Nicolas Fischbach, Forcepoint's CTO,  Phil Goldstein of FedTech and Mike Gruss of Fifth Domain weigh in on how Deepfakes and 5G will affect Government Predictions. Be sure to check out Forcepoint's Cybersecurity Predictions Report here.

Episode Table of Contents

• [0:43] Introducing Our Guests
• [2:00] The Five Big Cybersecurity Predictions
• [6:27] The Interactive Deepfakes
• [8:47] Creating Havoc
• [13:04] The Big, Big Change as per Cybersecurity Predictions
• [15:26] The Cybersecurity Predictions on Messaging
• About Our Guests

Introducing Our Guests

Eric: Today we have Nico Fischbach, our CTO of Forcepoint to talk about and introduce the predictions that we did publish in late 2019. We also have Mike Gruss, so you may remember him from episode 53. The topic was cybersecurity messaging and government.

Eric: He's the editor of Fifth Domain, with us to get his opinions on the predictions.  We're also joined by Phil Goldstein, senior editor for FedTech and State Tech magazines. You might remember Phil from episode 54 on cybersecurity challenges that are impacting us.

Eric: Nico would you introduce the five predictions that Forcepoint came out with?

Nicolas: Yes. And thanks for having me again. It's good to be back on To The Point. And honestly I'm actually looking forward to this content. Because I always have the enterprise view of the world and the feedback. And I'm actually very keen to see how the people that work more on the government side, on the federal side, see the threats or those predictions and apply or not to that environment.

The Five Big Cybersecurity Predictions

Nicolas: As you said Eric, we've been doing those for quite a few years now and this time we decided to narrow it a little bit. We only went for five big ones, five big rocks. And I think on some of them we've already been proven right. So the five of them to go to the list.

Eric: It means that weren't risky, daring enough. We need to work on that with the team.

Nicolas: Exactly. So, the five we have, we want to share with you and with the audience. The first one is deepfake as a service and we are changing. They've been around for quite some time but it's going to become very, very interesting. You know 5G.

Nicolas: Obviously your 5g is very visible in the consumer space but there's obviously going to be quite some impact on both enterprise and governments going forward. So, there are a few interesting tidbits I want to touch on 5G and then move to cloud. And obviously, in the enterprise space, this is top of mind. A lot of the DIO they are thinking cloud first nowadays.

Top of Mind Subject

Nicolas: But I've been ready. I'm very keen to understand how that applies to the government side of the house. And what do you guys need to do and how you look at it maybe differently than the enterprise of this world. The next one, data and privacy. Top of mind again, consumer space, enterprise space, government space for various reasons. Probably on the government side more on the regulations.

Nicolas: But again, a very top of mind subject where's GDPR, enforcing CCPA in California in the US. Finally, one that I really like a lot and it's not because I came up with it, is the shift on what we call IOCs. So, Indicators of Compromise to what we kind of came up with which are IOBs, Indicates of Behavior. And you will see how that fits now very much into you're thinking at Force Point. So those are the five Eric that we want to talk about today.

Eric: Awesome. Phil, what do you think? Were we daring enough or were we too conservative here?

Phil: I think that covers quite a lot of ground when it comes to the security landscape. I'm excited to get in and talk about them.

Eric: Awesome. Mike, thoughts?

The Deepfake Ones

Mike: Cybersecurity is always fun because it's unpredictable. I don't think a couple of years ago we would've guessed the deepfakes on one of these topics.

Eric: When you do a deepfake with Nancy Pelosi though it gets everybody's attention, including ours, I suspect. So Nico, kick it off. Let's talk deepfakes. Tell us what we are predicting and what we're seeing. I suspect this is one where we were already starting to see the prediction come true.

Nicolas: Exactly. I mean deepfake is a term which is kind of pretty newish. It's been used a lot lately because it hit the news. I think Facebook just announced a few weeks ago that they will try to detect deepfakes on their platform. It got coined in I think from memory 2017 and like the team just said, the advancements in machine learning, neural networks and so on actually enabled deepfakes.

