Greg Crabb's guest appearances

Greg Crabb

pm73media

To The Point - Cybersecurity

Tech Transforms, sponsored by Dynatrace

Richard Ford

Richard Stiennon

Eric Trexler

Mike Gruss

Dan Velez

Nico Fischbach

Meerah Rajavel

Mark Kelton

Sean Berg

Michael Theis

Ashley Rose

Joyce Hunter

Audra Simons

Karen Evans

Dick Schaeffer

OwlTail

What does it take to secure 160 million Americans privacy? Greg Crabb, former Chief Information Security Officer at US Postal Service joins Tech Transforms to talk about his experiences from his time as Projects Coordinator for International Fraud to his role in the 2020 US Presidential Election. Episode Table of Contents[00:42] Greg Crabb in the House, Founder of 10-8 Cyber[10:33] Good Guys Get Together With Greg Crabb[20:05] They Want To Do the Right Thing[29:32] Greg Crabb Had a Long, Deep, and Intense ServiceEpisode Links and ResourcesGreg CrabbUSPSFBISecret ServiceEuropolInterpolAQAPCISAEbayChief of Police ConferenceHurricane ElectricLexisNexisSergey PavlovichJames WoolseyDamitri GlubophOrange RevolutionRussian FSBSolar WindsChris KrebbsMatt HeartmanAmazonCADJen LimbDelivering HappinessAdam GrantGreg Crabb in the House, Founder of 10-8 CyberCarolyn: Today, our guest is a rockstar. His background just blew me away. Greg Crabb, founder of 10-8 Cyber and strategic advisor to several organizations, but that doesn't even scratch the tip of the iceberg of who our guest is today. Greg: Thank you, Carolyn. I enjoy the opportunity to chat.Carolyn: You recently retired after 20 years with the US Postal Service where you wore many hats. From being a project coordinator for international fraud, assistant director of economic crimes, you ended your career as the chief information security officer and vice president of USPS. That's the very tip of the iceberg of your career. I want to kick it over to you and have you tell us your story.Greg: The mission of my life has been to protect others and drive benefits for society. I was grateful enough to have the opportunity to retire last year after 30 years of federal service. When I joined the postal service in the mid-90s, I spent the first several years of my career being an auditor. I was responsible for the old electronic data processing controls portion of the financial audit. There I learned an amazing amount of information about how computers work, mainframes, networking, and all that sort of thing.In 2000, I transitioned to spend seven years investigating the origins of Eastern European organized cyber crime. That was an amazing experience. I got the opportunity to really attack an organized crime group. It was based out of Ukraine and had splinters all over the world. I worked with Europol and Interpol, the Secret Service, the FBI, and many other organizations in between.Bigger and Better Things for Greg CrabbGreg: In about 2005, I moved to Washington to take on bigger and better things. Then in 2010, the international supply chain was attacked with some parcel bombs from AQAP. AQAP put PETN, it's the liquid explosive that we all know as why we can't carry water bottles onto airplanes. It completely changed the security model of how international supply chains work for moving parcels. I spent a number of years working with an international community of 190 countries to develop new standards. Worked with civil aviation authorities to properly secure the supply chain from a commercial aviation perspective for parcel security.In 2014, I got tapped to respond to a pretty significant breach at the US Postal Service. In that moment, I transitioned from being the law enforcement officer who was the hunter to the chief information security officer who was the hunted and responsible for an amazing network. I was grateful to provide security for 160 million delivery points, private communications, and parcels for all of America for six years. As we talked before the show, I was really grateful to have the opportunity to help protect the 2020 election. It was just an amazing collaboration with the folks at CISA and many other organizations across the country in order to pull that off.Carolyn: Can you talk about what you did to prepare for that? Talk about pressure. You'd been preparing for 20 years.Greg: I had been preparing. I wouldn’t have been as successful in protecting the technology assets the postal service relied on to move 70 million ballots if I had not had those experiences.Greg Crabb Is Dealing With Eastern European Organized Cyber CrimeGreg: I’ve been dealing with Eastern European organized cyber crime and understanding what it takes in order to protect a network from everything. From disinformation campaigns to all of the technical details that are necessary to secure a network. Where do you want to start? From an application security perspective for the organization, from an OT security perspective, all of the technology that was necessary in order to be able to move the ballots were in the consideration.Carolyn: It's interesting because when I think of the US Postal Service. I'm not going to lie, it's a little boring.Mark: You think of physical security, OT.Carolyn: It's a letter and you're moving a physical thing. But like all the cyber that was involved in it, is it the processes that you were securing, the databases?Greg: It was everything. From the delivery scanner, the letter carrier that is driving by your house every day, securing that scanner to know that your ballot was in the mail, to all of the operational technology that exists. Now, imagine big warehouses larger than big football stadiums, where mail processing is made. Huge pieces of equipment were down to your address. All the