Amy Ciminnisi 0:00

Welcome to the Talos Takes Podcast, where we discuss Talos' latest research and security news. This podcast is for everyone, from the C-suite to the front lines.

Amy Ciminnisi 0:12

Welcome to the special Cybersecurity Awareness Month edition of Talos Takes. Last week we talked with Martin Lee on AI honeypots and various impediments you can deploy to stop an adversary in their tracks or make their life a living hell, whichever.

Amy Ciminnisi 0:30

But today we're talking about one of the holy grails of security architecture, network segmentation. We all know that limiting an attacker's movement in your network is critical, but moving from theory to reality there is where things start to get complicated.

Amy Ciminnisi 0:47

I am joined by Craig Jackson from Talos IR today to talk about how to move past these definitions, identify practical starting points for your team, and turn segmentation into a tool not just for prevention, but also for incident response. We'll also be touching on an emerging topic that is gaining steam, AI kill switches. Craig, how are you doing?

Craig Jackson 1:11

I'm well, Amy, how are you today?

Amy Ciminnisi 1:13

Doing pretty well. Recovering from a cold, but we're making it work.

Craig Jackson 1:18

You couldn't tell. I mean, your voice sounds perfectly fine to me.

Amy Ciminnisi 1:21

Thank you so much. Appreciate that.

Amy Ciminnisi 1:24

So this is a really cool topic. And I think as someone who is newer to cybersecurity, it seems like the word segmentation is everywhere. People are throwing it around. Um, but there are varying degrees of segmentation, right? So you have your network VLANs on one end, you have micro-segmentation on the other. Um, how do you identify which approach is going to work for your team?

Craig Jackson 1:50

That's a great question. And it's it's one that is going to vary by organization. So when whenever we talk about controlled deployment from a proactive or preventive perspective, we don't just want to recommend, you know, bias, you know, creating a bunch of budget, buying a bunch of tools that look really cool, and then just kind of like throwing them haphazardly into the environment.

Amy Ciminnisi 2:14

Yeah.

Craig Jackson 2:14

You always want to start out with foundational practices like threat modeling, risk assessment, um, asset management, which I talk about asset management more now as an incident responder than I have in the past as sort of a security analyst um or an auditor because it's so critical to understand where things are.

Craig Jackson 2:36

So once you have that understanding, that preliminary understanding of what's in the environment, where it is, what needs to be to have the most protections afforded it, then you can start laying out, okay, we need network segmentation at this point, or we've got a cloud control over here. So we need to have workflow segmentation or or micro segmentation here. Mapping out that sort of understanding will give you the most effective approach to what type of segmentation needs to be layered and where to fully implement that as a effective control.

Amy Ciminnisi 3:12

Right. And as an incident responder yourself, um, you know that segmentation is a really great preventative control, but it's also really useful for response when you're mid-breach. Um, how should teams be planning for segmentation um to contain a threat and you know, not just a way to design a network?

Craig Jackson 3:38

Yeah, that gets into the discussion of something that I like to call immediate containment actions. So when when we come into an emergency response situation where there's an investigation taking place because of a security incident or a suspected security incident, you don't necessarily want to wait until you're so far through the incident response life cycle that you're at a point of, okay, now we have we're comfortable with with what's going on, we understand what's happening, let's put our containment in now.

Craig Jackson 4:08

Typically, there's going to be that immediate containment, like, hey, we see these five systems are exhibiting this indicator of compromise or this type of suspicious activity. Let's isolate them, let's let's you know get them off of the production network so we can investigate what's going on there. So preparing for that immediate containment action and being able to implement those types of things is is critical. And it's not always easy because if your immediate containment action is something like let's disconnect from the internet or let's shut down an entire segment of virtual machines or virtual servers, there's going to be some definite operational impact to that type of approach. So planning for the segmentation, it's really important to make sure that you're looking forward to understanding what those impacts could be, where you might be able to implement that segmentation as an immediate containment action and understand who has the authority and the process to put those that segmentation in place.

Craig Jackson 5:19

I will add that um when it comes to segmentation in turn and immediate containment in terms of tiers, we we recommend kind of like a red, yellow, green tiering for our network segments when we're trying to respond and recover from a security incident. And it it can help an organization, either visually or conceptually, to structure that as you know, your red segment is known compromised or high confidence compromised systems that you don't want touching anything else. So you you kind of put those all in a specific segment. Um, from a yellow perspective, you looked at that as maybe these are systems that are remediated, but you still want to keep an eye on them to make sure that that your remediation is effective and that the adversary hasn't left any persistence or anything like that happening on the system. And then your green segment would be your production environment.

Craig Jackson 6:14

And every organization is going to have their own way of approaching this. But the idea here is you're using your segmentation throughout the incident response and recovery process to make sure that the adversary isn't able to, or the malware, whatever is the situation you're dealing with, isn't able to compromise or re-infect those systems. So again, it's it sounds like it it could be an something arduous to put in place or an arduous approach to take, but the organizations that take the time to lay out and map out that type of segmentation, either at the network level, at the host level, at the process or application level, are the ones that are going to naturally be able to put it in play uh more efficiently and more effectively during an incident.

