Join us as we discuss the upcoming RSA Conference session, Blackjack and Breaches, featuring cybersecurity specialist Tennisha Martin and data breach investigator Aleise McGowan where we explore cybersecurity challenges, data breach trends, and the unique risks faced by industries like casinos.
Guests:
Tennisha Martin, Executive Director and Chairwoman at BlackGirlsHack [@blackgirlshack]
On LinkedIn | https://linkedin.com/in/tennisha
At RSAC | https://www.rsaconference.com/experts/Tennisha%20Martin
Aleise McGowan, Chief Information Security Officer, BlackGirlsHack [@blackgirlshack]
On LinkedIn | https://www.linkedin.com/in/aleisemcgowan/
At RSAC | https://www.rsaconference.com/experts/Aleise%20McGowan
____________________________
Hosts:
Sean Martin, Co-Founder at ITSPmagazine [@ITSPmagazine] and Host of Redefining CyberSecurity Podcast [@RedefiningCyber]
On ITSPmagazine | https://www.itspmagazine.com/sean-martin
Marco Ciappelli, Co-Founder at ITSPmagazine [@ITSPmagazine] and Host of Redefining Society Podcast
On ITSPmagazine | https://www.itspmagazine.com/itspmagazine-podcast-radio-hosts/marco-ciappelli
____________________________
Episode Notes
The upcoming Blackjack and Breaches RSA Cconference talk featuring Tennisha Martin, a seasoned cybersecurity specialist, and Aleise McGowan, a renowned data breach investigator, promises to be an enlightening exploration of cybersecurity challenges, data breach trends, and the specific risks that casinos face.
Tennisha Martin, with her extensive background in cybersecurity strategy and risk management, is anticipated to share insights on the evolving cyber threats landscape and the crucial strategies organizations, including casinos, can implement to fortify their defenses. Aleise McGowan, known for her expertise in forensic analysis and incident response, is poised to delve into the intricacies of data breach investigations, highlighting the unique challenges that casinos encounter in safeguarding sensitive information and maintaining robust casino security measures.
The forthcoming presentation by Tennisha Martin and Aleise McGowan is aimed at shedding light on the importance of collaborative approaches in cybersecurity, particularly in industries like casinos where the risks can be heightened. Their combined insights and experiences are expected to underscore the significance of proactive cybersecurity practices and strategic incident response protocols tailored to the casino environment.
As we look forward to the Blackjack and Breaches RSA Conference session with Tennisha Martin and Aleise McGowan, the anticipation of their expertise and knowledge sharing, including insights on casino security risks, sets the stage for a compelling dialogue on cybersecurity best practices and the imperative for organizations, including casinos, to prioritize data security. Stay tuned for an insightful exploration of cybersecurity resilience and data breach mitigation strategies and to hear what Marco thinks about potential jail time.
Be sure to follow our Coverage Journey and subscribe to our podcasts!
____________________________
Follow our RSA Conference USA 2024 coverage: https://www.itspmagazine.com/rsa-conference-usa-2024-rsac-san-francisco-usa-cybersecurity-event-infosec-conference-coverage
On YouTube: 📺 https://www.youtube.com/playlist?list=PLnYu0psdcllS-B9eaPcHUVmy_lGrbIw9J
Be sure to share and subscribe!
____________________________
Resources
Blackjack and Breaches: History of Ransomware on the Casino Industry: https://www.rsaconference.com/USA/agenda/session/Blackjack%20and%20Breaches%20History%20of%20Ransomware%20on%20the%20Casino%20Industry
Learn more about RSA Conference USA 2024: https://itspm.ag/rsa-cordbw
____________________________
Catch all of our event coverage: https://www.itspmagazine.com/technology-cybersecurity-society-humanity-conference-and-event-coverage
To see and hear more Redefining CyberSecurity content on ITSPmagazine, visit: https://www.itspmagazine.com/redefining-cybersecurity-podcast
To see and hear more Redefining Society stories on ITSPmagazine, visit:
https://www.itspmagazine.com/redefining-society-podcast
Are you interested in sponsoring our event coverage with an ad placement in the podcast?
Learn More 👉 https://itspm.ag/podadplc
Want to tell your Brand Story as part of our event coverage?
