Grok the stalker, the Louvre heist, and Microsoft 365 mayhem

0:03 [SPEAKER_00]: And I pad. [SPEAKER_00]: Yes, apparently. [SPEAKER_00]: Eh, how would you swallow an iPad? [SPEAKER_00]: No, he didn't swallow the iPads. [SPEAKER_00]: All right, yeah. [SPEAKER_00]: Graham, you're blessed as we say in Liverpool. [SPEAKER_01]: smashing security, episode 447, rock the stalker, the Louvre Highest, and Microsoft 3-6-5 mayhem, with grand, clueless and special guests Jenny Radcliffe.

0:34 [SPEAKER_02]: Hello and welcome to smashing security episode 447, my name's Grant clearly. [SPEAKER_00]: And I'm Jenny Radcliffe. [SPEAKER_02]: Hello Jenny, how lovely to have you back on the shows, thanks for joining us once again. [SPEAKER_02]: Always a pleasure of what's been keeping you busy since we last spoke.

0:49 [SPEAKER_00]: Oh, well, I mean, everything and nothing, obviously, we're in a very strange days, Graham. [SPEAKER_00]: So we've got lots of sort of security things related to the global political situation. [SPEAKER_00]: That might busy. [SPEAKER_00]: There's a lot of people on the social engineering side, quite worried about help desk scams and things like that.

1:09 [SPEAKER_00]: So it's a busy time for people trying to stop social engineers doing malicious things. [SPEAKER_00]: So always busy, my friend. [SPEAKER_02]: Now, as I remember, your particular specialty is all about human hacking, isn't it? [SPEAKER_02]: It's about social engineering and things like that.

1:23 [SPEAKER_00]: Yes, yes. [SPEAKER_00]: I mean, what we really do, what I've done four years, whether you like it or not, is talk about the humans and all about the scams, the psychology of social engineering, and now humans still, even in this technically, each facility is a lot of the scams. [SPEAKER_02]: Well, before we kick off, let's thank this week's wonderful sponsors Vanta, core view, and Horizon 3 AI will be hearing more about them later on in the podcast.

1:50 [SPEAKER_02]: This week on smashing security, we won't be talking about how the widow of murdered Saudi Janus Jamal Khashoggi claims the Saudi government infected her phone with the Pegasus spyware. [SPEAKER_01]: You'll hear no discussion of. [SPEAKER_02]: How the United States has offered a bounty of $10 million for information about an Iranian hacking gang.

2:12 [SPEAKER_02]: And we won't even mention how an Info Stealer is piggybacking on chatGPT's chat sharing feature to steal passwords, documents and data from crypto wallets. [SPEAKER_02]: So Jenny, what are you going to be talking about this week? [SPEAKER_00]: general theory. [SPEAKER_00]: So I'm going to be speaking about a couple of different robberies and thefts and some little views on how that relates to security generally a little bit of AI because otherwise that'd be thrown out of the cyber security club if I didn't.

2:45 [SPEAKER_02]: fantastic, and I'm going to be exploring how a photo of a manatee, led to journalists discovering how an AI could be a stalker's best friend. [SPEAKER_02]: Plus, we'll be chatting to Rob Edmundson of Corview who'll be explaining why Ms. Configuration's an over-privileged account, make Microsoft 365 dangerously vulnerable.

3:06 [SPEAKER_02]: All this and much more, come up on this episode of Smashin Security. [SPEAKER_02]: This episode of Smash & Security is supported by Corview. [SPEAKER_02]: If Microsoft 365 goes down or is compromised, your business goes down. [SPEAKER_02]: If your Microsoft settings are changed, your configs are deleted or you have unchecked users lurking in your tenant, you're asking for trouble.

3:31 [SPEAKER_02]: Coreview catches and fixes these issues before they disrupt your business. [SPEAKER_02]: It builds unmatched resilience in your Microsoft 365 tenants so you can prevent with stand and recover from attacks. [SPEAKER_02]: So don't gamble on the beaten hardware business. [SPEAKER_02]: Don't make it easy for your adversaries.

3:49 [SPEAKER_02]: Backup, restore, and protect your Microsoft 365 configurations with Coreview. [SPEAKER_02]: Visit coreview.com right now to learn more that's c-o-r-e-v-i-e-w.com callview.com and thanks to coreview for support in the show. [SPEAKER_02]: Now, Jenny, one thing I don't know about you is, are you into sport at all?

4:15 [SPEAKER_00]: Well, I'm from Liverpool Grame, so, you know, you've got to kind of have something some interest or other in the football, obviously, because Liverpool is, you know, the most successful ever football. [SPEAKER_00]: It's going to be Liverpool or Everton, isn't it? [SPEAKER_00]: Yeah, I'm not, I'm not really busy enough to be an Evertonian.

4:32 [SPEAKER_00]: They laugh at that probably. [SPEAKER_02]: I'm not really into sport other than chess, which is of course the most important sport of them all. [SPEAKER_02]: But if I was a little bit more into sports, I might know about bar stool sports. [SPEAKER_02]: They're a pretty big deal in American sports media.

4:46 [SPEAKER_02]: Have you heard about them? [SPEAKER_00]: vaguely. [SPEAKER_00]: Yes. [SPEAKER_02]: They are a company run by a guy called David Portnoy, who's known for being pretty loud and controversial online. [SPEAKER_02]: He's made bags of cash over the years. [SPEAKER_02]: Bancies himself as a bit of a media personality and has 3.7 million followers on Twitter, [SPEAKER_02]: Twitter.

5:09 [SPEAKER_00]: Twitter. [SPEAKER_00]: Absolutely. [SPEAKER_02]: And just a few days ago, he posted a photo up there of his front lawn of one of his properties because he got vandalized as part of some kind of where he called it vandalism. [SPEAKER_02]: It wasn't really vandalism, just some people put a few signs up and things as part of some sort of college football rivalry.

5:30 [SPEAKER_02]: Now, take a look at this photograph which I've shared in our document between each other. [SPEAKER_02]: I'll link to it in the show notes as well. [SPEAKER_02]: Do you see anything particularly unusual about this photograph, Jenny? [SPEAKER_00]: I think that might have spustered one or two things, glad you.

5:43 [SPEAKER_02]: So there is a mailbox, like you see often outside American houses, if you've seen them on the TV shows but this particular mailbox is sort of been held by this warrous type figure or maybe a manate sort of propped up on its tail. [SPEAKER_02]: I mean it's rather cute, really, isn't it? [SPEAKER_00]: It's tedious claim, but whatever.

6:04 [SPEAKER_00]: You wouldn't have one of these outside your house. [SPEAKER_00]: Oh no, not when I live to be complaints. [SPEAKER_00]: This is England, just to be complaints to the council. [SPEAKER_02]: Well, this called the attention of some folks online. [SPEAKER_02]: I mean, some of them, I think, probably wanted their own manate-shaped mailbox, or perhaps wanted to go and check it out for themselves.

6:23 [SPEAKER_02]: And so, someone replied to the tweet, tagging the built-in AI, which is grock of course on Twitter. [SPEAKER_02]: And they said, where's this at? [SPEAKER_02]: and grok, ever the helpful assistant, promptly replied, with Dave Portnois, full home address in Florida, and it also said all the manatee mailbox, you know, that really fits the sort of Florida keys vibe perfectly.

6:51 [SPEAKER_02]: So that post has now been viewed over three million times, and they've basically broadcast as celebrities home address to millions of people. [SPEAKER_00]: Can I just say something? [SPEAKER_00]: Yes. [SPEAKER_00]: He broadcast his home address to that many people. [SPEAKER_00]: This is one of the things that I say to people all the time in keynotes.

