Skip to content
InTechnology Podcast

#20 – SolarWinds and Cyber Security: What CISOs Should Know

You’ve seen bits and pieces of the SolarWinds story in the news, but what actually happened (to the best of our knowledge) and what can CISOs learn from it?  On this episode of Cyber Security Inside, Tom and Camille invite Dr. Eric Cole, CEO and founder of Secure Anchor Consulting, onto the show to talk about the SolarWinds hack.

Plus, during Fun Facts:

•  What’s an early sign of Alzheimer’s or dementia?

•  What did people believe would kill you in 1954?

•  Why was a donkey-less game named Donkey Kong?

 

Tune in to find out. This is one you can’t miss!

Here are some key take-aways:

•  Large-scale data breaches all share one commonality: a lack of awareness about unprotected data.

•  When it comes to asset inventory and patching configuration management, automation is key. Businesses can’t rely solely on humans to get the job done. There’s technology available that can recognize when a new asset appears, so businesses only have to respond when there’s a problem. They don’t have to be looking 24/7.

•  The SolarWinds attack was a two component attack. First was the attack against SolarWinds to modify their source code for their Orion product. Second, was the distribution of a malicious update to all of their clients (which then created a back door).

•  Unlike attacks in the past where a specific company is targeted, with the SolarWinds attack, it’s more likely that a list of companies was compiled. From there, the hackers looked for common denominators between those companies in search of a way in.

•  There wasn’t a single point of failure with the SolarWinds attack. Source code shouldn’t have been directly accessible on Internet facing systems; checks and validations should have been done before sending out updates; and checking and testing should have been done in-house.

•  If you have servers or software from a third-party vendor, that needs to be isolated on a separate segment and going through a firewall.

•  Businesses should always be watching outbound traffic for anomalies.

•  The SolarWinds hackers knew that it’s not uncommon for vendors to push out patches for software. So, they made their malicious code look like a patch update.

•  Not all SolarWinds customers were affected. With this attack, you had to be running a specific version of SolarWinds in order to be affected.

•  These types of attacks aren’t typically spotted by security departments. They are usually caught as a result of performance issues with IT equipment. The reason is the attackers are clever enough to fly under the radar with security, but they don’t understand the thresholds of the hardware.

•  Even if you’re not a customer of SolarWinds, you need to work with your suppliers to ensure that they weren’t attacked through SolarWinds.

•  What else do you need to do now? Design as if you were compromised and it will happen again.

 

Some interesting quotes from today’s episode:

 

“When you’re looking at any of the large-scale data breaches over the last five years, anytime you’re seeing more than 50 million records compromised, it’s pretty much the same exact playbook. There is a server visible from the Internet that the organization isn’t aware of. It’s missing a patch. It contains critical data. And that data is not properly encrypted or protected.”

 

“The real big problem is companies don’t have a hundred percent asset inventory and therefore they don’t know what’s out there and they can’t patch it, protect it, or secure their data.”

 

“Anything that’s based on a human is eventually going to fail. But computers are systematic and can be programmed.”

 

“In the past, if I wanted to target Company X, I break into company X. If I want to break into Company Y, I target them individually. But in this case, they went in and said, ‘Okay, we want to break into all these companies. How do we go after it?’”

“I will tell you how I would have done this attack when I was on the offensive side. I would have put together a list of the companies and government entities that I wanted to break into. I would then start looking at what is the common denominator?”

 

“They got access to one of those computers. They used that computer to set up what we call a pivot point. They did lateral movement into the network and ultimately found the source code computers. Then from there, they were able to upload malicious code into that source code…They then push that update out to all of the clients. And then all of those systems got infected, installed malware, and then set up outbound command and control channels to communicate with the adversary.”

 

“Now whether they broke into other vendors is yet to be seen. Remember, most organizations don’t detect attacks for two to three years.”

 

“What they were going after on the source code is the ability to take control of the client computers that ran the SolarWinds software. So essentially what they wanted to do is have a command and control piece of code that, once it was installed on the system, would then be able to take control, make outbound connections, and give somebody access to those networks.”