packages come in and we sort them down to each delivery point.In total, I was responsible for the protection of 1.2 million technology assets. Petabytes and petabytes of data relative to package tracking and those kinds of things. Only 630,000 employees are necessary in order to be able to deliver that mission and interact with all those technology points.Mark: That's just at the federal level. I can only imagine the collaboration across states and everything must have been massive.A Massive Enterprise Focused on CollaborationGreg: I did not have the responsibility of dealing with each of the states. The postal service, in order to be able to secure the election, is a massive enterprise focused on all of the collaboration, developing standards on how mail pieces are supposed to be formed. There's a lot to make sure that everything gets delivered on time. If the ballots aren't there, they don't get counted. That was something that not only my role as chief information security officer but my security partner, who was the chief postal inspector, was out all over the country in facilities. Basically, just making sure that each of the communities were getting their ballots in a timely manner from all of our delivery operations.Mark: I know you've done a lot of work with cyber crime and you've worked with adversaries, I guess, as well. I’m curious to know how you've seen this whole landscape transform over the years.Greg: I started working in organized cyber crime investigations in 2000. I was asked to help the FBI with a case coming out, or some significant amount of fraud against eBay, coming out of Ukraine. It took me several years to wrap my arms around it. I was ultimately able to arrest a number of folks from Ukraine and other Eastern European countries that were involved in this. But really, I had the opportunity to sit down and talk with a lot of investigators from Eastern European countries.We had a conference in Warsaw a number of years ago. These were early days. They talked about how they started to see car smuggling gangs that were based in Eastern Europe starting to have technology equipment in the vehicles where they were getting arrested.Good Guys Get Together With Greg CrabbGreg: Eastern European car smuggling gangs would basically get caught in Poland with stolen cars. They popped the trunks and there would be a bunch of technology equipment, credit card skimmers, and other technology that's necessary in order to be able to commit those types of crimes.There was a conference. Good guys get together and do the International Association of Chiefs of Police Conference and those types of things. But in 2001, there was a conference in Odessa where a bunch of criminals got together. They referred to it as, "The First International Carders' Conference."  The members of that meeting became my targets.Carolyn: How did you find out about it?Greg: I had the good fortune of one of the criminals that I was investigating had hacked into a server in San Jose, California. At the time, I was based in Northern California. The data center was on my drive into the office. He was sending all of his communications through that server. I intercepted 40,000 of his email messages.Carolyn: How did you find that?Greg: Long story. It was just tracing IP addresses and getting back to the source of where all of his communications were coming from. They all sourced to this particular server. The company was called Hurricane Electric in Fremont, California. I worked with the US Attorney's Office and the victim to get approval to go in and review my suspect's messages on a daily basis. So I had this unbelievable wiretap on this criminal and all of his email messages. Not only facilitating his crime but with all of his cohorts in crime who were doing these activities.Greg Crabb With Eastern Law EnforcementGreg: One thing led to another and I learned about this International Carders' Conference based in Odessa and basically focused on this group. That led me to the opportunity to really work with Eastern European law enforcement officers. I had occasion to work with the Russian FSB and the Ukrainian MVD, and even law enforcement officers in Belarus. I proudly display the hat there from my colleague in Minsk, Belarus. Unfortunately, he was actually arrested for working with me. We went to the country in '05. The suspect had a website. The banner on the website said that their objective was to take the United States back to the time of 1929.Fortunately, the Belarusian law enforcement officers were willing to work with us until the government got involved after we left. From the computer equipment in that case in Minsk, we recovered over 55,000 full infos. These are victims in the United States where they've got their mother's maiden name, their social security number, all of the answers to the questions that are necessary for those knowledge-based questions. He had hacked into LexisNexis, and his hack was actually the subject of a congressional debate. The subject's name was Sergey Pavlovich.It was interesting to be able to work with all of those folks and deal with not only, on a personal relationship, the police officers but then the governments from a not-so-friendly perspective. I was never invited back to Belarus again, I was stupid enough to try to go back to Belarus. But I think the US embassy was smart enough not to let me in. Those experiences were foundational for me to understand what's necessary in order to be able to counter what we see from a law enforcement perspective.What James Woolsey Taught Greg CrabbGreg: Like James Woolsey taught me, there's little difference between a Russian businessman, a