Speaker Spotlight: Ryan Smith - The Control Plane Awakens

[music] Hey everyone, I'm Steve, a volunteer director at large with the Vancouver Island Security Research Society. We're getting ready for BSides Vancouver Island, a community-driven cybersecurity conference happening Friday, September 25th, 2026 at the Victoria Conference Centre. This year is our fifth anniversary and for the first time we're proud to announce that we'll have two talk tracks with even more great content for the community. Today I'm joined by Ryan Smith, one of our speakers and a founding member of the Vancouver Island Security Research Society. Ryan is a senior security researcher at Microsoft. His work focuses on threat research, detection engineering, incident correlation, Microsoft Defender XDR, and applying AI to some of the messiest problems in cybersecurity. His talk is

called The Control Plane Awakens: How Attackers Are Taking Over Network Edge Infrastructure. Firewalls and VPNs have always been important security targets, but today network edge infrastructure does much more than control access. It can sit directly in the middle of identity, authentication, session management, and security policy. Ryan's talk explores how attackers are moving beyond using edge devices for initial access. They're increasingly treating them as long-term operational platforms, places where they can up observe authentication, maintain persistence, and influence how trust is enforced across the enterprise. And when Ryan isn't investigating detection gaps or writing what is probably far too much Kusto, you may find him coaching youth wrestling, fishing in the back country of British Columbia, or working on a side project that somehow becomes a 6-month commitment. Ryan, welcome. It's great to

have you here and great to have you on this side of the interview table. To start, tell us a little bit about yourself and what drew you towards detection engineering and edge security. It's weird to be on this side. Usually I'm I'm hanging out with you doing all this type of work. So, uh you know, it's funny to have the shoe on the other foot, I guess, is is the term. Yeah, what what drew me into where I'm at now with detection engineering XDR at Microsoft. Long story. I've been in the industry a long time, as you know, uh like 20-plus years. Been here on Vancouver Island most of that. Just grinding away. Was in security before it became a thing and

I I got really into firewalls early in my career. Cisco PIX firewalls uh were kind of the big ones and I I got, you know, fell in love with the Cisco firewalls. Uh but Check Point was a thing back then and and all of that. So, that's kind of where I was starting my career and I was working for a great company here on Vancouver Island as a director of security and I think I think Microsoft got tired of me, you know, always giving them suggestions uh of how they can improve their product and you know, I got kind of drawn into the dark side of working over at Microsoft to in in our security research org, uh specific area around XDR and Defender. So, that's

how I got my start into the space and been kind of there ever since for the last 5 years working on a lot of the detections that we see in in XDR, Defender, some stuff in Sentinel, and and trying to tell like a really good attack picture for our customers and and clients so that it's not a big, you know, effort to figure things out. My first SIM was ArcSight. And it was like the IKEA of of SIMs. You guys had to build it yourself and you know, it was always a little bit wobbly at times cuz you didn't tie the right screw or put a handle on backwards. So, you know, I love being able to build these for customers to bring that view in specifically. And

now I'm taking kind of my my XDR research and my passion for firewalls and and kind of merging it together into some of the research that I've been looking at kind of the frames of talk. Well, that's great, and uh Microsoft is lucky to have you. Let's get this thing rolling. We've got a few questions that we have queued up, and you've agreed. Now, we're not going to give away the whole talk, but uh there we are. Uh so, your talk makes the point that attackers aren't just trying to break into edge devices anymore. They're trying to become part of the edge itself. What does that actually look like in the real world? Yeah, you know, when we started in the industry,

and I remember like years ago, like if you could breach the firewall, you were in, you know, that was like the cool thing. It's I think, you know, hack the firewall. Or I had You know, people would always talk about having the the unhackable firewalls. That was the joke. And then, you know, when we were security professionals, we were doing pen testing and and things like that, we were focused on compromising that firewall to get access to the network. And it it was just an egress point. That's all it was. It was It was opening a door. Not even necessarily landing a beachhead, as per se, but now, you know, years ago, when we started in technology, when we had branch networks and we had all these different sites,

you know, we backhauled to a central data center, you know. So, we didn't have firewalls in all the branches. We didn't need to do authentication. We didn't want to have domain controllers everywhere in all of our sites. And and firewalls kind of a lot of the manufacturers of next-gen firewalls kind of got attuned to this and started building in like authentication pieces there, so they they could authenticate. They could do lots of different things, you know, the VPN access, all of that. And they kind of become like this core piece of the infrastructure. And what we've noticed over the last couple years in some of these attacks, especially from nation-states, is that they they are leveraging the firewall as their edge device as their control plane on the network.

