Former U.S. Secret Service Special Agent Shares Cyber Criminal Secrets

Richard [00:00:00] most people think it's easy. Oh, I'll just shut down the line. I don't know if you, if you know this or others, it takes about a month to restart a quantum computer and it takes a large amount of money to do that, a, at least a hundred or more thousand dollars to restart a quantum computer to restart say, manufacturing line.

Intro Welcome to the Industrial Cybersecurity Insider. In each episode, we dive into the world of industrial cybersecurity. Join us as we cover the latest trends, innovations, and practical insights as we talk with leaders and practitioners across the industry. Gear up and let's get into this week's episode.

Craig Hi. I'm Craig Duckworth, and today with us we have Richard Tulip. Richard, welcome to the show. Please give us a little background about yourself, what you've done, and kind of where you [00:01:00] are today.

Richard Yeah, absolutely, Craig. Thank you for the introduction and, and thank you for inviting me onto the, show today.

Richard A little bit about myself, right? So where did I come from and how did I get here? 1995 is when I joined the US government in 1998 is when I switched over to the US Secret Service, and I think that's really where my journey became really interesting in, that regard. I think a lot of people look at the Secret Service and they, they've seen the movie in the line of fire.

Richard they've seen Clint Eastwood running alongside of, limos. And I can literally say that when I first started with the Secret Service, this is not something that we did. and, even though the movies, portrayed that, and so. I think that is how people see the Secret Service, but the Secret Service has a dual mission.

Richard One is to protect the financial infrastructure of the United States, and the other is obviously to protect the president. The popular one, obviously, that everyone knows about is the, presidential, but the unpopular one that most people don't necessarily automatically associated with is the financial.

Richard And that financial journey is really where my career [00:02:00] mostly perked up, right? So when I joined the Secret Service, I'd have to say. you know, 1998, a little bit behind in technology, but quickly, when I was working investigations, I really focused on how the computer played a role in advancing criminal activity.

Richard And so I very quickly pivoted to Cyber, let's say, roots, if you will, and joined our forensic program. That forensic program took me into a wide variety of other areas in the Secret Service. All still aligned with. Financially motivated threat actors. And so the dark web, not that it was new, but it became new to organizations like the Secret Service.

Richard And so we really started focusing on those who were working behind the computer and also those people who were doing what they could to stay masked. And so. That forensics took me into undercover operations where I became a cyber criminal, and I started working [00:03:00] on forums and I started, you know, meeting with, cyber criminals in the real world, to which I ended up writing a book about, it's called Operation Carter Chaos, which was the case title name.

Richard And so that took me from working there to then pivoting to international liaisons. And so I worked at the US Embassy in Colin Estonia. Continuing to work with a wide variety of individuals internationally focused on, you know, that, financially motivated cyber threat actor. After I was done with my time in Estonia and working with our international colleagues, I pivoted to our cyber threat intelligence section At headquarters.

Richard Here is where the goal was only focused on the most advanced threats that. Financially, let's say financial industry was, facing. And so I ended up, you know, working one particular case where, you know, the hacker, were taking advantage of the SCC, really the Edgar system and compromising a wide variety of those documents.

Richard [00:04:00] And case was huge because not only was it a. Critical, let's say resource, which in a lot of the, a lot of any publicly traded industry relied on, but also the fact of the global criminal network and how far it spreads, right? You think that by stealing a 10 q or some other financially or, company related document.

Richard Okay, well, what's the goal? It's to get that document and to spread it to their network so people can legally trade on those documents. So working to find that person really kind of dem mask the individual and bring them to, you know, that physical world was the journey and we were able to do that. And so that was just one case of many.

Richard But, identifying, locating, debriefing, and in those cases where we could, using them as an asset to continue that journey of climbing the ladder and being able to. Bring those who are the most disruptive to justice.

Craig Oh, fascinating. So a couple things in that, that really piqued my interest is my background and, not everyone [00:05:00] knows, is I started off in, finance, my degree is in accounting.

Craig I worked in casinos for 25 years and we had, you know, c TRCs, we had fencing, we under. Did that. We ran across counterfeit currency, which Secret Service would come in and they would inspect and they would collect, and the financial piece of that. But you look at how that's evolved to, you know, threat actors today and how it applies to the industrial manufacturing, you know.

