Risk & Repeat: Recapping RSA Conference 2024

### Overview In episode 230 of TechTarget's *Risk & Repeat* podcast, host Rob Wright and security news writers Alex Culafi and Ariel Waldman recap major themes and takeaways from RSA Conference 2024. The discussion focuses heavily on the ubiquitous marketing of artificial intelligence (AI), nation-state threats targeting critical infrastructure, the ongoing evolution of ransomware in light of the Change Healthcare attack, and an increasingly prominent government presence at the conference.

### Key Topics - **Pervasive AI Marketing and Real-World Limitations**: Alex Culafi estimated that 30% to 40% of vendor booths directly mentioned AI or intelligence. However, the hosts noted that generative AI currently has only a few practical security use cases, such as parsing complex threat intelligence log data to make it human-readable for security engineers. Public sector speakers (such as DHS Secretary Alejandro Mayorkas and Deputy Attorney General Lisa Monaco) touted AI heavily, though primarily for non-cybersecurity use cases like child abduction investigations and cross-jurisdictional crime pattern analysis. - **Volt Typhoon and Critical Infrastructure**: Ariel Waldman highlighted that Chinese nation-state threat group Volt Typhoon was mentioned in almost every session attended. Attendees raised significant alarm over the group's targeting of critical infrastructure and persistent living-off-the-land techniques used to evade EDR and MDR defenses. - **Ransomware and the Change Healthcare Incident**: Discussions touched on whether the definition of ransomware is shifting from encryption to pure data extortion, with most industry contacts preferring to keep the term unchanged. The Change Healthcare breach was specifically cited during an NSA session with Rob Joyce and Dave Luber, emphasizing that paying a $22 million ransom to the BlackCat/ALPHV group failed to prevent extended operational disruption or data re-extortion by a disgruntled affiliate. - **Secure by Design and Open Source Security**: 'Secure by Design' emerged as a dominant slogan across large vendors such as Microsoft (discussing its expanded Secure Future Initiative) and IBM. Conversations also addressed vulnerabilities introduced via open-source dependencies and third-party APIs during rapid AI adoption.

### Technical Details - **Living-off-the-Land (LotL)**: Rob Joyce noted AI's potential in analyzing log files and security events to detect LotL techniques favored by advanced persistent threat actors like Volt Typhoon. - **Attacker vs. Defender AI Dynamics**: Industry figures like Alex Stamos (SentinelOne) noted that AI currently favors enterprise defenders and SOC analysts, though adversaries are expected to catch up quickly through phishing generation, accelerated data analysis, and exfiltration. - **Supply Chain Risks**: Concerns were raised regarding open-source supply chain compromises, GitHub attacks, and backdoors, with Tim Mackie (Synopsys) remarking on AI's potential to help developers secure open-source dependencies.

### Takeaways - **A Potential 'Cloud Round Two'**: Hasty AI deployment without proper governance risks repeating early cloud adoption missteps, leading to widespread misconfigurations, identity issues, and unauthorized data leakage. - **Futility of Ransom Payments**: The Change Healthcare incident demonstrated the operational and reputational limits of paying ransoms, strengthening support among practitioners for ransom payment bans, despite skepticism around policy enforcement. - **Deepening Public-Private Collaboration**: High-profile participation from CISA, the FBI, the NSA, and the White House reflected expanding federal efforts to integrate and coordinate cyber defense initiatives with private sector enterprises.