Transcripción completa de “Por qué los jefes de la IA NO DUERMEN bien en 2026”. Haz clic en una marca de tiempo para abrir el video en ese momento. ¿Necesitas otro video? Usa el generador de transcripciones de YouTube.
0:00 Without security, the opportunity of AI cannot be realized. We have detected that 7 occur in our infrastructure. 000 attempts to crack and access passwords per second. Think about how long we've been talking here, how many password attack attempts have occurred. How awful! Who are they? What are criminals? Are they? Organizations. Exactly, let's not think about the hacker, the one wearing a sweatshirt and a cap, in the basement of his house. These are real organizations. Who are they? Why do they do it? We know that there are genuine organizations seeking to access information in order to exert influence. to break, to draw as many strategies as you could imagine in your head.
0:45 We are facing 2. 000 threat actors currently, which is more than 300. What we call nation-state actors. Wow. It could be an intelligence service, or it could be trade offices of different countries. That someone has recreated your voice, for example, to call the bank and carry out a transaction. Consider that to create a very realistic deepfake, they only need to record you for 30 seconds. A hospital. You cannot make an appointment. They might stop your operations. It has a huge impact. Because we are seeing that more than stealing it and then returning it, I am capable of stopping your operations. When you arrive at the office, you put on a superhero costume. Yes, I would tell you that superheroes don't exist. Work safely every day. Well, it's knowing for sure that you don't know how the day will end. Surprises can always happen when you least expect them.
1:34 We are at a turning point. In terms of historical change, if cybercrime were an economy, it would be the third largest in the world. Well, today I have the immense pleasure of welcoming two Microsoft executives to the studio. Those who work in the field of cybersecurity and are knowledgeable about it. Raquel, who is sitting to my left, perhaps on the client's side, of the problems faced by large Spanish companies. And Elena, as someone who has been working in the field of cybersecurity for many years, knows what she is talking about. So, you might be wondering what cybersecurity has to do with AI. Well, it has a lot to do with it, doesn't it? Then we'll discuss it. How AI is helping businesses and individuals defend themselves against crime, so to speak.
2:26 And also helping the bad guys do evil better. Then we'll talk about all this. So, Elena García Díez is the Chief Security Advisor, CISO, at Microsoft. And before that, he had that responsibility at Indrax, a very interesting Spanish company that does many things. And he spent 11 years at Incibe, which is the National Cybersecurity Institute. And Raquel Hernández has been director of security solutions at Microsoft, Spain, for just over two years. She has been in contact with large companies and their security issues for many years and was previously regional director of. Sid Scaler or Zero Sid Scaler or Zcaler, if we say it in Spanish. Zcaler okay? And then I also work for Garner and Repsol. So, you are two people who
3:14 That you deal with extreme situations such as threats and information hijacking on a daily basis. And then when you get to the office, you put on a superhero costume or whatever. In other words, it's a very stressful job. Complicated. Would you like to start, Elena? Yes, I would tell you that superheroes don't exist. Okay, there are great movies, great stories, great series, great content, but superheroes don't exist. So, effectively, working every day in safety means being certain that you don't know how the day will end. You have a rough idea of how it might begin, but surprises can always arise at the most unexpected moments and in the most unexpected ways.
4:02 So, in that sense, I believe that. And for me, what defines working in security is that it's a lot of fun. Very funny, yes. Because no two days are the same. You like to party. And who wouldn't? Well, not me. I mean, I prefer security and stability so I can do creative things and think and stuff. But someone who is constantly exposed. to a crisis that may arise in a large Spanish company listed on the IBEX 35, right? Suddenly, you receive a ransom note, which we will explain later. Those companies call you and say, "Hey, I have a problem." Well, let's see. This is happening. Hey, how's it going? Since we are talking about security risks in our daily lives. I wanted to share with you a very vulnerable moment I experienced last summer.
4:50 As those of you who follow me know. I was traveling around the United States and Canada to produce content for the channel. Imagine a very complicated journey. A pile of suitcases, film equipment. Several cities to visit in a short time, transfers to hotels, phew! In that context, the worst thing that could happen happened. My wallet was stolen, along with the credit card I use when traveling. I panicked until I opened the N26 app. In seconds, I was able to pause my physical card and create a new virtual card to continue making payments. Wow! It was my salvation! This experience has convinced me that N26 really is the best bank in the world for traveling.
5:36 I strongly recommend that you open an account. It has a lot of advantages that you can see in the link below. For people who travel, it is also very well equipped technologically to ensure that our money is completely secure. You don't have to pay fees for using the card outside your country. And if something happens like it did to me, you can instantly block your card from the app and create a new one to continue making your payments. After discussing this true story with the N26 team, they suggested I share it with you, and not only that, they decided to offer everyone who watches this channel a gift. 20 euros up front when you open your account with L26.
6:23 Click on the link and in seconds you will have 20 euros in your account. And it's not only the best bank for traveling, but also for everyday life, as you have Bizum, an investment platform, savings account, joint account, and even loans. You can't ask for more from a bank. So, you know what to do: sign up for L26 today and you'll get €20 in your account. We continue with cybersecurity risks in the age of AI. We, within Microsoft, want to say that, ultimately, technology provides us with a lot of opportunities for development as a society. And I believe we have to see that positive side. It's true that AI and I reflected a little before coming here, we are at a moment of historic change.
7:15 Our AI CEO Mustafa Zuleimán discusses digital humans. It is the fastest adopted technology compared to. a PC, internet, a cell phone, 1. 200 million users in three years will provide many opportunities, but it is true that it poses new risks because The bad guys are there too. I always like to compare it to the size of economies. If cybercrime were an economy, it would be the third largest in the world and is growing at twice the rate of the fastest growing economy. With a size of 9.4 trillion. The Spanish IBEX, or rather, sorry, the Spanish GDP is 1.7. What does this mean? Well, it has a lot of resources too. So it's true that we have to be aware of the risks and protect ourselves.
