Transcript
1 Welcome to the second episode of Let's Talk Security, where security and strategy meet. I'm Barry Mainz. I'm the CEO of Forescout. And as quantum computing moves from theory to reality, we're approaching a turning point in cybersecurity. One of the biggest risks is this whole notion of harvest now and decrypt later. In this model where the adversaries steal encrypted data today, and they wait for quantum capabilities to break it tomorrow. In post-quantum cryptography, or PQC, it's designed to withstand a certain amount of sort of threat and rigor. But the road to readiness isn't straightforward, especially in environments where encryption risks are hard to see. So this is exactly why I'm being joined here today with two of Forescout's leading experts. Rob McNutt, welcome. He's our chief strategy officer. Thank you for joining. Thank you, Barry. And we also have Daniel Dos Santos. He heads up our research at Vidari Labs within Forescout. Welcome Daniel. Thank you so much for having me, Barry. You're welcome. So we'll break down our research uncovered about the migration to PQC, and kind of what that means to organizations, and what practical steps can security leaders take today? All right. So let me ask a few questions of you two folks here. Maybe Daniel, I'll start with you. Is that okay? Sounds great. So Daniel, our Vidari Labs team has recently found only 6% of all SSH servers support PQC. Can you talk us through why and what this means for security and why we should be concerned about it? Yeah, of course. So it actually means two things depending on how you look at it, right? So if you look at the 6% number, it's greater than zero. It means that the migration has already started. A lot of organizations, a lot of technology providers out there have already started implementing PQC in their devices, in their own organizations, right? But if you look at the other side of it, at the 94% that haven't done that, it means that there is a really, really long road ahead, right? And we're now looking at quantum migration timelines throughout the world that say that traditional or classical encryption will be probably duplicated around 2030 in the next five years or less than five years, right? So that means that the 94% of organizations out there that still have to migrate need to do that somewhat fast. Yeah. And Rob, I'd ask you this, you know, I know you spend a lot of time with customers and in the field. I mean, are we already behind the curve? Yeah. I mean, I think from who I've heard from in specific verticals, mainly the ones who have a large dependency on securing information using current cryptography, things like banking or government communications, anything where there's a need to have the information secured over a middleman, there is a large concern that we're already too late and we really need to move faster to control what the blast radius or what the problems might really become. And, you know, you hear kind of scenarios of what if information has already been harvested and, you know, it's just only months away from being decrypted. And, you know, should we change all of our passwords more frequently because they have already been exposed or, you know, has sensitive information already been leaked? So there is a sort of effort out there to clean up what is already assumed to be compromised. But, you know, it's a it's a long road to go even from 6% to 8%. Like, you know, Daniel kind of found is those moving the needle will take a significant amount of energy in the industry. Yeah. So with that, those are really good points, Rob. So, Daniel, so based on your research and, you know, the evidence you've seen, are attackers already harvesting encrypted data for the future? Yeah, that's that's a great question. That's the real question, right? Like, so we don't we don't have 100% evidence that that has happened, but there's very strong possibility that it is happening. Right. So in the next one, in the past one to two years, we've seen a really big increase in attacks on telecom networks throughout the world. Obviously, everybody knows in the U.S. all the typhoon, the Chinese based APTs and so on. But that has been happening throughout the world as well. Right. And one of the main one of the main goals of this type of attacks on telecom networks is obviously to have an access to to be able to see the traffic of a lot of organizations that's passing through those telecom networks, establish some some persistence there and be able to do espionage. Right. And Harvest Now Decrypt later is the attack that would be deployed by siphoning off some of that encrypted data, storing that somewhere secure so that in the next, as Rob said, months or a couple of years that could be decrypted. Right. So, again, we don't have a case where that was done 100% for sure. But there is very strong evidence that attackers have these capabilities. Yeah. So going back to the comment that you made, Rob, about, hey, we're behind and you know, you've talked to a lot of customers. What's stopping the broader sort of adoption of PQC right now? It's primarily driven by the cost to replace equipment that can't handle modern encryption. Right. If you kind of imagine, you know, we've built a hyperconnected world with things that have been manufactured or built, you know, some some decades ago, it's very costly to patch these things. It's very costly to go in there and rip and replace and do the sort of upgrades that are necessary to get them