 

“I believe they had a long list and they had specific reasons and goals for each of those. Because the malicious code that got distributed with the SolarWinds software, it didn’t specifically gather data, exfiltrate data, or delete data. What it did is create access paths for the adversary. So all we know is that the adversary wanted to gain access to this list of networks.”

 

“That’s the interesting thing with not only SolarWinds, but most of these other attacks that we’ve seen over the last three years. It’s typically the IT department that catches it. It’s not the security department.”

 

“At some point they make the false conclusion, ‘Oh, no one’s going to catch us. We’ve been doing it for two years.’ And then they start cranking it up and they inadvertently go in and overload the computer systems. Because these attackers know how to bypass the security equipment, but they don’t know the thresholds of the IT equipment.”

 

“It’s often ‘Let’s get access and maintain the access to see what we can do, so we can use it at a later point in time.’ Sometimes it’s the cell access. Sometimes it’s to ransom it back to the company. Sometimes it’s to sell to a third party. But the name of the game now is whoever has access wins the game. And that definitely looks like what they were after with the SolarWinds attack.”

 

“The best bet is to assume that you were compromised and use this as a lesson learned. It will happen to you. You have software vendors, you have components. SolarWinds was not the first and they won’t be the last. So you need to go in and assume that you were compromised. Be proactive. And then whatever you would have done to respond to an actual compromise, those are the things you need to put in place today.”

Share on social:

Facebook
Twitter
LinkedIn
Reddit
Email

[00:00:38] Camille Morhardt: Welcome to What That Means, I’m Camille Morhardt.  And thanks for joining me for part 2 of our discussion on Non-Fungible Tokens – better known as NFTs.  If you missed Part 1, I suggest you go back and listen or watch that episode first so you can get a good grounding in what NFTs are.  As in Part 1, my guest is Mic Bowman, a Senior Principal Engineer at Intel Labs who runs the Trustworthiness Distributed Systems lab. For part two of our conversation, the talk turns to potential uses of NFTs beyond artwork, video clips or collectibles.

[00:01:18] Mic Bowman: Let’s speculate outside of media. Let’s say that what I want to do is create a trained machine learning model. I’ve got a classifier, right? And it does some really cool things, and I’m going to create an NFT for that. You buy the classifier and now you can use that classifier in your application. And if I do it right, maybe I can allow you to use the classifier, but you don’t have the right to see the model that’s inside the inferencing engine.

But you have some additional data and you take the original model that I gave you and you add your data and you retrain that model. So it’s a better classifier, right? And then you turn around and sell it, your new model. We could create a marketplace for those kinds of things, where even though you’ve created this new model, I get a portion of the sales when you sell yours, because I contributed to yours.

Those new ideas for what constitutes ownership and monetization and what is an economy is in this space. That’s the power of the NFT, that transactions can get a whole lot more interesting than me giving you $3 for a cup of coffee. There’s a lot more that can be about inside those transactions.

So, back to the technology. NFTs are really boring, it’s an identifier and an owner that goes along with it. But the interesting part is that we can expand that transfer operation to do a lot more interesting stuff, that it really is a smart contract. And that means that we can code entirely new behaviors in ownership transfer. It also means that we can define new ways for determining what ownership pose. 

[00:03:11] Camille Morhardt: Okay. Say more about that. How was ownership changing? 

[00:03:16] Mic Bowman: So let’s go back to an image, right? When you purchase an image, I’ve got a painting on my wall that I have, what am I allowed to do with that? Well, I can actually turn around and resell the physical art that way, but I have not purchased the copyright to that image for it, but with an NFT it might be possible to encode in that the right for me to purchase, not just the art, but to purchase the copyright that goes along with the art. There was one company that was talking about taking all of their patents, creating NFTs for the patents. And ownership of the NFT would convey certain rights to use the intellectual property that was part of the patent that way. So there becomes a very concrete license for what you can do with this idea that’s been patented. We can code up in these smart contracts simple licenses, complex licenses, or in some cases, no licenses at all for it. We can encode sort of downstream transactional value and derive the value of derived products from it, all of this can be encoded in the smart contract that goes along with the NFT. 