Learn More 👉 https://itspm.ag/evtcovbrf
Blackjack and Breaches: History of Ransomware on the Casino Industry | An RSA Conference 2024 Conversation With Tennisha Martin and Aleise McGowan | On Location Coverage with Sean Martin and Marco Ciappelli
Please note that this transcript was created using AI technology and may contain inaccuracies or deviations from the original audio file. The transcript is provided for informational purposes only and should not be relied upon as a substitute for the original recording, as errors may exist. At this time, we provide it “as it is,” and we hope it can be helpful for our audience.
_________________________________________
Sean Martin: [00:00:00] Marco. Sean. I have an ace and a queen.
Jack. Queen. King. I don't know. Take your pick. Doesn't matter. It's Jack, queen, king.
Marco Ciappelli: I don't know your poker face. Your poker face is really bad.
Sean Martin: And the way I talk about it's really bad too.
I have 21. Hit me. No way. Don't, don't hit me. I think that's what most casinos say. Don't hit me. Casinos like they keep their money. Don't hit me.
Marco Ciappelli: And be careful. What you wish for when you talk about HITME and we talk about cyber security. Exactly. What are you going to HITME with? So,
Sean Martin: I think there's probably something that we can talk about about that today.
So this is part of our Chats on the Road, not to Vegas, but to San Francisco RSA Conference. You might have gotten [00:01:00] confused there. Chats on the Road, not to Las Vegas, San Francisco for RSA Conference, where Marco and I get to, uh Talk to cool people and look at some of the sessions that are going on. And this one caught my attention for a couple of reasons.
First, the guests. Amazing. Good to have you on again, Tennisha, and good to meet you, Aleise. And also the topic, uh, blackjack and breaches is the topic. So now you can kind of guess what we're, what we're rambling on about, at least what I'm rambling on about. Um, so we're going to get into that, but first I want to give Tennisha and Aleise a bit of space to share.
What they're up to. Of course, Tennisha's been on the show before. It's good to have you back. Why don't you say a few words, Tennisha, what you're up to at the moment.
Tennisha Martin: Absolutely. Um, so I am currently, um, working on, um, a doctorate in cybersecurity with a focus on artificial intelligence. And, uh, part of the reason why I actually started looking at this topic is [00:02:00] number one.
Um, I, I love to gamble. And then number two, I'm interested in, um, some of the advances, um, in, uh, the gaming industry, for example, blockchain, artificial intelligence and adoption of the gaming and the casino industry. And some of the, um, I think kind of roadblocks that are preventing, you know, that from happening, especially like within the United States.
So, um, that's kind of like what, my interest in what I've been up to, I guess, for the past, um, You know six months to a year or so, um, but i'm super excited to be back and thank you guys for having us Uh,
Aleise McGowan: yes. Um, I'm Aleise McGowan. Look, I survived my PhD, so I feel tenacious pain. Um, by day, I'm an assistant professor at the University of Southern Mississippi, and by afternoon, evening, night, I'm a nurse.
Early mornings. I'm the CISO for Black Girls Hack. [00:03:00] And so, um, Tennisha pitched the idea and like, you know, I think in my write up, I said I was a baby gambler. But the more I looked into it, it was, um, really, you know, really intriguing. The whole digital ecosystem, um, that's kind of intertwined into the casino industry.
So, um, that's why I'm here.
Marco Ciappelli: Well, it's definitely a catchy You know, Sean said to me, Hey, you need to be part of this because it's gonna be a good topic. And I read the title. I'm like, Okay, I definitely want to know you got my attention. So apart from the passion for playing cards or gambling, I mean, what what is so relevant right now that made you pick this topic?
Tennisha, let's start with you.
Tennisha Martin: Um, absolutely. So for me, um, I think it was in August of last year, maybe August, September of last year, there were two very high profile breaches. Um, one of those was with the MGM [00:04:00] and the other one was with, um, I believe it was Caesars. Um, and they were both ransomware attacks and they both, um, had very, very different outcomes.
Um, Based on what I assume is different leadership and different approaches to different approaches to risk management. And when I saw those, you know, I started investigating because I was like, this is is super interesting how you can have, you know, what's basically the same. you know, threats, um, but then completely different, um, outcomes.
So, you know, we started looking into, to, you know, what the breaches were in the, the industry. And those were the, the first two that I had seen. But when we started investigating there were nowhere near the first or the second, um, probably not the 10th. Um, breaches that have happened, um, in this, this industry.
