When Borders Blur and Breaches Escalate

When Borders Blur and Breaches Escalate

Speakers: Tim Ehrhart (CISO, Roche), Dimitri van Zantvliet (CISO, NS (Dutch Railways)), Priya Mouli (CISO, Sheridan College), William Lin (Founder & CEO, AKA Identity), Alex Levinson (CISO, Scale AI)

Conference: Black Hat MEA

YouTube: https://www.youtube.com/watch?v=TVMNMtSKH3s

Overview

In an increasingly interconnected world, the lines between nation-state aggression, organized cybercrime, and geopolitical objectives have become dangerously blurred. This panel discussion at Black Hat MEA, moderated by William Lin, brought together a distinguished group of global CISOs to dissect the multifaceted challenges of cross-border threats, risks, and dynamics that demand a renewed focus from security leaders. The conversation underscored a critical shift in the cybersecurity landscape: from isolated, financially motivated attacks to systemic, weaponized campaigns targeting critical infrastructure and supply chains, often with state-sponsored backing.

The esteemed panelists – Tim Ehrhart from Roche, Dimitri van Zantvliet from NS (Dutch Railways), Priya Mouli from Sheridan College, and Alex Levinson from Scale AI – offered diverse perspectives shaped by their unique organizational contexts, ranging from global healthcare and national railway infrastructure to higher education and cutting-edge AI. Their collective insights highlighted the profound impact of globalization, geopolitical tensions, and the rapid evolution of threat actor methodologies on enterprise security. The discussion emphasized that understanding and defending against these complex, often covert, threats requires not just technical prowess but also strategic foresight, adaptive response mechanisms, and a deep appreciation for the interwoven nature of global digital ecosystems.

This article delves into the key themes explored by the CISOs, examining the evolving nature of cyber warfare, the perilous implications for critical infrastructure, and the strategic imperatives for building robust, resilient defenses in an era where geographic and digital borders are increasingly indistinguishable. From the weaponization of supply chains to the critical role of counter-intelligence, the panel provided a sobering yet actionable roadmap for navigating the escalating complexities of global cyber risk.

Background

▶ Watch: Introduction to panel and global CISO perspectives (0:00)

The traditional understanding of cyber threats, often compartmentalized into categories like financially motivated crime, hacktivism, or nation-state espionage, has been fundamentally challenged in recent years. Historically, cyber incidents might have focused on isolated breaches or data theft, with clear distinctions between the motives and capabilities of different threat actors. However, as Priya Mouli articulated, cyber security has evolved into a strategic field, where exploits are leveraged for competitive advantage or significant political gain, moving beyond mere financial incentives. This evolution has been paralleled by a corresponding shift in threat actor tactics.

The proliferation of digital technologies, the globalized nature of modern enterprises, and the pervasive reliance on complex supply chains have created fertile ground for systemic risks. Organizations, almost universally operating as "Microsoft shops" or similar, are deeply intertwined with vendors headquartered across the globe, inherently extending their attack surface. Furthermore, the rise of Artificial Intelligence (AI) has dramatically accelerated influence operations, disinformation campaigns, and sophisticated social engineering tactics like deepfakes, eroding digital trust and transforming the internet into a geopolitical battlefield. This context necessitates a rethinking of fundamental security strategies, particularly concerning identity verification and incident response.

Perhaps one of the most significant shifts highlighted by the panel is the blurring of lines between nation-state actors and criminal ecosystems. What often appears as a commercial ransomware attack, perhaps attributed to groups like Lapsus$ or Scattered Spider, can, in fact, be a proxy operation sponsored by a nation-state to achieve geopolitical objectives. Priya cited that over 50% of recent ransomware incidents are now attributed to nation-state actors, underscoring the strategic weaponization of cybercrime. This complex web of attribution, combined with the emergence of initial access brokers who sell compromised system access on underground markets, means that even a seemingly minor breach can quickly escalate into a far larger, more strategic threat. The panel stressed that this new reality demands a holistic, globally aware approach to cyber defense, moving beyond siloed national perspectives to embrace the inherent interconnectedness of global risk.

