Weekly Video: November 21, 2022
11–21–2022 (Monday)
Hello and welcome to another edition of Cyber Risk at Deal Speed, your weekly video rundown of cybersecurity news and strategy for investors, deal teams, and the management teams of portfolio companies.
I’m your host, Shay Colson, Managing Partner for Cyber Diligence at Coastal Cyber Risk Advisors, and you can find us online at coastalcyber.io
Today is Monday, November 21st, and we’re going to attempt to get back to normal - and leave FTX and Twitter out of the discussion, at least for today.
What does that leave us with? Back to business as usual - ransomware and cyberespionage:
Ransomware Incidents Leading Crisis for UK Gov
China’s Cyber Capabilities
Ransomware Incidents and COBRA Meetings
A headline from the UK that should bring us back to reality. You, like me, maybe got distracted a little with the election, FTX meltdown, and Twitter goings on - but in the UK, they haven’t been lucky enough to get distracted:
“Ransomware incidents in the United Kingdom are now so impactful that the majority of the British government’s recent crisis management COBRA meetings have been convened in response to them rather than other emergencies.”
I think this is an interesting framing - as we see this in our target acquisitions and existing portfolio companies - ransomware becomes a distraction that ends up getting attention above all else, and often at the long-term peril of the business.
From the UK’s perspective, they’re struggling with the same thing we are - incomplete information (i.e. how many ransomware incidents are there, actually, and of what type) and inability to coordinate action (in this case between the Home Office, NCSC, and other stakeholders.
So what do we do? I would suggest listen closely to the outgoing technical director of the NCSC (headed to Amazon, by the way) - “I apologize in advance, but you’re not trying to beat them, you’re trying to send them to France. The whole point is to make the U.K. more risky, less profitable, less useful, less scalable for ransomware while we fix the underlying problems.”
It’s the same old trope: you don’t have to outrun the bear, you just have to outrun the other person. True for the UK, and true for your businesses - to an extent. This is really only step one - the bare minimum. Beyond this, these capabilities become a strategic advantage. This is simply table stakes and self-preservation.
China’s Cyber Capabilities
Here in the United States, the US-China Economic and Security Review Commission delivered their 2022 Annual Report to Congress, with a specific section on supply chain and another on China’s Cyber Capabilities.
I’m bringing this up here because their capability set is far better than the ransomware operators causing trouble in the UK - again, which is what you might consider “directly” financially motivated, and nearly all sourced out of Russia, Eastern Europe, Iran, and North Korea.
China, as the report notes, uses their cyber capabilities for intelligence, military, and political gain - what the report calls “illegitimate economic advantage.”
The section covers some really important topics, including reviewing the “Key Ideas Driving China’s Cyberspace Activities” and contains a list of their Cyberespionage Goals and Capabilities.
If your businesses have any exposure to China, or operate in industries of interest to Chinese economic sectors, this is worth reading and understanding, as the threat here stands in such stark contrast to the more typical ransomware and Business Email Compromise (BEC) attacks.
Fundraising
Some big firms announced new funds, bringing last week’s fundraising total to $16.6B a solid showing heading into the holiday week here in the United States.
As a reminder, that puts us at nearly $100B ($97B) this quarter alone. With the rush to get things done by “year end” it’s possible that we could be getting close to the quarter trillion mark for this quarter with a strong December.
Best of luck to all the firms with new capital to deploy!
You can find all the links to the stories we covered in the comments section below, find back issues of these videos and the written transcripts at cyberriskatdealspeed.com, and we’ll see you next week with another edition of Cyber Risk at Deal Speed.
Links
https://www.uscc.gov/annual-report/2022-annual-report-congress