Troy Hunt: password security is the name of the game

Troy: Now, at the moment, this is available on a Tor hidden service, where the folks here are saying, "We have hacked the psychotherapy clinic Vastaamo and taken tens of thousands of patient records, including extremely sensitive session notes and social security numbers. We requested a small payment of 40 Bitcoins...", which I've just checked, and it's about 524,000 US Dollars at the moment. In brackets. Nothing for a company with yearly revenues close to 20 million Euros. "But the CEO has stopped responding to our emails. We are now starting to gradually release the patient records, 100 entries a day." And then there they are.

Paul: Yeah.

Troy: So inevitably in this case, it's- it appears to be financially motivated. Now who knows how long they've spent trying to get their 40 Bitcoin before the CEO stopped replying and... yeah, I guess now, they're hoping for money, maybe? That I don't think they're going to get if they just dump all the data either.

Paul: Yeah. But is that not- I mean, it's quite distressing for those patients involved, okay. Because they put a lot of trust into that organization to be able to protect that data. And what I'm seeing here from the report is that, as you mentioned, it was 40 Bitcoin, which supposedly was refused to be paid. And then they approached the individuals concerned, asking for 200 Euros, or 180 Pounds equivalent of Bitcoin, for- to stop that information being... So it seems that we're in that... cycle very much now where it's more predominantly visible now that this blackmailing and... is going on. Whether it's ransomware attacks of encrypting data, of getting data and then releasing it by malicious actors.

Troy: And it's not unprecedented, alright. We saw this with Ashley Madison. With individuals who are members of that service being blackmailed. And it's- look, I mean, we know from Ashley Madison, too, that it led to suicide. So it's just- it's enormously sad and serious, and it's... you can only imagine that if those folks do get caught, it's probably not going to end up very well for them. You'd hope not anyway.

Paul: Yeah. And so that would lead me to ask is, I mean, exposing data by design is something that you mentioned, but also, I mean, where's- there's a lack of accountability. You've mentioned this, Troy, before. Where does that accountability lie? Is that with the organization that should be responsible now for making sure that that information is obviously secured? Should they pay the ransom? Should- how does it- how do you feel with that? Maybe István as well.

Troy: Well, I think there's multiple ways of looking at it. So... yeah, what can the organization do? Data is already being leaked. It's a little bit of that old analogy of trying to remove your data from the web is like trying to remove pee from a pool. So, you know, like that's not going to happen. The data has already been leaked. The other discussion then of course is: Do we pay ransoms? And this is a discussion that's happening many, many times over now, as it relates to ransomware. And it's getting particularly interesting, because we're now seeing things like ransomware crews like Evil Corp being on the US sanctions list. And if you pay them, you're going to violate US sanctions and then you have to answer the Treasury as to why you've violated sanctions. So is it even possible to pay ransoms? In the presentation I had today, there was someone in the call from a healthcare organization, who said, "Look, we literally legally cannot pay the ransom, because we're using public funds, and there is a legal restriction on our ability to pay any ransom with public funds. So effectively, if our healthcare company gets hit, like too bad. No matter how much the RIY makes sense, we can't pay it." So it is becoming a particularly fascinating area.

Paul: Yeah. István?

István: Well, it's... it's certainly a question whether, for instance, the CAO of a company for paying that 40 Bitcoins from the personal funds, not necessarily from the company or the organizational budget. Because that... the accountability, who is accountable is the organization and the organizational- the managements of that organization, at the end of the day. And it's because they decided not to invest enough, or they decided not to look into, you know, the data breaches and... And they are, you know, like the New York State introduced data fiduciary concepts in their regulation. They are data fiduciaries. They are- they have their fiduciary uses to protect the data, what they- you know, someone handed over to them. And if they cannot do that, then well, they're not doing their job. And it's- so it's if, for me, is- with all means you need to protect information, especially when it comes to this very, very sensitive ones. Like psychiatric cases. And paying ransom to, you know, prevent that is a price you need to pay. But obviously the question comes- it's not just: Can you pay the ransom? Because it might be terrorist funding and money laundering, all these questions. But it also that: Okay, you paid. But what is the guarantee that they won't leak that information? What is the guarantee that they will? I mean, these are not respectable businessmen for- for the beginning. So...

