Preventing Bad AI: How SOC Teams Are Preventing AI-Generated Attacks

Mick Leach is Field CISO of Abnormal Security, an AI-native email security company that uses behavioral AI to prevent business email compromise, vendor fraud, and other socially-engineered attacks. At Abnormal, he is responsible for threat hunting and analysis, engaging with customers, and is a featured speaker at global industry conferences and events. Previously, he led security operations organizations at Abnormal, Alliance Data, and Nationwide Insurance, and also spent more than 8 years serving in the US Army’s famed Cavalry Regiments. A passionate information security practitioner, Mick holds 7 SANS/GIAC certifications, coupled with 20+ years of experience in the IT and security industries. When not digging through logs or discussing operational metrics, Mick can typically be found on a soccer field, coaching one of his 13 kids.

Abnormal Security: https://abnormalsecurity.com/unfiltered

Abnormal Security
Abnormal Security provides the leading behavioral AI-based email security platform

Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Transcript

Mick Leach's Journey Into Cybersecurity

Speaker 1 0:00

How's it going , everyone ? This is another security unfiltered podcast episode where today we actually talk with Mick Leach from abnormal security . Abnormal security actually sponsored this podcast and again , you know , just remind you guys , they didn't determine any questions that I can ask them or anything like that . You know , they just believe in what we're doing here at the podcast and they wanted to support the podcast and so that's how it all kind of happened , right ? So , you know , with that , let's go ahead and dive into the episode . I think you guys are going to love it All . Right , see you guys , how's it going ? Mick , it's really good to finally have you on the podcast . You know , I think this one we actually put together pretty quick . You know , most of my guests , it takes about like six months to come on . Honestly , like it's my backlog is insane , but we were able to put this thing together pretty quick and I really appreciate that Certainly , yeah .

Speaker 2 1:05

Thanks for having me , joe . I really appreciate it . It's great to be on the podcast .

Speaker 1 1:09

Yeah , absolutely Well , mick , you know before we dive into . You know abnormal security and everything . Why don't you tell my audience you know your background right how you got an IT ? Maybe why you got an IT ? The reason why I have all my guests start there is because you know everyone's coming at this from a different background . They're all coming at it from you know different skill sets and whatnot . And if I feel like , if they can hear , you know a matching background , a matching skill set , they can then know like hey , this thing is possible Right . Like I didn't know that this was possible at the time , but now I think I can actually do it . So what's your background ?

Speaker 2 1:56

with it . Yeah Well , hopefully my story is a little bit inspiring in that case , because I did take sort of the scenic route to cybersecurity . So I joined the military , was in the army , the US army go cap scouts , so you're familiar with that . Was was a cap scout for eight and a half years with the US army and as I was getting ready to get out it became time to start figuring out what next looks like . And had been interested in computers for a long time , really enjoyed working on them , had been in my , in my unit .

Speaker 2 2:30

I was early on the only guy that knew how to type . I'd taken a typing class in high school . I failed that class , by the way , was terrible at it , but still was the only guy that knew where the keys roughly were and got suckered into typing all kinds of non commission officer evaluation reports , these kinds of things . And so suddenly it became known as the computer guy in a combat arms unit . So it was . It was a little unusual there , so I get out and ended up having an opportunity right away to work with Linux . And so I was supporting custom based Linux applications , a small telecommunications company , and did that for about four years before an opportunity to join nationwide insurance , came along as a system administrator there and did a variety of different system administration things , really getting into encryption decryption of data and motion . So there was PGP , sftp , fts really encrypting and protecting data in motion and that was kind of my first foray into cybersecurity , so fast forward to about 2012 . And they were looking to start creating a security operations organization , and I was given the opportunity to join that group from the ground level and was jumped at that chance and realized this is what I was made for , you know , being able to protect with ones and zeros digitally felt so in line with my background in the military , and it really just felt like this convergence of everything I had been doing and loving for the last , you know , basically my whole life , and so I jumped at that chance .

Speaker 2 4:14

Of course , nationwide at that time experienced a relatively public breach . What that meant , though , for me was that and it happened to be my first week on call as these go what that meant , though , was they opened the wallet and said how do we fix this ? We hired a lot of consultants that came in and helped us build an elaborate security operation center becoming larger than Natta Security Command Center , and I was one of the founding members of that , so learned a great deal about building and running security operation centers , had the opportunity to move from there after that was reached a steady state to a company called Alliance Data and did much the same thing for them building and optimizing a security operation center there . Did that for about four years and then knew that my next role . I wanted to make an impact at a higher level . Right , I want to move the needle on the industry .

Speaker 2 5:11

Protecting one company is valuable work . Right , that's honorable work . But I wanted to be able to make that impact broader . And so that's when I knew the next move would probably be with a vendor . And I had bought and used abnormal security at my last company for about a year and loved it and added them to the list of companies that I would love to work for . And , sure enough , an opportunity came available . So I've been here . I was security hire number two at abnormal security yeah .

