Top 5 stories from Cybersecurity Dive

Once the adrenaline wears off after a cyberattack, the feeling that can wash over cybersecurity professionals is best described by Jackson Browne’s 1977 hit “The Load Out.”

A 32-second long earnest piano ballad precedes a crooning Browne, who goes on to sing a tribute to his roadies and fans: “Now the seats are all empty/ Let the roadies take the stage/ Pack it up and tear it down.”

For Allan Liska, threat intelligence analyst at Recorded Future, it's the perfect description for the aftermath of a security incident.

“Suddenly, the incident response teams are gone, the lawyers are gone, the insurance company’s gone, and now you have to put your network back together and rebuild security,” Liska said.

The highs and lows of incident response and recovery manifest a gloomy state of mind for many cybersecurity professionals. Finding an outlet, space and time to unwind is critical.

“You need to have that separation or this job will kill you, literally kill you,” Liska said.

To release tension and break away from the often chaotic work of cybersecurity, defenders have to get creative, and exhibit practice and intention. One of Liska’s outlets of choice — writing comic books — allows him to create characters that get to punish ransomware criminals.

Cybersecurity work is stressful and an extremely nerve-wracking way to make a living. Alerts flagging potentially malicious attacks are constant and they have to be taken seriously because every defender reluctantly knows attacks will happen, it’s just a matter of when.

On top of all of that, consider the insider’s perspective and insight they have into the personal threats criminals will make to extract a ransom payment from their victims. There is no honor among thieves.

Cybersecurity Dive spoke with more than a dozen security experts about the personal tolls of their job and simply asked: Are you OK? Some laughed nervously, others were momentarily taken aback by the question, and a few hinted at burnout, but the first response for each of them was, unequivocally, yes.

“My therapy session starts now,” quipped Stephanie Carruthers, chief people hacker and global head of cyber range at IBM Security X-Force.

Defenders who are doing well at work and in their personal lives have to recognize behaviors and circumstances that can throw them off course. Working all the time without breaks or meaningful distractions from the torrent of malicious activity is a surefire way to burn out, or at least undercut the ability to perform at a high level.

“If it’s always on my mind, I’m never going to have that fresh thought,” said John Dwyer, director of security research at Binary Defense.

“As much of a science cybersecurity is, a lot of it is an art and usually your best ideas come to you whenever you’re thinking about different things,” Dwyer said. “Being the best that I can be means that I’ve got to take care of myself, too.”

Coping mechanisms

Damage control is a two-way street — on the job and away from work. Many people are attracted to cybersecurity because of its mission, yet the job can be stressful and all-encompassing.

Huntress CEO Kyle Hanslovan said he almost burned out seven years into running the company he co-founded in 2015. Early signs of fatigue, which threatened to hinder the type of difference Hanslovan hoped to make, motivated him to turn things around.

“I don't know much in regards to psychology, but as somebody who regularly does personal therapy, it turns out for all of the negativity that you can focus on, there is just as much ample opportunity for that dopamine hit when you're doing good,” Hanslovan said.

“Look at me now,” he said during an interview in San Francisco’s Yerba Buena Gardens during the RSA Conference in May. “I’m not wearing a jacket, I’m wearing some Chuck Taylors, I’m out here having a good time and I’m going to hang at this trade show with my friends.”

Some people find meaning and the strength to absorb cyber-fueled tragedies in deeply personal ways.

“I’d rather that I see the bad, such that my daughter doesn’t have to,” Amazon CISO CJ Moses said.

“It’s one of those, take the bad out of the world as much as you can for those that you care about the most,” Moses said.

A career, at a cost

While many people in the security industry acknowledge the stresses of cyberdefense, detriments to wellbeing continue to cause havoc on mental and physical health, Forrester analysts said in an April report.

Burnout is preventing people from entering the industry and causing critical talent to leave for other professions, the report found.

Many CISOs told Forrester everything was a battle, and the human costs were so significant they decided to not just leave the job but leave the field entirely to reclaim some balance in their lives.

“It’s a really tough role and things like meditation apps aren’t really going to help with that,” said Jess Burn, principal analyst at Forrester.

