For SLT
Security Training for Senior Leaders#
Read
Why a separate module for SLT?
An Advanced Persistent Threat (APT, aka "a hacker") in the sphere of high-growth startups has the resources, time, skills, and motives to launch Cybersecurity attacks far more easily than in the past. Most of these attacks are directed at small, high-growth startups under the assumption that their security program is insufficient or non-existent. These are a tasty place to attack because chances are high, risks are low, and the payoff can be huge.
Senior Leadership at smaller organizations tend to be a common target for many of these attacks due to several factors.
-
Most startups are founded by members of the C-Suite, and these folks may have been the first accounts on the core services used to support the organization. For example, the CTO may have created the first AWS account, and retained forgotten root access for many years after.
-
An APT might also assume that the Senior Management team is operating under high stress and a results-driven modality.
-
Compromising the email account of the CEO or other highly privileged people is a wonderful way to convince someone on the finance team to wire money somewhere secretly.
-
Compromising the email account of a highly privileged person at an organization can also be used to pivot access to other services (password resets, etc)
-
Compromising the email account of a highly privileged person can also be used to destroy a customer relationship, or send false public relations data to external sources for publishing
Most of the above things are REALLY hard to reverse, if even possible at all.
COVID-19 and Cybersecurity#
Read
During COVID-19, there has been a significant increase in attacks on organizations from individual APTs and cybercriminal organizations. In some cases they are simply bored and learning new skills. In other cases, they are sophisticated criminals with sophisticated tools who are taking advantage of the sudden changes that some organizations have been challenged with in the last year.
Pandemic fatigue and anxiety, coupled with the changes of process, budget, and staffing in the last year have left many organizations more vulnerable and most of the time without a quantifiable metric of exactly how vulnerable they really are. New gaps, new vulnerabilities, and new exploitable assets and processes make for an easier target.
The Risks - Pre-IPO#
Read
High-growth tech companies that are not yet public are targets to an APT that have a high potential for financial gain.
Consider a piece of malware known as a timed logic bomb. This malware will be installed to the laptop of a senior manager or engineer, where it waits silently for a remote command, or a date condition to be met. In most cases, this malware is a subset known as Ransomware, and in the weeks or days before an IPO the software will trigger and it will encrypt the entire hard drive and render it inaccessible. The APT will send an email to the company demanding a ransom in exchange for the password, but what they're really after is ransom for the public reputation for your company.
In some cases, central file shares at organizations are encrypted, or the production database itself. This sends the technical teams into a scramble to restore from backups (after ensuring the malware is eradicated) at a time when they need to be on deck for the IPO itself.
Other attacks on pre-IPO organizations include copying the contents of a database containing customer information, or corporate financial data, with the intent of releasing it publicly if a ransom isn't paid.
Even just the rumour of a potential breach or production-halting attack can be enough to deeply impact a company's reputation and overall valuation.
We want to be in the position where a ransom demand can be safely ignored. Even better, where a ransom demand isn't even made.
The Risks - Post-IPO#
Read
Shortly after a company goes public, there is an intense period of excitement, distraction, and an enormous amount of fresh public interest. The threats during this phase come at a much higher rate than pre-IPO, but they're less sophisticated.
However the risk is that sometimes your guard is down as an organization. Some folks take a well deserved break after a long sprint, others take their cash-out and leave, others may feel like the work is done.
The Posture#
Read
At Vidyard, we have a good security posture for all phases of growth. We are not a critical supply vector, we do not host any infrastructure, and we are not in the finance/military/government/health industries. Attacking us will not allow you to leverage or pivot access into another organization or service. We just need to protect our own perimeters and hold the fort.
Where Vidyard stands now, we have third party audits (application penetration testing and SOC 2) that verify the integrity of our platform and operations. We have visibility into trouble areas. We have the tools, processes, and talent to respond to incidents and attacks. However, these just cover the technical processes and operations, and can not cover the human / personnel attack vectors, or the third party vectors external to Vidyard's control.
It's up to Vidyard's leadership to stay alert, stay smart, and watch for attacks coming through unpredictable channels. It's also up to our leaders to guide their teams to do the same. Because for every technical and process control that we put in place, there exists a vulnerability within the human processes that we can't anticipate.