Craig Organizations today are not always hit on the industrial side. It's a, business email compromise or something on the the IT side. And then the threat actor will pivot to the manufacturing side, understand what's there. And in a lot of cases there is a ransomware that is attached or some sort of demand for monetary value where.

Craig You know, they are seeking payment for [00:06:00] keys to turn over the, process back to 'em. I can see where even today as, as we focus on just how do we help organizations secure and protect the industrial. Networks, there's the entire secondary financial side of that transaction that most organizations are like, the insurance company will pay it, or we're gonna pay it and get it back.

Craig that's a whole separate piece of it. that's unique in itself.

Richard So I think you hit on a couple of interesting, topics, to be fair, right? So we talk about ransomware, that's tip of the tongue for most of the people. Yeah, it's a concern. But this is where I start talking to just other persons.

Richard Like when I speak at a conference, I'll, I'll talk about the value, the value of an information security management team. You brought up insurance, which is an interesting aspect as well. Do we rely on insurance? You know, pay the brighter, meet the, meet the contractual obligations. And then of course, you know, we've saved the day, so to speak.

Richard [00:07:00] Well, I think you need, say a couple real world examples to understand your value. The value of an information security management team is to allow the business to operate uninterrupted, and by allowing that, we allow business to continue. Business to survive. Those are our main goals. And so we should understand what's most critical to the business, and then we need to understand how to apply that in terms of a strategy to protect that business.

Richard So there's no interruption. Now, if we were to talk about value, just value alone, right? And I think a lot of security teams oftentimes start at the insurance ideology and also the ransomware payment. And this is not where you should stop, in my opinion, right? We need to continue down the line. And the reason why is because not are we.

Richard Asking for tools, we're asking for manpower, but we need to also show the ROI or even the justification of what can happen and if we take MGM or if we take the recent Jaguar Land Rover exploit. That started off for more than likely the social engineering aspect, and I think [00:08:00] we know for sure MGM or social engineering, whereas that they were able to get the toehold and then they would move into the environment Now.

Richard You have two decisions to make at this particular, at particular time. Do you pay the ransomware demand of whatever it is the actor is asking, or do you now look at saying, we're going to recover our systems? In both cases, you know, you look at the recovery of systems, so we start talking about not just our ransomware payment, that is possibly going to be the cost of doing business, right?

Richard Or. Let's say restoring the business is a better way of putting at it. But if we choose a different route, which some organizations are choosing now, you start looking at manufacturing companies or even the production of your, say, business line and MGMs example, they lost over a hundred million dollars.

Richard In downtime alone, but we look at, say, manufacturing and depending on what it is that you create and or deliver to the, consumer, now you start have to look at what does it cost for you to be one week, two weeks down. I can [00:09:00] tell you this, that people, well, organizations like AWS. Google, if you will.

Richard They know their profitability down to the second, and so they understand what a five minute disruption is going to cost them, and a one week disruption is going to cost them. If you look at, you know, the healthcare environment and you have a major disruption to a provider, it's not now hundreds of millions of dollars.

Richard It gets into the billions. And you look at JLR. That was 1.8 billion at the last time that I read it. It's likely the number is going higher in terms of costs. Now you look at that value and you talk about the ransomware payment. You talk about downtime, and downtime is only getting worse for these organizations in terms of their costs, but it doesn't stop there.

Richard But if you're publicly traded and because of the incidents, you're not necessarily looking at all the risks that you face, then that can be introduced if you're not paying attention. Because remember now the scramble between IT and information security management. Or even the manufacturing line is to bring the business back up and running.

Richard And so we may forget that [00:10:00] we have obligations to the SEC or say even in the EU, GDPR, so we have to report within a, a very tight timeline, at least something we have to tell them that there's been an incident or there's been something that's disrupted the business if we fail to meet those obligations.

Richard Then now you're looking at some type of regulatory, fines that come along. And if you've lost even more than that in terms of data, and that data can be correlated to PII or PHI type data, then now you start looking at, well, is there going to be, and I guarantee you this, just like anything in life, behind the scenes, behind the mass.

Richard There is a lawyer waiting there to jump out of the shadows with a class action lawsuit to your business. And so when we need to take about, let's say value, we need to look at it from a holistic picture. Yeah. That incorporates the entire business, not just a singular line of business.

