Pluton: The New Bedrock for Device Security
Nic Fillingham: Hello, and welcome to Security Unlocked, a new podcast from Microsoft where we unlock insights from the latest in news and research from across Microsoft's Security Engineering and Operations teams. I'm Nic Fillingham.
Natalia Godyla: And I'm Natalia Godyla. In each episode, we'll discuss the latest stories from Microsoft Security, deep dive into the newest threat intel, research, and data science.
Nic Fillingham: And profile some of the fascinating people working on artificial intelligence in Microsoft Security.
Natalia Godyla: And now, let's unlock the pod. Hey, Nic, how's it going?
Nic Fillingham: Hey, Natalia. I am good, I am excited. I've been excited for every episode, but I think this is the episode where we may be able to spin off into a major, major motion picture. I'm quite convinced that one of our guests, their story is compelling enough that a Nicolas Cage-style act, maybe even Nicolas Cage would be willing to turn this into a film.
Natalia Godyla: Let's line up the two guests, and l- let our audience figure out which one is the next National Treasure.
Nic Fillingham: First up, we have Peter Waxman, who's gonna talk to us about the Microsoft Pluton announcement from back in November of last year. This is a continuation from a conversation we had with Nazmus Sakib a few episodes ago where we talked about ensuring integrity at the firmware layer up and secured-core PCs, and now we're sorta continuing that conversation, deep-diving into what is the Pluton. Our Microsoft Pluton technology was announced in November. Fascinating conversation. And then we speak with?
Natalia Godyla: Madeline Carmichael, who has a background in library science and worked in physical libraries, and now she is a threat intel librarian. So her title is MSTIC Librarian, she helps to catalog the different threat actor groups that we monitor. So it's a callback to a conversation that we had with Jeremy Dallman about tacking nation-state actors.
Nic Fillingham: Yeah. So Madeline's job, apart from, uh, you know, one of the things that she does is she helps name these nation-state actors. And so we, Jeremy walked us through the, uh, periodic table of elements that is used to actually name who these nation-state groups are. So I just think that's fa- that's fascinating to go from a physical library and sort of library sciences into the deepest, darkest recesses of nation-state threats and nation-state actors. I- I think that is a Nicolas Cage vehicle waiting to happen, and I can't wait to go back into the cinema and we can sit down with our popcorn and we can watch National Treasure 7: MSTIC Librarian. This time, it's elementary? (laughs)
Natalia Godyla: (laughs).
Nic Fillingham: National Treasure 7: Threat Catalog- Catalog. Don't judge a threat actor by its name. No.
Natalia Godyla: I see it. I know why you picked Madeline's. I feel like we probably need a little bit more help on that tag line, so if anyone wants to give us some feedback, securityunlocked@microsoft.com, let us know. We are actively working on this script.
Nic Fillingham: On with the pod?
Natalia Godyla: On with the pod.
Nic Fillingham: Welcome to Security Unlocked. Peter Waxman, thanks for joining us.
Peter Waxman: Thank you, great to be here.
Nic Fillingham: So this is gonna be the second of three deep dives we do on the sort of very broad topic of ensuring the integrity and the security of physical devices through things like protecting firmware, and obviously we'll expand upon that in this conversation here. Peter, you're joining us today to talk about the recently-announced Microsoft Pluton processor, so that, this is gonna be great. We're excited to chat with you.
Nic Fillingham: Um, before we get into that, we'd love to ask. Tell us a little bit ab- about yourself. What's your job? What team are you in? What's the mission of the team? What's your day-to-day look like?
Peter Waxman: Awesome, awesome. At Microsoft, I work in, uh, the Enterprise Security team, part of the so-called Azure application platform. Basically what we do broadly is build all the operating system platform and everything underneath. You can think about it as Windows, the operating system, you know, Windows that powers Azure. Even what powers Xbox and some of our other devices.
Peter Waxman: And in particular, what I do is I focus on the operating system security and the low-level platform security that that operating system depends upon. Think about the hardware and firmware that our partners produce, to go make sure that that experience is completely secure. It protects our customers' data, it protects their identities, it makes sure that their application run with integrity and that they don't get hacked. And if they do get hacked, that we have an easy way to update and renew the system to get them in a good state again.
Natalia Godyla: And so, we recently announced on November 17th the Pluton processor. Can you tell us about that? What- what is Pluton?
Peter Waxman: Yes. Yeah. This is a big, exciting thing. It's something that we've been working on for quite some time. What Pluton essentially is is it's basically a security chip that lives inside of a larger chip. We call it basically the Pluton security processor, and this is like the heart of the security system in a PC or in a device.
Peter Waxman: If you think about the security of a device, when you push power on that, when you push power on your laptop or computer, the, and the CPU comes up, one of the most important things is that the way that that system boots up and starts happens in a secure fashion. Because if it doesn't happen in a secure fashion, then it's very easy for bad actors to basically get in underneath and to root the system and cause all sorts of problems.
Peter Waxman: So what Pluton is is basically this root of trust, the security processor that we, Microsoft, are integrating, and which is what we announced along with our major silicon partners in AMD, Intel, and Qualcomm, into the fabric of their products, in to the fabric of their chips. And so, by having that tight integration, it ensures that basically those chips and those products come up and boot in a secure fashion, and that we can then run Windows on this trusted foundation where we know the system is secure and basically we have, uh, much stronger footing with Pluton in the system going forward.
