline levels of protection before they are insured to, you know, like preexisting conditions except for like businesses networks, right?
Well, to continue with the Ian example, it's going to be a lot harder for a lot of people in my hometown to find insurance after this. Similar things can happen with the cybersecurity world, for sure.
So I think it is getting better. And I think that overall, more people are getting worse. And I also think, too, that the number of journalists covering cybersecurity has increased, which means that newsrooms are paying attention to this, which means that readers are becoming aware of this. And I think overall, it's a very good thing, and I think we are getting better at effectively communicating threats to the general public as well. There's a lot that we need to do that could improve, but I think overall, things are getting better.
We asked this of all our guests, we're coming to the end of our time here. What's something that we wouldn't know about you by looking at your LinkedIn?
Hip hop, actually. Back in the day, and I actually used to teach kids hip hop in an after school program. But That sounds adorable. Was great. It was great. But I do have to actually give a shout out to something that I currently do. I'm a volunteer with Achilles International, and, that's an organization that pairs up sighted runners with visually impaired athletes. And we run around DC every week. It's really great. And, yeah, I don't know if people would know that about me, but I I am a runner. Do talk about that. But, Achilles... I volunteer with Achilles, has just been the most wonderful thing that I have done since moving to DC.
Reintroduce That's not the direction I was going there. Yeah. Reintroduce dance. No, that's really wonderful, and we really appreciate you coming on the show. It's been great talking with some of these really important subjects with you.
Does your penetration testing meet compliance requirements? Does it adhere to the most rigorous security standards on the market today? Now you can find Synack on the FedRAMP marketplace for all of your agency's security testing needs. Synack recently received moderate in process status from FedRAMP, meaning that even more US departments, agencies, and contractors can utilize Synack's global network of trusted embedded security researchers for on demand around the clock pentesting. Learn more at synack.com. That's synack.com.
If you like today's episode, please give us a five star rating and subscribe wherever you're listening to this. It'll really help us get noticed on your favorite podcast platforms. Also, you can share this episode with your friends, and make sure to check out all of the other fascinating people that we've already interviewed. We're also open to your suggestions. If you know someone that we should be talking to, drop us a line at we'reinpodcastsynack dot com. That's we'reinpodcastsynack
