Today on our Tech for Business podcast, we are
joined by Ven, the Director of Information Security
at ArmorPoint. Thank you for taking time to be
here. I really appreciate it. Yeah, of course.
Thank you so much for having me. Yeah. I should
have mentioned this is going out during Cybersecurity
Awareness Month, which when we're recording this
is still a couple weeks away. But we're talking
ransomware as a service, like the business model
of it. So, Ven, can you tell me a little bit
of what does that mean, ransomware as a service,
and how it's kind of changing cybersecurity?
Yeah, definitely. So, ransomware as a service,
like you said, it's a business model where ransomware
developers create and sell or lease their malicious
software to other criminals. They call those
RAS affiliates. So, ransomware as a service,
or RAS. So, we have the RAS operators or developers,
and then we have the RAS affiliate. So the RAS
operators and developers, they are the ones with
the high technical coding expertise who create
the ransomware, but not just the ransomware itself,
but also the infrastructure to deploy it, to
manage it. This means monitoring who your victims
are. This means they provide a payment system
where victims are able to make their ransom payments.
And then the RAS affiliates are often individuals
with less coding skills. They don't have the
high technical expertise to create ransomware
themselves, but they usually have other technical
expertise, things like social engineering. They're
phishing experts. They may be your traditional
hacker who's able to infiltrate networks through
your other technical means. And so they work
together to... to where the RAS developers create
the ransomware and the RAS affiliate deploy the
ransomware. Traditionally, an attack like ransomware
would all be conducted by a single person or
maybe a couple people, and they would be responsible
for the entire attack chain. But now, because
ransomware as a service is becoming such a growing
threat, people with less technical expertise
who are interested for whatever their reason
in entering the world of cybercrime, that...
barrier to entry for technology expertise is
a lot lower now because of this ransomware as
a service growing. So the RAS developers focus
on creating powerful tools while the affiliates
handle the attacks themselves. And this increases
just the scale and the frequency of ransomware
campaigns, honestly, worldwide. Yeah. I mean,
that was going to be my next question was who
was doing this. But as you're talking, it sounds
like the speed at which this could be deployed
is just growing because of this service model,
which is crazy. Yeah, definitely. The speed is
one of the big issues, too, is how fast an attack
can be deployed means that us on the defensive
side, we have much less time to defend. Yeah.
So I would love to dive a little bit more into
some unique issues that this service is creating.
But I want to touch on who we're talking to today
because when I think of ransomware, I think of
like large corporations or people who have a
lot of data and also have a lot of money being
the targets. So is this a concern for small businesses
or is it a concern for specific industries? Who
are we talking to today? Oh, yeah, this is definitely
a concern for small businesses. In a lot of ways,
small businesses are the primary target. Like
you said, large corporations may have the resources
to pay a large ransom, but that also means that
they have more resources to invest in stronger
cybersecurity defenses. So small businesses often
lack a dedicated IT security team. They usually
have less budget for advanced protection. So
this makes them a much more vulnerable and attractive
target. Some data reports even show that small
businesses make up a larger percentage of ransomware
attacks than large businesses do. And it becomes
much more threatening because attackers and cybercriminals
will happily adjust their ransom demands to increase
the odds of payment. So they'll happily ask for
less money if it means that you're more likely
to pay. So it's much easier to ask 10 small businesses
or demand, I should say. It's much easier to
demand that small businesses pay $100 ,000 than
one large corporation demand pays a million dollars.
Interesting. I'd love to talk a little bit about
some practical steps. We don't need to go into
too much of incident response, because that's
a whole other conversation. But before we do
that, can we go back to the unique issues that
ransomware as a service is really causing? We
talked a little bit about speed. Is there anything
else that comes to mind that's unique to this
service that's affecting the cybersecurity world?