Speaker 2 5:44

Yeah , and so my CISO . My Britain is an old friend of mine , and so getting to come in and build from scratch , really put your finger on you know your fingerprint on something from the beginning was such a great opportunity . So did that for about the last two years and have just recently about two weeks ago moved into a field CISO role where I get opportunities to talk with folks like you .

Speaker 1 6:11

So you know I have a lot of questions about that journey . You know . So , when you started out with Linux , you know what was that like , because Linux is unlike anything else really , and I assume you know you're talking about the terminal side of Linux , not the fancy gooey side . You know that everyone is used to . What was your experience with that ? What was the ramp up like with that ? You know because I actually started my career with Linux and I mean it's like drinking from the fire hose on steroids . It's like wait a minute , the network stack works like this . You know , and I'm just getting out of college , I'm like wait , I just learned how to spell it . Like what are we ? What are we talking about ?

Speaker 2 7:01

here . Yeah , yeah , no , it's funny . You say that I couldn't have put it better right . Drinking from a fire hose on steroids , that's absolutely what it felt like . I will tell you that on the tail end of my military career , as I knew I was getting out , I had the opportunity to go to to a Solaris course . So they sent me to a Solaris course and I'll never forget , I felt like the biggest bonehead in the room because , you know , I was half paying attention , thinking about when's lunch , and suddenly it was time for an exercise and and the first , the first step was to install Solaris .

Speaker 2 7:39

And so we're working on that and and I've got the CD in and I and I could not , for the life of me , I'm hitting the button , the eject button could not figure out how to get the , the CD out , to change CDs to the next , the next run , and I couldn't figure it out . I felt like a moron . And so I I was like sorry , I'm going to have to raise my hand and just ask how do you get it to eject ? And he's like type eject . I was like no , no , no , like really , he's like seriously .

Speaker 2 8:09

So that was the first time that I remembered thinking , oh , this is very different , you know , than the world that I had been raised in . At the same time as we started to get into the tech stack and we started to see how the disk was , was partitioned and and data was stored , and you had so much more granular access to where you were putting things on disk and the ability to go and see things directly on the disk , I was like , man , this is fantastic , you don't have any of this with with Microsoft , and so . So that's how I kind of got into it learn just enough to convince somebody to hire me , which was probably a mistake initially , but they gave me a chance and and I wanted to prove them right , so so did that . That was 21st century communication . So got in there and they were very patient and allowed me to make a lot of mistakes and learn a few things the hard way and a lot of things the easy way , thankfully , yeah , it's .

Speaker 1 9:10

You know it's crazy when you , when you go from something like Windows it's very user friendly , you know . And then you go to Linux and you're I mean you have to like , like you said , you didn't know how to eject the desk , like on Windows . You hit the button , you know you don't type eject or anything like that , you're not clicking anything . You hit the button , you assume it's going to work , but in Linux none of those , none of those features and functionalities tie together right . You have to actually create the tie . You , if you want that button to eject , you need to write the script that says eject . When this is pushed , you know , like that's what it is , and you know . Same thing with . You know , like partitioning a disk .

Speaker 1 10:00

I mean , oh my God , and I tried to do encryption at one point on Linux . I mean my brain was melted . I actually needed my VP to come over because he was the only person at the company that knew how to do the encryption and I mean I had to have him just come over and just type and I just took notes on the side , just like my brain was melted after like two hours of that troubleshooting it , not knowing you know what the hell is going on not looking at the right log files , like I was just having a terrible time .

Speaker 2 10:33

Yeah , yeah , no , I agree . And so moving the good news was right . Learning with Linux early on , especially with like old school Solaris , and then moving to like red hats , is something a little better supported . You know you learned a lot of things the hard way , sort of the old school way , and while there are new , far more , you know new fangled ways of doing things . You know said knock can get you pretty far . So I kind of lean on those things from time to time . But yeah , learning from the beginning was great .

Speaker 1 11:05

Do you ever , do you ever work with Linux at all , like on the side even ? You know I find it that . You know I can't stay away from it . Honestly , you know I still have a VM that's forever , you know installed with a Linux flavor . That that I like , that I prefer , which , embarrassingly , it's Ubuntu , because I like the ability to have that GUI and also be able to do things in the terminal and feel like I'm getting things done . But I use that for very like select things you know , within my home network , sure .

Speaker 2 11:41

Sure , yeah , no , I absolutely it's still . It's like , it's like an old pair of comfortable shoes , right , it's still the most natural , most comfortable thing . So so I still do , just like you in my home lab , have a couple of VMs of Linux . I've got , a couple of Ubuntu versions I've got .

Lessons From Security Breach

Speaker 2 11:59

Of course , you can't be a security guy without having at least one instance of Cali running all the time . Adhd , which I really like . Active harbinger , active defense , harbinger distribution really good there . So yeah , just a few different security onion . You know you've got to have a few different versions running in the background , but it's still the most comfortable for me , especially if I'm going to get into log analysis .

Speaker 2 12:25

Yeah just nothing beats a great grep said AUK , you know ability to parse tons of data .