Natalia Godyla: So what differentiates the Pluton security processor from previous methodologies? What were you using in the past? Why is this better?
Peter Waxman: So traditionally in, uh, most PCs, the root of trust today is actually a separate chip. You know, very typically a discrete TPM. And that is something that lives on the motherboard as a separate unit, but it basically communicates over an insecure bus to the CPU. And the problem with that is that it just, it lends itself to all sorts of attacks. There's been a variety of ones that have been published. One of the common things that it's been known and in a published attack, basically there's one called TPM Genie. That bus, because it's insecure, even though the TPM chip itself may be highly secure, the system overall is not.
Peter Waxman: And so, attackers can go in with very inexpensive hardware, a logic analyzer, $50 worth of equipment, and go and basically intercept and alter the communications between the CPU and the TPM. And end up basically, you end up with an insecure system as a result. You could actually be booting malware in the firmware. You could basically be booting with exploits all through the boot chain, and Windows wouldn't know about it. The customer's data and experience would be compromised as a result. And so, by moving the root of trust into the CPU die, we're basically taking a whole class of attacks out of the scope, resulting in a system that is more secure overall in terms of how it comes up and the foundation.
Peter Waxman: It's also something, though, that one of the challenges that exists with the existing roots of trust is that they're very hard to update. Like other components in the system, right? They have their own firmware, the firmware can have vulnerabilities, and in fact, there have been notable vulnerabilities that have existed in TPM firmware. And when we look and see across the inventory of Windows 10 systems out there, there's actually a very large number of TPMs that are running out-of-date, unpatched firmware.
Peter Waxman: Uh, as a result of having Pluton integrated into the CPU and having tighter control of it from Windows, we can leverage the decades of experience and billion-plus endpoint reliability that we have in Windows Update to offer customers the ability to much more easily and automatically update firmware on the root of trust of the system. If there's ever any security issue that we find, we can very quickly get an update out. We can also, importantly, update with new capability, so as new scenarios come online, where customers want to take advantage or applications want to take advantage of this root of trust, we have the ability to add that capability to Pluton in a easy, quick ability through Windows Update.
Natalia Godyla: So what challenges did you have with bringing this security processor to life, with bringing it to PCs, in particular with the partners and OEMs that we were bringing it into the market with? And- and what challenges still lay ahead with the next steps that you have around Pluton?
Peter Waxman: Yeah, so there's plenty. I mean, there's a- there's a tremendous, uh, satisfaction that we have and, you know, came to the point where we have been able to announce with our major silicon partners that we're bringing this to market. But I'm humbled by it, but at the same point we still have a ways to go before this comes to market. And to continue really in seeing to the vision, which is really to enable Pluton everywhere and to be ubiquitous even beyond PCs and- and gaming consoles and- and IoT devices.
Peter Waxman: So- so a lot more work to do. Working with the ecosystem is something that takes a lot of time. It's been a tremendous effort, it's been several years in the making just to get to this point where, you know, we're far enough along with our partners that we can announce it, that we feel confident around landing these products. Both with the silicon partners that we announced, as well as with a range of PC OEMs that have been with us on this journey over the last year.
Peter Waxman: We're at a point, though, because, you know, we're basically taking Microsoft technology and integrating it with our- our silicon partners, it's our silicon partners' products that are the ones that will bring this to market on OEM devices. They are not yet ready to announce sort of their particular timeframe intercepts, so unfortunately I won't speak to exactly when products land. But, you know, they are coming, folks should stay tuned.
Peter Waxman: And when you think about Intel or AMD or Qualcomm chip, kind of the rule of thumb is it takes three years to go from the time that you start the design to the time that you have the chip in hand. So that's a long process. We're well away, well along that path in terms of where we're at, but it's lot of, obviously, detailed architectural work.
Peter Waxman: We're excited about, uh, the product finalization and also thinking about sort of the next set of steps and next silicon products for integration. But it's- it's a huge effort across a range of companies to- to land something like this.
Nic Fillingham: Is the goal to be integrated across the entire silicon spectrum in terms of consumer, low-end, affordable consumer devices, all the way through to secure e-work stations, uh, and sort of everything in between? Or it specifically a solution for more security-conscious, sort of enterprise customers?
Peter Waxman: Great question. Yeah. No, so this is important. We see this capability as something that just is a fundamental security property that needs to be there on a modern device. We have seen, we've all seen how over the last 10, 15 years there's just been an increasing amount of sophistication, not just in software attacks but in attacks that basically deal with low-level aspects of vulnerabilities in firmware, hardware attacks that exist. You can get up to nation-state stuff, and we see things, whether it's in the Snowden leaks or particular instances of nation-state attacks, that are taking advantage of, say, firmware vulnerabilities.
Peter Waxman: But it's more common that than. I mean, there are criminal networks that have exploited UEFI components in PCs to basically connect PCs to botnet networks to cause a variety of- of issues there. There continue to be, on a week-in, week-out basis, month-in, month-out basis, vulnerabilities that are reported that exist in a variety of firmware components or new hardware disclosures that exist.
Peter Waxman: So it is something that is cross-cutting, it's something that is not just an enterprise issue. It's something where, you know, this raises the security of all devices, and is basically something that the average consumer has a right to expect of their device. That expectation
Peter Waxman: Absolutely needs to be there from the lowest end consumer device to the highest end enterprise device. We... And, and Microsoft just committed to that.
