The CISO Signal: True Cybercrime Podcast

It's very easy to say

never pay from a distance.

But you know when your systems are down

and backups are gone

and millions are bleeding

out of the business daily. It's survival.

No one wants to fund crime,

but sometimes you're

buying your time to live and your

your business has to do it.

If it wants to survive.

It's not about your reputation anymore.

It's not about your clients even anymore.

It's about survival.

Welcome to The CISO Signal

the true cyber crime podcast.

I'm Jeremy Ladner.

On this episode,

the company that insures risk

became the risk.

In March 2021, CNA Insurance,

one of the largest commercial insurers

in the U.S., fell victim to a ransomware

attack that encrypted 15,000 devices

and compromised

customer data,

forcing the shut down of its systems

for weeks.

The breach didn't just steal data,

it stripped away

the illusion of preparedness

for an organization

built to model probability,

quantify exposure and price protection.

It was the ultimate irony.

They didn't underwrite the threat.

They underestimated it.

Joining us is our CISO co-host Matan Eli

Matalon, an incident response leader

and security strategist

with experience across the startup world,

military intelligence

and enterprise defense. Matan,

welcome to the show.

Can you tell us a bit about yourself?

Awesome.

So my name is Matan.

I am CISO for OP Innovate.

OP Innovate -

We're basically a cybersecurity company

that focuses on both

preventing attacks

and helping organizations respond

when things go wrong. You know?

Proactive side.

We do a lot of deep dive penetration

testing to help companies

find and fix weaknesses

before attackers do.

But we also are the team

that gets called up

when fires already started.

You know - incident response

forensics, helping

companies get back on their feet.

Thank you.

Matan.

Now...

Let's get started with the investigation.

We are in the midst of a ceaseless war.

Not of bombs or bullets, but of breaches,

firewalls and silent incursions.

The targets,

our borders, our banks, our commerce

and the critical infrastructure

that underpins a free civilization.

The enemy is cloaked in code,

fueled by greed, glory,

and a desire for chaos.

This is the story of the unseen

protectors, the nameless generals,

the CISOs,

chief information security officers.

They are the guardians at the gate.

Watchers on the wall.

Ever vigilant and always listening

for The CISO Signal.

There's a kind of silence

no company trains for.

Not the silence of idle

inboxes or frozen dashboards,

but the deep, airless quiet

that follows total digital collapse.

In March 2021,

CNA Financial,

one of the

largest insurance

carriers in the United States,

fell dark. Not a power outage.

A ransomware attack.

15,000 machines were encrypted,

phones offline, email gone,

an entire enterprise unplugged

from itself.

The attackers didn't boast.

They didn't break things for fun.

They came with a purpose and a number

$40 million.

At the time,

it was the largest

known ransom

demand in history by multiples.

But this wasn't just any company.

CNA didn't

just insure factories and fleets,

they ensured cyber risk.

They held the names of businesses

already worried about breaches.

Organizations that paid

for protection to the right adversary.

That's not just a customer database.

It's a blueprint for who will pay next.

A list of future victims.

And if that list got out,

it wasn't just CNA’s systems at risk,

it was everyone they'd sworn to protect.

This is the story of CNA Financial,

a 100 year old giant brought to its knees

by a breach no one saw coming.

and this... is The CISO Signal.

So let's talk about CNA,

in general at first,

and then we'll kind of dive

into some details.

But because you are this CISO for hire,

or outsourced CISO,

you're often called in

when something's already gone wrong.

I think you mentioned

that as well in your introduction.

What does that moment feel like

when you get that call,

that emergency panicked call,

whether it's a late night,

maybe it's on the weekend.

What's that feeling?

Yeah, I mean, it happens

way more times than I can count.

A CISO, especially the CISO as a Service.

And then incident response,

you know, manager

is it's not only a technical role,

but it's also like a psychological one.

It's an emotional one.

You were like their shrink.

It's not only to come

and solve the problem,

but it's also to make sure they are

relaxed enough

and confident enough

and trusting you into managing this.

So so it's about coming in

and build that initial trust

between the parties,

making sure they understand

where you're coming from,

what you're trying to achieve,

that you're here for them, not for me,

for anyone else, for the business.

This is your main goal.

And when you set that initial trust,

it's easier to come in and

and start working

and get to the bottom of the incident.

Do you

remember a moment that really shook you,

where the weight

of the responsibility

of being this guardian at the gate,

protector, watcher on the wall

landed with you,

and you realized the responsibility

and the magnitude

of the responsibility

in protecting these organizations

and these companies.

