Klara Jordan - The Forgotten Story of Cyber Hygiene

So good morning, I'm Claire Jordan. And I'm gonna talk to you about very different kind of security and cybersecurity than John did. Just wanted to have my slide so you can see the name of my organization, but let me just tell you a little bit of where I come from. I'm a recovering lawyer. I spend about first half of my career at NATO and the second half of my career in Washington, DC doing public policy for fire eye and in think tank and for some large cybersecurity organizations.

And then I was trying to find, you know, what, you know, what, what should I be doing with, you know, the second half of my career? And I thought, well, is there a different way of thinking about cybersecurity? Is there a way to think about cybersecurity at scale? Is there a way to think about protecting the most vulnerable community? So there's an organization called global cyber lines. I'll talk to you a little bit more about what we do in the second half of my presentation, but basically we are a global notfor profit.

There is about 263 members that are our member organizations, and they range from a large organizations like CrowdStrike, Microsoft to small, not for profit, small cybersecurity providers, academia, I not for profits. And really what we like to think of ourselves is that we are an internal laboratory. And what we do is try to think about what works at scale, because we know what we can buy and what we can buy, what it can do for us. But there is still a scale. There is still an ecosystem that's left out unprotected.

So our founders, as you can see, are the city of London police, the Manhattan district attorney, and the center for internet security and these three organizations, especially the first two on the law enforcement side. So, you know, there has to be a different way to do cybersecurity. We can just go and prosecute. So they provided us with financial resources from that were seized in cyber crime and said, well, go and think about what we can, you know, what we can do for the whole ecosystem.

So I'll, I'll run through what we do, but I'll just talk to you a little bit about, you know, the forgotten story of cyber hygiene. You know, as I said, I come from the world of FireEye. I come from the world of APTs. I come from the world where, you know, we really are trying to be at the, kind of the high level of the scale of attackers. I just recently was in Poland, in a, a cybersec conference. And they were talking about securing the world, digital DNA, and they were talking about IOT. You know, they were talking about 5g.

They were talking about all these cool things we're planning on doing in the future. But I thought, oh, you know, that's very forward looking, you know, in order to really explore and, and harness the benefits of the future, we have to really secure our DNA. And I do think that the DNA of the internet is not secure, that we do have huge, fundamental, you know, problems that are still existing because the way how we networked our world.

And, you know, I don't have to say to, to the room present here about, you know, where these problems come from, but they really come from how our founding fathers of the internet made internet to work. That it's open, that there is relative anatomy team and that, you know, we are just very exposed because of how we wired our internet. So what I wanted to talk to you a little bit about is, you know, cyber hygiene gets forgotten, and we do forget about the basics when we're talking about cybersecurity.

And we forget about the basics because we do think that the basics no longer matters when we are facing an advanced persistent threat. John had a great, I really like his pie chart about, about different threats and different actors.

But, you know, I think there is two issues. If we are only think about cyber security at that, you know, very high level, which is one, you know, not everyone can afford the cybersecurity we're talking here about today. There is enormous innovation going on in all of your companies and all of your organizations, but not everyone can afford it. So we have a huge part of the ecosystem that is exposed. And the second thing is, you know, the, even the APTs even the nation state attackers are opportunistic actors.

They will go after the weakest link, they will go after your one small vulnerability and they will not waste their zero day exploit if you haven't patched your software. And so, you know, we, we kind of, as I said, forget about the basics and the reasons why we forget about the basics is because we don't really understand or think about, or maybe even talk about the consequences of the basics. So I'll just spend a minute talking about some of the very me mediatized or media.

I'm not a native speaker, so you'll have to excuse if I mispronounce certain words, you know, there are some of the, you know, media attacks that happened in the past, I would say two or three years that if you really go down and dig down into where they started, they started with, with bad cyber hygiene. So let's think about what what's happened. What's been happening around elections. I don't think anyone has missed what happened in 2000 sixteens, us presidential elections. What's been happening in Germany, friends and some other countries.

And if you look at where you, you know, I mean, what we see in the media is the end goal of the weaponization of information, but all of those attacks started with weak passwords. They started with spoofed emails. They started with, you know, small little holes and gaps in the little ecosystem surrounding presidential elections. And so where we went from one spoof email is to where we are today. When election cybersecurity is a huge, you know, is a huge issue. And it's a huge issue, you know, in every single country.