Amy Ciminnisi 7:01

Yeah. And honestly, um, one of the biggest hurdles that I constantly hear from uh guests on the show is visibility and that you you can't segment what you don't understand. And so how do teams tackle this? You know, especially ones that may have inherited um systems from previous employees, they're plopped down in the middle of nowhere. Um, how how do you tackle this discovery phase? It sounds so difficult.

Craig Jackson 7:32

Yeah. Have I have I mentioned asset management and asset inventories before?

Amy Ciminnisi 7:37

I think so, maybe once or twice.

Craig Jackson 7:39

Yeah, yeah. I always feel like the least popular person in the room. I mean, you can actually see people's expressions just like sour towards me when I bring this up when I, you know, public speaking and stuff.

Amy Ciminnisi 7:50

It's the boring stuff that makes a difference.

Craig Jackson 7:52

That's true, it's true. And it, you know, it it it applies here as well. So historically, there's a manual approach to this. I mean, you could theoretically use things like Wireshark or TCP dump or you know, a couple other, I suppose, freeware utilities to try to map out traffic flows. But you know, nowadays there's all kinds of commercial applications that will really accelerate an organization's ability to understand what traffic is going where, traffic volumes, you know, establishing network baselines and things like that. Um you know, being Cisco, I sort of think of secure network analytics, I think of like Thousand Eyes, but you know, there's other many other commercial utilities out there and commercial tools that that organizations can drop into place. And and that that's really what you would probably want to use to try to identify this. And I I use the term baseline to step and go, and that's another important thing, especially as we look at the potential for data exfiltration during incidents or getting into agentic malware and some some AI-enabled attacks, if we're seeing gigantic spikes in traffic volumes and things like that, you want to be able to detect those types of anomalies, both in the directionality of traffic as well as in fluctuations in traffic volume.

Amy Ciminnisi 9:16

So micro-segmentation is notoriously pretty difficult, right? Um, and so if if a team realizes that that just isn't possible today for them to do, they just don't have the capacity, what should they prioritize first? Is there, you know, low-hanging fruit that can give them a bigger boost to their posture, or what what suggestions would you have?

Craig Jackson 9:41

I would propose that that would vary by organization. And I want to be careful not to make general statements because you know, if I just say, like, hey, this application server or this file server, you know, make sure you understand traffic flows from here and segmentation around these, that might do a disservice to other organizations where that's not as much of a priority. So I mentioned before some of the early steps for understanding the security implications in your environment, like threat modeling, uh, risk assessment, security control assessment, data criticality mapping, all that kind of stuff. That is going to give you a strong foundation to understanding where you need to put protections in place, such as segmentation and micro-segmentation.

Craig Jackson 10:27

And you also, as an organization, likely want to consider regulatory and contractual requirements as well, because there are certain um, you know, regulatory security frameworks that are going to actually stipulate, hey, you need to have segmentation in place, and it it should probably look something like this. It's not going to be granular, you know, it'd say specifically around application servers or domain controllers, things like that, but it's definitely going to say you have to have network controls and segmentation in place around this type of system at this point, you know.

Amy Ciminnisi 11:05

So let's move on to a topic that is tangentially related, uh, but that you've mentioned that you're hearing a lot of buzz from uh customers about, and then also on online forums, things like that. Um, we're seeing a lot of interest in AI kill switches. You describe this as controls designed to quickly contain or stop AI-enabled adversaries, um, or even legitimate AI applications that start behaving erratically. Um, let's uh talk a little bit more about this.

Craig Jackson 11:43

Yeah, so this is a topic that over the course of the past few months, more and more of our customers seem to be bringing up. And you know, at first it was kind of like, oh, this is that's unique. Haven't really thought about that before. As as we continue to move further and further into the AI era, I guess it's gonna be coming more and more more and more commonplace to talk about this. But um, this is something that we we've seen increasing interest in. And it it kind of gets phrased, and maybe I'm biased as an instant responder and a threat intelligence professional, but you know, it kind of gets phrased around something like an immediate containment action, where a few different circumstances or scenarios you might consider would be, you know, a threat actor dropping agentic AI malware in the environment or a uh malware that is AI augmented, I guess I could say. You could see, you know, an AI application that is either developed by the organization or is has been contracted by a third party and is used in the environment, maybe exceeding its access or going places or doing things that it's not necessarily supposed to be doing by default.

Craig Jackson 12:54

And the concept around all that is since these applications and this malware is potentially moving at machine speed, how do you get out in front of it quickly and implement that that kill switch or implement that containment action? Because with a with a human speed attack, hands-on keyboard, you know, human threat actor, you've got maybe a little bit more of a window to drop an immediate containment action in place to kind of halt the progress of the adversary in the environment. At machine speed, your your window is a lot more narrow for making yeah, you're you're you've got to do that a lot more quickly, and you've you've got to be arguably more confident that when you implement that, it's going to be effective because second chances are going to be probably few and far between.