Yeah, I mean, really it's that speed and the
widespread nature of it. It's the fact that it's
so much easier for people to execute the attacks
than ever before. Previously, you might have
seen malware tools out there, like a malware
developer might create something and they might
share it with some of their close friends or...
their close affiliates the same way that, you
know, I might find a new tool or a fun new app
in the app store. And I would send it over to
you because I'm like, Hey, this is a fun app.
But now because of more professionalized nature
of it or the more organized nature of it, it
becomes more of a, more of a business model,
honestly. So it becomes, we have more of a tiered
structure of the developers at the top, and then
we have the affiliates. They kind of act like,
let's say salespeople. They're responsible for
that last mile of, of the sale or the attack
really. And, and then even beyond that, there's
a little bit, there is a role that's a little
bit less spoken of. We call them initial access
brokers. So we have the RAS developers who develop
the ransomware, the RAS affiliates who are responsible
for deploying the ransomware. And then the initial
access brokers are those who. focus more on gaining
access to networks. So they might be internal
threats. They might be people, I don't know,
disgruntled employees or ex -employees of companies
who leave their company with credentials that
they've stolen. Or they're technical hackers
who focus more on breaking into a network and
they sell that access to the network to the RAS
affiliate so that they have access to deploy
the ransomware further. I keep thinking about
this business model. I mean, is it kind of the
same as there are the big hitters and there are
the small ransomware service businesses and they're
getting acquired and they're having holiday parties?
I mean, how deep does this true business model
go? Yeah, this definitely happens. We've seen
a new ransomware as a service provider. It's
funny to use that word, but they really are a
service provider. Ransom Hub is a new one that
has launched and we've actually seen them, security
researchers have actually seen them poaching
other cyber criminals from other ransomware groups.
And so the way that the ransomware as a service
typically works is the RAS developer creates
the ransomware and then the affiliates deploy
it and they share the profits. So usually the
profits have been... About 50 -50. Sometimes
the developer will take 70%, the affiliate will
take 30%, but it's that kind of range. But with
Ransom Hub, we saw them essentially campaign
and try and poach cyber criminals by offering
90%. You get to keep 90 % of the ransomware payment
and it will take 10%. So they really are employing
legitimate business tactics. Increase their,
to build their organization. Wow. That's crazy.
I mean, to have a business model, you must end
up having a lot of companies that have that end
up paying out. I mean, can we talk a little bit
about if you're a business and you are a victim
of ransomware, sort of what some of those first
steps you should do? I know everyone's big question
is, should I pay? Should I not pay? What does
that look like from a business point of view?
From a business point of view? Whether or not
you should pay the ransom, you know, generally
speaking, law enforcement agencies like the FBI,
they don't support paying a ransom. I personally
also don't support paying the ransom because
it encourages further criminal activity, you
know, and also it offers no guarantee that your
data will be returned. You know what, actually
that traditionally speaking, paying the ransom
doesn't always guarantee that your data will
be returned, but this is something that the ransomware
as a service model has changed. because they
want to operate more as a legitimate business.
It actually is more likely that they're going
to return your data because they don't want to
be known as a group who, well, we're going to
pay you, but we're not going to release your
data. In a sense, they want to build a reputation
that they're trustworthy, that, hey, you pay
us, we'll give you your data back. But even still
with that, government agencies, law enforcement
agencies definitely don't support paying the
ransom because of the fact that it encourages
further business. You know, it further supplies
the service operators to continue their operations.
But one of the things that often are the main
influences to whether or not a business sees
that ransom, it's usually how critical the data
is and how available their backups are. Those
are going to be the biggest influencers on it.
So if the business has no recent reliable backups
and the data that is encrypted is essential for
their operations, A lot of the times, the cost
of paying the ransom is going to be seen as less
than the cost of the law of business. Oh, sure.
It's definitely a slippery slope. There's no
real one advisement, but the best advisement
is going to be to be able to respond and recover
from the ransomware attack without ever having
to pay the ransom in the first place. Right.
