Ep. 347  How Fake Job Applicants Threaten Federal Cybersecurity Today

Speaker 1 0:00
Hey, John Gilroy here. Zero trust addresses the porous perimeter problem. Today, we’re going to move the perimeter to the resume. Hit the music, Manny. Welcome to the Federal Tech Podcast. My name is John Gilroy. I’ll be your moderator. We have a rare face-to-face interview here today with Patty Titus, field CISO for Abnormal AI. Patty, how are you?

Speaker 2 0:27
I’m great, John. Kind of a noisy

Speaker 1 0:29
place here. We’re recording this from the floor at Burlington Cybersecurity Summit. What a lot! 4,600 people, huh?

Speaker 2 0:37
Yeah, that’s a lot of people here for sure.

Speaker 1 0:39
Wow! But 250 speakers, 50 presentations. You were part of it, weren’t you?

Speaker 2 0:43
Yeah, I did a couple presentations yesterday, about four more today. So it’s been kind of crazy. Love it.

Speaker 1 0:49
I’ve been here for two days. I’ve sat on all kinds of all kinds of keynotes and beginning speakers, FBI, CIA, everyone. But this topic I want to dive into with you is a brand new topic for me, and to tell you the truth, I don’t even know if I understand it at all. So let me get this straight. So, moving from the perimeter to the resume, what you’re telling me is that a North Korean operative spent months working inside a federal agency as an authorized employee. Tell me it ain’t so.

Speaker 2 1:22
Unfortunately, it’s happening all the time. So it’s it’s much more pervasive in the private sector because we hire remotely, we interview remotely. The good thing is the government is back in the office full time. The unfortunate part is they rely heavily on contractors to support them.

Speaker 1 1:43
So I remember I was living in Fairfax, and a high-level government guy was living next door to me. Somebody knocked on the door and wanted to know about him, get a referral. This guy didn’t work for the government; he was just an independent contractor. I mean, so there’s a lot of loose flexibility in this, isn’t there?

Speaker 2 1:59
There totally is, John, and that’s part of the problem. There’s a gap right at the scene, and we’ve got to raise awareness to it, and we’ve got to start educating people about

Speaker 1 2:08
it. I was at your presentation yesterday, and you dealt with many different topics. But at the end, they said they turned to you say, “Patty, give us some advice for learning more about this. And you said, “Well, you know, the listeners got to get smarter faster. So it’s that we have to learn about the situation where people just aren’t vetting people properly. How can you get smarter faster in a situation like this?

Speaker 2 2:32
Well, I think this is this is a problem where we’re not talking to each other. When you hire someone who is not who you think they are. They’re using synthetic identities. They are using deepfake technology to get through the interview process. When you’re hiring somebody in a foreign country that’s in a sanctioned country, the problem is you need to. First of all, you don’t want to hire them, but you need to have a partnership with HR. HR looks at it and says you gave a foreign national access to our systems, and the CISO might look at it and say you should have found him in the hiring process. Background investigations aren’t working. It’s very easy, and we can get into that. But if you can imagine a foreign operative living in a foreign country, interviewing and going through the whole process, and then he’s got a counterpart. He or her has a counterpart here in the United States, and that person in the U.S. is setting up a laptop for him in a laptop farm, is actually going to their background investigation in person, interviewing, actually doing their drug tests. So they’re passing all the checks. So how do you find them before they get access to your environment, and that’s where we’ve got to get to, where we’re not even hiring them in the first place.

Speaker 1 3:50
So what you’re saying is that these background checks, what they can do is they can verify that this identity that’s presented is real. Doesn’t mean it matches the human, but it is a real identity of somebody.

Speaker 2 4:02
Exactly.

Speaker 1 4:02
Okay. Yesterday at your event, I was listening in the background, and someone was talking about voice recognition and voice duplication. We know that can be done on podcasts pretty easily, and I think maybe you or another person said that. Well, you know, the backstop here is voice, and many times your your bank may call you. You may call the bank and get something straightened out as a last resort, and so they’re even duplicating voices in these situations, aren’t they? This is incredible.