Key Findings

▶ Watch: Dimitri on cross-border malware impacting critical infrastructure (6:30)

The panel discussion illuminated several critical findings concerning the state of global cybersecurity:

• Weaponization of Supply Chains and Critical Infrastructure: Priya Mouli highlighted the dramatic increase in the weaponization of supply chains and critical infrastructure. Attacks are no longer isolated but aim to cause systemic risk, potentially crippling economies. This includes targeting utilities, telecommunications, and Operational Technology (OT) environments, with motives shifting towards geopolitical impact rather than just financial gain.
• AI-Accelerated Threats: The rapid advancement of AI is fueling a new generation of threats, including AI-accelerated influence and disinformation campaigns, deepfakes, and highly sophisticated social engineering scams. These tactics are eroding digital trust and turning the digital realm into a geopolitical battleground, necessitating a re-evaluation of identity verification and incident response strategies.
• Blurred Lines Between Nation-States and Criminals: A significant observation was the increasing overlap between nation-state objectives and criminal activities. Over 50% of recent ransomware incidents are now attributed to nation-state actors who are leveraging criminal proxies, such as Lapsus$ or Scattered Spider, to achieve geopolitical aims. This makes attribution incredibly complex and emphasizes the need to treat all breaches seriously, as even a seemingly commercial attack could have state-sponsored origins.
• Initial Access Brokers Elevate Risk: Tim Ehrhart noted that the rise of initial access brokers means that any single compromise, even a basic piece of malware on a laptop, can be bought and resold, potentially leading to far larger and more devastating breaches. This fundamentally changes how organizations must view and respond to seemingly minor incidents.
• Cross-Border Spillover and Infrastructure Targeting: Dimitri van Zantvliet provided a compelling example from Dutch Railways, detailing how malware initially targeting Belarusian railways during the Ukraine conflict (e.g., Indestroyer 2) could be repurposed and reused globally due to the limited number of critical equipment providers in the railway sector. This demonstrates how geopolitical events in one region can have direct, tangible impacts on critical infrastructure in unrelated countries.
• Fourth-Party Risk is Critical: The Dutch Railways CISO also underscored the severity of fourth-party risk, recounting a major breach where 800,000 travelers' data was sold on the dark web, caused not by a direct supplier but by a supplier's supplier. This highlights the deep and often unmanaged dependencies within complex supply chains.
• Resilience of Critical Infrastructure as a Business Enabler: Alex Levinson emphasized that the resiliency of a region's critical infrastructure (like telecoms) is a prerequisite for doing business there securely. He noted the Middle East as a region actively focusing on this, recognizing that a weak foundational infrastructure compromises the security of any business operating within it.
• Counter-Intelligence as a First-Class Citizen: Levinson advocated for treating counter-intelligence as a core component of a security program. This involves actively monitoring the "underworld of cybercrime" through communities and platforms like Discord to understand emerging threats and tactics before they become widespread, enabling proactive mitigation.
• The Global Enterprise Perspective: Tim Ehrhart articulated that for truly global organizations like Roche, the concept of "safe" vs. "dangerous" countries is moot; the entire world is a risky environment. Geopolitics for such entities often translates into legal and regulatory burdens, such as data residency requirements or pressure to use domestic services, which add significant operational complexity.
• Adaptive, Tactical Response: Alex Levinson championed an adaptive, tactical approach to threat mitigation over rigid, long-term plans. The rapidly changing global threat landscape demands swift action, immediate mitigation, and continuous detection rather than waiting for multi-month strategic rollouts.
• People, Process, Technology Framework for Resilience: Priya Mouli reinforced the enduring relevance of the People, Process, Technology framework. This includes fostering foundational cyber security skills and risk savviness among personnel, rigorous scenario planning and incident response testing (tabletop exercises, live drills, backup restoration), and strategic technology choices (e.g., considering "best of suite" solutions for better integration).

Technical Deep Dive

▶ Watch: Alex on regional critical infrastructure resiliency challenges (9:45)

While a panel discussion, several technical aspects and strategic approaches to managing them were discussed. The core technical challenges revolve around the sophistication of modern attacks and the complexities of global digital infrastructure.

The weaponization of OT environments was a significant technical concern. Dimitri van Zantvliet specifically mentioned the Indestroyer 2 malware, which was used against Belarusian railways. This malware is described as a "Swiss pocket knife" of solutions designed to breach railway operations, including signaling systems and other critical infrastructure components. The technical implication here is that such sophisticated malware, once developed, can be easily reused against other targets, especially given the limited number of global equipment providers (only a dozen) for railway systems. This highlights a critical vulnerability: a single point of failure or compromise in a vendor's product can have global repercussions across an entire industry sector.

The role of AI in accelerating threats also has profound technical implications. Deepfakes and advanced social engineering scams leverage AI to create highly convincing, personalized attacks that can bypass traditional security awareness training. This necessitates a technical re-evaluation of identity verification mechanisms, potentially moving towards multi-modal authentication and advanced behavioral analytics to detect AI-generated deception. The sheer volume of disinformation and misinformation campaigns also poses a technical challenge in filtering and verifying information at scale, impacting trust in digital communications.

