Subscribe
Share
Share
Embed
This episode of Cybertraps features an insightful panel discussion from the Inch360 conference held in Spokane, Washington, focusing on the latest trends and challenges in cloud security and systems architecture.
Topics include:
Topics include:
- Cloud security issues
- Integration
- Reactive to proactive
- Effective practices in an evolving landscape.
We’re thrilled to be sponsored by IXL.
IXL’s comprehensive teaching and learning platform for math, language arts, science, and social studies is accelerating achievement in 95 of the top 100 U.S. school districts. Loved by teachers and backed by independent research from Johns Hopkins University, IXL can help you do the following and more:
- Simplify and streamline technology
- Save teachers’ time
- Reliably meet Tier 1 standards
- Improve student performance on state assessments
🚀 Ready to see why leading districts trust IXL for their educational needs? Visit IXL.com/BE today to learn more about how IXL can elevate your school or district.
Creators & Guests
What is Cybertraps Podcast?
We explore the risks arising from the use and misuse of digital devices and electronic communication tools. We interview experts in the fields of cybersafety, cybersecurity, privacy, parenting, and technology and share the wisdom of these experts with you!
Welcome to the Cyber Traps podcast.
Today we have a very
special episode for you.
I am your host, Jethro Jones.
We will be talking about the
Inch 360 conference that took
place in Spokane, Washington.
This conference is a must attend
event for cybersecurity folks here in
Spokane, Washington, and it was a great
opportunity for me to connect with
cybersecurity folks here in Spokane and
learn about a lot of things that are
going on in the world of cybersecurity.
Right now, this episode is one of
the sessions from the conference.
I hope you enjoy it.
This session is titled Cloud Security:
Exploring the Latest Trends and Challenges
in Cloud Security and Systems Architecture
My name is Brant.
I am the regional CIO for
MultiCare Health System.
Uh, I oversee IT activities here
in the Inland Northwest region.
Largely Spokane, Spokane Valley,
Deaconess Hospital, Valley Hospital,
and more recently Yakima Memorial
Hospital in the center of the state.
Although I'm not focused exclusively on
InfoSec anymore, I did spend the first
part of my career, uh, leading the charge
against the bad guys, uh, for a healthcare
payer company, the tech sector, and
a little bit in the grocery industry.
So, um, I'm gonna jump right in and
all I'm gonna do is shout out names
and I would like to ask our panelists
to just give a quick introduction of
why you're here and the great knowledge
and experience you're gonna bring.
So I'll kick it over to my
friend Brent right here.
Just to let everybody know, my name is
Brent, not Brandt, though we do sing.
Hi, Brent Clements, VP of Product
Engineering for Vega Cloud,
a real local cloud finance
management platform, uh, company.
Uh, so very happy to be here at the
second annual Cyber Security Conference.
It's awesome to see the local
community grow, uh, not only
from a cybersecurity perspective,
but also general tech as well.
Uh, my background in security,
I started in security years ago.
I used to be a white hat hacker.
Um, I transformed that into application
modernization consulting where
obviously there had to be a bunch of
security consulting as part of that.
Um, and then today, um, we build in,
um, security in everything we do because
we do deal with a lot of financial.
Data from enterprise customers.
So nice to meet everybody.
Awesome.
Thank you Brent for joining us.
Vinesh.
Hello folks.
Good afternoon.
Again, nice to be here and to get
involved with the local community.
Uh, I'm Vinesh.
I'm a Cyber Security Engineer at Google.
Uh, and my role is
normally incident response.
My colleagues will say usually when I'm
around, it's like, oh, oh, what's wrong?
Today it's not one of
that, at least up to now.
Uh, and I'm also an engineer
in our DDoS protection teams
and our malware research teams.
Awesome.
Thank you for joining us.
My new friend, Nick.
Hi, excuse me.
Hi, Nick Marizzi.
Um, I'm about 30 years in
building high tech businesses,
the last 10 in cloud security.
Um, if we know about the words
like CASB, and SSC, and SASE,
and ZTNA, these kinds of words.
These are all words that have been created
in the last 10 years to solve problems
we had no idea about 10 years ago.