Speaker 1 12:35

Yeah , yeah , absolutely . Once I learned that it was like having a superpower in Linux . It's like wait a minute , I don't have to sift through this log and search for things and all that you know . So when you , when you started at nationwide , you said the first week they got breached .

Speaker 2 12:53

So it was the first week of my move into security . So I moved into a security focused role . It was the first week that I was on call and I remember joining the call and thinking , wow , this is an exciting call . And then it got very exciting and and I realized I'm in , I'm in over my head and so we had , you know , I had to call in for some help . But that being at the very front end of that and then actually seeing a large company work through a pretty large scale breach , that , that made an indelible , indelible impression on me because it taught me so much about security , the legal side of things . You know the way we we protect information , the way we share information , all right at the very beginning . So it was like a crash course and you know you , you can't pay for that kind of experience ?

Speaker 1 13:50

Did they ? Did they already have a security team stood up ?

Speaker 2 13:55

Yeah , yeah . So a lot of those . And that's what , as we brought consultants in , that's what we learned is that a lot of the right things were in place . You know , it wasn't a lack of skills , it wasn't a lack of people , a lack of tooling . What it really was was a lack of coordination . So we had a lot of disparate tooling , a lot of disparate capabilities spread across a very large organization , and what we learned is that we needed to better unite those capabilities in under one house , right under one floor , so that we could better communicate with one another . And that made a world of difference .

Speaker 2 14:28

You know like large , any large organization there were . You know territorial things where you're like oh that's , that's my world , you got to stay out of that . You know , you got to stay out of that area , that's mine and this is our world . And now we don't touch servers , we only work in . You know endpoints and you know . So we had to break down some of those walls , deal with some of those sort of past sins and and then figure out how to better collaborate going forward .

Speaker 1 14:55

Hmm , yeah , you mentioned , you know , the , the checkbook opened up , which you know , for a security person . That's like what you've been waiting for . And I went into a credit bureau right after a breach at one of our competitors and I mean , it was anything you want , like name , your number , it literally doesn't matter . We have a blank check from the CEO saying that we can do this . You know , apparently , apparently my manager this is a couple weeks before I got there , apparently , my manager actually , you know , was at the bar across the street with a bunch of the team and he was drinking a beer and he said you know what effort , you know I'm gonna , we're going to deploy this thing , we're going to buy these tools , like screw it . You know , the company is just going to figure it out . And I mean , like that was for the company , that was the best decision , because we desperately needed that technology in place before the team the team around him it was .

Speaker 1 16:05

It was miserable because not only were we trying to ensure that we want to get breached , like our competitor , but now we're , you know , trying to deploy these tools at the quickest pace of these vendors had ever seen . You know , I talked with the vendor that I was in charge of their solution and I asked him you know what's the quickest deployment you've ever seen with this solution at any other customer ? And he said , oh well , I'd have to . I have to , you know , ask around and get back to you , right ? They said the quickest full deployment was 18 months . I said , okay , you know what did we do it in ? He goes you did it in six weeks . Yeah , oh , I guess that was a little quick .

Speaker 2 16:52

Yeah , yeah , and I actually had a similar experience right coming here to abnormal security , where we were able to buy and build things very quickly , which was for me a whole new world , because in a massive fortune 500 , fortune 100 company , you know things move slowly and there's lots of red tape , and so you know to deploy a new sim would take 18 to 24 months , you know here , you know , three weeks , because everybody is pulling in the same direction .

Speaker 2 17:23

It was a massive difference . So that's exciting , I will say .

Cybersecurity Challenges and Changing Mindsets

Speaker 2 17:28

Part of the problem with the blank check , though , was that , because you know they did , they , the CEO , cfo , they all come down and say , okay , just tell me , tell me how much to write this check for us that we never have this happening . And that's where you have to have our conversations say , guys , it's , it's not how it works . Right , we can build a lot of defenses , we can better protect ourselves . We can certainly lessen both the likelihood and the impact of a compromise going forward , but to say it'll never happen again , that's , that's not something that we can do . So what we'll do is better position ourselves to lower the likelihood of it happening again , but in the event that it does and it likely will at some point but in the event that it does will lower that impact as well . So that's the key . That's what we're trying to do . It took a minute to kind of re-scope people's mentality on this .

Speaker 1 18:24

Hmm , yeah , that's . That's interesting because I feel like you know executives at that level they're not , they're not used to not being able to throw money at a problem and have that problem be fully resolved . You know , that's always kind of the question and the approach that's taken . But with security it's like , yeah , we could throw $20 , $30 million into this thing , we could have the best tech stack , the best you know engineers in the country working on this thing , and we could still get breached by something that you know we didn't even know existed . You know , because that's what a zero day is . You know they could use , they could literally just use a zero day on us and get around everything that we just did .

Speaker 1 19:18

You know , and I feel like it's also really important to what you did , there is , you know , explain it that way , you know , because a lot of security teams would just take that money and you know , like run for the hills basically , and that's maybe the worst case because what if you take all that money , you deploy all these tools , do all that work , you get the increased headcount and then you get breached . Well , now your job is at risk because you didn't properly , kind of prepare them . You know for that reality . And so now it looks like you're incompetent , when in all actuality you're not incompetent , you know . It's just how it works . In security , yeah yeah , absolutely .