Yeah.

Not too long ago,

I would say, like, two months ago,

we had, a very big incident

response

for a major organization

in the US where we got approached...

They saw malicious activity

and wanted one of their

development environments,

and they didn't really know

what was going on

and what made me feel really,

really surreal

is that the fact

that their security posture was good,

their security posture was really good.

It's

one that you,

you know, expect to see at a client.

You want to see at a client,

they got

every single tool in the book,

they got their network segmented.

They got the right VPN identity.

They had everything.

But they still got hit

with something

that at first,

you didn't know what it was

and how they got in.

So that feeling is kind of it

paralyzes you a little bit.

You don't know where to start,

why you want to check first.

And this is the moment when you

really get tested

by your emotions, how you

communicate with them,

how you communicate with yourself.

And what do you do first?

We love making this

podcast and we really hope

that shows in the care

and quality that we invest in it.

And we would really appreciate it

if you could take a moment to like

and share it with your fellow

security professionals,

as well as dropping us a comment,

letting us know what stories and guests

you'd like to have on the podcast

in future episodes.

Now back to the story.

Act 1

The Risk Experts.

CNA Financial didn't build cars.

They didn't make software

or manufacture microchips.

They sold something harder to define

and much harder to replace.

Assurance.

Founded in 1897, CNA

had spent over a century building

trust. Trust

that losses could be managed,

that disasters could be priced,

prepared for and, if necessary, paid out.

They were a backbone institution.

They insured skyscrapers

and shipping lines,

but more recently

they insured cyber. By 2021,

CNA had become one of the largest

cyber insurance providers in the US.

Their policies covered ransomware.

Their language

warned of credential theft,

lateral movement, exfiltration.

Their job was to anticipate the breach

before it happened. To study

the attackers

playbook and write policies

that made the unthinkable manageable.

But like many large, mature enterprises,

CNA carried

technical debt behind its sleek branding.

Legacy systems, patchwork infrastructure,

a hybrid of ‘on-prem’ servers

and cloud migrations still in progress.

And somewhere

inside that hybrid sprawl,

a door had been left open.

It wasn't negligence, it was complexity.

Years of mergers, years of integrations,

systems designed for resilience,

but not necessarily for speed

or visibility.

And so while CNA managed risk for others,

they quietly inherited risk of their own.

Internally, security tools

hummed in the background.

Phishing filters, VPNs,

endpoint detection, the modern stack

checked, maintained and compliant.

But in practice,

security wasn't just a product,

it was a race.

And in March 2021,

someone else crossed

the finish line first.

They weren't a nation state,

not a known APT, at least not yet.

But what they had was patience

and precision.

The malware came quietly,

not through a wide open door,

but through a subtle gap in the frame.

And once in, it didn't blink,

it didn't pause.

It just spread.

By the time CNA realized

what was happening,

it wasn't just about

defending their systems,

it was about whether they could

still defend anyone's.

What do you wish people understood

about being a CISO

that never shows up

in the job description?

You're not only there

to solve the technical problems,

you are there to solve more complex

business and people related problems.

It's not a checklist, it's about trust.

You carry the weight of potential failure

every day and sometimes even blame.

So you need to be

a very mentally strong person

to handle stress

from not only the specific problem side,

but also from many parties

in that specific business.

Okay, so if you had to name one issue,

one concern

that keeps you up at night

in regards

to your ability to provide security

and respond to an incident,

what would that one issue be?

It's rarely talked about,

but during an incident

and big incident, it's

what really keeps me up at night.

It's the resources

getting the right resources.

Because when you have the team

of incident

responders and analysts, it's

all about getting the right people

onto the job

and managing the time

well and the assignments.

Because if you don't

manage your research bank

and the things that you want to achieve

in that incident response well,

the incident response

is not going to go well.

So for me, when I

when I manage an incident response,

I really get nervous about the resourcing

because it's everything.

In an incident

when you see an organization

like CNA go dark,

what would your first step have been

if they were your client?

A smart man

once told me that

when a big incident happens,

the first thing you do

is to grab a cold glass of water

and just breathe.

You have to be relaxed.

You have to be very focused.

And the first thing that you want to do

is assess the impact,

because that's ethical,

because that

sets your tone

and what you're going to do

first and next.

You have to understand what happened,

what is the potential impact

to the business going to be?

How much money is this,

you know, environment

being down which costs you?

How much money does the data being leaked

gonna cost you?