Russian politician, and a Russian organized crime figure. They're one and the same, like the people that organized that International Carders' Conference in Odessa, I look at where we are in the political world today with Ukraine and Russia, and the United States. And I started going to Kyiv in November of 2003, trying to get the guy's name was Dmitry Golubov. Dmitry Golubov arrested.He was one of the key organizers of this conference, responsible for massive amounts of fraud against financial institutions and online companies. It was very difficult. He was protected by the police in Odessa. They were on the payroll. It really came down to the Orange Revolution. In early 2005, late 2004 to 2005, there was a highly contested election in Ukraine. The first election was called by the international community to be fraud, and a second election was made. It was very close from a decision perspective.You might remember that the candidate that won was actually poisoned by the Russian FSB in Switzerland while he was traveling there. He won. When he took power, the Ukrainian MVD asked for me to come over and actually present my case. I got an opportunity to go over and brief my case to the Minister of Interior to Ukraine. Two weeks later, they arrested Dmitry Golubov.Mark: In London, the UK?Greg: No, it was in Ukraine. It was in Odessa. I do stop for a second. The Orange Revolution was extremely important in Ukraine. It was really that turning point in the history of Ukraine where they went Western leaning, they were looking to democracy.Why the US Embassy Was Giddy When Ukrainians Invited Greg CrabbGreg: They were looking to, how can they become more westernized? At the time, when the Ukrainians asked me to come over, the US embassy was giddy. We actually have a government that's interested in working with the US.I remember going with the special agent that was the FBI leg-att there in Kyiv, Ukraine. His name was John Boles. We drove over to the briefing with the Minister of Interior to Ukraine. He was so excited that we were going to present this case. Then for them to actually, the Ukrainians, to go and arrest Golubov was unbelievable. I was invited back over after the arrest to again do something that had never been done before. Boles was really excited.I was the first US law enforcement officer to ever be asked to interview a Ukrainian on Ukrainian soil. Albeit, we went to jail. He told us to buzz off, but so be it. It was a great turning point in our relations. Now when you see what's going on in the international community, I can only pray for the folks in Ukraine to be able to maintain their democracy and keep the coalition here, or the West to be able to help them.Mark: Given all of the things that are top in the news right now, this is really interesting. Ukraine is in the news every day.Greg: Unfortunately, we weren't able to present our case in Ukrainian court against Golubov. I won't say it was corruption, but after some time the case was dismissed. Several years later, Dmitry Golubov actually became a member of Ukrainian parliament. And you're just, "That's the way the world works, people."Carolyn: The James Woolsey quote holds true.They Want To Do the Right ThingGreg: Exactly. You know it. I saw it firsthand. I've seen it again and again in my interactions with folks that are over in Eastern Europe. On an individual level, I was able to form some amazing personal relationships with law enforcement officers. They want to do the right thing, but governments, politics, and corruption are difficult things to overcome. I think that's where we really need to continue to focus and understand. Thank you for letting me take a little walk down history lane. I think all of those lessons are important today to understand what we face from an organizational national security perspective for the country.Mark: When I think of cyber crime, cybersecurity, I think of technology, bits, and bytes. I think of leveraging cutting-edge kinds of technologies and the way people do what they do. I'm really curious to know because you've talked about a couple of things which makes me think really just grassroots intel, spy versus spy. How much of this world is HUMINT or human intel as opposed to the technology piece?Greg: Technology's just an instrument to the motives of the actors. I think that one of the things that, as we look forward and we look at the attacks like SolarWinds and you name the Eastern European-based attacks that we've seen, they're all motivated by the objectives of either greed or control. Or I often recall, and this is a supply chain story. It's going to start a little weird. One of my colleagues in Eastern Europe always used to say, "Mr. Greg Crabb, trust no one. Not your wife, not your girlfriend and not your lover."Supply Chain Related StoryGreg: How could that possibly be a supply chain-related quote? I knew all three of his, by the way. His wife, wonderful mother of his children, awesome. Girlfriend was just beautiful. His lover, she was smoking hot. But what he would always talk about is that from a mass surveillance society, you need to understand your relations. You need to understand your most trusted intimate relations in order to keep them controlled.I think when we see the types of attacks with SolarWinds and the other supply chain attacks that we're seeing in software development lifecycle, we need to understand that mass surveillance is a technique that is used in those cultures. We need to understand and account for it in our information security practices. There's bits of the story that I've left out there, but you can get the main point.Carolyn: I feel like we're...