The Two Major Reasons

Nicolas: So I think what we have today in terms of tools and power, enables us to do that. And clearly, the prediction is that deepfakes have become more common and I think we've already been proven right. And there'd be used for two main reasons. One, to influence the masses. And it's been looked at a lot, especially in the US because of the election coming up.

Nicolas: But what we also believe is that deepfakes would be much more common when it comes to social engineering. We all know about fishing. I've seen many of the people who are listening to this podcast probably had some security. I want us to train on fishing. But mostly looking at emails and websites.

Nicolas: And the deepfakes are always going to make way into the fishing schemes and they are going to become much more subdued and much more kind of free and interactive. So, what we're also saying is deepfakes, some of them have been around.

Nicolas: I think you've talked about that with Nancy Pelosi and a few more. But also with the computing power and the shift to even maybe a criminal model, where you're going to have deepfake as a service, you actually have to end up with interactive big deepfakes.

The Interactive Deepfakes

Nicolas: If you remember the Google demo, where the Google bot was making coordination on your behalf and interacting with the hairdresser on the other side of the line. We could see deepfakes actually become not just static but actually become interactive.

Nicolas: And that's going to be a challenge for many in the enterprise space. Fall aside in our private lives, but also, for government agencies because they hold the keys to many, many things when it comes to identity.

Eric: So you're saying Sally, the computer hacker could create a deepfake service if you will or even a nation-state potentially rather than them attacking countries out there and systems through fishing, of course. They could actually create the capability to stride this information and mass market that.

Nicolas: I think it's exactly two things. I think that you're going to see criminal groups create a deepfake as a service platform that you can just buy the service from.

Eric: Five bucks and you can put your face and whatever.

A Combination of Deepfake and Automation

Nicolas: Exactly. And compliment that to your second point about automation and bots. So how do you kind of leverage that deepfake as a service that deepfake to automate the influencing through social media, to directed attacks or the means? So it's really going to be a combination of deepfakes and your automation around it that we're going to predict and probably see.

Eric: Mike, what do you think?

Mike: I think this is a really fascinating area. We've seen a lot of interests on the government side here. I know congress I believe held a hearing on this earlier in the year. We've seen a ton of interest. They had a prize competition. They were open to help find some answers to make deepfakes a little more obvious.

Mike: We've seen a lot of attention from the Defense Department in this area, particularly as Nico mentioned that information warfare becomes a much hotter topic. There are programs from IARPA, the intelligence community's kind of blue sky organization that looks at really hard to solve problems, the ways to identify deepfakes more so.

Mike: So I think this is going to be a really big issue that's going to come up. And Nico touched on this a bit but it's two different reasons.

Creating Havoc

Mike: It's the information or disinformation campaigns that we're seeing and of course with the election, but on a much broader scale as well. Even something as small as saying like, "Hey, here's a deepfake of a commander." And he's saying, "Hey I know it seems like there wasn't a lot of snow today, but the basis quotes."

Mike

: That can create a lot of havoc and that's what a lot of folks are after is just creating havoc. Then the second part which is even potentially more nefarious on a personal level is when you see videos of someone being put in a compromising position or obviously very unflattering video and it's like, "Hey, if you don't do this, we're going to release this video that shows you in this position."

Mike: I think that's going to get really tricky and create a lot of security problems for organizations everywhere.

Eric: I wouldn't remember the officer's name, but the Germans in the Battle of the Bulge in World War II sent Germans in American uniforms and some equipment to critical road junctions to send people in different directions.

The Dangers Posed by Deepfakes

Eric: As you were talking through this that was where my mind went to. I mean a total disinformation campaign and if it's a service, it's cheap, it's easy and anybody can do it.

Mike: I think we keep forgetting that even small bits of chaos can have a big impact. That's why we're seeing the federal government take this so seriously.

Eric: I agree. Phil your thoughts?