Speaker 2 20:01

It takes a while to change the mindset right . That's the big , that's the key thing , I think .

Speaker 1 20:08

Yeah , that mindset is the hardest thing I feel to change . You know , right now I actually I work at a pretty large company and when you said , you know , yeah , it's going to take 1824 months to deploy this SIM , you know it took me . It took me like 12 months to get through a POC of a far smaller solution than a SIM . It's like embarrassingly slow . You know , like guys , I would have had this done in three weeks , like , come on , just let me , let me do some work .

Speaker 2 20:43

Yeah , yeah , I know I'm with you , yeah . And the other thing in terms of , you know , avoiding future compromises is that , no matter how good your tech stack is , right , bad guys are always coming up with new and exciting ways of circumventing them . So you know , you look at some recent breaches that we've seen hit the news . You know they're not even targeting technical things anymore . They don't even use a zero day . Often it's not , it's not nearly that complex or technical . They just pick up the phone and call the help desk , right . It's more social engineering that we're starting to see these days , right , Because people are easier to hack than systems . It's just that simple .

Speaker 1 21:28

Wasn't that the case with LastPass , the LastPass breach , where they like called up support and the support guy had enough access and they just sent him a link and he , you know , he clicked on it , like he normally would , you know , and it completely compromised LastPass as a whole .

Speaker 2 21:46

Yeah , yeah , or you look at some of the recent things happening in the desert , right in Vegas , you know where they just picked up . Picked up the phone , called the help desk purported to be you know a high level security engineer and they reset his password , they reset his MFA for him , and suddenly we've given the keys to the kingdom to a bad actor . Right , it wasn't enough . They just reset his creds , but they also reset the MFA token so that he could get directly in the right way . Right , he didn't have to print anything . There was no like , there was . No , there was no link , there was no malicious activity of any kind apart from social engineering . And that's really what we're starting to see these days .

Speaker 1 22:32

Yeah , it's really interesting you bring that up . You know , when earlier on in my career I did a lot of work with the government and there was a slew of documentation and background checks that I had to do and I didn't even have a TS , right Like I didn't even have Top Secret , I didn't even have Secret , you know I couldn't touch a keyboard and I still had to fill out like a 80 page document about . You know , every place that I've been since I was born who .

Speaker 1 23:05

I spoke to like , yeah , all that stuff you know , and one of the things in there like a part of my training , I guess you know , I was talking to my handler and we somehow we got into this conversation . It was pretty late at night so I don't remember quite exactly what it was , but we were discussing about how people get compromised and he said , you know , from his own experience , right , he , you know , he had a sick kid with cancer . His credit card bills were very high and he was waiting on a tax return to actually pay off the credit cards . Because , you know , he's in government , he has a clearance , he has to make sure that it's low . But it wasn't anything that he did , you know , like he wasn't buying cars , he was like he was buying medicine for his kid and so the agency knew about it . You know , they , they were very understanding of it . But he said that you know , enemies will look at that and say , oh , we could cut him a check for , you know , a small amount of money 20 grand and it'll alleviate that debt and

Trust and Verification in Security

Speaker 1 24:21

we'll do that . Just for a name , right , he doesn't have to tell us anything else was doing .

Speaker 1 24:25

For a name they make it sound very small , very minute . Like what would you ever do with a first and a last name ? Like I'm not even giving you the title , you know , like nothing like that , and you know that's a good point , right . Like I don't know if something like that took place , but like these , these , these people out there , you know that that don't like America or don't like your company or whatever might be , they will literally , you know , pay you tens of thousands of dollars just for a name . I mean , that's a , that's an absurd topic to me , right to go down , because to me that means nothing and that's such a minute thing . I would never , personally , if I was ever confronted with that situation . I mean , now , obviously you know I wouldn't make that choice , because now I have that knowledge , but beforehand I would never , I would never second guess it . You want to give me how much for a name ? Dude , I'll give you the roster . You know , like that's where my mind would be .

Speaker 2 25:33

Sure , yeah , and the thing is and while that definitely happens right , I mean , when I was in the military , that was definitely something that we talked a lot about , you know is reporting those kinds of things . We're well trained to expect and report those kinds of interactions , regardless of how innocuous they seem . You know ? You look at Tesla . A few years ago , there was an external threat actor that offered a Tesla engineer significant money to just simply produce a single file of malware and let them they'd take it from there , and it was , and he thankfully reported it . So it didn't become an issue . But more , what we're seeing , at least in my experience , is bad actors that are preying on the good nature of human beings . You know , as security people , we don't trust anybody , right ?

Speaker 1 26:31

I suspect everything .