Natalia Godyla: So with Pluton becoming a new industry gold standard, I'm sure that also means that it'll become a target or a goal for hackers to try to break into. So, what are the challenges for hackers? What would they need to overcome in order to actually hack to Pluton processor in a, in a hypothetical situation?
Peter Waxman: Yeah, it's a good question. I mean, there's certainly, especially in the research community, there's a lot of established, uh, research and techniques that folks do to, uh, break into hardware products. I mean, we've seen that certainly, like, going back to the Xbox days, right? There's, uh... One of the things that's interesting about sorta the consumer gaming security space is that in order for the adversaries to thrive, they're not necessarily a criminal network, they're not a nation-state, and they need to share information so you can kind of observe them more easily. But there are techniques and capabilities that folks have addressed and, obviously, with Pluton we're trying to ensure that we are targeting a bar that makes it very challenging for them to attack the system.
Peter Waxman: It is one, though, we're never gonna say that there's any perfect security system, and so you have to design your system to be renewable. You have to allow for the fact that they're going to be, gonna be issues that are gonna be found and make sure that you can update, you can patch, and also that you have defense in depth. So, if a hardware measure is defeated, you have something backing that up. We feel confident about, uh, Pluton just in terms of its, it, it is battle-tested.
Peter Waxman: This is something that we started on this journey 10 years ago. We've continued to invest in the capability and we're not done investing in the capability. We will continue to harden and strengthen it over time. But it's, you know, we're, we're talking about super cool equipment that a variety of folks'll go over to try to glitch and figure out what timing abilities does an attacker have to figure out if they issue a, a 20 nanosecond pulse on exactly this pin and exactly ti- this time at boot can they glitch the system to cause a, a, or, say, a crypto operation or what have you to basically fail.
Peter Waxman: These are the rates of attacks that come into a scope when you get into hardware security and, so, we've got a bunch of super bright folks that are experienced in this space, but, uh, we'll be interested to see how the threat actors respond and... It's also important to note that Pluton, we don't trust in the system, there's a critical security component, but it's not the only security component, right? The whole stack of, uh, security that, you know, st- stands on top whether it's an OEM device and their firmware or in Windows itself or in applications. These all matter, too.
Peter Waxman: An application can still have a vulnerability in it that is remotely exploited regardless of Pluton being in the system. And, so, you've got to look at the whole system from a security perspective to make sure that, uh, we're continuing to drive security across, up, and down the stack.
Nic Fillingham: And, Peter, I assume, uh, Microsoft, as well as the actual silicon manufacturers, you know, they're actively gonna be pen testing, uh, the Pluton processor over time, right? So, as Pluton is defined and as it goes into production and as it actually gets into the hands of, of customers, there'll be a continual effort on behalf of Microsoft and, I assume, also the silicon partners, too. Keep it secure and, and see if we can hack it ourselves to, to deter and find any potential vulnerabilities and address them. Is that part of the process?
Peter Waxman: Absolutely. Absolutely. Nic, so, Microsoft, the history that we've got with Pluton, we have both ourselves and involved third parties in doing hardware penetration tests, hard- hardware hacking on it to assess its strength. We have a, a long history of working with our hardware partners on hardware security and working with them on basically issues in firmware and hardware in their silicon. And, obviously, for the particular partnerships, both parties, you know, in this case Intel, AMD, and Qualcomm, are fully aligned with us in ensuring that their security teams, our security teams, red team and pen test teams, and external evaluation that, basically, we get as much eyes on this to find any issues before anyone else does and, hopefully, to not find anything, which has been the case to date. When we do, to basically respond and, and react to, uh, accordingly with our partners.
Natalia Godyla: And, what learnings did you have so far from the days in which you put Pluton into an Xbox and now? Like, what have you changed in the processor for the PCs for this new announcement? If, if anything?
Peter Waxman: We've evolved in a number of areas. I think that one is that just the application of it is different somewhat in the PC than it is in an Xbox than it is in an IoT device. So, for example, TPM functionality, which we talked about earlier is something that we don't need a standardized TPM in the Xbox. It's all sort of vertically integrated. Stack, we do things that are similar to a TPM, but we don't need that capability. But in a PC, that's a standardized functionality that exists in pretty much every PC today. And, so, there are capabilities that we've added to be able to, say, support that from a firmware perspective and where needed to add additional hardware blocks.
Peter Waxman: We have advanced. There's places where it's just a matter of hardening the design that we have in Pluton. So, some amount of resistance to physical attacks that we've increased over time. And, it's also, you know, supporting newer capabilities that may exist in, in the industry. If I think back to Xbox days, the expectations around crypto key lengths, for example, right? We didn't have as many crypto algorithms or quite as long key lengths. We supported, say, in the, you know, early implementations of HSP versus today. Now that we have quantum crypto creeping up on us over the next 10 to 15 years, right? There's a much higher focus, for example, on longer crypto key lengths to make sure that we can maintain resistance until we get to sorta implementation, more common implementations of post-quantum crypto algorithms.
Peter Waxman: So, some examples of places where we have just evolved and, um, you know the way Microsoft views it the Pluton-based, the, the architecture and design is something that we evolved for all end points and, so, you'll see, for example, that the Pluton is in the latest Xbox series X and S that we announced, came to market with, and launched in November is a more advanced version, right, based upon that newer capability set then what was there in the Xbox One. So, as I mentioned, continue to sort of update this technology and continue to make it available through these range of markets.