Unbelievable Lessons with Greg Crabb Former Chief Information Security Officer of the US Postal Service

Messenger of Sympathy and Love Servant of Parted Friends Consoler of the Lonely Bond of the Scattered Family Enlarger of the Common Life Carrier of News and Knowledge Instrument of Trade and Industry Promoter of Mutual Acquaintance Of Peace and of Goodwill Among Men and Nations  --  Inscription found on the the Smithsonian Institution's National Postal Museum   Победить и вернуться  -- Motto of the Federal Security Service of the Russian Federation   Imagine being in charge of securing an enterprise comprised of over 450,000 connected devices spread over 31,000 locations worldwide. The United States Postal Service is a pretty serious organization when it comes to the amount of data that flows through its network. It would take a pretty cool individual to stand up to the daily pressure of an organization that big and that diverse.  Imagine cold calling the Federal Security Service of the Russian Federation and asking to speak with their head of Information Security in order to share the information you have uncovered regarding tens of thousands of incidents of mail and cyberfraud committed by Russian criminals. They took the call… It would take a pretty cool individual would have to be pretty cool to accept the FSB’s invitation to sit face to face in Odessa at FSB headquarters.  Now imagine that individual is the same person.   The good news? You don’t have to imagine.   On today’s No Name Security Podcast, Matt Stephenson welcomes Greg Crabb, founder of TenEight Cyber where he consults with CISOs and organizations needing CISO levels of expertise. With 25 years in law enforcement specializing in mail and cyber fraud as well as 6 years as CISO of the United States Postal Service, Greg has learned some things about security. Want to hear about the time he worked with the Russian FSB on a particularly large fraud case? Stick around…   About Greg Crabb      Greg Crabb is the founder of 10-8, LLC. With more than 25 years of law enforcement and security experience, he specializes in providing consultation to cybersecurity leaders and organizations to help protect their digital assets against evolving cyberthreats. Greg focuses specifically on delivering advisory services to C-suite executives, their boards, and other leaders responsible for securing their organization’s operations, products, and services.   For six years as the U.S. Postal Service’s chief information security officer, Greg secured the agency’s technology and information assets against nation-state threat actors. These efforts helped protect military mail globally and the unprecedented 2020 U.S. elections.   About Matt Stephenson      Matt Stephenson (@packmatt73) leads the Social Media team at Forescout, which puts me in front of people all over the world. Prior to joining Forescout, I hosted podcasts, videos and live events all over the world which put me with experts on every corner of the cybersecurity landscape. The new No Name Security Podcast will continue and expand upon that tradition as we seak out the leading minds in the security industry as well as those may break things every now again. And… just for fun, there will be some wildcard guests as well.   In 10 years in the ecosystem of Data Protection and Cybersecurity I have toured the world extolling the virtues of Artificial Intelligence and Machine Learning and how, when applied to information security, these technologies can wrong-foot the bad guys. Prior to the COVID shutdown, I was on the road over 100 days a year doing live malware demonstrations for audiences from San Diego to DC to London to Abu Dhabi to Singapore to Sydney. One of the funniest things I've ever been a part of was blowing up a live instance of NotPetya 6 hours after the news broke... in Washington DC... directly across the street from FBI HQ... as soon as we activated it a parade of police cars with sirens blaring roared past the building we were in. I'm pretty sure they weren't there for us, but you never know...   Whether at in person events, live virtual events or podcasting, I get to interview interesting people doing interesting things all over the world of cybersecurity and the extended world of hacking. Sometimes, that means hacking elections or the coffee supply chain... other times that means social manipulation or the sovereign wealth fund of a national economy.   Wherever I go, my job is all about talking with the people who build, manage or wreck the systems that we have put in place to make the world go round...   If you tuned in to any of my previous podcasts, there’s great news! The No Name Security Podcast is here! I will be bringing the same kind of energy and array of guests you know and love. Best part? We’re still at the same spot. You can find it at  Spotify,  Apple,  Amazon Music &amp;  Audible as well as,  GooglePlay, Gaana,  Himalaya,  I Heart Radio and wherever you get your podcasts!   Make sure you Subscribe, Rate and Review!