You know, so they're injecting themselves. They're viewing all the traffic coming in and out in the in the network. They're they're creating accounts if it's got authentication abilities kind of built into that. They're authenticating especially in the VPN, you know, getting access to the VPN and then they're doing that or leveraging that VPN as a jump-off point somewhere else. So, they're living off the land in that respect and they're using these firewall devices as them. And they're not necessarily compromising them through traditional means like we used to see with brute forces back in the day. It's it's a little bit different now and and how the approach is. So, that's kind of what we mean about like attacking that control plane.

Thank you. That's that's great. Definitely living off the land is is something that we see more and more. Second question. Compromised firewalls and VPNs can give attackers visibility into authentication flows. We just spoke about that a bit. Sessions and network traffic. What can defenders miss when they rely mainly on endpoint and identity tools? Yeah, I think that first really, you know, other big tool that we had you know, in our in our toolbox when we, you know, you and I started the industry was you know, endpoint EV. You know, we had that and we had our firewalls. Those were kind of that was security then. But, you know, as SIMs and XDRs have kind of evolved over the years, you know,

we're bringing in all other cloud you know, cloud telemetry. We're bringing in our you know, defender or or like you know, DLP telemetry or you know, our Microsoft Office or Google Apps telemetry. We're bringing all this telemetry now into into our detection platforms. And and you one of the things is looking at, you know, we take a look from a firewall perspective or an edge device perspective at the traffic that goes through. That's kind of our traditional monitoring. But, we are often losing sight of actually monitoring the firewall itself. You know, what are you know, what is the who's authenticating against it? You know, what are kind of the file traversals or path traversal that it's interfacing? You know, what's happening to

the device? Are we logging that device at all? And I find a lot of a lot of customers and a lot of people that I know don't actually log that part of their aspect. They like yeah, I log the firewall, but you log the firewall traffic. You log what's happening going through that firewall. But are you actually checking to see if your firewall has been compromised or if somebody is trying to, you know, run a remote code execution on it or something like that. Like that's what we we're starting to see this this gap happening. And when we're seeing these firewalls and these VPN services compromised, a lot of times they aren't monitoring that. And it does exist, but it's

actually a gap that a lot of customers just fail to think about because they they think oh yeah, I'm monitoring the firewall. Yeah, I'm monitoring traffic, monitoring, you know, the firewall logs that we have, not necessarily the firewall itself or the edge device. Yes, I'll I'll be doing something after this interview. Number three, for organizations that can't replace or completely redesign their edge security stack overnight, what is one detection or monitoring improvement that they could make this week? I don't think a full stack re- you know, redesign is needed for for most organizations to cover this area. It's just looking at your coverage around detection. So, you know, making sure that we're logging you know, activity on those firewalls,

admin activity on those firewalls, even things simple as simple as restarts and updates. Making sure we're just logging that and we're monitoring that actively and when we're seeing that behavior, you know, I remember a long time ago you could have to you had to go to site to get to the firewall. Like you had to get in your car and drive to the site and plug it in and do your configurations. We hated it. Did you bring your console cable? Did you Does your console cable work? You know, like you forgot the serial adapter, right? Like that was always the thing back then. But now, like you know, we kind of moved into having, you know,

you know, support VNATs and stuff like that to do that and air gaps and then now a lot of these firewalls are connected to the internet. You know, so, you know, those those doorways are there for the knocking and make sure that we just monitor them. You know, and kind of the basic things of of that because when we've seen these device compromises, the tells have actually been pretty obvious in the the log telemetry that we've analyzed on these devices. Okay, that that was great, Ryan. Thank you. Final question, this one's a bit of a bonus. Beyond the technical content, you're also one of the people who helped build the Vancouver Island security community. And I'll personally thank you for that. What advice would you give to someone

who is thinking about attending their first conference or giving their first security talk but isn't sure they belong? That that, you know, belonging is a huge thing of of why we built this is to make people feel belonging and I I remember our core group when we used to go over to the B-Sides in Vancouver. That's, you know, shout out to Alex Dow and and the crew that started that event because that's in reality where our community was. You know, we all felt attached to this Vancouver community. You know, so Dom and Sandy and and everybody we'd be over on the ferries heading over to B-Sides Vancouver cuz we would coordinate it and we'd sit there talk like,

