perspectives on when the world stayed home

How Organizations Must
Rethink Security in a
Work From Home World
Advice From a Recovering Hacker
An interview with Alissa Knight, group CEO at Brier & Thorn, partner at Knight Ink andprincipal analyst“It’s the human condition to believe that weKnight began hacking at 13 years old. She wasare prepared. But then when the thing actu-

caught hacking into a government network

ally happens, you realize how unprepared you

when she was 17. Released on a technicality,

actually were.”

she later began working for the U.S. intelli-Alissa Knight watched the pandemic arrive.
She saw organizations struggle to maintain
operations.
She realized these organizations were about todrop their guard.

gence community supporting the cyber warfare directorate.
Since then, Knight has founded and sold multiple ventures in the cybersecurity space, started
a venture capital fund, has published a book on
hacking connected cars, and has continued to

She knew hackers would take advantage ofwork hands-on within the cybersecurity field

the moment.

for the past twenty years.

And she knew how to stop their attacks.

When the pandemic struck, Knight guided

CYBER THREATS OPENED BY COVID-19

A Recovering Hacker’s Perspective

many of her clients through the new security
challenges opened up by COVID-19 and themass mandate to Work From Home (WFH).

Alissa Knight is a recovering hacker, serial

Knight knows the vulnerabilities that organiza-

entrepreneur, author, and thought leader. She

tions now face. She understands how hackers

currently acts as group CEO of the managed

are exploiting these vulnerabilities. And she

security service provider Brier & Thorn, a part-has learned the steps organizations must takener at Knight Ink, and as principal analyst atto defend themselves today and tomorrow—

Alissa Knight & Associates.

no matter what comes next.

©2020 Tanium. All rights reserved.

1Here is what Knight has learned.

and gaming devices. Any of these could becompromised. Adversaries could then move

A LOW BAR FOR ENTRY

laterally to the employee’s personal work

COVID and WFH OpenNew Vulnerabilities

device, compromise that, and then move tothe corporate network over VPN split tunnels.

The pandemic struck. Businesses began to
shut down. Workers were sent home.

Less Security
Organizations did not extend their existing

Knight watched this, and began to worry.

security controls to this new environment.

“I realized that the bar of sophistication forNow, adversaries no longer needed to hack aadversaries was being lowered,” said Knight.

hardened perimeter. They only needed to send

“You have an entire economy of people now

a weaponized PDF to an individual working

working from home who don't have a cyber-from home who lacked appropriate anti-vi-

security budget for their home. The attack

rus, patching, or vulnerability management

surface has increased exponentially, and has

capabilities.

become a massive soft target.”

Knight saw these issues add up. They created aKnightsaw

multiplevulnerabilities

openovernight.

perfect storm of security vulnerabilities.
And she watched malicious actors immediately take advantage of it.

More Targets
Organizations sent their entire workforces
home.

That

included

executives,

systemadministrators, and others with privileged
access to the corporate network. Adversaries

History has taught us that attackers

suddenly had more high-profile individuals towill always shift their attention totarget who could provide the "keys to the king-wherever there is a broader attack

dom through elevated access privileges."

More Shadow IT

surface — wherever they can find themost victims.

Organizations were not prepared to make thistransition. They did not have enough bandwidth, VPN licenses, or laptops for their new

WHAT HACKERS WANT

remote workers. Their workers had to pick up

Explaining the Malicious Mindset

whatever personal devices they had at home,

As a “recovering hacker”, Knight understands

and connect to the corporate assets throughpublic networks.

her adversaries, and what they seek.
In part, they seek the thrill of the hack.

More Backdoors“It’s like a drug,” said Knight. “Knowing you can

Organizations did not consider the otheraccess anything, anywhere, anytime… you feel

devices on these home networks—such as

like a god—and you want more.”smart refrigerators, baby monitors, IP cameras,©2020 Tanium. All rights reserved.

