Becoming Cybersecurity Bilingual: Effective Communication for Hackers

Becoming Cybersecurity Bilingual: Effective Communication for Hackers

Speakers: Unknown

Conference: Black Hat USA

YouTube: https://www.youtube.com/watch?v=EUbsgyEDM2I

Overview

This talk addresses a critical, often overlooked challenge in cybersecurity: the communication gap between highly technical security professionals and non-technical business leaders. The speaker argues that despite the increasing importance of cybersecurity, the industry struggles to effectively convey risk and justify investments in terms understandable to the broader organization. This failure often relegates security to a mere line item in the budget, hindering proactive defense and strategic alignment.

The presentation posits that the recent surge in security spending and executive attention is not primarily due to the industry's own advocacy, but rather a direct response to the quantifiable financial and operational impact of ransomware attacks. This "hot take" serves as a stark reminder that while security teams understand technical threats, they frequently fail to translate these into tangible business risks that resonate with decision-makers. The talk aims to equip security professionals with strategies to bridge this divide, enabling them to communicate effectively, quantify risk, and design detection strategies that genuinely align with organizational value.

Background

▶ Watch: Importance of cybersecurity communication for real change (0:00)

For decades, cybersecurity professionals have grappled with the challenge of convincing business stakeholders to invest adequately in security measures. The speaker highlights a pervasive issue where highly technical discussions about vulnerabilities, exploits, and threat actors often fall on deaf ears, perceived as "Klingon" by those outside the security domain. This communication breakdown leads to a lack of understanding, underinvestment, and a reactive security posture rather than a proactive one.

The speaker presents a controversial yet compelling argument: ransomware has inadvertently achieved more for cybersecurity investment than any security professional or conference. While this assertion may seem inflammatory, the data supports a direct correlation between the rise of ransomware incidents and a significant increase in security spending and executive focus. Ironically, ransomware attacks often exploit fundamental vulnerabilities that security experts have been warning about for over 20 years—issues like local administrator rights, open SMB shares, domain administrators logging onto workstations, and passwords in cleartext service accounts. The speaker, drawing from years of experience in incident response (IR), emphasizes that the success of ransomware was not due to groundbreaking technical innovation, but rather its ability to inflict a clear, immediate, and quantifiable impact on business operations and finances. This direct consequence bypassed the need for complex technical explanations, forcing organizations to acknowledge and address the risk in a way that previous security advisories often failed to do. The core problem, therefore, was not a lack of care from business leaders, but a failure on the part of security professionals to effectively communicate and quantify risk in a business-centric language.

Key Findings

▶ Watch: Critiquing common, ineffective cybersecurity detection strategies (4:10)

The talk reveals several key findings concerning the current state of cybersecurity communication and detection strategies:

1. Communication Failure: The primary issue is the inability of security professionals to effectively communicate risk to non-security stakeholders in a way that quantifies potential business impact, leading to underinvestment and a perception of security as a cost center rather than a value protector.
2. Ransomware as a Catalyst: Ransomware attacks have served as an unintentional but highly effective risk quantifier, directly linking technical vulnerabilities to severe financial and operational consequences. This has driven unprecedented investment and attention to cybersecurity, highlighting the industry's past shortcomings in articulating risk.
3. Ineffective Detection Strategies: Common security practices, such as playing "MITRE ATT&CK bingo" (checking off techniques for compliance without strategic threat alignment) and indiscriminately collecting high-volume, low-value logs (e.g., all 4624 authentication logs in a SIEM), are costly and inefficient. They often fail to provide meaningful detection capabilities or justify their expense.
4. High-Value, Low-Cost Detection Opportunities: The speaker's investigation into 250 ransomware cases between 2018 and 2021 revealed that a staggering 92% of these incidents could have been detected before data exfiltration or ransomware deployment by monitoring a single, specific Windows event log: System Event ID 7045 (a new service is installed). This event, indicating lateral movement and privilege escalation, represents a high-fidelity, low-cost detection opportunity often overlooked.
5. Risk-Aligned Detection Strategy: A proposed solution involves a Venn diagram approach to detection strategy, which integrates three critical components: defined threats, likelihood (exposure), and impact (aligned with business value). This framework ensures that detection efforts are prioritized based on actual risk to the organization, maximizing value and justifying security spend.
6. "Without a Defined Threat, No Meaningful Metric": A foundational principle of the talk is that any security metric or investment is meaningless without being mapped back to a specific, defined threat relevant to the organization. This underpins the need for a threat-driven, business-aligned approach to security.