Is it personal information?

Is it PII. Is it health information?

What is the regulatory

impact of this,

this whole things of items.

And answers that you want to get...

they set the tone

for the entire incident.

So before you even do any technical stuff

on the client's environment,

you have to answer some

very core questions.

Act 2

Contact Lost.

There is a moment just before impact

when the world goes quiet.

No alarms, no flashing lights, just

stillness.

That's how it began

at CNA. Not with chaos,

but with subtle disconnection,

a delay in response,

a paused cursor. A call

that didn't go through.

The systems were still on,

but something beneath them wasn't.

The malware was already inside,

moving, watching, preparing.

And then it began to spread.

Not wildly, not with noise,

but with intent.

One end point, then another.

Desktops across departments

locking into silence, servers

blinking off one by one

like lights going out in a distant city.

By the time it was recognized

as ransomware,

it had already become everything.

Phoenix locker,

though the name came later,

had claimed more than just devices.

It had severed the company's spine,

encrypted over 15,000 machines

not just tools, but lifelines.

Email gone. Phones dead. The network

detached from itself

like a body without a nervous system.

What remained was analog. Footsteps

in quiet

hallways, flashlights

sweeping across darkened

desks, whiteboards,

handwritten notes, radios.

If you were lucky,

the irony wasn't

lost on anyone who understood the stakes.

CNA didn't

just insure companies against cyber risk,

they insured against this.

They were supposed to be

the ones who understood

how to prevent it, contain it, price it.

Now they were living it in real time,

in silence

and worse files had been taken.

Policyholder data,

personal records, risk profiles, names

and numbers

and blueprints for future attacks.

The ransom note came quietly.

No theatrics, no countdown,

just a demand.

$40 million at the time,

the largest known ransom ever paid

and perhaps the most consequential.

Because CNA didn't

just hold sensitive data,

they held the identities

of other companies.

Companies already afraid of breaches

to the wrong adversary.

That wasn't just a list,

it was a target map outside the building.

The world hadn't noticed yet.

The headlines were all still quiet,

but inside, CNA faced

the most impossible question

what is the cost of silence?

During

a major ransomware event like CNA’s,

what's the right way

to handle communication

between vendors,

insurers, legal and execs?

One word that I would describe

is orchestration.

It's about every single person

needs to know their place,

and they have their place

to state they're opinion.

But at the end, it's

going to be my recommendation of what

the next move is,

and it's going to be the CEO's

final word.

So it's all about orchestration,

giving the person the place

to say their piece,

but it has to be in a respected way.

It has to be in a well organized way,

and it has to give that my way of giving,

my recommendation.

It's going to be the CEO’s final word

and them accepting it.

Have you run into any situations

where you've given advice

to the C-suite, to the CEO

or someone else?

And they said, you know, no,

we can't do that

because of a business situation

that we can't share with you.

But there are things that are going on.

Maybe for whatever reason,

they just didn't take your advice.

Did you ever run into that?

Of course.

I mean, a lot of times

when we come from the outside,

we always don't have the perspective

of an

an employee or a C-level manager

in that organization.

We don't know every piece of information

in that business.

So when I come in,

I give my unbiased opinion

or recommendation.

And sometimes, you know, it

conflicts with other stuff,

which I don't know about.

When a CEO comes in and tells me,

you know, we can’t do this, we can’t do that.

Usually I would say, okay, look,

you know, your business

and I'm here to serve your business.

And if you think this is wrong

for your business,

than I'm going with you.

But for the record,

and I always

say for the record

and we always make sure

we document those things

in a well-designed report

that it was being recommended by us

and the CEO chose

not to go with that direction

for whatever reason.

You know,

when you come in as a security person

from the outside,

you are the expertise on that.

And you have your... you're entitled

to say your opinion

and your recommendation,

and they are entitled to say no.

But it always needs to be on record

that you gave that information,

because sometimes rare cases,

They’re going to try

to twist it against you sometimes

because they're in

a very stressful position.

And if things go wrong,

even after the incident,

everyone wants to point a finger.

CNA was somewhat unique in the fact

that it's

one of the largest insurance

companies in the US, and what they insure

are other companies

against cyber attacks.

So if the attacker gets inside,

has access

to all kinds of data,

let's say a list of other companies

that are paying for cyber insurance,

that's their target list

for who they're going to hit up next.

Does that change

how you would

advise them, whether it's pay, don't pay,

or is that even something

that you would advise on,

or are you just there

to basically get their systems

back online, retrieve their data, etc.?