Speaker 2 26:33

I'm paranoid , that's just . You know , that's how we are built . However , like Marcy , over in finance isn't built that way , right , they're just people in service roles . Their job is to help people . If you work in finance , your job is to pay bills . You know , if you work in HR , your job is to help people solve problems . And so when someone comes to you needing a bill paid or needing a problem solved , they don't typically look very deeply into those things . They just don't suspect , you know , bad motives , and so they respond to that call for help . Right , you know ? I've talked to an FBI psychologist just before who talked about the power that comes with the request for help . Right , I need your help . Those four simple words right , I need your help . Those are powerful words and they can elicit people to do things they wouldn't otherwise do or that they might be more suspicious of . But because they feel like they're helping someone , they'll do more , they'll go further and not be suspicious , not think they're doing anything wrong and yet be the source of the compromise .

Speaker 1 27:51

Yeah , that's a really good point that you mentioned . You know , security professionals are some of the most paranoid people that I know . You know I feel like calling it paranoid is not doing it justice , but you get what I'm saying , you know . I'm sure all of our listeners , you know , understand that , which you know brings up a good point . You know , currently , and my current role , right , we POCed a bunch of different WAF solutions , chose one of them and my first response was hey , I want to stand up a Kelly Linux box and I want to pound this thing when we deploy it right as it's going live . As we're creating the rules , I want to make sure that these rules that they claim is working . I want to make sure that they're actually working .

Speaker 1 28:41

And almost everyone in the room was like you know , you think that they wouldn't , you know , already know that this is working when they're deploying it . Like we have the vendor that created it deploying it for us . I'm like , yeah , that doesn't matter to me . You know , if we're spending this amount of money , we need to know definitively it's working . Like not know , you know , oh , yeah , I'm sure it is . You know , I configured it right . Like no , I ran the configuration issues in the POC for a reason you know , like I configured it to the best of my knowledge and it wasn't working . Yeah , you know . So what does that say about , you know , this solution ? Like I have my own thoughts on it , but obviously I want to , you know , trust but verify . And I think the only other person in the room that agreed with me was my CISO . He's like , yeah , that's exactly why you're here . Like we need someone thinking outside the box , because everyone else in this room is just going to blindly trust this vendor because they put , you know , millions of dollars into this product .

Speaker 2 29:44

Yeah , I'll tell you , the military does a good job in a few areas and one of them and I'll be honest , I didn't understand the need for it then because it was not very pleasant . But when you go through the gas chamber in basic training , right , we have this CS gas . It's a tear gas , very like you know military grade of tear gas , and to give you confidence in your mask , you have to go through this gas chamber . And so you'll go through . It's very unpleasant . They give you the mask . They tell you the mask works .

Speaker 2 30:18

I was initially comfortable trusting . I just I'll trust you . I don't need to go through the gas chamber for you , you know , to trust that the gas mask works . But the reality is for all of us to truly understand and appreciate that it works . You got to test it and you got to test it in the worst way , which is you go in there no mask , right , or you go in with the mask , then you take the mask off , you breathe in , you choke , you cry , right , and then you throw the mask on and realize this works . And so it was a lot about not only training how to use it , but it was also learning to trust that it works . I think that's an important lesson in terms of security tooling today as well . Right , we can trust the vendors so far , but I would encourage you and I tell that to my clients right , our customers throw everything you got at it right ? That's how you'll trust it and how we'll make sure that we're meeting your needs . So that's absolutely critical .

Speaker 1 31:22

Yeah , that's a huge thing that trust would verify . You know , when you bring up the gas chamber there , it makes me remember , or recall , when people were saying that that's too cruel . Right , that's like too cruel for our soldiers to go through . It's like the very first time that they should experience CS . Gas should not be on the battlefield . They need to know one , they're not dying and two , they can get through it because they did it before .

Speaker 1 31:57

All of these things are absolutely critical . It's the same thing with security or IT in general . You have to build up that resistance . You have to launch a cross-site scripting attack yourself to understand what's actually going on . When I understood what a cross-site scripting attack was , it wasn't because I read it in a book , it was because I did it and I saw oh wait , a minute , I just made this query a little bit weird and I got back three accounts when I should have got back one . Okay , now I kind of understand what's going on . Here I get the function that's going on , which I think is an interesting segue into abnormal security . So let's start with what abnormal is . What's the problem that abnormal security is trying to solve ?

Speaker 2 32:55

Yeah , so abnormal security is an AI native , an AI native email security solution that uses behavioral data science to really baseline your environment and understand deviations from nor so , if you think

Emerging Threats in Email Security

Speaker 2 33:09

. If you go back a little bit in history and you think about the move from antivirus to EDR , right , instead of trying to define what evil looks like and then find it based on what we know it looks like , edr changed flip tables . It changed the game entirely and said what if we don't care what evil looks like ? What if we just know your environment so well that when we see a process run and spawn another process , right , microsoft Word shouldn't probably spawn another process ? That would be incredibly unusual , at least certainly 10 years ago , maybe a little less so today , but still there are certain behaviors . Regardless of how evil gets into an environment , it sort of standardizes in what it needs to do next , and so that's how EDR changed the game . Well , abnormal came along and our founders didn't come from the email security space . They actually come from AdTech , so advertising , and they had learned a lot about machine learning and understanding behavior through machine learning algorithms , large language models , and so they were actually behavioral data scientists and started to talk to other folks in the security industry and said what is a problem that isn't solved ?

