Nicole Perlroth | The New Frontline: Cyber on the Precipice

## Overview

In this keynote address delivered at Black Hat, cybersecurity author and former *New York Times* reporter Nicole Perlroth reflects on her decade covering cybersecurity, spanning the era between Stuxnet and SolarWinds. Introduced by Black Hat founder Jeff Moss—who highlighted her book *This Is How They Tell Me the World Ends*, her advisory work on the CISA Cybersecurity Advisory Committee, and her podcast *To Catch a Thief*—Perlroth frames the modern cybersecurity environment as a continuous escalation of nation-state activity and infrastructure targeting. She contrasts the traditional mindset of security practitioners and software developers with the broader systemic risks borne by society and taxpayers.

---

## From Subprime Mortgages to Cybersecurity Reporting

Perlroth began her reporting career covering complex financial issues at *Forbes* during the subprime mortgage crisis, where she traced a single $300,000 subprime loan from Countrywide through Lehman Brothers, hedge funds, pension funds, and AIG to the American taxpayer. The *New York Times* recruited her specifically for her ability to translate highly technical and opaque concepts into clear narratives for the public.

Upon entering the cybersecurity beat, Perlroth recognized the same financial dynamic ("a rolling loan carries no loss") playing out in software development: - Tech companies prioritized "moving fast and breaking things" and rushing code to market. - Software vendors externalized operational and security risk onto end users. - When critical incidents occurred, the general public and taxpayers were left bearing the fallout.

Early in her tenure at the *Times*, she received a firsthand education in advanced threats when the newspaper itself was breached by Chinese APT Unit 61398 based in Shanghai, illustrating that private enterprises and media organizations were now frontline targets for military-grade nation-state actors.

---

## The "Decade of Firsts" and Attack Surface Expansion

Perlroth categorizes her ten years covering the space as a "decade of firsts," characterized by novel attack vectors, unprecedented corporate transparency, and expanding physical consequences: - **Public Attribution & Disclosure:** Major private entities such as Google and *The New York Times* publicly disclosed intrusions by China. - **Unconventional Initial Access Vectors:** Attacks shifted beyond basic perimeter breaches to leverage trusted software updates, HVAC systems, smart fish tanks, and malicious PDF files (such as infected takeout menus). - **Shift to Sabotage and Physical Impact:** Cyber capabilities evolved from digital espionage, intellectual property theft, and payment card theft toward sabotage of critical physical infrastructure. Targets expanded from uranium enrichment facilities (Stuxnet) to Saudi Aramco, power grids, pipelines, healthcare institutions, aviation, transportation, and municipal water systems. - **Democratic & Information Operations:** Adversaries targeted electoral systems (beginning in Ukraine and spreading to U.S. elections) as well as public discourse and trust.

Despite the severity of these incidents, Perlroth observed that organizations and the public routinely treated each breach as a isolated black swan, only to expand the attack surface further once news cycles subsided.

---

## Escalation, Weapon Proliferation, and Technical Lineage

Looking at the broader historical trajectory, Perlroth identifies a continuous through line: attacks consistently advanced upon previous techniques, while the barrier to entry dropped.

A prime example is the operational fallout from Operation Olympic Games: - **Stuxnet:** While uniquely sophisticated, Stuxnet was only one component of Olympic Games. - **Iran Wiper Attacks:** Following the release of Stuxnet, wiper malware disrupted Iran’s oil ministry and paralyzed crude oil exports at the Kharg Island terminal. - **Shamoon Attack on Saudi Aramco:** Months later, a cruder variant of these wiping capabilities surfaced in the Shamoon campaign against Saudi Aramco, bricking 30,000 workstations and overwriting systems with the image of a burning American flag. - **Subsequent Campaigns:** The capability and destructive intent subsequently propagated to other high-profile incidents, such as the destructive intrusion at Sony Pictures.