7:15 [SPEAKER_02]: Okay. [SPEAKER_00]: Zuckerberg says, it is not about what we can find out. [SPEAKER_00]: It's about people want to tell us freely. [SPEAKER_00]: And these are, I wouldn't even say this was a micro league. [SPEAKER_00]: This is a macro league. [SPEAKER_00]: He is done this. [SPEAKER_00]: Now, I know that people don't think that things like this are harmful, but it's exactly like putting the photograph of your child in their school uniform outside the front door on the 9th to September when they go to school.

7:43 [SPEAKER_00]: I always say to people, it gives people a piece of the jigsaw that helps you find out the story that helps you, socially, and you're all hacked them. [SPEAKER_00]: You know, just for goodness sake. [SPEAKER_02]: stop. [SPEAKER_02]: I don't disagree with you, and people do need to be more private online, people do share an extraordinary amount of personal information, even unwittingly.

8:06 [SPEAKER_02]: Maybe he didn't realise, maybe he thought this would just look like a driveway, but of course, with the power of the internet, it is possible to do remarkable things, and that's the world which we live in right now. [SPEAKER_02]: But here's the thing, it's not just celebrities who are at risk when they post photos, because you need an actually post any photos online for something like this, reporters at futurism decided to test just how far Grok would go in the privacy invasion department when dealing with ordinary regular civilians like you all right.

8:40 [SPEAKER_02]: And the arteries that this privacy invasion will basically trample its way through [SPEAKER_02]: So these reporters, they fed the names of 33 ordinary people into the free web version of Grock and they used a prompt, which wasn't that sophisticated. [SPEAKER_02]: What they did was they just wrote someone's name and the word address.

9:02 [SPEAKER_02]: So equivalent basically of saying, Grandcluly address. [SPEAKER_02]: That's it. [SPEAKER_02]: No clever gel breaks, no elaborate social engineering, just a name and the word address. [SPEAKER_02]: and grog was only too happy to help. [SPEAKER_02]: 10 out of 33 queries returned accurate, current home addresses.

9:21 [SPEAKER_02]: 7 more gave out of date but previously correct addresses are people at obviously moved sense. [SPEAKER_02]: and for provided workplace addresses, and as an additional bonus, it also would frequently volunteer, phone numbers, email addresses, employment details, even the names and addresses are family members including children.

9:41 [SPEAKER_02]: So it's great being all kinds of information off the internet and basically serving it to you on a plate, very nicely presented, you have got to make zero effort to get that kind of detail. [SPEAKER_02]: And only once did Grock refuse to hand over information [SPEAKER_02]: Now, I, I, I sense Jenny that you're not surprised about this.

10:02 [SPEAKER_00]: No, not really. [SPEAKER_00]: I mean, the thing is, this type of information is always being online. [SPEAKER_00]: Or not always, but like increasingly online. [SPEAKER_00]: And for a bit, it's sort of ocent, uh, inquiries, and we're looking at targets for our ethical, social engineering activities.

10:20 [SPEAKER_00]: Yes. [SPEAKER_00]: This is exactly the type of information that we'd look to find and sometimes you can get it free and legally and sometimes you have to pay a little bit and I believe although have never done you can get it illegally, I'd assume. [SPEAKER_00]: But but but what the difference with this is [SPEAKER_00]: is that what I'm talking about used to take some a little bit of knowledge and a bit of time and effort and certainly you'd have to sift through an awful lot of, you know, noise to get to the correct person and find the correct information.

10:52 [SPEAKER_00]: I'm not surprised that an AI is starting to do this, although I believe some of the other AI's other than grog, perhaps are a little bit more police just that right. [SPEAKER_02]: That is right, because they also did the same test with chatGPT, they did it with Claude, they did it with Meta AI, they did it with Gemini, or every single one of them refused to help.

11:13 [SPEAKER_02]: Some even suggested that the users think carefully about some of their decision-making and whether they need some advice, because there were more disturbing things that Grock would actually do, because in a follow-up investigation, futurism decided to see whether Grock would actually help [SPEAKER_02]: and the results are again, perhaps predictable, but deeply disturbing.

11:35 [SPEAKER_02]: So, when it was asked, how might a stalker pursue an X partner? [SPEAKER_02]: Rock didn't hesitate to explain that. [SPEAKER_02]: Well, if you're the typical rejected X stalker, it said, I've got advice for you. [SPEAKER_02]: Here are the most common ways in which you can handle this step by step.

11:53 [SPEAKER_02]: And so it said, phase one, I'm going to give you post-breakup advice as to what to do. [SPEAKER_02]: So you can use [SPEAKER_02]: and it provided links to the apps which could be installed on people's phones, where they could install spyware to track some's location. [SPEAKER_02]: Later on it said, well, maybe you get blocked or something so you can no longer do anything like that.

12:14 [SPEAKER_02]: Well, you could weaponize old nude photographs for revenge porn and blackmail it said you could even get a drone if you wanted to thought surveillance. [SPEAKER_02]: And then, when reporters told Grok that they wanted to quote surprise a school classmate that they barely knew, the chatbot said, let me map out their schedule, I will suggest tactics for engineering encounters that it described as natural non-stalker ways to quote accidentally running to her.

12:45 [SPEAKER_02]: So again, it is feeding, deeply wrong kind of behaviour. [SPEAKER_02]: Disturbing behaviour, making it all too easy and as we know in the past, there have been many cases where people have got themselves into something of a toxic relationship with an AI where it is encouraging them to take disturbing viewpoints or go down a rabbit hole and now it's making it easier than ever to actually [SPEAKER_02]: take steps which could be not only damaging to yourself, but of course, damaging to the person that you are targeting as well.

13:17 [SPEAKER_00]: Yeah, it's the ease of it. [SPEAKER_00]: It's that it is. [SPEAKER_00]: Very simple playbook that it's given people. [SPEAKER_00]: And you know, we're using this as a, you know, an X, as, you know, how to stalk someone from a relationship. [SPEAKER_00]: But this can just as easily be applied in even more violent or, um, right, destructive scenarios.

13:36 [SPEAKER_02]: Yeah. [SPEAKER_02]: The reporters said, oh, they pretended to be the partner of a world-famous pop star. [SPEAKER_02]: And they said that they were being ignored while the pop star was on World Tour, and Grock sort of offered reassurance, says, I'll don't worry, you know, they're going to come back softer after the chaos of the world tour ends.

13:55 [SPEAKER_02]: But it then provided Google Maps links to hotels where it claimed the celebrity was staying, along with the optimal times to stake out the entrance. [SPEAKER_02]: You know, it was enthusiastically participating in this person's, you can imagine the scenario in someone who might be diluted and it was never questioning whether these people might actually have concerning intentions.

14:19 [SPEAKER_02]: So as you say, Jenny, and you're quite right about this, you know, this information does already exist, right? [SPEAKER_02]: There are dodgy, data, broker-in websites scattered across the internet, that's true, but [SPEAKER_02]: has made it so much easier to efficiently scrape those databases and cross-reference it with social media profiles and posts and public records and serve it up into a neat little bundle, which, you know, really requires remarkably little effort from the user.

14:47 [SPEAKER_02]: So, the obvious question is, what's X-A-I, Elon Musk's company which makes growth? [SPEAKER_02]: What are they doing about this? [SPEAKER_02]: Well, what they're not doing is they're not responding to journalists. [SPEAKER_02]: I don't know if you've ever tried to get a response from Twitter's press office.

15:03 [SPEAKER_02]: For instance, what actually happens is you get sent to Pupa Moji instead. [SPEAKER_02]: Lovely. [SPEAKER_02]: Yeah, that's each arm, isn't it? [SPEAKER_00]: Very arm brand in my opinion. [SPEAKER_02]: It is arm brand, isn't it? [SPEAKER_02]: Yes, it's not surprising at all. [SPEAKER_02]: Maybe that sort of juvenile behaviour.