So, I'll share a little
bit more on that in a bit.
Awesome.
And rounding out our panel, we have Deb.
Hi, good afternoon, Deb Wells.
from BECU and I am a senior manager
there for cyber security engineering.
Before that, I was a full time professor
at Central Washington University.
And before that, I know I'm really old.
I was 21 years in the
United States Air Force.
So thank you, Heather, for the
tribute to our fallen comrades and
during World War II and December 7th.
Anyway, great to be here.
Thanks.
Awesome.
You guys, do you want to sit down?
Do you want to scoot the chairs back?
We'll turn it into a little circle.
Um, so the cloud's been
around for a while.
We haven't figured out, right?
Right?
You guys don't have struggles
with cloud security, right?
Um, so in preparation, admittedly, I've
been out of the game a little while.
I thought, let's see
what's going on in cloud.
So I looked up the IBM data breach report.
What's going on with cloud?
82 percent of breaches.
These include data stored in the cloud.
Misconfigured cloud is the third
most common attack vector behind
phishing and compromised credentials.
And having migrated to the cloud is
the fourth biggest impact to additional
cost associated with a breach.
So cloud, still.
Matters.
And we haven't figured it out yet.
So we're gonna ask some questions
today to see what we can do
to get a little bit better.
So I'm gonna start with Nick.
Cloud's not new.
What has changed in the last 5 to
10 years that we're still talking
about it as an InfoSec thing?
Well actually, I actually might
say that cloud is kinda new.
Um, so AWS launched in about 2010.
Uh, Google and Azure followed
pretty closely after that.
Um, the internet came really in,
in form in com window, right?
1993 we started to really see it.
So, calling, call it 30 years of the
internet, call it 15 years ish of cloud.
Um, and about maybe 6 months ago I sat
in front of a guy named Ashim Shadna.
Hashim is a legendary investor, uh, he
was an original Bell Labs guy, so he's
a networking guy by, by upbringing.
And Hashim put three, put one slide
on the wall and it had three circles.
Those circles were cloud,
network, and security.
And he said even today, those
cloud, those three circles
haven't created a Venn diagram.
He said we're still really early.
So the first thing that I'm going to
tell you is that Although we feel like
we've been doing this a long time,
we're still really early in this.
Um, only maybe 15 years, um, and
so I'll kind of tell a little
story about the still early.
Eight years ago I joined
a company called Sky High.
It was a CASB vendor.
How many people in the room
are familiar with CASB?
Okay, actually, maybe, I saw maybe 20%.
I see a sales opportunity, Nick.
Yeah, yeah, yeah, well definitely
there's a sales opportunity, um, but
it's more like we're still educating.
If only 20 percent of this room
knows what CASB is, CASB came
around in, call it 2012, 2013.
Um, and CASB is essentially
a service that secures.
Software as a service, like
Salesforce or Workday or Dropbox.
These kinds of services.
Internet bound traffic.
Um, that company got bought by McAfee.
And you'd say, why did McAfee
buy a company like that?
And McAfee owned the
legacy SecureWeb Gateway.
How many people are familiar with
the SecureWeb Gateway in the room?
About the same number.
So, a secure web gateway is the
inline controls to inspect traffic.
Whether that traffic is inbound or
outbound or to the internet or private.
We want to inspect it for bits and
bytes, ransomware, malware, data loss.
When you combine an inbound, uh, uh,
an inline control like a secure web
gateway with a CASB control for the
internet, you actually start to see
what they call SSE, Secure Service Edge.
Has anybody heard of that term?
Secure Service Edge.
So these, this happened eight years ago.
They started cobbling this stuff together.
Um, and so what I just want to
impose on you is we're still early.
The second thing that's, I think,
very different is we actually, I would
say today, we know what we're doing.
Um, the road the last eight years
for me as a sales slash technical
guy that had to sell it and then
technically deliver it is I'm bloody,
and I'm bruised, and I'm bumped.
Um, my customers are bloody,
and bruised, and bumped.
Um, those who adopted early day
technologies to solve cloud security
challenges, they got it done.
I would say that today they say
they did a good job, but the
process of getting there was messy.
