RiskSense CEO Srinivas Mukkamala on the “Cyber Pandemic” and Joining Ivanti

As the global pandemic has tightened its grip, cybersecurity threats have climbed with it. Covid-19 exposed weaknesses in systems around the world, and criminals were quick to exploit them. Srinivas Mukkamala, co-founder and chief executive of RiskSense, puts it bluntly: the world is facing two pandemics at once, Covid-19 and a cyber pandemic, and he finds the number of attacks, how often they come and the harm they do to human life deeply troubling.

In an exclusive interview, Mukkamala shared his view of where cyber attacks are heading and how organisations can defend themselves. He also discussed Ivanti's acquisition of RiskSense and what it means for the RiskSense team and its long-standing customers.

Supply chains in the firing line

Asked about current trends in malicious attacks, Mukkamala pointed to one of the pandemic's biggest lessons: the supply chain starts in Asia. In his words, "80% of the goods manufactured are from Asia to the world", and attackers will exploit that.

Criminals have turned towards the targets where they can do the most damage. Attacks on shipping have closed ports and cost industries a great deal of money. Ransomware that halts assembly lines stops essential production, as attacks on pharmaceutical companies have shown. Mukkamala stressed that dealing with attacks on this ecosystem is an urgent concern. The health crisis has already limited access to the most basic needs, and cybercriminals are now cutting off important supplies as well.

On whether different regions face different threats, he drew a comparison with people: faith and colour may differ, but humans are humans. Attacks around the world follow much the same tactics and procedures, and only the intent changes. He estimated the overlap in how attackers operate across the globe at roughly 90%. A group from the eastern bloc may be after money, while those going after national databases may want state secrets.

Mukkamala calls this the animal instinct, where the hunt never changes. Knowing why an attacker is coming, though, lets a company rank its risks, concentrate on the ones that genuinely matter to it and work harder at preventing those. His advice is to keep returning to an "addressable unit economic", examining the particular vulnerabilities, exploits and patches that apply to each company.

How ransomware has changed

Ransomware is not new, but it has grown into whole ransomware families and a Ransomware-as-a-Service model. Using the WannaCry ransom worm as his example, Mukkamala explained that ransomware once relied on a single vulnerability and a single exploit. Today it chains several of each, which means it survives much longer.

The danger to the wider public has also grown because ransomware has spread through the technology stack. It is no longer confined to endpoints, servers and desktops, and now reaches phones, applications and SaaS. Behind these changes, he said, are unpatched systems along with misconfigurations and coding mistakes made by people.

RiskSense has followed ransomware's development for around six years and publishes a report on it annually. Mukkamala sees some good news in the data. Fewer than 300 known vulnerabilities are actively exploited by ransomware; 95% of the vulnerabilities with exploits allow remote code execution; and most of those already have patches that fix the problem. Serious as the attacks on the ecosystem are, companies can act ahead of time and get in front of them.

From partnership to acquisition

Ivanti's purchase of RiskSense grew out of a partnership between the two firms. Mukkamala describes the deal as "a marriage made in heaven". Both companies share the goal of stopping breaches, and each contributes something the other lacks. RiskSense applies intelligent, risk-driven analytics to give customers the data they need to manage and prioritise their cybersecurity risk, while Ivanti supplies some of the best patches in the world, as he sees it. Bringing context from data together with strong fixes, Ivanti chose to combine forces and acquired RiskSense's data along with its very experienced team.

Customers on both sides stand to gain. Ivanti has built RiskSense Vulnerability Intelligence and the Vulnerability Risk Rating into Ivanti Neurons for Patch Intelligence, where they help users score patches. Ivanti's clients get extra context, and RiskSense's clients get the remedy. The feature launched on 2 August, the day Ivanti announced the acquisition, and is available now to Ivanti Neurons for Patch Intelligence customers who also hold RiskSense licences.