8:03 Within Microsoft, as the company has 240. 000 employees out there. And we are different areas. I, for example, work more on the client side, trying to understand where their risks lie and how our solutions can help them mitigate those risks. Then we have other teams that respond to that type of incident. And the truth is that we are fortunate that the company places a strong emphasis on security. Because we understand that without security, the opportunity of AI cannot be realized. without being afraid, but rather by being able to improve our posture day by day in an incremental way.
8:48 And as Elena says, well. Supporting customers when they experience a crisis: what is the best way to respond? Are these crises common nowadays? Let's see, if we, our infrastructure... We see 100 billion signals a day; we see that they are extremely frequent. Well, it means that we are looking at our infrastructure to see what kind of attacks we are facing, what types of attacks. are attempted. For example, we detected 7 occurrences in our infrastructure. 000 attempts at. Crack and access passwords per second. Think about how long we've been talking here, how many password attack attempts have occurred. How awful! How many accesses, right?
9:34 To that user who had the password 1, 2, 3, 4, 5. Or of QERTI. Or if not, the one below, the ASDF. I mean. So, are we able to have a TV? Then we talk, of course, about many words, but telemetry, that is, what is happening, what types of access attempts by cloud or by user identity. or by attempting to carry out a certain type of attack, which is increasingly less about brute force and more about trying to steal credentials. Well, once we can see all that, we are able to work on our platform to try to perform automatic detection and remediation. I mean, as users of technology, we have a collection of anecdotes, of things that happen to us, right?
10:25 From messages from soy. Hi Dad, my phone is broken. Or messages from a courier company telling us that they haven't been able to deliver the package and that we should contact them and I don't know what else. So we have, we know that things happen. But I believe that we are not taking the full extent of this problem into account. You just gave a figure, didn't you? Nine billion dollars. And that is the value of the industry, so to speak, the money it handles. Okay, and who are they? What are criminals? They are organizations, so let's not think about it. They are companies, they are businesses. Exactly, let's not think about him. The hacker in the sweatshirt with the cap in the basement of his house is a real organization.
11:13 That is why we also say that that the battle against cybercrime is not a one-on-one fight. It is supranational and is a public-private partnership. because in that exchange of cyber intelligence, in that establishment of regulatory frameworks, We can establish more effective measures. Okay, so you've mentioned that the volume of attacks is absolutely brutal. And it affects all types of organizations; it affects individuals. To what extent? You detect that they are targeting individuals or organizations. In the end, what we have to understand is the simile of that.
11:58 third largest economy in the world. . I don't care what the volume is anymore. If we think about countries, which we all understand, it is the third largest economy in the world that is seeking what all economies in the world seek, which is growth, and it is also achieving it. Who are they? Why do they do it? Well, let's say they bring together all the interests that can help you grow. And this ranges from cybercrime. more traditional and more directly oriented towards obtaining direct economic benefits in the first instance, without having to enter into a more complex chain, up to geopolitical interests, where we know there are real ones. Organizations seeking this route to access information in order to influence, to disrupt. To draw up as many strategies as you can imagine in your head, there are countless movies we can make and watch.
12:50 If we leave, you didn't say who they are. We've talked about it many times, and it's one of the things that security has taught us, has taught us to do. . designing better protection strategies, which means understanding who is attacking, and then we are talking about threat actors. At Microsoft, through the visibility that Raquel mentioned, at the end of the day, we are tracking, following, we have channels, let's say identified, because ultimately, as we are talking about organizations, You know how each one does things, if you observe with a little intelligence and analyze what they are after, how they move, what the rhythm of that attack per second of password is, or how they move afterwards. What are their goals? Are they trying to obtain information, or are they simply looking for more credentials? This allows you to establish a pattern of who the threat actor is.
13:43 And we are facing 2. 000 Threat actors currently being tracked by Microsoft, and to give you an idea, there are more than 300 of what we call nation-state actors. Wow! And that could be an intelligence service, it could be trade offices of countries. For example, there was a case in North Korea, wasn't there? What's more. They try to infiltrate organizations with fake profiles. Let's go through it step by step. So, on the one hand, you're talking about monitoring by Microsoft. . Suspicious activities. Watch what happens. I think in two areas, right? In other words, there would be the cloud environment, because people know Microsoft for 365, Office. Like individual consumer products.
14:30 But then there's a Microsoft called Azure, which is huge, What are cloud services? And when you talk about monetization, you are talking about monetization in those two areas. That all of our services are ultimately in the cloud, basically. In other words, it's a format. Software as a service, such as our Microsoft 365, or a platform as a service format, which you can build on Azure using different services or infrastructure. They are in the cloud. In the end, we are referring to our entire life. And that will then require, that is, if you are monitoring everything that happens, I don't know what share of the Internet Microsoft will have now, but it could be a fairly significant share, right? Of activity. So. To monitor all that activity, what do you have? Two million people working?
15:16 No, but look, Raquel was telling you that there are 240 of us. 000, and currently what we have is 35. 000 people working in security. In the different aspects of security, which is not only monitoring and defense protection, it is one part of security, but security is worked on, it is worked on from the design stage, it is worked on by default. and we work with the technology on which you share your information and on which you deploy controls that allow you to do so. . Secure that information. I have here the latest report, the Microsoft Digital Defense Report, which sounds kind of military, doesn't it? That sounds quite strategic. From the year 2025, there is a document that I will include in the description so that you can download it, where you can find a description of all that follow-up work.