Right. How quickly do people bounce back from
a ransomware? Like, how quickly do businesses
get back up and running? I mean, it depends,
but... Yeah, it definitely depends. It definitely
varies. But how quickly a business can bounce
back mostly relies on how good their backups
and how available their backups are. If you have
regular backups that you trust and you've tested
them and you're able to quickly bounce back and
restore data that's been lost, that's how quickly...
you can bounce back from an attack. So if it
takes weeks to restore that data, it's going
to take weeks to bounce back. But in some instances,
if you have backups that can flash back in an
instant, then it's almost like it never happened.
Yeah. So we've been focusing a lot on the financial
part of it, because that's a huge part of this
conversation. But attacks like this also are
affecting reputation, compliance, you know? And
security in general. So beyond that financial,
what are some concerns about ransomware for businesses?
A lot of concern, like you said, it's a reputational
damage. So customer trust is going to be harmed.
And we are also seeing a lot of focus on the
supply chain right now. So if you're a service
provider who contracts your services out to several
large organizations, and that service provider
gets knocked out by ransomware. That means all
those large organizations also lost access to
that service. We thought that a lot with the
Change Healthcare breach, where Change Healthcare,
the division of United Healthcare, they got taken
down, so their payment processing and access
to critical data got shut down, which meant that
smaller providers, small medical providers all
around the country also lost access to that.
I actually have a personal connection to this
particular data. A close friend of mine She is
a marriage and family therapist and she runs
a small, she runs a small therapy practice in
Southern California and healthcare, change healthcare
was a large portion of her patients, their insurance.
So because they were taken down, she was unable
to process the, her patient's pay payments, which
also meant that her employee's payroll was affected
and it just created this whole cascading effect.
Oh my gosh. Yeah. And then reputation, I mean,
it's so hard. It can be really difficult to come
back from that. Even when you have all of your
backups, you have all of your things, everything
is back into place. I mean, once people kind
of have that feeling, it's hard to come back.
Yeah, definitely. I even feel guilty just calling
out Danger Healthcare and United, because it's
not necessary. I feel guilty calling them out
because I'm just perpetuating that reputational
damage. At the same time, we also do have to
speak about these real -world examples. They're
important for us to learn from. I call them out
not to say, hey, you did a bad thing, but this
is an example that we can all learn from, really.
Definitely. And it's come up on our podcast before,
and we definitely talked about other events that
we've seen and kind of talked about the importance
of communication and having not only an incident
response plan, but a communication response plan
and being able to have that open communication.
I mean, maybe you can touch a little bit on how
important that open communication is in an event
like this. Yeah, the open communication is huge
because the response needs to be very fast. The
attacks are happening much faster, so that means
our response needs to be much faster. So having
those open lines of communication between incident
responders, between staff who may have been affected
by a ransomware attack, that open communication
is huge. Say you're a lone employee, you're working
remote, but your workstation is connected to
all of your work resources and notice something
strange on your computer. If you don't know who
to talk to or who to tell about that, then that
strange activity is just going to continue happening.
But if you know exactly who to report, hey, this
is happening on my computer, can we take a look
at it? Or what do I do? If that open line of
communication is there, then response can be
much faster. And on that line of, or on that
note of communication, it's also important to
have backup communication methods because sometimes
the ransomware attack might take out your initial
communication method or... maybe themes having
a service issue or something like that. If you
don't have backup communication method, then
that could also hinder your response time as
well. That is so smart to consider. I hadn't
even really thought about that, but you're totally
right. It's true. And, and like even our team,
we, you know, we have our, we have our traditional
teams channel, and then we have our, our, our
email platform. And then I also, we also like
to keep a backup discord chat. open for our incident
response just to be sure that should anything
happen, if there's ever a team's outage or anything
like that, we have backup just in case. Super
smart. So coming back to this ransomware as a
service, and you spoke a little bit about open
communication, what are other ways in which cybersecurity
professionals like yourself are adapting to this
new model that's out there? Oh yeah, so it's
definitely changing the landscape mostly because
of how quickly attacks are being deployed. I
mean, from the defender side, the attack is going
to look pretty similar to previous. It's going
to be initial access, be that a phishing email
or someone stole credentials and they were able
to access the network and then they deployed
malware. So part of the problem is how quickly
they're able to respond to that and how quickly
the attacks happen. But one of the ways that
defenders are adapting to it, rather than only
focusing on simply blocking the attacks and responding
to things, they're starting to be a little bit
more proactive with things. So we're increasingly
using what's called zero trust architecture,
or sometimes you'd get a zero trust networking
architecture. And that means that it operates
off of the principle of never trust, always verify.
