Operations TradeSecret and Cloudhopper attributed to APT10. Third party risks. Lazarus Group update. US investigation of Russian influence operations and US surveillance allegations proceeds.

Dave Bittner: [00:00:02:24] Operation TradeSecret joins Operation Cloud Hopper, both appear to be facets of a Chinese cyber espionage campaign. 20,000 loan applications are exposed by a third-party IT vendor. North Korea's Lazarus Group still has banks in its crosshairs. A study shows that mobile users are in a complicated relationship with their apps. US Congressional hearings into Russian influence operations. And Allegations of US surveillance continue. And tomorrow is OpIsrael. Israel enterprises say they are prepared.

Dave Bittner: [00:00:39:03] We'd like to thank our sponsor Palo Alto Networks, you can visit them at go.paloaltonetworks.com/secureclouds. With the adoption of software as a service applications, data now lives beyond the traditional network perimeter, exposing your organization to more malware and threats. Palo Alto Networks helps your organization achieve complete SaaS protection with detailed SaaS visibility and granular control, data governance, automated risk remediation, and malware prevention. Palo Alto Networks has the broadest, most comprehensive cyber security for all cloud and software as a service environments. They know that secure clouds are happy clouds. Find out how to secure yours at go.paloaltonetwork.com/secureclouds. And we thank Palo Alto Networks for sponsoring our show.

Dave Bittner: [00:01:38:19] Major funding for the CyberWire Podcast is provided by Cylance. I'm Dave Bittner in Baltimore with your CyberWire Summary for Thursday, April 6th, 2017.

Dave Bittner: [00:01:47:15] Fidelis Security released a report this morning on Operation TradeSecret, which they attribute to APT10, the same Chinese outfit that BAE and PWC said earlier this week was behind Operation Cloud Hopper. Whereas, BAE and PWC devoted their attention to Cloud Hopper's effects on business and government organizations in the UK, Fidelis notes that Operation TradeSecret has been prospecting US targets since February of this year at least.

Dave Bittner: [00:02:16:10] As its name might suggest, TradeSecret is a cyber espionage effort directed principally at gathering information on developing US trade policy. It seems clearly related to Cloud Hopper, and to another APT10 espionage campaign currently in progress against Japanese targets.

Dave Bittner: [00:02:33:22] While the companies who've been investigation APT10's activity stop short of calling it a Chinese government actor. It's just being called "Chinese," or sometimes "Chinese language". Its operations seem consistent with longstanding patterns of Chinese government cyber activity. The concentration on acquiring trade secrets and gaining economic advantage is consistent with that government's longstanding goals.

Dave Bittner: [00:02:58:01] Cloud Hopper has elicited warnings to businesses from authorities in both the UK and Sweden, although the threat is not confined to those countries. Both Cloud Hopper and TradeSecret approach and compromise their targets via those targets cloud and managed service providers, so they represent an exploitation of third-party attack vectors.

Dave Bittner: [00:03:17:21] A different incident also also enabled through a compromised third-party affected Scottrade. Some 20,000 loan applications were exposed by an IT service provider in the course of uploading them to the cloud. The exposure is said to have been due to a misconfigured SQL server.

Dave Bittner: [00:03:34:24] Kaspersky and Symantec researchers continue to draw attention to North Korea's Lazarus Group. Kaspersky finds increased sophistication on the bank robbers part. Symantec sees signs of activity in some 30 countries. Lazarus has been traced fairly clearly to North Korea, and it's said to have steadily learned and increased in sophistication not only since the Sony hack of 2014, but also since 2016's Bangladesh SWIFT incident. The DPRK's interest in bank robbery is unlikely to abate given that country's economic straits and the sanctions imposed for its nuclear and ballistic missile ambitions.

Dave Bittner: [00:04:12:16] RiskIQ this morning released a report on mobile users problematic relationship with their apps. The average user regularly interacts with about 30 apps, and tends to do so carelessly. With so many apps in use, unselective downloading, clicking suspect ads, password reuse and other problems seem practically inevitable. RiskIQ recommends shifting defenses from consumers to businesses, which may be better equipped to control and mitigate mobile threats.

Dave Bittner: [00:04:41:05] Continuing our discussions throughout this week with people we met at the 2017 Women in Cybersecurity Conference. Today, we hear from Wendy Whitmore. She's a Global Partner and Lead with IBM's X-Force Incident Response and Intelligence Services. She started her career in the US Air Force, followed by leadership positions at Mandiant and CrowdStrike. I asked her how she learned to be a leader.