to be fully compliant. You know, you'll see movement in certain of the more modern types of systems, but you've got a lot of antiquated things like mainframes and just systems out there that have been around and are a core part of some enterprise or government agency that is unpatchable or un-updateable. And, you know, there's a significant amount of cost that comes with trying to just replace it and go to plan B. And in some scenarios, there aren't solutions ready yet that are quantum safe. Yeah. And then you talk about the cost. And I think, Daniel, you made a point in one of the research papers that you did, which is there was a pretty fast uptick and then it sort of dropped down in terms of the protection. I mean, what's your what's your thought? What's behind that? Yeah, this is this is something common with probably all new technology, right? Whenever there's a problem to or there's a cost to replace, as Rob said, where the early adopters, those that can patch, those that can upgrade quickly, they they do so quickly. Right. The problem is everybody else. The problem is all the IoT, OT medical devices, all that kind of equipment that's not it. There's no patch Tuesday for IoT or for OT, right? It's much more complicated than that. You have to wait for the vendor to issue a patch or, you know, an upgrade that will that will that will implement the BQC algorithms. You have to wait for things to be certified. You have to make sure that it will work. There are tests that have to be done in your own environment, site acceptance tests and so on. So it's not again, it's not as easy as IT. It's not just, you know, hit a button and upgrade your SSH server or your HTTPS server and so on. So that's we can draw parallels between the adoption of BQC with the adoption of other encryption technologies like TLS 1.3 or even HTTPS in the past 10 to 15 years. And there has to be a significant driver for things to move, right? There has to be either some regulation, some external mandate or some real risk that organizations perceive as being, you know, something that makes them act right now. Yeah, well, and I also think that do you feel like and, you know, you can go back to Y2K way back when, where everybody was very nervous about what would happen when we hit the year 2000. What, you know, Rob, you spent time also as a practitioner, you know, and working in IT, you know, when you draw the parallels between, you know, now being at, you know, Forescout and, you know, working as a cybersecurity software vendor and then, you know, kind of a lot of your contacts, you know, in the industry that are actually doing the work. Is there, I mean, do people underestimate, you know, the work? Are they putting their head in the sand in terms of saying, hey, I just I don't know what I don't know, a little frozen. I mean, where do you think the community as a whole is sort of sitting? I think it varies based on the vertical and you kind of have to put two things into perspective. Who is my adversary that might be able to compromise me with this type of attack? And, you know, we're talking some of the largest, most resourceful organizations in the world, typically nation states or somebody who has access to unlimited funding. Right. And that will be the first place where we see the attacks materialize from, you know, there's an arms race, you know, per se for whichever country can get to, you know, a quantum computer that can defeat, you know, even TLS 1.3 encryption. Right. And it's whoever can get there fastest gets their chance to get ahead in that arms race. But if you kind of imagine, you know, and just from my own experience and, you know, working on the other side, there's things like network infrastructure, routers on the Internet, you know, routers that move data across the entire Internet. Some haven't been rebooted in decades. Right. And imagine, you know, are you going to now reboot this router? And you don't know if it's going to come back up. Right. There's a lot of things where these organizations are a little bit terrified to even make the attempts to change and patch. Right. Because you don't know what might happen when it goes through that reboot cycle or when you do patch something. Right. So it is almost analogous to the Y2K where you kind of want to do enough. And at some point there's a little bit of hope, but, you know, hope is never a good strategy. And I think this is one of those scenarios where for once we at least can kind of have an observation or an ability to say, hey, I know what might be at risk here. I know who my adversary is likely to be. Let me sort of figure out where I go first and apply some protections versus just trying to upgrade all the software everywhere, because that's never going to happen. So that's a great way where you're going, Rob. I like kind of how you're making a transition here. So we talked about, hey, sort of PQC is real. We need to be mindful of it. Hey, we've started, but, you know, it's, you know, not good enough. We're not moving fast enough. And we know that there's an aging infrastructure. So, you know, hey, you know, what is the cost associated if you just were to replace the hardware? Right. Let alone any of the labor. And, you know, what would happen then? So let's talk about best practices. Right. And so given what you folks know, Daniel, I'll start with you. Would stronger visibility into encryption posture help teams act sooner? I think so. Absolutely. Actually, you know, it has to be