Craig Yeah. And I think that That holistic look is what a lot of organizations are missing. they're seeing a piece of that [00:11:00] insurance is a piece of the total picture. production line is a piece of the total picture. Having a instant response plan that you practice and is well rehearsed before an incident is part of the picture.

Craig It's like a 1000. Piece, jigsaw puzzle. You need all of it to understand the whole puzzle. You can't just use some of the pieces, and I think that you're right in looking at it holistically, it helps an organization truly evaluate their risk and what is that risk so that they can better define it too.

Craig The board of directors to the shareholders, to the regulatory requirements, whether that's SEC, that's private equity, that's whatever, and how do they begin mitigating and reducing that risk in various paths and methods to take a. Better approach what does the [00:12:00] cost of that look like?

Craig And it's different in every organization you mentioned JLR and that the 1.8 billion and the effect that it's having on the UK economy as a whole in trying to keep that organization afloat while they get back up and they start producing and they begin that ramp up I think that all organizations realize the amount of time, effort, costs to recuperate, to restart production, to begin that industrial network.

Craig Flowing again is a challenge. It's not an overnight process where, if you look back at your example. MGM chose not to pay the ransom. They said, we're not gonna do it. We're gonna rebuild our network. On the flip side of that, most people don't know Caesar's the exact same timeframe, said, here's the money, please give us the keys.

Craig And you never saw it in the press, you never [00:13:00] saw anything with it. And they didn't have a hundred million dollar loss. 'cause that was a different path they chose to take. Right or wrong. I don't know that answer, but it was definitely. Cheaper and quicker on their behalf, whatever circumstances they evaluated to make that decision.

Richard so go down the line of the holistic, which is interesting because the CIO role cannot be a, you know, back of the house. Lock your. Sit in a closet kind of job anymore. You need to really be social in what you do. That's why you have to understand the total business.

Richard You have to look at what's most critical to our business. What is it that I need to divert the majority of my resources to in terms of a manufacturing line, right? most people think it's easy. Oh, I'll just shut down the line. I don't know if you, if you know this or others, it takes about a month to restart a quantum computer and it takes a large amount of money to do that, a, at least a hundred or more thousand dollars to restart a quantum computer to restart say, [00:14:00] manufacturing line.

Richard When you start looking at the programmable, logical controllers and you look at how they are interacting with the servers, this is no small option for them. Right. It could go for sure. A couple hundred thousand, or it could be a million dollars or more of shutting down a line and restarting it. So, you know, to your point, it's not a singular event if you shut down a entire floor, and by the way, a ransomware event to a critical manufacturer is a long-term cost, even if you did pay.

Richard Right. Yeah. It's not going to be easy. I'll pay the 25 million. I'll be at back up tomorrow. That's not how it's gonna work.

Craig Right. No. Totally agreed. So let's shift gears just a little bit. Your current role as a field ciso. What are some things that you're seeing today for Recorded future and kind of how has that helped you, I guess, gain insight into maybe what organizations are doing or maybe not doing that they should be doing as you're out talking to clients, [00:15:00] talking to manufacturers, talking to industry, and what are you seeing?

Richard I mean, I think it, it spans the globe, right? I mean, it's from, a very little amount to a lot. and then there's this in between. And I think that the security program sometimes gets overlooked and when it gets overlooked, It's because of a variety of things. I talked about it earlier, the ROI, well, what's the ROI?

Richard It's an expense a lot of times. And so we have to constantly show the value of that team. But it's challenging because we do ask for the money. And if you protect an organization and the business continues to flow well, then again, it's hard, right? It's hard to show that value on a consistent and regular basis.

Richard but I, think that the organizations that really Are, let's say, performing well and understanding. They're the ones that are investing in security. They're the ones that understand that it can be them at any moment. These are the corporations now that are looking a little bit further down the road and saying, [00:16:00] well, what is our next threat?

Richard What is it that I need to be doing? Resiliency is top of, mind for most organizations. You can Define it in a wide variety of ways, but resiliency can be blocking the attacks, but also can be recovering very quickly, taking the, say zero trust approach where I trust nobody or taking the breach is occurred approach.

Richard And so I need to all, I need to understand. How to get my business back up and running. So, you know, that's where a lot of the conversation is shifted is that resiliency, ideology. And so those that get it, invest in it, they're putting more money towards the, idea because you're seeing. The headlines aren't going away.

