(Intense orchestral music) >> Hi, I'm Peter Burris and once again welcome to a CUBEComnversation from our beautiful studios here in Palo Alto, California. For the last few quarters I've been lucky enough to speak with Tony Giandomenico, who's the Senior Security Strategist and Researcher at Fortinet, specifically in the FortiGuard labs, about some of the recent trends that they've been encountering and some of the significant, groundbreaking, industry-wide research we do on security threats, and trends in vulnerabilities. And once again, Tony's here on theCUBE to talk about the second quarter report, Tony, welcome back to theCUBE. >> Hey, Peter, it's great to be here man, you know, sorry I actually couldn't be right there with you though, I'm actually in Las Vegas for the Black Hat DEF CON Conference this time so, I'm havin' a lot of fun here, but definitely missin' you back in the studio. >> Well, we'll getcha next time, but, it's good to have you down there because, (chuckles) we need your help. So, Tony, let's start with the obvious, second quarter report, this is the Fortinet threat landscape report. What were some of the key findings? >> Yeah, so there's a lot of them, but I think some of the key ones were, one, you know, cryptojacking is actually moving into the IOT and media device space. Also, we did an interesting report, that we'll talk about a little bit later within the actual threat report itself, was really around the amount of vulnerabilities that are actually actively being exploited over that actual Q2 period. And then lastly, we did start to see the bad guys using agile development methodologies to quickly get updates into their malware code. >> So let's take each of those in tern, because they're all three crucially important topics, starting with crypto, starting with cryptojacking, and the relationship between IOT. The world is awash in IOT, it's an especially important domain, it's going to have an enormous number of opportunities for businesses, and it's going to have an enormous impact in people's lives. So as these devices roll out, they get more connected through TCP/IP and related types of protocols, they become a threat, what's happening? >> Yeah, what we're seeing now is, I think the bad guys continue to experiment with this whole cryptojacking thing, and if you're not really, for the audience who may not be familiar with cryptojacking, it's really the ability, it's malware, that helps the bad guys mine for cryptocurrencies, and we're seeing that cryptojacking malware move into those IOT devices now, as well as those media devices, and, you know, you might be saying well, are you really getting a lot of resources out of those IOT devices? Well, not necessarily, but, like you mentioned Peter, there's a lot of them out there, right, so the strength is in the number, so I think if they can get a lot of IOTs compromised into an actual botnet, really the strength's in the numbers, and I think you can start to see a lot more of those CPU resources being leverages across an entire botnet. Now adding onto that, we did see some cryptojacking affecting some of those media devices as well, we have a lot of honeypots out there. Examples would be say, different types of smart TVs, a lot of these software frameworks they have kind of plugins that you can download, and at the end of the day these media devices are basically browsers. And what some folks will do is they'll kind of jailbreak the stuff, and they'll go out there and maybe, for example, they want to be able to download the latest movie, they want to be able to stream that live, it may be a bootleg movie; however, when they go out there an download that stuff, often malware actually comes along for the ride, and we're seeing cryptojacking being downloaded onto those media devices as well. >> So, the act of trying to skirt some of the limits that are placed on some of these devices, gives often one of the bad guys an opportunity to piggyback on top of that file that's coming down, so, don't break the law, period, and copyright does have a law, because when you do, you're likely going to be encountering other people who are going to break the law, and that could be a problem. >> Absolutely, absolutely. And then I think also, for folks who are actually starting to do that, it really starts to-- we talk a lot about how segmentation, segmenting your network and your corporate environment, things in that nature but, those same methodologies now have to apply at your home, right? Because at your home office, your home network, you're actually starting to build a fairly significant network, so, kind of separating lot of that stuff from your work environment, because everybody these days seems to be working remotely from time to time, so, the last thing you want is to create a conduit for you to actually get malware on your machine, that maybe you go and use for work resources, you don't want that malware then to end up in your environment. >> So, cryptojacking, exploiting IOT devices to dramatically expand the amount of processing power that could be applied to doing bad things. That leads to the second question: there's this kind of notion, it's true about data, but I presume it's also true about bad guys and the things that they're doing, that there's these millions and billions of files out there, that are all bad, but your research has discovered that yeah, there are a lot, but there are a few that are especially responsible for the bad things that are being done, what did you find out about the actual scope of vulnerabilities from a lot of these different options? >> Yeah, so what's interesting is, I mean we always play this, and I think all the vendors talk about this cyber hygiene, you got to patch, got to patch, got to patch, well that's easier said than done, and what organizations end up doing is actually trying to prioritize what vulnerabilities they really should be patching first, 'cause they can't patch everything. So we did some natural research where we took about 108 thousand plus vulnerabilities that are actually publicly known, and we wanted to see which ones are actually actively being exploited over an actual quarter, in this case it was Q2 of this year, and we found out, only 5.7% of those vulnerabilities were actively being exploited, so this is great information, I think for the IT security professional, leverage these types of reports to see which particular vulnerabilities are actively being exploited. Because the bad guys are going to look at the ones that are most effective, and they're going to continue to use those, so, prioritize your patching really based on these types of reports. >> Yeah, but let's be clear about this Tony, right, that 108 thousand, looking at 108 thousand potential vulnerabilities, 5.7% is still six thousand possible sources of vulnerability. (Tony laughs) >> So, prioritize those, but that's not something that people are going to do in a manual way, on their own, is it? >> No, no, no, not at all, so there's a lot of, I mean there's a lot of stuff that goes into the automation of those vulnerabilities and things of that nature, and there's different types of methodologies that they can use, but at the end of the day, if you look at these type of reports, and you can read some of the top 10 or top 20 exploits out there, you can determine, hey, I should probably start patching those first, and even, what we see, we see also this trend now of once the malware's in there, it starts to spread laterally, often times in worm like spreading capabilities, will look for other vulnerabilities to exploit, and move their malware into those systems laterally in the environment, so, just even taking that information and saying oh, okay so once the malware's in there it's going to start leveraging X, Y, Z, vulnerability, let me make sure that those are actually patched first. >> You know Tony the idea of cryptojacking IOT devices and utilizing some new approaches, new methods, new processes to take advantage of that capacity, the idea of a lateral movement of 5.7% of the potential vulnerabilities suggests that even the bag guys are starting to accrete a lot of new experience, new devices, new ways of doing things, finding what they've already learned about some of these vulnerabilities and extending them to different domains. Sounds like the bad guys themselves are starting to develop a fairly high degree of sophistication in the use of advanced application development methodologies, 'cause at the end of the day, they're building apps too aren't they? >> Yeah, absolutely, it's funny, I always use this analogy of from a good guy side, for us to have a good strong security program, of course we need technology controls, but we need the expertise, right, so we need the people, and we also need the processes, right, so very good, streamline sort of processes. Same thing on the bad guy side, and this is what we're starting to see is a lot more agile development methodologies that the bad guys--(clears throat) are actually using. Prior to, well I think it still happens, but, earlier on, for the bad guys to be able to circumvent a lot of these security defenses, they were leveraging polymorphous, modifying those kind of malwares fairly quickly to evade our defenses. Now, that still happens, and it's very effective still, but I think the industry as a whole is getting better. So the bad guys, I think are starting to use better, more streamlined processes to update their malicious software, their malicious code, to then, always try to stay one step ahead of the actual good guys. >> You know it's interesting, we did a, what we call a crowd chat yesterday, which is an opportunity to bring our communities together and have a conversation about a crucial issue, and this particular one was about AI and the adoption of AI, and we asked the community: What domains are likely to see significant investment and attention? And a domain that was identified as number one was crypto, and a lot of us kind of stepped back and said well why is that and we kind of concluded that one of the primary reasons is is that the bad guys are as advanced, and have an economic incentive to continue to drive the state of the art in bad application development, and that includes the use of AI, and other types of technologies. So, as you think about prices for getting access to these highly powerful systems, including cryptojacking going down, the availability of services that allow us to exploit these technologies, the expansive use of data, the availability of data everywhere, suggests that we're in a pretty significant arms race, for how we utilize these new technologies. What's on the horizon, do you think, over the course of the next few quarters? And what kinds of things do you anticipate that we're going to be talking about, what headlines will we be reading about over the course of the next few quarters as this war game continues? >> Well I think a lot of it is, and I think you touched upon it, AI, right, so using machine learning in the industry, in cyber we are really excited about this type of technology it's still immature, we still have a long way to go, but it's definitely helping at being able to quickly identify these types of malicious threats. But, on the flip side, the bad guys are doing the same thing, they're leveraging that same artificial intelligence, the machine learning, to be able to modify their malware. So I think we'll continue to see more and more malware that might be AI sort of focused, or AI sort of driven. But at the same time, we've been taking about this a little bit, this swarm type of technology where you have these larger, botnet infrastructures, and instead of the actual mission of a malware being very binary, and if it's in the system, it's either yes or no, it does or it doesn't, and that's it. But I think we'll start to see a little bit more on what's the mission? And whatever that mission is, using artificial intelligence then to be able to determine, well what do I need to do to be able to complete that place, or complete that mission, I think we'll see more of that type of stuff. So with that though, on the good guy side, for the defenses, we need to continue to make sure that our technology controls are talking with each other, and that they're making some automated decisions for us. 'Cause I'd rather get a security professional working in a saw, I want an alert saying: hey, we've detected a breach, and I've actually quarantined this particular threat at these particular endpoints, or we've contained it in this area. Rather than: hey, you got an alert, you got to figure out what to do. Minimize the actual impact of the breach, let me fight the attack a little longer, give me some more time. >> False positives are not necessarily a bad thing when the risk is very high. Alright-- >> Yeah, absolutely. >> Tony Giandomenico, Senior Security Strategist and Researcher at Fortinet, the FortiGuard labs, enjoy Black Hat, talk to you again. >> Thanks Peter, it's always good seein' ya! >> And once again this is Peter Burris, CUBEConversation from our Palo Alto studios, 'til next time. (intense orchestral music)

(vibrant music) >> Hi, I'm Peter Burris, welcome once again to another CUBE Conversation from our Palo Alto studios. Recently, we had FortiGaurd Labs here on theCUBE talking about a regular report that they do on the state of the security industry. And once again, we've got Anthony Giandomenico. >> Yeah, good. >> Here to talk about the most recent, the Q1 update. First of all, tell us a little bit about FortiGaurd labs, where's this come from? >> So FortiGaurd Labs actually is the threat intelligence organization of Fortinet, so what we do, is we keep track of the tactics, techniques, and procedures of the adversary. And make sure that we have detection methodologies to be able to stop all those tactics, techniques, and procedures. >> Peter: So you're the ones that are collecting the data that's right from the ground to help everybody keep up to date on where the threat's are likely to be, set priorities. So that's what this report does, right? >> Absolutely, it's something we do on a quarterly basis, and it's really, you know, we're looking at billions of events that we're observing in real time, you know, production environments, and what we're trying to do is identify the top application exploits, malware, and botnets, and what we want to be able to do is find different types of trends that then can be able to translate into helping organizations fortify their environments. >> Peter: Alright, so here, this is the Q1, 2018, people can get access to it. >> Anthony: Yeah. >> What's the top line change? >> Anthony: Yeah, well at a high level, I think, you know, one the actual cyber criminals, they're evolving, their attack methodologies to be able to increase their, you know, success rate as well as being able to increase their infection rate. So that's one thing, you know, the other thing, obviously we always have to talk about ransomware. That, you know, seems to be a very hot threat these days for cyber criminals to make money. Now, that threat isn't going away. We did see a slight decrease though, where the adversaries were more interested in hijacking, you know, systems to be able to mine for crypto currencies as opposed to taking that machine hostage and demanding a ransome. >> Peter: Really? >> Anthony: Yeah, believe it or not. >> I'm a little bit, I mean ransomware just seems like it would have so much potential, and crypto currencies are, well they're interesting. Tell us a little bit about why that's happening. >> What seems to be the indicators? >> Yeah, well, you know, like I said, ransomware isn't going away, I think they're going to continue to use that to make money. But from a crypto jacking, you know, perspective, we did see the uptake last year in our Q4 report. It was about 13 percent of the organizations actually reported some type of crypto jacking attack. Fast forward to this report, and it nearly doubled. Actually, over doubled to, you know 28 percent, so that's about one in four organizations that are actually impacted with this particular threat. Now, what I think is interesting about this particular threat, is the way it evolves, right. 