[00:04:39] Camille Morhardt: And part of the benefit of the smart contract is it self polices in a sense. How are you ever going to get something back if it’s stolen or you misused. It’s like good luck, but you’re saying you’re going to code it in so it may… 

[00:04:55] Mic Bowman: It doesn’t right. I mean, ownership, the NFT does, but recall what we said is that the asset is the separate thing out here, the picture. I may try to resell the picture, even though the NFT doesn’t necessarily give me the rights to do that. And honestly that distinction between the two and sort of these open markets, maybe the biggest barrier in extending NFTs out into new assets.

We do it right now. I mean, these things work really well with media right now because there’s some standard. External recourse through copyright law, that sort of sets what you can and can’t do with things. There’s some fairly standard creative commons licenses that define some basic sets of rights for access to simple media.

But as we extend these things out and start representing complex things like patents, for example, or there were a couple of bizarre things that have shown up recently, there was a woman who was selling eggs for an in-vitro fertilization through an NFT, which has got to be the most bizarre thing I’ve seen in the space so far. We don’t know what rights ownership of the NFTs actually conveys. That one to me feels like there’s a set up for some really complicated legal discussions about what constitutes ownership and the rights to define that. 

[00:06:25] Camille Morhardt: Wouldn’t it just kind of follow like stock market and rights to portions of securities. 

[00:06:33] Mic Bowman: those are well-defined by the government has really well-defined those and what the ownership parts of it are, but people are throwing stuff out and random ways about what they’re trying to get access to, and they’re doing it without any sort of standard legal vernacular to apply to those transactions in those relationships. 

[00:06:56] Camille Morhardt: To venture out on the like extreme speculative side of things here. We have all kinds of data that’s been collected through internet of things. And obviously some of that data or much of the data has privacy concerns, but let’s talk about data that’s just valuable information for people like sensor data of anything, whether nutrients in the soil, anything like that. Nobody has really a mechanism to release because they’re not going to gain anything from it. I know we’re way out in the future and we’re speculating, but can you let us know about how NFT might change something like that? 

[00:07:38] Mic Bowman: So again, we were talking about some of the kind of excitement what NFT facilitates that way. And to me, in some sense, this is the most exciting and most speculative kind of aspect and usage for NFT is can we really start to monetize the data?

As you pointed out, we have sensors collecting information in so many different ways. But the cost of getting that data to an open market of individuals who might find it valuable is just prohibitive right now. And so if we can find a way of connecting data providers or data creators to those who want to consume the data again, through some kind of an open market; that begins to justify the collection and publication of things we would not have done before. On the social good side of things, it opens us up to the potential for doing much more interesting queries over sort of large collections of information. Things like if a vineyard decides that they’re going to export the information about the soil type and climate information and how they manage the grapes and what the yield was that was collected as a result of their management type. That information suddenly becomes useful to somebody else who is trying to potentially start a new field. Can I find others that have done similar things, so I can configure mine in a way that will optimize the yield and the quality of the grapes that I’m getting. In individual vineyard the value of that data is disproportionately small to the cost of making it available. But if we can now start to create these NFTs around it, if there’s a way for us to tokenize that data, now we can create this marketplace and potentially make consumers of the data connected to the providers of the data in a way that justifies collection of and publication of that data. And that would be really exciting. 

[00:09:53] Camille Morhardt:  It’s interesting because it’s making me think about people who put up a YouTube of something that they’re doing. And if somebody else finds it valuable or many, many people find it valuable eventually whoever posted the video that who received nothing from it at the time becomes monetized and now, or they have a following and then somehow they get to monetize and make money contingent on the number of people who like it and they’re not in charge of the content. You’re not pairing people together, you are now getting advertisers involved or platforms involved.

I think what you’re talking about is a bit of a paradigm shift might be a little strong, but you’re talking about this decentralized way of connecting the content producer with the current consumer. 

[00:10:43] Mic Bowman:Yeah, exactly. And I love the YouTube analogy, right? Because what YouTube did by making it easy to publish videos is that it makes everyone who’s got some expertise an opportunity to monetize that expertise either through advertisements or subscriptions or whatever. When we collect data right now, there’s no easy way for us to get the value back for the data that we’re collecting. If there was some opportunity to make it as easy to collect the value on the data, as it is to get value for our expertise through YouTube, then maybe we would see a lot more people collecting more information and sharing it, which means that we will get a better understanding of what’s happening.