Richard organizations like Scattered Spider and the tactics that they're using and, we can talk more on it if you'd like, but the, let's say forward thinking of what is going to be your threats currently, you look at Scattered Spider and their advanced social engineering tactics. It's got most organizations scrambling of how is it the future is going to be even [00:17:00] worse when you start looking at genic ai.

Richard That's a whole different ballgame.

Craig it gives the, the adversaries a, let's call it a leg up. 'cause at the end of the day, it is now taking and basically scripting as a person the things that they need to be better at social engineering. To be better at writing malicious code to be better and quicker at executing on all the things they are doing.

Craig Nefariously at the end of the day, it's helping them be a better, bad person. Period. So you're a hundred percent correct. as organizations that are protecting critical infrastructure, manufacturing, industrial networks, we have to be a hundred percent spot on every single time. They only gotta get lucky once.

Richard I think really is, you have to be very agile. You have to be very responsive. AI has worked for the bad guy to make them more say, [00:18:00] effective and let's just say that they're more capable and. But our teams need to be the same way.

Richard So the agility of our teams and being able to identify, look, the quicker you can identify a database breach or, or compromise, the better off you'll be. And, quite frankly, large corporations can measure this in large dollar amount. So, you know, it does matter that we catch it quicker. And we are using AI to our advantage as defenders, right?

Richard Yeah. And we use. In a way that it can help us to identify these indicators of compromise so that we can respond. And so, you know, when I talk about cyber threat intelligence and bring that to the forefront of the conversation, cyber threat intelligence can give you the leg up. In terms of defending yourself from a potential breach, by understanding not just who your adversaries are, but also the tactics that they're using, you also can use intelligence to identify how is it?

Richard If you look at, say, for example, most vulnerability management programs, they're tied to, you know, internal documents that have a [00:19:00] service level agreement. It could say. Anything, right? Each corporation defines it differently, but let's just say on average. On average, if I pick 15 days to install a critical update within my organization, because it's highly exploitable, you can look at this and say, okay, well 15 days, but where are we achieving the mark?

Richard If you look at the statistics from a year ago, and the statistics are saying at day 30, there's still 85% of those highly vulnerable exploits are still unmitigated. They're still open. And at day 55, it doesn't get better. It's still 50% at day 55. And if you were to understand that an adversary, and this is according to csa, right?

Richard If it adversary takes a minimum of five days to completely own an organization, we understand that we have to do better and we have to be quicker than the bad guys. Those persons that are compromising our networks.

Craig that's some very scary statistics when you think about as an organization.

Craig couple things as we look forward, you mentioned [00:20:00] AI and the way that it's advancing both sides. It's helping organizations automate and, detect quicker. It's helping the bad guys to get in faster, so. The scale and the time at which it's changing is exponential. What was, you know, perfect.

Craig Technology today is outdated tomorrow, and I cannot imagine where we're gonna be in 12 to 24 months giving all of the. AI dominancy that's coming to the US and the hyperscalers that are building as fast as they can. You look at, you know, Oracle and open AI and Google and Meta and everybody, and they're just buying this compute as fast as they can to train these language models.

Craig where do you see us in two years? is there even a crystal ball that could. Even guess what we need to be looking for to get us there.

Richard Yeah, two, two years from now. It's kind of an interesting thing to talk about if you, rewind the clock and look back in terms of when the [00:21:00] computer was invented and was brought to the market, and so they did these statistics of, it took over six years for 75% of the population to kind of adopt a computer.

Richard you follow the trend chat, GPT. It took a, total of, I think it was something like, a week or a month is somewhere very, very, very tight threshold for 75, and this was probably even more than 75% adopted AI back quick. Right? So where does it go in the future?

Richard I'm hoping I'll be able to sit back and let a robot do the job for me That has a connection to me, right? To think like me. Yeah. To be able to apply a strategy to an organization. So it's really hard to predict, but I think that you see out of all different regions of the world, you see the advancement of chip technology.

Richard You see the advancements of robotics. You see the advancements of ai. You see where we used to define a timeframe where it was months, it went to months to detect a breach in which you had, right. As a A team. Mm-hmm. [00:22:00] Weeks to days, to hours to minutes. You look at how agentic ai now is, iterating on itself and it's thinking faster.