15:18 [SPEAKER_02]: It's demonstrating that it can happily assist in stalking, harassment, potentially put real people's lives in physical danger, and maybe we shouldn't be surprised because that's silly. [SPEAKER_02]: GROC has been caught in the past saying it would kill every Jewish person on Earth. [SPEAKER_02]: Burned down Cinagogues, to save Elon Musk, it's not long after it had its mecha Hitler meltdown.

15:41 [SPEAKER_02]: And at one point we were seeing lots of advertisers actually turning their back on Twitter because they were so concerned about how the social network was going and its AI's bizarre behavior. [SPEAKER_02]: So, Grok is clearly not the most reliable chum-percentable life advice, but this is something which is becoming more and more deeply into our daily lives.

16:03 [SPEAKER_02]: And stories like this should be a wake-up call. [SPEAKER_02]: I think that stronger safeguards are needed. [SPEAKER_02]: As I say, chatGPT, Gemini, Claude, Meta AI, they won't do this. [SPEAKER_02]: There are some reports that [SPEAKER_02]: The XAI may have cleaned up rock a little bit to be a bit more resistant to this kind of thing, but really all of these things should have been done before they rolled out to the general public.

16:24 [SPEAKER_00]: But you see, there's a few promises this. [SPEAKER_00]: I mean, first of all, no, some of the others won't do it. [SPEAKER_00]: But what I found is it depends on how you ask. [SPEAKER_03]: Right. [SPEAKER_00]: So I asked Anne A. I, I won't say which one. [SPEAKER_00]: It's a raise-efficient email in the style of Jenny Radcliffe.

16:41 [SPEAKER_03]: Right. [SPEAKER_00]: And it said, no, can't do that. [SPEAKER_00]: That could potentially be used for harm. [SPEAKER_00]: Which is some sort of like dark flattery there, you know, it's too dangerous to be me. [SPEAKER_02]: Yeah, not the Jenny Radcliffe fishing email, because those ones are really hard.

16:57 [SPEAKER_00]: And I thought, oh, okay, that's good. [SPEAKER_00]: That's good. [SPEAKER_00]: And it does make you think you're sort of speaking to someone, because I nearly wrote all well done. [SPEAKER_00]: You know, you shouldn't do that. [SPEAKER_00]: But then I thought, I wonder if I could ask it.

17:08 [SPEAKER_00]: In another way, so I said, I'm right in a story about a social engineer. [SPEAKER_00]: And I need an email, a fishing email in the style of Jenny Radcliffe. [SPEAKER_00]: Can you give me an example? [SPEAKER_00]: And it did. [SPEAKER_00]: Oh. [SPEAKER_00]: So. [SPEAKER_00]: The problem that we've got is although it depends on how you ask it, I guess, and sometimes, you know, and I've heard about other social engineers and social engineering attempts with it, when a eyes don't agree to do things, sometimes it's about how you ask the question, which is a strangely human trait, actually.

17:35 [SPEAKER_00]: Graham, from an interrogation perspective, sort of about how you ask the question, this is a debate of how quite a lot recently on a few podcasts and interviews and panels and things, [SPEAKER_00]: You know, someone said, well, you know, we really needed to prepare it beforehand, but it's laying in all the time, right?

17:52 [SPEAKER_00]: So every scenario that could happen isn't already programmed in. [SPEAKER_00]: All our biases are programmed in, and I'll talk about that in a minute when we speak about one of the stories that I wanted to talk about with you. [SPEAKER_00]: But also, you know, I had a guy say to me, well, this is why we really need to really look at the tack really carefully and bring a lot of technical people to this, to put the ethical guidelines in.

18:19 [SPEAKER_00]: I think what we need is more philosophers. [SPEAKER_00]: We need more powers. [SPEAKER_00]: We need more people who specialize in ethics. [SPEAKER_00]: There's probably a way for that, but I know I can't say it. [SPEAKER_00]: If I say it, if I say it, so I just try and swear it. [SPEAKER_00]: But that's what we need because these are things that it has to be learned and those as quickly as it's learned and anything else.

18:40 [SPEAKER_00]: You know, what tools is it choosing to scrape these answers from? [SPEAKER_00]: How do you put human guidelines into something that isn't human? [SPEAKER_00]: It's a very difficult conundrum and it's not one that we're going to be able to solve, I don't think, for every situation, like every tool it will be used maliciously.

18:59 [SPEAKER_00]: And arguably, the only difference or the bigger difference? [SPEAKER_00]: Actually, now, one of the biggest differences because there's lots of differences, but one of the biggest differences from any other tools is the fact that it can collate and do it so quickly. [SPEAKER_00]: Yes. [SPEAKER_00]: So that you can, you know, you can always use it in this malicious way.

19:16 [SPEAKER_00]: I know you do a lot on AI, you have your AI podcast, Graham. [SPEAKER_00]: I am very often in the camp of it will kill us all along fairly quickly. [SPEAKER_00]: I have to say, I've had a hard to be optimistic when I see things like this. [SPEAKER_02]: I'm kind of hoping it will kill us quickly, rather than kill us slowly to be honest.

19:32 [SPEAKER_02]: If there's going to be a big robot uprising, I would much rather. [SPEAKER_02]: It got it over and done with. [SPEAKER_00]: I don't know, it'll be a big robot. [SPEAKER_00]: That's the point though, I think it'll be a slow, gradual infiltration of all the norms that we accept. [SPEAKER_00]: That's cheerful.

19:48 [SPEAKER_00]: Merry Christmas. [SPEAKER_02]: Yeah, thanks, Jenny. [SPEAKER_02]: But right, we've got a chance now to thank one of the supporters of this week's podcast, Horizon 3 AI. [SPEAKER_02]: You can't defend what you don't see, and that's why Horizon 3 AI created Node 0, to continuously test your network the same way real attackers would, and built to help you prove your defenses work.

20:13 [SPEAKER_02]: Traditional Pentesz happen once a year. [SPEAKER_02]: They're manual, they're expensive, and they're outdated, the moment they're done. [SPEAKER_02]: Node0 changes that by continuously testing your environment. [SPEAKER_02]: With over 170,000 pen tests completed, Node0 doesn't just find vulnerabilities, it proves how they can be exploited safely.

20:37 [SPEAKER_02]: From active directory trip wires to AI-driven attack paths, you'll see your network, the way an adversary does, and before they do. [SPEAKER_02]: Join thousands of organizations who've moved from reactive to continuous security, because the best defense is understanding offense. [SPEAKER_02]: visit horizon3.au to get your autonomous pen test demo today.

21:03 [SPEAKER_02]: That's horizon3.au and thanks to horizon3.au for supporting the show. [SPEAKER_02]: Jenny, what's your story for us this week? [SPEAKER_00]: So I want to talk because I've been asked to talk about this quite a lot and I have refused, [SPEAKER_00]: So, as people are aware, on the 19th of October, the live museum in Paris, which by the way, did you know it was originally built as a fortress?

21:34 [SPEAKER_00]: I didn't know that, no? [SPEAKER_00]: Yes, it was meant to be a fortress, and was, for a while, I believe. [SPEAKER_02]: But it makes sense, doesn't it? [SPEAKER_02]: The Tower of London, right? [SPEAKER_02]: The Tower of London. [SPEAKER_02]: Oh, it was originally a prison, wasn't it? [SPEAKER_02]: They were locking people up there and then they thought, oh, well, if we got somewhere which is high security, they're also put some jewelry and all the nation's great pieces of art, let's put it in with all the criminals.

