Transcript
weakest component or its weakest device. So with that said I'm going to hand the time over and introduce you to my good friend Anurag Singh who is going to talk through some information as to how Sophos is helping to lower risk especially as it relates to your edge devices and those things that are exposed to the internet. So with that time I'm going to hand that over to Anurag. Is your firewall reducing a cyber security risk or introducing it? Is your firewall defending your network like it is supposed to or acting like a Trojan horse and inviting attackers in silently? That's what we'll try and figure out together in the next 10 minutes. Are you guys ready for this ride? Okay, let's do it. We are going to be methodical about this. We are going to first state a problem or establish a problem. We are going to then validate if it is a real problem or I'm just making it up to sell a product, right? How are we going to validate it? Using publicly available information. Then we are going to talk about the solution and then we'll also validate the solution. If that solution has been out there in the field for a couple of years, so we have a way of validating if it's actually solving the problem or not. Good? Okay, let's dive in. So if you pick any LLM model of your choice, Chad, GPT, Grog, Gemini, whichever one you use every day, just ask this simple question. What are the top five initial access methods that threat actors have been using to gain access into your network in last three years? So what it's going to do, it's going to go out and read reports, yearly reports released by vendors like us. Like we release active adversary report, Palo Alto releases one, CrowdStrike releases one, Microsoft, Google Mandiant, Verizon, tons of other sources. Like almost all these companies around, they all release these reports. They have insights in those. One of those things is, how are the attackers getting in? Or in other words, initial access methods. So what you'll see in this, the top one, exploitation of internet facing application. Guess what? Your edge device or your firewall is internet facing. It has a WAN public IP, meaning someone sitting on the internet can scan the public IP and see what it is responding to. Meaning if you have remote access VPN service enabled, user portal enabled, the UI access for the firewall enabled or SSH access of the firewall enabled, they are going to get a response. And if there's a vulnerability in there, they're going to try and exploit it and get in the network. Not just once, it shows up again at number five, exposed remote services. So if your firewall has RDP SSH enabled or remote services like VPN enabled, so if a problem shows up twice in top five, I think it's pretty safe to say using public data that we have validated the problem. What do you guys agree? Sounds good? Okay. Let's use more information to validate this further. This is another, if this LLM that you are using, if you ask another question, okay attacker gained access to the firewall, what are they going to do next? So this is some of the recent exploits of firewall vendors and their VPN service. In general, the goal is they gain initial access, then they would try and gain root access of your firewall. From there, still username, passwords, credentials, firewall config. Essentially use that as foothold in your network and from there, slowly move laterally inside the network. These are some other sources, specific ones like Verizon Data Breach, Mendian, Sophos, Coalition, CyberThreat Index, CrowdStrike, they're all talking about key findings 2326. How are the attackers getting in? Exploitation of vulnerabilities, credential abuse, internet facing application, external remote services, remote access services. So specific reports validate that as well. Okay, so here specifically now, we are going to talk about Sophos firewall vulnerability first. So in our firewall in 2020, a specific vulnerability was found by international APT groups and they used it to exploit vulnerability and gain access to some of our customers. That is how this whole thing started when we realized that this is a big problem and we need to address it. So to establish the problem, what are we saying? The firewalls are the problem? No, we still need the firewalls. We cannot get rid of the firewalls. Are we saying that the vendors are bad? No, wherever there's a hardware and software, the vulnerabilities will always exist. So what we need to improve upon or what is the problem is vulnerability management. So the problem statement is better vulnerability management in firewalls. In this case, it ran for like four or five years and we had to involve FBI and even few people got charged for this, right? From there, other news about other vendors, similar big breaches, multiple firewalls being used as an entry point into the attack or networks. It has got to the point where in last one week, National Cyber Security Center of UK, which is equivalent to US CISA, came out and said, we need better logging on networking devices. We need tamper-proof logging on networking devices because there are so many breaches happening because of networking devices or through networking devices. We need better logging and make sure attackers are not able to delete those logs. Then, other than the company that is under attack and maybe the MDR company that is there to defend them, who else is very interested in understanding if attackers are getting into your environment, how are they getting in? Any guesses? Cyber insurance companies because like any insurance company, they don't want to pay out, right? So if they can dig deeper and figure out how the attackers getting in, if they can add a clause or force your hand to fix that, then they will definitely do that. So this is a company called Coalition based out of Massachusetts that released a report within last year saying that out of every 10 ransom payments that they had to release for their customers, six were because of compromised VPN or firewall. So about 60% happened because of firewall. This is another vendor saying 90% of ransomware incidents happen because of firewall exploits. Maybe we can dispute the number, maybe this number is too high, but you cannot dispute that it's in top five and it's happening a lot. So I believe we have done enough to validate the problem. The