Paul: Yeah. Do you think that companies, organizations, are in a very difficult place right now, with- because there's... ? Here in GDPR-land, they've got GDPR. So there's a potential risk of fines about the way they're not following certain procedures for dealing with data properly and storing data and handling data. And maybe, in Australia, I don't know if you've got the same thing? I mean, I know that the US is starting to bring in some certain data laws as well, but I know that we, earlier on, I think last year, we had a bit of an issue for our organization in dealing with Australian companies, because there was some regulation change over there as well. How do you think that either regulation can help? Or is it basically there is not enough at the moment, to be able to support or prevent these data leaks from happening?

Troy: It's a... it's a very odd time where, for something which is so common and so universal - personal data - yeah, let's say, my name and my birthday and then we'll make it interesting, my sexuality as well. It's all very personal to me.

Paul: Yeah.

Troy: And if I live in the UK, I get a very different level of protection to if I live in Australia. And then I get a very different level of protection if I live in China. Yet we're all using many of the same online systems. Less so the Chinese, but certainly the Brits and us. And I sort of lament the fact that I'll see a data breach - and let's say it doesn't matter where the breach is from. We'll see a data breach. And a whole bunch of European people will pop up, who, for all intents and purposes, are equal to me. And they say, "This is it! I'm going to get all these protection from GDPR, because I'm European." And I'm like, "Well, what about me?" I have the same- the same rights. So we have some protections in Australia. We got our Notifiable Data Breach Scheme a couple of years ago, which is our sort of first iteration of mandatory disclosure laws. But fundamentally different levels of provision. So, for example, the three fundamentally different things to GDPR: Number 1 is rather than it being 72 hours before we have to report to a regulator, it's a month. It's like literally ten times longer. Number 2, if your company had revenues of less than- I can't remember if it was either 3or 3.5 million dollars a year. Basically, a number of which more than 90% of companies fall beneath, you don't have to report, because that might be hard work on the company. So it's literally like the organization responsible for the data loss doesn't have to report it if they're anywhere near a normal-sized company. And then 3rd thing was, if the breach is unlikely to cause serious harm to the individual, you don't have to report it, regardless of your size. So you can be a great big multinational, but you have a simple form somewhere, and because you say, "Well, it's just a form to comment on our cats, that's not potentially damaging. We don't have to disclose that. Never mind that all the passwords people are using are the same ones they'll use on their social media and their other very personal things." So we have a massive variance from different parts of the world. And then, I guess, the thing that then makes GDPR particularly odd is the assumption that it should apply to organizations operating in other parts of the world, because they may have the data of data subjects in the EU in there. And that other part of the world is then also going to be subject to all these other regulations, too. So I do fear that we're perhaps drowning a little bit in regulation, which to date don't seem to have had a fundamental impact on the data breach landscape anyway.

Paul: Right.

István: Well I... there are few regulations which is going on the opposite direction, like the Australian Assistance & Access Act. It's a recent one, two years- or not that recent, two years ago. They're basically- it's usually quoted as "anti-encryption law". Because it is banning strong encryption, so it's- and it's also that the EU recently, there are gossips that people are pushing to ban strong encryption. Or they want to have a backdoor in encryption, so that at the same time, there is a... sort of lobbying to weakening encryption, which is the fundamental- which is the bedrock of a strong security and strong security online. But I- well, I do agree, Troy, that we're drowning in regulation. Though I'm a big fan of GDPR. At least the principles what it introduced. Yes, they are- you know, the practicalities and how is it implemented and how it will- it comes to life. We need to wait a few more years. But I do believe that if you're putting the liability, which there was no real liability before - putting the liability on companies and well, basically, their shareholders in a way, because you are- so that the- the fees or the penalties are connected to the revenue, which is hurting the shareholders so that at the end of the day... then what you will see is more investments on prevention. More investments into cybersecurity. Because there is a bigger and bigger price tag of the damages of data breaches in the forms of penalties, but it's also in the forms of losing trust, because you need to publish it. That will, you know, make the security budget bigger. And I think it's- what is important is that the- to know that when you do security, you need to invest in it. It cannot- it won't happen without money. I mean, just pouring money doesn't help either. You need to make it in a smart way, you need to build the security program up. But if there is no budget and no attention inside an organization for such a crucial part, like protecting the data of the customers, then more data breaches will happen.