But, um, I think that what stood out to me, um, I actually had visited, um, an MGM property during, uh, the period [00:05:00] where this was going on, because I think it took several months for it to kind of resolve and for them to get back up and running. Um, and it was very interesting the way that things were impacted.
I think there was probably a bigger impact there than it was like at the beginning of of covid, which was crazy. But you know, because so many things were interconnected, um, I think that it basically to some places brought down, brought them down to a halt, which I thought was super interested because I was like, you know, how are all of these things Connected online and should they be?
Um, so I, I thought that was super interesting. And, and Aleise is always like, uh, down for a good, uh, investigation. Um, especially when it's, uh, you know, in the middle of the night when she's not sleeping. So
Aleise McGowan: you're just like, we'll sleep.
Sean Martin: Well, tell me a little bit about what technology is used. Cause I don't know how many. It's been 10 years now that I was back, back, uh, in behind [00:06:00] the scenes of, of a casino looking at the security operations center and kind of the stuff they worry about. And it was traditional IT stuff that, uh, they were primarily managing and at least sharing with us.
A group of us getting the tour. Um, but one of the things in the description you have is ICT. And you mentioned blockchain and, and of course, AI, we have to mention that, of course, these organizations are using the latest technologies available to them to provide the best experience, right? And to provide the best returns to the business.
Um, so who, who can paint a picture of kind of what's involved there is, I don't know, are blockchains embedded in the cards nowadays and do the, uh, do the. The roulette balls have, uh, sensors in them, and I don't know, they probably have all this time, but I don't know, what, what, what are we seeing in, in terms of.[00:07:00]
Yeah, exposure of technology.
Aleise McGowan: I usually play roulette and I go with the balls have something in them. But, uh, one of the biggest things that I can think about them using this like facial recognition and, um, AI. So even using that to identify, um, players that may have been banned from the properties and things like that.
And, um, Tennisha, you may have some more that you can speak to.
Tennisha Martin: Yeah, I was, uh, one of the things that I, I found interesting, like, I don't know if you guys, um, watch, like, for example, poker, um, I, I watch a lot of online poker and, um, what's interesting is that they have, like, you know, for example, RFID, uh, chips in, uh, the playing cards.
Um, and like all of the systems that they basically use, um, if you imagine like all the different games between the ones that play cards, the ones that play dice, you know, there are different, um, ways that these things [00:08:00] are connected. Um, and I think that the thing that I found interesting is that when you look in at the use of, um, you know, uh, When we're talking about AI, for example, when you look at the use of AI for a casino, like, it makes sense to me that they would be like, you know, Hey, Tennisha likes playing poker.
So, you know, we're going to send her some deals for poker or, you know, she likes staying and, you know, nice hotel room. So we're going to send her some deals for that. Right. But, you know, what was interesting is the way that a lot of the games themselves shut down during the breach, right? And the ability to see like which games were, um, up and running, you would think, all right, well, maybe it's just the slot machines, but it wasn't just the slot machines.
There were also table games and other things that are, that were in place as well, um, which to me was like, you know, Hey, there's a lot more things that are interconnected here than you would. You would think just from, you know, face value.
Marco Ciappelli: So that makes me think [00:09:00] one thing. I'm actually reading a book right now called the bottle for your brain, which is all about, um, the use of IOT devices and the study, the frequency of your brain, which pretty much still we're going to be reading your mind.
So when you start talking about the casino using, we already knew about all the camera to check out that things are okay. And, but the things that you can do with AI. Kind of, I don't know, maybe I'm already reading in the future with this, but, uh, it's, it's pretty scary. And, and again, how, how do you treat it in a way that you can just be safe or create silos or compartment where you say you were shocked that it would have effect everything or, or let's say a lot of things.
So how is that? It's, does it need to be all interconnected like this?
Tennisha Martin: I, I don't know, um, if it necessarily needs to be when you look [00:10:00] at what, you know, folks think of the future of, uh, gaming is going to look like, where you can basically do it, you know, beyond borders, um, across, you know, nations and states and, and whatever the case may be, um, It's, it's super interesting.
