Top Tips for Reducing Cyber Risk with Suroop Chandran at SonicWall

1
00:00:00,000 --> 00:00:12,360
Welcome to Logically Speaking, where we discuss the latest trends in cybersecurity, challenges
2
00:00:12,360 --> 00:00:14,320
with topic experts in their own field.
3
00:00:14,320 --> 00:00:18,600
Today, you're going to learn how to protect your data, how to keep your operation sound,
4
00:00:18,600 --> 00:00:21,160
and your business ready for whatever comes next.
5
00:00:21,160 --> 00:00:23,040
This is Logically Speaking.
6
00:00:23,040 --> 00:00:27,680
Today we're speaking with Sareeup Chandra of Sonic Wall.
7
00:00:27,680 --> 00:00:29,680
Could you introduce yourself?
8
00:00:29,680 --> 00:00:34,560
I know you lead product management for Sonic Wall's capture client and the web application
9
00:00:34,560 --> 00:00:38,760
firewall products, but maybe you can share with our listeners about how you got into
10
00:00:38,760 --> 00:00:41,760
cybersecurity and then maybe talk about your current role.
11
00:00:41,760 --> 00:00:42,760
Absolutely.
12
00:00:42,760 --> 00:00:49,920
So, interesting enough, I'm probably one of the people in my generation who had the
13
00:00:49,920 --> 00:00:53,960
fortune to start my career in cybersecurity.
14
00:00:53,960 --> 00:00:57,040
I actually started off with the coming to the United States.
15
00:00:57,040 --> 00:01:03,040
I'm brought up in the Middle East in Dubai, but I did my undergrad in India, originally
16
00:01:03,040 --> 00:01:08,320
of Indian origin, and I eventually then went to do my postgraduate or I should say my grad
17
00:01:08,320 --> 00:01:13,640
school in the United States at the University of Pittsburgh, where I got to do a master's
18
00:01:13,640 --> 00:01:18,280
in networking and specialization in security.
19
00:01:18,280 --> 00:01:21,160
That's kind of where it started, in a sense.
20
00:01:21,160 --> 00:01:24,760
It was one of those early programs that was actually sponsored by the NSA, where they
21
00:01:24,760 --> 00:01:30,320
were trying to spread cybersecurity awareness and education through grad school programs,
22
00:01:30,320 --> 00:01:34,000
understrived programs, and the University of Pittsburgh was one of those early pioneers
23
00:01:34,000 --> 00:01:35,880
in that space.
24
00:01:35,880 --> 00:01:38,040
Once I got into that space, I couldn't get out.
25
00:01:38,040 --> 00:01:41,920
So after I got out, I kind of got a little stubborn about the fact that I want to get
26
00:01:41,920 --> 00:01:43,120
a job in cybersecurity.
27
00:01:43,120 --> 00:01:45,520
I don't want anything else.
28
00:01:45,520 --> 00:01:50,640
I remember getting a job as like a DB operator for any of these, and I decided, no, I don't
29
00:01:50,640 --> 00:01:51,640
like this.
30
00:01:51,640 --> 00:01:52,640
I don't want to do this.
31
00:01:52,640 --> 00:01:56,280
For an immigrant in the United States to be able to say no to a job three months later,
32
00:01:56,280 --> 00:01:58,120
it was a big risk I took.
33
00:01:58,120 --> 00:02:03,680
I figured out how much fun that would be because at that time, cybersecurity was still one
34
00:02:03,680 --> 00:02:09,440
of those niche spaces that you could only get a job in if you're someone who has a lot
35
00:02:09,440 --> 00:02:10,440
of experience in IT.
36
00:02:10,440 --> 00:02:16,920
Here I am, three years of age, only gone through schools, never worked a job in my life.
37
00:02:16,920 --> 00:02:20,240
The other side of it is that if you do want to get a break, most companies were federal
38
00:02:20,240 --> 00:02:24,040
contractors, and obviously I'm not a US citizen.
39
00:02:24,040 --> 00:02:31,440
So getting security clearance level, I don't know, minus one if that even exists is impossible.
40
00:02:31,440 --> 00:02:37,240
So three months and about 150 job applications later, I finally found my first job with a
41
00:02:37,240 --> 00:02:42,440
managed security services provider called Integrals.
42
00:02:42,440 --> 00:02:46,760
They were based in Connecticut at the time, and they're originally from Germany, but their
43
00:02:46,760 --> 00:02:49,800
United States operations was in Connecticut.
44
00:02:49,800 --> 00:02:55,640
And I got in over there, I think originally interviewed as a break fix engineer, those
45
00:02:55,640 --> 00:02:58,960
in the hardware world understand it's this person who drives out to the site plugs the
46
00:02:58,960 --> 00:03:02,120
network cables turns it on walks away.
47
00:03:02,120 --> 00:03:07,120
But I fortunately, because I had studied and I had some fairly good background in understanding
48
00:03:07,120 --> 00:03:11,400
what security concepts are, they moved me up in the sock pretty quickly.
49
00:03:11,400 --> 00:03:15,480
And that was my first experience in enterprise security.
50
00:03:15,480 --> 00:03:21,760
I would shouldn't say enterprise, but in cybersecurity, but working in the sock, managing firewalls,
51
00:03:21,760 --> 00:03:29,000
IPS, and doing eyes on glass monitoring for security alerts for mid market customers.