It's because they didn't know what
they were doing, they were guessing.
And all the vendors, all the manufacturers
of security products didn't know what
they were doing, so they were guessing.
And so You're saying you lied to me, Nick.
Yeah, I did lie to you, yes.
Just so you know, we bought some
products from Nick when I was working
at a former employer, and we implemented
that stuff and it was cool, but I think
it's kind of And it works, it works.
It does work, it does work.
It just took a lot of work
to get it to work then.
And so what I'll say today, so if you
compare then to now, which I think
was the question, it works today.
The services are purpose built.
So the legacy vendors, even though
they look like they're new vendors
because you never heard of them,
who were built before cloud, those
types of vendors, they were guessing.
Their services are clunky.
It works, it gets the job
done, but it's clunky.
All the, the, what I call cloud
borne services that have come kind of
2017, 2018, 2019, these services are
purpose built because we knew what
the problems were at that point and we
purpose built them for the problems.
So, the good news is only 20 percent of
the people in the room raised their hand.
Those 80 percent who haven't done it,
you've got a really good chance of
not getting bumped and bruised and
bloody in the process because It works
now and you can do this really well.
The services get the job done.
Um, and then the last thing that I'd
say has shifted massively like, like
complete different world today is that we
used to solve problems in cybersecurity,
meaning a problem was identified.
We'd go buy some technology.
We'd go fix the problem.
We'd now manage that new service.
And manage it alongside the
10 other, the 20 other, the 50
other services that we manage.
And now what's happening is we're
actually not doing that anymore.
Customers, my customers are not doing
break, fix, find a problem, fix a problem.
They're actually doing, everything
they're doing is all about business value.
User experience and,
and improving security.
So you have to, you have to
actually improve the business.
while you deploy new
cyber security products.
And if you do that, the cyber
security products actually
really deliver for the company.
And so business value is driving
the security conversation.
User experience, meaning
improving the user experience.
I don't have to log on
to three different VPNs.
Um, I'm not boomeranging my traffic
to hit a firewall that's, you
know, halfway across the country.
It's hitting the internet.
Firewall that's close to me.
So my, my user experience goes up.
And then lastly, lastly, in that
process, because I'm closer to the
user, I can actually deliver more
online ready security controls.
I don't have to wait to get it.
It doesn't, my user
experience doesn't go down.
So those are the three big things
that have changed I'd say in the last.
Awesome.
I saw Deb make, uh, uh, an
expression during, is there
something you wanted to pile on?
No, I just was in awe.
I think that was beautiful because it
is clunky, it was clunky, and you know,
there's still a lot to be said for the
education piece of it when it comes to it.
To the cloud and how do I protect the
cloud and the cloud's kind of scary to me.
It's not like a hardware that
I'm right in there looking at.
That's the way I always look at
it from, from my vantage point and
especially from a my, uh, professor.
I guess vantage point is, you
know, don't be scared of it.
You have to embrace it.
You have to understand the foundations
of cybersecurity and how to protect might
not be the same as we had before with belt
suspenders and all these other things, but
you still need to have the foundation so.
I was all in your, you know, space, Nick.
Awesome.
Um, so one thing we should talk
about, which happened over the
last couple years, so I'm going
to tee this up for Brent first.
Um, more people work from
home than they used to.
A lot more people.
What are you seeing in terms of
shifts either in architecture,
approach, use, either good or bad?
with this massive shift of people
out of the office and connecting from
home, Starbucks, the vacation house
in Boca Raton, whatever it might be.
So, uh, my view is that remote
work has been around for years,
tens of years, Twenties of years.
Tens.
Tens of years, Twenties of years.
Um, back in when I was growing up,
um, it was Unix terminals, right?
Um, so you had a remote, uh, huge
Unix server, you had a terminal and a
In a, uh, in a cafe or a university,
uh, office or what have you and you
still have the same problems you have
today as you had back then, right?
And so I think some of the
trends we're seeing is, um,
again, the move to the cloud.
And the cloud, the various CSPs like AWS,
Azure, GCP, they've built in controls
in some of their remote desktop, uh,
technology to enable us to put those
controls in place, that security in place.
