Assurance IT invited Identify and Deception Specialist, David Lindstrom, from SentinelOne, to chat about how unsophisticated attacks breached high-profile companies like Uber, Cisco, and LastPass.

In this episode, David Lindstrom and co-founder of Assurance IT, Luigi Tiano, answer the following questions: 

1. Do you need someone with high credentials to hack a system?
2. Is Active Directory good at protecting the enterprise?
3. Is it possible to understand the full scope of a data breach?
4. What is a honey pot?
5. Can you buy credentials on the dark web?
6. How do you prevent an employee from being a target of social phishing?
7. Is there a golden rule for creating a safe password?
8. How do you avoid being the softest target for dark web credentials?
9. What does it mean to secure your identity in an enterprise?

Resources: 

Watch the episode: https://youtu.be/9zs2MzInI50

David Lindstrom's LinkedIn: https://www.linkedin.com/in/davidlindstrom/

SentinelOne's website: https://www.sentinelone.com/

Luigi Tiano’s LinkedIn: https://www.linkedin.com/in/luigitiano/

Assurance IT Website: http://www.assuranceit.ca/

About David Lindstrom: 

Passionate cybersecurity sales professional focused on successful security and business outcomes. I’ve had the pleasure of working on behalf of enterprise and educational organizations across industries and have excelled in the role of start-up evangelist, team leader, and practice expert for established companies.

About 10 Questions to Cyber Resilience: 

Twice per month, learn about how IT leaders are strengthening their cyber security practices. Every episode comprises of 10 questions that get you one step closer to cyber resilience. Subscribe to stay up-to-date with hot topics in cyber security. 

About Assurance IT: 

Assurance IT (www.assuranceit.ca) specializes in data protection and data privacy for the mid-market in Canada, since 2011. The Montreal-based company’s unique approach to helping customers become cyber resilient is called the PPR Methodology which stands for Prepare, Protect and Recover. Based on industry best practices, the PPR Methodology is an easier way to achieve cyber security and compliance objectives.

Good morning

everyone, happy to be here this

morning with a friend of ours

from SentinelOne, David Lindstrom.

Before we get started, we have

some really good content and

really good questions to ask Dave.

But I want Dave to give us

a bit of an introduction

on himself, his expertise.

Dave, tell us where you

work and what you're doing

today with SentinelOne.

Yeah.

Thanks Luigi.

It's a pleasure to be here.

So I'm an identity and deception

specialist for SentinelOne, and

I joined SentinelOne via the

Attivo acquisition last May.

And what's interesting about

those two things is Attivo

started as a deception company

and in the process of following

the attacker's evolution and

staying one step ahead, that

really evolved into protecting

the identity infrastructures

because that's where the action

happens, and we're seeing

that more and more these days.

Yeah.

It's interesting you say that the

identity protection is becoming a

huge conversation with our clients.

It's always been there, right?

But we see more of a

conversation around it.

Before it was taboo to talk

about it because it, we

thought it never happened, but

the attack surface is huge.

And there's so many

angles to cover.

So yeah, I'm really excited to

have you on and I appreciate

your time cause I know you're

very busy, especially nowadays.

So tell us a little bit

about SentinelOne just

before we get into it.

The product that you

support at SentinelOne and

you deliver for clients.

Yep.

As the identity specialist, we

focus on protecting organizations

from identity compromise reducing

the attack surface detecting

identity attacks early in the

recon stage so they can, reduce

the blast radius, improve time to

recovery, improve the fidelity of

a lerts around identity compromise.

So it's very complimentary

to the overall SentinelOne

approach, which, involves

endpoint and XDR security.

Awesome.

Awesome.

Thank you for that.

So today we're gonna talk about

some companies who've gotten hacked

specifically around, identity.

Two high profile attacks

that we saw late last

year were Uber and Cisco.

So if you can double click on

those, they often sound very

sophisticated, but can you

tell us a little bit about how

unsophisticated those attacks

were and what the impact

was to both Uber and Cisco?

Yeah.

Luigi, these are two really good

examples of, unsophisticated

attacks that leveraged identity

in the initial breach phase.

Identity has always been page

one and one a of the attacker

playbook on a post breach basis.

So they're gonna go after

active directory to try

to get domain privilege.

They're gonna try to

enumerate active directory.

They're gonna try to

dump local credentials.

That's just what they do.

But increasingly we're

seeing that identity is

the initial breach vector.

And in the case of Uber,

this was an 18 year old who

bought an Uber employee's

credentials on the dark web.

Then created an MFA storm,

basically blasted him with MFA

requests until he finally relented.

