Fireside chat: The tortured "cybersecurity" poets department

Fireside chat: The tortured "cybersecurity" poets department

Speakers: Jeannette Jarvis (Chief Business Officer, Cyber Threat Alliance); Kathi Whitbey (Palo Alto Networks Unit 42); Jeanette Miller (Chief Cyber Intelligence Officer, Dataminr); Selena Larson (Staff Researcher, Proofpoint)

Conference: Virus Bulletin

YouTube: https://www.youtube.com/watch?v=mSIVFIMovYY

Overview

This engaging panel discussion, titled "Fireside chat: The tortured 'cybersecurity' poets department," delved into critical challenges facing the cybersecurity industry, guided by the lyrical themes of Taylor Swift songs. Featuring prominent female leaders—Selena Larson (Proofpoint), Jeannette Jarvis (Cyber Threat Alliance), and Jeanette Miller Osborne (Dataminr), with Kathi Whitbey (Palo Alto Networks Unit 42) originally slated to join—the session offered a candid and often impassioned examination of the human element in cybersecurity, the evolving threat landscape, and systemic issues hindering effective defense.

The panelists explored topics ranging from the pervasive rise of sophisticated social engineering tactics amplified by artificial intelligence, to the overwhelming volume of software vulnerabilities, and the societal desensitization to cybercrime. They passionately advocated for a fundamental shift in industry priorities, emphasizing "secure by design" principles, greater accountability for vendors, and a move away from purely profit-driven security decisions towards a recognition of cybersecurity as a societal good. The discussion culminated in a call for enhanced public-private collaboration to impose tangible costs on adversaries and create a more secure digital ecosystem for everyone.

Background

▶ Watch: Panel introduction and Taylor Swift theme (0:00)

The cybersecurity landscape has reached a critical juncture, characterized by an increasingly sophisticated and relentless adversary. Historically, defense strategies have largely focused on technological barriers, assuming that robust firewalls, intrusion detection systems, and advanced endpoint protection would suffice. However, as the panelists highlighted, threat actors have adeptly adapted, shifting their focus from purely exploiting technical vulnerabilities to hacking the human element. This evolution underpins the pervasive challenge of social engineering, where psychological manipulation, rather than technical prowess, becomes the primary vector of attack.

The problem is exacerbated by several systemic issues. Software development, driven by market pressures for speed and new features, often prioritizes rapid deployment over inherent security, leading to a deluge of vulnerabilities. This burden disproportionately affects small and medium businesses, which lack the resources and expertise to manage a constant stream of patches and updates. Furthermore, the lack of significant legal or financial liability for companies experiencing breaches means that the onus often falls squarely on the end-user, creating a sense of resignation and desensitization to widespread cybercrime. This panel, part of a five-year tradition of using musical themes to explore industry challenges, sought to dissect these issues and propose actionable solutions, emphasizing the human and societal dimensions often overshadowed by purely technical discussions.

Key Findings

▶ Watch: The human cost of cybercrime and lack of accountability (9:50)

The panel's discussion yielded several crucial insights into the current state of cybersecurity and potential paths forward:

• Social Engineering is Evolving and Amplified by AI: Attackers are increasingly sophisticated at exploiting human emotions (fear, excitement, anxiety) rather than just technical flaws. The rise of artificial intelligence (AI) significantly enhances this, enabling the creation of highly believable and personalized lures for phishing, pig butchering scams, and telephone-oriented attack delivery (TOAD). While AI may not be universally adept at complex programming, its proficiency in generating convincing text makes it a potent tool for social engineering at scale.
• Overwhelming Vulnerability Burden: The current pace of software development often neglects secure by design principles, leading to an unsustainable volume of vulnerabilities. One major platform, for example, released over 800 vulnerabilities in a single year, making it impossible for organizations, especially small businesses, to prioritize and address them effectively. This results in continuous compromise and places the liability burden on the end-user.
• Desensitization to Cybercrime and Lack of Consequences: There's a widespread normalization of digital crime, with millions impacted by scams and fraud globally. Unlike physical crime, which elicits immediate societal outrage, digital crime often lacks visible consequences for perpetrators, leading to victim blaming and a sense of helplessness among those affected. The industry's focus on nation-state espionage, while important, often overshadows the immense impact of everyday cybercrime on individuals.
• Misuse of Security Frameworks: Frameworks like MITRE ATT&CK, intended to help defenders prioritize and understand threats, are often misused by marketing departments as mere "checkboxes" or metrics for superficial "perfect scores" rather than practical intelligence applications. This dilutes their effectiveness and misguides security strategies.
• Capitalism vs. Security: A core tension exists between profit-driven business decisions and the fundamental need for robust cybersecurity. Prioritizing cost-cutting and market share over security investments leads to less secure products and environments. The panelists argued for recognizing cybersecurity as a societal good, akin to healthcare or education, requiring significant investment regardless of immediate financial return.
• Urgent Need for AI Safeguards: The rapid, "wild west" development of AI lacks sufficient safeguards, creating new attack surfaces and exploitation opportunities in both cyberspace and the physical world ("meat space"). The absence of ethical considerations and built-in protections mirrors early challenges seen with cloud adoption, risking a similar period of widespread vulnerability.
• Collective Action and Imposing Costs: The ultimate endgame is to impose significant costs on adversaries, making cybercrime prohibitively expensive or dangerous. This requires robust public-private partnerships, intelligence sharing (e.g., through organizations like the Cyber Threat Alliance), and proactive security investments to "price out" criminal actors.