Speaker 2 34:34

Well , today , and one thing kept coming up email . You know it's 2023 . At the time it was 2018 . And we're like , look , email's been around since the dawn of time in terms of the internet and networking . Why are we still talking about email security ? And the reality is because nothing had really solved it completely . You know , you think about what we used to see malicious links , malicious attachments . Those were the kind of the bread and butter of bad guys . And the reality is today , you know , bad guys aren't even using these tried and true methods . We've trained our users in all what worked then , but are now the wrong ways to think we train them . Don't click on any links , and you'll be fine . Don't open any attachments from somebody you don't recognize , and you'll be fine . Look for misspellings or bad grammar , and that's how you know you found the bad guy . Right , that's a phishing email . Look , the reality is bad guys have departed from those tried and true methods in favor of more advanced attacks .

Speaker 2 35:47

Right , first , it started with Grammarly long before generative AI was a thing . Right , ai , ml , nlp , these things they've all been around a good long time , but the transition into AI that generated net new content . That is a relatively new concept . Right , chatgpt was released almost a year ago today , right November 30th , I think 2022 kind of changed . But even before that they were using Grammarly to improve and so . But now , with the advent of ChatGPT and Bard and other generative AI solutions , we're seeing threat actors that couldn't formulate a coherent English sentence two weeks ago can now write a very they can craft a very good , realistic phishing message , probably better than my 10th grade English teacher , mrs Fox , I mean , and that's saying something . So that's what we're seeing is things are leveling . Generative AI , ai in general , has leveled the playing field for bad actors .

Speaker 1 36:57

Hmm , yeah , you bring up a very valid point . Is that email security really hadn't changed in , I mean , a decade ? You know , like it's kind of the same exact thing , like oh , this is how you train your users on email security . These are the rules that you configure . You know , like it's such an antiquated method it would never keep up , you know , in modern day . You know security , yeah .

Speaker 2 37:28

Yeah , and so , at my last , my last job , you know , I just had never seen a good solution to an email that simply said hey , bill , it's Bob , give me a call when you get a minute , because that's what we're seeing today . Right , bad actors , it starts with a conversation . Right , if they can , the social engineering attempts that we're seeing today , really just seek to start a conversation and carry it from there . Business email compromise is the number one , you know , at least in terms of financial impact , the number one security threat for the last three or four years running , according to the FBI's ICEN 3 report .

Speaker 2 38:05

So , you know , this is what we're seeing . And so when I and I remember thinking at my last company , I had all the right tools , had a wonderful tech stack , I'd spent three years building with my leadership , flipped it over entirely , had upper right quadrant stuff across the board , it was the tech stack of my dreams .

Speaker 2 38:26

And yet there were still things slipping through and so we needed to think about things differently . Right , you look at the way email security has traditionally been you set a secure email gateway on the perimeter of your environment to protect you . That's great . It's largely looking for again defined evil . Right , it knows malicious IPs , malicious URLs , malicious attachments , but if those things aren't present and if DMARC , dkms , pf all check out , it's going to deliver that message regardless of what it says , because it couldn't really look into the body of the message .

Speaker 2 39:07

And then I took a meeting with Abnormal's founder and he explained Zanjay . He explained that Abnormal was fundamentally different . Rather than trying to sit on the perimeter and guard things and evaluate them as they pass , it would sit outside as a SaaS solution . It would sit outside your network entirely and make API calls directly into your email tenant , evaluate every message , including those that are that east-west traffic that nothing else could see . Right , 70% of all email traffic is internal and so tags are blind to that . And so , hearing all of this , I said , okay , that's great . I mean , how long is this going to take to install ? This is going to take months . You know , I was a Fortune 500 bank . I mean , I couldn't do anything in weeks , let alone months , sending up the infrastructure . It's going to be a nightmare . And he said no , no , no , no , no , that's not how it works , it's all going to just take minutes . It takes three clicks and because it sits outside , you don't have to change your mail flow , you don't have to make MX record changes , right , all you do is give it the creds and we're off and running . And I said , okay , we'll see . And sure enough we did . We set it up as a POC and I got a report the next day and I'll never forget looking at that report , thinking wait , wait , wait , wait . Let me just understand . All this is slipping through my tech stack right now . And he said , yeah , and listen , we want to , we want to call your attention to one message in particular . This one here . This is your HR business partner corresponding in real time right now with a threat actor . And I went no , no , no , no , oh my gosh . And sure enough it was .

Speaker 2 40:56

That particular one was a direct deposit fraud case where they were trying to convince our HR person that one of our internal users was trying to change their direct deposit . They were on vacation and , to be fair , the threat actor had done their homework . They used the world's greatest hacking tool , linkedin , found someone with a high you know big title and probably a lot of money , went cross-referenced that with Facebook , saw that they were posting pictures from Cabo and realized this person's on vacation . They created a Gmail account . That was the user's first name , dot . Last name , addgmailcom it was an unusual name and it looked very legit .