Richard It's, executing commands Now. You can still keep a human in the loop. Yeah, you can still to know what it's doing, you know, but if you're an adversary attacking, say for it could be a political reason. It could be for an espionage. Espionage by the way too, think of it from a multifaceted factor. It can be governmental, it also can be industrial.

Richard Yeah. You know, when I start talking to companies about the risks to the infrastructure for an industrial organization, you have to think about the intellectual property in which you own. You have to think about the research and development that you put into whatever it is that you're focusing on.

Richard That's going to be your next. Thing that you're bringing to the market. And if that were to be compromised, and if somebody was to go to market before you because they were able to steal your intellectual property, you can imagine the, tragic nature for a business that can ruin an [00:23:00] entire corporation and it can, or set them back for a very long period of time.

Richard And so when you look at the agent side of ai, you look at what it's doing and how it's being used today. It's only gonna get scarier. I think also when you look at social engineering tactics, it's gonna become more human-like, you know, it's already pretty human-like, but it's gonna get to the factor of, you know, 10 x and you know, we're even cyber criminals.

Richard Just like what I said for myself. A robot that's connected to me that thinks like and can take commands from me directly, you know, it's gonna be the same for them, and this battle is going to continue and it's going to be more challenging. The investment for corporations is rising, you know, but the cost of business right.

Richard Is, is rising, in its entirety.

Craig Yeah, it is. those are all, great points. And you know, I've read, I saw an article. I don't know in the last week that, you know, it was from one of the, phishing companies that, are out there [00:24:00] promoting. You know, we, test your employees.

Craig We make sure that they're not clicking on something they shouldn't. And the, thing was, if you think that testing your employees is a bad thing, what do you think that the adversaries are doing to them? Wait till they click on something that you are not sending to them.

Richard you're absolutely right.

Richard I mean, leaving people with thoughts when I do speak at, conferences, education, education, real world education, not annually, you know, but you need to be more consistent. Quarterly can be the minimum threshold I believe in person needs to be added into that as a consideration, but I think that education cannot stop.

Richard Yep.

Craig as we look to if I kind of go back to your. Secret service days and the financial piece of it as organizations are becoming more targeted, whether that's geopolitical, that is hacktivism, that is pure profit from scatter spider, and organizations like that are, basically cartels for money.

Craig It is what they are. So as we look at that [00:25:00] and ransomware becomes a bigger piece, do you see. The secret service and law enforcement becoming better at maybe recovering part of that for organizations that do pay something. You know, we heard, you know, this was, I think part of the, Colonial pipeline, they were able to get part of that money back.

Craig You know, the trail is, is not easy. It's in, normally in Bitcoin or some other sort of electronic means. It's transferred within seconds of it going into an account to multiple accounts globally. What's our opportunity or chances of kind of helping to, to recover some as we go forward?

Richard So law enforcement, you know, this is kind of one of the things where when I was working in law enforcement doing incident response and going to businesses, and I think at times it, it kind of left an empty feeling because our goal was to gather evidence and then target the bad guys.

Richard And there were times that we were successful, right? We got these financially [00:26:00] motivated threat actors and we were able to arrest them, you know? But to your point, sometimes. Let's say restitution was ordered by the courts in which they never had access to it. Colonial Pipelines was a great example of law enforcement being very successful of recovering keys and being able to get that ransom payment back.

Richard Lock bid, which was another great example with law enforcement in terms of the global operation in which a lot of international team, right, the team got together and they went after lock bid and they did the same thing where they recovered. A lot of these Bitcoin keys and, passwords and, and codes, and they were able to use that to kind of get back some of that money and to return that, restitution to victims of, cyber crimes.

Richard But this is where it's a challenge, right? Because if you are a financially motivated threat actor, hiding or, protecting your money. Is your number one goal, right? Yeah. And so, I actually worked a big case with the US Secret [00:27:00] Service where I targeted some of the money launderers within the infrastructure, right?

Richard So we look at, you know, say for example, the threat actors where they're compromising the big databases. It could be Heartland Payment Process, it could be the Jaguar. Situation. It can be Colonial pipeline, and sometimes we looked at that as an opportunity for success. But as we've gotten our successes in law enforcement, the adversary has changed their tactics and techniques, and they've gone further underground.

Richard They've learned better operational security measures, you know, so they're hiding. You're using the internet for anonymity. And so the goal was for me saying, well, what is the key point of all of this? It's the money. So follow the money and you can, peel back the layers of the onion and you can then identify those persons.