Nic Fillingham: I want to ask about the architecture of the Pluton security processor. When it goes onto the actual CPU die, is it going to be a tax on the CPU? Is it, or is it sort of occupying such a trivial amount of sort of transistors and, you know, storage elements that you're not gonna know that your computer is Pluton powered? It's just gonna be happening silently and completely invisibly in the background.
Peter Waxman: Yeah. That's r-, that's right. It is, from a power perspective or sort of any other aspect from an end-user, you're... Basically it's a small component when you think about it in relation to a modern SOC or modern CPU. It's not taking any relevant amount of power that's at all gonna be noticeable from the device perspective. It's basically this hidden component inside the SOC, system on a chip, complex that, uh, is basically working on your behalf ensuring you have a much higher security experience as a result, but you will not notice it being there. That's right. It's basically invisible.
Nic Fillingham: And, and just circling back to that Xbox comment, so, so I've got an Xbox One, uh, here at home. It's the Xbox One S.
Peter Waxman: Yep.
Nic Fillingham: So, there is a version or a precursor to the Pluton on my Xbox. Is it Pluton v. 1 or is it pre-Pluton? How should I sort of think about that?
Peter Waxman: You've got Pluton. You've got Pluton.
Nic Fillingham: I've got Pluton?
Peter Waxman: You got Pluton.
Nic Fillingham: Yeah.
Peter Waxman: Yes.
Natalia Godyla: (laughs)
Peter Waxman: (laughs)
Nic Fillingham: Can I get a sticker? Can I get a sticker to put on my Xbox that says you got Pluton, baby?
Peter Waxman: I will get to work on that, Nic. I love the idea. I love the idea. I think... I... Your t-shirts and stickers. I think that's, you know, that may be the, uh, the holiday project coming up.
Nic Fillingham: And, then, so, moving forward, at some point, when I'm buying a new piece of computing, whether it's a laptop, whether it's an IoT device, or I get something else with a CPU inside it, I'm gonna want to look for probably a Pluton sticker or a Pluton badge or something that lets me know that the CPU or the SOC contains the Pluton architecture. Is that, again, part of the vision for Pluton?
Peter Waxman: It's a great question. I don't think we've come to a conclusion on it. I'm not sure that we're gonna get to the dancing Intel guys in their, uh, clean suits, uh, commercials on T.V.
Nic Fillingham: That's a, that's a callback to, like, is it the 90s? When they do that? That was a long time ago.
Peter Waxman: (laughs) Yeah. That's, that's showing my age there, perhaps.
Nic Fillingham: Natalia wasn't born then. She doesn't know what that is.
Peter Waxman: (laughs).
Natalia Godyla: Right over my head.
Peter Waxman: (laughs)
Nic Fillingham: (laughs) But, I mean, in terms of as a consumer, or a potential consumer, or even just a, you know, an employee at a company, do you envisage that it'll get to a point where I'll have, you know, an opportunity to buy a Pluton secured device and a non-Pluton secured device and so, therefore, I'm gonna wanna think about my needs, my security needs, and make sure I'm getting that Pluton secured device or, again, maybe to what you said earlier, it's just gonna be completely invisible, completely integrated into the silicon? You're not gonna worry about it, but you're just gonna know that there's, there's a higher grade of sort of fidelity and security on that device because of the architecture in the CPU.
Peter Waxman: Yeah, I mean, our goal is really to get to that point where it's ubiquitous and it's just there. I mean, it's, again, if we're gonna provide, uh, customers with the level of security that is required in today's day and age, we've got to get to a point where this is like oxygen. It's everywhere. It's just a common ingredient that exists. We have to work with our ecosystem. We have to basically work to a path where, you know, we get there. It's not on the market yet. It's gonna take some time. There will be points in time where it's a journey to get there and not every system is, is certainly gonna have it, but our vision is this just needs to be everywhere.
Peter Waxman: It's something where, you know, we're doing this not to make money off of this thing. Not to basically drive specific scenarios. Not to charge and up-prem as we talked about earlier for enterprises. This is about how do we make sure that everyone from consumers to enterprises to you name it has something where we're taking the last 15 years of hardware and systems security, hard learnings, and bringing it and modernizing the PC space based upon those learnings.
Nic Fillingham: How did you come up with Pluton? I had not heard Pluton before I plugged it into Wikipedia, which is the font of all knowledge and it tells me that it is an igneous intrusion... No. No. It is a body of intrusive-
Peter Waxman: (laughs).
Nic Fillingham: ... igneous rock. So, how'd you get Pluton, but, maybe more importantly, tell me some of the names that you considered, but didn't go with? Can you-
Peter Waxman: (laughs)
Peter Waxman: ... can you let a few cats out of the bag? Proverbial cats out of the proverbial bags?
Natalia Godyla: Most important question. (laughs)
Peter Waxman: So, this one, Nic, I think we're gonna have to put the pause button on the recording-
Nic Fillingham: Ahhh.
Peter Waxman: ... and I actually have no good answer nor do I have a great joke to go, uh-
Natalia Godyla: (laughs)
Peter Waxman: ... to go, to go make fun. You know, so, it's, like, code name/buzzword that we use publicly. It's one word. It sounds cool.
Nic Fillingham: It does. Sounds very cool.
Peter Waxman: It's not named by anything else. And, uh, it's... If you think about hey, this thing is going to set the direction and do something leading, it's, like, a north star that's out there. Sounds cool. I don't know what it means.
Nic Fillingham: (laughs)
Natalia Godyla: (laughs)
Peter Waxman: I didn't even know it was an igneous rock until you mentioned it, honestly. But, uh, yeah. Exactly. I...