'Cause it's so new, it's always looking back at, its other successful, you know, predecessors to be able to determine how can I be more stealthy, and how can I get my, you know, malware, or my, you know, payload out to all the different sort of systems. So, you know, an example of that is phallus malware. Phallus malware is very stealthy. It's starting to use phallus malware techniques, it'll use scripts to inject their actual payload into memory, nothing on disc, so it makes it a lot more difficult to be able to detect. Now, how do I get my payload out to all the other, you know, workstations? Well, it takes a one two punch combination that, you know, Petya used last year. It's leveraging, um, there's this open source technology called, you know, minicats, steals different types of credentials and does something called pass the hash. Passes the hash credential out to those other systems, and then it gains access. That way it can actually pass the actual malware from system to system. If that fails, and then goes back to identifying different vulnerabilities that it could then exploit. One vulnerability it does looks for is eternal blue, which was a vulnerability that was so graciously given to us from shadow brokers. So those are the ways they're starting to be more effective and be more stealthy, and also being able to propagate a lot faster. >> Peter: And crypto currency obviously is one of the more extreme things because you take over the computer resources without necessarily stealing any data. You're just grabbing computer resources. >> Anthony: Yeah, what's interesting, I don't want to actually kind of go off topic here, but that' another conversation. Is crypto jacking actually a threat or not? Right, 'cause all it's really doing is stealing, you know, CPU resources, so, you know, so people say. So that's a whole 'nother discussion to actually get into is, is it actually really a threat or not? >> Well, you're able to get access to a computer, presumably you're able to get access not just for that purpose, but many others. >> Exactly. >> So that's probably an indication, you may have a problem. >> Yes, yes. >> Let's talk about ransomware. You said ransomware's not going away. Ransomware, most folks are familiar with it. What is it, what's the report suggest? >> You know Peter, did you realize that this month is the one year anniversary of WannaCry? Don't know if you remember that or not, but, you know, WannaCry was very infamous for, not necessarily the payload, but by the way that it actually was able to spread so fast and affect so many different machines. Now, that spreading, that worm-like spreading, kind of capability still exists here, you know. Today, you see a lot of different sort of threats using that, but what seems to be a bit different now is the combination of that ransomware payload along with more targeted attacks. >> Mm-hmm >> So, usually in a ransomware type of attack, you do some type of spammy campaign. You spam out that email, you know, and see what sticks. Well, these are more, a lot more targeted, so they're going to spend a lot more time doing, you know, reconnaissance on an organization and being able to find different vulnerabilities on the outside of the network. Once they actually come in, very methodical at how they're able to laterally move and put their actual malware on systems that they actually think, you know, well you know, however many systems they think they should actually have that particular malware on. Now, at this point, they hadn't actually executed you know, the actual payloads. So they have it on as many systems as possible, and once their ready (fingers snap). They flip the switch, and all those systems now are held hostage. That impact is much greater to the business. >> Peter: Now, when we think about the attacks, we think in terms of computing devices, whether it's a mobile device or PC device, or servers or what not, but are we seeing any changes in how people are attacking other computing resources within a network, hitting routers and other to try to drive more control over somebody's network resources? >> Well, I mean, we definitely see exploits that are actually hitting, you know, mobile devices, their hitting routers, um, a lot of IOT as well, but also web technology because, you know, web technology, there's so much external facing websites these days, you know, they're much easier targets. So we are seeing that. I would mention also that, it's up seven percent to 21 percent of organizations have actually reported mobile malware as well. >> And that is a especially difficult thing because your mobile applications are not just associated with a particular business, but other businesses as well. So you are both an employee and a consumer, and if your mobile applications get hit, that can have enormous ramifications on a number of different levels. >> Anthony: Yeah, absolutely, and I think sometimes, you know, in an organization where an actual consumer will have a phone, and they won't necessarily think it's the same as their workstation. So, it's like, oh, well not that much can happen on my mobile phone, right, not the same as on my workstation, but actually, it could be even worse. >> Peter: Yes, so if you think about some of the things that are on the horizon, you mention that we're seeing a greater utilization of different techniques to make money in some of the new domains, like jacking, uh, crypto jacking. >> Mm-hmm. >> Uh, there's still ransomware, still an issue, as folks go back and identify these different malware, these different security breaches, what are they doing to actually clean things up? Are we seeing folks actually cleaning up, or is there still just like, whack-a-mole, whacking things out, andt worrying about whether they go back and clean things up later? >> Anthony: Well, to basically answer your question, they are starting to actually kind of clean up, but, you know wait 'til you hear this, so what we try to do here, in this quarterly report, is we wanted to measure how quickly they were able to clean up that, you know, that particular threat. And what we found out, you know, we used botnet alerts. And we wanted to see how fast those botnet alerts actually got cleaned up. So what we were able to determine is 58 percent of all organizations, within 24 hours, were able to clean up that particular botnet infection. Which is actually pretty good. But, that 42 percent, it took them either two days or longer, you know, to be able to get that actual threat out. Actually, sometimes the threat really never even, you know, actually went away. Great example of that, is actually the Andromeda botnet. It's a threat that was brought down last year, but even though it's not there anymore, the infections on the workstations are still there, so we're still kind of getting those actual hits on that Andromeda botnet, and that actual threat >> for Q1, was one of the highest in prevalence and volume. >> Even if it wasn't necessarily doing damage, because we'd figured out how to deal with it, >> Right. >> but if it's there, somebody might find a way to use it again in the future. >> Absolutely, absolutely. >> So as we think about the next quarter, you doing this on every quarter, are there any particular areas that you think folks have to, they need to anticipate some of these changes, more of the same, different trends, or what about OT for example, as operational technology becomes increasingly part of that common technology fabric, how is that likely to be affected by some of these different attach types? >> In answer of your first question, I think we'll probably see a lot more of the same. And I think what we'll continue to see, you know there's this whole zero day market, I think it's getting more and more mature, meaning that we're going to see more and more vulnerabilities that are actually kind of zero day that have just been discovered or just been announced, and I think we're going to continue to see the adversaries take advantage of those newly discovered zero day vulnerabilities. You know, they'll take those actual, those exploits, you know, put 'em into their attack methodologies, to propagate faster and faster, so I think, organizations are going to have to make sure they can address some of those newly discovered vulnerabilities fairly quickly. Now, as we switch the, you know, the OT side, you know, we didn't see a lot of attacks if you look at the percentage of the overall attacks, however, you know, OT, if there is an actual successful attack, I think it's, you know, worth saying that it's >> a much larger impact, right. >> You have a major problem. >> You know, my concern is, these different types of trends that are coming together. One, OT is starting to connect to other networks, which means they're going to eventually be accessible from the internet, which makes it a lot more difficult to be able to protect. At the same time, we're seeing nation states continue to focus on compromising OT systems as well. So, I don't know what's going to happen in the coming months and years, but the trends aren't actually looking so good right now. >> So if you were to, if we had a CIO sitting here right now, and you were talking about this report, what are the, first off, how should they regard the information, what should they be doing differently as a result of the information that the reports are viewing? >> Yeah, I mean, I would say, one, we always talk about this, it's easier said than done, but you know, going back to the basics, and making sure that you have good cyber hygiene and being able to identify vulnerabilities that exist in your environment, and that, you know, me just saying that sounds kind of simple, but that really means identifying all the assets that you have in your environment that you're responsible for protecting, number one, and then being able to, you know, identify the vulnerabilities that may exist on those things. That's uh, it's not the easiest thing to do, but I think it's something that really should be focused on. At the same time though, threats are going to get into your network. That's just a, you know, that's a given. So being able to make sure that you can identify, you know, threats within your environment is extremely important, and then, once you identify them, what's the processes for you to go ahead and actually respond and clean up those particular threats? That really is going to be the key. I know it's at a high level, it's much deeper than that. But that's where you start. >> Alright, Anthony Giandomenico, Tony G, >> Tony G. >> thanks very much once again for being on theCUBE and talking to us about FortiGuard's Q1, 2018 report from Fortinet. >> Awesome, well thanks for having me. >> You betcha, so, Anthony Giandomenico (laughs) a senior strategist researcher at FortiGuard labs, Fortinet, talking to us about the 1Q 2018 report. Once again, this has been a CUBE Conversation thanks for listening. (vibrant music)

>> from our studios in the heart of Silicon Valley, Palo Alto, California It is a cute conversation. >> Well, the Special Cube conversation. We are here in Palo Alto, California, Cube studios here. Tony, Gino, Domenico, Who's the senior security strategist and research at for Net and four to guard labs live from Las Vegas. Where Black Hat and then Def Con security activities happening, Tony, also known as Tony G. Tony G. Welcome to this cube conversation. >> Hey, Thanks, John. Thanks for having me. >> So a lot of action happening in Vegas. We just live there all the time with events. You're there on the ground. You guys have seen all the action there. You guys are just published. Your quarterly threat report got a copy of it right here with the threat index on it. Talk about the quarterly global threats report. Because the backdrop that we're living in today, also a year at the conference and the cutting edge is security is impacting businesses that at such a level, we must have shell shock from all the breaches and threats they're going on. Every day you hear another story, another story, another hack, more breaches. It said all time high. >> Yeah, you know, I think a lot of people start to get numb to the whole thing. You know, it's almost like they're kind of throwing your hands up and say, Oh, well, I just kind of give up. I don't know what else to do, but I mean, obviously, there are a lot of different things that you can do to be able to make sure that you secure your cybersecurity program so at least you minimize the risk of these particular routes is happening. But with that said with the Threat Landscape report, what we typically dio is we start out with his overall threat index, and we started this last year. If we fast forward to where we are in this actual cue to report, it's been one year now, and the bad news is that the threats are continuing to increase their getting more sophisticated. The evasion techniques are getting more advanced, and we've seen an uptick of about 4% and threat volume over the year before. Now the silver lining is I think we expected the threat volume to be much higher. So I think you know, though it is continuing to increase. I think the good news is it's probably not increasing as fast as we thought it was going to. >> Well, you know, it's always You have to know what you have to look for. Blood. People talk about what you can't see, and there's a lot of a blind spot that's become a data problem. I just want to let people know that. Confined the report, go to Ford Nets, ah website. There's a block there for the details, all the threat index. But the notable point is is only up 4% from the position year of a year that the attempts are more sophisticated. Guys gotta ask you, Is there stuff that we're not seeing in there? Is there blind spots? What's the net net of the current situation? Because observe ability is a hot topic and cloud computing, which essentially monitoring two point. Oh, but you gotta be able to see everything. Are we seeing everything? What's what's out there? >> Well, I mean, I think us as Ford, a guard on Darcy, have cyber threat in challenges. I think we're seeing a good amount, but when you talk about visibility, if you go back down into the organizations. I think that's where there's There's definitely a gap there because a lot of the conversations that I have with organizations is they don't necessarily have all the visibility they need from cloud all the way down to the end point. So there are some times that you're not gonna be able to catch certain things now. With that said, if we go back to the report at the end of the day, the adversaries have some challenges to be able to break into an organization. And, of course, the obvious one is they have to be able to circumvent our security controls. And I think as a security community, we've gotten a lot better of being able to identify when the threat is coming into an organization. Now, on the flip side, Oh, if you refer back to the minor Attack knowledge base, you'll see a specific tactic category called defense evasions. There's about 60 plus techniques, evasion techniques the adversary has at their disposal, at least that we know may there may be others, but so they do have a lot of opportunity, a lot of different techniques to be able to leverage with that, said There's one technique. It's, ah, disabling security tools that we started seeing a bit of an increase in this last cue to threat landscape report. So a lot of different types of threats and mile where have the capability to be ableto one look at the different processes that may be running on a work station, identifying which one of those processes happen to be security tools and then disabling them whether they're no, maybe they might just be able to turn the no, the actual service off. Or maybe there's something in the registry that they can tweak. That'll disable the actual security control. Um, maybe they'll actually suppress the alerts whatever. They conduce you to make sure that that security control doesn't prevent them from doing that malicious activity. Now, with that said, on the flip side, you know, from an organization for perspective, you want to make sure that you're able to identify when someone's turning on and turning off those security control to any type of alert that might be coming out of that control also. And this is a big one because a lot of organizations and this certainly do this minimize who has the ability to turn those particular security controls on and off. In the worst cases, you don't wanna have all of your employees uh, the you don't want to give them the ability to be able to turn those controls on and off. You're never gonna be ableto baseline. You're never gonna be able to identify a, you know, anomalous activity in the environment, and you're basically gonna lose your visibility. >> I mean, this increase in male wearing exploit activity you guys were pointing out clearly challenge the other thing that the report kind of She's out. I want to get your opinion on this. Is that the The upping? The ante on the evasion tactics has been very big trend. The adversaries are out there. They're upping the ante. You guys, we're upping the guarantees. This game you continue this flight will continues. Talk about this. This feature of upping the ante on evasion tactics. >> Yes. So that's what I was that I was kind of ah, referring to before with all the different types of evasion techniques. But what I will say is most of the all the threats these days all have some type of evasion capabilities. A great example of this is every quarter. If you didn't know. We look at different types of actors and different types of threats, and we find one that's interesting for us to dig into and where create was called an actual playbook, where we want to be able to dissect that particular threat or those threat actor methodologies and be able to determine what other tactics and corresponding techniques, which sometimes of course, includes evasion techniques. Now, the one that we focused on for this quarter was called His Ego's Was Ego, says a specific threat that is an information stealer. So it's gathering information, really based on the mission goals off, whatever that particular campaign is, and it's been around for a while. I'm going all the way back to 