Defensive Security Podcast - Malware, Hacking, Cyber Security & Infosec

Defensive Security Podcast Episode 296

Feb 9, 2025

The discussion dives into the latest ransomware tactics, revealing how attackers target employees to exploit insider threats. There’s a deep look at the rise of LLM hijackers manipulating cloud accounts, highlighting the urgent need for better security measures. The ethics of phishing simulations come under scrutiny, advocating for supportive training instead of punitive measures. Cybersecurity professionals face challenges balancing risk with effective security, especially with the implications of generative AI in the workplace, where sensitive data can be at stake.

Ask episode

AI Snips

Chapters

Transcript

Episode notes

ANECDOTE

The $700 AWS Bill

One person racked up a $700 AWS bill in 24 hours from LLM hijacking.
He luckily had billing alerts; otherwise, it could have cost $20,000.

ADVICE

Protect Your API Keys

Protect API keys and credentials to prevent LLM hijacking.
Compromised accounts can be used for malicious purposes, including generating illegal content.

ADVICE

Ethical Phishing Simulations

Design phishing simulations carefully, avoiding emotionally manipulative lures.
Overly effective tests don't teach good security practices.

Get the Snipd Podcast app to discover more snips from this episode

Get the app

In this episode of the Defense of Security Podcast, Jerry Bell and Andrew Kalat discuss the evolving landscape of cybersecurity threats, focusing on ransomware tactics that exploit insider threats, the hijacking of LLM resources, and the effectiveness of phishing simulations. They explore how adversaries are increasingly targeting employees to gain access to sensitive data and how organizations can better protect themselves against these threats. The conversation also covers the ethical implications of phishing tests and the need for a more supportive approach to security awareness training. In this episode, Jerry and Andrew discuss the challenges faced by cybersecurity teams, the dynamics between security and other business units, and the importance of learning from incidents to improve security practices. They explore the balance between enabling business operations and maintaining security, the implications of generative AI in the workplace, and the need for effective governance around AI usage. The conversation emphasizes the proactive role security professionals must take in navigating these complexities while ensuring organizational safety.

Takeaways

Ransomware attackers are increasingly using insider threats to gain access.
Greed can turn employees into insider threats, especially in tough economic times.
LLM hijacking is a new tactic that exploits compromised API keys.
Phishing simulations may create a rift between users and IT security teams.
Punitive measures for phishing failures can lead to underreporting of actual attacks.
Security awareness training should focus on protecting users, not punishing them.
Adversaries are finding valid API keys to exploit cloud resources.
The effectiveness of phishing simulations is being questioned by experts.
Organizations need to do a better job at protecting their secrets and credentials.
The cybersecurity landscape is rapidly evolving, requiring constant adaptation. Cybersecurity teams often feel like janitors cleaning up after others.
Organizational dynamics can create resentment in security teams.
Learning from incidents is crucial for improving security practices.
Balancing security needs with business operations is essential.
Generative AI presents both risks and opportunities for organizations.
Effective governance is needed for AI usage in business.
Security professionals must help businesses understand risk management.
Building relationships across departments can improve security outcomes.
AI tools should be used with proper agreements to protect data.
The landscape of AI in business is rapidly evolving and requires adaptation.

Links

https://www.scworld.com/news/ransomware-attackers-turn-to-workers-for-data-breach-access
https://www.darkreading.com/application-security/llm-hijackers-deepseek-api-keys
https://www.wsj.com/tech/cybersecurity/phishing-tests-the-bane-of-work-life-are-getting-meaner-76f30173
https://www.securityweek.com/security-teams-pay-the-price-the-unfair-reality-of-cyber-incidents/
https://www.darkreading.com/threat-intelligence/employees-sensitive-data-genai-prompts