And that allowed

him to gain access.

From there it was a more

traditional, attack profile.

So scan the internet find

PowerShell scripts that include

PAM privileges and as a privileged

user within the pam find

sensitive data that you can use.

And, in both the case of Uber

and Cisco, it's not so much about

the sensitivity or the value

of the data that they were able

to exfiltrate, but it's just

the approach that they took.

Which is really highlights the

importance of understanding the

attack surface around identities

and then reducing that protecting

identities and detecting early.

You said

something interesting, David.

You mentioned that this 18 year

old went on the dark web and

just bought some credentials.

In your experience or in your

opinion, , do those credentials

have to be attached to someone

with a lot of privilege

within the organization?

Or it could just be a basic user.

It can be a basic

user and most often it's Joe from

accounting that gets popped first.

But, once I'm in, then

I'm a trusted user.

So active directory, for instance,

is more than happy to tell me

lots of sensitive information.

I can try to up level privilege.

I can try to see what

credentials exist, on disk,

in memory, in registry.

There's a lot of

leftover credentials

that can be very useful.

So it's most common that it's

just a regular user that is

the initial point of entry.

So

just a regular user.

That's interesting because, and

without pointing the finger at

Microsoft, obviously we talk

a lot about active directory

because let's be honest,

active directory is present

in a lot of organizations.

But what I've learned over

the last year is how quickly

someone can navigate through.

And maybe you can just

highlight that a little bit.

Does active directory not

do a good job of protecting

the enterprise or, obviously

there's a lot of loopholes

that have come about obviously.

Yeah.

Active directory is really

good at what it's built

for, which is function.

It's a directory after all.

It's wide open to any domain

joined user level account.

Unless you take actions

to the contrary.

So it's more than happy to tell you

all kinds of sensitive information

about, where the data resides,

who the Sys admins are for those

systems, what the unpatched systems

are who the domain admins are.

It really allows you to plan

your attack progression.

And it's interesting, the data

around the LastPass breach

is just coming out, in the

last couple days, but that

was a more targeted attack.

They were able to compromise the

developer account last August.

They were able to steal some,

source code information and

LastPass was able to eject them.

So it didn't seem like such

a big deal, but, what we have

found out is that they were doing

reconnaissance in the environment.

They were able to find where the

sensitive corporate resources

existed and who they needed to

go after next in order to get

the credentials to access that.

Oh, interesting.

So that kind of leads

to my next question.

These unsophisticated attacks

happen, unbeknownst to a lot of

users, now, you mentioned the

fact that a bad actor can get

in and stay there for weeks or

months to do all that recon work

and I think really that's what

companies are afraid of, right?

How long have they been

there and what information

have they gathered?

Because the point of attack

or the point where you find

out that you've been breached,

to backtrack that how does an

corporation backtrack to determine,

how bad they've been hit?

Is that even possible

given what we've seen here?

It's not easy.

Certainly on a host breach

basis scoping the problem is

a big part of remediation.

Understanding how far it's gotten,

what the initial point entry is,

where they still exist, and how

to get them out are really the

main questions that SecOps ask.

The challenge in using identities

is that if you've got someone who's

acting as a legitimate, trusted

user . And that's someone whose

credentials have been compromised

or the same conversation

for a malicious insider.

If they're doing things that

aren't particularly anomalous,

then detection is a big challenge.

Because if you

have traditional EDR or XDR,

you're able to backtrack or

stitch, the events that happen.

Now, again, in your opinion,

does identity play into that?

Is there any stitching that could

be done from the endpoint to the

XDR and backtrack that, or has it

become a lot more difficult because

it is from a trusted person?

It's interesting

one of the things I mentioned

with deception is that rather than

reveal legitimate assets like,

local credentials or information

within Active directory one of

the things that Deception allows

me to do is to present deceptive

responses to those types of

queries and in the process,

you can lure an adversary to

an authentic, legitimate decoy

environment that protects

legitimate assets in the

process, wastes their time.

They think that they're

engaged with real treasures.

But the other thing it does

is it really allows you to

capture the full attack path,

the full tools, techniques and

processes that they're using

and what their objectives are.

Because, they're gonna proceed as

if things are going well for them.

So you can really observe

what they're up to.

Is that what

you call the honey pot?

Yeah.

Yeah.

Honey Pot is a term that has

been around for a long time and

as I mentioned, the evolution

of deception technology, it

started as we're gonna put

this out there and see who's

attacking us, on the internet.

Then on an internal visibility

perspective, east, west

communications, moved into the data

center and then out closer toward

the edge where the action happens.