Paul: So I think that's leading to the point of where I wanted to come onto around education. And I think, obviously, we're becoming more aware of what's happening out there and people are starting to take it more seriously. Maybe also here, in GDPR-land, for the sake of GDPR being implemented. But what direction do you both see now, going forward? What do you think some positive solutions could be, on top of what we already have? I mean, we see a lot of breaches. We also got these, as you mentioned, password managers to put your password in, so we're getting help with our passwords. I mean, I see things like- like last night, I was watching a documentary with regards to China and the US, and the race for AI, artificial intelligence, and facial recognition. So is there potentially more security further down the line, as AI develops, for example? To help us keeping things very secure. Or is there a potential- more threats to our data out there, with content computing, for example?

Troy: I think it's- it's one of these ones where there's- it almost feels like I'm walking around the RSA conference. Yeah, it's like AI and blockchain and content computing. I was at InfoSec a year in London, the middle of last year, and I remember seeing a stand that was selling NextGen blockchain. What's the thing? So I'm a little bit conscious. There's a lot of buzzwords around this. Look, I think there are some roles for these technologies to play. Inevitably not as much to date, at least, as we've seen prophecized. I think that, going back to your point about education... one of the challenges is: How do we educate several billion internet-connected people about online security? About things like passwords? And this is a massively hard challenge. Now I've got a blog post I'm hopefully publishing in the next day or so about people being able to recognize URLs. And effectively, how bad we all are at reading URLs and being able to figure out whether you can trust it or not. Now this is not something we can educate away. I can't tell from the URL whether it's bad or not. Particularly once we have homoglyphic characters and homographic characters and then this sort of thing as well. That- the sort of things that we can practically do, which I think will help our privacy online, is just being more conscious about information reshare. Now an example I always give here is that something like your date of birth is knowledge-based authentication. This is what I went to Congress to talk about. It's static knowledge-based authentication as well. You can't change it. Yet it's regularly used as a piece of identity verification data. Don't hand that out to catforum.com. And I don't say that as a joke. Literally, if you go and register at catforum.com - I checked this, just because I wanted to pick like the most inane site I could think of - catforum.com will ask you for your date of birth when you register. Now not providing that data removes the risk of the website losing that data. I mean, this is one of the principles of GDPR and data minimization. Like let's not have data we don't need. Let's not give organizations data we don't need to give them. And now I'd like to see organizations being more responsible about minimization, and then us as individuals also being more responsible about minimizing the data that we willingly provide.

Paul: Because there is an attitude of maximization, as you've previously mentioned, right? So we want to maximize what data we can collect, and when we go online sometimes, and let's just say we want any book or we want some kind of information, sometimes the forms that we have to fill out are pretty in-depth about the information they require for us to get the information that we want.

Troy: Well, when I- when I announced that I was going to do that talk at Congress, and I sort of crowdsourced some ideas, someone gave me a really great statement, which I did actually put in my testimony, which relates to what you just said. And the statement was that organizations look at our data as an asset, and they never look at it as a liability. Now if it's an asset, they want as much of it as they can possibly get. If it's a liability, they want as little of it as they can possibly get. So we really got to try and shift that mindset from asset to liability.