Speaker 2 41:41

And from that email sent a note to our HR business partner and said hey , I just I'm on vacation . That's why I'm emailing you for my Gmail account . I don't have access to my corporate account right now . I just realized we changed banks before we went on vacation . But this is really important . I need you know we're on vacation . I need my next check to come to the right bank . Can you take my direct deposit information ? And she was like no , you didn't fill out the right form . It's attached for your convenience and wouldn't you know it ? Threat actor fills it out , probably better than any employee ever would , and she was getting ready to make those changes when we caught it . So , as I say , it didn't take much more to convince me we found the right .

Speaker 1 42:32

So you know what I hear a lot of the times . You know everyone's using Microsoft Office . You know 0365 , right , everyone kind of thinks that Microsoft has this stuff . You know kind of locked down that it's , you know , not going to really get through . You can get by with their default settings . You know what I mean . How do you break that mold ? You know ? Do you break it by showing them ? Because I'll tell you right now . Actually , you know , we looked at abnormal internally , right , and it was that exact same mentality . It was like we already have Microsoft . Like what are they going to provide that Microsoft isn't ? And then when we talked to Microsoft and Microsoft referred abnormal security and we're like , oh , wait a minute , like Microsoft provides similar things and they still refer to us to abnormal , you know . So , like , how do you break down those boundaries ?

Speaker 2 43:40

Yeah , I think the key thing is to understand the differences . Right ? Microsoft , to be fair , very good , right ? If you've got an E5 license and you've got all of this spam stuff turned on , you've got they do a great job with defined evil . Right ? If they know that this is a known malicious IP address , a known malicious sender URL , if you know they can look at how recently the URL was stood up , they can do lots of things on the front end .

Speaker 2 44:10

However , where they admit right to their own . You know , as they brought you guys , you know they told you guys to look at us . You know they're admitting that there are still things that they don't do well , and one of those is identifying malicious activity without a link , an attachment , without any known evil , and that's where we come in . We're using those large language models , we're using behavioral data science to baseline your entire environment . So what I say , what I mean when I say that , is that you know when let's go back to that that added you a moment ago hey , bill , it's Bob , give me a call when you get a minute right , the things that we may know . Having lived in your email environment for a while , we know that Bill actually goes by William right .

Speaker 2 45:02

Bob knows that , and so for the first time ever , bob calls him Bill instead of William . Even though they've been friends for a long time , they've traded thousands of email messages , he's never called him Bill . Well , that's unusual , right . And then it comes from a place that we just don't expect , right , where the timing is off . You know , there are certain things tonally , by using , by evaluating the content of the message , using natural language , processing large language models , what we can do is understand , break , parse out the message itself , the message body , and understand what's actually being said for the first time , and so , because of that , we can understand tonal changes . This isn't how Joe normally sounds , you know he doesn't . He's not this formal in his messaging . Normally , some things and some things differ .

Speaker 1 45:58

Huh , yeah , I mean you just answered probably like my next two questions , right , I was going to go back to that email and you know ask how do you defend against it ? And to you know what's a large language model ? You know , because you always hear , you always hear these terms with vendors and at some point , you know , as a security professional , you kind of just gloss over it , right , you don't even , you don't even look into it anymore . But that that makes a lot of sense as to why and how abnormal is able to kind of change the email security landscape , because you're looking at the actual context of the email , with the context being the other millions of emails that are sent within the environment .

Speaker 2 46:41

Yeah , and not only that , but because we're plugged in at that level . Let's assume you're using a Microsoft 365 account for email . You know we also support Gmail as well if you go that route . But so if you're using Google workspace for mail , but let's assume it's Microsoft 365 . Because of the way you plug in using the API Microsoft's Graph API what you can then see also is all of AD .

Speaker 1 47:08

So now I see everybody in your company .

Speaker 2 47:11

I know what all of their titles are , I know what the work groups are , I know who's bosses who's and , and now I get this rich , the richest understanding of who you are as a person . Now , when you couple that together with all of the past emails I've ever seen you send or receive , I now have this tremendously rich understanding about who you are and how you communicate and who you do it with . So suddenly get a new message that purports to be from a friend , right , or maybe it's a vendor that you do business with , but something's amiss , right . They call you by the wrong name . It doesn't come from the right email address . It doesn't come from the right IP address or URL . Something's amiss Even if it so . With vendor email compromise , we're starting to see vendors get compromised , their email accounts get compromised , threat actors living in those email accounts for a while , understanding who folks do business with and then targeting and praying on those trusted relationships from the right message right from the right email account .

Speaker 2 48:21

And yet we can still detect that based upon tonal changes , based upon the way we've the history of how you talk , so , and we've caught that before . It's very interesting , Hmm .

Speaker 1 48:35

Yeah , that's really it's . It's a fascinating way to look at it , you know , like it . It makes me wonder why no one else ever thought of that before . But I mean , I guess that's a topic for another podcast .