Let's assume for a moment that an APT finds Vidyard's technical points impenetrable. They're not getting in through our application, our supply chain, or through direct contact to staff. But this APT isn't ready to give up yet. It's time to try a few other tactics. These other attack vectors can include Social Media, Home Automation, third party services such as voice recorders and productivity apps, or your personal life.
Extra Special Tactics#
Read
Using a bit of online sleuthing, it doesn't take much effort to gather a profile on someone. This is a process known as OSINT, or Open Source Intelligence. This is using publicly available information, or information behind "soft" gates to build a profile of a person or entity. Check out #vyfirstround or #vidyardlife on a social media platform and you can build a list of staff personal accounts. From there, you can build lists of family members, friends, opinions/interests, and more.
While this is a tactic more commonly used in the finance industry, or for espionage in the military, it's not entirely un-common in the Small-Medium Business world, and I assure you it doesn't take much effort.
I will sound the alarm red-hot here with an example that I saw at a conference. A senior executive at a large financial organization was delivered a ransom package to his home address. In it was a letter detailing what he would find on the enclosed USB drive; copies of pictures from his teenage daughter's cloud accounts and phone. The ransom was not asking this executive for money directly, as they wanted to go for the deeper pockets of the corporation he worked for. Instead, it asked him to leave his RSA Two-Factor token card and his password in a discreet location and to not alert his I.T. or security department for a period of time. Using his access credentials, the attacker quickly downloaded several terabytes of intellectual property and financial data and used it to leverage a much higher valued ransom.
Extra Special Tactics 2#
Read
Another example from that talk was towards another senior executive at an insurance company. An attacker sent a number of spam messages with tracking pixels to this executive. These messages were designed to figure out his interests based on which ones were opened and which were deleted.
This is a technique used by marketing firms to build a profile on users. As they found out, this executive did not believe that he had an estranged uncle from another continent who left him a fortune, and did not need his furnace ducts cleaned. However, he was interested in meeting nearby women and seemed to always click on adult themed emails.
The attacker sent a similar collection of spam to this executive's wife, with content about relationship and marriage satisfaction, and quickly figured out that they were having marital issues.
This attacker then used one of their fake Facebook accounts using a profile picture of an attractive woman (likely procedurally generated or stolen), and messaged our victim. They built an online relationship over a few weeks, and during this time the attacker had obtained plenty of information from him like where he worked, what kind of car he drove, his kids' names, his pets, etc. He also built a solid case for blackmailing him to his wife. But that wasn't the attacker's primary goal.
The attacker recommended a piece of software to the victim, and sent a link to a version which had been backdoored with a piece of software known as a keylogger. After a few days, the attacker had what they came for: the VPN password to our victim's network, and an ability to instantly obtain the Two-Factor code. This was used to access and copy data from their customer's database which included health information, PII, and account access passwords. The victim didn't find out until months later during the forensics investigation that he had been used. His wife also found out about the online relationship at that time.
Institutional Cybersecurity: A Case Study of Open Source Intelligence and Social Networks
Cushioned Excuses#
Read
These examples may sound extreme, but I assure you THEY HAPPEN.
These situations were usually quite sensitive in nature, with emotional outcomes, financial losses, ruined careers, and failed businesses. For these reasons, many of the people involved would be very likely to cover-up or outright deny that they even occurred.
Legislation in the last decade has put the responsibility on business and organizations to disclose and report on security breaches, and it's far more common to hear about these events in the news than before. However, you are reading a news article that has passed through many filters where the impact has been downplayed by those who were at fault; facts omitted for security or privacy reasons, language gentled by a communications department, completely re-written by a news outlet to be interesting again.
Quote#
Read
I've seen it said often, that the period of time after a security breach is the only time that an organization takes security seriously.
Let's all work to avoid that moment of panic by being prepared, informed, and ultimately with a plan of action.
Just because you're paranoid, doesn't mean they're not after you#
Read
I have shared some pretty scary stuff with you today, and I hope the takeaway isn't all doom and gloom.
While these risks are real, they're also easy to spot and even easier to deal with if you're armed with the knowledge and processes.