2011. Now you might be asking yourself, Why did we actually choose this? Well, there's a couple different reasons. One happens to be the fact that we've seen an uptick in this activity. Usually when we see that it's something we want to dive into a little bit more. Number two. Though this is a tactic of the of the adversary, what they'll do is they'll have their threat there for a little while, and then local doorman. They'll stop using that particular malware. That's no specific sort of threat. They'll let the dust settle that things die down. Organizations will let their guard down a little bit on that specific threat. Security organizations Ah, vendors might actually do the same. Let that digital dust kind of settle, and then they'll come back. Bigger, faster, stronger. And that's exactly what Z ghosted is. Ah, we looked at a specific campaign in this new mall where the new and improved Mauer, where is they're adding in other capabilities for not just being able to siphon information from your machine, but they're also now can capture video from your webcam. Also, the evasion techniques since Iran that particular subject, what they're also able to do is they're looking at their application logs. Your system logs your security logs, the leading them making a lot more difficult from a forensic perspective. Bill, go back and figure out what happened, what that actual malware was doing on the machine. Another interesting one is Ah, there. We're looking at a specific J peg file, so they're looking for that hash. And if the hash was there the axle? Um, our wouldn't run. We didn't know what that was. So we researched a little bit more on What we found out was that J Peg file happened to be a desktop sort of picture for one of the sandboxes. So it knew if that particular J pick was present, it wasn't going to run because it knew it was being analyzed in a sandbox. So that was a second interesting thing. The 3rd 1 that really leaned us towards digging into this is a lot of the actual security community attribute this particular threat back to cyber criminals that are located in China. The specific campaign we were focused on was on a government agency, also in China, So that was kind of interesting. So you're continuing to see these. These mile wears of maybe sort of go dormant for a little bit, but they always seem to come back bigger, faster, stronger. >> And that's by design. This is that long, whole long view that these adversaries we're taking in there as he organized this economy's behind what they're doing. They're targeting this, not just hit and run. It's get in, have a campaign. This long game is very much active. Howto enterprises. Get on, get on top of this. I mean, is it Ah, is it Ah, people process Issue is it's, um, tech from four to guard labs or what? What's what's for the Nets view on this? Because, I mean, I can see that happening all the time. It has >> happened. Yeah, it's It's really it's a combination of everything on this combination. You kind of hit like some of it, its people, its processes and technology. Of course, we have a people shortage of skilled resource is, but that's a key part of it. You always need to have those skills. Resource is also making sure you have the right process. Is how you actually monitoring things. I know. Ah, you know, a lot of folks may not actually be monitoring all the things that they need to be monitoring from, Ah, what is really happening out there on the internet today? So making sure you have clear visibility into your environment and you can understand and maybe getting point in time what your situational awareness is. You you, for my technology perspective, you start to see and this is kind of a trend. We're starting the leverage artificial intelligence, automation. The threats are coming, and it's such a high volume. Once they hit the the environment, instead of taking hours for your incident response to be about, at least you know not necessarily mitigate, but isolate or contain the breach. It takes a while. So if you start to leverage some artificial intelligence and automatic response with the security controls are working together. That's a big that's a big part of it. >> Awesome. Thanks for coming. This is a huge problem. Think no one can let their guard down these days? Certainly with service, they're expanding. We're gonna get to that talk track in the second. I want to get quickly. Get your thoughts on ransom, where this continues to be, a drum that keeps on beating. From a tax standpoint, it's almost as if when when the attackers need money, they just get the same ransomware target again. You know, they get, they pay in. Bitcoin. This is This has been kind of a really lucrative but persistent problem with Ransomware. This what? Where what's going on with Ransomware? What's this state of the report and what's the state of the industry right now in solving that? >> Yeah. You know, we looked into this a little bit in last quarter and actually a few quarters, and this is a continuous sort of trend ransom, where typically is where you know, it's on the cyber crime ecosystem, and a lot of times the actual threat itself is being delivered through some type of ah, phishing email where you need a user to be able to click a langur clicking attachment is usually kind of a pray and spray thing. But what we're seeing is more of ah, no sort of ah, you know, more of a targeted approach. What they'll do is to look for do some reconnaissance on organizations that may not have the security posture that they really need. Tohave, it's not as mature, and they know that they might be able to get that particular ransomware payload in there undetected. So they do a little reconnaissance there, And some of the trend here that we're actually seeing is there looking at externally RTP sessions. There's a lot of RTP sessions, the remote desktop protocol sessions that organizations have externally so they can enter into their environment. But these RTP sessions are basically not a secure as they need to be either week username and passwords or they are vulnerable and haven't actually been passed. They're taking advantage of those they're entering and there and then once they have that initial access into the network, they spread their payload all throughout the environment and hold all those the those devices hostage for a specific ransom. Now, if you don't have the, you know, particular backup strategy to be able to get that ransom we're out of there and get your your information back on those machines again. Sometimes you actually may be forced to pay that ransom. Not that I'm recommending that you sort of do so, but you see, or organizations are decided to go ahead and pay that ransom. And the more they do that, the more the adversary is gonna say, Hey, I'm coming back, and I know I'm gonna be able to get more and more. >> Yeah, because they don't usually fix the problem or they come back in and it's like a bank. Open bank blank check for them. They come in and keep on hitting >> Yeah >> same target over and over again. We've seen that at hospitals. We've seen it kind of the the more anemic I t department where they don't have the full guard capabilities there. >> Yeah, and I would have gone was really becoming a big issue, you know? And I'll, uh, ask you a question here, John. I mean, what what does Microsoft s A N D. H s have in common for this last quarter? >> Um, Robin Hood? >> Yeah. That attacks a good guess. Way have in common is the fact that each one of them urged the public to patch a new vulnerability that was just released on the RTP sessions called Blue Keep. And the reason why they was so hyped about this, making sure that people get out there and patch because it was were mobile. You didn't really need tohave a user click a link or click and attachment. You know, basically, when you would actually exploit that vulnerability, it could spread like wildfire. And that's what were mobile is a great example of that is with wannacry. A couple years ago, it spread so quickly, so everybody was really focused on making sure that vulnerability actually gets patched. Adding onto that we did a little bit of research on our own and ransom Internet scans, and there's about 800,000 different devices that are vulnerable to that particular ah, new vulnerability that was announced. And, you know, I still think a lot of people haven't actually patched all of that, and that's a real big concern, especially because of the trend that we just talked about Ransomware payload. The threat actors are looking at are Rdp as the initial access into the environment. >> So on blue Keep. That's the one you were talking about, right? So what is the status of that? You said There's a lot of vulnerable is out. There are people patching it, is it Is it being moving down, the down the path in terms of our people on it? What's your take on that? What's the assessment? >> Yeah, so I think some people are starting to patch, but shoot, you know, the scans that we do, there's still a lot of unpacked systems out there, and I would also say we're not seeing what's inside the network. There may be other RTP sessions in the environment inside of an organization's environment, which really means Now, if Ransomware happens to get in there that has that capability than to be able to spread like the of some RTP vulnerability that's gonna be even a lot more difficult to be able to stop that once it's inside a network. I mean, some of the recommendations, obviously, for this one is you want to be able to patch your RTP sessions, you know, for one. Also, if you want to be able to enable network authentication, that's really gonna help us. Well, now I would also say, You know, maybe you want a hard in your user name and passwords, but if you can't do some of this stuff, at least put some mitigating controls in place. Maybe you can isolate some of those particular systems, limit the amount of AH access organizations have or their employees have to that, or maybe even just totally isolated. If it's possible, internal network segmentation is a big part of making sure you can. You're able to mitigate some of these put potential risks, or at least minimize the damage that they may cause. >> Tony G. I want to get your thoughts on your opinion and analysis expert opinion on um, the attack surface area with digital and then ultimately, what companies can do for Let's let's start with the surface area. What's your analysis there? Ah, lot of companies are recognizing. I'll see with Coyote and other digital devices. The surface area is just everywhere, right? So I got on the perimeter days. That's kind of well known. It's out there. What's the current digital surface area threats look like? What's your opinion? >> Sure, Yeah, it's Ah, now it's funny. These days, I say no, Jenna tell you everything that seems to be made as an I P address on it, which means it's actually able to access the Internet. And if they can access the Internet, the bad guys can probably reach out and touch it. And that's really the crux of the problem of these days. So anything that is being created is out on the Internet. And, yeah, like, we all know there's really not a really rigid security process to make sure that that particular device as secure is that secure as it actually needs to be Now. We talked earlier on about You know, I ot as relates to maybe home routers and how you need to be ableto hard in that because you were seeing a lot of io teapot nets that air taking over those home routers and creating these super large I ot botnets on the other side of it. You know, we've seen ah lot of skate of systems now that traditionally were in air gapped environments. Now they're being brought into the traditional network. They're being connected there. So there's an issue there, but one of the ones we haven't actually talked a lot about and we see you're starting to see the adversaries focus on these little bit more as devices in smart homes and smart buildings in this queue to threat landscape report. There was a vulnerability in one of these you motion business management systems. And, you know, we looked at all the different exploits out there, and the adversaries were actually looking at targeting that specific exploit on that. That's smart management building service device. We had about 1% of all of our exploit, uh, hits on that device. Now that might not seem like a lot, but in the grand scheme of things, when we're collecting billions and billions of events, it's a fairly substantial amount. What, now that we're Lee starts a kind of bring a whole another thought process into as a security professional as someone responds double for securing my cyber assets? What if I include in my cyber assets now widen include all the business management systems that my employees, Aaron, for my overall business. Now that that actually might be connected to my internal network, where all of my other cyber assets are. Maybe it actually should be. Maybe should be part of your vulnerability mentioned audibly patch management process. But what about all the devices in your smart home? Now? You know, all these different things are available, and you know what the trend is, John, right? I mean, the actual trend is to work from home. So you have a lot of your remote workers have, ah, great access into the environment. Now there's a great conduit for the obvious areas to be ableto break into some of those smart home devices and maybe that figure out from there there on the employees machine. And that kind of gets him into, you know, the other environment. So I would say, Start looking at maybe you don't wanna have those home devices as part of, ah, what you're responsible for protecting, but you definitely want to make sure your remote users have a hardened access into the environment. They're separated from all of those other smart, smart home devices and educate your employees on that and the user awareness training programs. Talk to them about what's happening out there, how the adversaries air starting to compromise, or at least focus on some of them smart devices in their home environment. >> These entry points are you point out, are just so pervasive. You have work at home totally right. That's a great trend that a lot of companies going to. And this is virtual first common, a world. We build this new new generation of workers. They wanna work anywhere. So no, you gotta think about all that. Those devices that your son or your daughter brought home your husband. Your wife installed a new light bulb with an I peed connection to it fully threaded processor. >> I know it. Gosh, this kind of concern me, it's safer. And what's hot these days is the webcam, right? Let's say you have an animal and you happen to go away. You always want to know what your animals doing, right? So you have these Webcams here. I bet you someone might be placing a webcam that might be near where they actually sit down and work on their computer. Someone compromises that webcam you may be. They can see some of the year's name and password that you're using a log in. Maybe they can see some information that might be sensitive on your computer. You know, it's the The options are endless here. >> Tony G. I want to get your thoughts on how companies protect themselves, because this is the real threat. A ni O t. Doesn't help either. Industrial I ot to just Internet of things, whether it's humans working at home, too, you know, sensors and light bulbs inside other factory floors or whatever means everywhere. Now the surface area is anything with a knife he address in power and connectivity. How do companies protect themselves? What's the playbook? What's coming out of Red hat? What's coming out of Fort Annette? What are you advising? What's the playbook? >> Yeah, you know I am. You know, when I get asked this question a lot, I really I sound like a broken record. Sometimes I try to find so many different ways to spin it. You know, maybe I could actually kind of say it like this, and it's always means the same thing. Work on the fundamentals and John you mentioned earlier from the very beginning. Visibility, visibility, visibility. If you can't understand all the assets that you're protecting within your environment, it's game over. From the beginning, I don't care what other whiz bang product you bring into the environment. If you're not aware of what you're actually protecting, there's just no way that you're gonna be able to understand what threats are happening out your network at a higher level. It's all about situational awareness. I want to make sure if I'm if I'm a C so I want my security operations team to have situational awareness at any given moment, all over the environment, right? So that's one thing. No grabbing that overall sort of visibility. And then once you can understand where all your assets are, what type of information's on those assets, you get a good idea of what your vulnerabilities are. You start monitoring that stuff. You can also start understanding some of different types of jabs. I know it's challenging because you've got everything in the cloud all the way down to the other end point. All these mobile devices. It's not easy, but I think if you focus on that a little bit more, it's gonna go a longer way. And I also mentioned