Technical Deep Dive

▶ Watch: Shifting from capitalism to societal good in cybersecurity (17:20)

The panel, while not presenting specific code or architecture, engaged in a detailed discussion of technical trends and challenges, particularly focusing on their implications for defense and the human element.

A primary technical concern articulated by the panelists was the advanced evolution of social engineering. Selena Larson highlighted examples such as ClickFix, where users are manipulated into self-infecting their systems by following malicious instructions, and Telephone-Oriented Attack Delivery (TOAD), where attackers pose as IT support over the phone to gain access. The discussion also touched upon sophisticated financial scams like pig butchering, which prey on emotions and build long-term trust before defrauding victims. The technical aspect here lies not in exploiting software flaws, but in the sophisticated psychological profiling and communication techniques used by adversaries, often leveraging publicly available information to craft highly personalized and convincing lures.

The emergence of Artificial Intelligence (AI) was identified as a significant technical accelerant for these social engineering tactics. While one prior talk mentioned AI's limitations in complex programming (except perhaps with Python), the panelists emphasized its strength in generating believable text and creating sophisticated lures. Jeannette Jarvis noted concerns about AI eroding critical thinking skills, citing instances of students relying entirely on AI for academic work without validation. Jeanette Miller Osborne added that AI-generated business communications often contain "hallucinated stats" or irrelevant information pulled from obscure vendors, which, while appearing legitimate to the untrained eye, immediately reveal their unreliability to industry professionals. The ease of generating deepfakes using AI was also highlighted as a growing technical threat, making it simpler to manipulate individuals through convincing, yet fabricated, audio and video.

Another critical technical challenge discussed was the overwhelming volume of software vulnerabilities. The panelists pointed to a staggering statistic: one major software platform released over 800 vulnerabilities in a single year. This sheer number makes effective patching and prioritization technically unfeasible for many organizations, particularly small and medium-sized businesses that lack dedicated security teams and advanced vulnerability management tools. The underlying technical problem here is a lack of secure by design principles in software development, where speed to market and feature delivery often overshadow rigorous security testing and integration from the outset. The cost of addressing these vulnerabilities post-deployment is exponentially higher than building security in from the start, leading to a perpetual state of technical debt and exposure.

The misuse of the MITRE ATT&CK framework was also brought up as a technical misapplication. Jeanette Miller Osborne passionately explained that ATT&CK was designed to help defenders prioritize specific T-codes (tactics and techniques) relevant to the threats they face, allowing for targeted and effective defense. However, marketing departments often treat it as a checklist, aiming for "perfect scores" by claiming detection across the broadest possible range of T-codes, regardless of their actual relevance or the efficacy of the defense. This technical misinterpretation undermines the framework's intended purpose, diverting resources and focus from truly impactful defensive measures. The panelists advocated for a more nuanced, threat-informed application of ATT&CK, focusing on the specific use cases and attacker perspectives to guide defensive priorities.

Finally, the discussion touched on the technical implications of developing AI safeguards. The current environment was likened to the "wild west," where AI development is rapidly outpacing the implementation of ethical guidelines and security protections. The panelists drew parallels to the early days of cloud computing, where widespread adoption occurred before robust security architectures (like Endpoint Detection and Response - EDR for cloud workloads) were mature, leading to a period of increased exploitation. The technical challenge now is to proactively embed safeguards into AI models to prevent their misuse in generating malicious content (e.g., AI-written phishing emails) and to mitigate risks like the dissemination of harmful information, as evidenced by class-action lawsuits against AI companies for providing self-harm-related content. This calls for a fundamental shift in technical development practices to prioritize ethical considerations and built-in security from the ground up, rather than as an afterthought.

Demo / Proof of Concept

▶ Watch: Need for safeguards and ethical mindset in AI development (19:30)

As this was a panel discussion focused on current industry challenges, trends, and future aspirations, there was no live demonstration or proof of concept presented. The panelists engaged in a robust verbal exchange of ideas and observations based on their extensive experience in the cybersecurity field.