For people on the front lines, fatigue and stress are rampant. More than 4 in 5 cybersecurity professionals are experiencing burnout, pentesting platform provider Hack the Box found in a June report.

“Many cyber pros are considering leaving their position or the industry altogether if their roles are impacting their personal lives too much,” Hack The Box CEO Haris Pylarinos said.

With cybercrime surging, business leaders need to address burnout now before it snowballs into a bigger issue, Pylarinos said.

The job is especially difficult for people fighting a five-alarm fire every day. For incident responders, the calls for help come often and at unseemly times.

“We always joke, Friday you’re going to get a call. And it happens,” said Sam Rubin, global head of operations at Palo Alto Network’s incident response firm Unit 42.

Rubin said he worries about burnout on his team more than himself personally. He tries to structure work, expectations and resources in a way that provides practitioners important downtime. “But, it’s still hard,” Rubin said.

Unit 42 CTO and VP Michael Sikorski takes comfort in surrounding himself with people that are trying to fight the good fight.

“The reason we got into this is to do away with all the evil that’s happening out there,” Sikorski said. “The type of people who tend to gravitate to this, they want to be in the trenches.”

Hardship is relative

The psychologically taxing impact of cyberattacks cuts deep. More than 2 in 3 incident responders have experienced stress or anxiety in their daily lives and sought mental health assistance as a result of responding to cybersecurity incidents, IBM Security found in a 2022 report.

Some executives maintain the right balance with a reflective perspective.

“I have a small superpower in that I’m an immigrant,” LastPass CEO Karim Toubba said, who came to the U.S. from Aleppo, Syria when he was nine years old.

“I often say that my worst day here is better than my brothers and sisters back home,” Toubba said.

Toubba said his tendency to take hardships in stride helped him a lot personally last year as LastPass recovered from a cyberattack that exposed a cloud-based backup of the password manager’s entire customer vault database.

“Balance is something that was elusive for years,” Toubba said. “I think I’m much better at it now.”

John Hultquist, like many cybersecurity professionals, has a background in the military that’s served him well as chief analyst at Mandiant Intelligence.

“I remember being in a truck full of cab scouts driving around Baghdad. We expected that we were going to get hit with a [roadside bomb] any day, and the only way you could get through it is you had to laugh it off,” Hultquist said.

“You have to try to not take yourself too seriously.”

The U.S. Supreme Court ruling to overturn the Chevron doctrine could have major implications on the cybersecurity regulatory landscape at a time when federal agencies have enacted significant requirements designed to strengthen incident reporting and meet baseline security standards. 

The ruling will likely lead to new legal challenges against recent cybersecurity regulatory measures, including the 2023 cyber incident reporting requirements from the Securities and Exchange Commission, according to the Center for Cybersecurity Policy and Law.

The Supreme Court ruling could impact rulemaking on the Cyber Incident Reporting for Critical Infrastructure Act, too, according to the CCPL. Officials see the potential for the ruling to impact baseline requirements for the healthcare industry or future efforts by the Environmental Protection Agency to mandate cybersecurity rules for drinking and wastewater treatment utilities.  

The Chevron doctrine stems from a 1984 case, Chevron U.S.A. v. Natural Resources Defense Council, which set the precedent for courts to yield to the expertise of federal agencies to interpret ambiguities in a statute. 

The Supreme Court ruling involved Loper Bright Enterprises v. Raimondo and alongside a second case, Relentless v. Department of Commerce.

The U.S. Chamber of Commerce called the Supreme Court ruling an “important course correction” that will help create a more stable and predictable business environment.  

SEC cyber rules in the hot seat

The SEC rule passed in 2023 requires publicly traded companies to report cybersecurity incidents to the agency within four business days of determining their materiality. Companies must file annual updates that outline their strategies for how to mitigate cyber risk.

In October, the SEC also filed suit against SolarWinds alleging the company and its CISO defrauded investors by failing to disclose its true cybersecurity risk leading up to the 2020 supply chain hacks by state-linked hackers. 

The Chamber of Commerce and Business Roundtable filed briefs in the SolarWinds case arguing the SEC had expanded its authority in the case far beyond the original intent of Congress. 