we as humans. When something happens into the environment, we can only act so fast. And I kind of alluded to this earlier on in this interview where we need to make sure that we're leveraging automation, artificial in intelligence to help us be able to determine when threats happened. You know, it's actually be in the environment being able to determine some anomalous activity and taking action. It may not be able to re mediate, but at least it can take some initial action. The security controls can talk to each other, isolate the particular threat and let you fight to the attack, give you more time to figure out what's going on. If you can reduce the amount of time it takes you to identify the threat and isolate it, the better chances that you're gonna have to be able to minimize the overall impact of that particular Reno. >> Tony, just you jogging up a lot of memories from interviews I've had in the past. I've interviewed the four star generals, had an essay, had a cyber command. You get >> a lot of >> military kind of thinkers behind the security practice because there is a keeping eyes on the enemy on the target on the adversary kind of dialogue going on. They all talk about automation and augmenting the human piece of it, which is making sure that you have as much realty. I'm information as possible so you can keep your eyes on the targets and understand, to your point contextual awareness. This seems to be the biggest problem that Caesar's heir focused on. How to eliminate the tasks that take the eyes off the targets and keep the situational winners on on point. Your thoughts on that? >> Yeah, I have to. You know what, son I used to be? Oh, and I still do. And now I do a lot of presentations about situational awareness and being ableto build your you know, your security operations center to get that visibility. And, you know, I always start off with the question of you know, when your C so walks in and says, Hey, I saw something in the news about a specific threat. How are we able to deal with that? 95% of the responses are Well, I have to kind of go back and kind of like, you don't have to actually come dig in and, you know, see, and it takes them a while for the audio. >> So there's a classic. So let me get back to your boss. What? Patch patch? That, um Tony. Chief, Thank you so much for the insight. Great Congressional. The Holy Report. Keep up the good work. Um, quick, Quick story on black hat. What's the vibe in Vegas? Def con is right around the corner after it. Um, you seeing the security industry become much more broader? See, as the industry service area becomes from technical to business impact, you starting to see that the industry change Amazon Web service has had an event cloud security called reinforce. You starting to see a much broader scope to the industry? What's the big news coming out of black at? >> Yeah, you know, it's it's a lot of the same thing that actually kind of changes. There's just so many different vendors that are coming in with different types of security solutions, and that's awesome. That is really good with that, said, though, you know, we talked about the security shortage that we don't have a lot of security professionals with the right skill sets. What ends up happening is you know, these folks that may not have that particular skill, you know, needed. They're being placed in these higher level of security positions, and they're coming to these events and they're overwhelmed because they're all they'll have a saw slight. It's all over a similar message, but slightly different. So how did they determine which one is actually better than the others? So it's, um, I would say from that side, it gets to be a little bit kind of challenging, but at the same time, No, I mean, we continued to advance. I mean, from the, uh, no, from the actual technical controls, solutions perspective, you know, You know, we talked about it. They're going, we're getting better with automation, doing the things that the humans used to do, automating that a little bit more, letting technology do some of that mundane, everyday kind of grind activities that we would as humans would do it, take us a little bit longer. Push that off. Let the actual technology controls deal with that so that you can focus like you had mentioned before on those higher level you know, issues and also the overall sort of strategy on either howto actually not allow the officer to come in or haven't determined once they're in and how quickly will be able to get them out. >> You know, we talked. We have a panel of seashells that we talk to, and we were running a you know, surveys through them through the Cube insights Most see says, we talk Thio after they won't want to talk off the record. I don't want anyone know they work for. They all talked him. They say, Look, I'm bombarded with more and more security solutions. I'm actually trying to reduce the number of suppliers and increase the number of partners, and this is nuanced point. But to your what you're getting at is a tsunami of new things, new threats, new solutions that could be either features or platforms or tools, whatever. But most si SOS wanna build an engineering team. They wanna have full stack developers on site. They wanna have compliance team's investigative teams, situational awareness teams. And they want a partner with with suppliers where they went partners, not just suppliers. So reduce the number suppliers, increase the partners. What's your take on that year? A big partner. A lot of the biggest companies you >> get in that state spring. Yeah. I mean, that's that's actually really our whole strategy. Overall strategy for Ford. Annette is, and that's why we came up with this security fabric. We know that skills are really not as not as prevalent as that they actually need to be. And of course, you know there's not endless amounts of money as well, right? And you want to be able to get these particular security controls to talk to each other, and this is why we built this security fabric. We want to make sure that the controls that we're actually gonna build him, and we have quite a few different types of, you know, security controls that work together to give you the visibility that you're really looking for, and then years Ah, you know, trusted partner that you can actually kind of come to And we can work with you on one identifying the different types of ways the adversaries air moving into the environment and ensuring that we have security controls in place to be able to thwart the threat. Actor playbook. Making sure that we have a defensive playbook that aligns with those actual ttp is in the offensive playbook, and we can actually either detect or ultimately protect against that malicious activity. >> Tony G. Thanks for sharing your insights here on the cube conversation. We'll have to come back to you on some of these follow on conversations. Love to get your thoughts on Observe ability. Visibility on. Get into this. What kind of platforms are needed to go this next generation with cloud security and surface area being so massive? So thanks for spending the time. Appreciate it. >> Thanks a lot, Right. We only have >> a great time in Vegas. This is Cube conversation. I'm John for here in Palo Alto. Tony G with Fortinet in Las Vegas. Thanks for watching

from our studios in the heart of Silicon Valley Palo Alto California this is a cute conversation welcome to the cube studios for another cube conversation where we go in-depth with thought leaders driving business outcomes with technology I'm your host Peter Burris every Enterprise that is trying to do digital transformation finds themselves facing two challenges one their digital assets themselves are a source of value and to other assets that are sources of value are becoming increasingly digitized and that creates a lot of challenges a lot of security concerns that bad agents out in the internet are exploiting and requires a programmatic fundamental response to try to ensure that the digital assets or digitized assets aren't mucked with by bad guys so to have that conversation we're here with Tony Jian Domenico Tony's a senior security strategist and a researcher and the CTI lead at Ford NIT Tony welcome back to the cube hey Pete it's great to be here man so as you get to see you yeah well we've been doing this for a couple of years now Tony and so let's get just kick it off what's new so what's new should we start talking about a little bit about the index here what we saw with the overall threat landscape sure well cool so you know y'all like you know like we always do we always like to start off with an overall threat landscape at least they give an overview of what that index looks like and it really consists of malware botnets application exploits and what we looked at over the quarter there was a lot of volatility throughout the quarter but at the end of the day it ended up only 1% higher than the quarter before now some of that volatility really is being driven by what we've talked about a lot of times Peter and a lot of these other episodes is that swarm like activity whenever an actual vulnerability is successfully exploited by an adversary everybody swarms in on that vulnerability and our fertig are labs you see that really like super spike up a great example of that would be in the last year in December think PHP which is an application that's a framework to rapidly develop web apps they had a vulnerability that if you successfully exploited it it would give you remote the remote access or I'm sorry remote code execution and they were exploiting that and we definitely seen a huge uptick now that wasn't the only one for the quarter but that and along with some of the other ones it's really what's kind of driving on volume so the index has been around for a few quarters now and it's a phenomenal way for folks out there to observe how overall trends are evolving but as you said one of the key things that's being discovered is that or you're discovering as you do this research is this notion of swarming it seems as though there ought to be a couple of reasons why that's the case Tony it's it's we've talked about this in the past there's folks who want to get a little bit more creative in creating bad stuff and there's other folks who just want to keep the cost low and just leverage what's out there which approach are the bad guys tend to using more and or is there an approach one of the other approach is more targeted to one or another kind of attack well it's funny you usually see the folks in the cyber crime ecosystem that are really focusing on you know identifying them not so much where they're doing more sort of targeted attacks it's more of a you know pray and spray you know type of thing and you see a lot of that you know anytime they can hire you can get a life of cybercrime right in the leverage some of these common you know you know services you have code reuse you know which is out there so you have that sort of like group there right and then you have more of the you know more of the you know hands-on sort of keyboard the more you know targeted attacks that are really focused on specific you know victims so you have those you know those two groups I say now with that though there kind of is a commonality there where there's this concept and it's nothing new we've been talking about this for years in the cybersecurity industry it's living off the land right where once a victim is on the actual machine itself they start leveraging some of the tools that are already available there and usually these tools their administration tools to be able to minister the actual network but these tools can also be used in the farías ways from example here would be you know PowerShell they you know a lot of admins use PowerShell for efficiencies on the network but that also can be used in the forest ways and the bad guys are using that and then this past quarter you know we did see a lot of PowerShell activity now you know Peter having said that though I think as a whole with the security community we're getting better at being able to identify these types of PowerShell attacks one we got better technology on the endpoint and I think to Microsoft is in a better job of being able to provide us more hardening capabilities for PowerShell like being able to restrict access to PowerShell as well as giving us better logging capability to be able to identify that malicious activity so we are getting better and the bad guys know this so I think what we can probably look for in the future is them leveraging either a different interface or different language because all they really need to do is interface with that dotnet framework which is part of a Windows system and they can start doing the same exact things they were doing with PowerShell and we're seeing that it in the open-source community now things like Silent Trinity open source tool that allows you to do those same things so for C an open source pretty much guarantee we're gonna see it out there in the wild here soon so we've got a group of bad actors that are using this living off the land approach to leverage technology that's out there and we've still got kind of the big guys having to worry about being targeted because you know that's how you make a lot of money if you're successful but it certainly does sound is that a general business practice for a lot of these guys is to leverage common infrastructure and that this common infrastructure is increasingly becoming you know better understood have I got that right no I you know Peter you're spot-on here what we did we did some exploratory research in this last quarter and what we found out is with the exploits within that quarter or or or the axe will come threats sixty percent of those threats are using the same infrastructure what I mean by infrastructure you know I I mean things like you know infrastructure to download malware maybe to redirect you to some other site and then downloads malware and that makes a lot of sense Peter you know why because in this cybercrime ecosystem if you didn't realize this it's a vicious competitive market everybody is trying to sell their wares and they want to make sure that their service is the best it's better than someone else's and they want to make sure that it's stable so they find these you know community you know infrastructures that are tried-and-true you know some of them are from you know bulletproof hosting so you know services you know things of that nature so you see a lot of the folks in a cybercrime ecosystem using them now on the flip side though you definitely see some of the thread actors that are more sort of you know more the advanced threat actors maybe what they want to do is hide a little bit so they'll hide in that larger community to be able to possibly be able to bypass that that attribution back to them because they don't want to be sort of labeled with oh hey this particular thread actor always uses this infrastructure so if they can blend in a lot harder to find them so they can use what is available but at the same time differentiate themselves in this bad actor ecosystem to take on even more challenging the potentially lucrative exploits now tell me if we know something about this common infrastructure as you said sixty percent of these attacks are using this common infrastructure that suggests we can bring a common set of analysis frameworks to bear as we consider who these actors are and what their practices are have I got that right yeah yeah absolutely if you can align your PlayBook defenses with the offensive actual playbook that the threat actors are using they're better off you're gonna be right because then you can be able to combat them a lot better and as a matter of fact I mean we've kind of introduced this sort of concept in conjunction with our our partnership with the cyber threat Alliance we're actually producing these thread actor play books you know and what we're doing is the idea behind this is if we can identify the malicious activity the threat actors are actually doing to complete their cyber mission expose some of them tactics those techniques those procedures we could possibly disrupt some of that malicious activity and you know this past this past quarter here we focused on a group you know Peter called the the silence group and they're really focused on identifying and stealing financial data they're looking at banks banking infrastructure and ATM machines and you'll get a kick out of this with the ATM machines they're doing something called jackpot II where they if they can find the axle software behind the ATM machine find that ATM process they can inject a malicious DLL into that process giving them total control over the ATM machine and now they can dispense money at will and they can have these money mules on the other side receive that actual money so you know we have a lot of different campaigns in play books that we've identified on our website and that once we understand that we align that with our security fabric and ensure that our customers are protected against that particular playbook Tony I'm not happy to hear that so this is this is my distressed face that I use during these types of interviews but it's if if we're able to look at how