Um, there are a lot of, I think, legislative and regulatory hurdles right now that will prevent that from happening within the United States. But at some point, um, you know, there needs to be a way for us to be able to. And by us, I mean, like the industry of being able to monitor to know what's going on.
One of the, um, I think, uh, ways that at least MGM, if you've ever, if you've read their privacy policy, which I have, um, they say that they use it to detect things like cheating, for example. Um, they also, you know, Use things like, um, you know, they, they mentioned your biological material. I don't know what that means to this day, but that, that found that interesting.
Um, but then also things like [00:11:00] license plate readers and, you know, facial recognition, that's, you know, I think that's standard par for the course type of things. Right. But when you're talking about, you know, the, the way with the future, you know, like, let's say if you're wearing, um, uh, a VR headset, right. Um, And you go into the casino and they're like, Hey, Tennisha, the game you like is over this way.
You know, the food that you like is, is this way, you know, folks that you typically play with are in the casino. They're at this table and this, you know, I'm saying, um, this machine, this machine hasn't hit in, you know, X amount of time. Right. Um, so if we're having all of these things connected from a security professional, uh, perspective, uh, what's interesting is, Hey, yes, we have as consumers a lot of, a lot more information, um, available to us.
Like, you know, Hey, if this machine hasn't hit in a while, maybe it's time for it to hit. Right. But at the same time, I think that also improves our outcomes, especially if you think about, you know, in person games, like, um, [00:12:00] Poker and, um, you know, any, any of the card games, whether you're playing human versus another human.
So I think that, um, you know, something that's interesting to me is like looking at the security. What does that actually look like for the gaming industry? Um, especially as we tend to move towards things full speed, such as artificial intelligence and blockchain and, um, you know, all of the virtual reality, augmented reality.
Um, whatever the possibilities are moving forward, you know, um, we need to do that in a way that, um, takes a look at the security of the system in a way that, you know, we can still have fun, but, you know, we're protected as well.
Sean Martin: Yeah, at least I like your perspective on this because I'm seeing three things.
So one, clearly the human driven fraud, they're trying to get a handle on that and they're using technology to, to do that. Um, If they do that too well, that may [00:13:00] impact legitimate players, right, in their experience and might make it less fun at the, at the casino. Um, and then there's just the general business side of it.
We have to make enough money to provide an experience. So we're using technology to do that, but now we're also exposing ourselves and adding more risk for technical or digital type of fraud. So it's, it's this juggling, if you will, and every company has it, not just casinos, but this juggling act. So I'm wondering, how do you perceive organizations like the casinos kind of tweaking those knobs and, and flipping those levers and sliding the slides to find that right mix of risk reward experience.
Revenue, all that good stuff. Shareholder value.
Aleise McGowan: Well, I guess just like with every other industry, you know, it's all about, you know, balance, um, balancing, you know, [00:14:00] figuring out what your risk appetite is and, you know, providing, you know, figuring out how to move forward, um, because like, Even with the protections that are in place, you've got like tech, uh, technologies like quantum computing and things like that, that, you know, coming down the pipe that are going to revolutionize things like, you know, data security and make current, like, things that we're doing as far as, uh, encryption methods obsolete.
So. It's just always going to be like, no matter what, having to try to improve, you know, what it is that we're doing while, you know, having a competing interest of making sure that the players are happy and able to do, you know, what they need to do, because that's where you get your money from as, you know, the casino.
So it's just all about trying to figure out how to balance. And keep everybody happy and safe.
Tennisha Martin: . And I think I would probably also say that it, it, at the end of the day, I think data is [00:15:00] king, right? When it comes down to it. Um, they're collecting all of this information, um, not necessarily to make the environment more safe or more enjoyable.
Like when it comes down to it, the information they're collecting gives us, gives them more of a complete profile of the people who are actually using their, their facilities, the people who are actually gambling, which, um. For them, you know, of course, probably means higher, you know, probability if you continuing to do that, especially if they can figure out, you know, the, the human perspective of which is what makes each one of these people take what do they do in certain scenarios, things of that nature.
And I think that the, the data, um, you know, is probably going to be more valuable to them than the actual, you know, gambling themselves, just because it, I think, you know, Like many, many organizations, um, you know, it doesn't necessarily matter. Like, for example, some of the social media sites, you know, doesn't necessarily matter that you have access to all of your friends and family, right?