Speaker 2 4:28
Yeah. So the voice or the vishing, that voice piece where we’re a lot of institutions are are saying, do you want to use your voice as your identity? Well, if you’ve got a voicemail message on your cell phone. That voicemail message is enough of your voice to create a voicemail impersonation. So, should we just leave the standard voicemail message on there? That, if you’re worried about that, that would be my suggestion. John, you and I are. Already out in the public with a lot of voice that’s been recorded, I think we’re already toast.

Speaker 1 5:05
Yeah, I think that’s true. So in other areas of cybersecurity, people encounter a problem and they bring in a tool. Okay, then they have another problem. They bring in a tool and they get they get they under a false assumption that these tools are handling the problem, but but I think what we heard yesterday in presentation is that the identity and the tools are two kind of separate, different compartments or different aspects of the whole onboarding process, huh?

Speaker 2 5:32
That is true. So what these threat actors do is they recon. They do recon on the individual. It might be scraping LinkedIn. It might be pulling a synthetic identity, creating an identity for you that looks like you, talks like you, walks like you, and being able to take that and turn it into an application for a job. And so I know it’s happened the other way, where I’ve been sent, “Hey, we think this job would be a great fit for you. Would you like to apply? And it’s from a Gmail account. All right, that’s number one clue that I’m not going to respond to that, even though they’re offering me a million and a half to go be a virtual CSO in their company. First of all, if it sounds too good, it’s not happening. It’s not real.

Speaker 1 6:17
I I’ve done hundreds of interviews, and I think I’m kind of a acronym champion, the federal government here, and I stumbled on an acronym doing research for this interview: ATS, Application Tracking Systems. Well, that’s the answer. Just use one of those, right?

Speaker 2 6:32
Well, if the data is synthetic, if it’s not real, how is the application tracking system going to change that?

Speaker 1 6:38
Oh, you’re right. Yeah.

Speaker 2 6:40
And so we we currently have application systems where you apply for a job. Maybe it’s through Workday, maybe it’s greenhouse. You interview for the job. In some instances, some organizations have you interviewing with an AI agent, which I think is crazy because I am the old school. I like the human contact because I want to see them. I want to watch their body language, and that’s unfortunately that’s one of the things we can do through this process to make sure that you know we’re in security. We’re paid paranoids, right? We’re we’re that’s what we get paid to do, and if my gut tells me something’s off. I’m going to follow that gut instinct. In this case, when you’re interviewing, and we have lots of video of our CIO interviewing people, you’re going to see some nuances that you’re going to say something’s not right here. Now, that just doesn’t happen overnight, where all of a sudden a CIO or an HR person figures out. Oh, I need to be educated on this. This is something that we have to focus on and educate people properly, so that they’re looking for the flags. You know, if you don’t want to buy a technology, you need to look at your process and you need to make sure that you’ve got some validation, because what you don’t want is to give them access to your network, and then they’re in your network living off the land. So the original concept with these threat actors is not to steal; it is to get a paycheck, and then that money siphons back to North Korea to their ballistic missile program.

Speaker 1 8:19
Wow! Yeah.

Speaker 2 8:20
Or then all of a sudden it’s like, well, that company or agency is very interesting to us. Now we want you to pivot. That identity may go to a completely different person who has the skill to do network reconnaissance and start mapping out ways to put in backdoors, start siphoning data out, monitoring and listening, so it was like the old State Department that they built, and it had listening devices because they used local contractors. I don’t know if you’re old enough to remember that, John, but I am, and so you know it’s like we have to we have to be smart, and we need to figure out how to be smarter than they are. And sure enough, we’re going to figure out like their indicators, their vulnerabilities, their weaknesses. They’re going to change them. So this is the good thing about AI is it moves very fast. The bad thing about AI is it’s helping the bad guys move as fast.