2

In the past, hackers chased this feeling, andTo create these new breaches, adversaries

primarily sought recognition from other mem-

have not simply launched more attacks. Theybers of their community. They would mostly

have adapted their methods to directly target

just compromise websites and tag them with

the new WFH environment, through a combi-digital graffiti that let everyone know who

nation of conventional social engineering andhad pulled off the hack known as website

new types of malware developed to exploit

defacements.

Mac devices.

But times have changed, and attackers have“History has taught us that attackers will always

adopted much more sinister motivations.

shift their attention to wherever there is a

“It’s now 20 years later, and it’s no longer about
defacing websites. It’s about finding, stealing, and monetizing data,” explained Knight.
“That’s the reason behind ransomware. That’s

broader attack surface, wherever they can findthe most victims,” explained Knight. “With thenew WFH economy, adversaries know they aregoing to run into more OSX devices, versus thethe reason behind adversaries targeting organizations—they are looking for PersonallyIdentifiable Information (PII), usernames andIt’s no longer about defacing

passwords, and payment card information

websites. It’s about finding,that can be stolen, monetized, and sold on thestealing, and monetizing

black market.”In this sense, the pandemic has been a gold
mine for these hackers.
It has created distributed operating environments that are filled with valuable data, andcountless new ways to access it.
At the same time organizations were rushingto spin up these new environments, adversaries were rushing to find the best way to exploit
them.

data...That’s the reason
behind adversaries targetingorganizations—they arelooking for PersonallyIdentifiable Information (PII),
usernames and passwords, andpayment card information thatcan be stolen, monetized, andsold on the black market.”

And many have been successful.
TODAY’S NEW ATTACKSWindows devices you typically see in an enter-

Exploiting the WFH Environment

prise environment. They are going to adapt toMalicious actors have kept busy the last fewmonths.
“I do a lot of incident response and forensics,
and the number of IR engagements at Brier &Thorn have nearly doubled,” said Knight. “I canattest to the news that the number of breaches
have increased since the WFH economy started.”©2020 Tanium. All rights reserved.

that, and that’s exactly what’s happening.”
Since March, Knight has seen a rise in newcrime kits, back doors, and command andcontrol exploits for Macs and other mobiledevices. To get these threats onto user devices,
adversaries have been leveraging social engineering campaigns targeting those looking foremployment.
3

VISIBILITY AND CONTROLThe Key Challenges
Organizations Face TodayToo many breaches are the result ofWhen asked about the biggest security prob-an attacker exploiting a vulnerability

lems organizations now face, Knight was clear.

that has a patch available for it.

“It’s a dichotomy of visibility problems into theOrganizations are not patchingassets an organization has out there, and a lackfast enough. They need technicalcontrols that enable them to identify
vulnerabilities that need to bepatched, and to apply those patches.

of vulnerability and patch management on theendpoint,” said Knight.
For Knight, resolving this fundamental problem begins with re-establishing visibility acrossthe entire operating environment.
“The biggest threat to organizations today“What adversaries will do is called ‘Hacking
the Human’ or social engineering,” explained
Knight. “They will target an individual at a specific company based on their title. They willtalk with them, gain their confidence, create a
relationship, and then send them a PDF. Whenthat PDF is opened, it will execute malicious
code, and create the backdoor on their system.”This backdoor will give the attacker accessto anything they want on the victim’s device.
It might even give the attacker access to thecorporate network.
Over the course of the pandemic, Knight
has seen these attacks increase in theirsophistication.
And yet, despite the rise in targeted attacks
molding themselves to the unique contours
of today’s operating environments, Knight still
feels the biggest threats to organizations today
are much more fundamental problems thathave become even more challenging during
the pandemic.