Um, I think also it comes
down to policy, right?
Um, I'm a huge governance, uh, proponent.
So, um, my background is also
in, in governance and policy.
And one of my biggest things is,
again, uh, with any new technology
or any technology that affects
both on site employees as well as
remote employees, uh, ensuring that
your policies are in place, there's
education, um, those sorts of things.
Yeah, I love that.
I don't know if we'll have time to dig
into it, but, um, kind of going back to
what Deb said and what you just said.
Removing the barriers for people
to do stuff right and making
it way harder for people to do
stuff wrong is a huge win, right?
Um, and sometimes it feels draconian
when you sort of limit how people
can interact, but from a security
perspective, um, a huge win.
It, it, it really comes down to, as a
security professional, you know, I've
struggled with this, uh, CISOs, CISOs
struggle with this, security professional
struggles, which is, again, you Putting
in those, like you said, those, those
controls, but still enabling your,
your employees to work effectively.
And that's, it's, it's a, it's a,
it's a, it's a hard balance sometimes.
I think it always is.
Does anybody here have iHeart Governance
bumper stickers, because I feel
like those need to be handed out.
Yes.
To every person everywhere, because
governance, governance sinks you, right?
You can have the best tools in the
world, but if you're not doing the
right things with them, it doesn't work.
Let's talk about bad stuff happening.
Vinesh, I think you might have
some insight into where people
might be making some mistakes.
Stakes in how they are either setting
up or using their cloud services.
Okay,
boy, where do I start?
So how long do you have, right,
? I mean, when I, when I look back, uh,
and I do a fair bit of auditing, uh,
with the customers and others as well.
Sometimes I try to find patterns
just to wrangle them into like some
simple meaningful ways I can wrap
my head around all this happening.
Most often, the case it's
basics as, as Deb said.
Uh, credential leaks, and one
example, one story which has played
itself many times is a developer.
He or she, for all the good reasons,
a service is starting up, just dumps
all the config to make sure the service
is connecting to prod, not test.
And in there, there's a credential,
there's a database URL, it goes
into a log file, that log file
ends up in different places.
Repeat that, because there are a
lot of people here who need to hear,
Don't dump your config file with
the prod connection credentials.
Wait, we're not supposed to do that?
So, but, but it's, it's some of those
basic, I call the hygiene, and um,
if you heard some of the, the things
that Nick said, that was reinforced
as well, is we've got ourselves into
this masterful world of And then, of
course, it's about looking at disease.
Like, you know, we're fighting disease.
We are finding cures for disease.
And then we become a master of sickness.
And there is this entire world,
a few good professors had to, you
know, drill that into me that you
need to think of turning into, like,
uh, an aspect of digital well being.
Like, what is healthy?
What is good hygiene as opposed
to just focusing on the, the
things that are going wrong.
So it's credential leaks.
It is misconfiguration.
It is Lack of separation of controls.
These basics, I would say, if you just
eliminate that class of issues in itself,
would just get rid of so many other.
So you're saying it's
basic security hygiene.
Yeah.
I actually want to give everybody
else the opportunity to answer this
question because I think the best way
to learn is when you screw something up.
And if anybody's had exposure to
somebody else who screwed something
up and can share those stories
with us, I would love to hear more.
Deb, do you have anything you want to add?
Maybe even a specific instance, but
we won't name names or companies.
Yeah, well, no, I don't have any
of those, because I use such great,
you know, CASB products, and I
use, we have such great governance.
No, we're always, we're always
striving to get better, and
that's the biggest thing, right?
You always strive to get better, and
you always try to, you know, don't
repeat history, although it sometimes
repeats itself, as you all know.
But, um, Always, I guess, um, I don't
have any real examples about that
except, you know, once again, learn from
what's been going on and in the past.
So you want to, you don't, because you
don't want to repeat that or you want
to say, Hey, maybe we should check that.
And I think the thing that resonated with
me was the governance piece of it, because
you talk about governance is so important.
And it's one of those, it's not as,
can I use the word sexy sometimes?
It's pretty boring.
It's not very sexy, right?
It is the antithesis of sexy.