Wendi Whitmore: [00:05:03:13] So, my dad was a coach, my parents were both teachers, my dad was a coach growing up. I spent a lot of time with him on ball fields all over the country, basically, and kind of being surrounded by a bunch of like older brothers, if you will, right, in addition to my actual older brother. But all of his teammates and all the guys my dad coached. And so I got a chance to really kind of see how he coached a team, but how he actually looks to kind of mentor and coach his team members along the way. And I think that had a huge influence on me. I then ended up playing a lot of sports myself. And so that certainly helped in terms of being in those like tense situations where, you know, the game is ready to be won and you need to be the person who makes the clutch play, or gets a hit, or whatever it may be. I learned a lot through that. And then certainly in the military, just getting, you know, tons of training when it came to leadership training. But also just understanding along the way kind of the importance of mentoring your team members, and learning as much from them as you kind of have to offer yourself.

Dave Bittner: [00:06:04:19] What do you think is going on in the environment in the ecosystem that we are not able to do a better job attracting and keeping women in the field?

Wendi Whitmore: [00:06:11:24] Yeah, that's a great question. I mean, some numbers that I think we keep hearing throughout the week at this conference. You know, there's an average of, I think, around 48% to 50% of women in the workforce in general. And between 8% to 11% in cybersecurity. So, we're starting with a much kind of smaller grouping, right, a smaller percentage. And then if you look at the retention issue or progressing through the ranks, that becomes more challenging over time, because just of general attrition rates for one. And then, you, know I look back like, so in terms of the solutions, again, I think it relates to increasing the awareness at the lowest levels at elementary school, junior high. Really kind of letting kids of all ages and all genders know that these solutions exist, or these opportunities exist. But then you look at, like, when I was in college, you know, maybe my major might have been say a hundred people and maybe there were ten women in the field. And then as, you know, we got to upper graduate level courses, that got smaller and smaller, and that's normal, unfortunately. But I think we need to increase the pipeline kind of on the front end one.

Wendi Whitmore: [00:07:15:15] And then two, just I think in addition to gender, it's just diversity as a whole. I think there are studies now that show how much more effective teams are when they have people of different genders, different ethnicities, different what have you, just different opinions. Because, you come up with more creative solutions, you have different approaches to the problems and new solutions. And so, as a whole those are things that are shown to be really effective and that we need to continue promoting. You mentioned it might be getting worse, from my perspective, I definitely have not seen that. I've seen the opposite. In that when I first started there were very few women, and both when I was in the Air Force in this field, when I started early days of consulting. And now you're really seeing a lot more women in the field, a lot more women moving into leadership roles. So, from my kind of perspective, which may be either more limited and what not, but it's definitely I think been a positive growth.

Dave Bittner: [00:08:15:16] That's Wendi Whitmore from IBM. You'll hear more from her in our upcoming CyberWire Women in Cybersecurity Conference Special Edition.

Dave Bittner: [00:08:25:01] US congressional hearings into surveillance and Russian influence operations continue. It's been reported that Representative Devin Nunes, Chair of the House Intelligence Committee, will recuse himself from the investigation, at least for now, over access the White House gave him to evidence suggesting the previous Administration conducted surveillance of the Trump Presidential campaign and subsequent transition. Congress departs for a two week recess tomorrow.

Dave Bittner: [00:08:52:07] And speaking of tomorrow, April 7th is scheduled for OpIsrael, the cyber action Anonymous mounts every spring to bring down Israeli networks in furtherance of the Palestinian cause and other causes. OpIsrael has essentially always fizzled, never succeeding in rising above the nuisance level, but this of course is in a large measure, because Israeli enterprises prepare for it. A number of Israeli security experts go so far as to advise treating it as a training an cyber-spruce-up opportunity.

Dave Bittner: [00:09:27:12] Time to take a moment to tell you about our sponsor Control Risks. If you own cybersecurity in your organization, let's be honest, you might not sleep easily. If you lie awake thinking about new threats over the horizon, or how to allocate your limited resources, Control Risks can help. It's often impossible to separate threats to your data from geopolitical swings, local regulatory shifts, and competitors maneuvering. Without a risk-led approach, how can you be sure all your shiny tools are working? Talk to Control Risks. They treat information security as a business risk, not just a technical problem. For over 40 years, they've helped clients proactively identify and mitigate risk. Respond to and recover from disruption, and capitalize on opportunities. In short, they bring order to chaos, and reassurance to anxiety. Let Control Risks help you spend money where it really counts, protecting what really matters. Find out more at controlrisks.com/cyberwire. That's controlrisks.com/cyberwire. And we thank Control Risks for sponsoring our show.