"Hey, like I'd love to have like why can't we do this in Victoria? Like I'm tired of taking the ferry." You know, we love B-Sides Vancouver. They're the cool crew over there, but you know, we have a lot of talent, a lot of really exceptional people here on Vancouver Island. So, you know, y- it doesn't matter, I think, what your your technical level is. If you're doing research at Microsoft in in XDR or if you're working at a help desk for government, like the there is a place at B-Sides for you. You know, we all weren't born experts. We weren't all born at these levels we're at. We learned a lot of what I attribute my career successful to is B-Sides in general,

you know, be it Vancouver, Victoria, Seattle, Portland, a lot of these events that I've gone to. Um because, you know, I met all these great people, I've taken all these talks, and I and I have these connections in my friendship group. You know, all of my best friends in technology come from BSides Vancouver Island. You know, and we now hang out we have a group up Island now that we hang out with up here in Duncan, but you know, so it's building that good sense of community, but I think one of the great things that I've loved about the the island scene is I think A we have this island personality that's a little bit different and and we can be we're always

accepting everybody. It doesn't matter who you are. You know, is like don't be if you're coming into this for the first time, like it is okay to be intimidated cuz we have some absolutely brilliant people here on Vancouver Island, you know, and one of those people I always think about is Tanya Janca. Um and I think most people in our industry know Tanya. I have the fortunate to be a friend of Tanya and and you know, I listen to her all the time and you know, she's a rock star in our industry and and we have rock stars in our industry at this conference, but don't be afraid to go say, "Hey guy, I don't fit in here. I don't belong because I'm not a rock

star." Well, we're not all rock stars. We're all just here to like have fun, give back with with zero ego. I think is is the big thing and and be welcoming and just be yourself. You know, be you know, we have it on our our banner. Just be awesome to each other. I think Bill and Ted said that in one of their movies, you know, or be excellent to each other. I think that's the term that he uses. I think that's what we have there, but yeah, just just come and have fun because it's it's chill. And we've been really good this year that we have these double talks tracks. You know, and I as you know, I've been pushing for double tracks for years is cuz I want to say like,

"Hey, like if you want to go dive into AI and maybe some type of like memory attack, that's there for you. But if you're getting new in here and you want to learn like, you know, how to become a better security person, there should be a track there for you. You know, and like that's the beauty about it. And if you're coming to speak for the first time, like this is the first time that I I've been so busy planning conferences that I haven't actually, you know, put in my hat and I put this talk in as the backup of as you remember. And and guys all dragged me kicking and screaming into delivering this one for everybody.

But BSides, when the BSides movement started many years ago in Jack Daniel's out of Las Vegas and and all them that original crew, it was meant for people who are just getting into this. You know, to hey, like I want to give a talk and like we've had people over the every year we have somebody that's this is their first talk. You know, and it's to build that confidence for themselves and and like yeah, sometimes you stumble through talks. That's okay. Cuz it shouldn't this isn't about, you know, finding a $10,000 an hour speaker uh for BSides. This is about bringing the talent that we have here in Vancouver Island, you know, the Pacific Northwest, to the forefront and giving people that opportunity that may or may not be able to go to

Def Con, you know, Black Hat or RSA to to have a have a chance to talk. And that's why we built it. And this amazing community that we have that you're part of as well. Ryan, we'll leave it at that. Thank you so much for joining us and for giving us a preview on your talk and a bit of a background. I think attendees are going to leave with a very different perspective on what it means to secure the network edge and also attend a BSides conference. If you'd like to hear the full session and join us in Victoria, visit bsidesvi.com to get your tickets. They're selling fast. And if you purchase your ticket before Monday, August 24th, you'll receive

an exclusive custom-designed BSides Vancouver Island t-shirt in the size of your choice while supplies last. I know last year they flew off the back shelves. And we have another banger this year. Uh shout out to our other colleague Tao for designing that. Uh you can also find links to all of our social channels on the website. Follow along, join the conversation and use #BSidesVI in your posts. We'll see you Friday, September 25th in Victoria. [music]