It doesn't have flashing lights or
a shiny front, like a server that
you might stick in your data center.
Yes, or in something like that.
It's so important and so if you can
just kind of start getting your heels
into the governance piece of it that
and it comes to the BYOD I think that
one resonates with me when it comes
to cloud and comes to work remote work
and and things like that is just have
some guardrails around it because by
golly people are going to test you.
You'll even probably have people
in your own org in your own
team or something that's testing
you but have those guardrails.
And, uh, and, and use the good
cyber hygiene and digital wisdom
when, when doing things, so.
Awesome.
Nick, anything to add?
I mean, it's so teed up for me, I,
I, I gotta, I gotta bite on it, um.
I, I, I tried the softball, um.
I actually, yeah, yeah, this
is a, this is a softball, um.
This is actually the hack of the decade,
so the hack of the decade, and this
is my quotes, so you probably won't
find it in the internet, but I say
the hack of the decade is the third
party contractor VPN access onto a flat
network that hasn't been micro segmented.
Their purpose is to get to this
application and the next thing you know
they're everywhere on that flat network.
And we call a VPN a security service.
But really all that a VPN is is a
network access control solution.
It doesn't deliver any security.
And we have to change that.
I believe.
That it's my job to actually,
to make the VPN go away when
we're talking about security.
We don't want to let people
on the network anymore.
The network is a risky place, right?
That's where the crown jewels sit.
Keep them off the network.
All traffic should be outbound.
No traffic should be inbound.
If you're having inbound traffic
and you haven't segmented
your network, you're done.
You will be hacked.
You will be ransomwared.
Your data will be gone.
Target.
You name them, go read it.
VPN hack, Target.
That was a third party
contractor on a flat network.
And, and so all I say is that
you get your VPN for free.
Attached to an ELA from a major vendor.
All of you in this room get it for free.
And that's why we continue to use it.
Hundred percent.
Free service attached to an ELA and we
say it's a security product and it's not.
That's probably what
I'll have to say to that.
That's awesome.
Brent, do you want to add anything?
'So, I don't know if you've heard
a common word here, it's people.
Uh, people are the biggest
problem when it comes to security.
Um, my example of this, I
actually worked for Capital One,
uh, during the, um, AWS breach.
I don't know if you guys are familiar
with it, but it's since she was.
A, um, staff member of, of AWS had
access to our creds at Capital One
and they were able to modify S3 and
get some, uh, essentially admin level
privs to all of our environments.
So, um, you know, that could have
been prevented by, uh, adding
a couple different controls.
So again, I go back to our original
statement, which is people.
And I said something a
little bit earlier as well.
It comes down to a couple things.
First of all is basic security comes down
to good background check so that may not.
Catch everything.
There's anger of people, you know,
people get disgruntled, right?
But it also comes down to education.
One of our biggest things at Vega is
on a monthly and a quarterly basis,
we are continuously educating, right?
We're doing, we're running
scenarios almost monthly with
people, fishing exercises, those
sort of things to get people to
do those behavioral change things.
That will force people to understand,
hey, I'm not doing the right thing.
So to me, the biggest, uh, the biggest
challenge with any type of breach
is when it comes down to people.
Because technology will always
be there, and we can put the best
technology out there, but humans
are always going to be the problem.
I agree humans are the problem.
Humans are the problem.
Anybody else?
Show of hands.
People are the problem.
Oh, come on.
That's why we're getting AI.
That's why we're getting chat bots.
That's why we want bots, right?
People, people, so,
Okay, I'll tell, I'll take a
little moment to be a speaker for
a second and not the panelist.
Um, In my career doing some InfoSec
work, I've had people look at me with
a very honest, straightforward face and
say, Our employees make great decisions.
And I said, I work in healthcare now.
Let me prove to you that
people make horrible decisions.
Go spend some time in an emergency
department and see what sorts of
things people put in their body.
Right?
Really bad decision makers, okay?
So, um, yeah, and this goes
back to what we talked about.
Make it super easy to make the right
decision and make it really hard.
to make the wrong decision.
Because people will always
make the wrong decision.
And, a lot of times it ends up bad.