Legal and cybersecurity experts are still evaluating what the impact of the Chevron doctrine ruling will be on future regulations. However, Brandon Pugh, director of cybersecurity and emerging threats at the R Street Institute, said the ruling will force federal officials to rethink how they approach future cyber regulations to make sure they don’t create an overly burdensome environment for critical infrastructure and industry partners. 

“I think it may give agencies more pause to think about their legal justification, and perhaps look to Congress for more authority in the cases of ambiguity,” Pugh said in an interview.

Officials from the SEC and the Office of the National Cyber Director declined to comment for the story.

 

CrowdStrike CEO George Kurtz’s immediate and unreserved apology for a doomed software update that took global IT systems and networks offline July 19 marked an uncommon episode in the cybersecurity industry.

Cybersecurity executives aren’t in the habit of saying sorry or admitting to mistakes.

Hours after CrowdStrike’s software update crashed huge swaths of the global economy Friday, Kurtz was on “Today,” apologizing for the mistake as its cascading effects were still unraveling.

“I want to start by saying we’re deeply sorry for the impact that we’ve caused to customers, to travelers, to anyone affected by this, including our company,” Kurtz said on NBC’s morning news program.

With CrowdStrike’s reputation on the line, other top executives at the cybersecurity vendor followed suit with candid apologies and accepted responsibility for the damage.

“On Friday, we failed you, and for that I’m deeply sorry,” CrowdStrike CSO Shawn Henry said in a LinkedIn post.

“The confidence we built in drips over the years was lost in buckets within hours, and it was a gut punch,” Henry said. “We let down the very people we committed to protect, and to say we’re devastated is a huge understatement.”

While CrowdStrike’s response isn’t unprecedented, the damages its ill-fated software update caused are beyond comparison.

“Nothing of this scale or magnitude has happened in recent memory, if ever,” Kelsey Eidbo, a crisis communications professional and VP at Infinite Global, said via email.

“Cybersecurity firms are typically not the story because they intentionally operate behind the scenes,” Eidbo said. “The crisis at Crowdstrike this week was a wake up call and will certainly go down as a cautionary tale for cyber firms, IT vendors, and all of us who rely on them to keep the world spinning.”

A rarity in cybersecurity

Mea culpas are sparse in the cybersecurity industry. CrowdStrike accepted an usual level of accountability of its own volition — and without condition.

“Kurtz's quick apology for a defective software update is rare in cybersecurity — I can’t think of any other case — but reflects a growing trend of corporate accountability,” Mauricio Sanchez, senior director of enterprise security and networking research at Dell’Oro Group, said in an email.

CrowdStrike’s rapid and energetic response was also an act of damage control and self-preservation.

From a crisis management perspective, it was critical for CrowdStrike to get ahead of any rumors and “confirm as soon as possible that this was an outage rather than a breach,” Eidbo said.

“Companies that acknowledge and take responsibility early, publicly and proactively, position themselves as the authority and foremost expert on the issue facing their own company, and, in the case of a vendor, lessen at least some of the burden, from a reputational standpoint, on their customers,” Eidbo said.

As executives managed one of the worst days for CrowdStrike since it was founded in 2011, executives sought to control the narrative about what happened and engender confidence in its response.

“The fact that CrowdStrike embraced an open, contrite, and all-hands on deck approach certainly helped,” Katell Thielemann, VP analyst at Gartner, said via email.

“We have seen examples when companies have decided to go the other way by not acknowledging security defects, by deflecting blame, or by trying to hide facts and delay communications,” Thielemann said. “That’s when brand damage occurs.”

Rebuilding trust in the thick of recovery

At their core, cybersecurity vendors play an incredibly difficult role in the software ecosystem: spot and alert customers to malicious activity, mitigate risk and stop attacks. Their job is to keep systems safe and secure.

Security vendors that approach major incidents with transparency, accuracy and responsiveness have a better relationship with their customers, and a swifter, less reputationally damaging recovery, according to Allie Mellen, principal analyst at Forrester.