Messenger of Sympathy and Love Servant of Parted Friends Consoler of the Lonely Bond of the Scattered Family Enlarger of the Common Life Carrier of News and Knowledge Instrument of Trade and Industry Promoter of Mutual Acquaintance Of Peace and of Goodwill Among Men and Nations  -- <a href="https://about.usps.com/who-we-are/postal-history/mission-motto.pdf" rel="nofollow" target="_blank"> Inscription</a> found on the the Smithsonian Institution's National Postal Museum Победить и вернуться  -- Motto of the Federal Security Service of the Russian Federation Imagine being in charge of securing an enterprise comprised of over 450,000 connected devices spread over 31,000 locations worldwide. The United States Postal Service is a pretty serious organization when it comes to the amount of data that flows through its network. It would take a pretty cool individual to stand up to the daily pressure of an organization that big and that diverse. Imagine cold calling the Federal Security Service of the Russian Federation and asking to speak with their head of Information Security in order to share the information you have uncovered regarding tens of thousands of incidents of mail and cyberfraud committed by Russian criminals. They took the call… It would take a pretty cool individual would have to be pretty cool to accept the FSB’s invitation to sit face to face in Odessa at FSB headquarters. Now imagine that individual is the same person. The good news? You don’t have to imagine. On today’s No Name Security Podcast, Matt Stephenson welcomes Greg Crabb, founder of TenEight Cyber where he consults with CISOs and organizations needing CISO levels of expertise. With 25 years in law enforcement specializing in mail and cyber fraud as well as 6 years as CISO of the United States Postal Service, Greg has learned some things about security. Want to hear about the time he worked with the Russian FSB on a particularly large fraud case? Stick around… About Greg Crabb <a href="https://www.linkedin.com/in/gregorycrabb/" rel="nofollow" target="_blank">Greg Crabb</a> is the founder of <a href="https://teneightcyber.com/" rel="nofollow" target="_blank">10-8, LLC</a>. With more than 25 years of law enforcement and security experience, he specializes in providing consultation to cybersecurity leaders and organizations to help protect their digital assets against evolving cyberthreats. Greg focuses specifically on delivering advisory services to C-suite executives, their boards, and other leaders responsible for securing their organization’s operations, products, and services. For six years as the U.S. Postal Service’s chief information security officer, Greg secured the agency’s technology and information assets against nation-state threat actors. These efforts helped protect military mail globally and the unprecedented 2020 U.S. elections. About Matt Stephenson <a href="http://linkedin.com/in/packmatt73" rel="nofollow" target="_blank">Matt Stephenson</a> (<a href="https://twitter.com/packmatt73" rel="nofollow" target="_blank">@packmatt73</a>) leads the Social Media team at Forescout, which puts me in front of people all over the world. Prior to joining Forescout, I hosted podcasts, videos and live events all over the world which put me with experts on every corner of the cybersecurity landscape. The new No Name Security Podcast will continue and expand upon that tradition as we seak out the leading minds in the security industry as well as those may break things every now again. And… just for fun, there will be some wildcard guests as well. In 10 years in the ecosystem of Data Protection and Cybersecurity I have toured the world extolling the virtues of Artificial Intelligence and Machine Learning and how, when applied to information security, these technologies can wrong-foot the bad guys. Prior to the COVID shutdown, I was on the road over 100 days a year doing live malware demonstrations for audiences from San Diego to DC to London to Abu Dhabi to Singapore to Sydney. One of the funniest things I've ever been a part of was blowing up a live instance of NotPetya 6 hours after the news broke... in Washington DC... directly across the street from FBI HQ... as soon as we activated it a parade of police cars with sirens blaring roared past the building we were in. I'm pretty sure they weren't there for us, but you never know... Whether at in person events, live virtual events or podcasting, I get to interview interesting people doing interesting things all over the world of cybersecurity and the extended world of hacking. Sometimes, that means hacking elections or the coffee supply chain... other times that means social manipulation or the sovereign wealth fund of a national economy. Wherever I go, my job is all about talking with the people who build, manage or wreck the systems that we have put in place to make the world go round... If you tuned in to any of my previous podcasts, there’s great news! The No Name Security Podcast is here! I will be bringing the same kind of energy and array of guests you know and love. Best part? We’re still at the same spot. You can find it at <a href="https://open.spotify.com/show/7qUp6uGXoshmBKHYJlXBtb?si=YYeiQ5lhQCeo5DvzAsSh-Q" rel="nofollow" target="_blank"> Spotify</a>, <a href="https://itunes.apple.com/us/podcast/insecurity/id1260714697?mt=2" rel="nofollow" target="_blank"> Apple,</a> <a href="https://music.amazon.com/podcasts/64bb852d-74fd-49bc-bbc3-05105382afa1/InSecurity" rel="nofollow" target="_blank"> Amazon Music</a> &amp; <a href="https://www.audible.com/pd/B08JJNM1VB?action_code=SNGGBWS072717001P&amp;ipRedirectOverride=true" rel="nofollow" target="_blank"> Audible</a> as well as, <a href="https://play.google.com/music/listen#/ps/Ipudd6ommmgdsboen7rjd2lvste" rel="nofollow" target="_blank"> GooglePlay</a>, <a href="https://gaana.com/season/insecurity-season-3-2020" rel="nofollow" target="_blank">Gaana</a>, <a href="https://www.himalaya.com/technology-podcasts/insecurity-251737" rel="nofollow" target="_blank"> Himalaya</a>, <a href="https://www.iheart.com/podcast/263-insecurity-29945330/episodes/" rel="nofollow" target="_blank"> I Heart Radio</a> and wherever you get your podcasts! Make sure you Subscribe, Rate and Review!