Richard And I think the government in a whole right, is understanding that as well. And we're using as many of the resources as they can. You know, to be able to identify where's the money going and how is it that we can get [00:28:00] that back so that we can give back to those organizations. But it's definitely nu number one challenge.

Richard Bitcoin. I remember the logs when I was reading some of the logs and stuff. if you look at say, the beginning iterations, when I first started doing my undercover work for Operation Carter Chaos, when I started doing that, we used MoneyGram and Western Union as a means and methods to send money internationally, globally, if you will.

Richard Yep. And the bad guys started having conversations a little bit Afterwards, right. The conversation they started having was, what can we use? As a way to digitally move money that's a trusted criminal organization. Like we can trust it being not necessarily a hundred percent bulletproof, but moving to that bulletproof ideology.

Richard And so Eagle came along, and so Eagle was operating where you would trade ounces of gold or, or you even less. And, and, and you would put, you would see these bad guys writing in the, comments line. For a case of beer. So they transfer an ounce of gold for a case of beer. And you're like, well that [00:29:00] doesn't make sense.

Richard Right. You know, so you would say, well, you're not as a money remitter following the anti-money laundering or know your customer rules. And so we were able to team up and go after E Gold and recover those databases. Huge success. Right? Well then they just move. Over to, you know, a couple different others.

Richard But Liberty Reserve became that next opportunity for them. And I think if you look at Liberty Reserve, this was my opportunity, by the way, to be a billionaire. I missed it. But when Liberty Reserve was taken down by the United States government, then Bitcoin was, I think less than a dollar. It was. It was cents.

Richard Yeah. You know when that happened and that conversation of the digital bank was going on, and all of a sudden they pivoted to Bitcoin, why did they do that? Was because it was highly decentralized. Mm-hmm. And so that person I was talking about earlier, that was laundering money for. A wide variety of, cyber criminal actors.

Richard They were operating out of an eastern European country and they would be meeting with people in subway stations [00:30:00] and handing them bags of cash or keys to wallets or purses, and that was how they were exchanging and laundering money and continuing this going. But because it was so decentralized, the regulatory oversight of governments was limited and it was fractured so that.

Richard Let's say what they wanted already existed in Bitcoin.

Craig Yep. part of that, I think, you know, we as an industry have to get better at. Advanced notification. if I have an issue, I can't wait until I circle my attorneys and I circle my board and have a conversation because three days after I've given money and paid it, I'm never gonna see it back.

Craig You know, if I can alert somebody immediately, you know, it's, time to value. If I call the secret service, so the FBI or the local law enforcement within. Hey, this just happened. I was forced to do this. I just said it. Here's the information and let 'em start sooner than later. At least in my mind. Maybe I'm off base, [00:31:00] but the chances of recovering are better than if I wait three or four days or whatever That.

Craig Requirement is to make the notification, then say, oh, by the way, I paid them $25 million. And you're like, wow, that was three days ago. We had no chance of seeing that money now. So we as an organization as an industry, it's all cloak and dagger. Oh, don't tell anybody that we had a breach it. You know, because I don't want somebody to know that I, where my soft side is, I guess.

Richard Yeah, well, I mean that's kind of, taking your dirty laundry and hanging it outside to dry and do you want the world to see it? And I think that currently, you know, a lot of corporations are taking the. The tactic of, you know, yeah. We're not gonna put their laundry out there for the world to see because it's a brand issue.

Richard It is. You know, no one wants their brand to be tarnished. and beyond that they also, let's say the company secrets, they don't want people to know, customer trust, if you will, and brand reputation. These are two huge aspects. Mm-hmm. And I think obviously the [00:32:00] cybersecurity team plays a role in being able to provide that confidence, but to your point.

Richard quicker you can have a conversation with law enforcement, the quicker you can start providing information, you know, and meeting your own needs internally. Right. Because we, can't forget of how regulated businesses are. We can't forget of how, let's just say delicate. These things can be for organizations.

Richard So it has to be a good balance. We definitely cannot forget about, let's just say being a good citizen or being someone that is collaborating. 'cause quite frankly, and I talk about this too, is the more we collaborate, the more we partner, the better we are collectively, right? Collectively, you're stronger.

Richard Individually, you're weaker, and so the more that we can collaborate. Provide that information and this doesn't just go with database breaches, it goes with cybersecurity teams, learning from one another and understanding what it's that you're using and that works, and what is that you're using and doesn't work.