Nic Fillingham: It is an igneous intrusion.
Peter Waxman: Igneous intrusion. I stand corrected.
Natalia Godyla: (laughs)
Peter Waxman: God. I'm gonna have to go look up that 'cause that, that's kind of freaky and scary.
Natalia Godyla: I feel like that's the best answer.
Peter Waxman: (laughs).
Natalia Godyla: It sounds cool.
Nic Fillingham: It sounds cool. That's totally-
Peter Waxman: It's authentic.
Natalia Godyla: (laughs)
Nic Fillingham: Yeah. That's totally fine for it to sound cool. I did wonder if there might have been something a little bit more sort of esoteric and, and deep to it, but I'm totally happy with it sounding cool. We'll have to, we'll have to go and talk to some of your colleagues to see if, uh, maybe Dave Weston can let us in on a few, uh, names that didn't make it that we could, we could make fun of on another podcast episode.
Peter Waxman: Yeah. Microsoft Bob was one option, but it was taken. So, uh...
Nic Fillingham: (laughs)
Peter Waxman: Yeah. No. Dave will be good to, uh, get history there.
Nic Fillingham: Peter Waxman, thank you so much for your time and for joining us. And, uh, I would love to have you back on the podcast on another episode to discuss the history of Xbox security and maybe mod chips and Xbox hacking and all that cool stuff that we all did in the early 90s. Oh, the early 2000s-
Peter Waxman: (laughs)
Nic Fillingham: ... I should say.
Peter Waxman: Awesome. Awesome. I really appreciate it, Nic. Natalia, it's been an awesome discussion so thank you very much.
Natalia Godyla: Yeah, thanks for being on the show.
Natalia Godyla: And, now, let's meet an expert from the Microsoft security team to learn more about the diverse backgrounds and experiences of the humans creating AI and tech at Microsoft.
Natalia Godyla: Hello, Madeline Carmichael. Welcome to the show.
Madeline: Hi, thanks for having me.
Natalia Godyla: It's great to have you on the show. I have never talked to a threat intel librarian before so let's start with that. Can you, can you tell us about that role? What does your day-to-day look like? How did get into
Natalia Godyla: ... becoming a Threat Intel Librarian.
Interviewee: Yeah. I mean, I can pretty safely say you're among good company in not having met someone with that job title (laughing). I get a lot of really interesting reactions to the title. And, to be honest, it's kind of self-styled (laughs), so it's not like an official Microsoft HR title. But that's the one I go with for my day to day function and what I actually do. So, basically, I work as part of the Threat Intel team in the Microsoft Threat Intelligence Center and as a Threat Intel Librarian for them. And that means I'm sort of responsible for organizing a nation-state threat actors that we track and supporting the end-to-end business process that enables the team to do that as efficiently as possible.
Interviewee: So, recently, I've added being a MITRE attack evangelist to my description and my role. So I look at how we can integrate that framework into our workflows and how that can help us do more with our data to support internal workflows. But also how we can share better Intel with our partners. And the MSTIC team sort of tracks nation-state actors, primarily. There's a little bit of wiggle room around human-operated ransomware. It's becoming a, a more concerning threat and we're, we're onboarding some of that. We currently have more than 270 groups on our radar and that's between named groups that we, we name after the periodic table of elements.
Interviewee: So, so when we speak publicly, you'll hear things, uh, named after that. And then we have what we call dev groups, which are sort of the pre-stage, it's for our internal tracking and to keep, keep things in order. But we don't tend to discuss those publicly. Yeah, we do like security detection, analytics, um, response capabilities for Microsoft end customers. And that kind of entails providing threat intel to Microsoft and defender teams across the company, and then out to customers through security products. So I originally started as a, well, thought I was going to be a librarian and probably a public librarian at that. I was doing that degree and there was an option to do, uh, an internship or a co-op for credit, not a requirement, but I found an interesting job posting.
Interviewee: So took a chance and applied for it and got it. And that was with a research library for the government of Canada. And that was great. I really, really enjoyed working there, and actually, ended up finishing my last (laughs) two degree credits distance while I was still working. That kind of led to moving on to a team that my role was doing aggregate reporting and sort of trend analysis a little bit for the executive leadership at the org. And from there, just got interested in the actual cybersecurity analyst part of the team, and eventually, moved over to that, which was where I got the skills that kind of transitioned into my role at Microsoft.
Natalia Godyla: I'm just going to un- unpack some of the roles there and some of the skills that you're, you're bringing to role as a Threat Intel Librarian. So in the research library, when you're saying that you got into data reporting, what, what were you reporting on?
Interviewee: So that was mostly incidents that have been tracked by that team during the month or the quarter. And so it was just kind of aggregating that data in sort of human-readable format that could be sent up to executive leadership. So they were aware of kind of the high level trends that were happening.
Nic Fillingham: But, you, so when you were studying, you said you, you found a job posting, you said it was an internship, is that correct?
Interviewee: Yeah, co-op internship. However you want to call.
Nic Fillingham: Got it, a co-, a co-op, and that was with the government of Canada/
Interviewee: Yep.
Nic Fillingham: And is it accurate to say that was sort of more of a traditional librarian style role? You, you are physically in a building that had a lot of sort of printed stuff or am I like way too old school and antiquated in my thinking (laughing)?