So traditionally, traditional network architecture
would say that if you're connected to the corporate
network, if your device is connected to a corporate
Ethernet, if you're on premises, that means we
trust you. You have access to everything that's
on the network. Now with zero trust, it means
that regardless of what network you're connecting
from, regardless of what your device ID is, you're
always going to have to verify who you are and
that you are who you say you are and that you...
have legitimate access to whatever you're trying
to access, be that a critical application for
business use, be it administrative functions,
if it's HR files, things like that. And then
in that same vein, we're also more increasingly
using micro segmentation within a network. So
micro segmentation is making sure that each department
really has a specific segment of the network.
So HR will have different a different section
of the network than finance and they'll have
a different section of the network than R &D
and so on and so forth. So that means that you
only have access to what you need access and
we call that the principle of life privilege.
So you're only going to have access to what you
actually need to access. Yeah, I'm going to move
a little bit forward in an or like higher level
in this conversation. We talk a lot or are excited
about AI. So I'd love to talk a little bit about
what the changes in AI and all these new amazing
tools, how they're sort of helping with that
attack and defend from your point of view. Yeah.
So attackers are definitely using AI. Well, we're
definitely using AI on both sides of the battle.
Attackers are using it more to create more believable
phishing emails. So that old adage of, you know,
if there's typos, then it's definitely a scam.
That doesn't really apply anymore because a generative
AI is much more able to create more believable
phishing emails. Not just with grammatical errors,
but also AIs to scan social media to see how
what someone's communication habits are. And,
you know, it's more able to recreate or copy
someone's communication style and specifically,
you know, what types of words they use, what
types of punctuation they use, things like that.
And then AI is also being used to automate parts
of the attack chain, so it's able to deploy and
send out phishing emails at a much greater speed.
And then on the defense side, we're also leveraging
AI to do more real -time threat detection. So
AI is much quicker at analyzing huge amounts
of data than any human analyst or any group of
human analysts would be able to do. And then
we're also able to automate responses. So things
like quarantining an infected endpoint, before
the ransomware can spread. Things like that are,
are how we're utilizing AI, but it's definitely
changing and it's changing fast. I just saw something
this morning. One of the new AI models has, is
much better at creating the deep fake technology.