You know, it's about crisis management.

And first of all,

when you reach to a company like CNA,

which they sell cyber insurance,

you know, it's about reputation

and if you, you know, ruin

that reputation

by getting hit by yourself

in such a way

and getting that ‘ransom ask’

then it's a problem.

First for your brand

and second for the clients

that are paying for you.

And like I said before,

you know, supply

chain attacks are big these days

because attackers

not only target the end businesses,

they target their suppliers

so they can reach more.

So that definitely changes

the picture in regards

to paying

a ransom generally, you know,

my position is usually not to advise

if to pay or not to pay,

because usually

those companies have their own.

You know, legal or financial advisors

to guide them in that direction.

But if they would ask me for my opinion

it all adds up to the impact, you know

what would be the financial

and business

impact of not paying

of, let's say,

the data

being lost. Of that environment

not being restored.

If you don't have the right backups,

if that

business and financial impact

exceeds that ransom payment,

then I would probably

suggest them to pay it.

Although morally this is probably wrong.

But you know,

moral doesn't take you to the bank.

And if you're looking at a business

and the business goal is to maximize,

you know, their,

their financial capabilities,

then probably paying

is the right way to go.

But again,

it varies

and it depends on a lot of variables.

Act 3

The Cost Of Control.

There are breaches you respond to

and then there are breaches

you negotiate with.

This was the second kind

the attackers had said little.

No manifesto, no countdown,

just a lock on the systems

and a number 999

Bitcoin, roughly $55 million at the time.

cold, calculated, and delivered in code.

But CNA didn't pay.

Not immediately.

They engaged

negotiators, third party

and unbranded began the slow,

tense ritual back

channel messages, delayed

replies, subtle signals, stalling,

probing, testing

the adversary's patience.

But it didn't work.

The demand increased

1099 Bitcoin,

now nearly $60 million.

The price of recovery

was going up by the day

for two weeks.

The back and forth continued

not in war rooms but in encrypted chats,

not with raised voices,

but with slow typing ellipses.

The attackers weren't amateurs.

They didn't posture. They didn't panic.

They knew who they had and what CNA

stood to lose.

Because this wasn't

just a company brought to a halt,

it was an insurer of cyber risk.

It held the names, exposures

and histories of companies

who were already worried about ransomware

policyholders, executives,

industries marked vulnerable

and now exposed.

If that data was sold,

it wouldn't just hurt CMA,

it would prime the next victims.

A roadmap of the insured.

The pre-qualified. The likely to pay.

That was the real leverage. Inside CNA

The debate wasn't philosophical,

It was operational.

Every hour meant delayed

claims, eroding trust,

rising reputational cost

systems remained encrypted.

The business was functioning all

but barely. Publicly, CNA said

little.

Privately, they ran every scenario

legal compliance, regulatory exposure.

Could they pay?

Should they?

They consulted the US

Department of Treasury, specifically

the Office of Foreign Assets

Control, OFAC.

The attackers were believed

to be part of the Phoenix Group

using a ransomware

variant linked to Evil Corp.

But unlike Evil Corp,

Phoenix was not sanctioned.

That cleared a legal path,

but not a moral one.

Still, with the backing

of law enforcement

and after vetting the threat actor

through multiple

channels, CNA authorized the transfer

1000 Bitcoin, roughly $40 million,

a negotiated reduction

but still one of the largest

known ransomware payments in history.

The payment was made anonymously.

As always.

No receipts, no paper trail,

just a

cold transaction on a blockchain ledger.

Value moved, and with it.

The promise of a decryption key.

The key arrived. Files

began to unlock, servers

blinked back to life

and CNA’s systems stirred.

But they did not celebrate

because the recovery was not instant

and it was not clean.

Some files were corrupted,

some had been copied,

and no one yet knew

what had been left behind.

The business resumed,

but not where it had left off.

Something had changed.

The breach wasn't

just a technical failure,

it was a reputational rupture.

Word leaked of the payment.

Reporters circled, forums buzzed.

CNA wouldn't confirm the number.

They didn't need to.

Everyone already knew.

And in cyber security

circles, the questions began to echo.

Had CNA done the right thing,

or had they set a price for recovery

that others would be forced to match

for the attackers?

The payout was validation

for the industry.

It was a line drawn in dark water

and for CNA

it was the beginning of the next phase.

The breach was no longer

about what had been lost.

It was about what was still out there

and who might be coming next.