[00:11:25] Camille Morhardt: You have to also agree that this could be frightening. 

[00:11:29] Mic Bowman: It’s terrifying, actually. The biggest barrier for me on the technical side is how do we make it possible to do this monetization of data and preserve the appropriate use of that data? And there are some technologies that we could bring to bear on it, but it’s very much an open question. This is why we do research and forward-thinking and development in this space. 

[00:11:58] Camille Morhardt: Pay attention to the ethics side and the privacy side.  

[00:12:01] Mic Bowman: Absolutely you have to. 

[00:12:04] Camille Morhardt: I want to ask two questions on the security side. One is how do you protect your NFT? And the other one is more interesting to me; are NFTs going to allow us to protect things differently than we’ve been able to in the digital word.

[00:12:21] Mic Bowman: Protection is an interesting word. The NFTs themselves, to a certain degree, don’t need to be protected. They are a very standard representation, they’re well-defined with the smart contract platforms that we have and to a certain degree, every one of these new marketplaces that builds their own blockchain around it is defining a certain set of rules for it, they’re all trying to be relatively public about what transactions and exchanges mean? So the NFT part of it is not that interesting to me. It’s how do you protect the asset that goes along with it? So let’s go back to that classifier. I give you a model that has been trained by some machine learning algorithm. That model may have confidential information and what I give you is the right to use this model to do interesting inferencing and potentially to derive new models. It doesn’t mean that I’ve given you the right to see all the data that went into training, the model that I gave you. So how do I protect that? How do I prevent you from taking this interesting asset, copying it out and then selling it independently without giving me my cut of the derived goods? 

[00:13:37] Camille Morhardt: I’m also saying you may have personal information or private privacy concerns. 

[00:13:43] Mic Bowman: Exactly, or things that have been derived from that.  And right now the answer is we just don’t do it if there’s going to be private information in there, which is a very safe thing to do that’s appropriate.

But if we have technologies that allow us to protect the confidentiality of it and whether that’s zero-knowledge proofs or homomorphic encryption or trust that execution environments or whatever. Are there ways that we can protect the intellectual property and those assets to create digital scarcity and to protect the assets more rigidly than we currently have, more formally than what we have with existing kind of media parts of it. If we can do it, that opens up some doors for some really interesting new applications for NFTs that we can create new markets for data, not just for media.

[00:14:37] Camille Morhardt:  I have heard of scenarios where it’s at least being explored that NFTs are helping verify the authenticity of a physical object. I heard Nike does it for sneakers to verify that there are certain kinds of sneakers.

[00:14:58] Mic Bowman: Let’s be a little careful to differentiate between the NFTs which are the kind of tradable representation and having a serial number registered in a blockchain or in a database someplace. I think we’ve talked about this last time that there were a couple of times to do diamond registries where you could actually add some identifier and the diamond and then you could track its progress. There are already systems to be able to do that, you don’t need an NFT in order to track the uniqueness of shoes. What you need is a way of creating a unique identifier in the shoe, and then registering that identifier someplace else. 

[00:15:42] Camille Morhardt: But that could create the need for digital items or digital assets to self-generate IDs that are non vulnerable, non hackable, 

[00:15:55] Mic Bowman: Do we have the ability to generate unique identifiers? Yes. Do we have an ability to generate unique identifiers that are unforgeable for physical goods? It’s not all that easy, but it can be done. Do we need NFTs in order to make those unique identifiers? Yes, it might be a nice way to do it, especially for thinking about moving into these secondary markets. But if you buy a pair of Nike shoes and I buy those Nike shoes from you and somebody else wants to buy them from me and verify that they are a unique real Nike product unless when I bought them from you, we did an NFT transaction that transferred ownership then what’s the point? 

