Adversary Universe Podcast

Talking OT Security with Fernando Madureira, Global CISO of Cosan

Where in the world are Adam and Cristian? In this episode, they’re coming to you live from São Paulo, Brazil, where they sat down with a special guest: Fernando Madureira. Fernando is the Global CISO of Cosan, a Brazilian conglomerate of several businesses spanning energy, transportation and logistics, and other sectors that operates around the world.
Given Cosan’s size and the nature of its business, Fernando has a broad range of threats at top of mind. Operational technology (OT) security is a key concern because adversaries seek access to OT devices and traffic, and it requires a different mindset and technology than a modern IT environment. Social engineering is another, as adversaries attempt to disguise themselves as employees to manipulate customers and partners.
Tune in to hear a conversation that explores OT security, modern phishing scams and how the Global CISO of a major company is taking steps to protect it.

How Adversaries Respond to Law Enforcement Takedowns

What happens when there is a takedown of a major cybercriminal group or law enforcement activity has a major impact on its leadership?
In this episode, Adam and Cristian unpack what happens in the aftermath of a takedown, including how some groups splinter, reemerge and even rebrand.

When the Adversary Knows They’re Caught

How do adversaries react when they know they’re being tracked? How do they respond to organizations that are on to them — and how do they know what the defenders know?
In this episode, Adam and Cristian explore how adversary behavior shifts as their activity is discovered and tracked. Today’s adversaries carefully research their victims. They read corporate blog posts and craft their techniques based on the information defenders share. As this intelligence becomes more detailed, organizations like CrowdStrike are forced to consider an important question: How much information can they share when they know adversaries are looking for it? Helping potential victims often comes at the cost of adversaries knowing we can see them and shifting their behavior accordingly.
How does their behavior change? As always, it depends on the group. Tune in for this fascinating conversation and real-world examples of adversaries responding to defenders’ actions.

Unpacking China-India Cyber Tensions

What happens when two cyber superpowers — and the most populous countries in the world — target one another? Tensions between China and India have been rising in recent years, and it’s time we take a deep dive into the many factors at play.
In this episode, Adam and Cristian examine the dynamics between the two nations, the drivers of their evolving cyber activity and the key adversaries involved in this growing conflict. “The key thing to understand here is adversaries are not only focused on us … in the U.S. or in Europe … and they’re not only focused on a particular business vertical,” says Adam. “They target each other all the time.”
When did we start to see this adversary-vs.-adversary conflict? What do the attacks between China and India look like? And how have we seen other nations target one another around the world? Tune in for these answers and to learn what organizations operating in these countries need to know to stay secure.

Understanding Social Engineering with Shelly Giesbrecht, Director, Professional Services

Social engineering is not a new threat — adversaries have long used psychological manipulation to gain access, money, information and more. But as we learn in this episode from Shelly Giesbrecht, Director of Professional Services at CrowdStrike, it remains a top cybersecurity challenge for all organizations.
Today’s social engineers are more convincing than ever. Gone are the days of clunky phishing emails rife with spelling errors. Modern social engineering attacks arrive as convincing and well-crafted text messages, emails and voice calls. They prey on human emotion and instinct, creating situations where technology can’t always help.
“It really comes down to that human factor,” says Shelly. “We talk a lot about technology, and obviously CrowdStrike is a technology company, but we are fallible still at the human level — and that’s where social engineering is targeted.”
In a conversation that starts with impostor syndrome and quickly pivots to the impostors who are emailing employees and calling help desks, Adam, Cristian and Shelly explore the modern social engineering landscape. Shelly describes what her team is seeing on the front lines of incident response, how social engineering campaigns are evolving with the rise of AI, and guidance for organizations worried about this prolific technique.

Hacktivism and the JACKALs Behind It

The rise of hacktivism — the use of hacking techniques to make a statement supporting a political or social cause — is often associated with the Occupy Wall Street movement and the Anonymous hacktivist collective. But the practice of hacking as a form of civil disobedience goes back to the 1990s. It has taken many forms in the years since, driven by a wide range of hacktivists around the world.
In this episode, Adam and Cristian trace the history of hacktivism to its early days, dive into high-profile examples and explain the practice of “faketivism” often used among nation-states. They share why hacktivism is top of mind during a year in which 55 countries have held, or will hold, elections. And they disclose the meaning behind JACKAL, the name CrowdStrike broadly uses to track activists who operate online. Tune in for an engaging explanation of a complex and oft overlooked topic.

Building a Strong Threat Hunting Program with Andrew Munchbach

Organizations fear adversaries will attack. Threat hunters assume adversaries are already in the system — and their investigations seek unusual behavior that may indicate malicious activity is afoot.
Andrew Munchbach, CrowdStrike’s Global VP, Field Engineering, joins Adam and Cristian in this week’s episode to explore what threat hunting is, how it works, and what makes a good threat hunting program.
As CrowdStrike’s “Chief Reddit Officer”, Andrew also shares how he came to run CrowdStrike’s Reddit account and discusses the platform’s evolving role in communicating with the security community. Now with nearly 20,000 followers, CrowdStrike’s Reddit account is used to share information — from key data on active attacks to weekly threat hunting exercises — with CrowdStrike customers and the general public.

Adversary Attribution: What It Means and How It Works

Today’s conversation explores a common question around adversary activity: Why does attribution matter? When a cyberattack hits, why go to the trouble of learning who is behind it? Each attempt at an intrusion can reveal a lot about an adversary — who they are, what they’re doing and what their motivations may be.
This information can not only inform your response to an attack but how you strengthen your security architecture against future attacks. In this episode, Adam and Cristian discuss the importance of knowing who the adversary is and what they’re after.
They go back to the early days of adversary attribution, explain how adversaries are tracked as their activity changes over time and examine the value of this intelligence in helping organizations succeed in the face of evolving cyber threats.
The tool Adam mentions at the end of this episode can be found at https://adversary.crowdstrike.com/

LIVE from Gov Threat Summit: A Chat with Morgan Adamski, Chief of the NSA’s Cybersecurity Collaboration Center

The National Security Agency’s Cybersecurity Collaboration Center (CCC) was created based on a growing need for the public and private sectors to work together and share insights to understand adversaries’ intentions, as well as the scope and scale of their activity. In this special episode of the Adversary Universe podcast, Adam and Cristian are joined by Morgan Adamski, Chief of the CCC and government security expert, onstage at CrowdStrike’s Gov Threat Summit in Washington, D.C.
“We both had different pieces of the puzzle,” said Adamski of the NSA and private sector organizations, which collect different types of data on adversaries and how they operate. In this conversation, she, Adam and Cristian discuss the CCC’s mission and its evolution, explain how it works with private sector partners, and go “around the world” to discuss their observations of modern nation-state adversary activity.

CrowdStrike CSO Shawn Henry on Election Security, Nation-State Threats and His FBI Career

CrowdStrike Chief Security Officer Shawn Henry joined CrowdStrike as employee number 19 after a 24-year career at the FBI, where he retired as the Bureau’s Executive Assistant Director.
Today, he joins Adam and Cristian for a wide-ranging conversation exploring his early days at CrowdStrike and transition to the private sector, his perspective on the 2016 DNC breach and the risks modern elections face. Adversaries have numerous opportunities to sway voters’ opinions — and now they have the technology to wield greater influence through misinformation and disinformation campaigns.“I think we've just scratched the surface with AI from a deepfake perspective,” Shawn says of how artificial intelligence may play a role in this activity. Tune in to hear his perspective, stories and guidance as we navigate this election year.