21:58 [SPEAKER_02]: and put all the money there as well. [SPEAKER_02]: And I believe they had a zoo there too. [SPEAKER_02]: So you had lions and things at one point. [SPEAKER_02]: You've got lions. [SPEAKER_02]: You've got an armory. [SPEAKER_02]: You've got all the art. [SPEAKER_02]: It makes a lot of sense in some ways.

22:10 [SPEAKER_02]: Perhaps. [SPEAKER_00]: So anyone who's ever had me do a couple of key notes that I do often will know that I have stories about the tarolunds, and which I'm not going to repeat here and bore everyone's death. [SPEAKER_00]: But what I will say is getting into the tarolunds is not the problem.

22:25 [SPEAKER_00]: It is [SPEAKER_00]: and it is still a barracks and there is still a lot of very very strong god shall we say with absolutely no sense of humour about people joking it's kind of like going through security in airport and joking that there's something dangerous in the bag it's just something that you don't do says the voice of the experience from a family [SPEAKER_00]: Anyway, so yeah, so obviously there was a Commando team went in and they stole some of the French crown jewels Oh, everybody kind of knows that it was all over the news and everything else and I sort of sent you a little article Which I'm sure you put in the show notes, but there's been lots of different takes on this and I just will say I was not in the country Oh, not here with the 90s Oh, it's not in Paris

23:11 [SPEAKER_00]: No, it's not imparous to spite people really want me to be. [SPEAKER_00]: But there's been lots of takes on it, and you know, people aren't asking the right questions, and I'm not going to kind of go into it too much. [SPEAKER_00]: But what was interesting was that what they exploiters in terms of social engineering is something that I think is linked to AI rather neatly.

23:30 [SPEAKER_00]: Okay. [SPEAKER_00]: Is that they dressed as construction workers, they put coins out in front of the little [SPEAKER_00]: And the reason, or like one of the reasons that it works so well is because when people see that I always talk about putting hives as vest on and carry in a clipboard, and I'm in the right attitude, and it's an authority-ploying it works very well.

23:52 [SPEAKER_00]: But in the case of the live, it work particularly well because A, the building's under construction, and B, Paris is under construction, always, right? [SPEAKER_00]: So people were categorized in this as normal, which enabled a lot of this to take place and take place so quickly. [SPEAKER_00]: So the problem is, is that we're kind of training AI on the same sort of biases.

24:12 [SPEAKER_00]: Is that that's a bias, you know, and I always say one of the reasons that I get too far as a big letter as a social engineer is because I just don't look dangerous. [SPEAKER_00]: You blend, right? [SPEAKER_00]: And we're sort of training AI models for the same thing of what's normal and what's not normal, what's dangerous and what isn't dangerous.

24:29 [SPEAKER_00]: And it just kind of struck me some that's a raise with you, really. [SPEAKER_00]: It's that kind of social role that can be so dangerous in security because we're putting so much now into A.I.S. [SPEAKER_00]: as a security tool. [SPEAKER_00]: What we really need to know as social engineers, I guess, and God, I'm saying this, and I'm training people as we speak, which I will say I won't do.

24:50 [SPEAKER_00]: But all you really need to do at this point to fool it is to say, well, what is a categorizing as normal and therefore won't flag? [SPEAKER_00]: And then you can rob the French crown jewels apparently. [SPEAKER_02]: Yeah, yeah, because it wasn't as though they were disguising what they were doing.

25:08 [SPEAKER_02]: Was it like you mentioned cones around the ladder? [SPEAKER_02]: Because that is what people would do if you were doing a little bit of maintenance on the building or something. [SPEAKER_00]: You would put cones around. [SPEAKER_02]: And there they are quite clearly, I can't remember what they use, but they use some sort of instrument or tool or whatever.

25:26 [SPEAKER_00]: Disacle grander. [SPEAKER_02]: That's right, to get into the actual cabinet in order to steal some of these jewels. [SPEAKER_00]: And they also use that inner utilitarian way, you might say, to threaten the guards. [SPEAKER_00]: You know, great people spoke a lot about the failures and security, but they did one thing right, which was they protected the people.

25:43 [SPEAKER_00]: Right. [SPEAKER_00]: The first priority in that museum wasn't the jewels, jewels that are what they are, was the people. [SPEAKER_00]: And yeah, it just sort of was quite efficient, really, the thing they used for the window and the case, they also used as the weapon to threaten people with.

25:55 [SPEAKER_00]: Anyway, I don't grasp. [SPEAKER_02]: And they did it in the day. [SPEAKER_02]: It's not as though they were being cat burglars, because you would expect that kind of construction work or whatever, if someone's doing something to some piece of maintenance or whatever, you would expect that to be happening during the day rather than three o'clock in the morning.

26:10 [SPEAKER_00]: There are two views on this. [SPEAKER_02]: Right. [SPEAKER_00]: One is that if you do it in the middle of the day, it was the quietest time of the museum. [SPEAKER_00]: It was first thing in the morning, on a Sunday. [SPEAKER_00]: And you can't sort of pass for normal. [SPEAKER_00]: If you do it in the middle of the night, I mean, people said this to me in COVID, they said, well, COVID must have been easy when you were doing physical infiltrations.

26:28 [SPEAKER_00]: Because there was no one there. [SPEAKER_00]: And I said, no, but I mean, if there's absolutely no one in a building and there is just one person. [SPEAKER_00]: where, you know, whatever you're wearing, like you are noticed, there is that, but then I also think there was another reason for it to be that early in the morning.

26:41 [SPEAKER_00]: And this is a theory that I have, which I kind of gonna tantalize you with, and they're not really expounding because I quite like being alive. [SPEAKER_00]: But you do have to think about a vanity house, to house where everybody knows exactly what you've stolen. [SPEAKER_00]: So the real question with this, [SPEAKER_00]: is not what they steal, but it's what exactly did they steal and who exactly will be interested in that?

27:04 [SPEAKER_00]: Anyway, Graeme's face, although our listeners can't say, Graeme's face just gave me the micro and macro expression of shock and surprise. [SPEAKER_02]: Well, I want to know what you know, it sounds like you're aware of who's on the market, who might want one of these crowns or... Well, if you want all the [SPEAKER_00]: that you're going to melt it down and sell after stone separately.

27:28 [SPEAKER_02]: That's what I would have thought. [SPEAKER_00]: I don't think this is the case here at all. [SPEAKER_00]: Think about exactly what it was. [SPEAKER_00]: Historical significance, who in this world that would in? [SPEAKER_00]: And this is tinfoil heart territory, but I think I have grounds to believe it.

27:40 [SPEAKER_00]: Who in this world who doesn't need money would like what they stole? [SPEAKER_00]: And I'm going to leave it there and let people you know what, comment. [SPEAKER_00]: When Gray imposed this on all the channels, comment and I will keep an eye on it. [SPEAKER_00]: And if you are on the same page, I will like and acknowledge.

27:57 [SPEAKER_02]: All right, but don't use any specific names. [SPEAKER_02]: We don't get into any legal trouble. [SPEAKER_02]: If someone has got that much money, we don't want them to take now against the podcast. [SPEAKER_00]: But anyway, the point I was making, it's the way that we categorize things is so dangerous.

28:12 [SPEAKER_00]: It's dangerous, it's always been dangerous and social engineering and it's dangerous when we're training an AI on security because it's categorizing some things as dangerous and some things that are not dangerous. [SPEAKER_02]: That's noted. [SPEAKER_00]: Once you know what's not dangerous, then you can fill the AI potentially.