16:09 So, can you each give us a couple of highlights of what has impressed you most this year, from this year's report, in terms of how our online insecurity is evolving, so to speak? Well, it has really struck me that we are beginning to emphasize that identity is the new perimeter. All the attacks that are being made on identity, both human and non-human, which we can talk about afterwards, right? Not only must we protect users' identities, but also the entire identity of the data we put in the cloud, which is increasing due to the process of cloud adoption. Because we are enabling the adoption of the University of the University of the University of the University of the University of the University of the University of the University of the University of the University of the University of the University of the University of the University of the University of the University of the University of the University of the University of the University of the University of the University of the University of the University of the University of the University of the University of the University of the University of the University of the University of the University of the University of the University of the University of the University of the University of the University of the University of the University of the University of the University of the University of the University of the University of the University of the University of the University of the University of the University of the
16:55 Baptism No, to identity When I explain it to my 10-year-old daughter, I often tell her it's like a human and a humanoid, in the sense that it anticipates processes. has an identity, it can be attacked to execute other processes. Then we must protect it. And those people He also has access to sensitive company information. That is why it is important to protect your identity and protect who has access to it. It's as if. Forgive me, but I'm freaking out about this conversation. So, you guys, Microsoft, until two years ago, what you were monitoring was...
17:42 Bot activity, right? People talked more about bots and the actions of people trying to break into a system than they did about them. But of course, now let's say that the number of actors has multiplied by by a thousand, because if you're talking to me about agents of hers who are also operating there, let's say that the possibilities of the subjects operating in the network are many more, no. Well, I think the attack surface keeps expanding, but what needs to be protected is that identity from being corrupted by someone trying to gain access. Just like a workload. Well, the loads you carry or the processes you take to the cloud, to Sure. are identified. It could be, for example, a company's billing process.
18:29 For example. Wrong. So you have the identity that you have to have. Something that defines it so that it can be controlled. But the very fact that we are having this conversation about identity and the identity of agents is a sign of maturity. And from the perspective of the importance of security in adopting and facing any transformation that we have had to experience. I don't know if we'll have many more like this one, which we're designing with security in mind from the outset, because someone could indeed be thinking, and it has been happening for a long time with applications, And the data has been flowing for many years now, exchanged automatically. What was the problem there? Then when things happen, we don't know who did what or why.
19:14 And that is why we put identity on the table, and why identity is the new perimeter and the key to finding what we know in any other process, in the food process, traceability. If we don't have traceability of what is happening, we won't be able to understand exactly what is happening because it has to happen, differentiating it from what is happening because a bad actor has entered. And linked to that, and linked to identity, which I believe will become increasingly relevant, and we say this and see it too with the clients and organizations we work with. I believe that how these attacks are being carried out with synthetic identities that are fake, which is also explained in the report. Interesting. That it is related.
20:00 Are they fake users or are they users who act like another user, that is, who imitate the voice of another user? Sure, in the end it's linked to whether you have deepfake, right? That's another one. Another aspect. That someone has recreated your voice, for example, to call the bank and carry out a transaction. Consider that to create a very realistic deepfake, they only need to record you for 30 seconds. Any one of us. So they might call us one day asking us questions about anything and everything, and they're recording us and they're... . And they can make a deepfake, but not just of you anymore. Also video. Therefore, authentication systems must be strengthened. For me, another aspect that caught my attention, and which ties in somewhat with what you said at the beginning, is: are we aware of the risk we face as individuals?
20:49 We need to be aware of deepfakes, for example, because it's no longer the case that I can be attacked when I'm trying to log in as a Microsoft user to Microsoft systems. But also as a personal user of my banking products or the healthcare system. It is my identity that can be carried over into other areas of personal life. That is why awareness is important. Okay, I get the idea that I have to be careful. in the use of my identity or in the use of the credentials I have to log in anywhere, right? Yes, and to be suspicious, right? And to distrust me. To distrust, for example. Two-factor authentication also in the banking app.
21:37 Sometimes there are people who find it difficult, it's like, oh, they're asking me to sign this, the passwords or not. While we do it at work, we also have to do it in our personal lives, because we are exposed to the risk. What caught your attention most in this report, Elena? What are the points that matter most? . Well, are you working, or are you more impressed? I believe that, for the sixth consecutive year, the report is once again a great reference for understanding what is happening outside and also for guiding major strategies at the right time. When we sit down with a client to analyze how comprehensive their strategy is, what is missing, what is not, where it is not going, because the report always brings, and this year, there are two blocks, one part on how the threat is evolving and another part on
22:24 how we see the defense strategy and protection strategy evolving and where we need to take it. So, I particularly like that second part, which is also strategic. where, based also on the data and observability that you can find in the first section, with lots of interesting data cases, you can browse whatever you want. If we start to dig around a little in the middle times How attackers manage to get inside organizations by sector, or which sectors are targeted—if you want, we can discuss it, but then it could be harmful. Understand in the second part how as well. Based on what is happening, we are seeing that the strategies we had until now, which were merely reactive, are not enough, that we need to move the Security Operations Center to a. Let's say proactive activity or operation in which you already anticipate what might happen to you in order to train yourself to have complete processes that minimize response time and anticipate
23:20 That risk and improving a response in the first second, I think that's very interesting. So that the people watching us can understand a little bit about what these terms you use mean. Why don't you first describe the possible attacks that an organization suffers on a daily basis? So, what are we talking about? There's one thing. For example, right? Phishing yes. Okay, then exit, then exit, ransomware. Why don't you make a list of things that might happen? in an organization, which are occurring today. Let's take phishing, for example. Ultimately, someone receives an email asking them to click on a link. I always say that what AI is doing is making them better and easier to write.