Interviewee: No, it was kind of in the middle of that. There was a physical library, and yeah, definitely more towards the traditional end. Slightly untraditional, I guess, in the sense that it was like a focused collection. So it was specific to the type of research that, that group was doing. But, otherwise, yeah, books and cataloging and, uh, organizing that.
Natalia Godyla: Why cybersecurity or how were you exposed to cybersecurity? Was it part of the research that the library had or was it just that subsequent roles brought you closer and closer to the field?
Interviewee: Mostly the sort of subsequent role is getting closer and closer. It feels pretty serendipitous when I look back at it now. Like I didn't intentionally set out for a career in cybersecurity or Microsoft or where, where I am. I, uh, did a presentation a couple of years ago for a conference, uh, in the UK that's run by a woman at Microsoft and it's called TechHer, more, more like TechHer. So I did this presentation at TechHer, which is a, a conference run by Microsoft UK. And it aims to kind of give women more networking opportunities and sort of more visibility into technical roles. And during that presentation, I, I called myself an Accidental Threat Intel Analyst.
Interviewee: At the time I was still in that analyst role, more the, the Threat Intel Librarian role. And it's kind of true, like I never intended for that. Accidental is maybe giving myself too little credit for taking some, some opportunities that presented themselves (laughs). But, yeah, it was just kind of each pivot kind of brought me one, one step closer and I thought it was really interesting. And I've been lucky to work with people who are really engaging and their passion for it is contagious. So, yeah, I guess that's why I stuck around.
Nic Fillingham: So what do you do as the Threat Intel Librarian to expand the collection of knowledge and data and, and papers and content in a particular direction? Who, who are your customers and, and how do you go about expanding that collection?
Interviewee: My customers, I guess, or my, my user base would be the threat analysts on the team. And the collection of data is their analytic output, essentially. So it's less curating new collection and less providing resources as it is organizing the output that they're producing. So we have a, a knowledge base that holds all of the threat intelligence that the team produces. And the aim there is to organize that in a way that makes it more friendly for capturing data, but also, um, produces more usable output for downstream users, whether they be in Microsoft as other security teams or Microsoft customers through security products.
Nic Fillingham: And what tools or sort of platforms do you use, you know, this knowledge base? Are you, is it SharePoint or is it some other sort of more secure encrypted storage system? I mean, uh, maybe you can't talk about it, but, but what sort of in, in a general sense do you, are your tools that you're using day in, day out?
Interviewee: So that's changed over the years since I've been here. I've had a number of iterations where we store things, we, we're using, uh, DevOps at one point and kind of mashing that into our scenarios. But we're now using a proprietary knowledge base that's being developed by a dev team out of ILDC.
Natalia Godyla: So what big goals do you have around the library that you are maintaining, building? What's, what's next for you to optimize? What are some challenges that you're trying to tackle?
Interviewee: Well, yeah, so the, the nature of tracking nation state threats and like threat actors is that capturing the relevant threat intel means you often end up with a lot of data that's constantly evolving based on what the actors are doing. It's hard to keep tidy. So the ultimate goal, I guess, is to make our knowledge base as organized as possible to enable as much automation as possible. The threat analysts do a lot of repeatable pivots or queries. And those are really important for, for maintaining an ongoing awareness of what the, the threat actors are doing. But a lot of that can be codified and then made into a repeatable process where they just have to like check in and make sure it's functioning accurately.
Interviewee: And then that allows time for them to do the really clever stuff that takes nuance and a human sort of intuition and experience with tracking for actors to do well. Not all of it can be reproduced by a computer. So as much of the sort of day-to-day stuff that we can automate as possible, that's, that's great. And we do that by having well-labeled classified data that's organized, and yeah, we can feed it to an automation pipeline and then let the analysts do the fun stuff.
Natalia Godyla: So speaking of classification, we, we chatted with Jeremy about how we came to the names of some of the threat actors. I know you mentioned we use the periodic table. What was the impetus for that? Why are we using the periodic table and wha- what's going to happen after the periodic tables run-up?
Interviewee: (laughs) Uh, well, that was in place before I started. So I, unfortunately, can't take credit for (laughing) why it was chosen. I think it was probably chosen because it's a, a, a ready set of names that are easily identifiable to the general public. You can kind of say we named things after periodic elements and most people will know or have some familiarity with that. So there's some, not really branding, but that kind of familiarization so that if you hear a name like that, you think MSTIC and Microsoft. It's also not rooted in a specific culture, really, so there's not any cultural connections or connotations that you need to worry about for applying a name. It's going to be used publicly and associated with Microsoft (laughs), so.
Nic Fillingham: One of the questions we asked Jeremy was, is there a logic behind why one particular group would be given a particular element? Like, you know, are all the inert gases, are they, are they a particular continent or something? Or were they all discovered in the 2000s? Is, is there, is there any logic or is it, is it... because I think the, the joke we made with, with Jeremy was whether or not there was a, a big periodic table of elements against a wall? And then there was a bucket of dots (laughing). And as a new group comes out, you grab a, you grab a dart and you throw it at the wall. Uh, where are you in that continuum?
Natalia Godyla: It's funny the second time around too.
Interviewee: Yeah, I mean, honestly, I wish that was the case. It would be pretty cathartic, I think. But, no, there- there's no logic to the, the name choices we decided or my predecessors decided not to add that layer to the naming. So they're meant to just be just a name. We're, I think, careful as Microsoft about what kind of associations or what we mean when we say, like, we, we choose what we say carefully. And I think it was intentional not to associate that sort of, um, this type of name means this origin for an actor. We, we wanted to have that level of abstraction still.