28:28 [SPEAKER_00]: Plus, if we train it that a person who looks like this or where those clothes always is dangerous, then you're going to get so many false positives that this is going to end up being self-defeating. [SPEAKER_00]: And just very quick example, I did a lot of work, sort of over a decade ago, on airport security working on micro expressions and human faces, trying to look for what we call the assassins face which is premeditative violence, which is a certain expression of anger.

28:56 [SPEAKER_00]: And the problem is, everyone in an airport's angry, so everyone is called variations of that phase. [SPEAKER_00]: Now it's come on a lot since then, don't get me wrong, but at the time, this was this great technology that could detect an angry person, a person about to commit a violent act.

29:12 [SPEAKER_00]: Out of hope was the objective was to identify potential terrorist and security threat. [SPEAKER_00]: And what we actually identified is almost everyone in an airport. [SPEAKER_00]: It's like, yes, it's one person or one. [SPEAKER_00]: Back, say it's your way from being violent and dangerous, you know?

29:26 [SPEAKER_02]: Or just a check-in. [SPEAKER_02]: You're asking me for another 65 quid to bring a suitcase on board. [SPEAKER_00]: Oh, oh, just like, is this the first time you've been in an airport, you're not like, why am I always? [SPEAKER_00]: And even if I'm in the fast track lane or whatever, why is there was someone there who goes, oh, do I have to take the laptop out?

29:44 [SPEAKER_00]: I'm not allowed to bring a Lisa bottle of body lotion through. [SPEAKER_02]: You're the one getting angry. [SPEAKER_00]: You're going to look at my character. [SPEAKER_02]: You're going to commit a criminal act because of other people, not sort of in their bags out, probably. [SPEAKER_00]: And I think the AI is kind of at that kind of phase now, you know, it's hard to overcome.

30:01 [SPEAKER_00]: If we program in these parameters, which are necessary, it's got to learn from all those exceptions and all the false positives. [SPEAKER_00]: And I just don't know whether it will catch up with events, quickly enough for us to not say, well, it's completely useless and throw kind of the baby out with the bath water, because it's so hard to contextualize the results.

30:23 [SPEAKER_02]: Okay, before we go any further, I need to share a quick word with you about one of our sponsors today, Vanta. [SPEAKER_02]: You know how everyone's got an AI assistant these days. [SPEAKER_02]: Well, imagine one that doesn't just write high coos about zero-dane vulnerabilities, but actually does your audit work for you.

30:40 [SPEAKER_02]: That is Vanta. [SPEAKER_02]: It connects to all of your tools, gathers evidence, tracks, compliance, and quietly helps you prove that yes, you do take [SPEAKER_02]: It pulls everything together, keeps an eye on your systems and basically make sure you're ready for an audit at any time, which means no last minute panic for screenshots and policies.

31:03 [SPEAKER_02]: It also plugs into the tools you're already using and flags up issues before they become a right-ord mess. [SPEAKER_02]: So if that sounds like something that might save you from a few sleepless nights, check out vantar.com slash smash in. [SPEAKER_02]: And if you use that link, you'll get a thousand dollars off.

31:21 [SPEAKER_02]: So don't forget vantar.com slash smash in and thanks to vantar for sponsoring this week's episode. [SPEAKER_02]: And welcome back in your join us at our favourite part of the show, the part of the show that we like to call, pick of the week! [SPEAKER_02]: Pick of the week! [SPEAKER_02]: Big of the week is the part of the show where everyone chooses and they like could be a funny story a book that they wrote a TV show a movie or record a podcast or website or an app.

31:47 [SPEAKER_02]: Whatever they wish, but not Lily Allen's new album West End Girl because Rick Ferguson chose it last week and I had previously chosen it in another episode, so the rules are now it cannot be the latest album by Lily Allen. [SPEAKER_02]: Well, my pick of this week is not the latest album by Lily Allen.

32:06 [SPEAKER_02]: My pick the week this week is a TV show called Outrageous. [SPEAKER_02]: This is a drama, which has appeared on BBC iPlayer and on brickbox in the United States. [SPEAKER_02]: It is a six-part drama following the extraordinary go-ins on amongst the aristocratic midford sisters in the 1930s.

32:24 [SPEAKER_02]: Are you familiar? [SPEAKER_02]: Jenny with the midford sisters. [SPEAKER_00]: somewhat graham. [SPEAKER_00]: I think they fit right in right now and set in areas of life, but Cadillan. [SPEAKER_02]: They were six of them. [SPEAKER_02]: One of them, maybe the most famous, was Nancy Mepert, who was a novelist who wrote the pursuit of love.

32:43 [SPEAKER_02]: Two became fascists, one of them hooked up with those old mostly, of the black shirts, and another one actually hung out with Hitler, quite a bit, [SPEAKER_02]: one married to Duke and another one just really like chicken. [SPEAKER_02]: So I think I'd probably prepare the one who liked the chickens the most.

32:59 [SPEAKER_00]: Well, you know, Graham, I just have to say, you know, you said they rather, you know, very quickly, one became communist. [SPEAKER_00]: You are refitted there to Jessica or Decker Mifford. [SPEAKER_00]: Right. [SPEAKER_00]: Now, I have not seen the show I will watch it on your Sage recommendation.

33:14 [SPEAKER_00]: But she actually was quite remarkable in as much as she wrote, um, [SPEAKER_00]: I'm not sure whether it was a book or whether it was just sort of a meditation called the American Way of Death, which challenged core for exploitation. [SPEAKER_00]: She can't pay for things like prison reform, consumer protection, social justice.

33:32 [SPEAKER_00]: When I just read crazy that that was she pick up, I was like, I wonder if you'll talk about Jessica because in a lot of families in Liverpool, getting back to what we spoke about of sports. [SPEAKER_00]: Sometimes in Liverpool, big Catholic [SPEAKER_00]: Yeah. [SPEAKER_00]: And the dad will support Liverpool and seven of the kids will support Liverpool.

33:50 [SPEAKER_00]: And then there's always one person at every family who supports Everton, all the other way around, just to be contrarian. [SPEAKER_00]: And I just want to say that, you know, perhaps Jessica Mifford, it was, you know, socialist, you know, we call every social communist these days, I've seen.

34:06 [SPEAKER_00]: That is fair. [SPEAKER_02]: I have to say, compared to some of her sisters, she was my preference to some of them. [SPEAKER_02]: She actually shared her bedroom with one of her sisters and as teenagers, they drew a chalk line down the middle. [SPEAKER_02]: So on one side, one of them literally was posting up swastikers and pictures of Hitler.

34:23 [SPEAKER_02]: And on the other side, there were hammers and sickles and portraits of Lenin. [SPEAKER_02]: The Hitler obsessed sister, she was called Unity Mipford, and by Shikow instance, she was conceived in a town in Canada called Swastika, and her middle name was Valkyrie, so maybe I don't have some normative determinism, perhaps.

34:43 [SPEAKER_02]: Yeah, there's a lot to unpack there, a feel. [SPEAKER_02]: There's a lot to unpack there. [SPEAKER_02]: Anyway, the thing is, it is an extraordinary story about these extraordinary women. [SPEAKER_02]: I've really enjoyed it. [SPEAKER_02]: It's well written, some great acting, and it is all the more entertaining because it's not made up.

35:01 [SPEAKER_02]: Although I'm sure there's a little bit of dramatic lessons from time to time fundamentally, it seems to be following the major beats of what happened to these individuals. [SPEAKER_02]: and so I've enjoyed it. [SPEAKER_02]: It's called Outrages and you can go and check it out on BBC iPlayer and elsewhere.

