Dmitri Alperovitch - Offense as the Best Defense

### Overview In this talk, Dmitri Alperovitch (co-founder and CTO of CrowdStrike, formerly head of threat research at McAfee) challenges the cybersecurity industry's traditional reliance on passive defense. Despite advancements such as ASLR, DEP, sandboxing, code signing, and rapid vulnerability patching, organizations—ranging from major technology firms to global Fortune 2000 enterprises—continue to suffer persistent breaches. Alperovitch argues that cybersecurity should be viewed not as a generic software vulnerability problem, but as an adversary-centric challenge driven by specific threat actors with distinct motivations and budgets.

### Key Topics - **Limits of Passive Defense and the Escalatory Arms Race**: Building higher walls and layering defense-in-depth resembles an outdated "castle-building" approach. Because an attacker only needs to succeed once (or attempt an attack ~200 times against a 99% effective system to gain a 90% chance of breach), passive measures merely delay the inevitable and spur an escalatory arms race, akin to missile defense versus cheap offensive missiles. - **Threat Actor Taxonomy and Economic Asymmetry**: Threat actors broadly fall into opportunistic attackers (hacktivists and cybercriminals motivated by quick ROI or convenience) and targeted attackers (state-sponsored groups or intelligence agencies). Targeted attackers pursue unique, high-value assets—such as aircraft designs (e.g., Boeing Dreamliner blueprints) or proprietary mining negotiation strategies—where stealing saves billions in R&D or yields massive strategic advantages. - **Shift from Indicators to Tradecraft and Attribution**: Defenders frequently fixate on static indicators of compromise (IOCs) and patch vulnerabilities like a homeowner repeatedly calling a locksmith instead of the police. Alperovitch emphasizes understanding who the adversary is, their underlying intelligence consumers (e.g., state-owned enterprises or specific PLA departments), and their post-compromise tradecraft inside the network, which is human-driven and difficult for attackers to change.

### Technical Details & Case Studies - **Active Deception and Misinformation**: Rather than destructive "hack back," organizations can feed deceptive data—such as flawed blueprints or false negotiation positions—which wastes an adversary's resources and undermines their trust in stolen intelligence. - **Targeting Intelligence Consumers**: Legal avenues (injunctive relief, punitive damages, travel restrictions) should target the commercial beneficiaries of stolen intellectual property rather than focusing solely on untouchable military hacking units. - **The Georgian CERT "Dye Pack"**: In response to a Russian intrusion, Georgian CERT planted a booby-trapped document titled "Georgia NATO negotiation." When executed on the attacker's system, the payload activated the intruder's webcam, captured his photo, gathered forensic files, and enabled public attribution. - **Private Sector Action (Luxembourg Firm & Poison Ivy)**: Following the APT1 report, a Luxembourg security firm scanned Hong Kong IP ranges for Poison Ivy command-and-control servers, exploited a protocol vulnerability in the RAT to access the infrastructure, and actively notified ongoing victims.

### Takeaways Alperovitch advocates for a strategic framework where the private sector can exercise active defense and deterrence. Drawing historical parallels to civil arrest and maritime letters of marque, he urges policymakers to consider granting regulated, limited authorities to private entities so they can actively restrain threats rather than remain perpetual passive victims.