I want to give the audience a chance
to ask some very specific questions.
So I'm going to pause, and see if any
brave soul wants to raise their hand,
Okay, I'm going to repeat the question.
I'm going to do my best.
You give me a thumbs up if I got it.
In a post quantum computing world with,
um, we'll say the injection of AI, what
are the repeatable, consistent, and we'll
say effective things we can do to continue
to successfully protect the cloud?
Did I get it?
You want me to take a stab at that?
I mean, I don't think I can come in
here and talk too much about, you know,
qubits and, you know, what is quantum
decryption is I think the term of the day.
But once again, with the new technologies
that are coming out, the biggest thing
that I feel What is to learn it, you
know, as best you can, and learn the,
uh, what the bad actors or the nefarious
individuals are going to use it for.
Whether it be AI, I did a speech before
on Ying and Yang of ChatGPT and deepfakes.
You have to get better than them and
you have to be on top of it because
if you just rest your laurels on the
old days of cyber security, defense
in depth, you know, getting and
using VPNs to get into the network,
you're going to be behind the curve.
You've got to get up front.
You've got to say, okay, so they're going
to use AI or they're going to use some
sort of quantum computing to get in.
I hope and pray that our vendors
are putting that into their tools.
I know that for us, we are putting a
lot into AI governance because of, you
know, the whole technology, but it's
one of those things you have to be
able to counter it with itself almost.
Does that, I mean, I don't know, that's
kind of my stab at that question and
maybe my illustrious counterpart's got it.
Anybody else want to add?
I see Brent picking up his mic.
He's ready to go.
Yeah, so as my, uh, my daddy used
to say, what's old is new again.
So, quantum computing, uh, I was in high
performance computing for a while and,
you know, AI has been around for a while.
Um, I was doing neural networks at
Rice University 20 years ago, right?
And, which, if you don't know,
neural networks is using AI to map
similar to the very brain, right?
So, AI has been around.
So, I think it's, it's a lot of
the same things you're doing today.
Like you said, get ahead of it, right?
It's, it's always going to be that,
that battle, that yin and yang
with, you know, ad research, right?
And I keep going back to, and I want
to hone in what you asked about,
which is how do you, how do you, um,
resolve the fear that your users,
that people might have, right?
It comes again down to education, right?
Doing now, teaching what AI,
it comes down to teaching what
people, teaching what AI is, right?
Teaching, or telling them and teaching
them what they can and can't do.
As an example, right?
General AI today, your chat
GPTs of the world, right?
That's going to lead to
a lot of data leakage.
It's going to lead to a lot of IP leakage.
Um, if you're in a vendor, a software
vendor, you have developers that want
to go out and try the newest cool tool
that can help me do my job, right?
You want to, again, add those controls,
add that governance, add that education,
teach them, but also enable them, right?
Give them opportunities.
So, um, doing things like, as
part of your security program.
Evaluating partners that have AI
technology and in your contract make
sure that they have those same controls
in place that you expect, right?
Set a high standard for your
vendors and your partners.
Lawyers can be your best friend.
Yes.
Yes, and And yeah lawyers
are your best friend.
Yeah, I have a very good friend.
I should actually introduce you to his
name is Brad Frazier He works out of
Boise, Idaho and resonated with me forever
It's all academic until you get sued.
Yes, and It's a hundred percent right
and the reality is it doesn't matter
how nice your vendor is or what kind of
bunch lunch They bought you or whatever
like when things go south the only
thing that matters in the contract.
Well guess what?
Like, this is all new, I think, to
some of our points, this concept of
AI and who has to do what to protect
things, um, lawyers will be your friend.
Binesh, did you want to
add anything to this?
How, how do we, how do
we fight the good fight?
I, I'm just going to restate what
the others said and look cool.
That's the right way to
go last and wrap it up.
Try to look cool.
Uh, like, you heard the terms, like,
you know, education, get better at it.
And one of the ways I usually
articulate this when I'm speaking with
others is just get good at software.
And the way to think about it is, like,
we've conducted so many studies now.
Like, before the, this panel gets
done, if you have a vulnerable asset
in the internet, it's compromised.