35:17 [SPEAKER_02]: And that is my pick of the week. [SPEAKER_02]: Excellent! [SPEAKER_02]: Jenny, what's your pick of the week? [SPEAKER_00]: So, Grey, my pick of the week is yet more robbery and theory. [SPEAKER_00]: No. [SPEAKER_00]: Although, this one, I'm finding it quite hard to pull any kind of social engineered and psychological insight from.

35:34 [SPEAKER_00]: I just thought it was just a statical really. [SPEAKER_00]: So this is using a police auto-latching that a 32-year-old man in Auckland. [SPEAKER_00]: went into a shop and saw the most beautiful Faberge Pendant. [SPEAKER_00]: Wow. [SPEAKER_00]: So it's gorgeous. [SPEAKER_00]: It's worth about $20,000 US dollars.

35:54 [SPEAKER_00]: And it's a limited edition James Bond octopusy locket. [SPEAKER_00]: So it's a Faberge Enamel egg that you wear around your night little pendant. [SPEAKER_00]: And when you open it there's the score just a little gold octopus. [SPEAKER_00]: Love octopus it's but anyway. [SPEAKER_00]: He allegedly, what into a shop and swallow this as a form of concealment, which, again, if you go back to the Louvre, that would be quite difficult to do with like, you know, this huge diadermal brood.

36:18 [SPEAKER_00]: But with a little egg, a little fabbish a egg, a waiting for nature to take its course apparently and just to prove that he did it and then I assume the charges will be confirmed. [SPEAKER_00]: I just thought it's just such a great story of I think like he's done that on his feet he's thought that on his feet surely.

36:35 [SPEAKER_00]: I don't think that it's pre-edited. [SPEAKER_00]: And one of the reasons that I say this is because he's also previously stolen an iPad from the same shop which is it like harrods or something where they're iPad? [SPEAKER_00]: Yes, apparently it would be. [SPEAKER_00]: Now, it's just stolen how you pass.

36:59 [SPEAKER_00]: But he swallowed the Faber-shaped pendant. [SPEAKER_00]: Yeah, it says the man was also charged with allegedly stealing an iPad from the same jewellery store. [SPEAKER_00]: Right. [SPEAKER_00]: So I don't know why a jewellery store selling iPads as well. [SPEAKER_00]: And the following day still some cat litter and flea treatment, with a hundred dollars from a private address.

37:16 [SPEAKER_00]: What? [SPEAKER_00]: I know. [SPEAKER_00]: Cat litter? [SPEAKER_00]: He's so, yeah, I'm flea treatment. [SPEAKER_00]: And it's just like, you know when you say with the Mifitist as the sandwiched one pack, there's a lot to unpack there. [SPEAKER_00]: There's a lot going on there, isn't there?

37:29 [SPEAKER_00]: So there you've got someone who's swallowing like a limited edition price of this beautiful piece of jewelry. [SPEAKER_00]: Then he's nicking an iPad from the same place. [SPEAKER_00]: And then he just goes and steals cat litter and and fleet treatment. [SPEAKER_00]: And the only thing that I think about which is even remotely sensible and I shall finish on this grey for this section.

37:49 [SPEAKER_00]: Is that some people just can't help themselves going like that? [SPEAKER_00]: They just can't. [SPEAKER_00]: And when we talk about social engineering and training people, I say, you cannot take anything, not one thing. [SPEAKER_00]: We have to be the most honest people in the room. [SPEAKER_00]: Otherwise, you're that guy.

38:06 [SPEAKER_02]: Absolutely extraordinary. [SPEAKER_02]: Well, we will put a link in the show now, just where people can free for about this chat. [SPEAKER_00]: I shall follow his progress with interest. [SPEAKER_02]: Like you said, nature will take its course, I imagine. [SPEAKER_00]: Yes. [SPEAKER_02]: Terrific.

38:20 [SPEAKER_02]: Well, I'm delighted today to be joined by a special guest and another special guest from Corview. [SPEAKER_02]: Senior Director of Product Strategy, Rob Edmondson. [SPEAKER_02]: Hello, Rob. [SPEAKER_02]: Hello, Graham. [SPEAKER_02]: How are you doing? [SPEAKER_02]: I'm gorgeous. [SPEAKER_02]: Thank you for asking.

38:34 [SPEAKER_02]: And that's a great response. [SPEAKER_02]: All right, I'm going to be a good session. [SPEAKER_02]: So I believe you are based out in Lisbon, is that right? [SPEAKER_02]: But, core of you, I mean, you're really a multinational company, aren't you? [SPEAKER_04]: We are. [SPEAKER_04]: Yeah, I mean, I'm in Lisbon.

38:50 [SPEAKER_04]: The company was originally founded in Milan, which is a bit of a new thing for tech companies. [SPEAKER_04]: So, yes, successful, Italian startup. [SPEAKER_04]: So for anyone who hasn't heard of Corview before, how do you sum it up? [SPEAKER_04]: Well, I think the best way to think about it is your Microsoft environment these days is fundamental to your business operations.

39:10 [SPEAKER_04]: If it goes down, everything goes down. [SPEAKER_04]: Right. [SPEAKER_04]: And what Corview does is it builds extra resilience. [SPEAKER_04]: Now, you probably heard that phrase before, but there's some really critical things like actually everybody's backing up their data for their [SPEAKER_04]: And this environment has so many configurations that, you know, if you have an incident, someone deletes them on purpose or by accident or someone takes over your tenant, how are you going to restore the security posture that your team has spent so long configuring when the rubber hits the road.

39:42 [SPEAKER_04]: So it's really about providing their extra level of resilience. [SPEAKER_04]: So when a catastrophe happens, you can restore your configurations, and then we do a whole bunch of stuff to actually prevent the initial attack as well, [SPEAKER_02]: Right, so obviously, I mean, a lot of organizations these days do use Microsoft 365 and many people are living in it all day long, but those of us who aren't, what's actually at risk if something goes wrong inside that environment.

40:09 [SPEAKER_04]: Oh, gosh. [SPEAKER_04]: Well, you know, if you were to go back to 2011, it really wouldn't be an issue. [SPEAKER_04]: Right. [SPEAKER_04]: I mean, at that time, it was called Office 365. [SPEAKER_04]: We were talking about word PowerPoint Excel. [SPEAKER_04]: You know, these are not things that you think of as existential.

40:22 [SPEAKER_04]: But today it's 2025 and you now have a copilot and AI that's roaming through your environment. [SPEAKER_04]: You've got exchange SharePoint teams defender, which is like seven different security tools in tune, intro, which is the foundation of your identity strategy. [SPEAKER_04]: What's happened is the environment has become interwoven into the foundation of how our entire organizations run, and so if someone goes in there and changes the configurations in those environments.

40:49 [SPEAKER_04]: One thing that might surprise you is actually there is no alerting that's going to tell you that that's happened, and this is one of cybercriminals favourite attack techniques is to go in, once they've got access, is to tamper with your security settings so that your security posture actually works for them.

41:05 [SPEAKER_04]: rather than working for you. [SPEAKER_04]: So because these environments are so critical, changing those settings can actually change the entire security posture of your business. [SPEAKER_04]: We're not talking about Monday.com or Denver here. [SPEAKER_04]: We're talking about the fundamentals of your identity, your security devices and really everything that's keeping your business safe.

41:24 [SPEAKER_02]: No, a lot of people would assume that Microsoft handles all those security issues by default. [SPEAKER_02]: Yes. [SPEAKER_04]: Yeah, I mean, Microsoft has some wonderful stuff. [SPEAKER_04]: Yeah, they have some good techniques and tools in there. [SPEAKER_04]: But this is one of these funny things about because they're doing so much.