coupled with understanding your whole metric, right? Understanding all the assets that are there. And then in those assets, which of those are using PQC, which are not using PQC and so on, so that then you can understand, actually, the risk that that's bringing to you. Right. It's not just about the device. It's the type of communication, as Rob mentioned, who is your adversary, what, who that device is talking to. Right. Is my device already segmented in the network? And then I maybe don't need to worry so much about PQC. Is that carrying confidential sensitive data or is that carrying, you know, just just my data that's not relevant for anybody out there that that might not be, you know, something that I'm very worried with. So I do believe that having the right visibility is paramount. And it's not just something that I believe or that, you know, Forescout believes in. It's something that is in every quantum migration roadmap that's being deployed or designed by governments out there. Right. So CISA's initial step in the migration that they mentioned is inventory your devices. Right. And others in other parts of the world have migration handbooks and so on that also start the same way. Like, look at your network inventory, what you have, understand the encryption that they're using, understand what you have to migrate, when you can migrate that, and then, you know, potentially come up with with workarounds or other types of controls for the things that you cannot migrate. Excellent. Rob, now to you here. Right. So Forescout recently introduced a patent detection detection capability. Right. And it's kind of this helps organizations map and manage the risk at scale, especially in hybrid environments for PQC. Tell me a little bit more about that and, you know, how that can help through the transition that Daniel just kicked off about visibility and understanding what's out there. Yeah, thanks for the sort of question on this. And, you know, if you if you kind of imagine the makeup of today's modern network, you have traditional assets that you deploy different kinds of software on to manage, you know, the Windows operating system or Linux, and those you have fairly good insights into what libraries are available and what makes them tick and what their capabilities are and what they aren't. But the large portion of what most modern networks are made up of are things that you don't get to see inside of, for example, you know, old network switches, you know, IOT devices, things that control the building automation, things that control lighting or power or the electrical grid of a city. Right. These are all things where you can't install any kind of agent on there. You can't poke in and see what software libraries are being used. You have no real understanding of is it safe or not. And if it's not safe, how bad is it going to be? And the other angle of this is, well, if it's not safe, is it communicating in some way that exposes it to one of these harvesting attacks? So this is what we sought out to solve was we knew the industry had a good line of sight on modern things, Windows computers, the kind of market where you see a lot of other existing agent based softwares out there. But that's the shrinking market. And that's also the market that doesn't pose the biggest risk. What poses the biggest risk is passwords to routers, passwords to firewalls, things that are on non-traditional operating systems. I think, Daniel, one of the stats you shared recently was there's two or three thousand unique operating systems that we track that aren't Windows or Linux. And when you kind of imagine the necessity to understand what is its likelihood of being compromised, what is the potential for exposure and who is it communicating to that might be exposed to somebody in the middle? That's kind of the challenge we sought to solve, right? We wanted to make sure organizations can create an inventory of which devices are cryptographically compliant and safe against the attack that will likely come. And in a nutshell, we present that to our customers. We present that in a inventory fashion to show you where is it communicating to who? What kind of device is it? What is its criticality? And it helps you build a clear picture of what do I do next? Do I patch? Do I protect? Do I replace? And you can make that assessment at the business level. Great. Great answer, Rob. And Daniel, one question on sort of your recommendations or your kind of thoughts on stuff to kind of piggyback off Rob's comment. What about segmentation? You know, you kind of posted in one of your blogs about segmentation to eliminate or containment or limit the blast radius. What's kind of your thoughts on segmentation? Yeah, that's a great question, Barry. And it goes to what Rob mentioned, right, that you need to know whether the device is using PQC or not, but then who that device is communicating with. Right. So if it's a device that is well segmented in your network and it's it doesn't have any external communication and you don't have any reason to worry about the data that's in that specific segment and so on, then that's a lesser risk than a device that has external communications or that has a path to external communications where the data from that device can be, you know, exfiltrated on the network and so on. So segmentation is definitely an important control. And when we look at, you know, the list of things that organizations should be doing to try to contain risk, segmentation