bad guy play books are operating then we ought to be able to say and what are those fundamentals that a shop should be using the security professionals should be using that are just you know so basic and so consistent and it seems that are you guys have identified three to do a better job of taking a fabric approach that starts to weave together all assets into a more common security framework to to do a better job of micro and macro segmentation so that you can identify where problems are and then finally increase your overall use of automation with AI and m/l how is this translating into your working with customers as they try to look at these playbooks and apply their own playbooks for how they set up their response regimes yeah so I mean I think overall I mean I think you can hit it on the head computer you kind of nailed down really those some it was kind of fundamental sort of concepts here now you can identify and you can document as many playbooks as you want but if you're not able to quickly respond when you identify those actual playbooks you know that's really half the battle I mean if you need to be able to identify you know one not only when the threat actors in your environment but then also you need to be able to quickly you know take action and like you were saying with that fabric if we can have that actual fabric being able to talk to the other controls within that fabric and take some action they're better off you're gonna be because you can align your defenses there and that's a great would you gotta make sure that all the controls within that fabric are all communicating together they're working together they're sharing information and they're responding together sure enough yeah are you starting to advise customers I'm curious you advising customers that even as they increase the capabilities of their fabric and how they handle their architectures from a micro macro segmentation and increase their use of automation or are there things that they can do from a practice standpoint just to ensure that their responses are appropriate fast and accurate yeah sure sure I mean I think a lot of the actual fabric once you actually build that fabric there's certain you know playbook responses that you can program into that fabric and I'll also even go I know we talked about you know fundamentals but I'll even dive a little bit lower here and you know you have that fabric but you also have to make sure you understand all the assets you have in your in you know your environment because that that information and that knowledge helps you with that macro and micro segmentation because when you can isolate you know different areas if there is a certain area that gets infected you can quickly turn the knobs to isolate that particular threat and that specific you know area or that's a specific segmented area and that is really gonna allow you to fight through the attack give you more time and ultimately reduce the impact of that particular breach so Tony we got the summer months coming up that means more vacations which is you jest less activity but then we got summer interns coming in which you know may involve additional clicking on things that shouldn't be clicked on any ideas what what should security pros be thinking about in the summer months what's the trend show well I think we're gonna continue to see that you know I I think the same type of threats that we've seen in the first quarter but I would say you know there may be a slight sort of drop-off right we got kind of kids that are gonna be out on vacation so you know schools may not see as much activity you got you know folks gonna be taking vacations and at the end of the day most of these exploits are client-side exploits which means you know a lot of times you need somebody to do something on the actual computer either you know clicking that link or clicking the attachment and if they're not there to do that they'll just sit there and you'll see less activity over time so we might see a little reduction in volume but I still think we'll see very similar types of you know threats in the coming months so good time good time are a good opportunity for security pros to double down on putting in place new architecture practices and response regime so that when stuff kicks up in the fall they're that much more prepared da Tony G on Domenico fort Ned great once again thanks very much for being on the cube hey you know Peter it's always a pleasure being here man hope to see you again soon you will and once again I'm Peter Burroughs until next time [Music]

(dramatic string music) >> Hi I'm Peter Burris and welcome to another theCUBE Conversation from our outstanding studios here in beautiful Palo Alto, California. Like all our CUBE Conversations, we've got a great one today. In this one we're going to talk about some of the trends that people are experiencing in the world of security and threats. And to have that conversation, we've got Tony Giandomenico who's a senior security strategist researcher at Fortinet's FortiGuard Labs. Tony welcome back to theCUBE. >> Hey Peter, how ya doin' man? It's great to be here. >> It's great to see you again Tony. Look, we've had this conversation now for at least four quarters and FortiGuard Labs has published their overall threat analysis for at least the past couple of years and that's what we're going to talk about today. So, give us a little bit of overview of what this report entails. Where does the data come from and how are you using it within Fortinet and FortiGuard Labs? >> Sure, sure, well, so this is a quarterly threat landscape report, right? So obviously, we do it on a quarterly basis and it's really geared towards the IT security professional from the CSO all the way down to, you know, the folks that are actually in the operations, you know, the daily operations. And we're getting billions of events that we're observing in real time production environments and we're looking specifically at application exploits, we're looking at malware, we're looking at botnets, and we hope to be able to identify different trends and then maybe able to translate into that IT security professional to be able to figure out where they should be focusing their security efforts. >> Yeah, and I think that's an important issue because you can't know what you should do next if you don't know what's happening right now or what has happened recently. But you've tried to provide, let's call a more general flavor to the report this year in the sense that you've introduced some indices that shows trends over time. Talk to us a little bit about that. >> Sure yeah, so last quarter we finally introduced what's referred to as our threat index. And what we were trying to do is be able track the ebbs and flows of threats over time and like you know, we always break down our exploits or our threats into application exploits, malware and botnets, so each one of them also have their individual index. Now, although there was some peaks and valleys and application exploits did hit an all-time high, at the end of the quarter, it ended up around the same the threat index did as last quarter, and I think a lot of that may be actually driven by the holiday season. Now, if I had a crystal ball, I would've probably think that the future quarters, the threat index is probably going to continue to increase. >> And I think that there's a couple reasons for that, right? When you say it's the holiday quarter, the overall threat index goes down because as people spend time home for the holidays, take vacation, little less time at work, they're opening fewer malicious files from fewer unknown sources or bad websites. But I think you've made the point multiple times that just because they're not opening a bad file in an email attachment right now, doesn't mean that they're not going to open it when they get back from work. >> Yeah, that is definitely true, but you know what? Maybe they are more focused and they'll be more attentive to looking at their email. I will also say, the bad guys need a break too, right? So, when a holiday season comes around, I mean, they're going to probably slow down some of their malware and some of their exploits and you know, just kind of enjoy the holidays. >> (laughs) Good for them. All right, so let's take a look at each of the different areas. The overall threat index is comprised of, as you said, the application exploits, malware and botnets. So, let's take them one at each. What did we see in the threat index as it pertains to application exploits? What were the big trends? >> Well, of the top 12, six of them, you know Peter, do you know what, the six exploits we're focusing on for the top 12, any idea? >> I read the report so yes, but tell us. >> Okay, yes, IOT. Now, that's not like extremely interesting because we continue to see that a quarter over quarter the adversaries are targeting more on the IOT device, which makes sense, right? I mean, there's a lot of them out there, the volume is there, and of course, they're not as secure as they typically need to be. But what's interesting though, out of those six, four of them happen to be IP cameras, right? So, these monitoring devices that are monitoring your physical security, the adversaries are targeting those a little bit more because they understand that this cyber world and the physical security, they're combining, and when they're combining, if you're bringing over a physical security device that already has vulnerabilities, you're bringing that vulnerability with you, and that would just open up an opportunity for the adversary to be able to penetrate into that particular device and then get access to your internal network. >> Yeah, let me ask you a question Tony because I was very interested in the incidents related to cameras because cameras is kind of one of those domains, one of those technologies, one of those use cases that is somewhere between the old OC world or the OT world, the operational technology world and the IT world or the IOT world where in the OT world folks have spent an enormous amount of time making sure that the devices that they utilize are as secure as they possibly can be. I mean, they've got huge teams devoted to this. In the IOT world, we're working on speed, we're working on software defined, we're working on a little bit more generalization. But this notion of cameras just kind of coming in from an IOT side but hitting the OT side, is that one of the reasons why cameras in particular are vulnerable? And does that tell us something about how IT and OT have to work together based on the data that we're seeing in the report? >> Yeah, I mean, I would totally agree, right? Because a lot of those different types of technologies have been isolated, meaning that not everybody had the ability to reach out and touch it, maybe security, you know, wasn't top of mind here, but now that convergence is taking place, it's really top priority to make sure that if you are merging those things together, make sure that those devices are part of your threat and vulnerability management process 'cause now vulnerabilities that may actually be introduced from that particular device can affect your entire cyber assets. >> Yeah, I think it's a great point. The cheap, what one might regard as constrained devices, nonetheless have an awesome processing power and if they're connected can enormous implication. Okay, let's move from the application exploits into the malware world. What was the big trend in malware in this past report? >> Sure, sure, yeah, so what we continue to see, and I think this is great, sharing information, sharing threat information, sharing malware samples, is awesome and we've been doing it for a long time and we continue to see more and more of public available sources for showing exploits, for showing malware, you know, open source malware and that's great because as a cyber defender, it's great that I can research this and I can ensure that I have the right detections and ultimately the right protections against those particular threats. I would also add that we have such a skill shortage, right? I mean, we're trying to build up our future cyber warriors and the way we want to be able to do that obviously is through a lot of training and we can give them great examples that they can actually glean and learn from. And so all of this is good but at the same time, when you have all this information out there, you know, freely available, of course, the adversaries have access, they have access to it as well. So, what that means is, I'll give you an example, Peter. You'll download, let's say there's open source malware that's ransomware. You can download that, modify the bitcoin address of where that victim is supposed to send the ransom, and you just operationalized this ransomware. But then again, you might be saying well, you know, you just said that it's available for us to be able to research and have better detections and you're right, most of the time we'll detect that. But now, you add in the fact that there's a whole bunch of open source evasion tools that you can run your malware through that would obfuscate possibly the malware enough that it can circumvent some of the actual security controls that you have in place. So, it's a good thing but we do continue to see some of the bad guys leverage it as well. >> So, let me see if I can put that in the context of some overall industry trends. Historically, the things that got the greatest install base were the targets that were preferred by bad actors because they could do the most damage in those large numbers and open source, as we improve these toolings, we see more people flock to that set of tools and as those tools become more popular, they both have more value to the enterprise as a protection, but they become increasingly obvious targets to the bad actors. Is that kind of what you're saying? >> Yeah sure, it's almost like the cybercrime ecosystem, the actual tools that are available, the services that are available at your fingertips, no longer do you need to be an expert. Begin a life of cybercrime, you just need to know where to get these resources and that is what's really driving the volume of attacks these days, so you're absolutely right, Peter. >> So, we've talked a little bit about application exploitation, we've talked a little about malware, now these are things that we look at before the system gets compromised. We're really concerned about avoiding them getting a footprint or hold within our system. Now, let's talk about botnets, which are particularly interesting because often the botnet gets turned on and becomes a source of danger after the compromises take place. What do trends in botnets tell us? >> Sure, sure, yeah, so one interesting point in botnets in quarter four was the fact that the initial botnet infections per firm was up 15% from the quarter before, so what that means is, on average, each firm saw about 12 botnet infections for that quarter and that kind of translates into, out of maybe the 91 days that you have in that quarter, 12 of those days, they actually had some type of botnet infection that they had to actually respond to, right? 