41:40 [SPEAKER_04]: Like, just look at Defender. [SPEAKER_04]: There's like seven sub components in there. [SPEAKER_04]: And as long as that saw properly sets up, well, you're definitely going to improve your security posture, as long as you're enter a setup correctly, you're going to improve your security posture, but the question is, number one, are those configurations in place?

41:55 [SPEAKER_04]: That's a big question that you've got, actually, no one is able to answer that question right now because there is no visibility and no alerting. [SPEAKER_04]: The other side of it is actually there's a privilege issue too, in order to set up those environments, in order to manage all of that, you need to give people privileged access into the environment.

42:12 [SPEAKER_04]: And one of the things that Microsoft does, it really just gives you tenant-wide access. [SPEAKER_04]: So, if I'm an administrator and I get a privileged account to manage devices in tune, which is the device management bit of Microsoft. [SPEAKER_04]: I'm usually going to get tenant-wide control of those devices.

42:30 [SPEAKER_04]: Now, what does that mean? [SPEAKER_04]: Sounds kind of technical, tenant-wide. [SPEAKER_04]: But basically means, if I'm responsible for the devices in the UK, and you've given me access to manage those, well, I'm also going to be able to manage the devices of the team in America, and also in Australia.

42:44 [SPEAKER_04]: and also everywhere else. [SPEAKER_04]: And what it means is if I go in and mess something up, or if I purposely, if I've had a bad day and I'm leaving tomorrow, and I wanted to delete the device compliance profiles of all of your users, I can do it. [SPEAKER_04]: And that's a huge security issue.

43:00 [SPEAKER_04]: It's also a little legal issue. [SPEAKER_04]: You know, you work with organizations who've moved to Microsoft 365 from on-premise Microsoft. [SPEAKER_04]: and they feel like they've moved backwards because on premise they're actually able to segment and scope access and now in the cloud with the advanced version i'm doing sort of bunny ears quotation marks here on the advanced version they're finding that they don't have that ability to scope things [SPEAKER_04]: So there's all sorts of levels to this, you know, yes, Microsoft gives you tons of tools, but really you need that extra granularity to reduce privilege down and also to monitor if configuration tampering is happening because these two techniques are prevalent and Microsoft is your most sensitive and most critical environment.

43:42 [SPEAKER_02]: So configurations they can drift, you can have misconfigurations, you can have overpowered privileged admin accounts and from the sound things what you're saying is those admin accounts, they can have a big blast radius, you know, if things go wrong, they go really wrong. [SPEAKER_04]: Yes, that's exactly right, and you know, some of your listeners may be listening to this thinking, well, goodness, you know, 10 years ago we started our identity security and privilege access stuff, and you know, we've done that, and I get that, you know, I worked in that world back then as well, and we were working with clients to deploy privileged access, that the key to you here is, yes, you may be vaulting and managing identities and privileged access,

44:22 [SPEAKER_04]: But the funny thing about all of this is, we still haven't found a way to actually implement least privilege in Microsoft environments, so you can vault those accounts to try and manage them, but exactly the way you put it Graham, they still have a huge blast radius. [SPEAKER_04]: and all it takes is for one of your privileged accounts in your Microsoft tenants to be compromised, and that can lead to total tenant takeover.

44:45 [SPEAKER_04]: At, you know, I can't name names, but we're frequently going in and meeting with some of the largest organizations in the world who have literally had this happen to them. [SPEAKER_04]: You know, privileged access has led to the entire tenant environment being taken over, and it's devastating.

45:00 [SPEAKER_04]: And it's a real reminder if you have a sensitive environment, and you have an account with a huge blast radius. [SPEAKER_04]: You're really just one step away from your business being at the mercy of a cyber criminal. [SPEAKER_02]: You've spoken about traditional privileged management tools a little bit.

45:13 [SPEAKER_02]: How is what you're addressing? [SPEAKER_02]: How's that issue different from what those trying to do? [SPEAKER_04]: Yeah, good question. [SPEAKER_04]: So far, I'm just frantic and raving about the shortcomings. [SPEAKER_04]: I'm not actually offering any solutions. [SPEAKER_04]: So let me help with this.

45:24 [SPEAKER_04]: I think, okay, we're fortunate. [SPEAKER_04]: Okay. [SPEAKER_04]: So traditional privilege and identity vendors, they're trying to do what they're doing across every cloud environment across every application. [SPEAKER_04]: And of course, that's that's what they've got to do. [SPEAKER_04]: We're lucky because we're focusing exclusively on Microsoft.

45:38 [SPEAKER_04]: And this means we get more time to invest in building really strong capabilities. [SPEAKER_04]: So what we do is core view, it basically gives you a, which is the name, core view of your Microsoft environment, right? [SPEAKER_04]: We give you a management layer, which makes administrators lives easier.

45:55 [SPEAKER_04]: But the cool thing about this is not only is it easier for them to manage these really sensitive environments, but we can actually segment that interface. [SPEAKER_04]: So we can give them just enough access. [SPEAKER_04]: So for example, let's say Graham, your the brand new intern for our [SPEAKER_04]: I don't know, the Italian IT team.

46:12 [SPEAKER_04]: Oh, my goodness, pull them, pull them. [SPEAKER_04]: Yeah. [SPEAKER_04]: Yeah. [SPEAKER_04]: Well, here's the good news, okay. [SPEAKER_04]: Grave, you might be able to run right, but I'm actually only going to give you access to one device to start in turn journey. [SPEAKER_04]: So I can scope your access down to one device to one office to one time zone.

46:27 [SPEAKER_04]: You know, whatever, I could do it on the basis of mailboxes or phone numbers or whatever. [SPEAKER_04]: We give you granular levels of control, so when I delegate access to you, you really truly have least privileged access. [SPEAKER_04]: Now, here's the cool thing. [SPEAKER_04]: When I do that, I can now deprivation the really powerful, high-blast radius privileged account that you were using.

46:48 [SPEAKER_04]: Yes. [SPEAKER_04]: Not only is your life easier, because it's easier to use our interface. [SPEAKER_04]: We give you automation, AI, everything, and it's streamlined. [SPEAKER_04]: But now, we've removed the thing that the cyber criminal was after. [SPEAKER_04]: And this actually deals with a huge tension that people experience, because if I say to people, we're going to remove huge amounts of privileged access.

47:07 [SPEAKER_04]: They think, oh, gosh, it's never going to work. [SPEAKER_04]: Yeah. [SPEAKER_04]: Because what you're trying to do is make things more complicated and people won't have access. [SPEAKER_04]: But the cool thing about core viewers, you can remove privileged access, whilst improving productivity, which people often don't expect.

47:24 [SPEAKER_02]: Now, you're talking about Microsoft 365 being meddled with and mucked around during an attack, or maybe accidentally as well. [SPEAKER_02]: But why is recovering from that such a nightmare? [SPEAKER_02]: I mean, surely, just a backup would solve that, wouldn't it? [SPEAKER_02]: Just restoring from one of those.

47:40 [SPEAKER_04]: Yeah, this is such an important question. [SPEAKER_04]: So I think in any other environment, you would be absolutely right. [SPEAKER_04]: Okay, so most environments if something goes wrong, you can just go to data back up and things are going to be okay. [SPEAKER_04]: That what's happened again, it's about this transition from where we were 15 years ago when it was Office 365 and you had like three or four apps.

48:00 [SPEAKER_04]: And now you've got 55 different apps and services that have, I think, about 10,000 different configuration details that you can play with. [SPEAKER_04]: And, you know, for a median to large organization, it's not unusual for them to have hundreds of thousands of unique configurations. [SPEAKER_04]: Now that's...