István: And I think it's- it's a great analogy. But it's also what I would say- education, and the reason why I really like the Have I Been Pwned website - I'm sorry for my accent, Troy - so the reason why I really like, because it- that website makes it real. So that when I showed to my wife, for instance, her- that typing her email address in and then, "Oh, I have been hacked. Why?" And it makes it real. So I think it's important that people demanding accountability, so that the- yes, regulations puts accountability on someone, but the very person whose data is at risk, should demand higher standards. And if- it's only- it can only come from education. Because if people are not demanding from services to make sure that is- they are, you know, investing in cybersecurity, if people will not drop the service immediately after they realize that they're not doing a good job in protecting their data, then nothing will happen. So it's- it all comes to- yeah, to education of private individuals, who are- who want to watch cat videos and yeah... use a fake birthday or something. Or ask yourself, "Why does this website wants- want it from me?" So- and it- this type of education, this type of realization, is not necessarily an education, because it's more like people need to realize that they are at risk. That's a better- it's a big and important way of preventing.

Paul: Yeah. That might explain why some of the forms that I get from my- in my lead pipe tend to have fictitious names around them. Especially if they're CISOs and... etc. I just wanted to finish off, 'cause we've got five minutes left before we have to wrap up the podcast, and I'm sure you've got other things you need to get onto with your day. But the COVID situation, of course. Yeah, it can't be escaped. Can't get away from it. What's the risks now, with people potentially working remotely? Especially if you're working for an organization, so work from home, I think, is there a case that people need to be more security-conscious? Is the risk higher? Just because of this situation? What's your feelings around the COVID? Has it bought- let's say, has it brought an awareness, that awareness, forward? From working remotely. I mean, I know a lot of people have been working remotely for quite a long time, but certainly in Europe, we're a little bit more conservative. We have to go to the office. What do you see there? What do you see with the whole COVID situation?

Troy: I think it's a combination of the risks are higher by virtue of having more people doing work things outside the workplace without the time to properly prepare for it. I mean, we've seen things like the number of Zoom meetings people have Zoom-bombed and inevitably listened into things they shouldn't have, through to the risks of just simply being different. And a good example of the latter is: We had a short period there where our kids needed to work from home. And my son's sitting in his bedroom on his laptop on one of the first days, and I was quite impressed to see all the other boys in his class - he's in a boys' school - also sitting there on their laptops. And thought it was all very organized. And then one of them was obviously sitting in the living room, and his dad walking behind him on a phone call, having am business meeting, with like clearly audible information. And I'm like all these kids and who knows how many of their parents are sitting there like listening to this business call. So because of the way it changes the way we work, it's not just a question of we might have more direct risks online in terms of entering our credentials into a phishing page or something like that, but it changes a whole bunch of other environmental factors as well. And I think there's all sorts of aspects of being a sudden, unplanned remote workforce, that we're yet to see the full effect of.

István: Just here from me another react on the dad walking with a phone. I am also- when I'm working from home, I'm- the room, the working room is close to my baby's room. And my wife usually leaves the baby monitor turned on in that room. And when the baby is not there, the door is open, and it's basically the baby monitor is broadcasting my discussion to the air. And I'm- I need to keep on switching off or, you know, closing the door, not to broadcast the potentially confidential information, when I'm in. But it's- that's the environment when you are at home, you can easy- it can easily happen.

Paul: And with the COVID situation as well, I can see already some companies saying that, "We're not going to go back to the office." For example, there's some companies that have already come forward now, where you can have a permanently work-from-home situation. Again, is that something you feel like- hopefully, once we get over this COVID situation, where people will be more educated about the security aspects, not just the people themselves, but the organizations as well. Because we're putting a lot of trust in people's own infrastructure, I suppose. Right? We're- when I work from home, I got to have the right wifi, I've got to have the right security settings up, we've gone through, at Tresorit, a security training seminar to work from home. But I think there's probably still a lot of cases out there, where people just aren't aware of potentially the risks in their own home that they could be confronted with.

Troy: Well, you know, I think forever is a long time as well.

Paul: True.

