EP266 Resetting the SOC for Code War: Allie Mellen on Detecting State Actors vs. Doing the Basics

Key takeaways

Understanding the historical motives and strategies of nation-states is crucial to anticipating cyber threats and making strategic security decisions.
Fundamental cybersecurity best practices—such as strong passwords, multi-factor authentication, and supply chain vigilance—are vital, even when facing sophisticated nation-state actors.
The role of large tech companies, especially cloud providers, is significant but still constrained by national sovereignty and legal frameworks, impacting their ability to act independently against threats.
AI has the potential to significantly enable more dynamic, automated, and sophisticated attacks, demanding new defensive strategies and better threat modeling.
Small and medium organizations should not dismiss nation-state threats; supply chain and third-party intelligence, along with basic security hygiene, are critical for mitigation.
Regular strategic discussions on geopolitical and technological developments are necessary for security teams to adapt to the rapidly evolving threat landscape.

Summary

Introduction and Podcast Context

The podcast begins with hosts Ever, Tim Peacock, and Anton Chewvacan setting the scene for their discussion on cyber warfare, society, and the implications of geopolitical conflicts on cybersecurity. They highlight their focus on the strategic and practical lessons for security leaders amid complex, evolving threats, emphasizing the analytical expertise of their guest, Ali Melon.

Focus on Ali Melon and His Book, 'Code War'

Ali Melon, principal analyst at Forrester and author of 'Code War: How Nations Hack, Spy, and Shape the Digital Battlefield,' discusses his selection of the US, China, and Russia as focal points for his book due to their historical and current influence in cyber conflicts. He explains that limited book length and the need for a comprehensive understanding of these powers shaped his choices, and highlights the importance of understanding historical context in geopolitics and cyber warfare, paying special attention to how these countries’ strategies are rooted in their historical motives and geopolitical agendas.

Fundamentals vs. Dynamic Threats in Cybersecurity

Ali asserts that fundamental cybersecurity principles—like understanding the history and motives behind nation-states—are key to making sense of current threats, despite the rapidly changing tactics of attackers. He emphasizes that strategic insights from history remain relevant and can help predict future behaviors of state actors, especially in relation to emerging technologies such as AI.

The Role of Cloud and Tech Companies in Cyber Defense

The discussion covers how technology giants, which Ali refers to as 'the fourth power,' hold significant influence over global internet infrastructure and user data. Despite their economic and infrastructural control, these companies remain subject to national laws and sovereignty issues, often caving to authoritarian demands and legal pressures. Ali underscores the importance of shared responsibility in cloud security but notes its limitations against sophisticated nation-state threats, highlighting the importance of strategic resource allocation for organizations.

Cyber Warfare and the Impact of AI

Ali discusses the threat of AI-enhanced cyberattacks, recognizing the current capabilities of state-sponsored actors to automate and sophistication tactics but clarifies that AI hasn't yet reached full automation for creating novel zero-day vulnerabilities. He expresses concern over more dynamic, adaptable attacks that leverage existing vulnerabilities, and highlights the need for new defensive strategies, including better bot management techniques.

Threat Modeling for Small and Mid-sized Businesses

Ali stresses that even small and mid-sized enterprises should consider nation-state cyber threats, given the potential impact exemplified by cases like NotPetya, which originated from a small Ukrainian business. He advocates leveraging supply chain and third-party intelligence, along with basic security measures like strong passwords and multifactor authentication, to mitigate risks from more sophisticated adversaries.

Final Advice and Resources

Ali recommends reading accessible cybersecurity literature, including Wired articles and books like Kim Zetter's 'Countdown to Zero Day.' He underscores the importance of regular strategic risk discussions about geopolitical developments, suggesting quarterly meetings to keep pace with the rapidly changing threat environment. He emphasizes that cybersecurity must be integrated with broader geopolitical awareness to prepare for long-term threats.

Show notes

Guest:

Allie Mellen, Principal Analyst @ Forrester, author of "Code War: How Nations Hack, Spy, and Shape the Digital Battlefield"

Topics:

Your book focuses on the US, China, and Russia. When you were planning the book did you also want to cover players like Israel, Iran, and North Korea?
Most of our listeners are migrating to or operating heavily in the cloud. As nations refine their "digital battlefield" strategies, does the "shared responsibility model" actually hold up against a nation-state actor?
How does a company's detection strategy need to change when the adversary isn't a teenager looking for a ransom, but a state-funded group whose goal might be long-term persistence or subtle data manipulation? How should people allocate their resources to defending against both of these threats?
How afraid are you of a "bad guy with AI" scenarios? Mild anxiety or apocalyptic fears?
Do you see AI primarily helping "Tier 2" nations close the capability gap with the "Big Three," or does it just further cement the dominance of the nations that own the underlying compute and models?
You've spent a lot of time as an analyst looking at how enterprises buy and run security tech. For a CISO at (say) mid-tier logistics company, should 'nation-state cyberattacks' even be on their threat model? Or is worrying about the spies just a form of security theater when they haven't even solved basic credential theft yet?

Resource: