Supported Isn't the Same as Safe: Legacy Assets And the Enforcement Gap - Mateusz Madrzynski

Yeah how I'm first third year student. He was handing me to take a photo or his probably posts. But yeah, let's get on to it. So start off with is probably going to be a 15 minutes 5 minute Q&A. Please ask questions at the end because it will get my train of thought for dwa completely. Uh other than that, let's get into it. So November November 2023 uh 40% of Australian uh port trade was completely shut down for a bit and just say thousand containers stranded over in part of Australia. They couldn't move anything in or out meaning a lot of money was lost. They didn't say how much. I try and check I couldn't

find a figure but considering how it's portked and the whole supply chain issue supply chain probably a couple million or maybe more but it was a vulnerability that was sitting uh available for 21 days Citrix speed uh it was a session hijack and a MFA bypass as well. So luckily if I remember correctly, let's go on. I'm skipping ahead. I will skip ahead. But uh it was known ability for patch it. Uh they knew about it. It was known to the public as a export that was being currently exported by threat actors by I think two groups of different uh ransomware. It was one of them was bin 7. I can always remember I can't remember

the other one. Uh and it was sitting there available to the public. They didn't patch it. Didn't catch it. Uh and yeah, this whole talk was about this enforcement gap. Some of it is being fixed nowadays, but yeah. Uh no problem. I skip the head of why this is interesting to me. Uh, and before I blame anyone, what is the reason why people don't patch, which is completely valid, there's the whole friction issue where the whole friction issue where you've got specific deadlines, you have to do for maintenance, you have to uh maybe you have to do several weeks of testing to make sure the patch doesn't break anything down the line or just anything

that maybe business people don't want to patch it because they don't want to spend that amount of Uh but

uh we'll stop [clears throat] uh

uh asymmetric asymmetric risk. This is more business level where the upper level management uh sometimes have the false idea of certain patches shouldn't be applied because either there's uh a whole issue of production probably breaking. There's maybe some monitoring reasons they don't want to do. Uh the breach whilst could happen. It might never happen. It could be in 10 days. It could be never. So they kind of view it in a crooked sense of uh it might happen, might not happen. I'm going to have to spend x amount of money to fix this issue and I don't really want to do it. And above one is safety and like safety trap where the for OT and like fabric for

OT medical fabric uh factories they have specific certifications and warranties that they have to listen to and they can't patch without doing the prerequisite testing either uh validating the safety again all that kind of stuff. Uh and that kind of situation last month if if they don't have a digital twin because you talked about it yesterday digital twins kind of going more into the mainream making their digital twins to test out the patches before they go out which is good. saves a bit of money, saves make sure that uh patch doesn't break anything or doesn't break million pound equipment which is hard to replace and will be you being screened that by your CFO or the department and then

there's whole issues regarding maintenance companies have quite strict requirements on because they work 24/7 the production facilities can't stop otherwise they will impact other companies down the that will impact their bottom line, the amount of money they produce. So they normally have like one to two maintenance windows per se where they output a lot of patches per time. And from some little research I did, any downtime they have, 74% of it gets above 100K per down time and then 20% gets above a million, they have downtime, which is not scheduled correctly. So, a patch that's released on like March might wait until October to be actually applied if it's not uh risky enough, let's say.

And one thing I was looking at was uh VM I'm not going to say how I see the number that had the a free patch available March 193 and then uh it was distorted within weeks and by Cuba 7 and it was still hit a year on. So at that point you have to figure out why is it still not patched after a whole year of it being known it being known that this vulnerability is being used and currently exported by actors. So this is that's why was it not patched when it kind of should have been by that point. Uh, and there's some stats I've looked at and 60% had just unused, unapplied, and most guidance that is current.

There's some that is musts, but most is a should, not a must. There's federal rules like in the US that have specific sectors that only apply to med uh medical uh critical infrastructure but don't apply to let's say retail or just use retail as an example. Uh there's everyone hates the AI thing but >> recently website and it under >> it means time for exploits >> people are finding exploits before the CV are ever public which gives us much less time to actually fix these issues. So in the past in back in 2018 time for three years now it's ever so slightly gone down all the way to the levels which whilst most companies work on a slower

paces and just put a bigger and bigger gap upon it but I'll go past this topic because yeah just say I don't want to talk more about it. Uh what we can do to actually fix these issues. Uh some of this I'm going to talk about is currently being applied in the US uh to actual uh laws and regulations. So let's start with the first one. the CISA key and PS and uh key is basically a catalog of currently known and exported vulnerabilities that are being used by threat actors actively in the wild. So everything on that list should be something threat actors are actively using in the wild as well. So we have you have we have exports ready. They can