'Cause they got to respond. Like you said Peter, the infection's already there, somehow the payload circumvented their security defenses, it's on there and it's trying to communicate out to it's command and control infrastructure, whether it's to download other malware, whether it's to actually possibly provide different types of commands to execute their cyber mission, whatever it is, it's there, and that's where we were sort of triggering on it. And I'll add to this, because of this, you got to invoke your instant response process, which means you're taking time, you're taking resources away for folks that are probably working on other projects to be able to help them fortify their overall security program more, which I think underscores the need to be able to ensure that you're leveraging technology to help you make some of these automated decisions, with being able to prevent and ultimately, hopefully, be able to remediate those threats. >> Yeah, so we've seen application exploits down a little bit, malware down a little bit, largely because the fourth quarter's a holiday quarter. We've seen botnets also follow those trends but still we have to be concerned about the number of net new days in which a botnet is operating. Is there something that we started to see in the data that requires new thinking, new approaches? What about all these memes that people are downloading, for example? >> (laughs) Yeah, I tell ya, you know social media, right? Love pictures. You know, whether it's Facebook, whether it's Twitter, you know, Instagram, words are good, but what's even better it seems is pictures. People love pictures and adversaries know that, so with an attack called leveraging steganography, I think I spoke about that a couple, maybe it was last year, you know sometime, we talked about that, but if you don't remember, steganography is really the art of hiding something in a picture file, whether it was a message, whether it was a malicious payload or it could even be different types of commands that the adversary wants to do to overall be able to complete their cyber mission, so they hide that information in there. And the adversaries to be able to attack or leverage a steganography attack, they're used in social media as a means of that communication. And what's interesting about that is nowadays, you know, maybe 10 years ago, not as much, but nowadays, social media traffic and apps are kind of acceptable on a network these days, right? The marketing organizations' comms and PR, they leverage these social media sites. It's a key part of their overall plan, so you're going to see a lot of social media traffic in the network, so the adversary, if they can blend in with that normal traffic, they may go unnoticed for quite some time. >> So, as new sources of data are exploited by the business to engage their customers, like social media, new technologies or new concepts like steganography or, steganography's been around for a long time, but its new to a lot of people, becomes something that increasingly has to be observed and tracked and acted upon. >> Yeah, you know I always say this is like, we want to continue to advance technology, right? We want to leverage it, why? Because overall, it makes our society better. Makes my life better, makes your life better, makes everybody, you know, future generations' lives better, but we need to make sure that we are securing the advancement of that actual technology, so it's a constant kind of catch up game for us. >> Yes, I need my cat pictures, Tony. All right, so I want to do one last thing here. We learned a lot in the overall FortiGuard Labs reports over the past few quarters, certainly since you've come on theCUBE, I've learned a lot, and I'm sure everybody who's been watching these CUBE Conversations has learned a lot as well. Let's now think about some recommendations. If we kind of quickly summarize what happened in 2018, what does it tell us about things that people should do differently in 2019? What are the kind of two or three key recommendations that FortiGuard Labs is putting forward right now? >> Yeah, I think one of the things that we continue to see is just how these threats are becoming bigger, faster, stronger, right? And that's really being sort of driven by the cybercrime ecosystem, the advancement of these types of attacks. So, how do you continue to ensure that you can keep up with this sophistication and this volume? And I'll kind of make it simple at a high level, obviously it goes a lot a lot deeper, but the first thing is having awareness. I really feel people don't truly know what they're actually protecting within all of their cyber assets. What are operating systems? What software? Where are they located? Where is their data located? How is their data flowing from system to system? I don't think they have a good understanding of that, so having that awareness, right? It's getting even harder now because it's cloud, right? It's on your workstation It's in the cloud, it's all over the place. So, it's good to get a handle on that, and once you have that, you need to act on it. So, whether it's identifying vulnerabilities that need to be say, patched or whether it's finding some type of threat in your environment and taking action, it's important that we need skilled resources to be able to deal with that. But I would say, once again, look at automation. How can you leverage technology to be able to communicate with each other through open APIs and make some automated decisions for you, isolate those threats, allow you to fight through the attack a little bit more so you can figure out what to do? Ultimately, hopefully it's going to minimize the impact of that one breach. And I would say this, threats are going to get in, but if you can continue to resist that threat before it gets into the core of your network, that's a win for everybody. So, continue to resist is a big one. That initial access, it's going to happen. Continue to resist, so you can ensure the minimization of the actual impact of that risk, of that threat. >> I got two quick comments about that, Tony. Tell me if I can summarize this right. One is that, look, everybody's going to digital, everybody's going through digital transformation, very few firms however have truly adopted an asset-oriented approach to their data. What you're saying is security is how you go about making your data private so that you get value out of it and not bad people. That's I think kind of an overarching statement, that this is a business problem that has to be treated like a business problem and invested in like a business problem. The second thing >> Possible. >> that I would say, and let me see if I got this right, that the idea ultimately, that data stays in one place and is used only in one way is wrong. It's going to change over time, and we have to acknowledge that there's not one approach to how we go about data security and handling these threats. There's differences in application exploitation, differences in malware and as you've said, botnets are indications that something's already happened, so we have to use a more balanced comprehensive view to how we think about handling the threats against us. Have I got that right? >> Yeah, absolutely. And I'll just end it with that, there's a lot of things that you have to deal with, and we have such a cybersecurity shortage, and you can never get to everything, but like you had said, it's a business issue. If you can understand your critical business processes and focus on those things, those assets, that data, that is going to be how you're going to prioritize and ensure that you can minimize the overall impact of an actually threat that may actually enter into your environment. >> Tony Giandomenico, senior security strategist and researcher at FortiGuard Labs at Fortinet. Once again Tony, thanks for being on theCUBE. >> It's always a pleasure Peter. >> And always love having Tony G. on. Hopefully, you've enjoyed this CUBE Conversation as well. Until next time, I'm Peter Burris. Talk to you soon. (upbeat string music)

(uplifting music) >> Hi I'm Peter Burris, and welcome to another great CUBE conversation. We're here in our Palo Alto studios with Fortinet's Anthony Giandomenico, Anthony welcome. >> Welcome, it's great to be here. >> So or otherwise known as Tony G. So in theCUBE conversations Tony, we want to talk about interesting and relevant things. Well here's an interesting and relevant thing that just happened: Fortinet has put forward their quarterly Threats report. What is it? What's in it? >> Really, it's something we do on a quarterly basis, and it's really geared towards the IP security profession, so we go to from the CSO all the way down to the security operator. And what we're looking at is billions of events that are being observed in real time, you know production environments around the world and what we're hoping to do is look at different types of trends that are specific to application exploits, malware, and botnets and hopefully then provide some recommendations back to those IP security professionals. >> Now Tony, malware's been around for a while, some of the bots are a little bit new, but certainly there's some real new things that are on the horizon like IoT and we've heard recently that there's been some challenge with some of these IoT devices. Is it the threat getting more or less intense according to the report? >> Yeah, definitely it's getting more sophisticated, specifically with these IoT devices. What we're seeing as an example with the Reaper and Hajime, always had a hard time actually pronouncing that so I think it's "Hajime". They're actually starting to attack multiple vulnerabilities so instead of just going after one vulnerability, they have multiple vulnerabilities that is inside their malicious code, and then they have the ability to automate the exploitation of those vulnerabilities depending on what the IoT devices are. Now, they're also becoming a lot more resilient. And what I mean by that is some of the actual botnets like Hajime is able to communicate via P2P to each other. What they kind of creates is a decentralized command and control infrastructure. And then lastly, they're becoming much more agile as well, they have this Lua engine, which enables them to quickly update their code so, giving an example, let's say there's a new vulnerability out there. They can quickly swap out or add the additional exploit before that vulnerability, propagate that out to all of the IoT devices that are part of the botnet, and then they can swarm in on that new vulnerability. >> So Fortinet's Fortiguard Labs is one of the leading researchers in this area, especially internet, enterprise security. What is your recommendations that people do about the increasing intensity of the IoT threats? >> But I think we need to start, at least thinking about fighting these automation attacks or worm attacks with our own swarm-like defenses. And what I mean by that is having a seamless integration and automation across your entire security fabric. Now, there's a lot that actually kind of goes into that, but your technology controls need to start talking to each other, and then you can start automating and taking some action really based on whatever threat happens to be in your environment. Now, it's easier said than done, but if you can do that, you can start automating the continual resistance or resiliency of you being able to actually defend against those automated attack. >> So let's change gears a little bit. Willie Sutton, I think it was Willie Sutton, the famous bank robber was famous for saying, when someone asked him "Why do you rob banks?" he said "That's where the money is." >> All of the money (laughing) >> Crypto-jacking. What's going on with as BitCoin becomes a bigger feature of the whole landscape, what's happening with crypto-jackers, what is it, how does it work, why should we be concerned about it? >> Well definitely cryptocurrency is becoming more and more popular these days and the bad guys are definitely taking advantage of that. So when we talk about what is crypto-jacking, so it's really it's sharing, or secretly using, the CPU resources to be able to mine for cryptocurrencies. Now, traditionally you used to have to put some type of application on your machine to be able to mine for cryptocurrencies. Nowadays, all the bad guys really have to do is install a little java script in your browser and away they go. And the only way that you're going to know that your machine may be part of this mining, is it may become super slow and you may be savvy enough to say "Well, maybe look at the CPU." And you look at it and it's pegged at 100%. So that's one of the ways that you can determine that your computer is part of crypto mining. Now in the Q4 report what we've seen is a huge update in crypto mining malware, and it's interesting because it's very intertwined with the rise and fall of the BitCoin price. So as we saw the BitCoin price go up, the crypto mining malware went up, and as it actually dropped off so did the activity. The other thing that we actually ended up seeing is actually in the Darknet. There's a bit of a shift where the bad guys used to only accept payment in BitCoin. Now they're looking at accepting other forms of actual cryptocurrency and that also holds true for ransomware. So if you have an infected with ransomware, it's quite possible that they're going to demand that ransom in something other than BitCoin. >> Interesting, so, in fact we had a great previous group conversation with another really esteemed Fortinet guest, and we talked a little bit about this. So one of the prescriptions is businesses have to be careful about the degree to which they think about doing a lot of transactions in cryptocurrencies. But they probably want to have a little bit of reserves just in case. But what should a business do? What should someone do to mediate some of the challenges associated with crypto-jacking? >> Yeah, I think one of the first things, it's probably self-explanatory to most us that are actually in the cyber field, but having good user awareness training program that actually includes keeping up with the latest and greatest tactics, techniques, and the actual threats that the bad guys are doing out there. Now the other obvious thing would probably be just make sure that your security solutions are able to detect the crypto mining URLs and malware. And I would also say>> now I'm not condoning that you actually pay the ransom>> however, it's happened many times where they've paid, I think there were some companies that actually paid over a million dollars in BitCoin, it may actually be an option and if you have that in your incident response plan, and what you want to do sometimes>> and we've seen organizations actively go ahead and do this>> is they'll buy some BitCoin, kind of keep it on hand so if they do have to pay, it streamlines an entire process. Because ransomware, the actual ransom now, you may not be able to pay in BitCoin. You probably have to keep abreast of what are the actually trends in paying up for your ransom because you may have to have other cryptocurrencies on hand as well. >> So, make sure your security's up to date, then you can track these particular and specific resources that tend to do this, have a little bit on reserve, but make sure that you are also tracking which of the currencies are most being used. So, there are other exploits, as you said earlier. Now we see people when someone's not working by doing peer to peer type stuff. The bad guys are constantly innovative, some would argue that they're more inventive than the good guys because they got less risk to worry about. What other threats is the report starting to highlight, that people need to start thinking about? >> So in this Q4 report what we did is we added in the top exploit kit. And I think we'll probably continue to do that over the-- >> What's an exploit kit? >> Exploit kit is something, it's a very nice little kind of GUI that allows you to really just kind of point and click, has multiple exploits in there, and it's usually browser based so it's going to be able to compromise usually a vulnerability within the browser, or some of the actual browser plugins, things of that nature, and the one that we had in the Q4 report was the Sundown exploit kit. Now, it was interesting because we didn't necessarily see that one on the top, it might've been top of its game maybe 2014, 2015, but it actually rose in early December to actually kind of be number one for Q4. And it's unique because it does leverage steganography, meaning it's able to hide its malicious code or its harvested information inside image files. So we'll continue to track that, we don't know sure why it actually kind of rose up in the beginning of December but we'll just actually continue to track it on time. >> So you've already mentioned ransomware but let's return to it because that's at the top of people's minds, we pay lawyers when they come after us with sometimes what looks like ransom. But what is happening, what's the point in ransomware, what's the report on they like? >> Well, what you see is the actual growth and volume and sophistication has really been common amongst all the reports that we have actually put out to date, but not a lot has really changed. In Q4, what we did have Locky was the number one malware, or ransomware variant along with Global Imposter. Now, it's still the same delivery mechanisms, so you still got the social engineering, it's being delivered through fishing email, but then it's expanding out to let's say compromised websites, malvertising, as well as earlier on last year, we saw where it was being able to propagate from vulnerability to vulnerability so it had this worm-like spreading capability. That's all really been the same and not a lot has really sort of changed. The thing that has changed actually is the fact that they're up in the ante a little bit to be able to hopefully increase their chances of you actually falling for that actual scam, is they're making the subject of that scam a little bit more top-of-mind. As an example, the subject may be cryptocurrency because you're more likely to figure out what's going on there, you'll be more likely to download that file or click that link if the subject is something around cryptocurrency because it is top-of-mind today. >> Interestingly enough, I, this morning received an email saying, "You could win some free cryptocurrency." And I said "And you can go into the trash can." (Tony laughing) So what should people do about it? I just threw something away, but what should people generally do to protect their organization from things like ransomware? >> I do get that a lot, I get that question a lot. The first thing I say, if you're trying to protect against ransomware, you follow the same things that you were doing with some of the other threats because I don't think ransomware is that unique when it comes to the protection. The uniqueness is really an impact, because certain threats they'll actually go and steal data and whatnot but when's the last time you heard of a business going out of business or losing money because some data was stolen? Not very often, it seems to be continued as business as usual, but ransomware, locking your files, it could actually bring the business down. So what you want to do is be able to minimize the impact of that actual ransomware so having a good offline backup strategy, so good backup and recovery strategy, making sure you go through those table top exercises really to make sure that when you do have to recover, you know exactly how long it's going to take and it's very efficient and very streamlined. >> Practice, practice, practice. >> Yup, and don't rely on online backups, shadow copy backups because those things are probably going to be encrypted as well. >> Yup, alright so that's all we have time for today Tony. So, Anthony Giandomenico from-- >> Tony G! (laughing) >> Tony G, who's a senior security strategist researcher at the Fortinet Fortiguard Labs. Thanks very much for this CUBE conversation. >> It was great to be here. >> Peter Burris, once again, we'll see you at the next CUBE Conversation. (uplifting music)