There’s a lot of this stuff about, we know how to trade NFTs. But we don’t necessarily know how to update the NFT as we trade the physical goods. There’s a new space of digital twinning where you’re binding a physical object to a digital representation of that. And the synchronization of those two in a continuous synchronization of those two, if you build it that way can be done. But for a lot of these physical goods, if you’re not building it that way, it’s going to be really hard to maintain those relationships. 

[00:17:25] Camille Morhardt: Well, okay, that’s one of the hottest topics in NFTs right now. Are there any other kind of barriers or major things that people are arguing about? 

[00:17:38] Mic Bowman: We just talked about interoperability as being one of them, partial ownership is another thing. And you can kind of understand that again from an investor’s viewpoint, rather than an owner.

What does partial ownership of an image mean from a practical terms? Does it mean I own a slice of pixels out of that image? What can I do with that slice of pixels? I don’t know. Right? I mean, there’s that part of it. But if I’m treating the NFT as a security in which I am purchasing it for an investment for resale, then partial ownership is a very interesting concept. Especially when these NFTs are going for a hundred thousand dollars, and being able to get into the NFT marketplace becomes so expensive. So in those situations, how a collective goes together to purchase the NFT, that becomes important as the values are going up.

[00:18:32] Camille Morhardt: A most basic question is which is why create scarcity when it’s not needed? Why create digital scarcity? Anything digital can be reproduced essentially for free. Forever. So why create the scarcity? 

[00:18:55] Mic Bowman: Can we make digital assets that can’t be copied arbitrarily? That is an interesting question here that that supports the scarcity, but why scarcity is valuable because it makes them collectible it’s back to that Onus Wagner card. What makes that card valuable is that there were only a very, very small number of them originally produced. And Onus Wagner happens to be a really good, popular baseball player.

And my understanding is that the card came out before he became a popular baseball player. And there were certain mistakes made in the card run. Whatever it is, there are very, very few of this particular card, as opposed to some mass-produced card. Even though it’s 110 years old, a mass produced card because they’re available the marketplace doesn’t support high value.

[00:19:53] Camille Morhardt: It’s just the human nature of valuing what’s scarce, we’re going to create that in the digital world so that we can essentially replicate the system of trading money value as we know it, but in the digital space as well. 

[00:20:10] Mic Bowman: And there’s all the sociology and psychology that goes behind possessing something unique. The whole point is that we can own something that nobody else does or that very, very few other people do. What is the cost or what is the value to you of owning that thing? In some cases it’s like owning a Monet, what’s the value of owning the original Monet?

It’s a painting, right? And I can get digital prints that are very, very good copies of that Monet. But owning the digital print is not owning the Monet. The digital print may look just as good on my wall, but it’s not a Monet. It’s not the original Monet. The print on my wall is worth $25 bucks. The Monet, the painting Waterfront just sold at Christie’s for what, $60 million or some ridiculously high number. It’s worth that much to somebody. Is it worth it because they are a collector. Is it worth it because they value seeing the paintbrush strokes on the Monet? I don’t know. Those are good questions and probably all of them are a little bit true. 

[00:21:20] Camille Morhardt: All right. Thank you, Mic. Good conversation. I appreciate it. I feel smarter and also have 25 more questions than I came in with. 

[00:21:31] Mic Bowman: It is a very exciting space.  I’m really excited to see what happens over the next few years as we start to realize more value. 

[00:21:39] Camille Morhardt: Thanks again for your time. 

[00:21:40] Mic Bowman: Thanks Camille.

[00:21:42] Camille Morhardt: Thanks again for joining me for our two-part look at NFTs.  Again, if you missed part 1, I suggest you check it out because Mic gives a good explanation of what NFTs are and we explore the nuances of what people are actually buying when they purchase an NFT and what they can and can’t do with it.  Thanks for listening.

 

Stay tuned for the next episode of Cyber Security Inside. Follow @TomMGarrison and Camille @Morhardt on Twitter to continue the conversation. Thanks for listening. 

The views and opinions expressed are those of the guests and author, and do not necessarily reflect the official policy or position of Intel corporation.

More From

#27 – What That Means with Camille: Carbon Neutral Computing

#26 – What That Means with Camille: Crowdsourced Security and Bug Bounty

#25 – What That Means with Camille: Privacy and Its Policy