CSO Online: Insights on Cyber Espionage From CrowdStrike VP Mike Sentonas

May 09, 2019

| Michael Busselen | Endpoint Security & XDR

An article on CSO India titled “Cyber Espionage Shows No Signs of Slowing Down,” by Soumik Gosh, presents CrowdStrike^® VP of Technology Strategy Mike Sentonas’ views on the growth of espionage as an objective of cyber adversaries, and what that means for organizations that may be targeted.

How Serious Is Cyber Espionage?

Sentonas says cyber espionage is a growing threat and that despite some indictments and promises to curb their activities, nation-states have only given lip service to curtailing their actions. He says, “This problem has become a critical concern of a number of governments around the world, following ongoing targeted intellectual property, and confidential business and technical data theft for unfair competitive advantage.”

What Sectors Are Being Impacted?

Sentonas discusses how CrowdStrike Intelligence has tracked a number of targeted intrusion campaigns by China, Iran and Russia focused on the telecommunications industry, where the objective was espionage. He also cites other sectors that are targeted for intelligence gathering by nation states, including government, defense contractors, think tanks, high tech, hospitality, the energy sector and many more. The author also asks Sentonas about the Chinese telecom giant Huawei leveraging 5G technologies to enable cyberattacks and espionage by the Chinese government. Sentonas says, “The U.S., along with a number of other countries, has cited the potential for espionage as the reason for not using certain technologies.” He continues, “It’s a business risk that needs to be managed.” Sentonas also mentions that concerns have been raised around vulnerabilities in certain Huawei products that haven’t been fixed, even though they have been identified.

When Attackers Leverage Advanced Technology

The article delves into Sentonas’ view on how attackers are innovating to bypass standard security products. He stresses that legacy security technology is too slow to stop today’s cyberattacks and argues that behavioral analysis that can isolate threats by observing the actions taken are what’s needed. He says, “Consider this — 40 percent of intrusions don’t actually involve any malware, but instead leverage stolen credentials, and living-off-the-land techniques like the use of PowerShell and legitimate Windows tools, which is why you need security solutions that cover the entire threat lifecycle.”

What Sets CrowdStrike Apart?

The article concludes with the author asking Sentonas what sets CrowdStrike apart from other endpoint protection solutions. Sentonas cites several key factors:

CrowdStrike was built on cloud-native architecture from the beginning, which provides customers with fast deployment across users, while reducing friction and costs. It also enables infinite scalability for any size organization.
CrowdStrike Threat Graph™ is unique — a massively scalable, cloud-based graph database technology that processes over one trillion events per week across 176 countries.
CrowdStrike Intelligence comprises an elite team of threat analysts, security researchers, cultural experts and linguists who work together to provide in-depth and historical understanding of adversaries, their campaigns and their motivations.
Falcon OverWatch™ managed hunting

comprises an elite team of security experts who proactively hunt for threats 24/7 on behalf of customers. OverWatch adds a layer of oversight to ensure no threats get missed.