But again, what happened in 2016 is in, in the United States really did start with bad cyber hygiene and bad and spoofed emails. You know, I think rent somewhere is something everyone is very familiar with. And if we look at how most of the ran somewhere attacks start, they again do start with spoofed emails.

You know, they start with bad, you know, emails, practices, bad email security. And, you know, again, we rarely connect where ransomware comes from.

You know, we see what's happened around NAIA. We saw wanna cry. We saw the financial and human cost of these attacks, but we have not really said, oh, well, how did they really start somewhere in the United States? I dunno if you're following in, you know, there are cities like Atlanta and Baltimore, who've been really hit by massive ransomware attacks. And these are all organizations who have very poor practices, and unfortunately they don't have resources, financial or human to go out and procure what they should be able to procure in. So John mentioned business, email compromise.

I, I just read a recent FBI report, apparently in the last three years, the global community had lost about 26 billion in business, email compromise Europe, Interpol, the UK's NCSC and Nissan other organizations have, are actually calling out business email compromise as the biggest threat to businesses worldwide. And I was actually very surprised to see that on your pie chart, it was a relatively small, relatively small part for the moment.

But I think that just the trend that other parts of the world being world being seeing, and if you look at what business email compromise leads to, it does lead to ransomware enables ransomware, and it enables wire transferred fraud. I think ransomware is a huge challenge, sorry.

Business, email compromise and spoofing is a huge challenge for public administrations. I think lots of cities, lots of government, lots of countries are trying to, you know, they're trying to move to the e-government, they're really trying to be out there, but you know, this is really stopping them because their emails are being spoofed. And in the United States, again, an example, the tax returns season is a huge opportunity for, for criminals.

And again, you know, it leads really to, how do you think about protecting your domain, protecting and against spoofing and protecting it against these kind of basic basic cyber threats. So what do we do about it or how the global cyber lines thinks about it? And as I mentioned, I'm gonna talk a little bit about more, what we do is that, you know, we know that cyber hygiene standards exist, right.

There is, you know, there's center for internet security. There is N there are some technical standards like D a, I dunno if you are all familiar with DMAR, but it's, I'm gonna talk about it a little little later. So we know there are existing standards. We know there's existing guidelines. I think the challenge is what do we do for those who are in our ecosystem who cannot afford to pay for managed security service? I just went through a couple of reports from large, you know, large providers, large insurance companies.

And they told me, you know, the latest strength they're seeing is that organizations with sophisticated cybersecurity practices are being hit because their third and kind of fourth down the chain, someone in their supply chain has not had, you know, a software pitch. And these organizations said, you know, we do protect ourselves internally. We try to protect our supply chain, but we don't know how to help, you know, kind of really, really downstream supply chain.

So there is lots of good efforts, you know, out there in terms of guidance, in terms of existing practices, but we are still wondering, you know, why we haven't gotten there and where we come from is we haven't gotten there because we haven't figured out how cybersecurity works at scale. So maybe I will say that, you know, from, from our perspective where we come to come to these problems, and what we are trying to create is, is actually a community of organizations who are active in cybersecurity, who are supporting and contributing to a larger goal to think about what can you do at scale?

So we all know about fishing. I'm not gonna really talk about why fishing is happening, what it leads to and why it's successful. But one of the things that's been out there for at least a decade is demark, which is domain based message, authentication, reporting, and conformance. It's a very long name, but basically what it is, is, as I said, it's been around for, you know, for, yeah, I, I think a decade, but the awareness and adoption is very low. And the awareness of adoption of it is very low because it does require certain, you know, technical skills.

But if, if set up properly, you know, it stubs direct domain spoofing in its track. So it really protects every domain owner in a way that nothing else out there currently protected. So what we've done as an organization, we've done and we're, you know, we're not for profit. We are doing a public good work. We're almost, you know, it's a charity like work, and I'm gonna talk about what do we do for small businesses and election and journalists. So we looked at D a, we've done a big study about why there is suboptimal adoption of D a.

And then we go, when we, then we went and set up actually a wizard and a video series and started a huge advocacy campaign globally around D a C. And what this led to was, for example, we worked very closely with the department of Homeland security in the United States. And as a result of our engagement, they have issued a binding operational directive, mandating D a C protection of the domain for all the federal agencies, because it's really the organization who set up their own domains that are the most vulnerable. We work with the governments of New Zealand.