It's, it's AI actor type. It's, you know, it's
an AI actor where, you know, me on a webcam,
it's going to change my face. It's going to change
my body. And up until recently. our defense,
our recommendation for defending against deep
fake interviews like that would be, you know,
have the, have, have the interviewee stand up,
have them wave their hand in front of the camera,
because previously AIs would be able, you know,
you'd be able to spot a little bit of blurriness
in the eyes, you know, the hand might move weird,
but this new, new developments in AI are making
that much more believable. It kind of tricked
me out this morning, seeing this, this AI actor
and it was, it was really good. Yeah. You know,
it's, and it's getting better. So it's moving
fast. So it, it is, it is a little bit unsettling
if I'm being honest, but it's also, it's also
true that As AI continues to develop on the attacker
side, we're continuing to develop AI on the defense
side. You know, using AI tools could conduct
live scanning of an interview today. Hey, you
know, this is unlikely to be an AI actor, an
AI generated video, things like that. So it's
developing fast, but on both sides. Yes. I've
heard some IT professionals that I work with
who To combat some of that stuff. They almost
to go backward in technology for example They
will just have like a code word that they will
use and they'll be just say the code word You
know because yeah, even some of that simplified
ideas or technology Kind of works. I mean, I
don't know if you have anything like that that
you do or that you could think of No, definitely
that that that subject actually came up with
in our team recently and, and it feels so, it
feels so like 1950s spy movie, like what's the
secret password, you know, what's the, what's
the, but it's, it really is kind of the, the
way that it's one of the best ways that we can
defend against it right now is, is that your
team has a daily or weekly code word and you
have to start a meeting with this code word or
you start an interview with that specific passphrase
or, you know, things like that or. So it definitely
feels that way. It definitely feels like we're
going back a little bit, but it's kind of nice
in a way in that like one of the recommendations
that I have now is if you don't trust whether
or not a message coming to you is legitimate,
one of the best ways to verify that is to see
the person in person. So it kind of bringing
us back to an in -person and a more human connection
than we had before. So there is a bright side,
there is a silver light. However, however, I
don't know, however, however, I don't know, campy
or silly it may feel to have that task phrase.
It really is effective. Yeah, it did. Yeah, it
for sure is. That's so funny. So to close out,
I'd love to talk a little bit because we like
to give advice on this podcast to make sure that
businesses have some action steps. Are there
any kind of practical? everyday steps that businesses
can easily do right now to risk being targeted
or to just kind of improve that defense of their
security? Yeah, I wouldn't say that there's anything
that businesses could do to reduce the target.
It's kind of a theory, not a theory, it's kind
of a philosophy within cybersecurity that it's
not a matter of if you get attacked, it's more
a matter of when. So the best strategy that you
can have is great defense. So making sure that
you focus on resilience. So that means, firstly,
implementing a robust and regularly tested backup
strategy and recovery plan, that's going to be
huge. So making sure that your critical files
or your entire network is backed up. and able
to be restored as quickly as possible and that
you regularly test it to make sure that it's
effective. That's huge. And then there's also
the 3 -2 -1 rule. So the 3 -2 -1 rule advises
you to maintain three copies of your data and
store those copies on two different types of
media and keep at least one of those copies on
an off -site location. So that just helps to
ensure that, you know, your backups remain secure,
because that's going to be one of the first things
that ransomware attackers will target, is your
backup strategy. So to make sure that you're
not able to restore from that. Second, enforce
multi -factor authentication on all critical
accounts. Really all accounts possible. Personal,
professional, multi -factor authentication is
going to be huge. There are still some ways around
it, but it's not, it's still one of the best
ways to make sure that your critical account
stays secure. And then the biggest thing for
me, I'm always going to be an advocate for this,
is conduct regular employee cybersecurity training.
Cybersecurity awareness is huge. Human error
and through things like phishing attacks, even
something as simple as misplacing your work device,
the human vector is the primary attack vector.
That's why social engineering is such a huge
thing. conducting regular cybersecurity awareness
training to make sure that everybody knows what
to look out for. That's going to be huge. And
I feel like that there's a lot of development
and there's a lot of progress that can be made
in the security awareness realm. Traditionally,
you might see once a year, cybersecurity awareness
training or even one cybersecurity awareness
training at your onboarding and you know, that's
it. And it covers the basics of like, this is
what a phishing email looks like. This is how
to set a strong password. These are safe browsing
techniques, but I think that security awareness
training needs to evolve to where we're sharing
with all employees at all levels. These are the
threads that are on the landscape. This is how
it affects the business. This is how it affects
you in your personal life. And this is how these
are ways that you can protect yourself. And that's,
that's one of the things is it's with the advancement
of remote work and with cloud infrastructure
and just how vast the landscape, the attack landscape
is. It means that a cyber security attack does
not only affect a business. It can also affect
your personal life as well. So like my friend
who ran her business and was unable to process
payment for her employees, that affected a whole
bunch of people. And it was strictly a business
attack and it didn't even happen to her practice.