24:10 More realistic, too. And that could be a message telling you your bank account number, which everyone knows. Or they tell you that there is a package that they have tried to deliver to you but have been unable to do so. Or they might even say to you, look, we mentioned in the report that this one is perhaps a little more elaborate, isn't it? The clickfigs. who also talks about trying to take you to, listen, because your microphone isn't working or this application is failing you. Authenticate yourself, and that authentication screen is fake, and what they are trying to do is steal your credentials. Wow, and they do that on your computer. Sure, and if you put it in, of course. So, what could happen? With that, the theft of those credentials makes that internal movement legitimate.
24:59 And then we'll talk about how to fix it. But you're no longer talking about fraudulent access; it's that the credentials were compromised on a broken site. And what do they do? Are they stealing money from that person? Well, sometimes what they do, what they want, is to get into the systems, because then they can move around laterally and get to sensitive company data. to critical systems that can shut down. Stealing money doesn't always allow me to move freely. Within an organization until you find it. To perhaps take some data with me. Bring me data, that is, it's a bit of politics. I mean, I like it there, and it gives me a little something, you know? I believe that those of us in security always have a duty to. have to explain ourselves better. And you were asking about phishing, right?
25:45 And besides, all those terms, well, it's true that we've been incorporating a lot of new words, but if we think about it a little, the words aren't misplaced. What is phishing? It's fishing. So phishing is the typical and most classic attack that generally allows you to fish. What are you fishing for? For a user, this means a username and password to access a site. Then, how the story will end and the effect and motivation of that phishing cannot be anticipated, because what classic banking phishing will do is... . Take your ace and withdraw money super fast so you can't claim anything, okay? But we are seeing how there are other password thefts that then.
26:30 They result in much more complex attacks on much more complicated infrastructures, don't they? Because also, to what extent by entering or knowing what my personal email password is? Because someone could find information that would allow them to access your professional email account through your personal email account. And from there, climb the ladder and join a company, making sure you understand who else is in the company. We are seeing this when we talk about those sophisticated attacks that also. has a very strategic vision. In other words, here the cybercriminal is clear about what he is doing. What is your goal? And he takes the steps necessary to achieve the goal. You will often need to create false identities as well.
27:19 You will need to make lateral moves, you will also need to understand the context, who is relevant in this organization, who I have to send the phishing to, to which personal email address, so that I can then move up the ladder. ¿ And that's when we move on to more classic attacks that are still very much in use. Business email compromise, and I apologize for using another technical term, but ultimately, that is what it means. The value of the bec is the PEC. We talk about BEC, but it's him. It's an email that you receive. But your CEO, your boss, or the person who has the most influence over you, will kindly ask for your help in anticipating a payment or providing certain information, because they are counting on you. And that's where they load up on real social engineering techniques that, at the end of the day, are no longer psychology but rather influence the illusion with which you are going to do things, because you believe you are doing things right.
28:13 And we all want to do things right every day, and we love doing favors. And we love being part of the plan and the things that really matter to change the world. So, with AI, the message is very powerful; they know who to send it to. The email appears to be genuine SEO mail, and it is very difficult for a user to identify it. Yes, it is possible to identify it, but that's where technology comes in. And how technology can help ensure that email actually appears in your user's inbox. With an ey, this isn't what it seems, or I know exactly what it is, and the security team will take it away because, believe me, you didn't want to receive it.
29:02 And ransomware is just that. So they steal the information, and they say, hey, I have to go. They don't steal it from you. They don't steal it from you first. They kidnap her. They encrypt it for you. Why can't you access it? So that you cannot access it. So you can't access your customers' data, for example. Indeed. Overnight. Overnight, but there is a gentleman. Like in a good kidnapping, right? What happens during a kidnapping? You can't see a person, but there's someone who tells you, pay me this and I'll tell you where they are and I'll bring them back to you. And it will come back to you. And this is how we can take advantage of the digital world: the information is where it was, but I've put a layer on it, I've encrypted it.
29:51 If you want to decrypt it at the modest price of D, I will give you the key with which you can decrypt it. The attacks of. Yes, yes, they are very common. But you don't even know who you're paying. Let's see, you don't have to pay, right? Because if you don't, you're ultimately feeding the 9 billion wheel. Well, there are countries that. For example, in the United States, you can decide whether or not to pay. A couple of years ago, there were two high-profile attacks on two casino companies; one paid up and the other did not. And make sure you recover.
30:37 Imagine you are a medical company. Or a hospital. A hospital. You cannot give appointments. They might stop your operations. has a huge impact. Because we are seeing that more than stealing from you to then give it back to you, I am capable of stopping your operations. Wow! That's what really limits you, and that's why we see it clearly with more sensitive issues, but imagine any CEO responsible for any productive industry being told, no, you're not manufacturing anymore, we're not going to manufacture today, boss. What does the boss say? Or critical systems, right? In other words, critical infrastructure, because you can stop. We must restore the light. Electricity gas. And then something happens that we also see evolving, right?
31:24 We are talking more and more about cyber resilience. And as Elena said at the beginning, she's also ISO, right? He has experienced firsthand what it means to be responsible for operations within a company. You have to be there. Be prepared for when an attack occurs, because it will occur. And I believe that it is no longer an attack; it is simply happening. A lot throughout your cybersecurity career, but it's how you respond, how you become resilient. information retrieval. That is also another aspect that I believe is increasingly being brought to the table. Assuming that we are going to have attacks, let's talk about cyber resilience.