Craig Jackson 13:41

So that's kind of where our customers are and and some of the organizations that we work with are going with that particular topic is exploring this in advance because it is still such a nascent idea in terms of you know putting these types of controls in place for AI, uh, and then understanding, you know, or or maybe mapping out and documenting what their internal approach would be to implementing those AI kill switches.

Amy Ciminnisi 14:13

I'm I'm curious, would like strong segmentation kind of widen that time uh that that gap up enough for um defenders to be able to deploy a kill switch more? Like I'm thinking about like you were talking about the speed of agentic malware or things like that. Like how how does segmentation come into play here?

Craig Jackson 14:39

It certainly could. The challenge there is it's tough to answer that unless we are we're saying, okay, are we talking exclusively about network-level segmentation? Are we talking about host-based isolation, which is, you know, again, kind of a form of one-off segmentation? Um, or are we talking about something at the application or workflow level? So it's it's certainly possible and and likely that segmentation could impede an an AI augmented attack, but the question is for how long? Um, you know, if you're not necessarily directly addressing the AI component of that attack, how long will your other compensating controls remain in place and remain effective before that that pseudo autonomous malware or or threat actor is able to circumvent or bypass or or overcome that particular control?

Amy Ciminnisi 15:38

And then also let's maybe talk about the like the collateral impacts too. Like you said, second chances could be few and far in between. And you know, you really want to make sure that the switch is doing what you want it to do. Um, so like if you are talking about this as, you know, an immediate containment act, what are these collateral impacts that people need to consider?

Craig Jackson 16:04

I think they'll probably be similar to what we would see with an immediate containment action. And, you know, I alluded to two examples earlier. I think shutting down or heavily segmenting an entire server network uh you know or VM infrastructure to protect it from an attack, and also disconnecting from the internet, which is something that we see organizations either considering or in some cases actually going through with just completely severing all ties to the internet. Those are going to come with operational impacts, both internally, and if you're you have customers, if you have vendor partners, things like that that that need access to your resources, there's going to be an impact there as well. And also, people are probably going to take notice in the news media and you know, in the public that hey, this this entire company's infrastructure suddenly is offline. So um, there's different levels of impact, both operationally and reputationally, there that need to be considered.

Craig Jackson 17:01

The same is probably going to be true of an AI kill switch eventually. As AI applications become more prevalent in the operational environment for enterprise organizations, as more and more applications become dependent upon AI workflows and processes, dropping a kill switch into place, just like I alluded to with a with an immediate containment action, is probably going to have similar outcomes where there's going to be an operational impact in the organization and potential reputational damage from people sitting up and taking notice that something weird is going on as well. So, you know, I would argue that some of the things that we're discussing with customers right now and and should be considered as we continue to work fully work through maturing AI kill switches is you know, what are the the best locations in the environment to deploy them? Uh, do additional tools need to be deployed, or can we leverage existing security controls as part of that effort? Um, who has the authority? Just like with an immediate containment action, who has the authority to activate a kill switch? And are there thresholds that need to be met before that type of action is considered as a security measure? Um we already talked about operational impact, and then documenting all of this as part of your IRP, testing it, making sure that it's just it's not metaphorically sort of shooting from the hip, if you will, um, with your with your security controls, making sure that the team understands how to use them, what they're for, how to implement them, and and what that authority and that potential impact might be from deploying them.

Amy Ciminnisi 18:48

The former tech writer in me was so excited when you said documentation. And also just like looking at all the incident response plans that I get my eyes on day to day. Like, if this is something that is newer to your organization and you're considering putting something like this into place, like don't wait to get documentation down for all of those things that you said.

Craig Jackson 19:13

It makes a difference. It makes it we see it in in our investigations and our emergency response engagements. We see it in tabletop exercises. It's very clear when you sit down with a customer for a TTX and you ask a question, let's say it's about immediate containment actions or AI kill switches or any type of defensive measure like that, it's very clear which organizations have it documented, they know where to find that IRP, and they just spell it out for you immediately versus those that maybe struggle with it a little bit more. Or it's maybe it's more clear that it's an ad hoc process that that isn't broadly understood across the organization.

Amy Ciminnisi 19:54

Any any final words of wisdom for our listeners?

Craig Jackson 19:57

Oh man, I didn't know there was gonna be a words of wisdom question. No, I mean I could I'm sure I could go off one wild tangents about things that we're seeing across the threat landscape right now, but I think preparation, take your preparation steps, don't wait until it's actually happening and you're in the midst of an incident to figure this stuff out.

Amy Ciminnisi 20:14

Well, thanks so much for coming on today, Craig. Really appreciate it.

Craig Jackson 20:17

Thank you, Amy. Appreciate it as well.

Amy Ciminnisi 20:19

Yeah. Thank you so much for listening, everyone. We have a ton of Cybersecurity Awareness Month content out and even more headed your way. So check out our blog, blog.talosintelligence.com, for our latest posts. Stay safe out there.