Yeah, it's

a really interesting question

because you're right,

paying ransom is certainly

not the moral thing to do,

and it invites more attacks.

But at the same time,

if you have this corporate responsibility

where you, let's say,

have a thousand customers

who've paid you for cyber

attack insurance,

and the attacker is threatening

to make that list public

so that other attackers

start lining up to attack those

your customers,

because now they know they're insured

and they're more likely to pay up,

even if it hurts you morally

to pay up the 40 million in this case,

then you do it

because in some ways,

it's the right thing to do

because you're protecting your...

you think you're protecting...

You believe you're

protecting your customers. Yeah.

If not, you have responsibility.

You have a responsibility

not only to yourself

but to other companies as well.

So I know we touched on this briefly,

but is there anything you want to add in

regards to the concept and wisdom

of paying ransom demands,

like the $40 million

that CNA was forced to fork over?

Yeah.

So, you know,

like I said,

it's very easy to say

never pay from a distance.

But, you know, when your systems are down

and backups are gone

and millions are bleeding

out of the business daily,

I mean, it's survival.

Basically, no one wants to fund crime.

But sometimes you're

buying your time to live and your

your business has to do it

if it wants to survive.

It's not about your reputation anymore.

It's not about your clients.

Even anymore. It's about survival.

So, it varies

and it depends on a lot of variables.

But, you know,

sometimes you've got to do it.

You have no choice.

Do you think most of your clients

could survive

ten days completely offline, like CNA?

That's a very good question

because it differs

between one client and another.

I had an incident a few months back

that an attacker leaked a lot of the data

out of that organization,

and we had to shut down the environment

for like two days.

And after few hours,

clients already threatened to leave.

And it was about

not even about the cyber attack anymore.

It's about restoring

that trust and reputation.

On the contrary,

I had another incident

where the client told me,

look, the incident already only happened

in the development environment

and the attacker seems to not

be able to get out of it - and it’s contained to this environment

I don't mind

shutting down the dev environment

for how long as it needs

to find a root cause for this incident.

So I can shut it down

and it has no business impact on me.

So it really varies.

But, you know, as

as I saw in a lot of businesses,

you know, ten hours, could even back them.

So, you know,

ten days could be very, very crucial.

Yeah.

That makes that makes perfect sense.

Different companies

are going to react differently.

If all your business is online,

it's going to make

a big difference versus whether you

you have a website

up and a couple things

and ya okay, it's

an inconvenience. Okay, great.

So what tools or tactics are underrated

in defending against an attack

like CNA. Visibility -

I think for me

visibility is everything

because you cannot protect

what you can't see.

You cannot respond to what you can’t see.

If I’m not able

to see, and be able to alert

on, you know, a

suspicious activity or malicious activity

than I cannot defend against it.

And second thing,

which I really think is important

is about the segmentation.

If you have the right segmentation

between environments and

and be able to say

that your most [precious] crown jewels

are being protected by that segmentation,

then I am well.

Rest assured that if you do get hit

and one of your external

facing environments,

the attacker won't be able

to move laterally

into those more important production

like environments.

So segmentation is very important.

But again,

cybersecurity is all about

defense in layers.

You're building those layers

to slow down the attackers.

There's never that 100% protection.

You always try to make it harder

for the attackers.

So you don't only need

that segmentation of visibility.

It has to be combined with,

you know, that

EDR. That identity control.

Those DNS layer protections.

The basics still win those battles.

It's not about the zero

days anymore.

They are

only they focus usually on the simple

simple weaknesses

Act 4 | Surface Tension.

The lights came back on slowly,

system by system, file

by file and function by function.

After weeks of darkness,

CNA's infrastructure began to hum again.

Work resumed,

claims were processed and phones rang.

But something fundamental had shifted.

Internally, there was relief.

Externally, there were questions.

The breach, once invisible to the outside

world, was now impossible to ignore.

Headlines began to surface

not just about the attack,

but about the price.

$40 million - 1000 Bitcoin. Paid in full.

Reported but not confirmed.

Echoed but not denied.

The amount

set a new watermark, one

that towered above the others.

Colonial Pipeline weeks

later would pay $4.4

million. JBS foods $11 million.

CNA's payment was several times that,

and the target

wasn't infrastructure or food,

it was trust.

The industry took notice

and so did regulators.

There were no sanctions violations,

CNA had verified that

they worked in tandem

with federal law enforcement,

followed OFAC

guidance, made sure the attackers

were not on the Treasury's blacklist.

Legally, the path was clear, but

ethically the terrain was unstable.