Technical Deep Dive

▶ Watch: One simple event log could stop 92% of ransomware (6:00)

The technical core of the talk critically examines common, yet often ineffective, security practices and proposes a more strategic, value-driven approach to detection. The speaker challenges the prevailing "MITRE ATT&CK bingo" mentality, where organizations focus on covering as many techniques in the MITRE ATT&CK matrix as possible simply to appear secure or compliant. While acknowledging MITRE ATT&CK as a valuable resource for security professionals—providing context and a common language for mapping adversary tactics—the speaker stresses that merely "making it all green" in a spreadsheet does not equate to effective security. Without aligning these detections to specific, high-priority threats relevant to the organization's unique risk profile, such efforts become a costly exercise in compliance theater rather than true risk reduction.

A second major technical critique targets the common practice of ingesting all available logs into a Security Information and Event Management (SIEM) system without proper prioritization or analysis. Specifically, the speaker highlights the prevalent habit of throwing all Windows Event ID 4624 (successful logon) entries into a SIEM. While authentication logs are foundational, the sheer volume of these events makes them a low-value data source for a high cost. Identifying malicious activity within a sea of legitimate logons is incredibly difficult, often requiring highly specific parameters, such as those seen in RDP tunneling, to differentiate. This approach leads to significant expenses in storage, processing, and analyst time, with minimal return on investment in terms of actionable intelligence.

The speaker then introduces a powerful counter-example: Windows System Event ID 7045. This event log signifies the installation of a new service on a system. Through extensive incident response investigations, covering 250 ransomware cases globally between 2018 and 2021 across diverse industries, the speaker found that 92% of these ransomware operations could have been detected before data exfiltration or the deployment of ransomware by simply monitoring this single event. Attackers frequently install new services for various purposes, including persistence, lateral movement, and privilege escalation. Detecting this event, especially when it originates from an unusual source or involves an unfamiliar service name, provides a high-fidelity indicator of malicious activity. The speaker notes that while attackers are gradually adapting and moving away from this specific technique, its historical effectiveness underscores the importance of identifying such high-signal, low-noise indicators rather than broadly collecting all data. The investment required for this detection is "zero dollars," contrasting sharply with the high cost and low value of indiscriminate 4624 logging.

To move beyond these ineffective strategies, the speaker advocates for a detection strategy built upon a Venn diagram model. This model integrates three crucial elements:

1. Threats: What specific threat actors, attack campaigns, or attack types are most relevant and impactful to the organization. This requires understanding the current threat landscape and tailoring it to the organization's unique context.
2. Likelihood (Exposure): How probable is it that a specific threat will materialize, given the organization's current vulnerabilities, controls, and attack surface. This involves assessing the conditions necessary for a threat to be successful and measuring the organization's exposure to those conditions.
3. Impact (Business Alignment): The potential consequence of a successful attack, quantified in terms of direct business value. This means translating technical risks into financial loss, operational disruption, reputational damage, or regulatory penalties that resonate with business leaders.

By intersecting these three components, organizations can prioritize detection efforts based on actual risk. This approach moves away from reacting to "the cool new thing on Twitter/X" and instead focuses resources on threats that pose the highest likelihood of significant business impact. The speaker illustrates this with the example of Managed File Transfer (MFT) systems and the MoveIt vulnerability. Prior to widespread exploitation, MFTs were often overlooked in "crown jewel" assessments, despite their critical role in data exchange and the high impact of their compromise. A risk-aligned strategy, considering the potential impact of data exfiltration via MFTs, would have elevated their importance for detection and defense before they became a major attack vector, demonstrating how the Venn diagram approach enables proactive identification of high-risk, high-impact assets and attack paths.

Demo / Proof of Concept

▶ Watch: Principles of effective communication: inspiring self-change (7:00)

While the talk did not feature a live technical demonstration or present specific code for a proof of concept, the speaker effectively used real-world examples and statistical data to illustrate the core principles of effective security communication and detection. The most compelling "conceptual demo" was the revelation that 92% of 250 ransomware cases investigated between 2018 and 2021 could have been detected by monitoring Windows System Event ID 7045 (new service installed). This statistic, derived from extensive incident response experience, serves as a powerful testament to the value of targeted, high-fidelity logging over broad, low-value data collection.