Phil: I would agree with everything that Mike laid out in terms of the dangers posed by deepfakes. Also I just want to add that it's likely that the volume of them that proceeding across the internet is going to increase as the election gets closer.

Phil: I think that like most technologies, it's something that's going to become more sophisticated over time and it's going to become more and more difficult to be able to the naked eye kind of know, Oh this is a dee fake or this is something that is real.

Identifying a Deepfake

Phil: I think that defenders are going to have to invest in a commensurate amount of technological sophistication when it comes to algorithm analysis and image analysis to be able to definitively and quickly determine that something is a deepfake. It could potentially become kind of an arms race that way.

Eric: I think this is a real problem. This is when I saw and we talked about it quite a bit. The disinformation side, the realism in the fishing side, wow do you know? And when most people in the connected world get their news, more people get it from social media than actual proper news outlets.

Eric: To me this one's a scary one. Who do you believe? How do you know if it's real? Or was it memorex, I believe was the oil commercial? I mean, how do you know? I think this is a problem we're going to deal with for a long time.

Eric: Okay Nico, let's switch to 5G. Introduce it, would you?

What You’re Getting With 5G

Nicolas

: Yes. So 5G, I mean technically if you look at it, there's a lot of talk about 5G. It's the next big thing. But you know, fundamentally it is an evolution of 3G and 4G. What you get with 5G is more bandwidths, less latency. You should have more density for better coverage, but also what 5G brings is access to many more components.

Nicolas: I think of it as sensors to compliment what's being done with low run or Sigfox or other technologies. So that means that not just the consumer or the enterprise space, which has been using three, four, 5G for many, many years, you're going to see 5G also appear in the OT side of the house.

Nicolas: So the operation technology side of the house. So you will end up with sensors in the critical infrastructure environments use it using 5G.

Eric: In the office space, the Alexa's of the world, the Siri.

The Big, Big Change as per Cybersecurity Predictions

Nicolas: Yes, probably too. I see a lot of these things in the offices and back home. We probably seem to stay on wifi for quite some time but the big change is really kind of the OT side of the house, the CIA side of the house and what it also means, it's going to enable even more workforce.

Nicolas: We already deal with a lot of data today on all mobile devices. Whatever they are, wherever we are and so on and 5G is going to enable even more mobility. That means that from a pure network point of view, you need to look at your infrastructure security and so on.

Nicolas: But that's kind of more for the telcos. If you look at it again from a consumer angle, being at the enterprise or the governments, how would you protect the data that's transiting, roaming, circulating, all of that 5g environments?

Nicolas: So one of the prediction is that 5G is going to enable even faster data breaches. Because it names faster data movements.

The Data Exfil Points

Nicolas: There would be even more connected devices that can become entry points or data exfil points in the environment. So that's the nozzle in the prediction we have and something that people who really didn't have on their radar because of there's a lot of trust wasted in that environment and trend distrust. You, hopefully, as seasoned in the enterprise the government space, look at 5G and the security of the mobile cloud and SAS and data applications you have running over it.

Eric: So it's not as much about the bandwidth as the accessibility to information and data and the bandwidth within at that point. Phil, I know you've spent a lot of time here. I'd love to hear thoughts.

Phil: Sure. So in my prior life, I used to cover the wireless industry pretty exclusively and deeply and 5G obviously is to become the next big wireless standard roughly for the next decade or so. That's how it tends to go. Once a decade you get this major upgrade. So obviously, as an attacker, you're going to be able to potentially extract data at a faster rate because you have that faster bandwidth.

The Cybersecurity Predictions on Potential Dangers of 5g

Phil: I think that the real danger is going to come with all the devices that are potentially going to be connected to 5G networks on the internet of these environments. I know that from a federal perspective, the DOD has started to move ahead with IG pilots at various bases around the country.

Phil: And I think that civilian agencies are also going to be looking at 5G as well. So, I believe that for a 4G LTE cell tower, it's roughly like 2000 devices can connect to one cell tower and for 5G it's orders of magnitude larger than that. Just because of the way that the standard is set up in the sort of evolution of the technology.