Speaker 1 9:14
Speaking of old, 20 years ago, hey, take all these tests for network stuff and CISs. All these crazy tests I took. I learned about cryptography, and I remember taking notes. It was a one-time pad, and this was very popular. 2530, a one-time pad. Great. They couldn’t scale it, and no one talks about one-time pads anymore. Let’s talk about you know deep fakes. I mean, how can they scale? How can they scale this synthetic information? I can see maybe a bespoke application, but how can they scale this? Seems like impossible to do. Can you do laptop farms and different individuals and three or four people? You talked about this being popular in the commercial world and different types of companies. I mean, from an agriculture company to a construction company to an accounting company. I mean, how can they scale in these different areas? It seems almost. Possible to do

Speaker 2 10:00
so. They don’t need to scale. Actually, they don’t need to scale. So one person can have six different personas going through the interview process. The whole idea is get hired, get that paycheck rolling in, and we’ll bring in the right people to do the job if we have to. So let’s say you get hired for a very technical senior security engineering job. You get in the door. You have all the right things to say because you’re scripted. So let’s say that AI is actually writing what the person should be responding. So that makes it really challenging. But once they get hired, now you can bring in other skilled workers who can do the actual job. And I’ve actually heard some people get really upset when they get told that they have this threat actor in their environment because that person’s really good at their job.

Speaker 1 10:47
Yeah,

Speaker 2 10:47
and they don’t want to fire them, but you don’t want to have sanction problems when you’re hired somebody from a country that is not friendly to the United States.

Speaker 1 10:55
I look around the show here, 4,600 people, people walking by the booth here, and all kinds of action and everything else, and I look around. Most of these people maybe have bought a car in the past. Maybe they go in the dealership, and they know what questions to ask: reliability, pricing, size, and everything else. So that’s good. With a topic like this, I don’t know where to start with synthetic data. Where would a public sector leader start? What kind of questions could they even ask?

Speaker 2 11:21
So I think there are some some things you have to do. One, you have to connect the dots. You’ve got to verify the identity of the individual. None of this. Take a picture and send it to me later. You know, if you’ve got an I-9 witnessed by somebody and that’s good enough, no, you got to come in and be verified. So it’s really kind of going back to the human validating thing. There’s also getting your HR educated and making sure that the application process is tight and that you. I mean, like one company. This is different than the federal government, but they asked me to email them my I nine, so we have to like educate because HR people are not security people, and to be honest with you, recruiters are hired to get butts and chairs, qualify the right people. I mean that’s they’re on a lot of them are on quotas, and so we just have to think about this differently. I think in the federal government, thankfully, there are some capabilities out there, technologies that are emerging that can help solve this problem. What you don’t want to do is let them have access in the first place, and then if they do have access, you want to extricate them quickly. You’ve got to figure out how to find them.

Speaker 1 12:39
Simon Sinek, we know him. He says, “Start with why. So I’m start with why. Why start at the application level? Can’t we catch it afterwards?

Speaker 2 12:47
Once they’re in, you don’t know what kind of damage they’re doing, and so you then then it becomes a big forensics nightmare. Then you’re going to bring third parties in that are going to try to help you track where they went, and those capabilities are so good and so hard. Like I can, I can make a change to a system and then erase the logs to cover my tracks. You’ll never know I was there.

Speaker 1 13:09
I went to the Abnormal AI website and read some articles, took some notes, and I stumbled on a phrase called threat intelligence signals. So apparently, when someone is hired and acting on a network, there’s certain signals that maybe abnormal AI can look at and go, “Ah, I see. Patty is in Korea, or or she’s in India checking in, and she actually lives in Springfield, Virginia. So, what are these these signals? VoIP number? I mean, behavioral activities. What are the signals that are threat risky?

Speaker 2 13:45
So it’s. I don’t want to sound like inflammatory here, but it’s exponential. Like we look at 1000s upon 1000s of telemetry components to identify risky behavior. So if we if we think about email, everybody communicates over email. I don’t remember. Some not very long ago, somebody said, “Oh, we’re gonna never have email. We’re gonna move away from it. We’re only gonna go to Slack. And I’m like, “Yeah, well, like we all just figured out how to use email in the early 2000s, so I don’t think it’s going anywhere for a while. But that’s how we do business. We communicate with our business partners. That information is very rich when you contextualize it using an AI model, using the behavior of an individual. Now we don’t like to say it, but you’re actually building a profile of how the individual communicates, the tone of their emails, who they communicate with, what vendors they work with. You can create this huge profile. If all of a sudden something’s different, even in the tone, that’s the signal

Speaker 1 14:51
then, huh? That is the signal.