Additionally, the discussion around Managed File Transfer (MFT) systems and their overlooked criticality prior to incidents like the MoveIt vulnerability served as a practical demonstration of how the proposed Venn diagram detection strategy would proactively identify and prioritize such high-impact assets. These examples, though not live code, clearly demonstrated the speaker's methodology for identifying critical detection points and aligning security efforts with actual business risk.

Defensive Implications

▶ Watch: Introducing a value-driven detection strategy using a Venn diagram (8:00)

The insights from this talk carry significant implications for how security teams should approach defense, emphasizing a shift from purely technical or compliance-driven postures to a more strategic, business-aligned one:

• Prioritize Risk Quantification: Defenders must learn to translate technical vulnerabilities and threat intelligence into quantifiable business risks (e.g., potential financial losses, operational downtime, reputational damage). This "cybersecurity bilingualism" is crucial for securing executive buy-in and adequate resources.
• Rethink Detection Strategy: Move beyond generic "MITRE ATT&CK bingo" and indiscriminate logging (like all 4624 authentication logs). Instead, develop a detection strategy that is explicitly aligned with defined threats, their likelihood of occurrence, and their quantified business impact. This ensures that detection efforts are focused on what truly matters to the organization.
• Focus on High-Fidelity Indicators: Identify and prioritize monitoring for specific, high-fidelity event logs and behaviors that signal critical attacker actions. The speaker's example of Windows System Event ID 7045 (new service installed) is a prime illustration of a low-cost, high-value detection point for lateral movement and privilege escalation, which are common in ransomware attack chains.
• Strategic Log Collection: Instead of collecting all logs, prioritize those that offer the most actionable intelligence against high-priority threats. This optimizes SIEM costs and reduces alert fatigue, allowing analysts to focus on genuine threats.
• Proactive Asset Identification: Security teams should work with business units to identify "crown jewels" and critical systems based on their potential business impact, not just their technical classification. The example of Managed File Transfer (MFT) systems highlights how previously overlooked assets can become critical attack vectors with immense impact.
• Embrace Attacker Perspective: Understand common attacker methodologies and focus defenses at critical choke points in typical attack chains. By anticipating how attackers achieve persistence, lateral movement, and data exfiltration, defenders can place more effective controls and detections.
• Continuous Improvement through Feedback: Use incident response findings to refine the detection strategy, ensuring that new intelligence about attacker tactics and overlooked vulnerabilities feeds directly back into the Venn diagram model to update threat, likelihood, and impact scores.

Key Takeaways

• Ransomware has been the most effective risk quantifier for cybersecurity, driving investment by demonstrating direct, quantifiable business impact where traditional security communication often failed.
• Effective security communication is paramount, requiring security professionals to translate technical risks into business terms that resonate with non-technical stakeholders to secure resources and strategic alignment.
• Traditional detection strategies are often inefficient and costly, exemplified by "MITRE ATT&CK bingo" and the indiscriminate collection of high-volume, low-value logs like Windows Event ID 4624 in SIEMs.
• High-fidelity, low-cost detections exist and are critical. For example, monitoring Windows System Event ID 7045 (new service installed) could have detected 92% of 250 ransomware cases before significant damage.
• A robust detection strategy must align threats, likelihood (exposure), and business impact. This Venn diagram approach prioritizes security efforts based on true organizational risk and value.
• "Without a defined threat, there is no meaningful metric" – all security activities and investments must be mapped back to specific, relevant threats to justify their value and measure effectiveness.

About the Speaker(s)

The speaker, whose name was not provided in the talk metadata or transcript, brings a wealth of experience to the discussion. They have a background in security R&D, malware analysis, and threat hunting, and have spent "years in the trenches in IR," including personally investigating approximately 250 ransomware cases across the globe between 2018 and 2021. This extensive hands-on experience forms the foundation of their insights into the practical challenges of cybersecurity. The speaker also shared a personal career anecdote, highlighting their journey from a quiet attendee to a speaker, emphasizing that saying "yes to scary stuff" and forcing themselves to communicate more effectively significantly changed their career trajectory and reduced imposter syndrome. Their perspective is rooted in both deep technical expertise and a personal understanding of the importance of communication in the cybersecurity field.