And, in the last several years onto

the endpoint, as the point we made

earlier, Joe from accounting, if

he's the one who gets compromised,

how do you protect on that

and how do you detect on that?

Okay, that's great.

So you kinda answered my question

about the unsophisticated hacks.

Because we often ask

ourselves, how do they get in?

But you've just outlined a few ways

that bad actors can take advantage

of seemingly innocent people and

getting into the organization.

Yeah.

And I was gonna make one more

call out on the Cisco example.

That was very similar.

So in that case, it was a

regular user and they compromised

his Google account, which

had cached vpn credentials.

And besides the MFA storm that

they used, they also called him

as IT and said, Hey, we need you

to approve this so we can get in.

My goodness.

Yeah.

So it's pretty gnarly, it's really

you have to be extremely diligent

to avoid that type of approach.

There's so many

things going on you feel for the

IT folks who have so many things

going on in a day and sometimes

they take things for granted.

And like you said, if it's coming

from a trusted source, I can

see how these things happen.

I guess you gotta just, increase

your vigilance or just increase

your level of trust or decrease

the level of trust and make

sure that you're really, seeing

and then hearing what you're

hearing from everyone around you.

Earlier you mentioned

something about credentials

for sale on dark web.

What's going on with that?

Is that a real thing?

It sounds like it is.

I hear more and more where,

credentials could be bought

on the dark web , talk to

us a little bit about that.

You're an expert in this field, so

what's going on with credentials

for sale on the dark web?

Yeah, it's

scary to think about, but

there is an extremely active

marketplace of credentials

for sale on the dark web.

And these are credentials that have

been captured by various ransomware

groups and threat actors over time.

At any given point in time, there's

dozens of forums for hundreds

of these initial access brokers,

and it's hard to put a number on

because it's simultaneously both

under reported and over reported.

But one estimate I saw said

that there was about 15 billion

legitimate credentials for

sale on the dark web today.

So it's a low cost of entry, as

we mentioned, the 18 year old

at Uber, that might have cost

him a couple thousand dollars.

If that.

If that, yeah.

Yeah.

And 15 billion credentials, you're

talking about username, passwords.

Wow.

That's a lot of credentials

for sale or available anyway.

Yeah.

And it's really a force multiplier,

as a bad actor, if I can avoid all

of the recon work to, investigate

your organization and who I need

to target and you know how to get

to them, if I could just buy it

then, it really accelerates my

ability to hit, a lot of targets.

Wow.

Okay.

And just off topic here, maybe

within topic, how does social

phishing fall into that?

Because obviously once you have the

credentials does social phishing

even have to come into play?

If you have the credentials,

do you need to bother

about doing more work or is

that, you've cut the chase?

Yeah, it

can certainly compliment

the validity of an approach.

You can do, initial research to

identify who to target, then,

as a bad actor, you've probably

got better chance of success.

As a corporate citizen, you also

have to be really careful about

oversharing on social media.

That falls into two categories.

One is just what you post on

LinkedIn, so why make it any

easier to advertise the types

of systems that I work on and

where my area of expertise

is and those types of things.

But also just, being really

careful about who you engage with.

So if someone reaches out, your

guard has to be up really high.

Is an age old

thing about us sections

on websites, right?

Every corporation has their about

us section and they give you

so many details about, who the

person is, who the CFO is, who

the CTO is, and who the CEO is.

And they give you like a pedigree

of all kinds of stuff, like of

all their experiences, right?

And an email sometimes of

how to reach them, that

sometimes can backfire.

As much as you wanna be transparent

with your clients and prospects.

You might wanna be careful

what you're giving out there.

Cause you're right, that could

be a negative impact for sure.

While we're on the

subject, staying off of LinkedIn

is not the answer either, because

if you don't have a presence,

then someone will create one for

you and use that against you.

Oh yeah.

We just wrote an article

very similar to that,

what you just mentioned.

We wrote in our newsletter,

where a company will go and find

real job postings and then mimic

that job on another website.

Recruit individuals and then

they'll fish them in and

then they'll do some kind of

money transferring scheme.

So, you gotta be on

guard at all times.

So the more we can, put this out

there, I think, as professionals

in the field, I think it's

our responsibility to at least

advise a community after

that, you're on your own.

You gotta make sure you do

your part, like you said, as

a good corporate citizen, you

gotta play your part as well.

Yeah.

And if the next question is as

an organization, if there's 15

billion credentials for sale,

the odds are that someone in

my organization is on that

list, what do I do about it?