Dave Bittner: [00:10:40:03] Joining me once again is Rick Howard, he's the Chief Security Officer at Palo Alto Networks, and he also heads up Unit 42, which is their Threat Intel Group. Rick, we want to touch base today about some trends that you saw coming from the RSA Conference, specifically related to cloud security.

Rick Howard: [00:10:57:11] Yeah, thanks. This got me thinking. I was listening to an interview with the CEO of Securosis, I think that's how you say it, his name is Rich Mogull. And he was talking about these tidal forces moving everything to the cloud, or as my CTO Nir Zuk likes to say, to somebody else's computer. I agree with Rich when he points out that the cost of owning and operating your own mail servers, your file servers, your enterprise resource planning servers, your customer relationship management systems, ticketing systems, and HR systems, just to name a few is cost prohibitive, since none of those skills are what you should be doing for your primary business anyway. So, Rich says that, you know, SaaS, one of the components in cloud computing, wipes out major chunks of capital investments. I would add IAS and PAS does that too, but, you know, I take his point.

Rick Howard: [00:11:49:13] The world of cybersecurity is changing right before our eyes. This is the reason that this thing caught my eye. We are literally right in the middle of a paradigm shift as everybody races to the cloud, and embraces DevOps as a deployment philosophy. What I like about this is, we don't normally notice these things, okay, we don't usually see these things coming. And mostly don't realize the new paradigm is in place until well after it is established. So I see that as a unique opportunity for all organizations, in general, but also for security specifically. Because, if we act now, okay, we can change our organization's process before our competitors do and before the cyber adversaries learn how to leverage these new attack services, and before we're ready to defend them.

Rick Howard: [00:12:32:20] So, here is the advice, if you are not seriously considering how to move your already established, perimeter defense security best practices to SaaS and ISS and PAS environments, it is not too late. You still have time, but you need to start soon. I think the good news is that the general principles of securing these new environments are no different than what you're used to doing in the old perimeter defense days. It's how we do it is a bit different, but we are trying to do the same thing. Network defenders are trying to put multiple prevention and detection controls down the adversary cyber kill chain, in order to beat the adversaries offensive play book, right? So, as you plan your move to these environments, seek security vendors products who can accomplish the same thing you used to, use them in the perimeter defense piece, so you can do it in the cloud

Rick Howard: [00:13:22:16] You need complete visibility, you need the ability to reduce the attack surface, you need a way to prevent all known threats, and the ability to discover new threats and convert them into protections down the kill chain in the most efficient manner. Now, what's scaring everybody away from this, is they think they had to admit new things. And what I'm here to tell you, these technologies exist already. So my advice to all my fellow network defenders is to be bold here. Get in front of this paradigm shift, in the process maybe greatly improve your organization's security posture as you go down the line.

Dave Bittner: [00:13:53:19] All right. Good advice. Rick Howard.

Rick Howard: [00:13:56:08] And be bold.

Dave Bittner: [00:13:57:13] Be bold. Be bold, that's right. Go bold or go home. All right. Rick Howard, always a pleasure. Talk to you soon.

Rick Howard: [00:14:05:21] Thank you, sir.

Dave Bittner: [00:14:06:23] And that's the CyberWire. For links to all of today's stories along with the interviews, our glossary and more visit thecyberwire.com. Thanks to all of our sponsors who make the CyberWire possible, especially to our sustaining Cylance. To find out how Cylance uses artificial intelligence to protect you, visit cylance.com.

Dave Bittner: [00:14:27:05] We hope you'll check us out on Twitter, Facebook and LinkedIn. And if you will head on over to iTunes and leave a review for our podcast, well, that would be great too. It's one of the best ways you can help new people find our show.

Dave Bittner: [00:14:37:22] The CyberWire Podcast is produced by Pratt Street Media. Our Editor is John Petrik. Social media editor is Jennifer Eiben. Technical editor is Chris Russell. Executive editor is Peter Kilpe, and I'm Dave Bittner. Thanks for listening.