is not knowing about the assets that they’vegot,” said Knight. “What we refer to as theShadow IT problem. An employee deploying
a server that has been unpatched, unsecured,unhardened into the network, and accessible
from the internet.”
The rapid move to WFH has flooded operational
environments with these unknown assets.
“We need to know what assets we have,because organizations now have assets everywhere,” said Knight. “And now organizations
have more devices that historically weren’tconnected being connected and reachable
from the Internet.”
Knight knows first-hand how valuable these
unknown assets can be to a hacker.
“Over the last two decades of my career, I’ve
hacked over a hundred networks in penetration tests,” said Knight. “More than half of thosecompromises were the result of me gaining
access to the network through an asset thecompany didn’t know they had.”
For Knight, this lack of visibility feeds into the©2020 Tanium. All rights reserved.

4

second problem set crippling most organizations’ ability to protect their new WFH environments—an inability to manage patches andvulnerabilities on the assets they know theyhave.
“Too many breaches are the result of an attacker
exploiting a vulnerability that has a patch avail-Over the last two decades of mycareer, I’ve hacked over a hundrednetworks. More than half of thosecompromises were the result ofable for it,” explained Knight. “Organizations areme gaining access to the network

not patching fast enough. They need technicalthrough an asset the company didn’t

controls that enable them to identify vulnera-know they had.

bilities that need to be patched, and to apply
those patches.”industrial revolution before knowledge work

While Knight affirms that re-establishingarrived in the 1950s. It simply doesn’t work forvisibility and control are the most importantthe new workforce in today’s economy.”

actions that organizations can take to secure
their new environments, she also acknowledges there is no one “silver bullet”, and thattoday’s security challenges demand multiple,
complex answers, that may force organizations
to rethink their approach to how security isperformed.

Defense-in-Depth is Dead. “The idea ofdefense-in-depth is very much a castle-andmoat mentality. You had your crown jewels,
which was the castle, and the moat was built
around the castle to protect it. The problem isdata is mobile. It’s now in our employees’ homes
and we have no purview over it. We can’t have

SECURING TODAY’S WFH ENVIRONMENTS

the moat because data is everywhere.”

A New Narrative

Security Must Move to the Data. “We need toKnight challenges many of the assumptionsof her industry, and the security problems
opened by the pandemic and the rapid transition to WFH appear to validate much of what
she says.

rethink data security. The idea that we know
where data will be all the time to secure it assuch is epistemically delusional and intellectually arrogant. We need to figure out what it
is we’re trying to protect, determine where it
is, and then build security controls like layers

Knight believes:of an onion around it. We need to secure data

Centralization is Gone. “We need to get away

everywhere it lives, and everywhere it could

from this idea of a central office and network.
A lot of organizations are going to stay in ago. Security should therefore travel with thedata, not on the infrastructure we think it will

permanent WFH architecture. The perimeter

never leave.”is gone. And the new workforce of Millennials

Prevention is No Longer Possible. “Nowadaysand Gen-Z workers want to work differently

organizations know it’s not about if they arethan previous generations. They want to work

going to get hacked, but when. And the ques-from anywhere, from any device, on their own

tion is what security controls can you imple-

hours. The idea of 9 to 5 and reporting into

ment—on the network and on the endpoint—in

an office is a precept created during the first©2020 Tanium. All rights reserved.

5order to lower the amount of time it takes todetect them so you can eradicate them fromthe network.”
Ultimately, Knight summarizes her perspective
on how organizations must approach securing their operational environments—against
today’s threats, and against whatever tomorrow brings—through a simple sentiment, firstmade by Sun Tzu in the Art of War, that shesummarizes.
“We can’t bet on the enemy not coming,
because the enemy will come. We simply needto make our position unassailable.”This interview is part of the interview series,
When the World Stayed Home, which takes
a comprehensive look into IT challenges thatwere exacerbated by the COVID-19 pandemic
and how organizations are shoring up their
weaknesses while preparing for the unknown
future.
visit world-at-home.tanium.com
brought to you by Tanium©2020 Tanium. All rights reserved.

6