At the end of the day, there's a

lot you can do to make it harder

to be the one that becomes the

target, the successful target.

Things like credential

monitoring, so if you have a

threat intelligence service,

they'll often offer the service.

So you know for sure

that you're on that list.

And then, normal hygiene

things like MFA and the whole

conversation around password

reset on a periodic basis.

It's an interesting debate because

if your password is Frisky1, then,

in 90 days it's gonna be Frisky2.

And, it's gonna be Frisky3

90 days after that.

So that's no better.

That's way too easy to

figure out the pattern.

So it's better to have to have

a password manager or have

some type of secure password

phrase than it is to, follow

an easy to detect pattern.

Okay.

You bring up a good point.

I know nothing about cybersecurity.

I meet you, at a cocktail

party and you tell me, Luigi,

your password should be this.

What is the golden rule given

what you know in the industry?

Like how long should

my password be?

How complex should it be?

Yeah.

And I'm not necessarily

a password expert.

But what I think is a good rule

of thumb is if you can create

something that's both a lot

of characters, which, makes it

a lot harder to crack through

brute force, but also easy to

remember , then you're better off.

So things like password phrases

for instance Jack and Jill

went downtown to buy a dog.

Is easy enough to remember,

but that's a lot of characters.

That's one approach.

The other is password manager.

Obviously

we hear about this recent

hack of LastPass, right?

That's a big one.

So a lot of people had this

fear now of password managers,

and then obviously there's the

issue with the Google Chrome

hijacking of passwords as well.

So we've seen some situations,

but in your opinion, those are

still safe password managers

in general, should be safe?

Yeah.

What else are you gonna do?

You can write

'em on a piece of paper.

But then that's not a

good idea either, right?

Yeah.

And like at LastPass for instance,

it's interesting that by virtue

of knowing who to go after, they

used some fairly sophisticated

techniques to get to him.

So it looks like, it was this home

device which shouldn't be allowed

to access corporate resources.

It's usually not part of the

threat profile for organizations.

They used a vulnerability that

exists within a media server,

and with that they were able

to install a key logger and

get the master password.

And he was, one of four people

that that had those privileges.

So you can absolutely blame

LastPass for not doing

everything conceivably

possible to prevent that.

But at the same time, I think

they will have learned that

lesson and they will implement

stricter controls as a result.

Yeah.

It's amazing how the bad

actor was able to pinpoint who

that person of privilege was.

To me, that's the most

fascinating thing.

Once you get in, there's so

much information you need to

gather to make sure that's the

actual person you need to hunt.

After that, once you know who

the target is, and there's

always a vulnerability somewhere.

But to me that's the

most interesting pieces.

How do they know

who to go and hunt?

That takes some time.

That takes some

time and recon work.

Yeah, for sure.

Absolutely.

And one of the objectives of

identity protection is to detect

when that recon work is happening

early so that you can prevent

the worst impacts from any

type of identity compromise and

So that

leads my question.

Sorry to cut you off there, David.

A couple more questions before we

cut off here, but, so how does a

company avoid those tiny mistakes?

Is there top three things, top

five things that you as an identity

specialist would recommend to, Hey

guys, you gotta do this right now

to stop, those tiny mistakes that

maybe could lead to a cyber attack?

Yeah,

so a lot of the themes

we've touched on already.

So as an organization to

prevent being the softest

target for dark web credentials,

for instance, we want to apply

best practices, so we want to

use MFA and wherever possible.

So, we wanna subscribe to a dark

web monitoring service, which

could be available from your

threat intelligence provider.

Have I Been Pwned?

Is a good one.

Just to get a snapshot . And

then, as a individual there's

a lot of best practices that

can reduce the chances of you

being the one that is subject

to a identity compromise.

We talked about don't

overshare on social media.

Don't make it any easier to

be, found and to be researched.

Don't use personal devices

for corporate access.

Especially if you're, the dev

engineer at LastPass that has

access to the entire database.

You just

had to throw that one in.

I like that one.

Yeah.

I'm sure they learn

from that one for sure.

Yeah.

It's not a best practice and

it's usually not part of the,

risk profile for organizations

home networks and home computers.

And the problem's gotten

worse with work from home.

Yes.

The B Y O D work from

home, the hybrid workforce.

Yeah.

We've seen a whole bunch of

new attack options for bad

actors that the attack services

have become much bigger.

So many more entry points like you

said, and that's why as corporate

citizens, I think we need to

be on the lookout at all times.

Your point is well taken

and I appreciate those

four or five points.

I was gonna add

one thing to an earlier comment.