32:17 And it's part of the regulations that are also coming into play. When we also talk about investment in. Not all investment is in technology; a very important part is also in people and processes. And in the end, Raquel told it very well, didn't she? When you are already in crisis, you have to recover, but what preparatory work can you do? so that everything that is going to happen, knowing that you are going to have a crisis, can be managed in the most efficient way. And that's not just about. . Continuously refine and review technology to ensure it helps you in the best way possible, but also consider everything that surrounds technology, and here I am even talking about the CEO's decisions.
33:02 and any stakeholder in a moment of crisis who has to be prepared to make decisions. You have to be prepared to make decisions under pressure. And that's where we can provide training so that those decisions can be made in the most agile and appropriate way. Okay, and I think that's one of the keys in that shift from reactivity to proactivity, in working on things beforehand, because the incident is going to happen, the crisis is part of business as usual, if you'll allow me. And there are many things that can be done to optimize crisis management, to professionalize it once again. In fact, in the frameworks we use for work, we will try to use English words. We always talk about what you do, don't we?
33:48 With our security platform, what you do before the breach and what you do after the breach. That includes preparing them for a ransomware scenario, for example. For example, you have to have, for example, starting with identity, right? Well, you have to have conditional access, in case someone suddenly enters and you notice something suspicious. Being able to detect, that is, to establish which behaviors may be anomalous in order to detect them and act on that identity or on the device, or to be able to detect that It could be abnormal access by someone who always logs in from their home in Madrid and suddenly you see that they are accessing from the Philippines, right? From France.
34:33 Hey, that sounds weird, doesn't it? There you can carry out preventive measures, such as setting up backup systems so that in the worst-case scenario you can Recover the press. Can an organization today guarantee that it has no suspicious agents within its ranks? No. And her. The most accurate hypothesis for defining a truly effective protection strategy is to assume What's inside you. Assume. There is someone inside, of course, so you don't forget and so you really unfold. The case of identity gives us a very good picture of the perimeter we can see. That's unusual access, but we can also do a lot of work inside.
35:21 And I also believe that we are at a very good moment for that. Why? Because I'm on the inside and I know that information is the crown jewel. and what information is not relevant, which part of the servers or applications can be shut down for a certain period of time without any problems. and which part does not. So, working preventively, protecting that information, even if the bad guy is inside, he won't be able to access it because we also know the protection technology. Information encryption is also available to the good guys. If we apply it at the right time, with proper management, the bad guy may be inside, but he won't see what we don't want him to see. And the thing is, it's complicated. make the decision and be able to truly identify what we never want to happen in order to focus our attention.
36:10 The report discusses a concept known as dual time, which refers to the length of time these malicious agents or attacks remain within the organization. It's not just that they come in to take things, but that they come in to stay. Maybe they're getting in through someone's electricity bill, they're getting into the power grid and they're there for months. Months, that is, without doing anything. Observing. In other words, they are doing something like an X-ray of the stories. Or working on an alternative door in case they get kicked out. It is one of the first activities when searching for a threat that we call persistent and advanced, which seeks to ensure its persistence.
36:57 The first thing they do is make sure that if I get caught, I can get in from another way, because it's much easier to find a door when you're already inside. You create a user specifically. So, you've seen it, you can see everything, but once you're inside, depending on your abilities, Well, you can be sure that if they kick me out, I'll come back another way, change my tactics, learn, observe what they've detected so I can come back more quietly or differently to be more successful. And artificial intelligence, how has it helped those who want to do evil, and how has it helped those who want to do good? You want to deal with evil, and you want to deal with good. Well, I think there is a part where the attacks are becoming more sophisticated.
37:43 Because artificial intelligence is used. When we referred to the 7 earlier. 000 password attempts per second. That has also increased exponentially. Two years ago there were 400, we have gone from 400 to 4,000. 000 7. 000, because artificial intelligence is used. Phishing is of higher quality because it uses artificial intelligence. The same goes for deepfakes that trigger synthetic identity attacks, because they use artificial intelligence in the development of malicious code. use artificial intelligence. So bad guys don't have to be so sophisticated to attack now. In other words, they don't need to know how to code. They don't need to know code, of course, because they have artificial intelligence. And that will have done it, it will have multiplied the number of criminals, perhaps.
38:28 Well, let's see, as far as we're concerned, the number of malicious actors we've been tracking has been increasing. In the end, it is a sample of the activity. If you combine that with how the billions in which we could simulate its GDP have been growing. Yes, they are getting bigger and bigger. Those nine billion? Whose money was that? So, are those corporations the ones losing money, or is it also the public systems? That's obvious, really. If I steal credentials, I sell them on the dark web. Okay, so there's a market there. There is a market, of course. I ask for a ransom, I feed that industry, and that has to be paid for.
39:19 There's a whole industry to such an extent that we don't talk about it, right? We say that the bad guy You no longer need to know how to program. The bad guys have been perfectly segmenting roles within cybercrime for many years now. The programmer is one thing, right? And what if we take ransomware as a service or phishing as a service? Often, the technician who has deployed the phishing platform puts it up for sale so that a criminal will come along and pay for it. And he's already the one who dresses. And there are companies, right? In other words, there are companies that sell software. And with the co, and with the economy in complete. In other words, there is one who pays and another who collects. He laughs so he doesn't cry, because the truth is that he does too.