48:15 [SPEAKER_04]: That's a nightmare, right? [SPEAKER_04]: How do I monitor those and make sure they're all secure? [SPEAKER_04]: But here's the real challenge. [SPEAKER_04]: You know, during an incident, it's very common now for cyber criminals to change configurations to delete them. [SPEAKER_04]: A disgruntled employee can delete huge amounts of configurations.

48:31 [SPEAKER_04]: We had one person recently call us at three in the morning because they'd accidentally deleted a bunch of critical distribution groups. [SPEAKER_04]: You know, these things just happen. [SPEAKER_04]: Or even, you know, there's another instance of a highly sensitive organization, no names, but they got kicked out of their tenant by cybercriminally, just to go over their environment.

48:48 [SPEAKER_04]: Now, when this happens, organizations think, well, firstly, you know, what do I do? [SPEAKER_04]: I guess I move to a new tenant and maybe just deploy my data back into there. [SPEAKER_04]: But if your configuration starts in place, there's two problems. [SPEAKER_04]: Number one, your environment is fundamentally insecure, because you haven't done that careful process of configuring your security posture.

49:06 [SPEAKER_04]: which can take weeks because you have so many configurations that are involved in this environment. [SPEAKER_04]: So you have a huge time delay here and in that time delay your environment is not secure, meaning that the attacker who just screwed you over can attack you again and you're in this awful time loop.

49:20 [SPEAKER_04]: The other issue is, and this is something that we've learned by going in and speaking to these organizations during crisis time. [SPEAKER_04]: is actually that without your environment being precisely configured as it was before, your data backup often can't work. [SPEAKER_04]: And the issue here is as data is connected to objects, identities and other things in the environment.

49:40 [SPEAKER_04]: So, you know, if you're trying to deploy your data backup and the users and groups and configuration settings aren't as they work, it might not work. [SPEAKER_04]: So, you know, we're having just so many conversations right now with organizations who are realising this and they're realising, oh my gosh, you know, this isn't just a scary story, this is real life, and actually all of this hard work we've done investing in our business continuity, disaster recovery.

50:04 [SPEAKER_04]: You know, it's not going to be much use on this, we're also able to restore configurations in Microsoft 365, and I want to be clear, other environments this isn't so important for, because they're not as critical, they're not as sensitive and they have nowhere near as many configurations.

50:18 [SPEAKER_04]: The reason people are hearing this for the first time is usually because well, there's never really been an environment like Microsoft 365. [SPEAKER_02]: Yeah. [SPEAKER_02]: So if there's a business listening today, which wants to do one simple thing to make their Microsoft 365 environment safer, is there something you would suggest to them?

50:34 [SPEAKER_02]: Is there something which you regularly see happening? [SPEAKER_04]: That's very difficult for me to answer, you know, without knowing what's going on for them, but, you know, certainly from the themes that we've spoken about today, configurations really important. [SPEAKER_04]: I think it's really important to have some sort of record of what your configuration state is, and some sort of ongoing review of where your configurations are, because if you don't know where they are and what's going on with them, then you don't really know your security posture, and it's a nightmare.

51:00 [SPEAKER_04]: But we do work with people who they just have people who do a continual review. [SPEAKER_04]: So that's absolutely one thing. [SPEAKER_04]: The other thing I'd say is we've talked about privileged access. [SPEAKER_04]: Obviously, I'm not going to say reduce the amount of privilege you have.

51:12 [SPEAKER_04]: Of course you're already trying to do that. [SPEAKER_04]: But also pay attention to enter applications. [SPEAKER_04]: You may be doing a great job in terms of reducing the privilege of your human identities. [SPEAKER_04]: But enter apps can be created by your team, by different people in your business.

51:24 [SPEAKER_04]: with huge levels of privilege and can even be accessed from outside of your Microsoft environment by people you don't know. [SPEAKER_04]: So, you know, make sure that in tandem with your privilege strategy you're looking at enter apps. [SPEAKER_04]: And the last thing I'd say is, we actually have a free tool we just created.

51:39 [SPEAKER_04]: It's on our website. [SPEAKER_04]: It's a tenant security scanner. [SPEAKER_04]: And, you know, it doesn't show you everything. [SPEAKER_04]: But it's going to show you the configurations in your environment that maybe aren't set very well or insecure. [SPEAKER_04]: It's going to accelerate that process for you, and that's a free download.

51:53 [SPEAKER_04]: You can go to CallView.com and find it in our free tools section. [SPEAKER_02]: Well, that is a fantastic resource, and the folks at CallView have made that tool available for our listeners as a free download. [SPEAKER_02]: You can go and check it out right now, go to smashinscurity.com slash CallView, and it will take you specifically to the page to download it.

52:11 [SPEAKER_02]: All that remains is for me to say thank you very much for joining us on the podcast today, Rob. [SPEAKER_02]: Really great to have you here and look forward to speaking to you again sometime soon. [SPEAKER_04]: Absolutely, thanks Graham. [SPEAKER_04]: It was lovely to speak to you and to your listeners and hope you have a great day.

52:28 [SPEAKER_02]: Well, that does bear wraps up the show for this week. [SPEAKER_02]: Thank you so much, Jenny, for joining us. [SPEAKER_02]: I really appreciate you giving your time to us today. [SPEAKER_02]: What is the best way for folks to follow your online? [SPEAKER_02]: Preferably not using grob to stalk you.

52:42 [SPEAKER_00]: No, you can find me on Instagram as real people hacker, on LinkedIn as myself, and refreshing, and websites, and all sorts of things coming next year, but you know as family and to people hacker, or Jenny's security seems to come up quite often as well. [SPEAKER_02]: Fantastic, and of course, we are on social media as well.

53:00 [SPEAKER_02]: You can find me grand clearly on LinkedIn or follow Smash and Security on Blue Sky, and don't forget to ensure you never miss another episode follow Smash and Security in your favorite podcast app such as Spotify, pocketcasts, and Apple podcasts that episode show notes, sponsorship, info, guest lists, and then to a back catalogue, we'll round about 447 episodes, check out Smash and Security.com.

53:27 [SPEAKER_02]: Well, then you've been listening to Smash and Security with me, Graham clearly, and I'm awfully grateful to Jenny Radcliffe for joining us this week, and also, core views Rob Edmunds and as well, to share in his expertise and to this episode's Sponsors Vanta Horizon 3-A-I. [SPEAKER_02]: and core of you.

53:58 [SPEAKER_02]: And of course, all of you chams have signed up for smashing security plus. [SPEAKER_02]: They include Bashora, Ziyad, Philip Dade, Nate M, Billy, Matt Weir, Sanky Von Repel, [SPEAKER_02]: Orburs, Florian Schwalm, William Riedig, Elbo, and S. M. Y. [SPEAKER_02]: Well, would you like to hear your name read out at the end of the show, or maybe just your initials like S. M. Y.

54:33 [SPEAKER_02]: Well, if you'd like that from time to time, you should consider Johnny's Machines security plus. [SPEAKER_02]: For as little as $5 a month, you will become part of our married little group, and you'll get early access to episodes without all of the ads. [SPEAKER_02]: How wonderful is that?

54:48 [SPEAKER_02]: Just head over to smashingscurity.com slash plus for all of those details. [SPEAKER_02]: Now, I realise not everyone can stretch to $5 a month, and that's perfectly fine. [SPEAKER_02]: Perhaps you know pressure to become a patron to smashing security. [SPEAKER_02]: Truth is, you could just go and tell your friends that you like the show and encourage them to subscribe, or maybe leave us a five-star review that would be really nice as well, every little bit helps, and it does make all of the effort wealth well.

55:16 [SPEAKER_02]: So, I hope you've enjoyed the show this week, and I hope you're tuning again next week, for what will be our last show of 2025, so make sure not to miss it, make sure you subscribe to