“Trust is paramount in the relationship between a security vendor and its customers and partners. This is true for all vendors, but security especially, where reliability and competence are fundamental,” Mellen said via email.

“CrowdStrike has built a lot of trust with its customers over the years, and how it approaches this incident will define its relationship with customers moving forward,” Mellen said.

The brisk and remorseful response of CrowdStrike’s leadership also caught the attention of federal authorities who were working closely with the company and partners across government and industry to recover and restore operations.

“While it wasn’t malicious, it was a serious mistake, one for which Kurtz took full responsibility, apologized, and committed to resolving collaboratively,” Jen Easterly, director of the Cybersecurity and Infrastructure Security Agency, said in a LinkedIn post.

Years of accumulated security debt at Microsoft are seemingly crashing down upon the company in a manner that many critics warned about, but few ever believed would actually come to light. 

Microsoft is an entrenched enterprise provider, owning nearly one-quarter of the global cloud infrastructure services market and, as of Q1 last year, nearly 20% of the worldwide SaaS application market, according to Synergy Research Group.

Though not immune to scandal, in the wake of two major nation-state breaches of its core enterprise platforms, Microsoft is facing one of its most serious reputational crises.

“It’s certainly not the first time a nation-state adversary has breached Microsoft’s cloud environments and after so many instances, empty promises of improved security are no longer enough,” Adam Meyers, SVP of counter adversary operations at CrowdStrike, said via email.

In January, Microsoft said a Russia-backed threat group called Midnight Blizzard, gained access to emails, credentials and other sensitive information from top Microsoft executives, certain corporate customers and a number of federal agencies.

Then in early April, the federal Cyber Safety Review Board released a long-anticipated report which showed the company failed to prevent a massive 2023 hack of its Microsoft Exchange Online environment. The hack by a People’s Republic of China-linked espionage actor led to the theft of 60,000 State Department emails and gained access to other high-profile officials.

Just weeks ago, the Cybersecurity and Infrastructure Security Agency issued an emergency directive, which orders federal civilian agencies to mitigate vulnerabilities in their networks, analyze the content of stolen emails, reset credentials and take additional steps to secure Microsoft Azure accounts. While the order only applies to Federal Civilian Executive Branch agencies, CISA warned other organizations could be impacted. 

For many critics of Microsoft, the events of the past nine months are the logical conclusion of a company that has ridden the wave of market dominance for decades and ignored years of warnings that its product security and practices failed to meet the most basic standards. 

“In a healthy marketplace, these would be fireable offenses,” said AJ Grotto, director of the Program of Geopolitics, Technology and Governance at the Stanford Cyber Policy Center and a former White House director for cyber policy. “Regrettably, the marketplace is far from healthy — Microsoft has the government locked in as a customer, so the government’s options for forcing change at Microsoft are limited, at least in the short term.”

The concern was, and is, that Microsoft's security gaps would potentially lead to catastrophic outcomes. 

Microsoft needs to dedicate its internal resources towards zero-trust initiatives and make new investments in its infrastructure, according to Karan Sondhi, CTO, public sector at Trellix.

“Currently, Microsoft directs the vast majority of their security investments in revenue generating roles instead of internal security roles,” Sondhi said via email.

Microsoft has a considerable stake in the cloud security space. Not only is Microsoft one of the world’s largest cloud providers, but it is also a major security provider to the enterprise. Microsoft has more than 1 million security customers, with 700,000 using four or more of its security products, CEO Satya Nadella said during the company’s fiscal second quarter conference call in January. 

The company generates more than $20 billion in revenue per year from its security business. 

Vulnerable ecosystem

The state-linked activity targeting Microsoft systems also impacted on other companies that use Microsoft products — Hewlett Packard Enterprise disclosed it was impacted by ongoing activity from the threat group as well. 

HPE in January said Midnight Blizzard gained access to a small number of company mailboxes dating back to May 2023, stealing data from executives in cybersecurity and other key departments, in a filing with the Securities and Exchange Commission. The activity appears to be related to the access and exfiltration of SharePoint files, according to the filing. 