The rise of initial access brokers represents a technical arbitrage in the cybercrime ecosystem. These brokers exploit vulnerabilities or misconfigurations to gain initial footholds into networks, which are then sold to other threat actors, including ransomware gangs or nation-state proxies. This means that even a seemingly unsophisticated attack, like a basic malware infection, can provide the entry point for a more advanced, targeted breach. Technically, this requires robust endpoint detection and response (EDR), continuous vulnerability management, and proactive threat hunting to identify and neutralize these initial access points before they are leveraged for larger campaigns.

Managing third- and fourth-party risk involves significant technical controls. Dimitri van Zantvliet detailed Dutch Railways' approach, which includes enforcing adherence to recognized security standards like ISO 27001 and SOC 2 Type 2 for all suppliers. These standards mandate specific technical and organizational controls for information security management. The incident where 800,000 travelers' data was compromised due to a provider of a provider underscores the technical challenge of gaining visibility and control over an extended supply chain. Implementing robust supply chain risk management (SCRM) technically means integrating security requirements into contracts, conducting regular security assessments, and establishing clear breach notification protocols. The NIST 2 regulation in Europe further mandates end-users to control their supply chain security, pushing for greater technical oversight.

From a defensive technology perspective, Priya Mouli discussed the trade-offs between "best of breed" and "best of suite" security solutions. Best of breed involves selecting the top-performing product for each specific security function (e.g., a particular firewall vendor), potentially leading to a fragmented security architecture. Best of suite advocates for consolidating security tools under a single vendor ecosystem, which can offer better integration, simplified management, and improved correlation of security events, making it easier for analysts to "connect the dots" during an incident. This technical decision impacts the efficiency of security operations and overall threat visibility.

Alex Levinson's emphasis on counter-intelligence also has technical underpinnings. Actively monitoring underground forums, hacker communities (like Discord channels), and dark web markets allows security teams to gather real-time intelligence on emerging tactics, techniques, and procedures (TTPs). This proactive intelligence gathering enables organizations to implement specific technical controls and detections to mitigate threats before they become mainstream. For example, understanding new ransomware methodologies from these sources can inform the rapid deployment of specific signatures, behavioral detections, or network segmentation strategies. This tactical approach prioritizes immediate mitigation and detection capabilities over lengthy strategic planning.

Finally, the focus on backup and restoration testing is a fundamental technical control for resilience. Priya stressed that in a crisis, the ability to quickly restore operations depends entirely on the reliability and speed of backup systems. This requires not just performing backups but also regularly testing their integrity and the restoration process itself, ensuring data recovery capabilities are robust and functional when needed.

Demo / Proof of Concept

▶ Watch: Alex's tactical counter-intelligence approach for threat detection (17:30)

This panel discussion focused on strategic insights and high-level challenges in global cybersecurity, rather than demonstrating specific tools or proof-of-concept exploits. Therefore, no live demo or technical proof of concept was presented during the talk.

Defensive Implications

▶ Watch: Priya's P-P-T framework for long-term cyber resilience (29:00)

The panel's insights offer a comprehensive roadmap for defenders navigating the complex global threat landscape:

1. Elevate Supply Chain and Fourth-Party Risk Management: Given the weaponization of supply chains and the demonstrated impact of fourth-party risk, organizations must double down on their supply chain risk management (SCRM) programs. This includes rigorous due diligence for all critical third parties, extending to their own sub-contractors. Implementing periodic security assessments, enforcing adherence to standards like ISO 27001 and SOC 2 Type 2, and establishing clear escalation protocols and breach notification procedures are paramount. The NIST 2 regulation serves as a strong impetus for European entities to strengthen this oversight.
2. Adopt a "Treat All Breaches Seriously" Mindset: The blurring lines between nation-state actors and criminal proxies, coupled with the prevalence of initial access brokers, means that even seemingly minor incidents cannot be dismissed. Every breach, regardless of apparent sophistication, must be investigated swiftly and thoroughly, as it could be a precursor to a much larger, more destructive attack.
3. Invest in Counter-Intelligence and Proactive Threat Monitoring: Alex Levinson's emphasis on counter-intelligence as a first-class citizen is critical. Defenders should actively engage in communities, forums, and intelligence-sharing platforms (including less conventional ones like Discord) to gain real-time insights into emerging threat actor TTPs. This allows for proactive implementation of detection and mitigation strategies, staying "left of bang" or at least swiftly "right of bang."
4. Strengthen Critical Infrastructure Resilience: For organizations operating OT environments or relying heavily on global infrastructure, building intrinsic resilience is non-negotiable. This involves understanding the unique attack vectors for systems like railway signaling (e.g., Indestroyer 2), diversifying critical vendors to mitigate concentration risk, and actively participating in regional and national efforts to secure foundational services like telecommunications.
5. Re-evaluate Identity and Verification Strategies in the AI Era: With the rise of AI-accelerated influence, deepfakes, and sophisticated social engineering, traditional identity verification methods are increasingly vulnerable. Defenders must explore advanced authentication mechanisms, behavioral analytics, and robust frameworks to combat the erosion of digital trust and verify identities in an environment rife with synthetic deception.
6. Embrace Adaptive, Tactical Incident Response: Rigid, long-term security plans may be insufficient in a rapidly evolving threat landscape. Security teams must cultivate an adaptive, tactical posture, capable of swiftly identifying new threats, implementing immediate mitigations, and continuously refining detections. This demands agility, empowered teams, and a willingness to prioritize "priority zero" issues over lengthy strategic roadmaps.
7. Prioritize Scenario Planning and Resiliency Testing: Priya Mouli underscored the importance of comprehensive scenario planning and rigorous testing of incident response and business continuity plans. This includes not just tabletop exercises but also live drills and, crucially, consistent backup and restoration testing. Knowing "when, not if" a crisis will strike means preparedness, reflected in the ability to quickly bounce back, is paramount.
8. Optimize Security Technology Stacks: The "tools sprawl" in many organizations necessitates a strategic approach to security technology. Evaluating the benefits of "best of breed" versus "best of suite" solutions can lead to better integration, simplified management, and improved analytical capabilities for security operations center (SOC) analysts, enhancing overall threat detection and response.
9. Address Geopolitical and Regulatory Burdens: For global enterprises, geopolitical shifts directly translate into legal and regulatory challenges, such as data residency requirements and pressure to source technology domestically. CISOs must proactively engage with legal and compliance teams to understand and adapt to these evolving frameworks, which can significantly impact architectural decisions and operational complexity.
10. Focus on People and Culture: Beyond technology and process, the "People" aspect of the People, Process, Technology framework remains foundational. Investing in foundational cybersecurity skill sets, fostering risk savviness, and actively managing burnout and fatigue among security teams are crucial for maintaining an effective defense.