Natalia Godyla: There are more groups, though, don't you track more groups than there are elements in the table? Is that, am I right there?
Interviewee: Yeah, so we have two types of groups. The ones that have element names are what we would call sort of permanent groups, or it's a permanent name. And that kind of is just the level of, uh, awareness we have for the group. So it's a more mature understanding of the threat actor that has that name. Um, we have a second type of name and we, we call them dev groups, um, dev for development. And it just means they're, they're in development and they're not as fully f- fleshed out as the element names. So it gives us a little more flexibility to kind of label clusters of activity without having to do as much rigor b- behind that sort of is that cluster and what its scope and breadth is.
Interviewee: So there's definitely cases where multiple dev numbers or dev groups will merge into one named element group as we develop more of an understanding about who the threat actor is. Um, yeah, so I think we have over 185 dev groups on the go at the moment, and then 89 element groups. And that will probably change very quickly. So the numbers are not actually that useful (laughs), uh, uh, long-term, but yeah. It, we, we have more dev groups because they're easier to spin up and faster and they're, they're meant to be precursors for the named groups. But as, as you say, there are not that many elements. So we, uh, we'll be running out rather soon (laughs). I'm not sure what's going to come out.
Nic Fillingham: You'll be into the theoretical element-
Interviewee: Yes.
Nic Fillingham: ... category, genre. What's the one from, uh, Avatar? Unobtainium or something?
Interviewee: Yeah, yeah, I think that might be it (laughing).
Nic Fillingham: Was that right? And then there's, what's the one that's bonded to Wolverine skeleton? That's, that's a made-up one too, isn't it?
Natalia Godyla: Oh, you have an, uh-
Nic Fillingham: Adamantium, Adamantium (laughing).
Natalia Godyla: ... wealth of knowledge about this (laughing).
Nic Fillingham: Yeah.
Interviewee: We recently actually added another name schema and they're named after volcanoes. I don't know if that came up in your conversation with Jeremy, but as we put more focus on tracking human-operated ransomware groups, we thought they're distinct enough from the nation-state groups that we would have a separate schema for those. So there's some, some volcano names that are out
Interviewee: ... they're now, and it's the same kind of idea where dev numbers still support both names. And as we develop maturity, it, of awareness on a group, if it's a nation-state, it'll get an element and if it's human-operated ransomware, it gets a volcano.
Nic Fillingham: You know what? I probably should've asked this at the tippy-top of the conversation, but why do we name these groups? What is the value in assigning a name and then actually sort of publicizing the name of that group? Where, where is the value to threat hunters to analysts to customers? What- what's the rationale behind this?
Interviewee: Yeah. So, I guess it's mostly for consistency. It's, it's kind of a language of its own. And you use language to communicate, so having a name and being able to explain what that name means is important. So, one of the other things that our team does is write activity group profiles. They go along with alerts in security products.
Interviewee: So, a customer might get an alert and they'll get this, this document that contains context of what that means for them, and that will include things like the TTPs that that group uses, some of their infrastructure, or like malware that goes along with it, and context that kind of explains their typical motivations or their typical targeting.
Interviewee: So if you're in an industry that is a, a usual target for that group, it might make sense for you to say, "Oh, yeah. Like, it makes sense that we were targeted, it makes sense that this alert is hitting our network, or our endpoints."
Interviewee: But it is also useful to know if you're an outlier in that circumstance. That might mean you pay more attention to it because you're not a typical target for that group. But yeah, so having a name is just a, a way to kind of say, "We mean this group," and here is the context that goes with it, and it's a consistent message.
Natalia Godyla: What other ways are customers benefiting from this library? So, you noted that the alerts will have some of this context that you've been gathering. What other features or capabilities are based on the library?
Interviewee: So, yeah, it's our awareness of the group long term. So, it allows us to kind of see what we would expect of them. We, because we have this body of knowledge built up, we can then see quickly if a tactic or a technique that they're now undertaking is brand now. That's kind of a departure from their normal M.O., that's more interesting. It's useful context.
Interviewee: Yeah, for Microsoft as well as customers, we use our own TI to help defend ourselves. And, yeah, I guess it's just a, a way to kind of contextualize what is happening with IOCs or indicators of attack. They're kind of distinct bits of information that help you detect or protect or respond to a threat.
Interviewee: They contextualize indicators of attack or IOCs, and those, those can be really s- like, small bits of information that help you detect a threat actor. And just having an IP address doesn't really tell you a lot, so that's useful to kind of have that explanation that goes with it that says, "This IP address is used by this group in this way," and that informs how you respond to it as well, depending on the, the attack slide, is useful for how you mitigate that.
Interviewee: And that's a, a big part of why we're starting to add the, the MITRE ATT&CK classification to our data as well. It's a clearer language or repeatable way of describing something to your customers. And the customers as well have started to use attack labeling in their own data sets, so it's a good way to kind of match things up.
Interviewee: And you can layer customer protections that have been mapped to the attack framework with detections on our side that have those attack techniques labeled. And when you layer those on top of each other, you can find gaps really easily and find how they might need to improve their security posture in a certain area.
Interviewee: If, say, its reactor uses a certain technique and that, that customer has a, a gap in detections in that area, they can go, "Oh, well, we are a typical target for this group. We're not super well secured in that area. Maybe we should focus our investment there."