40:04 It's comprehensive, it's comprehensive, but well, that's what has happened with organized crime. Always Where does organized crime money come from, and where does Europe stand? It's just that with the explosion of digitization in the information society, creativity It has multiplied exponentially. Indeed, and it takes us to moments when, in addition, when you introduce that industrialization and professionalization, what we are also seeing is that that industrialization is getting better and better. segmented, and it is true that we believed that those who only engaged in cyber espionage would never pay for a specific Malware as a service, and now we are seeing that yes, the industry is increasingly collaborating and sharing issues. And everything is anonymous, meaning that when I receive a ransomware attack
40:54 I don't know, I pay him, I pay into a checking account, if I pay, but I don't really know who he is. Of course, always seeking what is outside the law. What is outside the law, outside control, will hinder quality. There isn't a bad guy that I can, I mean, that I have a relationship with. He's anonymous; no one really knows who he is. Man, you never really know who he is, because he won't let you know who he is. Because, let's see, we still have police forces and, at the international level, they act Always working closely with the private sector and the public sector to combat this, as with other crimes.
41:40 This year's outstanding operation by Luma Stiller, who were stealing credentials, has been a collaboration at the highest level. with Microsoft, which has led to the dismantling of the gang behind it. Obviously, those thieves never give anything away; they're a completely organized gang. Well, there were four hundred thousand infected computers, right? I don't have any data. I may be mistaken now about the size of the band, but in terms of infrastructure, that is how the threat capacity is measured. 400. 000. And Spain was also highlighted in red as one of the most infected countries. And it is a worldwide threat. In other words, there was no country that escaped with even a minimally functioning economy. And it's true that this is a good example of collaboration.
42:28 public-private right? Because few people know about it—I didn't know about it until I joined the company—the Microsoft Digital Crime Unit. Oh really? It is a team dedicated to fighting criminals. So, they were the ones who later requested the order. In other words, they collaborate with the police, which is what they do. Of course, cooperating with the police. In other words, these collaborations, what I have, and in security. I am especially proud because I believe that we do talk a lot about always collaborating, but we are also very respectful of all roles. And in the end, here the one who pursues the criminal, what the groups told me. They were the cyberterrorists at the time, the ones who make your neck tingle. As you said, he is the police officer, and he has to remain the police officer, because otherwise we could end up with inaccuracies in the process that could later lead to the criminal being brought to trial.
43:18 You find yourself in a moment of inconsistency due to the process followed, because in the end, justice is justice, and professionalism must prevail once again. So, we are pursuing what the Digital Crime Unit does there. Identify malicious activities and contact and share information with governments and law enforcement agencies to help them do their job more efficiently. Once again, technology at the service of society. How does AI help combat cybercrime? How is it helping? To safety in general, as it can help us all. And I believe that applies here. all the open-mindedness we can muster, because it will help us along the path and the road to automation that we were already working on to
44:11 in that world I was talking about. Sex surveillance routines. Routines for monitoring, monetization, and also for better understanding what is truly anomalous and what they are. the things that happen that have to happen. These millions of signals you talk about that you monitor will have to be done by an AI. It won't be a human being watching there. It is not a technological combination. We were already working with very powerful technology to monitor all of that. Now the scale that the IAE gives you It's amazing not only on an operational level, which could be achieved directly with more traditional automation, but also in terms of what we're seeing and what we're doing, right? It is to allow That the security operator who has seen an anomaly, or the system has already given him some context of an anomaly.
45:02 You have to start planning, making other inquiries throughout the environment to see where that bad guy has moved within the organization, what else he has done, and how long he has been there. Well, what we're seeing now is that you can program that script that we needed before, which required programming knowledge, by asking artificial intelligence to do it. Of course. And he gives you the code and displays the code, which gives you tremendous power. And if you go up, because I was covering what the downward operation is with this. You can get an idea of the power. But then there's also the security work, which involves explaining to upper management and making sure everyone within the organization understands what's happening, why we have to invest in this, and so on. AI allows you to efficiently generate executive summaries to present at the C-level, as well as comparative and contextual analyses with reference reports such as the MDDR and others.
45:55 In terms of regulatory compliance, having that in natural language at the click of a button through a copilot that does the work for you that you would otherwise have had to do yourself. Days or weeks. Well, give it to me, won't you? It is an example of power. We're not just talking about them being guardian angels, are we? Of the guard, of the organization. But they are also security experts who keep you informed. Of course, because you train them. For example, we block 5. 000 million phishing emails sent daily. We have one of the agents we have developed, which is an agent for phishing triage, because you may have some positives. Before, I was the analyst; I observed him. Now you have an agent that works based on patterns.
46:43 In the end, as Elena says, artificial intelligence is what gives you a computing capacity that we as humans cannot achieve. Then, you can analyze based on much more information and be much more accurate, eliminating false positives and noise. Understanding what has happened in a way that exponentially increases human capacity and knowledge. There is a part of automation That we will probably stop doing, or that Level 1 SOC analysts, who may be involved in that triage, will stop doing. To tackle more complex situations, in which they will also use AI to try to provide a better account.
47:29 There is a type of attack in which the report that has affected me greatly is discussed. It really caught my attention. It's email bombing, which means they send you tons of emails, and among all those emails, which may be subscriptions or whatever, they slip in a message that infects you with malware or something. Are you familiar with these types of massive email attacks that target an organization and start sending you emails from the bank or emails about anything, from a subscription? To try to provoke. Yes, to try to get you to fall for one of those things, right? But the way they do it, I mean, they send you tons of emails so you don't realize when they're attacking you. But the good thing is what Elena said, if we have worked to establish those protective barriers. We will try to prevent these emails from reaching the user.
48:16 Because it is not normal for a user to receive so many identical emails, put the same thing, without having. So technology, obviously enhanced by AI, was already helping us, and now it can help us even more. But that's normal; in other words, it's the same tactic all over again. I'm going to wear you out or I'm going to pique your curiosity. What I want is. to have the power of your mind after all to do what I want you to do. What is clear is that attackers use AI. We have to have the same tool; we cannot have less, otherwise there will be an imbalance. There is a question that many people ask me on the channel: that in the end, artificial intelligence models are They are handling many questions from many people. And those questions can contain all kinds of information.