Key Takeaways

• Cyber Threats are Geopolitical Weapons: The lines between nation-state actors and cybercriminals are deeply blurred, with over 50% of ransomware attacks now attributed to state-sponsored proxies, shifting the motive from financial gain to strategic geopolitical objectives.
• Supply Chains and Critical Infrastructure are Prime Targets: The weaponization of supply chains and OT environments (e.g., Indestroyer 2 targeting railways) is a systemic risk, demanding rigorous fourth-party risk management and a global perspective on infrastructure resilience.
• AI Accelerates Deception and Erosion of Trust: Deepfakes, disinformation, and advanced social engineering fueled by AI are eroding digital trust, necessitating a fundamental rethink of identity verification and incident response strategies.
• Proactive Intelligence is Paramount: Treating counter-intelligence as a core function, actively monitoring the "underworld of cybercrime" through diverse channels (e.g., Discord), enables organizations to anticipate and mitigate emerging threats tactically.
• Resilience Requires Adaptive Measures and Constant Testing: Beyond long-term planning, effective defense demands adaptive, tactical responses to new threats, coupled with continuous scenario planning, live incident response drills, and robust backup and restoration testing to ensure swift recovery.
• Global Context Demands Global Solutions: For truly global organizations, risk is pervasive across all geographies, and geopolitical shifts often manifest as complex legal and regulatory burdens (e.g., data residency), requiring a unified yet adaptable security strategy.

About the Speaker(s)

The panel featured a diverse group of cybersecurity leaders, each bringing unique global experiences and perspectives:

• William Lin (Moderator): Founder & CEO of AKA Identity. William skillfully moderated the discussion, guiding the CISOs through complex topics related to global threats and risk management.
• Tim Ehrhart: CISO at Roche. Tim is noted for having "hacked his way" into his career early on, leading him from Germany to Zurich. His perspective is shaped by leading security for a truly global organization with operations in almost every country, emphasizing that for such entities, the entire world is a risky environment.
• Dimitri van Zantvliet: CISO at NS (Dutch Railways). Known as the "Zen master" for his ability to calmly communicate with executives, Dimitri brings experience from a 200-year-old critical infrastructure company. He shared insights on managing OT environments, the impact of geopolitical malware like Indestroyer 2, and the complexities of fourth-party risk.
• Priya Mouli: CISO at Sheridan College. Priya has an extensive international background, having worked in over six countries across Asia and North America, and consulted for Fortune 500 companies. She provided a framework-driven approach to risk, emphasizing the weaponization of supply chains, AI-accelerated threats, and the blurring lines between nation-state and criminal actors.
• Alex Levinson: CISO at Scale AI. Alex is a seasoned traveler, having spent over 200 days on the road in the past year. His CISO role at a leading AI company gives him a unique perspective on the tactical aspects of combating evolving threats, advocating for counter-intelligence and adaptive, rapid response over long-term strategic plans.