The Future of Email Security

Speaker 1 48:49

You know , where , where do you see abnormal Going in this space in the future ? Right , where do you see email security going and growing in the future ? You know , if you would have asked me , you know , 10 years ago , if this is where email security would have gone , you know it wouldn't have been something that crossed my mind , right ? I would say it's a good idea . But I I never would have said you know , oh , yeah , like that's where it's going , yeah , so where do you think that it's going ?

Speaker 2 49:19

Yeah , I think the key is AI . Right , ai is changing everything . It's changing everything on both sides of the fence , right ? So in terms of threat actors , it's leveled the playing field . It's also to allow them to scale attacks in a way we never could have envisioned before . And so I think what it takes and what you're going to see you're starting to see it now , but I think it's going to proliferate in a massive way soon which is Security solutions beginning to use AI to combat right , good AI to combat that bad AI . Because the reality is , as the threats scale up , our defenses need to scale up as well . Because we're seeing so much more throughput In terms of malicious activity , it's going to take different security solutions that are leveraging machine learning that can , that can parse through thousands and thousands , tens of thousands of signals to identify that thread of of abnormal , of abnormal , to chase that down and identify that and tell you , as an operator hey , I think we have something unusual here and it's Really based on the volume of signals that we're seeing .

Speaker 2 50:40

It's too much for a human to probably unite that way , and so it's going to take artificial intelligence through through machine learning algorithms that can parse all that data together , just like a sim can aggregate and correlate data together from logs . We're going to need it upstream , though , right in our different security solutions . You're going to need it in your email security . You're going to need it in your EDR . You're going to need it in in in your firewalls To be able to parse through and and understand . Unite all of the disparate information together to understand what's going on .

Speaker 1 51:17

Is there ? Is there any thought around potentially creating , like a verified user , uh , you know , logo or icon ? Um , you know , in an email so like , let's say , you know I'm talking to a vendor , both of us are abnormal security customers , so you would know if the person that's sending me the email is a real user , right , and you could tell if I'm a real user ? Um , is there any thoughts around , you know , maybe Adding a logo to that email saying abnormal security , verified user or something like that , right , because that would that would really , I feel like , just from a , from a user perspective , you know , that adds a lot of peace of mind where it's saying like , hey , I know I'm responding to the right person in this case . Um , you , anything like that ?

Speaker 2 52:12

you know we've talked about that before . You know , uh , google just released that capability . You know the sort of the blue check mark , if you will . You know , if you go back to twitter's uh , mentality , um , you know , we've looked at that concept before . The challenge with that Is that this is that that was the concept of the sender policy framework spf Using dmark and dkim to verify the authenticity of the sender . So , so those things actually already exist and as long as we're all good corporate citizens and you have your spf set to fail and and or reject or whatever , um , you shouldn't be allowed to spoof . Traditional spoofing has kind of fallen out because most companies Do the right thing they set up their dmark , their dkm . Spf is set to reject , so if it doesn't come from the right place , it shouldn't reach you at all in the first place . That's that's sort of email security 101 .

Speaker 2 53:10

Now , if you , if you fast forward , the real challenge then becomes how hard is it to compromise an email , a cloud email account , today , right , whether it's credential stuffing using Um compromise creds that are found all over the place , uh , that because users refuse to change their passwords like , or they use weak passwords , or whether it's , uh , whether it's like a credential phishing attack and I've now collected your creds Regardless .

Speaker 2 53:38

Let's say I have your creds Logging into your it's . It's already a done deal . If you don't have mfa enabled , right , I can just log directly into your office 365 account . Now , if you have mfa , I can still brute force it , right , I can still try and smash you at 3am with push after push after push until eventually you just accept one . And now I'm in . So Compromising a cloud email account by itself today , it's pretty trivial to do . The danger then becomes now that I'm in as you into your account . I can send messages as you , with the blue checkmark or whatever would be there . So I fear that it would give a false sense of security in the in the circumstance of an account taken .

Speaker 1 54:28

So that's where you've got to be cautious of these days . Yeah , that makes sense . I um , somehow I didn't think of that , but it definitely makes sense . Well , mick , you know , I really appreciate you coming

How to Find Abnormal Security

Speaker 1 54:42

on . Unfortunately , I think we're at the the top of our time here , um , you know . So , before I let you go , how about you tell my audience , you know , where they can find you if they want to reach out , where they can find abnormal security , if they wanted to learn more about Abnormal ?

Speaker 2 54:56

Yeah , yeah , you guys can reach me directly at mick at abnormal security calm . That'll reach me m I c k at abnormal security calm . You can also go to abnormal security calm slash demo if you want to see how this works , because seeing it live Changes lives . I'm going to tell you that right now . And lastly , if you want to sign up for a free risk , free trial , if you want to , we can come in and do a report . You can go to abnormal security calm and uh and we'll , we'll be able to set you up there as well .

Speaker 1 55:29

So , yeah , I think we're going to be able to do a report . You can go to abnormal security calm slash demo if you want to see how this works .