So I try not to store credentials

in Chrome whenever I can.

It always asks me if

I want to, and no.

I always try to clear my

cache whenever possible.

I try not to use keychain on iOS.

Not that I don't, I try to

minimize the the exposure

that I personally have.

Yeah.

That's a good point.

And I've used password managers

and I continue to use them, but

one thing maybe I made this piece

of advice if anyone takes it,

but I never like to include the

actual URL of the of the website.

So what I'll do for example, if

I'm visiting my bank, I'll put

the bank in either an acronym

or something, and then I'll

just put the credentials in

that secure note basically.

So I shy away from putting

the actual url, cuz that

could obviously give away,

there's another layer, I

dunno how valuable that is.

But for me, I'm paranoid even

within the password manager.

Yeah.

Yeah.

I think we all learned the lesson.

If you are a LastPass customer,

then you probably wanna

change all your passwords.

And yeah, I know I'm

not here to point any fingers,

but that's been an argument that's

happening over the last few months.

Ever since this has happened,

I think people are like, it

hurt their reputation for sure.

They're a huge company and

I know, they're not the only

ones who've been attacked, so

I'm not here to attack them.

But yeah, I'm sure it's

impacted their reputation like

many other companies who've

been breached in that nature.

Dave, we only have a few minutes

here, so I don't want to keep

you too long cause I know your

time is precious, but I did

have one question, one last

question, or perhaps I should

have asked this at the beginning.

So today, in the corporate

environment, what does it

mean, identity security?

If you can give us an

umbrella, what does that

mean when you're talking to

a client or to a corporation?

What does it mean to secure

the identity in the enterprise?

Yeah, absolutely.

There are a number of excellent

tools that exist in the universe

of Provisioning, managing and

controlling identities such

as IAM and PAM, IGA, even MFA.

Those are all excellent techniques

to prevent an identity compromise.

. But identity compromises are still

happening, all over the place.

I think, conservatively

80% of successful attacks

leverage identity at some

point in the kill chain.

So there's this concept of identity

threat detection and response.

And the idea is that you're

gonna prevent the worst outcomes

from an identity compromise.

Assuming the worst and

protect the identity

infrastructure in the process.

And that's where

Sentinel One lives.

What we do for organizations

is we provide a comprehensive

view into the risk landscape

around active directory and

other credentials, allowing you

to reduce the attack surface.

Prevent identity attacks

and protect the identity

infrastructure, and

it's an emerging space.

Gartner, put a white paper

out in November about this.

But we think it's an

excellent compliment to

those more traditional

types of identity security.

The acronym

I T D R, we've seen more

and more of it recently.

Yeah.

So Gartner's recognizing it as

its own independent space now.

Is that an accurate statement?

Yes.

Gartner has been beating this

drum for a couple of years,

by virtue of, the examples

that we talked about today.

And some of the more macro trends

it's really emerged as a critical

control that a lot of organizations

haven't haven't considered yet.

And in your opinion,

and based on what you've seen,

do we have a lot of security

professionals in the field?

Is the I T D R domain still

relatively new that the

expertise needs to ramp itself

up based on what we know?

Yeah.

It's an emerging field

within identity security.

As I mentioned, Attivo evolved

naturally to be a leader

in this space prior to the

acquisition by Sentinel One.

It's an excellent compliment for

the overall Sentinel One portfolio.

So we want to build the walls

as high as possible, but

regardless of how they get in,

whether it's through identity

or other means, they're going

to use identity from that point.

How can you prevent

that from happening?

How do you protect legitimate

assets and how do you detect that

those activities are in process?

And the question

was about expertise.

There's certainly some

growth, I would say in the

industry to support some

of these newer initiatives.

But it's important

enough, like this isn't a

marginal risk reduction.

We think this is a material

requirement for organizations.

Yeah, I

would agree with that.

Yeah, absolutely.

Definitely a material requirement.

Dave, listen, this has been an

honor , I've learned so much today.

I'd love to continue

conversation offline.

But again, I appreciate you

taking the time with us.

I T D R is obviously a domain that

is hot and on the rise right now.

So thanks for bringing

that to our attention.

I will be putting out as many of

the notes or maybe those links

that you shared with us earlier.

So some of the folks can

obviously benefit from that.

Do you have any questions

before we go for me?

No,

this has been fun.

I appreciate the time.

I love talking about stuff.

It's obvious.

The passion comes right through.

Dave, appreciate your time.

Have yourself a great day, and

I hope the audience loves this.

Yeah.

Thank you so much.

Thank you.