(Upbeat orchestra music) >> Hi, it's Peter Burris with Cube Conversation. We're here with Anthony Giandomenico who's a senior security strategist and researcher at FortiGuard Labs. Tony G! >> Thanks for having me today, Peter! >> Good to see you again! So, Tony G, you spend a lot of time talking to a lot of users, a lot of other professionals, you're doing a lot of research on issues. Give us a quick snapshot. What's the state of security today? >> Well I think there's a lot of things happening right now, I think in the cyberworld. One, a lot of us already know is we have a huge skill shortage. We just don't have enough folks to be able to defend our cyber assets. And, I think the other thing is, you look at some of the mid-tier organizations, maybe a thousand users or so, they don't have those skilled resources, and what happens is they end up relying on different types of technology to help fill that skills gap, and that's good, but what they need to also make sure is that they have an over-arching good solid security program that takes into consideration, technology controls, so you're buying these specific products, but also, what are the processes and what are the actual kind of people that are involved. And are you actually combining all of those to encompass a solid, good, cyber security program? >> Yeah, a bad guy who watches a ransomware attack on a mid-size company, may be a little disappointed that they are not able to get 10 million dollars, but they'll be pretty happy with a million or 500 thousand dollars. That's a good day's work for these guys. >> It's low-hanging fruit, Peter, right? It's much easier, and I think that's the sweet spot for the bad guys, right, because if you go too high, sometimes it's too much effort. You go too low, you're not really getting much. But in the middle, you're getting a decent amount, and a lot of times, they don't have that strong, cyber security program. Now, I always tell a lot of my customers in that sweet spot, forget about protecting and monitoring everything. It's not going to happen. You will fail 100% of the time. However, if you focus on what are the key assets, what are those five, six business critical processes, understand the assets that those processes ride over, focus on protecting those. Everything else is ancillary because this is all that really matters to the business. The other thing I would say, Peter, and I think that this is a mindset change. If I'm a security professional and I'm responsible for protecting my cyber assets, and if I'm being measured on whether there's a breech in my network or not, so if there is a breech I fail, that has to go away. Because you will fail every single time. That's not the way you should be measured. You should be measured on, hey, we quickly identified, something in the network, isolated it, we mitigated it, we got everything back up and running, and we're back up and running as normal, minimized the actual damage. That's how I should be graded on. >> So, it's an important point, Tony G, so what we're saying is, that the real metrics associated with this should be the degree to which you can mitigate problems, not whether or not you're 100% clear of everything, because the bad guys are going to find their way at some point in time. >> They got enough time to do it and you don't. So, like if you can quickly identify when they are in the network, isolate it, minimize the damage, and get your business processes back up and running, that's a win! >> One of the things you mentioned, you mentioned for your cyber security, or your cyber assets, which by itself is not an easy thing necessarily to measure. It's hard to say that this cyber asset's worth that, and that cyber asset's worth that, but we do have to make some effort to understand the risks associated with cyber where it's an opportunity cost or whether it's replacement cost or whatever else it might be. But it also suggests historically we invest in assets we appreciate the value of those assets. Should security be regarded as an asset, should cyber security be regarded as part of the asset base of the business? What do you think? >> Absolutely, you definitely as a consumer or as someone who is interested in looking at an actual business, I think that's a key asset to make sure that your information is being protected. And, honestly, I don't think it always is. We have these regulations that are tied to making sure for example, if you're storing customer credit cards, there's PCI, and there's all these other now HIPPA regulations, and all that type of stuff, but those regulations still don't seem to be enough, and I think the minute you can turn >> You mean it's not enough and it appears that enterprise has generally continued to under invest in their cyber security assets. Is that kind of what you mean? >> Yeah, I still think it's a check-box. >> Okay, I am compliant, okay, that's enough. I betcha, there are companies out there, they'll put a certain money aside knowing that they're going to get breached, and use that money to be able to pay for their breach or whatever else they have to do to meet those regulations, instead of investing into the actual technology to fortify their environment a lot better. >> Well, at wikibon->> we are doing research on related type things all the time, we're just fascinated by the idea that if a business is going after greater flexibility and agility, a crucial element of that has to be, do you have a cyber security profile that allows you to take advantage of those opportunities, that allows you to connect with those partners, that allows you to set up more intimated relations with a big customer. And it just seems as though that something has to become an explicit feature of the conversation about what are strategic assets. >> Yeah, I totally agree. That kind of stirs up something in my head about cyber insurance. I think a lot of companies are also moving towards, well, let me just buy some kind of cyber insurance. And, in the beginning they would go ahead and buy those things, but what they would quickly find out, is that they wouldn't be able to reap the money on an actual breach, because they were out of compliance because they didn't have the good cyber security program they were supposed to have. >> Yeah, the insurance company always finds a way to not pay. Let's talk now about this notion of great agility. We talked about the role that cyber security could play in businesses as they transform the digital world. We've seen a lot of developers starting to enter into cloud-native, cloud-development, new ways of integrating, that requires a mindset shift in the development world about what constitutes security. Now everybody knows, we're not just talking about perimeter, we're talking about something different. What is it that we are talking about? Are we talking about how security is going to move with the data? Are the securities going to be embedded in the API? What do developers have to do differently or how do they have to think differently to make sure that they are building stuff that makes the business more secure? >> Well, before you even start talking about the cloud, or anything else, we still have an issue when we're building our applications, developers still, I don't think are up to speed enough on tracking good, secure coding. I think we're still playing catch-up to that. Now, what you just said, think about where we're at now, we're not even sort of there, now you're going to expand that out into the cloud, it's only going to amplify the actual problem, so there's going to be a lot of challenges that we're going to have to face. We talked about this off-line before, is where's your data going to be? It's going to be everywhere. How are you going to be able to secure that particular data? I think that's going to be a lot of challenges that face ahead of us. We have to figure out how to deal with it. >> The last thing I want to talk about, Tony G, is a lot of the applications that folks are going to be building, a lot of things the developers are going to be building, are things that increasingly provide or bring a degree 6of automation to bear. hink about it, if you've got bad cyber security, you may not know when you've been breached or when you've been hacked or when you've been compromised. You definitely don't want to find out because you've got some automation thing going on that's spinning out of control and doing everything wrong because of a security breach. What's the relationship between increasing automation and the need for more focus and attention on cyber security? >> Usually when I talk about automation, I'm talking about how the bad guys are leveraging automation. Now, I'll give you a little bit of an example here, in our FortiGuard Labs, I think last quarter, I think it was over a million exploits or at least exploit attempts that we were thwarting in one minute. The volume of the attacks are so large these days, and it's really coming from the cyber crime ecosystem. The human cannot actually deal with handling dealing with all those different threats out there, so they need to figure out a way to fight automation with automation. And that's really the key. I had mentioned this earlier on before, is you have to make sure that your technology controls are talking to each other so that they can actually take some automated action. As far as you're concerned as a security operator working in a sock, no matter how good you are, the process for you to identify something, analyze it and take action on it, it's going to be a couple hours sometimes. Sometimes it's a little bit faster, but usually it's a couple hours. It's way too late by then because that threat could spread all over the place. You need those machines to make some of those actual decisions for you, and that's where you start to hear a lot about, and all these buzz-words about artificial intelligence, machine learning, big data analytics. We're really diving into now and trying to figure out how can the machines help us make these automated decisions for us. >> But as you increase the amount of automation, you dramatically expand the threat surface for the number of things that could suddenly be compromised and be taken over as a bad actor. They themselves are more connected. It just amplifies the whole problem. >> Yeah, it gets more complicated, so a system that's more complex, is less secure. >> More vulnerable, sir. >> Yeah, more vulnerable. Absolutely. >> Alright, so once again, Tony G, thanks for being here. We've been speaking on Cube Conversation with Anthony Giandomenico who's with the FortiGuard Labs. He's a security analyst and researcher. Thank you very much for being here. >> Thanks! Thanks for having me. (Techno music)

(Upbeat orchestra music) >> Hi, it's Peter Burris with Cube Conversation. We're here with Anthony Giandomenico who's a senior security strategist and researcher at FortiGuard Labs. Tony G! >> Thanks for having me today, Peter! >> Good to see you again! So, Tony G, you spend a lot of time talking to a lot of users, a lot of other professionals, you're doing a lot of research on issues. Give us a quick snapshot. What's the state of security today? >> Well I think there's a lot of things happening right now, I think in the cyberworld. One, a lot of us already know is we have a huge skill shortage. We just don't have enough folks to be able to defend our cyber assets. And, I think the other thing is, you look at some of the mid-tier organizations, maybe a thousand users or so, they don't have those skilled resources, and what happens is they end up relying on different types of technology to help fill that skills gap, and that's good, but what they need to also make sure is that they have an over-arching good solid security program that takes into consideration, technology controls, so you're buying these specific products, but also, what are the processes and what are the actual kind of people that are involved. And are you actually combining all of those to encompass a solid, good, cyber security program? >> Yeah, a bad guy who watches a ransomware attack on a mid-size company, may be a little disappointed that they are not able to get 10 million dollars, but they'll be pretty happy with a million or 500 thousand dollars. That's a good day's work for these guys. >> It's low-hanging fruit, Peter, right? It's much easier, and I think that's the sweet spot for the bad guys, right, because if you go too high, sometimes it's too much effort. You go too low, you're not really getting much. But in the middle, you're getting a decent amount, and a lot of times, they don't have that strong, cyber security program. Now, I always tell a lot of my customers in that sweet spot, forget about protecting and monitoring everything. It's not going to happen. You will fail 100% of the time. However, if you focus on what are the key assets, what are those five, six business critical processes, understand the assets that those processes ride over, focus on protecting those. Everything else is ancillary because this is all that really matters to the business. The other thing I would say, Peter, and I think that this is a mindset change. If I'm a security professional and I'm responsible for protecting my cyber assets, and if I'm being measured on whether there's a breech in my network or not, so if there is a breech I fail, that has to go away. Because you will fail every single time. That's not the way you should be measured. You should be measured on, hey, we quickly identified, something in the network, isolated it, we mitigated it, we got everything back up and running, and we're back up and running as normal, minimized the actual damage. That's how I should be graded on. >> So, it's an important point, Tony G, so what we're saying is, that the real metrics associated with this should be the degree to which you can mitigate problems, not whether or not you're 100% clear of everything, because the bad guys are going to find their way at some point in time. >> They got enough time to do it and you don't. So, like if you can quickly identify when they are in the network, isolate it, minimize the damage, and get your business processes back up and running, that's a win! >> One of the things you mentioned, you mentioned for your cyber security, or your cyber assets, which by itself is not an easy thing necessarily to measure. It's hard to say that this cyber asset's worth that, and that cyber asset's worth that, but we do have to make some effort to understand the risks associated with cyber where it's an opportunity cost or whether it's replacement cost or whatever else it might be. But it also suggests historically we invest in assets we appreciate the value of those assets. Should security be regarded as an asset, should cyber security be regarded as part of the asset base of the business? What do you think? >> Absolutely, you definitely as a consumer or as someone who is interested in looking at an actual business, I think that's a key asset to make sure that your information is being protected. And, honestly, I don't think it always is. We have these regulations that are tied to making sure for example, if you're storing customer credit cards, there's PCI, and there's all these other now HIPPA regulations, and all that type of stuff, but those regulations still don't seem to be enough, and I think the minute you can turn >> You mean it's not enough and it appears that enterprise has generally continued to under invest in their cyber security assets. Is that kind of what you mean? >> Yeah, I still think it's a check-box. >> Okay, I am compliant, okay, that's enough. I betcha, there are companies out there, they'll put a certain money aside knowing that they're going to get breached, and use that money to be able to pay for their breach or whatever else they have to do to meet those regulations, instead of investing into the actual technology to fortify their environment a lot better. >> Well, at wikibon-- we are doing research on related type things all the time, we're just fascinated by the idea that if a business is going after greater flexibility and agility, a crucial element of that has to be, do you have a cyber security profile that allows you to take advantage of those opportunities, that allows you to connect with those partners, that allows you to set up more intimated relations with a big