So that's huge. Definitely a security awareness.
I like that you kind of wrapped it back around
to that communication too and that training and
that human element is huge. As we close out here,
I want to give you an opportunity to share anything
else that you didn't get to. And then I'd love
to close out with sort of what 2026 or what five
years from now, maybe what 10 years from now,
this ransomware as a service is going to start
looking like. Yeah, definitely. I think that
ransomware as a service on the defender side,
it's going to look the same. It's going to look
like attacks. They might be more organized. On
the defender side, like the ransomware, it's
gone beyond just a simple ransom note on your
device that says, ha ha, we've locked all your
files. Send this many Bitcoin to this wallet
or else. You know, and it, it gotten much more
advanced where now they have dark web websites
where they'll point you to, and you'll be able
to chat live with a representative from the ransomware
as a service operator to say, to even negotiate,
to, to ask for more time. You know, there's a
whole customer service or victim service, I guess.
There's a, there's a whole service operations
line there. And then one of the bigger trends
that I feel like businesses should look out for,
there's an increase in what we call double extortion
attacks. So criminals are not only encrypting
data and demanding ransom, they're also stealing
that data so that if the ransom is not paid,
now they're threatening to release the data publicly,
you know, cause more reputational harm or just
sell the data in the first place, which will
lead to further ransomware attacks or further
cyber attacks. Double extortion, it made tougher
because of how quickly technology is advancing
and particularly internet speed. Because the
internet is so fast, because we have 5G and the
speed of the internet is evolving quickly, that
means that they're able to steal larger amounts
of data much faster. And devices are able to
encrypt data much faster than before. I think
we remember an hour or... is to have to leave
a download overnight. So that download one music
video, you know, I don't, I might be aging myself,
but yeah, it's so much faster now. You can download
a block of data in a blink of an eye with these
internet speed. So this makes double extortion
that much more threatening where they can, they
don't even need to send through the company data
to find the key important stuff. They can just
say, Hey, I'm going to take this whole block
and I'm going to do it later. You know, so that's
definitely a big, a big threat to deal with.
So that's where, that's where initially defending
yourself to begin with, you know, keeping that
human attack vector, making sure your employees
are trained to spot these things so that to stop
the ransomware attack in the first place. That's
going to be huge. Yeah, for sure. Anything else
that we didn't cover that you would like to share?
You know, I'd say. Looking forward, the best
piece of advice I could give is to treat cybersecurity
as a core business function and a strategic investment.
It's not an IT expense. It's not something that
you have that good budget and try and find the
chief provider. I mean, of course you're going
to want to find the most or works best for your
revenue for those numbers. But the key is treating
it as a core business function and not just an
arm of the IT department. So making sure that
treated as something important to the business,
as something that's core to the business, that's
investing in ongoing employee training, conducting
regular tabletop exercises, test the risk bond.
And then like we said, ensuring that your data
backups are strong and that they are functioning
as they should be. That's going to be... huge
for your defense. And then yeah, just building
that culture of cybersecurity. That's, that's
huge. You know, by investing in cybersecurity
awareness screening for all your employees, by
ensuring that that open communication path is
there for people to report something that's a
little fishy or something that's a little off
on their device or, or what have you, that's
going to build a stronger culture of cybersecurity
where people are watching out now. And, and that
just makes it that much harder for for an attack
to take place. This is a great way to start Cybersecurity
Awareness Month, but it's not just a month. It's
all year and it should be integrated into all
pieces of your business. So we love it. Thank
you so much for joining us today. I really appreciate
it. Of course, thank you so much for having me.
I really enjoy it. Thank you for joining us today.
If you enjoyed this topic, please let us know.
Like, subscribe, or reach out to us at info at
cit -net .com or head out to our website cit
-net .com slash podcast. We'll be back next week
with an all new episode.