Security professionals debated it openly.

Had CNA prevented wider damage

or funded a playbook

for future attackers?

Was this containment or encouragement

inside the company?

CNA began the hard work of rebuilding

not just systems, but credibility.

A full forensic

investigation was launched,

and they confirmed that the attackers

had gained access

to sensitive personal information.

75,349 individuals were affected,

mostly employees, past and present,

and their dependents.

The company offered credit

monitoring, issued notifications

and published statements,

but they chose their words carefully.

The message was always framed

around restoration,

control and compliance and not fear.

What CNA

didn't say publicly

couldn't say

was what else might have been taken.

The value

wasn't in the files themselves,

it was in the patterns.

Insurers know

more than they say

about risk, exposure, liability.

That's what makes them valuable

and what makes them vulnerable.

In the months

that followed,

CNA initiated sweeping changes. Security

modernization, cloud migration,

new controls and new vendors.

Externally, they began advocating

for ransomware awareness.

Speaking on resilience,

positioning themselves

as a cautionary tale

but not a cautionary brand.

It was a careful return

to visibility. Controlled, measured

and very corporate.

But beneath the surface,

other conversations had started.

Insurance firms

reconsidered their underwriting models,

premiums rose, policies narrowed, and

some insurers quietly

began refusing

to cover ransomware payments altogether.

The market was changing, and CNA's breach

was part of the reason why.

Because this wasn't just another attack.

It was a glimpse into a high value,

low resilience target class.

The insurers of risk themselves.

No one in the industry missed the irony,

and no one was ready to say

it couldn't happen again

because the truth is, CNA

did many things right.

They followed guidance,

they contained the spread.

They worked with law enforcement,

they communicated with regulators,

and they took care of their people.

But even doing everything right

wasn't enough to stop the breach,

or to avoid the payment,

or to fully explain what had been lost.

Because not all damage is visible.

Not all

compromises leave logs, and not all truths

survive

press review.

CNA returned to business,

but the industry had changed around them

more cautious,

more expensive

and in some corners more afraid.

The ransomware economy had evolved,

and this breach helped prove

just how valuable

the right kind of victim could be.

When something does blow up

and maybe you've already been there

for a while,

or maybe you're called

in because it's blown up,

what would you say

would be the first conversation

you have with the CEO?

That's a very good question.

And as I mentioned

before, it's

all about building that trust.

he needs to trust me.

A lot of times you come from the outside.

The CEO doesn't know you.

Maybe he knows the company you work for,

but he doesn't know you personally.

And you come in

and you see him

usually at his most vulnerable

state. He’s broken.

They try to keep this business alive and

and it's all about keeping him

calm and trusting you

that you are here for them.

It's saying,

you know,

we are going to lead you through this.

We are not reacting.

We're going to find out what happened,

or at least try to.

But it has to be together.

No blame, just clarity.

Because, you know, if he panics,

then everything falls. Interesting.

You said try to.

Would you say it

from a sort of a forensic

analyst point of view?

What percentage of the time

are you just able to not solve

the mystery

of how they breached, how

they got in, when they got in,

is that most of the time,

or is that a tiny percentage of the time

that most CISOs just can't figure it out?

You just can't.

You can't find that hole

that they crawled in through.

I would say it's much more than you

would think.

I mean,

if everything was,

you know, being documented

and being configured

to be to have the right visibility

and the sufficient visibility,

then every incident

would have been solved very quickly.

But usually it's not the case.

Nothing is perfect.

And sometimes you just crawl your way in

and and you investigate

for days and weeks and,

you know, eventually the,

the company

says, look,

it's not that important to us

at this point.

We restored the services.

We kept the business going.

The impact was minimum.

We contained the incident.

We don't really care to know

exactly how he got in.

But, you know, sometimes

companies tell us, look,

take as much time

as you need to find that,

find that root cause.

And unfortunately,

sometimes you just can't because

you don't have sufficient information.

And, you know, that's why I say

make sure everything is visible.

Make sure you log everything.

Everything you can log log.

Because if some some things blow up

and you need to find

why it happen

if you don't have the sufficient logs.

You're just blind

and you wouldn't be able to find it ever.

If CNA had been your client pre incident,

what would you have pushed them to fix

or prepare for?

I think one of the first items -

the front lines, identity and access.

I mean you don't need ransomware

if you have a domain admin.

you need to have MFA everywhere

because MFA is your one wildcard.

An attacker can get your password,

they can get username,

but it's much, much harder

getting your MFA.