We work with the government of Australia and some others. And so we really try to, and it exists in many different languages, including German. But what we really try to do is talk about benefits and talk about economic return on investment in D a R C and what it really does to prevent business, email compromise. I'll say that use of anything we do and we provide is for free, and we're trying to really provide resources to the community. So then they can go and kind of push out cyber hygiene at scale, because we do believe that cyber hygiene does come from the opportunity to work at scale.

So we've also, as I mentioned, measured the economic impact on protecting your own domains. And the numbers are, are really astounding.

The, the reports are on our, on our website. We have couple of, we actually have couple of organizations who are partnering with us. Who've provided pretty interesting information and metrics as to what protecting their own domain brought to them. So the other thing, I don't know how many of you are familiar with quad nine, but it's another, you know, it's another free resource out there for you. And basically what it does.

It's a, it's a protective DNS service. It protects your DNS. And we have pulled threat data from cybersecurity providers who are, who are willing to, you know, as I said, protect something on a larger scale than their own businesses. You know, the thread data is valuable for commercial purposes at its beginning when it's really hot off the press for your clients. But in a couple of, you know, couple of weeks, the data can still help the ecosystem, but it's not of a huge commercial value for you. So together with IBM and PCH, we build, we build.

So we build quad di and basically what it does once you install it, it prevents you from accessing known malicious domains. So if we know that something is bad, you will just not be able to go there. And this is really interesting for small municipalities. We work with the city of New York because they city of New York provides free wifi to their citizens and the tourists and this just, you know, takes away the known badness out there.

And again, there is the unknown badness. There are the zero days, there are the sophisticated and stealth occurs who will completely go around basic cyber hygiene. But I do think that, you know, raising the cause, doing the minimum, doing your cyber hygiene and helping your, you know, small ecosystem around you to do that is, is very important. One of our latest project it's called the automated IOT defense ecosystem.

And we, yeah, we, we just launched this, this, this year and what we're doing is actually a and, and John talk a little bit about the, the deception, but we're really putting a network of honey pots and proxy pots around globally working with universities, different providers, different hosting organizations. And we're trying to see the attacks on real on IOT devices in real life. And what it does is the, it leads, it feeds into a dashboard where organization can actually go take data, use data, analyze data, they can exchange data, they can take it out, they can provide it for free.

And what it really does is the, the dashboard is down the road going to allow automated IOT defense. So we've done also, I'll just very briefly mention our small, small business election and journalist toolkits. So we've done three thing. We've done three toolkits for three very vulnerable communities.

And again, we looked at the existing guidance. You know, there's so much guidance for small businesses, but they have no resources to implement it. So we literally build, we literally build a toolkit where we took the best or the, the most effective cybersecurity controls and match them with free tools and put guidance there.

So again, the organization like MasterCard and, and other large banks who are our partners can push it out to their client base and say, you know, well, this is not going to help against everything, but it's going to eliminate the most pervasive threats. So, you know, we're mapping to government standards globally, in terms of, in terms of, in terms of controls that we're implementing.

And again, it's to protect, you know, the basic, the basic things. So we've done one for election officials, one for journalists, and one for small businesses, I will just run through, you know, you can really go on our website and go through it.

It's, it's also done in a language that's easy to understand, and this is not necessarily for your organizations. This is for organizations, you know, in your ecosystem or down the chain or for your mom and pop shops, if you are working with them and you wanna give them something on poor them to something that can help them protect themselves. So I'll just say that, you know, there is, there is different ways to think about cybersecurity.

You know, we think about cybersecurity in terms of bringing the communities together, doing something impactful at scale, and then pushing it out globally. So we have, as I said, 300 about almost 300 organization in 30 countries. And they come to us for different things.

Some just want to engage some, wanna be part of our advocacy effort efforts, some wanna provide, you know, we have lots of organizations who do provide actually free tools because they wanna help the world and they wanna push out, you know, some of what they're doing, but we're really interested in bringing more organizations, whether to help with our toolkits or working on the IOT. So I'll be around all day and you'll hear actually from me on two other panels. So I'm looking forward to meeting you and answering any questions you may have about GCA. Thank you. Great. Thank you.