HPE in January told Cybersecurity Dive the threat actor “used a compromised account to gain unauthorized access to the Office 365 email environment." HPE has declined to comment further on the Midnight Blizzard threat activity beyond its SEC filings. 

Microsoft in a March filing with the SEC, said Midnight Blizzard was trying to use various secrets it stole from the company. Microsoft said it had shared secrets with certain customers via email, and was reaching out to those customers to help them take mitigation steps. 

Midnight Blizzard has repeatedly launched attacks against Microsoft customers using a variety of means, including password spray attacks and social engineering. 

CISA and other officials are still assessing the ongoing threat from the Midnight Blizzard attacks to federal agencies and other Microsoft customers. 

The Center for Internet Security, through the Multi-State Information Sharing and Analysis Center, provided “intelligence and response information regarding the campaign of activity targeting Microsoft products,” said Randy Rose, VP of security operations and intelligence at CIS. 

Rose confirmed a “low number” of MS-ISAC participants were notified that they were likely impacted. However, there were no reports of external activity linked to this and no reports of incident response.

Indeed, the CSRB report laid out a blistering assessment of a corporate culture that has failed for years to take cybersecurity seriously. 

The report was designed to assess the company’s response to the summer 2023 breach from the People’s Republic of China-linked threat actor that breached the company’s Microsoft Online Exchange environment. 

However, it also laid out a security culture that failed to adhere to the most basic standards, given the enormous market power that Microsoft yields across modern business applications in government and the private sector. 

One of the more damaging findings was that Microsoft learned of the attacks only because the State Department had set up an internal alert system after purchasing a G5 license from the company. Customers who failed to purchase the enhanced license, were not able to see the extensive logging capabilities that would have alerted them to a breach.

Failure of accountability

Many in the security community see the CSRB report and the recent CISA emergency directive as direct indictments not only of Microsoft’s security culture, but a government that has allowed Microsoft to maintain lucrative government contracts with no fear of competition across many of its services. 

“The federal government gets off the hook a little easy in this report,” said Mark Montgomery, senior director at the Center on Cyber and Technology Innovation at the Foundation for Defense of Democracies. “Despite significant encouragement from outside experts, the Biden administration, and its predecessors, have failed to treat cloud computing as a national critical infrastructure, that is itself critical to maintaining the security of our national critical infrastructures.”

Sen. Ron Wyden, D-Ore., who called for a federal investigation following the State Department email hack, said the federal government shared responsibility for the negligent behavior disclosed in the report. 

Wyden said Microsoft has been rewarded with billions of dollars in federal contracts, while not being held to account for even the most basic security standards. 

“The government’s dependence on Microsoft poses a serious national security threat, which requires strong action,” Wyden told Cybersecurity Dive after the CSRB report was released earlier this month. 

Technology vendors should be held to strict cybersecurity standards, use independent audits to make sure vendors are adhering to those standards and if violated, the company and senior executives must be held accountable, Wyden said.

Microsoft officials said they understand the larger concerns raised by the summer 2023 attacks and the continued threat from Midnight Blizzard and other nation-state actors. The company is working to make extensive changes in its engineering processes, improve its relationships with the security community and its responsiveness to customer needs. 

“We are energized and focused on executing Microsoft’s Secure Future Initiative commitments,” Bret Arsenault, corporate VP and chief cybersecurity advisor at Microsoft, said in a statement. “And this is just the beginning. We commit to sharing transparent learnings and future milestones as part of our efforts to strengthen all systems against attacks.”

As part of the larger shakeup of Microsoft’s security operations, Microsoft in December named Igor Tsyganskiy to take over as the new global CISO effective Jan. 1, moving Arsenault out of that role after 14 years. 

Aresenault pointed out that since launching the company’s Secure Future Initiative in November, the company has sped up related engineering work in several areas:

• Microsoft has accelerated the lifecycle management of tenants, with a focus on either unused or older systems. The company eliminated more than 1.7 million Entra ID systems related to used, aging or legacy technology.  It has also made multifactor authentication enforcement automatic across more than 1 million Entra ID tenants. 
• More than 730,000 apps have been removed across production and corporate tenants that were either out of lifecycle or not meeting current SFI standards. 
• New employees and vendors are given short-term credentials to make impersonation and credential theft more difficult. More than 270,000 have been implemented thus far. 
• The company’s internal MFA implementation using Microsoft authenticator has been enhanced, by eliminating a call feature and relying on an in-app login feature. This change covers more than 300,000 employees and vendors.