What matters is that they have all of this data that they could now use, you know, [00:16:00] to determine what is it that you're purchasing? What do you do? You know, things of that nature, which I think is far more valuable, um, to the industry than anything else.
Sean Martin: They're blowing up a casino to put in a new ball field or sports betting over, uh, over slot machines, it seems.
Marco Ciappelli: Or maybe there's going to be both by the time you go to work.
Tennisha Martin: Right. They could just put it in like one of those behind the chair, like little screens where you can just basically, uh, Gamble there while you're sitting there and watching the game. Or while you're waiting.
Marco Ciappelli: I mean, I hope you're not going to gamble while you're watching the game.
But, you know, there are level and level of addiction.
Tennisha Martin: But, you know, they have, um, uh, you guys probably know, uh, they have the, the slot machines in the, Airport at the in Las Vegas, right? So like they have a long set precedent of, you know, why don't you go ahead and play while you're waiting? [00:17:00] You know, so I don't think it's a they're above that
Marco Ciappelli: for sure.
So, before we dive into maybe give a little of the teaser for what your talk is really focusing on. So we can achieve our objective to have people come and actually. Feel the room for you guys and and and look and watch a listen to the conversation One observation that I have is I cannot think a better place for adversary to Experiment more than on the gambling table all this new technology Like I said, you know the camera were there so that you know back in the 70s the 60s the 80s took Be sure that you're not cheating just by looking at the physical aspect of things.
But now again, if you have something that, you know, smart glasses or smartphone or a way to get the, I don't know, the, [00:18:00] the, the excitement in the reading the face, literally the poker face we were joking about was shown at the beginning. I mean, it's an entire environment of, you know, Almost like a lab for for attack and therefore for defense.
So I don't know if you want to add a comment to this. But for me, that could be a movie right here. Very high tech sci fi movie. Just just about that.
Tennisha Martin: And I think that they're shooting for that, you know, very high profile, you know, movie aesthetic, you know, Um, and I think that when we tend to design systems, we tend to go with the outcome in mind and build security in as an afterthought, right?
Um, so, you know, as a, as a hacker for me, like that seems like super, um, interesting. Um, I'm not trying to get banned forever or anything like that, but you know, um, I would love to be involved in like, you know, uh, either physical or pen test of, you know, the casinos, because, you know, just from a, [00:19:00] um, As a player, you know, I think it's super interesting to see the technologies that they have, how they're interconnected, um, you know, how the traffic flows, right?
Um, because, you know, for the longest time, you know, unless you're at, like, a slot machine, if you're, like, at a table, for example, they don't want you to have a phone, um, there with you, and part of that, um, is, I think, In my mind, I've always thought it was because they don't want you basically tracking the outcomes of the hands to try to, you know, generate, you know, probabilities or whatever.
In my mind, that's what I figured the reason for the ban on phones. But, you know, I've seen over the last couple of years that some places are becoming more. Lacks in terms of, you know, that restriction. Um, so I, I, I would really love to see, you know, how that works because, um, it's, it, it, it, it would literally be like a huge playground for me.
Like if they let me loose in a casino and we're like, go forth and hack and do [00:20:00] your worst. And like, I get that, you know, get out of jail free card and like, that would literally be what, you know, a playground would look like for, uh, for me.
Aleise McGowan: Look, I've got all my lock pick tools ready. You know, they can call me anytime.
I volunteer.
Tennisha Martin: Right. I don't even necessarily know that they would have to pay me because that just sounds like it would be a lot of fun.
Marco Ciappelli: Just don't put me in jail.
Tennisha Martin: Right.
Aleise McGowan: Need how to sign documents.
Sean Martin: Well, they don't mind your phone being in there now because you connect to their cell tower, not the, uh, not the carriers.
Tennisha Martin: True. And they can see all of your traffic, which is the other thing that's, that's interesting. Um, because, you know, I think most people, non security professionals, you know, think nothing of, you know, Hey, My phone doesn't work when I get in here, like, let me connect to their Wi Fi and then when you connect to their Wi Fi, they basically see all the traffic for [00:21:00] what it is that you are doing.