All it takes is that, that much time
for someone to find it and exploit it.
But the scary part is not even that.
It is, once something is found,
all it takes is 45 seconds for an
adversary to make it productive.
And then I turn around and ask the
question, I'm going to ask you to
make a release of software, not your
prod, just your dev environment.
Can you beat that 45 seconds?
Usually the answer is no.
And if our adversaries are that good
at exploiting software, exploiting
software, like, we should be better than
them if we have to keep up at the game.
Right?
So it's, no matter what technology
is always going to move,
it's going to keep evolving.
We just have to be an expert at it.
As good as the adversaries are.
Do you want to add anything, Nick?
I'll wrap it up.
So, what I heard, and I'll summarize
how my simple brain processes it.
It's still all the same
fundamental problems.
The tools are slightly different.
What I think we have to get better at, and
I think I had conversations with both you
and you about this, we gotta get faster.
Right?
We can't take 9 months or
12 months to figure it out,
we gotta figure it out in 3.
And that's where, probably, getting
the right kind of support from your
leadership to invest, and understand,
to be educated enough that they know,
yeah, this is the right way to go
and, by design, not treat symptoms.
But address the fundamental problems,
which are probably like architecture
and governance and people, um,
to get where we need to go.
Can I add one thing?
Yeah, go for it.
So, any security professional in here,
um, actually the one thing that has
benefited me in my career, in my life,
and in winning the security argument from
a top down perspective, learn to present.
Learn to have an elevator pitch, which
means to explain what your problem is,
what the value of doing something is.
Because we all know that
security becomes an afterthought.
So, get good at being a politician.
So that you can sell your ideas,
sell your, uh, sell your needs, so
you can secure, uh, your company
and your data and your people.
Great advice.
Do we have any other folks?
Yeah, go for it.
Setting up a by design secure
architecture, technologically
speaking, for their organization.
And where can they go to get the right
resources to educate themselves so that
they understand why that's important.
Did I get it?
At the right value for them.
Value is an important word.
Um, so that's an awesome question.
Um, so I used to actually do
small business consulting as well.
So this is near and dear to my heart.
The first is look at your vendors.
Um, all the cloud vendors provide secure
architectures that you can replicate.
They even provide you, as an example,
in GCP, literally a click button
ability is to deploy these secure
architectures, secure infrastructures,
with all the various things in place.
Is that, is that the, the final step?
No, right?
Um, there's also many
open source products.
I don't want to negate any of the vendors
here, but there's num tons of open
source products out there, solutions.
The government provides a ton of things
from CISA, the NSA, those sort of things
that provide you all the various policies.
Um, and also, you know, as you're
building your organization, you can look
at bringing in consultants such as, um,
uh, part time CISOs and those sorts of
folks that can actually help you build
your security posture, uh, going forward.
So that's my thoughts.
Yeah, I, what I would say is outsource it.
Number one, to that, because that
person needs to focus on his core
business, or her core business.
The selling, the building, the three
other things you mentioned there.
Um, and the difference today versus
ten years ago is there's a There's
a ton of those types of providers.
So you can actually almost buy MSSP
services the same way that maybe
you might buy, uh, a Jersey Mike's.
Am I going to get a Jersey Mike's
or am I going to get a Subway or
am I going to get a Togos, right?
That's kind of where we are now.
The MSSP market is evolved and it's, and
it's here to support the SMB because the
SMB doesn't care about cyber security.
They care about making
their business perform.
That's what I would say to that.
Did you want to add something, Deb?
No, I think that, you know, the
government does have the NIST, the ISO.
There's a lot that's out there.
You don't have to recreate the wheel.
Just, you know, and you might, you
know, try cyber security as a service.
I mean, everything is as a service
these days that you can use.
That's the same as all you
said with the, you know, get
some consultants to help you.
You're not alone, though.
That's the biggest thing.
And, you know, I would, you know,
learn from other people's mistakes.
You probably I already know that about
me, that, you know, try to read what's out
there and say, eh, I don't wanna do that.
But,
and I see a hundred plus people
in this room who might be able
to help answer a question or
point you to someone who could.