49:03 So, I'm asking you more from a security standpoint than as a company that sells language models. In other words, is it sensible for someone in your company to upload the company's financial data to their personal account? No. That generally violates any good policy. Or customer lists? No. In fact, when Elena spoke of information protection as a predictive part. AI has not created new risks, but it has increased the likelihood that they may occur in a certain way. In other words, if we're talking about. Possible over-sharing of a document; that document was already over-shared.
49:49 The thing is, it's much easier to locate it when you use a generative AI tool. Then you have to protect the environment. We have worked extensively on security as an enabler of the safe adoption of AI. Because if you make policies to limit oversharing, policies on labeling information. If something is sensitive, someone cannot get used to it. What is happening is that many people who want to use AI in their work find that their organization does not allow them to do so. But on the other hand, what we also see is that organizations want to use.
50:37 Well, but they want to take advantage of the opportunity presented by AI. Of course, because what they are realizing is that... And it is in the process and at the moment when we are collaborating and putting in all our effort that AI can really cause us problems if we have not worked sufficiently on security beforehand. And what cannot be, is not. Having more problems than we already have. But wouldn't it be more sensible for your organization to have a Copilot enterprise account? Exactly, of course. I mean, I think there's a part of me that agrees with you, you can't put gates on the countryside. We are at a historic moment, the digital backbone we mentioned at the beginning. So, it's true that it often is. We will help you use generative AI safely.
51:24 So, let's establish some principles first. In other words, information protection projects have always been complex and time-consuming, especially for companies with a long history, right? We accompany you so that you can implement measures that are ready to be used safely and immediately, and continue to develop those security capabilities as you are able to use others. But, for example, we can redirect them and have a series of applications that are permitted for use within the company, and if someone tries to use another one, they are redirected. those permitted by the company, because they are controlled, because we are no longer just talking about information leaks. We are talking about trying to make a PROM perhaps an unethical use.
52:13 Or attempt to generate information against the company. By the way, what are these prompt injections that everyone is talking about? Let's see, we incorporate AI as an asset in our organizations. And at the end of the day, what we are doing is incorporating another asset, another application, another environment that we also have to take care of, because it will also be vulnerable to attack. Therefore, prompting and prompt attacks are one of the new risks that any security responsibility must take into account when protecting. In my ChatGPT And start sending messages to ChatGPT or Copilot or whatever it's called. Yes, to confuse and even poison the data and training you have been doing, what you have begun to teach him.
53:00 Well, change it. And that's it, in language models, that humanoid too, and that ability we have. It's worth a lot, so you have to protect it a lot because they're going to come and attack it. And that can harm you, not only on an ethical and legal level, but also in terms of normal regulations. I believe that there is a strong effort and commitment from all organizations as well. But that's the thing, we have to make sure that the education we've given him is still there and that there's no risk to him. fraudulently in an organization's AI assistant to introduce false information into the organization. Or start training him to effectively say what you're telling me, which is really nonsense, is what you should always respond with.
53:51 And it can have a reputational impact or cause the project to go wrong. But this can be the same for both the co-pilot and the partner. If someone comes up to a coworker and starts training them and telling them about processes that aren't the company's, not exactly. And no one can prevent that from happening, because that professional will indeed start doing things in those countries. That's what we try to do: protect the models. That's where we really work. A very strong effort. To achieve that, because as I was saying at the beginning, I think that we in security have learned, and everyone in technology and organizations for the most part, We have to address all these risks from the outset, and that is the approach we are taking, so that we can determine the level of tolerance and discrimination that you are going to allow in this model.
54:42 How you want it, how your company will operate. These are things that are already being made available so that they can be controlled and managed securely. Then the report also talks a lot about geopolitics, doesn't it? And mention it, as you mentioned earlier. There have been North Korean workers who have been working and are working remotely for American companies. Of course, Insider Risk. Sure, I think we're in a scenario of geopolitics or even cyberwarfare, right? Then, of course, you can have it. Elena was talking about them. almost 2. 000 groups that we follow, 300 of which are backed by nations, different countries that support and sustain them.
55:28 So, that was a case we detected where certain workers can modify their VPN location. Instead of being in North Korea, it seems like they are in the United States or Europe. With deepfake, it may seem that they are different people than they really are. They are developers, so they are involved in a company. And what are they doing? Well. be able to steal intellectual property, access sensitive data from the companies they work for, and engage in espionage. That's the risk, of course. which also infiltrate resumes on LinkedIn or other professional job search services.
56:22 We're very vulnerable, aren't we? That's the conclusion I'm drawing from this conversation. Well, but we're no more so than we've always been. The thing is, there actually is. And on both sides, right? The selection process for a legitimate organization becomes more complex, and the selection process for These cybercriminal organizations are global in nature, operating in a comprehensive context and also because of the value that the industry has seen in them. And we don't move on our own, nor does the industry move on its own, just searching. incorporate its own staff directly into payrolls, but often also resorts to what I would call professional services, seeking that insider, that employee who is already within the company that interests me.
57:10 to offer them extra pay, a way to collaborate, and there are also major cases and big headlines where this has happened, and in the end, it is the last link in the chain of employee unrest. Which ends up facilitating certain issues. Technical services, right? Support services are also sometimes attempted. Yes, it's very classic, isn't it? Impersonation, which is the easiest thing to do when you're on your PC and what most awakens our instinct or call to action. Or your money is at stake, and it's banking phishing. Or your computer is broken It's broken, or if you don't listen to me, it's going to break, because obviously, when your computer breaks, it's a disaster.