Nic Fillingham: So, is it accurate to say that naming these groups and sort of building and maintaining a profile on them allows both hunters and analysts and then customers to better understand where they may or not be a target, and then therefore, how their security strategy should evolve?
Interviewee: Yeah, definitely. Yeah.
Natalia Godyla: (laughs)
Nic Fillingham: Cool. I got my head around it. I must admit, the very first time I read a, a blog post from Mystic and I, I saw, you know, the name, like, "Here's the name of the threat actor and here's what other industry groups sort of name them," I was like, "I don't get it. Why, why are we naming them?"
Interviewee: (laughs)
Nic Fillingham: But, I, I got it now. So, thank you so much.
Interviewee: (laughs) Cool, glad that came through. (laughs)
Nic Fillingham: I'm glad that this podcast exists, exclusively for me to, to get my, (laughs) get my questions answered.
Natalia Godyla: (laughs)
Interviewee: (laughs)
Nic Fillingham: Hopefully someone had a similar question and we, we helped answered them. Thank you.
Natalia Godyla: So now that you've been in the cybersecurity space for several years now, come to a role that feels like it marries a lot of what you've studied and done throughout your career, the cybersecurity and library are coming together in the name. What comes next that is... Does this feel like it's a merging of the worlds or is there something you want to do after this, either in the cybersecurity space or not?
Interviewee: That's a great question. Yeah, I wish five-year planning came easier to me. (laughs)
Natalia Godyla: (laughs)
Interviewee: Although in, in the world of COVID, I don't know that anyone can plan that far ahead. But yeah, I, I don't know. And I think because I got sort of sidetracked from my original public library path, I haven't really thought about how I would go back to that.
Interviewee: I mean, libraries are becoming much more digital now anyways. It's a great way to serve more content to your patrons and your, your, your users in the world of e-readers and eBooks and podcasts and things like that.
Interviewee: Libraries procure that kind of content for their users all the time, but yeah, I don't know. I don't, I don't know what's next. I mean, I'm happy where I am. So, yeah, stick here for a little while.
Nic Fillingham: Madeline, one of the questions we'd like to ask in, in this part of the podcast is what from your personal life, your hobbies, your interests outside of work, so first of all, what are they? And second of all, do any of them, do you bring any of them into your day job?
Interviewee: Yeah. I mean, I feel like this is where your assertion earlier that I broke all of the librarian stereotypes will fall down, because I do love to read and I have two cats. Um... (laughs)
Natalia Godyla: (laughs)
Nic Fillingham: (laughs) And you just travel round to libraries with your-
Natalia Godyla: (laughs)
Nic Fillingham: ... with your cats and your, and your book bag? That's all you do?
Interviewee: Uh, yeah, yeah. I mean, if the cats were allowed in the library, that would definitely be something.
Natalia Godyla: (laughs)
Interviewee: But I think library tourism is a very underrated area. Expedia should look into that.
Nic Fillingham: And apart from reading, cats, and visiting other libraries, is there anything else you're willing to divulge?
Interviewee: (laughs) I don't know that a lot of it actually makes its way into my day job. Baking is another hobby, but we're not in the office, (laughs) so I can't really share that with anybody.
Nic Fillingham: What's your favorite baking show to binge? Are you a Great British Bake Off fan?
Interviewee: I am. Since moving here, I've definitely started watching that.
Natalia Godyla: (laughs)
Nic Fillingham: Have you thought about entering? Do you wanna be a contestant?
Interviewee: I did actually consider it at the end of this year's series, but I haven't got up the nerve to actually apply yet, and I don't know that I could take the pressure of having to figure out all of those (laughs) different baking techniques without a recipe. (laughs)
Natalia Godyla: What is one of your favorite books of all time? I was gonna say, what's your favorite booK? But I feel like that's just an impossible question to answer, unless you have one.
Interviewee: I, so I generally read fiction. That's my primary genre, but that kind of covers a lot of different (laughs) sub- sub-genres of fiction.
Natalia Godyla: (laughs)
Interviewee: I think my go-to answer for my favorite book is usually Anna Karenina by Tolstoy. (laughs)
Nic Fillingham: In the original Russian?
Interviewee: Of course, yeah. No. (laughs)
Nic Fillingham: (laughs)
Natalia Godyla: (laughs)
Interviewee: No. Yet, I should say. Um-
Nic Fillingham: There, there's different translations, right? Is-
Interviewee: There are, yeah.
Nic Fillingham: Which one do you like?
Interviewee: It's by Richard Pevear and Larissa Vol- Volokhonsky, I think. I'm probably not pronouncing her last name very well. But yeah, it's, it's a great book. And it's long and you have to flip back to the, the list of character names every five pages or so and every character seems to have five names.
Nic Fillingham: (laughs)
Natalia Godyla: All the diminutives. Yep. (laughs)
Interviewee: Yes, yeah, (laughs) precisely.
Nic Fillingham: (laughs)
Interviewee: Uh, but it's good. I, I just, it has always stuck with me as a book I really enjoyed.
Natalia Godyla: Well, thank you, Madeline, for being on the show.
Interviewee: Yeah, it was great to speak with you guys. Thanks for having me.
Natalia Godyla: (singing) Well, we had a great time unlocking insights into security. From research to artificial intelligence, keep an eye out for our next episode.
Nic Fillingham: And don't forget to tweet us @msftsecurity or email us at securityunlocked@microsoft.com with topics you'd like to hear on a future episode. Until then, stay safe.
Natalia Godyla: Stay secure.
