Episode 170: Visibility for SLTTs in Blocking Typhoon APTs

In Episode 170 of Cybersecurity Where You Are, Sean Atkinson and Tony Sager sit down with Douglas Holland, Senior Solutions Engineer at Akamai Technologies. Together, they discuss how U.S. State, Local, Tribal, and Territorial (SLTT) government organizations can increase their visibility to obstruct the attack attempts of Typhoon advanced persistent threat (APT) groups.

Here are some highlights from our episode:

• 00:49. Introduction to Douglas
• 02:16. How Typhoon APTs are using trusted tools to target critical infrastructure
• 08:30. Professionalism as a tell of sophisticated nation-state threat actors
• 09:15. How U.S. SLTTs come up with creative solutions despite budgeting and staffing limits
• 14:14. The "big credential playground" that is U.S. SLTTs' expanded attack surface
• 16:46. Visibility into network activity as a way to continuously build defensive capability
• 19:11. The use of context to connect technical visibility to defensive action
• 23:20. Identity as the new perimeter, cloud and SaaS posture, and micro-segmentation
• 29:18. One piece of advice: assume an attacker is already in the network or will be

Resources

• Malicious Domain Blocking and Reporting (MDBR)
• Living off the Land: The Power Behind PowerShell
• Cybersecurity for Critical Infrastructure
• Build a Zero Trust Roadmap for FinServ with CIS SecureSuite

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing [email protected].