You know, they get access to that. And if you look at their, uh, again, their privacy policy, the terms and conditions, like the things that they're allowed, like they've covered pretty much all of the things. And I'm looking at here and I'm like, Okay. Like, you know, they have a breach, uh, a breach I would expect like, you know, Hey, maybe my phone and you know, my credit card numbers are released, but like the types of information that they're Uh tracking today and not to pick on them.
I just happen to be researching them for a project Um, but the type of information they're they're tracking You know, points towards a future where, which is very integrated, um, which includes, you know, things like, um, artificial intelligence and, and virtual reality and, you know, blockchain. And I think it's going to be super interesting once they start getting over, like I said, some of those regulatory and legislative, um, hurdles to be able to, you know, make it so that you can play anywhere, you know, at any time,
Sean Martin: so they could see me searching for [00:22:00] how to count cards on my toes.
All right. Well, let's, let's do this. Um, I mean, we could talk about this for a long time, I'm sure. But, uh, I want people to come see you at, uh, RSA conference Wednesday, May 8th, 225. Uh, your session is blackjack and breaches history of ransomware on the casino industry. Uh, you gave us a snippet, Tennisha, of why this came to be, but who, who do you, Who do you want to join you there?
Who are you speaking to as part of this session? What do you hope they get out of this?
Tennisha Martin: Um, I'd say it's probably split. I'd say, um, it's interesting for your, you know, avid, uh, uh, gambler, but I think as security professionals, it's also interesting as well because, um, I, I think that when it comes down to it, um, You know, when you're just looking at, like I said, for us, the, um, the, [00:23:00] the difference between like the two situations which happened basically, I think, within mere weeks of each other and the severity of the outcomes in terms of the financial and the length of time that it took to recover from it, um, I think are both super interesting.
There's some lessons learned, um, there, um, and I think also when we look at the history of what, um, you know, it looks like, um, across all of the different, um, Um, gaming industry, the different casinos and the different breaches that they've had over the past. And I think we, if I'm not mistaken, I think maybe we identified like between 10 and 15 different breaches, um, that have, have happened.
Um, my hope is that it would help, it would help to improve security within the industry. Um, and then, you know, cybersecurity practitioners can look at some of the parallels that exist. Um, in terms of, you know, your response to issues, you know, having a, uh, reactive approach versus a proactive approach to security, which I think a lot of the, the, the casinos do, you know, they're, [00:24:00] um, you know, we, we've seen, seen some trends, which, you know, lets you know certain things about, um, the industry as a whole.
And, you know, we're going to say, you know, Hey, this is what we're seeing. Um, this is some recommendations that we can provide that. On how to make it better. And, you know, for people who are maybe not necessarily in the gaming industry, this is what you could take away just as far as, um, being able to look at the, the breaches that happen and, you know, assess what's the best way to move forward in terms of lessons learned.
Marco Ciappelli: At least anything to add to that?
Aleise McGowan: Nope, she covered it. That's the biggest thing I was gonna say was that, you know, it's It's applicable to multiple industries or whatever, and the actionable items that, you know, we'll give during the presentation can definitely be applied.
Marco Ciappelli: Yeah, I was definitely thinking when you were going over all the things like the parallel with airport security or other venue of entertainment, like, Big [00:25:00] parks and all of that, where you need to show that everything is sparkly and safe.
And then in the back, the backstage is where a lot of things are actually happen so that you can enjoy your gaming, your entertainment and everything you do in those, uh, in those In those locations, so I think it's exciting. Uh, definitely going to try to stop by when we are in uh in uh, Now I was going to say las vegas I'm thinking las vegas right now San francisco, so moscone And uh, we're looking forward to see you guys there and uh, sean
Sean Martin: Well, we can get our bring
Marco Ciappelli: your card, please just
Sean Martin: leave the cards back.
We can do our pretend, uh, casino at the, the arcade museum. I'm sure we'll find something.
Marco Ciappelli: I'll play pinball.
Sean Martin: You're risking a quarter.
Nice one. Well, it's a pleasure to have you both on Tennisha and Aleise, and, uh, thanks everybody for [00:26:00] listening to and watching this episode or chats on the road, RSA conference. Uh, we have loads more coming up and of course, lots of fun stuff on location there, Marco and I. And so stay tuned. Itspmagazine. com forward slash RSAC.
Everything is there. And, uh, see you all very soon. It's coming up very quick. So thanks everybody.
Aleise McGowan: Thank you. Thanks.