So a challenge to everybody during the
break is go introduce, introduce yourself
to someone you don't know, and at least
explain who you are and what you do, and
how you might be able to help each other.
Any other questions?
This is going to be our last question.
So I'm going to summarize.
From a research and development
standpoint, how do we shift from
being reactive to proactive?
Vinesh, you go first.
We made eye contact.
Uh, let me start.
And, uh, it's actually a
deep and a profound question.
Because part of it has to do, deal with
unlearning what we've been doing always.
And the reason I say that is, one of
the ways to tackle that switch from
being reactive to the master of disease
to one of health would be first, how
do you know you're doing a good job?
We should be able to answer that question.
And in cyber security, often the
answer is, if nothing happens, now
how do you measure nothing happens?
So you see, cyber security is that field
where there are these paradoxes, right?
And it's, the paradoxes are real
because cyber security is a very
hard problem in technical words.
Some people call it the NP hard problem.
And those problems pose themselves
with a certain set of characteristics.
Some characteristics are, I don't
know what a good solution is.
But if you give me a good solution, I can
immediately tell you if it's good or bad.
And that's reinforcing the
behavior of being reactive.
So one way is to understand what we
call the Leading indicators or defining
something that's going to give you that
early warning sign and then track yourself
on those measures in addition to all the
other things that we have normally to do.
So that's partly education, partly
enablement, and this the shift from what,
how we've been doing things all along.
That's like one, the, the other
one is, I would say we have to get
to a grips with the, the world of
convergence, which is happening.
What do I mean by that?
Uh, like, traditionally, cyber security
is you defend your network, you define a
perimeter, you establish something's safe
zone, and you touch something, you bless
it, you go through your checklist, it's
all checked, and then you don't touch it.
Because when you touch
it, it means change.
And change means risk.
Right?
That's, that's been philosophically
a way of how we've approached
the problem that has to change,
uh, to get to this, uh, state.
And, for example, I told you
how the bad actors are able
to, like, exploit software.
Why?
You know, software has very
two important characteristics.
Low cost to change, meaning I
can make a change very easily,
and low cost to distribute.
I can get it at the speed of
electrons, basically, wherever I want.
But it's very expensive
to operate and maintain.
Historically, we've been optimizing
ourselves for the weakness of software.
For the, for the, uh, because it's
very hard to operate and maintain.
And we squander away the
benefits of software.
The adversary is exploiting software
using the benefits of software.
So we ourselves should
shift into using software.
So for example, rather than, uh, uh,
not changing your server, let's say
your servers expire every three days.
Even if an adversary was to compromise
you, they have to re compromise you,
they have to recognize since again,
they'll have to Know your IPs, know
your names, I mean we floss every
day, we take a shower every day, do
a digital floss, a digital shower.
So these are some counterintuitive ways
of how you can grapple the, grapple with
the problem and then get to the state.
And I would say that, and I'm not
demeaning any of the planning and the
organization and the structure and the
architecture and the workflows and the,
and the building the clean process, but
We also heard that, I think, Finesh,
you said it, is that how do you manage
when the The threat is changing every
single moment and every 45 seconds
you've got to do something different.
The only way you can really
manage that is through reaction.
So it's sort of like the
concept of the pucks moving.
How am I going to get there?
And so what I would say is you have
to build both sides of this pyramid.
It's not just build the architecture
and build the workflows.
It's build the architecture,
build the workflows, and then
build the IR response process.
So that you have the So you can
respond quickly and deal with it.
You're gonna.
Cause you're gonna deal with it.
Cause you're gonna.
Yeah.
It's, it's, it's, it's sort of the,
I, I think it's, it's different than
what I'm so used to in my old days in
networking and data storage, you know.
You, you sort of like configure it and
you make it work and then it works.
But cyber security, you do that and then
three days later somebody figured out how
to hack it and now you need to fix it.
But nothing really broke.
So it's just, it's a tricky
dilemma we're in, for sure.
Learn how to react.
Alright, I think we're gonna
officially get the hook here.
So I'm gonna ask you guys to
give a round of applause to our
amazing panelists for their time.
And great brains.
And we will jump to the next session.