CrowdStrike CTO: 'Rookie mistakes' are hurting cloud security - TechTarget

More than two decades after the advent of the cloud computing era, CrowdStrike still sees too many organizations making too many unforced errors.

Elia Zaitsev, global CTO at CrowdStrike, spoke with TechTarget Editorial at Black Hat USA 2023 earlier this month about recent trends the threat detection vendor has observed so far this year. A common theme was enterprise struggles with cloud security, including misconfigurations, poor development practices and a general lack of knowledge about how to secure hybrid cloud environments.

Zaitsev explained that while cloud providers have designed their services to be simple and easy to use, organizations too often deploy applications or instances that make easy targets for threat actors. And many threat actors, he said, are increasingly looking for simple but effective ways to gain access to networks and make money, whether it’s selling credentials on the dark web or extorting stolen data. Here’s more from the conversation with Zaitsev.

Editor’s note: This Q&A has been edited for clarity and length.

One of the trends that that stood out from CrowdStrike’s 2023 Threat Hunting Report was the increase in identity-based attacks. Why do you think that is happening so much still, to this day, with all the emphasis we put on identity management, securing credentials and multifactor authentication?

Elia Zaitsev

Elia Zaitsev: I like to think about these a lot in terms of military analogies. And just like any other innovation on the battlefield, you find there’s a technique that may not necessarily be new but is very effective. Kerberoasting is a great example. If you if you saw the report, I think we observed almost six times the number of attacks this year [compared with 2022].

Well, here’s the interesting note on Kerberos: It’s not a new thing. It has been around since 2014. It’s not a zero day. It isn’t a bug in the code of Microsoft Active Directory. This is a fundamental issue in the design and architecture, and it has been around since 2014. And this is my original point: The adversaries are now realizing, “Hey, this is incredibly effective.” And once you start seeing something is a little bit effective, you’re going to push on it with both hands and try to move that along. Nothing has changed in regard to the underlying technology — adversaries are just seeing it’s super-effective.

And I’m speculating here, but I think there are some economic motivations to it as well. Credential brokerage services, where you can go online and just purchase credentials en masse, have become a business in and of itself. Think about the adversaries’ motivations. If they’re an e-crime actor and not a nation-state actor, they just care about money at the end of the day. Whatever gets them that payoff and that ROI benefit — how much effort do I put in, versus what I get out — they’re going to do it. They want to maximize that. If all an adversary needs to do now to monetize a penetration against an organization is go get a bunch of legitimate credentials and post them online, then that’s a much quicker, easier thing to do. And it’s also stealthier, by the way, than to burrow deep, move laterally throughout the organization, put backdoors everywhere and steal intellectual property.

Readers Also Like: France heightens security for New Year’s Eve, with 90,000 police officers to be mobilized

But for defenders, what do you think is perpetuating that attack surface on the enterprise side? Why are we collectively not better at defending this?

We spent as an industry so much time and effort focusing on malware, anomaly detection, exploits, et cetera. And we’ve gotten, by some measures, quite effective at preventing that, but sometimes we over-focus. Sometimes we let mastery of one domain lull us into a false sense of security that we’ve solved the problem. I think about half, maybe two thirds of organizations are still relying primarily on legacy antivirus technology. What does antivirus technology have to do with [a threat actor] coming in with legitimate credentials?

At some point, unless you have fully adopted zero-trust technology, you’ve got to trust that if someone says, ‘Hi, I’m Rob, and I have access to this device,’ and they have Rob’s password, then they must be Rob. We still see a lot of kind of old-school techniques that don’t really have a technical fix, like pretending to be someone from IT [support] and asking an employee for their password. That’s not a technical control. That’s a human weakness. That’s social engineering.

And with techniques like Kerberoasting becoming very popular, we see cloud variations of that. Cloud is the new domain for adversaries. It’s the new battle theater that they’re increasingly moving towards. And there are some other identity-based, credential-based techniques that they’re going after in the cloud specifically as well, like looking at secrets that are built into an application, which is a big no-no from a security architecture perspective. But people make mistakes.

There are built-in tools in these cloud service providers that are designed to allow you to manage these environments — inheriting permissions and having metadata APIs built into these systems. And of course, they’re there to make developers’ lives easier. But if not properly secured, the adversary will take advantage of that as well.

I think by and large, cloud service providers are doing a pretty good job of making these technologies fairly secure by design. The issue is many organizations and developers are new to the cloud.

Elia ZaitsevCTO, CloudStrike

CrowdStrike CTO: 'Rookie mistakes' are hurting cloud security – TechTarget

Related posts:

You Might Also Like

Recommended For You