Speaker 2 14:53
The tone of the email. Instead of me saying, “Hey, John, because we’re very we’re good buddies here, maybe I go. Back to hello, John. That’s out of character.

Speaker 1 15:02
Yeah,

Speaker 2 15:03
it’s an indicator. So we want to pay attention, and we want to build up these little indicators into the big indicator to say this is where we’ve got risk. These are the things like like on a phishing email, we look at lots of different. Is the domain correct? I mean, we’re all overly trained on what to look for for a phishing email, and you know what? To be honest with you, I feel like I got really good at it. Guess what? I got phished by my own company. Whoa,

Speaker 1 15:30
red team, huh? And

Speaker 2 15:31
I got caught. I’m admitting it. I’m vulnerable here because AI is so good at creating these. It’s so hard to spot them. Okay, the one that got me was really easy to spot, but I was working off my phone, so I couldn’t see the domain. You know, and email strips off the headers and the information we would look at. Of

Speaker 1 15:51
course.

Speaker 2 15:52
Yeah, so that was all gone, and what that did is it told me to stop doing work on my phone.

Speaker 1 15:57
So be healthier in the long run.

Speaker 2 16:00
Yeah.

Speaker 1 16:00
Okay, now part of the program where we stomp the chump. There’s a phrase that I saw that maybe you can help me with. It’s called facilitator network fingerprints. So there’s fingerprints that people leave when they’re they’re in a specific network. Is is that what Abnormal AI can handle?

Speaker 2 16:16
So we’re actually looking at 1000s of points through the interview process,

Speaker 1 16:22
ah,

Speaker 2 16:23
and so we take all that data in and basically build a fingerprint of the individual. So the threat actors will use common patterns-a resume that’s been crafted exactly the same. Maybe it’s the same resume, resume

Speaker 1 16:36
reuse or something, huh?

Speaker 2 16:37
Resume reuse. They’re using the same phone numbers, they might be the same person applying for the job under a different name. I mean, all the way down to when I where I went to college and what year.

Speaker 1 16:53
So let me get this right. So it’s possible that I may be interviewing three candidates for a job, and they could be the same person. Exactly.

Speaker 2 17:00
That is exactly correct. How

Speaker 1 17:02
could you even admit to doing that? I mean, obviously people have done that. I mean, it must be embarrassing.

Speaker 2 17:07
Well, I mean, there are many things in life that are embarrassing, but we all made it. We all made it to our age, so there you go.

Speaker 1 17:13
But I’m just thinking about VoIP numbers. You can pick and choose a VoIP number just as flexibly as the next day, and so imagine. I never thought that would be one indicator, but you have to you have to build the case. You know, it’s not just one. It can’t be the VOIP number, the resume. They’re using burner

Speaker 2 17:28
phones. That’s an indicator, huh? That’s an indicator. So, what are the things that could be indicators? Now, one of the things we have to think about, especially in the federal government, is when we’re doing all of this collection and looking at the individual, we want to make sure that we’re not inadvertently high-risking a U.S. citizen. So this is going to be the delicate balance that we have to find in any sort of behavioral analysis. So many years ago, I was in a board meeting, and it was my first board meeting. And I was a new CISO in this company. I was an old CSO by years of being a CISO, and I was a little full of myself when I walked in the board meeting. And I’m full of myself today. Every day for me, and I said, you know, we’re going to. These are the programs we’re going to build. I had just finished my risk assessment. I was doing my 45-day out brief, not 90, 45, because it was pretty easy to build what needed to be done. Yeah, and and I said, you know, we’re going to build this insider threat program. And one of the board members said, that goes directly against the culture of our company. And I said, well, and I got a little, you know, sassy, and the chairman of the board had to step in and say, “Okay, well, look, we need to change something in our culture. Blah blah blah. I basically rescued me, and I I went back to my team who were, you know, we’d only been together for 45 days, and I said, “Can you believe this board member did? We yada yada yada, and they’re like, “Oh, that’s really bad boss that’s terrible, and then I went home and I thought about it, and I thought insider threat is a very intimidating term used by our industry.