Troy: So let's just see how that works out. I'm sure there was a phase there where in those heady dotcom times, people thought they'd be having free lunches, literally free lunches, forever. And, you know, water slides and whatever else they had in the Google offices. I think this is one of these things which is going to take quite a while to adapt to. Even if we get to the point of- let's think of something simple, like unlocked laptops in a home. What is the risk that that poses? But yeah, then again we're also a sort of moving risk, aren't we? There are other risks that we incurred when we transited backwards and forwards and had those laptops in the car or in the shops on the way to work. So... yeah. But maybe one way of looking at this is that there are aspects of security that may not necessarily be better or worse, but they will be different.

István: What I- what I see is that it is pushing the organizations to really upgrade their system in the way of our system, because a lot of enterprises are currently looking at their IT system as a fortress. So that they're- they need to build walls around their, you know, information assets and around the people and around the laptops. And try to protect these assets. And recently, not I mean because of the COVID, but a few years ago, started this zero trust and this (inconclusive) frameworks type of thinking that, "Okay, try not to view your organization as a fortress, because if something- there is one infection, one malware or one weak point and someone gets into that fortress, they can get everything they want. So try to build inner walls. Try to make sure that you're securing the independent computers, you're authenticating the users, you're making sure that you're not assuming, when you're on the network or on a physical site, that will protect everything. So that this sort of thinking process, this type of architecture, came into life, and- before COVID, and more and more organizations will be pushed into this, because of, you know, single laptops in a single home. And as Troy mentioned, how to make sure that those laptops, when it's carried to home, back and forth, these laptops will not leak information if being stolen or lost. So these things was there, out there, as a security architecture before, as security professionals were always saying, "Don't trust your home network." Now it's just another motivation, another push.

Paul: Yeah, and I think - final thoughts on this - and this situation potentially brings for organizations an acceleration for moving to the cloud, potentially? Because of people working remotely, and maybe they don't have existing infrastructure that can cope with that very well. Is that something that you potentially can see as well? That companies will reorganize and take cloud adoption more seriously? 'Cause they were always those ones that'd been sitting on the line or sitting on the fence. Thinking that there was still that in there- you know, there's a risk with cloud services. What do you both see there now, going forward? Final thoughts.

Troy: A little bit like the last answer, where cloud doesn't necessarily make things less secure, even more secure. It makes things differently secure. And the sort of the example I always care to remember: Years ago, when we started going into the cloud. And let's go back, you know, five to ten years. And I'd sort of give the example of, well, you know, when we merged into the cloud, we very often have a much more focused, well-resourced team looking after your cloud things, as opposed to, you know, when we had the on-prem things. So, you know, that's a good example of where things change. It doesn't mean that they won't go wrong, it just means that the security posture is different to what it was before. So that I would sort of encourage people to look at each aspect of moving things to cloud, in terms of how does security change, as opposed to some sort of atomic "is it better or worse".

István: What I see, based on my own experience, that more and more companies considering clouds. And yes, with a caution, as Troy mentioned. With that, you know, "Is it good for us or not?" But at least, more and more banks. European banks were not really considering clouds, or using cloud as an alternative to their internal system. And now they are! And- so what we can expect that more information and more companies will think about and moving to the cloud. Not everything. For sure. Because, as Troy mentioned, it's differently secure than an on-premise system. And there will be systems which will be kept on premise for long. But certainly that will create new and bigger challenges, as we move on. That these type of conservative companies, sitting on big, big amounts of confidential data, is pouring that data into the cloud.

Paul: Okay. I think, well, the hour's up. I really appreciate you guys coming down and running this podcast with me today. And I hope that down in Australia, you'll have a successful and good evening. I think you're going to continue to write your blog, and I'll be following that quite closely. István, thanks for coming in this morning - early this morning - for us. And I wish you both the- all the best! Thanks very much for joining!

István: Thank you.

Troy: Thanks, guys!

Paul: Cheers!

Troy: See you later!

Paul: And that is all for today's episode of "under CTRL". You can find links to all our social platforms and to our guest in the episode description. If you like the show, make sure you subscribe and leave a review. Join me again in two weeks' time for the next episode.