use them whenever they want. They can attack your company. They figure out you have the wrong patch applied. It's very easy to be like oh they don't have that patch. You can quite easily hit them with this specific thing you have on the disc and they can easily break in. And uh EPS is more probabilistic. It's the probability a patch that CV will be exploited within the next 30 days. This get gathers information from the public from certain sources on uh looking into the chats that proctors are talking in and it uh takes all that data and sets say between zero and one value where it's like oh it's more likely to be actually used in

the next 30 days. you should prioritize it more than these several thousand other vulnerabilities that are not being exploited currently. There's no explosively. Uh and it just cuts down that huge amount of noise that we get every time a new go out to the public. And this is now being like I said federal policy. E O D 2006 264 how to use in the US basically where it states oh you have to start patching by exploitation not by uh severity because severity you could have a 10 but then like to get to that exploit you have to do 10 other small steps which are in very hard to get to. You would more likely want to

produce a very well-known textbook that is currently being used by a threat actor to actually breach active systems than something that could whilst maybe being used in a lab being built slowly. But yeah, EPI EPSS does not track any zero days or nation states. Why? Okay. It does not have that capability, but it's a good way to see. And then let's say you've got uh patch you want to do you before you want to do a private patch, you got a couple weeks of testing you have to do. Make sure it's doesn't break your system. Then whilst you do that, you may want to look at what the CV states is. uh initial access vectors and either if

you can block it off at the network level or just disable the ports that you can disable just to like just close that gap whilst you make the changes you need. And then if you can't patch it because some systems you have there's no patches for uh you know they're vulnerable, no one's made a patch for it, can't get a patch. The best next thing you can do is segment it. segment it in a VLAN or separate network and that's the best you can do have like an MFA jump host onto it and that's pretty much the only option if you have a OT system or an IC system that cost would be you can patch but then you have

to buy new equipment new systems you have to wait for new set of warranties just takes a lot of money instead you can just uh segment N states that's one thing you can do. Uh IC also says you can also do that. There's seven minutes left. Wait, no, that's good. Uh so whilst there's thousands of thousands of CVs being posted each year, not all of them are exploited and not all of them are used. Some of them are low severity. You don't need touching and you just apply the patches in the usual maintenance windows you have. while some in the key TV catalog that says, "Oh, this patch, this CD is being currently used by X uh for active group for this

kind of behavior." Ransomware, which can cost you millions, thousands, and potentially a lot of money because you lose a lot of operating time if they get into your systems. Like recently there was the we love the retail acts that happened and the new newly proposed changes to the UK legislation correctly don't include retail as a sector to hold to those negative impacts. So some people want that change. I would like that change. It should be more of a kind of global not specific sector I would say because that just incentivize people to not delay those patches for longer than they should longer than whilst a couple months may be justified. Waiting a year or two to actually patch

these systems is kind of a why haven't you done it already? you have one to two years of time to actually do this. You could have done it in X maintenance [clears throat] window very easily. So shield before you do any systems before you do any patches whilst waiting for patches to go through the process. Shield it a bit. close it down. Close certain vectors in it vectors and if you can't update it, just compose it with segmentations and yeah, I would say that's pretty much what I want to kind of tell you. Uh there's an equivalent there was just Q&A my LinkedIn done with me but you should see my face. I don't have

red hair in that intro. I don't I need to update it. Uh but yeah, any questions you have please go for us. That's

awesome.

Yeah. >> Uh the general guidance for infrastructure is try to segment

uh segment as much of systems as you need. So let's say example plastic molding machine and a should not be the same system

and then the first question and issue of supply chain acts. uh forgot to talk about [clears throat] uh but I I mean it's the dependency I suppose new updates versions most companies do that kind of delay patching where they test out patch and we like check by

or any incences of being broken into leaving holes. Is that me? Yeah.

So time is basically since the CV was CV was recorded to the time was uh some so publish

SQL number 26 and then someone on the internet and then they write it and that's the island. So five days and then in 201 >> 18 it was two years. >> Two years. Yeah. Two years.

>> They may have a patch but they not

measures and this negative time differential now basically means that uh people are making

no

you can see the kind of trend it's kind of tapered off a Uh, it might slowly slowly slowly

software. So software

nowadays because AI is more and more

and then always

question.

some uh laws make you get fined. >> Well, one of them uh I think it's EU it's think 2% of global turnover or 10 million euros for like a vulnerability you haven't got corrected. So they look into it like oh you didn't patch it correctly you didn't patch it within the set time but like oh got 31 days to patch these types of vulnerabilities. Oh, you just have to pay attention. You'll find all your big company which Amazon would hurt if they did that

>> at one time. I'm sure you Thank you. >> [applause]