And basically you have to have

that anomaly detection.

You have to have the capable people to

even if they did get a hold of MFA,

you have to have the person that is able

to tell you that something's weird.

And afterward,

as we saw in the CNA incident,

they probably weren't

segmented right enough

because they got exposed

and everything got encrypted eventually.

And you have to be able to segment

so your attacker wouldn't

be able to move laterally.

Is there a multi-factor

authentication tool

that you live by

that you would say

you're not going to pry

that from my cold, dead hands.

I trust this tool.

It's awesome.

It's the best. It's never failed me.

Or they pretty much all the same.

Pretty much. I'd say all the same.

There's not a specific favorite.

The big ones like Microsoft

and Google and Okta,

they usually do the job.

But you know,

you usually need to be able to say

if you

even if you don't use

those authenticators

and you're able to only send emails

or SMS messages,

everything is something

you need to start somewhere,

and you need to be able

to add that layer.

As I said, it's all about the layers.

It's all about making

the attacker work hard for their money.

I guess it's

similar to that sort of old story

where you don't

have to be fast enough to outrun

the bear,

you just have to be faster

than the guy next to you

so that the bear eats him.

So if you're making it,

if you're making it so hard

that the attackers like you know

it's not worth it,

we'll just go somewhere where

it's easier to to breach.

Yeah, that's that's something

that we, we tell clients a lot

that you don't need to be 100% protected.

You just have to make it hard enough

for the attacker saying,

yeah, it's not worth my time.

And and that's something that we do

see sometimes when clients look,

we saw that something trying to

to attack us,

but it didn't really go further

because we had the right

protection mechanisms.

So if you do it in a way

where you make it hard

enough for the attacker, then

then it should be good enough.

Nothing is 100%.

Act 5 | The Insured

Cyber insurance

used to be the safety net,

the final layer,

the thing you hoped you'd never need

but were glad to have.

It was built on logic

models, probability curves,

loss projections,

premiums priced

like seatbelts in a luxury car.

But CNA's breach cracked that illusion

because when the company writing

the policies

becomes the victim of the policy,

you're forced to ask

where does the risk really live?

For years, ransomware attacks

followed a script: 1. Attack 2. Lock 3. Demand

and then 3. Vanish.

But this one changed the conversation

that because of how it started,

but because of what it cost,

CNA didn't

just pay a ransom,

they reset expectations

40 million dollars - confirmed or not,

the number took on a weight of its own.

It was repeated in boardrooms

and underwriting meetings

and whispered

conversations between CISOs and CFOs,

and it signaled something dangerous

to both sides of the equation

to attackers.

It said.

Insurance companies are lucrative,

they're central, and when breached,

they have motive to pay fast. To insurers,

it said

we may have underestimated

our own exposure.

It wasn't just a CNA a problem,

It was a blueprint for how quickly

the tables could turn.

In the months

that followed,

insurers across the globe

revised their stances.

Some added ransomware

sublimates, others

introduced clauses

excluding ransom coverage altogether.

Premiums climbed,

but not because risk had changed,

but because now they'd seen it up close.

Cyber insurance

was never meant to eliminate loss.

It was meant to transfer it,

to redistribute it.

But CNA’s

breach

revealed something difficult to admit.

You can't insure against a system

you're part of.

If the companies pricing the risk

or also feeding the targets,

then the model isn't

just flawed,

it's compromised. And somewhere...

Quietly,

defenders began asking harder questions

“Are we enabling ransomware by covering it?”

“Are payouts fueling the criminal economy?”

“Should we outlaw

ransom payments altogether?”

There were no simple answers.

OFAC had already made its position clear

paying sanctioned entities was illegal,

but Phoenix, in CNA's

case, was not sanctioned.

So the payment was legal.

Ethically fraught, yes, but compliant.

So what does it mean

when a payment can be legal,

effective, and still feel like defeat?

This is the paradox of modern cyber

defense.

You can build well, you can detect early.

You can comply with every regulation

and still find yourself

with no good options.

CNA did what many would have done,

what many will do.

They contained the damage,

protected their clients,

restored operations and followed the law.

But the moment they pressed

send on that Bitcoin transaction,

they stopped being just a victim

and they became a signal. To attackers

It was a green light. To peers

It was a warning.

And to regulators a case study.

And maybe that's the cost

no one calculates

in the insurance tables.

Not just the ransom,

not just the downtime,

but the moment

a breach becomes a precedent.