customer. And it just seems as though that something has to become an explicit feature of the conversation about what are strategic assets. >> Yeah, I totally agree. That kind of stirs up something in my head about cyber insurance. I think a lot of companies are also moving towards, well, let me just buy some kind of cyber insurance. And, in the beginning they would go ahead and buy those things, but what they would quickly find out, is that they wouldn't be able to reap the money on an actual breach, because they were out of compliance because they didn't have the good cyber security program they were supposed to have. >> Yeah, the insurance company always finds a way to not pay. Let's talk now about this notion of great agility. We talked about the role that cyber security could play in businesses as they transform the digital world. We've seen a lot of developers starting to enter into cloud-native, cloud-development, new ways of integrating, that requires a mindset shift in the development world about what constitutes security. Now everybody knows, we're not just talking about perimeter, we're talking about something different. What is it that we are talking about? Are we talking about how security is going to move with the data? Are the securities going to be embedded in the API? What do developers have to do differently or how do they have to think differently to make sure that they are building stuff that makes the business more secure? >> Well, before you even start talking about the cloud, or anything else, we still have an issue when we're building our applications, developers still, I don't think are up to speed enough on tracking good, secure coding. I think we're still playing catch-up to that. Now, what you just said, think about where we're at now, we're not even sort of there, now you're going to expand that out into the cloud, it's only going to amplify the actual problem, so there's going to be a lot of challenges that we're going to have to face. We talked about this off-line before, is where's your data going to be? It's going to be everywhere. How are you going to be able to secure that particular data? I think that's going to be a lot of challenges that face ahead of us. We have to figure out how to deal with it. >> The last thing I want to talk about, Tony G, is a lot of the applications that folks are going to be building, a lot of things the developers are going to be building, are things that increasingly provide or bring a degree 6of automation to bear. hink about it, if you've got bad cyber security, you may not know when you've been breached or when you've been hacked or when you've been compromised. You definitely don't want to find out because you've got some automation thing going on that's spinning out of control and doing everything wrong because of a security breach. What's the relationship between increasing automation and the need for more focus and attention on cyber security? >> Usually when I talk about automation, I'm talking about how the bad guys are leveraging automation. Now, I'll give you a little bit of an example here, in our FortiGuard Labs, I think last quarter, I think it was over a million exploits or at least exploit attempts that we were thwarting in one minute. The volume of the attacks are so large these days, and it's really coming from the cyber crime ecosystem. The human cannot actually deal with handling dealing with all those different threats out there, so they need to figure out a way to fight automation with automation. And that's really the key. I had mentioned this earlier on before, is you have to make sure that your technology controls are talking to each other so that they can actually take some automated action. As far as you're concerned as a security operator working in a sock, no matter how good you are, the process for you to identify something, analyze it and take action on it, it's going to be a couple hours sometimes. Sometimes it's a little bit faster, but usually it's a couple hours. It's way too late by then because that threat could spread all over the place. You need those machines to make some of those actual decisions for you, and that's where you start to hear a lot about, and all these buzz-words about artificial intelligence, machine learning, big data analytics. We're really diving into now and trying to figure out how can the machines help us make these automated decisions for us. >> But as you increase the amount of automation, you dramatically expand the threat surface for the number of things that could suddenly be compromised and be taken over as a bad actor. They themselves are more connected. It just amplifies the whole problem. >> Yeah, it gets more complicated, so a system that's more complex, is less secure. >> More vulnerable, sir. >> Yeah, more vulnerable. Absolutely. >> Alright, so once again, Tony G, thanks for being here. We've been speaking on Cube Conversation with Anthony Giandomenico who's with the FortiGuard Labs. He's a security analyst and researcher. Thank you very much for being here. >> Thanks! Thanks for having me. (Techno music)

(uplifting music) >> Hi I'm Peter Burris, and welcome to another great CUBE conversation. We're here in our Palo Alto studios with Fortinet's Anthony Giandomenico, Anthony welcome. >> Welcome, it's great to be here. >> So or otherwise known as Tony G. So in theCUBE conversations Tony, we want to talk about interesting and relevant things. Well here's an interesting and relevant thing that just happened: Fortinet has put forward their quarterly Threats report. What is it? What's in it? >> Really, it's something we do on a quarterly basis, and it's really geared towards the IP security profession, so we go to from the CSO all the way down to the security operator. And what we're looking at is billions of events that are being observed in real time, you know production environments around the world and what we're hoping to do is look at different types of trends that are specific to application exploits, malware, and botnets and hopefully then provide some recommendations back to those IP security professionals. >> Now Tony, malware's been around for a while, some of the bots are a little bit new, but certainly there's some real new things that are on the horizon like IoT and we've heard recently that there's been some challenge with some of these IoT devices. Is it the threat getting more or less intense according to the report? >> Yeah, definitely it's getting more sophisticated, specifically with these IoT devices. What we're seeing as an example with the Reaper and Hajime, always had a hard time actually pronouncing that so I think it's "Hajime". They're actually starting to attack multiple vulnerabilities so instead of just going after one vulnerability, they have multiple vulnerabilities that is inside their malicious code, and then they have the ability to automate the exploitation of those vulnerabilities depending on what the IoT devices are. Now, they're also becoming a lot more resilient. And what I mean by that is some of the actual botnets like Hajime is able to communicate via P2P to each other. What they kind of creates is a decentralized command and control infrastructure. And then lastly, they're becoming much more agile as well, they have this Lua engine, which enables them to quickly update their code so, giving an example, let's say there's a new vulnerability out there. They can quickly swap out or add the additional exploit before that vulnerability, propagate that out to all of the IoT devices that are part of the botnet, and then they can swarm in on that new vulnerability. >> So Fortinet's Fortiguard Labs is one of the leading researchers in this area, especially internet, enterprise security. What is your recommendations that people do about the increasing intensity of the IoT threats? >> But I think we need to start, at least thinking about fighting these automation attacks or worm attacks with our own swarm-like defenses. And what I mean by that is having a seamless integration and automation across your entire security fabric. Now, there's a lot that actually kind of goes into that, but your technology controls need to start talking to each other, and then you can start automating and taking some action really based on whatever threat happens to be in your environment. Now, it's easier said than done, but if you can do that, you can start automating the continual resistance or resiliency of you being able to actually defend against those automated attack. >> So let's change gears a little bit. Willie Sutton, I think it was Willie Sutton, the famous bank robber was famous for saying, when someone asked him "Why do you rob banks?" he said "That's where the money is." >> All of the money (laughing) >> Crypto-jacking. What's going on with as BitCoin becomes a bigger feature of the whole landscape, what's happening with crypto-jackers, what is it, how does it work, why should we be concerned about it? >> Well definitely cryptocurrency is becoming more and more popular these days and the bad guys are definitely taking advantage of that. So when we talk about what is crypto-jacking, so it's really it's sharing, or secretly using, the CPU resources to be able to mine for cryptocurrencies. Now, traditionally you used to have to put some type of application on your machine to be able to mine for cryptocurrencies. Nowadays, all the bad guys really have to do is install a little java script in your browser and away they go. And the only way that you're going to know that your machine may be part of this mining, is it may become super slow and you may be savvy enough to say "Well, maybe look at the CPU." And you look at it and it's pegged at 100%. So that's one of the ways that you can determine that your computer is part of crypto mining. Now in the Q4 report what we've seen is a huge update in crypto mining malware, and it's interesting because it's very intertwined with the rise and fall of the BitCoin price. So as we saw the BitCoin price go up, the crypto mining malware went up, and as it actually dropped off so did the activity. The other thing that we actually ended up seeing is actually in the Darknet. There's a bit of a shift where the bad guys used to only accept payment in BitCoin. Now they're looking at accepting other forms of actual cryptocurrency and that also holds true for ransomware. So if you have an infected with ransomware, it's quite possible that they're going to demand that ransom in something other than BitCoin. >> Interesting, so, in fact we had a great previous group conversation with another really esteemed Fortinet guest, and we talked a little bit about this. So one of the prescriptions is businesses have to be careful about the degree to which they think about doing a lot of transactions in cryptocurrencies. But they probably want to have a little bit of reserves just in case. But what should a business do? What should someone do to mediate some of the challenges associated with crypto-jacking? >> Yeah, I think one of the first things, it's probably self-explanatory to most us that are actually in the cyber field, but having good user awareness training program that actually includes keeping up with the latest and greatest tactics, techniques, and the actual threats that the bad guys are doing out there. Now the other obvious thing would probably be just make sure that your security solutions are able to detect the crypto mining URLs and malware. And I would also say- now I'm not condoning that you actually pay the ransom- however, it's happened many times where they've paid, I think there were some companies that actually paid over a million dollars in BitCoin, it may actually be an option and if you have that in your incident response plan, and what you want to do sometimes- and we've seen organizations actively go ahead and do this- is they'll buy some BitCoin, kind of keep it on hand so if they do have to pay, it streamlines an entire process. Because ransomware, the actual ransom now, you may not be able to pay in BitCoin. You probably have to keep abreast of what are the actually trends in paying up for your ransom because you may have to have other cryptocurrencies on hand as well. >> So, make sure your security's up to date, then you can track these particular and specific resources that tend to do this, have a little bit on reserve, but make sure that you are also tracking which of the currencies are most being used. So, there are other exploits, as you said earlier. Now we see people when someone's not working by doing peer to peer type stuff. The bad guys are constantly innovative, some would argue that they're more inventive than the good guys because they got less risk to worry about. What other threats is the report starting to highlight, that people need to start thinking about? >> So in this Q4 report what we did is we added in the top exploit kit. And I think we'll probably continue to do that over the-- >> What's an exploit kit? >> Exploit kit is something, it's a very nice little kind of GUI that allows you to really just kind of point and click, has multiple exploits in there, and it's usually browser based so it's going to be able to compromise usually a vulnerability within the browser, or some of the actual browser plugins, things of that nature, and the one that we had in the Q4 report was the Sundown exploit kit. Now, it was interesting because we didn't necessarily see that one on the top, it might've been top of its game maybe 2014, 2015, but it actually rose in early December to actually kind of be number one for Q4. And it's unique because it does leverage steganography, meaning it's able to hide its malicious code or its harvested information inside image files. So we'll continue to track that, we don't know sure why it actually kind of rose up in the beginning of December but we'll just actually continue to track it on time. >> So you've already mentioned ransomware but let's return to it because that's at the top of people's minds, we pay lawyers when they come after us with sometimes what looks like ransom. But what is happening, what's the point in ransomware, what's the report on they like? >> Well, what you see is the actual growth and volume and sophistication has really been common amongst all the reports that we have actually put out to date, but not a lot has really changed. In Q4, what we did have Locky was the number one malware, or ransomware variant along with Global Imposter. Now, it's still the same delivery mechanisms, so you still got the social engineering, it's being delivered through fishing email, but then it's expanding out to let's say compromised websites, malvertising, as well as earlier on last year, we saw where it was being able to propagate from vulnerability to vulnerability so it had this worm-like spreading capability. That's all really been the same and not a lot has really sort of changed. The thing that has changed actually is the fact that they're up in the ante a little bit to be able to hopefully increase their chances of you actually falling for that actual scam, is they're making the subject of that scam a little bit more top-of-mind. As an example, the subject may be cryptocurrency because you're more likely to figure out what's going on there, you'll be more likely to download that file or click that link if the subject is something around cryptocurrency because it is top-of-mind today. >> Interestingly enough, I, this morning received an email saying, "You could win some free cryptocurrency." And I said "And you can go into the trash can." (Tony laughing) So what should people do about it? I just threw something away, but what should people generally do to protect their organization from things like ransomware? >> I do get that a lot, I get that question a lot. The first thing I say, if you're trying to protect against ransomware, you follow the same things that you were doing with some of the other threats because I don't think ransomware is that unique when it comes to the protection. The uniqueness is really an impact, because certain threats they'll actually go and steal data and whatnot but when's the last time you heard of a business going out of business or losing money because some data was stolen? Not very often, it seems to be continued as business as usual, but ransomware, locking your files, it could actually bring the business down. So what you want to do is be able to minimize the impact of that actual ransomware so having a good offline backup strategy, so good backup and recovery strategy, making sure you go through those table top exercises really to make sure that when you do have to recover, you know exactly how long it's going to take and it's very efficient and very streamlined. >> Practice, practice, practice. >> Yup, and don't rely on online backups, shadow copy backups because those things are probably going to be encrypted as well. >> Yup, alright so that's all we have time for today Tony. So, Anthony Giandomenico from-- >> Tony G! (laughing) >> Tony G, who's a senior security strategist researcher at the Fortinet Fortiguard Labs. Thanks very much for this Cube conversation. >> It was great to be here. >> Peter Burris, once again, we'll see you at the next Cube Conversation. (uplifting music)