57:57 So if someone calls you to help you fix it, because otherwise it will break. We all say yes, please. Welcome, thank you for calling me. I'm so happy. I already said today that I haven't restarted anything. You remember not to use some old Microsoft applications, right? Quick Assist, I think it was called, right? Okay. Because they're not protected, right? Because they do not allow for the levels of security required by the current threat context. Because the threat is what we were discussing. It has evolved over time and will continue to evolve. What is certain today. It may not be safe tomorrow. And that's why I mentioned at the beginning that we work with security by design and security by default, but we also work. Operating safely and assuming that we have to continuously monitor how we are protecting ourselves and continue to evolve that protection strategy so that it really remains effective, because otherwise, it won't be.
58:51 One of the biggest attack vectors is obsolescence. That's why we have to take care of it. We always recommend that you eliminate obsolescence from your organization. Some quick tips on an individual level to protect myself or protect the people watching this video. Some tips are very practical. Well, I think it happens because we don't trust the messages we receive, when we are asked for something. There is a part of awareness that Elena has spoken about. To think that there may be a risk and be suspicious. We apply this in zero trust architecture policies.
59:38 It's just that since I don't trust, I verify. If someone calls me and gives me my personal information and is calling me from the bank, then I hang up and call them myself. Also try to implement the two-factor authentication we mentioned in the report. So there are two ways. That I am obligated. There are two ways to log into the system, right? Exactly, in addition to. The password and a phone call. And a text message or a phone call. Well, just as we have it deeply ingrained in the company, we should use it in our applications. People make him feel lazy. So then, how do we create passwords? Well, not just one for everyone, for all beings.
1:00:24 When is this password issue going to be resolved? Well, we say that whenever we apply BIOMES, for example, in Microsoft, right? We have Windows Hello. I can't remember my password anymore. What is Windows Hello like? Well, in the end, it's biometric recognition. So what do you do? Do you put your finger in one place? He recognizes my face. Ah, the dear one. And then, if I need to access certain applications, I have to re-authenticate myself. And with that, you can forget about passwords completely. Of course. Okay, and for organizations, Elena, you've talked a lot about prevention, but I don't know, I mean... For example, an SME—you know that it may not be very sophisticated from a technological point of view—what can it do to be less vulnerable? Well, I would sum it all up in a word: responsibility.
1:01:10 If I may, I would also like to mention something about the individual that applies very well to the company, which is knowing yourself and being responsible for what you are going to do and where you leave your things. What do you do with your belongings? How do you drive? Because, indeed, having an armored key. to access the safe or the data center or whatever is truly critical to your business Well, it's proportionality that you have to apply. Safety, zero risk does not exist. So, it is up to SMEs and any organization to carry out this exercise. What hurts me or what could hurt me, and how can I work on preventing that pain and avoid a more serious injury? I've already put on a knee brace because I noticed that my knee was giving way, and hey, with this brace on now...
1:02:03 I can ski much more safely. Ultimately, it is also our responsibility to protect our credentials and passwords. If we find it so difficult to remember passwords, we also have to weigh up the effort involved. The things that really aren't important, and rely on what you understand. There are things that are not important, that do not deserve a strong password. But keep in mind, that is, be aware that you have decided that it was not important. If you decide that the fruit shop's website wasn't important, that may be true, but be careful if you left your card there and there's no way to prevent the bank from always asking you for a second factor. Now, what do you see? The bank will always ask you for a second factor, and I think that's where the regulations and how we mature come in.
1:02:48 I don't know many people who complain about when, through PSD2, we all have our coordinate card, our tal, they send it back to you. Authorize your device directly to make it more talented. There is a lot of trust, so we have to understand a little and be a little responsible with it. where we are and what we play with. Just as we do in so many other aspects of life. It's not that much more complicated than other much more complicated things we do on a daily basis. I truly and firmly believe this. I have here a glossary of terms related to cybersecurity, a dictionary, okay? I think we've already covered phishing, right? That would be impersonation or deception by mail. Fishing. We've also touched on phishing and ransomware, which is when your data is hijacked and protected with an encryption system, right?
1:03:35 Which prevents you from accessing them. Malware, what is malware? Malware is any code. Realize that it's code, any code. . Malware is malicious code. Evil. Okay, multi-factor authentication—that's crystal clear to everyone. Then, bots too, I think that's well known. We have discussed business email compromise, those emails you receive from the CEO, who first praises you, flatters you a little, and then asks you to help him with something. Social engineering. Okay, endpoints, the terminal devices. Why is this used so much in the field of activities? This is very interesting because it also ties in with what we were discussing earlier and why MDDR is where it is. And Microsoft's capacity in terms of observability is what it is.
1:04:24 The endpoint is the final device. It's the cell phone, it's the tablet, it's the PC, it's whatever. And what we have also learned over the years when talking about security is that you cannot talk about security if you do not have an end-to-end vision. And that's Microsoft, right? From the class, from the best part. classic office automation, operating systems, cloud computing, endpoints. When you are able to cover everything and know everything from end to end and see what is happening from end to end, that is when you really You can protect that. So it's not about protecting servers that I have in a building, but rather ensuring that all points of contact have the technology with the organization. It could be a cell phone, it could be Malexa, it could be doors, because IoT devices or a staircase system, that's how the electrical industry was.
1:05:14 They are doors, internet doors. He is referring to the attack surface, which would be all the endpoints. All those doors at the end. Doors and windows, if you like. In other words, the surface area of this attack keeps expanding, because in the end it's like the size of your connected network. There used to be much more. closed, because if you had your data center, it was much more localized, but now it is completely distributed. And in the end, that's what we were telling you a moment ago. AI also increases the attack surface because previously we did not have language models that could be attacked and therefore had to be protected.
…