Speaker 1 19:12
Aha! Yeah, you’re right.

Speaker 2 19:14
I I went to the CEO the next day, apologized for my behavior first of all, and then I said we’re going to rename this program Employee Protection Program because that’s really what it is. We’re trying to protect our employees’ credential from being abused. Went over with flying colors. Guess what? It was an insider threat program. It’s all about how you market it to leadership on if you will be culturally accepted. So this is going to be the challenge. Also, I had a really hard struggle with my HR team getting them on board. With I kept saying we’re we’re not profiling people, we’re understanding their behavior because profiling is. Not, it’s gotten a really, really bad rap lately. So, also how you market the program, how you’re going to encourage your organizations to listen, to think. But you may not think you have a problem in the federal government. I can almost guarantee you, you do.

Speaker 1 20:18
As we are recording this, we’re live from Billington, and Brigadier General Greg Tuhill just walked by, waved to him, and I remember interviewing him years ago, and he used a phrase that you know, culture eats strategy for lunch. I love that. So maybe this is the lesson here, huh?

Speaker 2 20:35
Maybe it was karma that he came by just at that time. Just

Speaker 1 20:38
just because he was coming by, and we knew exactly what was going to end this interview with you giving some tips for my listeners on what next steps should be as far as vetting procedures and and I mean are maybe articles at Abnormal AI that maybe they can can find out more information on your company.

Speaker 2 20:54
Yeah, so actually we’re doing closed door threat intel briefings, so we’re being very careful because we actually have a lot of data that we’ve collected, and so we want to make sure that we’re delivering the content and material to the right people at the right organizations at the right time. That’s number one. So there is some public information available. There is an interview that you can find at Abnormal AI. Great, and I

Speaker 1 21:18
will put a link to that on the show notes page.

Speaker 2 21:20
That’s awesome. Thanks, John. So helpful. And yeah, there’s there’s definitely things that you can do. Again, don’t assume. Build that relationship with your HR team. This is a partnership. This is not a finger pointing exercise. Let’s figure out how to work across our organizations. Let’s actually start educating. HR people are not cybersecurity people, and cybersecurity people don’t want to be HR people.

Speaker 1 21:48
Well, great. That was interesting. I’ll put a link to that in the podcast. Like to say, we’re signing off here from Billington’s cybersecurity conference here in downtown Washington D.C. 4,600 of my closest friends, 50 sessions, 250 speakers. This is a bad house. I’m gonna have to go home and go to sleep or something. How about you?

Speaker 2 22:07
I need a nap. I hope I don’t fall asleep on the metro going home.

Speaker 1 22:11
You haven’t listened to the Federal Tech podcast by John Gilroy. I’d like to thank world famous Patricia Titus Field Sisso at Normal AI.

Transcribed by https://otter.ai

With over 25 years of experience as a cybersecurity leader, Patricia Titus now leads as Field Chief Information Security Officer at Abnormal AI. Her extensive background includes CISO positions at prominent organizations such as Booking Holdings, Markel Corporation, Freddie Mac, Symantec, Unisys, and the Transportation Security Administration. Throughout her career, she has been responsible for developing and implementing security strategies that align with business objectives and ensure adherence to global regulations. Recognized for her expertise in areas like risk management, artificial intelligence, cybersecurity operations, and crisis management, Patricia has a proven track record of optimizing security frameworks, improving business resilience, and incorporating innovative solutions, including AI, into security practices. She currently contributes her expertise by serving on the boards of Black Kite, The Girl Scouts of the Commonwealth of Virginia, and Glasswing Ventures.