Defensive Implications

▶ Watch: Cyber Threat Alliance's role in collective defense (25:20)

The insights from this panel offer several critical defensive implications for organizations and individuals alike:

• Prioritize Human-Centric Defenses: Recognize that social engineering is now a primary attack vector. Defenses must extend beyond technology to include robust security awareness training that focuses on psychological manipulation, emotional triggers, and recognizing evolving scam techniques like pig butchering and TOAD attacks. Regular, interactive training is crucial to inoculate employees against sophisticated lures.
• Embrace "Secure by Design" Principles: Organizations must demand that software vendors prioritize security from the initial design phase, rather than treating it as an afterthought. For internal development, adopt a shift-left security approach, integrating security controls and testing throughout the entire Software Development Life Cycle (SDLC). This will significantly reduce the overwhelming volume of vulnerabilities that defenders currently face.
• Strategic Use of MITRE ATT&CK: Move beyond using MITRE ATT&CK as a simple compliance or marketing checklist. Instead, leverage it as a practical threat intelligence framework to identify and prioritize specific tactics, techniques, and procedures (TTPs) most relevant to your organization's threat landscape. Focus on implementing robust defenses against the most impactful T-codes rather than aiming for broad, superficial coverage.
• Verify AI-Generated Content Critically: Be inherently suspicious of information generated by AI, especially in critical business communications or intelligence reports. Always perform independent verification of facts, figures, and statistics to guard against AI hallucinations and misleading information. Implement policies for responsible AI use within the organization.
• Advocate for Vendor Accountability and Liability Reform: Support initiatives that shift liability for data breaches and insecure software from the end-user to the software vendor. As consumers and enterprises, demand higher security standards from products and services. This systemic change will incentivize vendors to invest more in upfront security.
• Foster Public-Private Partnerships: Actively participate in intelligence sharing initiatives and collaborative defense efforts, such as those facilitated by the Cyber Threat Alliance (CTA) or sector-specific organizations like FS-ISAC. Sharing threat intelligence in real-time or near real-time enables collective defense, increases situational awareness, and helps to impose costs on adversaries.
• Invest in Proactive Adversary Cost Imposition: Defenders should focus on strategies that make cybercrime less profitable and more dangerous for adversaries. This includes:
• Improving infrastructure security: Making it harder and more expensive for threat actors to establish and maintain their operational infrastructure.
• Collaborating with the financial industry: Working with banks and financial institutions to trace and claw back funds stolen through cybercrime, thereby hitting adversaries where it hurts most – their profits.
• Supporting law enforcement efforts: Reporting incidents thoroughly and providing actionable intelligence to help law enforcement disrupt criminal operations and bring perpetrators to justice.
• Demand and Implement AI Safeguards: As AI becomes more pervasive, advocate for and integrate robust ethical and security safeguards into its development and deployment. This includes technical controls to prevent the generation of malicious content, as well as policy frameworks to ensure responsible AI use, mitigating risks in both digital and physical realms.

Key Takeaways

• Social engineering, amplified by AI, is the dominant attack vector: Attackers are increasingly "hacking brains" through sophisticated lures, making human-centric defenses and awareness critical.
• The volume of software vulnerabilities is unsustainable: A lack of "secure by design" principles leads to an overwhelming number of flaws, placing undue burden and liability on end-users and small businesses.
• Cybercrime normalization demands a societal response: The widespread desensitization to digital fraud and scams, coupled with a lack of consequences for perpetrators, highlights the urgent need for collective action beyond just nation-state threat focus.
• Rethink security as a societal good, not just a business cost: Prioritizing profit over security fundamentally weakens defenses; a mindset shift is needed to invest in cybersecurity as a core societal benefit.
• Leverage frameworks like MITRE ATT&CK strategically: Avoid superficial "checkbox" approaches and instead use intelligence frameworks to prioritize defenses against actual, relevant threats.
• Impose tangible costs on adversaries through collaboration: Public-private partnerships, intelligence sharing, and financial industry collaboration are essential to disrupt criminal operations and make cybercrime less profitable and more dangerous.

About the Speaker(s)

• Selena Larson is a Staff Researcher at Proofpoint, where her work primarily focuses on cybercrime, particularly analyzing email as an initial access vector. She also dedicates time to senior cyber education, raising awareness about scams and fraud.
• Jeannette Jarvis serves as the Chief Business Officer at the Cyber Threat Alliance (CTA). In this role, she oversees recruitment of partners and membership, marketing communications, and general business operations, working to foster a trusted community for real-time threat intelligence sharing.
• Jeanette Miller Osborne is the Chief Cyber Intelligence Officer at Dataminr. Her current focus is on highlighting Dataminr's extensive cyber threat intelligence capabilities and integrating them into product development, including for penetration testing.
• Kathi Whitbey (Palo Alto Networks Unit 42) was originally scheduled to join the panel but was unable to attend due to travel challenges.