Customer renewal or rejection

How private industry and government agencies respond to these security challenges is a near-term concern for Microsoft.

Dante Stella, an attorney at Dykema and specialist in incident response, says enterprise customers do not usually walk away in the face of nation-state threats against Microsoft, in part due to its enormous presence as a cloud provider. 

“Many switched to Exchange Online or Microsoft 365 to get away from on-premise servers and [managed service providers]," Stella said via email. “If the other choice is going 'back' — or a potentially disruptive switch to another platform like Google Workspace — they most often just ride it out and trust Microsoft to fix the issues.”

Attacks like these will spur proactive security measures at many companies, for example increasing employee training, upgrading email security to an E5 level, adopting the use of audit logs and increasing the use of encryption during file transfers, Stella said. 

E5 is considered the premium tier for Microsoft 365 customers, offering enhanced security and other services, he said.

Though Nadella says security is Microsoft's No. 1 priority, the company also has raced to develop artificial intelligence and incorporate it into its products.

Microsoft has placed a major bet that customers will embrace its effort to incorporate AI into its security product platforms. Microsoft said, after months of testing with customers, that Security Copilot helped security analysts be 22% faster and 7% more accurate. 

In addition, the company sees a larger number of Microsoft 365 customers embracing E5, which provides enhanced security protection and is reflected in higher average revenue per user. 

Microsoft made Security Copilot generally available earlier this month and is offering the technology on a pay as you go basis to make it more affordable to a wider range of customers. 

Remote-access tools were the primary intrusion point for ransomware attacks, accounting for 3 in 5 attacks last year, cybersecurity insurance firm At-Bay said in a report.

Attackers primarily targeted perimeter-access tools in 2023, but shifted their focus from remote desktop protocol to targeting self-managed VPNs. These on-premises VPNs were linked to more than 3 in 5 ransomware attacks where remote access was the initial entry vector, according to At-Bay.

“Attackers go after the same things. If you have a city that has walls around it, you’re going to go after the gate because the gate is a weaker point than the actual wall,” Rotem Iram, At-Bay founder and CEO, said last week at an Axios event on the sidelines of the RSA Conference in San Francisco.

Network devices are common targets for financially-motivated and nation-state linked attackers. Vulnerabilities in devices sold by Barracuda, Cisco, Citrix, Fortinet, Ivanti, Palo Alto Networks and others were widely exploited during the last year.

Ivanti zero-day exploits were linked to intrusions at Mitre Corp. and the Cybersecurity and Infrastructure Security Agency. Boeing and Comcast were both impacted by attacks linked to exploits of the Citrix vulnerability, dubbed CitrixBleed.

Self-managed VPNs, especially the most popular among enterprises, were more troublesome with respect to ransomware attacks than cloud-managed VPNs or no VPN at all, according to At-Bay research.

“Organizations using self-managed VPNs by Cisco and Citrix were 11 times more likely to fall victim to a direct attack in 2023,” the report found. Self-managed Fortinet VPNs were five times more likely to be linked to a ransomware attack than cloud VPNs.

“Today, technology is basically use-at-your-own risk,” Iram said last week while previewing the research during the RSA Conference.

“Security is infinitely complex,” he said, “but at the end of the day, most of the attacks are very predictable.”

Attackers are targeting everyone in the remote-access business and they don’t always need to break in with exploits, Iram said. “They also walk in through the front door with credentials they stole.”

At-Bay’s report is based on claims information it received from customers and claims data analyzed by the insurer’s researchers. The company is currently fielding about 200 claims a month, according to Iram.

“We’re never going to be able to get this risk to completely go away, but I think we need to bring it back to a level where an organization doesn’t need to think twice about adopting technology,” Iram said. “To me, that’s the risk. If technology starts to add more risk than value, then it’s going to be detrimental.”