Greg Crabb: What CISOs can learn from the US Postal Service and… the Russian Security Service?

Buckle up for this week’s episode because it is quite a ride! Greg Crabb, founder of TenEight Cyber and former CISO for the United States Postal Service shares insights from his more than 25 years in law enforcement and bringing cyber criminals to justice. And hear perspective on CISO best practices for a 630k+ employee organization with 43k facilities and 160 million daily delivery points and how he took a 40 person cyber team to 600 in just a few years. Also learn how his team partnered with CISA to secure the 2020 U.S. election, how postal inspectors serve as first responders (hint: anthrax vs cornstarch), the importance of identifying and quantifying risk for your organization today and the DevSecOps opportunity ahead. For links and resources discussed in this episode, please visit our show notes at https://www.forcepoint.com/govpodcast/e144

Buckle up for this week’s episode because it is quite a ride! Greg Crabb, founder of TenEight Cyber and former CISO for the United States Postal Service shares insights from his more than 25 years in law enforcement and bringing cyber criminals to justice. And hear perspective on CISO best practices for a 630k+ employee organization with 43k facilities and 160 million daily delivery points and how he took a 40 person cyber team to 600 in just a few years. Also learn how his team partnered with CISA to secure the 2020 U.S. election, how postal inspectors serve as first responders (hint: anthrax vs cornstarch), the importance of identifying and quantifying risk for your organization today and the DevSecOps opportunity ahead. For links and resources discussed in this episode, please visit our show notes at <a href="https://www.forcepoint.com/govpodcast/e144" rel="nofollow" target="_blank">https://www.forcepoint.com/govpodcast/e144</a>

One Night in Bangkok --- Greg Crabb