Richard And if we raise the bar [00:33:00] and we raise it high enough, then the adversary might be discouraged from continuing their path of trying to compromise your organization.

Craig Yeah, no, great insight. we wrap up, if you were to put on your CSO hat and you were to, pick some advice that organizations that you think would really make a difference in their journey, that something that you see has really helped someone that, that has taken it and implemented or where you see a gap, what would you say to listeners today that maybe could help them?

Craig Get a leg up on this wildly crazy journey that we're all on. And as fast as it's changing and as unpredictable as it is, what advice would you give?

Richard Well, because I work with Recorded Future, I'd always say cyber threat intelligence is an important key, and I think it is. And I do believe that gives an organization's a leg up.

Richard But if I was to pivot back and say, we've already talked about education, we've already already mentioned about partnerships. Mm-hmm. But [00:34:00] internally. Right. Understanding and partnering with all of the different business verticals. Once you can do that, you identify the criticality of the businesses and you start to wrap protection around that.

Richard And then you add things like cyber threat intelligence to understand where your greatest threats are. You understand based on the criticality of what it is important to the business. And then you understand through, say, the tactics, techniques, and procedures that the, the adversaries are using. Now you are.

Richard Becoming more resilient and we're moving down that path and we're becoming more agile. And so when you wrap all those things around, and we have to understand why the education part is so important, is because our employees greatest asset that the organization has, but also they can become the weakest point of an organization because they have keys to the castle, they have an entry point, a toehold into an organization.

Richard And from there, of course, you know everything that an adversary does, only gets more. Let's say the percentages continue to rise as they're able to, you [00:35:00] know, climb that ladder and to be able to, you know, use the exploits that are internally from the toehold, right? Because you have that layered ideology, the defense in depth ideology, and then you add in, say, a team who's dedicated cyber threat intelligence, who's looking beyond that and who's iterating on the possibilities of what, based on the current tactics they look at. Say, you know, something that I've said before too, because I've had the comments to me is no one told us that scattered spider had pivoted from industry A to industry B, and the comment that I make to some people is that not a single cyber criminal that I.

Richard Debriefed told me during my interview, well, I had access to industry A, but because I had been designated an industry B threat actor, I decided that I wasn't gonna go into industry A and I handed that off to somebody else that was identified. in that realm of the world. So we need that cyber threat intelligence team looking beyond, [00:36:00] you know, whatever the box is, that's our most likely, and saying, well, who right now is the hottest?

Richard Who is the one that's making the headlines? What is it that they're doing? How can I prepare better to be more resilient against the attacks that they're using?

Craig and it kind of ties back to the beginning when, the very first conversation we had was organizations to look at this holistically.

Craig You need to look at every aspect and faucet of it, and not just vertical or departmental, but how does the risk to the organization spread across everything that we're doing? I think it's important. Great conversation. I could, pick your brain for hours. I don't know that we have time today, but it was, hopefully the listeners got some insight.

Craig I appreciate your time. Keep doing the work that you're doing. We appreciate your service to the country, and the community and everything that you do today.

Richard If I could just, wrap up, you know, obviously absolutely like these insights and you liked the conversation. [00:37:00] You really wanna know about what it took to, penetrate the underground economy.

Richard I encourage all your listeners to Google my name. Look for the, title Operation Carter Chaos. It's a. You know, 40 chapters of some of the most interesting and intriguing, you know, undercover work, you get to read about me as from two different perspectives, right? You know, one side as a secret service agent and the other side living a dual life as this cyber criminal meeting with and, and working with bad guys.

Richard It's a super interesting read and it can shed a lot of insight in terms of, where we currently are.

Craig Absolutely. We'll make sure we put that in the show notes so that everybody that's listening can have access to that. I'll definitely get myself a copy of the book. I can't wait.

Craig So appreciate it. Thank you so much. Have a fantastic day.

Richard Yeah, yeah, yeah. Thank you too. Take care.

Intro Thanks for tuning in to the Industrial Cybersecurity Insider to stay up to date with our latest episodes. Be sure to click the follow or subscribe button now, and if [00:38:00] you found this podcast helpful or have a topic you'd like us to discuss, please leave us a review or let us know.

Intro Thanks again for listening. See you next time.