problem is validated at this point. Would you guys agree? Okay. So the problem was already bad, it was in top five. It's going to get worse because now there are frontier AI models available that will speed up the number of vulnerabilities identified and very quickly even a non-technical person can give a couple of prompts that, hey, write a code to exploit this vulnerability and it will write it. It doesn't even have to be high or critical vulnerability. It will say, find three or four medium or low vulnerabilities, chain them together and get me access of this network. And it's literally doing it. So the problem is only going to get worse. So let's talk about solution. What is the solution? I'm sure you have heard secure by design before, right? Every company, every cybersecurity company talks about secure by design, secure by design. In this case, I'm going to demonstrate that we are walking the talk. We are not just talking about it, we are actually implementing it in our product. So the solution, what is the solution? The first solution is automated hot fixes. So let me ask you this question. I'm sure you're familiar with or you might manage some sort of endpoint or antivirus on your devices, right? Have you recently upgraded your antivirus or endpoint in the last two, three years? No, because they're all cloud managed and the vendor, whoever is providing the endpoint, they automatically upgrade it for you. So if there's a vulnerability, you don't have to worry about it. They just find it, fix it, patch it. But for the firewall, that's not the case. Endpoint is sitting inside your network. It has a private IP. Firewall is out. It has public IP, but endpoint has better vulnerability management than the firewall. Why is that? That's the question we are trying to address and fix. So in our firewall, we added automated patching. So an example of automatic patching would be, let's say there is a vulnerability in our syslog database, in our firewall where we keep our logs. How would it look like? We will upgrade the logging database and only restart the logging daemon, the logging service, not the whole firewall. So we're not changing your version. You're not rebooting the whole firewall, bringing downtime. Just a few seconds for one service. That's it. It is enabled by default, so you don't have to opt in, but you do have a choice of opting out if you don't like it. Does this address the whole problem? No, it doesn't, because we are relying on the fact that some security researcher will find the vulnerability and report it to us. What if it's a nation-state actor? They'll find the vulnerability and they will keep it to themselves because they want to use it to gain access into the country that they don't like and their infrastructure. So for that, what we did at the crux of it, any firewall is just a custom Linux box, right? Whichever firewall you're thinking of or you might be using is a custom Linux box. Vendors like Sophos, Trend, and many others, they do provide endpoint agent for Linux and Windows servers and other kinds of servers. Why not put that endpoint agent in the Linux server that is the firewall? So that is exactly what we did here with system integrity monitoring. We took our Linux endpoint agent and we put it into our firewall OS and started monitoring it, like doing EDR monitoring for it. Unauthorized access, file modification, privilege escalation, any vulnerable library being exploited, all that is being monitored for free. Even if you don't have our MDR service, if you have our Sophos firewall, it will be monitored for free. So those are the two main features, two solutions to secure your security device. In addition to that, we do other things, for example, hardening the hardware itself. For example, the operating system is compartmentalized, modularized, so if attackers gain access to one part of the OS, it's not easy to get to the other part. In addition to that, we have cloud management, which means you can simply disable the WAN access of the firewall, SSH and UI, and simply access it from our cloud management. Any questions here? This is the most important slide. Okay, sounds good. So in addition to that, in our firewall UI, this is not about the device of the security itself, but this is, as a customer, you don't have to become an expert in our firewall. What we did is we created one page called health check, and all the important features are listed here, and we are showing whether it's on, turned on, or off, and we are matching it against CIS benchmark. So you can see if your important settings are enabled, disabled, and whichever ones are not enabled, you can quickly click on it, get to that feature, and turn it on. So that's the solution. So we established the problem, we validated the problem, we talked about the solution, now it's time to validate the solution. So how do we validate the solution? Again, the same LLM model, any one of your choice, go in and ask this question, give me a list of devices or networks that have been breached in last two years because of the exploitation of Sophos firewall vulnerability. You will find nothing. Change that to five years, you'll find stuff because of the CV that we talked about earlier. Change it to any other firewall vendor name, and you'll find a big list. So that's how we know that our solution is working, and you can validate it to yourself. So how did we get to this point? So that CV 2020 that I showed you, we have dubbed it as Project Pacific Rim. We don't really have enough time to talk about it, but there's ton of blogs, videos, information that we have published transparently. You can go and read about it, but essentially that became a necessity for us, so this innovation came out of necessity of auto-patching, monitoring the OS, hardening the firewall itself. So I want you to walk away from here with this message. Demand a better firewall, right? If you do it yourself, ask it to yourself. If you have an IT team, ask them. Have a better firewall that does auto-patching for you, just like your endpoint does, that does OS monitoring, just like you do endpoint DDR XTR monitoring, and has a hardened OS. Thank you for your time. Have fun at Black Hat. Take care, guys. A round of applause for Anurag. Thank you very much, Anurag. Appreciate you spending your time here, and thank you all for joining us here.