CNA moved on, filed their disclosures,

closed the case.

But for the rest of the industry,

the breach never fully ended.

It left behind a question

still echoing in the background.

If the one who insures

against the worst case scenario

can't stop it, who can?

How do

incidents like CNAs

change the way CISOs today built trusts

with their boards or with their clients?

It's a good question.

The trust with the boards

- they don't care about the excuses.

They don't care about the blame.

They want to see receipts.

They want to see your readiness.

They want to see how you learned

from the mistakes.

They want to see

what you're going to do next

and how you’re going to make sure

this doesn't happen again.

So when building that trust again

with the boards,

you have to be able to show them

that you are doing

everything in your power

to make sure this doesn't happen,

whether it's playbooks,

whether it's, policies,

whether it's

you know, buying more security vendors

and paying even more about,

you know, for cyber insurance,

you have to show them

what you're doing in order to,

to be prepared.

What should every CISO be doing right now

to avoid being the next CNA?

Two things.

Like I said, with the board,

you have to be able to run the playbook.

It's not about tabletop.

Tabletop is nice to do once in a while,

but you have to run the full simulation.

You have to test everything, run

the drills,

test backups. KILL your own services

and see who panics.

Make sure that someone besides

the CISO knows

how to initiate the IR, and also it's...

you need to be able to have someone

to try to hack you from the outside.

Whether it's red teaming exercises

or penetration tests.

You need to do that as well

because you know

where your weaknesses are.

But the attack.

But potential attackers

can know about weaknesses

that you don't know about.

And if you bring someone from the outside

which is unbiased in a white hat,

gray hat type of service,

then it can potentially

get you a much clearer picture.

And and we

we actually do that in OP Innovate as well.

We come to clients,

we expose those, you know, unbiased

vulnerabilities from the outside

and tell them,

you know, we found a lot of stuff

that you didn't know about.

And that way they come in

and they it usually changes

the whole picture in their organization.

Interesting. Okay.

You see a lot of different types of teams

across different verticals

in different sectors.

What's one mistake

you still see too often

coming up again and again?

One mistake.

As I previously said,

it's the visibility.

People just don't

turn on that configuration

when you're asked to

to log

the information

whether it's the EDR,

or it’s the firewall, the VPN, even if it's local

logs like on the server itself

or the endpoints,

because afterwards when you come in

and you investigate the instance,

you just don't see anything.

Another thing is our shared credentials.

A lot of the people

still share the credentials.

They send it in Slack,

they send it in Teams,

they put it in Google

Docs on the cloud, and even more,

they don't have the MFA.

So sometimes the attacker gets it so easy

and he just grabs that password

and just does what he wants.

And you're not even able

to see that anomaly

because it's legitimate activity.

You know, people

a lot of the time obsessed

over the zero days because it's cool.

It's sexy.

But it's

what I see from the past few years.

It's always the door.

Someone forgot to lock it.

That simple,

you know, mechanism

that it's so obvious that people

sometimes forget to turn it on.

Matan

thank you for those words of wisdom.

It was great having you on the show.

Looking forward to having you back again.

And now onto our closing.

Every breach leaves a mark,

not always in the systems,

sometimes in the story,

and sometimes in the mirror.

CNA wasn't the first company to get hit.

They weren't the first to pay,

but they were one of the first

to show

what it looks like

when the people who price the risk

become the risk.

For years, insurers spoke with certainty.

They modeled loss events,

calculated premiums

and forecasted frequency.

But cybersecurity isn't weather.

It doesn't move in seasons.

It shifts, it adapts, and it learns

and this breach made that clear.

The attackers

didn't need to break the rules.

They just needed to study

the ones that everyone else

was already playing by.

CNA paid the ransom.

They followed the law and they recovered.

But the breach was never

just about one company.

It was a signpost for the industry.

A moment

where the guardians of risk discovered

just how vulnerable they really were.

And now

everyone's policy

feels a little more fragile.

This is the world we live in now, where

safety is a negotiation,

where trust is provisional,

and where the people

who promise protection

sometimes need it most.

Today, security experts

must always be prepared, always vigilant,

and always listening for The CISO Signal...

All episodes are based on publicly

available reports, post-mortems

and expert analysis.

While we've done our best

to insure accuracy,

some cybersecurity incidents

evolve over time

and not all details have been confirmed.

Our goal is to inform and entertain,

not to assign blame.

Where facts are unclear,

we've used cautionary language

and we always welcome your corrections.

Thanks for listening to The CISO Signal.