comes probably right at the top after, you know, identifying what the devices are and the risk is and so on. But the most important one of the most important controls that you can apply on the network is segmentation, right? Making sure that you divide the network into zones that are according to the risk that you want to accept in each specific zone. Right. And then after that, making sure that you monitor those zones that you can actually detect if there are signs of compromise, if there is something going wrong, if there's any abnormality or any known malicious activity going on in any of those segments that you need to protect. Excellent. All right. So in closing here, I'm going to give each one of you a little bit here to kind of sum it up and I'll sum it this way, maybe just sum up a little bit about one or two talking points and a bit about, hey, so, you know, how can Forescout perhaps help our customers and prospects? So, Rob, I'll start with you. OK, I would say, you know, one thing that is consistent with every organization out there is there is a lack of understanding or a lack of intelligence into how these things are communicating and to who. We as a civilization have done an amazing job of connecting the planet and we connected the planet through all different types of means. Internet service providers, VPN tunnels, SASE solutions, you know, and if you kind of imagine all the different pieces along the way that move one data point to another data point or to another system, there's a lot of places for information to be extracted or have that compromise happen. And we've built this kind of sense of confidentiality on the thought that, well, the math is so hard, nobody could ever break it. And as short sighted, you know, we innovated ourself on breaking our own ability to defeat the math. So, you know, in typical fashion, like we've solved the problem, we've also created the problem by solving the problem. I think another kind of key thing here is, you know, there is the scenario where networks aren't just cloud, they aren't just on-prem, they aren't just wireless or virtual. We've accumulated more and more things over the years, over the decades, and that's not going away. We have work from anywhere, we have work from different countries, we have global organizations, we have things running in multiple private clouds, multiple public clouds. All of that has to be wrapped together to understand, well, where might my risk be coming from? Because I don't control the wiring anymore like there once was. Yeah, very, very good comments. And Daniel, what are your closing comments here? No, sure. So I'll tell a bit of a story, let's say, right, that a couple of years ago when we started looking at this, actually, Rob approached me and I'm the researcher, right? I should be looking into those things. But actually, Rob approached me and said, you know, quantum computing is coming, PQC is coming and all that. And I was like, internally, right, I didn't say anything to him, but I was like, yeah, I guess it's coming in a few years, right? People are not really talking about that yet. Like, yeah, maybe it's coming. And then fast forward two years, everybody's talking about that, right? Especially as Rob mentioned, in government, in defense, in financial services, everybody knows that it's coming. So my message would be, if you are still thinking that this is something for the future, if you're still thinking that this is something that I don't need to worry about now, I have other things to worry about. And, you know, quantum, when will that come? Is it science fiction and all that? That's not really a good line of thought to have these days. This is coming. It's coming fast. As I said, current timelines are about deprecating traditional cryptography in 2030. I do expect that that might be accelerated in the future as things move very, very fast. Right. So don't leave it for the future. Start looking at that now. There are solutions out there, including, you know, what we developed at Forescout that can help you to start planning, start thinking about a migration. Starting to understand what's the size of the problem that you have on your network. Start acting now. Right. It's not. Don't wait for, as you asked, Barry, like there will be there. Is there evidence of attackers doing Harvest Now Decrypt later? Don't wait to be the first organization that will, you know, provide that evidence to everybody else. Right. Don't be that one company out there. So start acting as soon as possible. Start looking at the problem and we can, you know, help you to solve it. And there are things that that we can do as an organization, as a cybersecurity community, as an industry to move together and kind of solve the problem that has been done before with, as I mentioned, Y2K, you mentioned, Barry, HTTPS, GLS 1.3. Things can move and progress. Right. Let's do the same for PQC here. Very good, you two. And, you know, again, in closing, hey, PQC is here. Don't wait. Work with a vendor that can provide you a solution. That'll tell you what assets you have out there. Where are those assets? What's the risk associated with them? Pursuant to our conversation here, some detection, response and segmentation and then some fast control. So I hear you loud and clear. And hey, we're here at Forescout to help you. So that's a wrap. Let's keep the conversation going and we'll see you in the next episode of Let's Talk Security. Transcribed by https://otter.ai