Phil: So, you'll potentially going to have, especially in urban environments, lots and lots of connected devices and that obviously means lots and lots of threat vectors. I think the telecommunications companies are obviously going to have to work very closely with agencies that are interested in deploying 5G to ensure that the networks are as secure as they can be.

Another Potential Threat Vector

Phil: But it's just another faster network that's going to enable more and more connected devices and as we've seen in the past with wifi and 4G connecting devices to the internet, just means that it's another potential threat vector.

Eric: So from your background, I mean this has to be a Nirvana, right? Everything's connected all the time, everywhere with massive speed. I mean, if you went back 20 years, this is what we dreamed of. We didn't think about the security angles as much, but this was the dream, wasn't it?

Phil: Yes, for sure. I mean, I think that 4G obviously kind of led to increasing capabilities over 3G in terms of streaming video and just greater capabilities of the network. But 5G does represent a kind of a quantum leap in not only bandwidth and lower network latency, but just in terms of what it has the potential to connect people.

Phil: I don't think that these examples are going to happen overnight, but people in the industry, talk about this really being the enabling technology for vehicle to vehicle communication. Potentially down the line autonomous vehicles. So, there is a lot of potential there, but I think that the security threat is there as well.

The Cybersecurity Predictions on Messaging

Eric: Mike, on episode 53 we spent a lot of time on cybersecurity messaging as we're talking 5G, what's coming into your mind? I know you spent a lot of time interviewing people and writing.

Mike: I think so. This area is covered pretty closely. But I think the one thing that immediately comes to mind and it's not directly cybersecurity-related, but it is security-related. There's a huge debate right now about 5G hardware and how that's going to play out.

Mike: And so I think we've seen some concerns on the hill already. I know particularly some folks in the intelligence committees. I think the big debate going forward at least for the short term is how are these 5G networks going to be built?

Mike: What kind of hardware are they going to use and where that hardware comes from? Until those issues are kind of settled, I think unfortunately some of the cybersecurity concerns are going to take a back seat and that creates a real risk.

Conclusion

Eric: It's interesting we had Katie Arrington on a couple of weeks ago from the CMMC Cybersecurity Maturity Model Certification team and they're pushing really hard on the DIB suppliers to apply the NIST frameworks to how they protect information.

Eric: As you talk about the devices and creating these capabilities, 5G was top of mind for her. Top of mind. It's why they're pushing so hard on CMMC because of the real threat that they see. So, we're going to split this into a two-part episode. I appreciate everybody's feedback. We have a lot here. I'm going to break here and thank our listeners for listening.

Eric: We appreciate you tuning in every week. Send your comments, let us know what you like, what you dislike, what you want to hear. If you have guests you want to hear from, let us know. We appreciate the feedback. It helps us make it a better show and what we're going to do is pick this up next week. So for now, thanks for listening to To The Point Cybersecurity. We'll talk to you next week. Take care.

About Our Guests

Phil Goldstein is a web editor for FedTech and StateTech. Besides keeping up with the latest in technology trends, he is also an avid lover of the New York Yankees, poetry, photography, traveling and escaping humidity.

Mike Gruss is the editor of C4ISRNET, a battlefield technology news site and magazine, and Fifth Domain, a news site focused on government cybersecurity. Previously, he served as managing editor of FedTech magazine and as the senior national security writer at SpaceNews.

He has written for newspapers in Virginia, Indiana and Ohio and his work has been published in a series of regional and national magazines, including Runner’s World.

Nicolas (Nico) Fischbach is the Global Chief Technology Officer at Forcepoint. Nico is leading Forcepoint’s cloud-first transformation as the CTO for the company’s cloud security business, where he oversees technical direction and innovation. Before joining Forcepoint, he spent 17 years at Colt, a global B2B service provider, and was responsible for company-wide strategy, architecture and innovation.