52
00:03:29,000 --> 00:03:35,840
So credit unions, banks, healthcare organizations, state organizations, really interesting experience
53
00:03:35,840 --> 00:03:43,480
being literally on the floor, working in shifts, working on call, leading teams eventually
54
00:03:43,480 --> 00:03:48,040
making sure that our customers are secure with a company that I thought at that time
55
00:03:48,040 --> 00:03:52,760
was a real pioneer in the security monitoring space because this was before even sim really
56
00:03:52,760 --> 00:03:54,760
took off.
57
00:03:54,760 --> 00:03:59,160
And it was I got really lucky that I got exposed to all of that at that, you know, in my very
58
00:03:59,160 --> 00:04:04,680
first job and I'm really eternally grateful that company eventually got acquired by entity
59
00:04:04,680 --> 00:04:07,520
and is now part of the entity security division.
60
00:04:07,520 --> 00:04:14,440
And after that, I moved into a much bigger sort of IT outsourcing organization.
61
00:04:14,440 --> 00:04:20,920
It's a company called Wipro based in India, one of the largest IT outsourcing companies.
62
00:04:20,920 --> 00:04:22,160
Very interesting experience.
63
00:04:22,160 --> 00:04:26,320
Their customers are typically the Fortune 200.
64
00:04:26,320 --> 00:04:29,360
And you know, those security needs over there are very, very different.
65
00:04:29,360 --> 00:04:34,600
And I switched hats from being an operator to being more of a consultant on how to build
66
00:04:34,600 --> 00:04:40,600
a sock, how to implement best practices for security technologies, et cetera.
67
00:04:40,600 --> 00:04:45,640
And that's sort of where after coming from the operator world and also playing consultant
68
00:04:45,640 --> 00:04:50,480
side of the house, the seed of product management got sold.
69
00:04:50,480 --> 00:04:51,480
Right.
70
00:04:51,480 --> 00:04:55,600
Because I was like, okay, I know what the problems are when I use a product.
71
00:04:55,600 --> 00:04:58,960
I know what the problems are when I position products with customers and why they don't
72
00:04:58,960 --> 00:05:02,200
like our products, whether it's from the use perspective or whether it's actually effective
73
00:05:02,200 --> 00:05:03,200
for them.
74
00:05:03,200 --> 00:05:07,000
But I can't keep complaining about the fact that my customer doesn't like the product
75
00:05:07,000 --> 00:05:10,000
because it's not good enough.
76
00:05:10,000 --> 00:05:14,520
How about I switch over to the dark side and figure out how to actually make the good product.
77
00:05:14,520 --> 00:05:15,520
Right.
78
00:05:15,520 --> 00:05:19,520
And that's kind of how I rolled into product management and where I am at SonuQua right
79
00:05:19,520 --> 00:05:20,520
now.
80
00:05:20,520 --> 00:05:27,600
And I think my background being mostly in the security operations and sock space, I got
81
00:05:27,600 --> 00:05:32,080
the opportunity to be in the cloud side as well as the endpoint and the socks.
82
00:05:32,080 --> 00:05:37,280
And what I do at the sonic wall today is I am the product management leader for our
83
00:05:37,280 --> 00:05:39,160
endpoint strategy.
84
00:05:39,160 --> 00:05:43,200
I'm also leading our third party integration strategy.
85
00:05:43,200 --> 00:05:47,840
So as we try to build out the ecosystem with no enterprise customers as well as our managed
86
00:05:47,840 --> 00:05:50,520
services partners like yourselves.
87
00:05:50,520 --> 00:05:52,800
And I am very heavily involved.
88
00:05:52,800 --> 00:05:58,000
I should say I forced myself to be involved in building out what should be our, you know,
89
00:05:58,000 --> 00:06:03,280
Uber management strategy or security operation strategy for whether it's for MSPs who are
90
00:06:03,280 --> 00:06:07,880
really like the real in today's world, they're the real operators of cybersecurity.
91
00:06:07,880 --> 00:06:08,880
Right.
92
00:06:08,880 --> 00:06:13,160
Or even for those really highly regular enterprise customers that want to do things by themselves.
93
00:06:13,160 --> 00:06:14,160
Yeah.
94
00:06:14,160 --> 00:06:19,240
So you touched on a couple of great things that maybe we can chat about.
95
00:06:19,240 --> 00:06:24,080
So in your career, right, you started as an operator and you moved through your career.
96
00:06:24,080 --> 00:06:32,000
What have you seen kind of the threat landscape evolve or red actors and their tactics evolve
97
00:06:32,000 --> 00:06:33,360
over your career, right?
98
00:06:33,360 --> 00:06:40,200
So, you know, that that's something I'm really interested in kind of your viewpoint on how
99
00:06:40,200 --> 00:06:44,640
how that has changed over the last maybe 10, 12, 15 years.
100
00:06:44,640 --> 00:06:48,400
So I think a lot of it is actually tied to how technology evolves.
101
00:06:48,400 --> 00:06:49,400
Right.
102
00:06:49,400 --> 00:06:53,120
So when I started off, you know, being in the sock.
103
00:06:53,120 --> 00:06:58,760
You know, it was really fun to see attackers trying what you would call the classic vulnerability
104
00:06:58,760 --> 00:06:59,760
exploit.
105
00:06:59,760 --> 00:07:00,760
Right.
106
00:07:00,760 --> 00:07:06,000
We'd see SQL injections or cross-site scripting type of attacks or, you know, any sort of
107
00:07:06,000 --> 00:07:07,600
like application vulnerability.
108
00:07:07,600 --> 00:07:12,480
I remember actually looking at a series of events and seeing hexadecimal obfuscated SQL
109
00:07:12,480 --> 00:07:17,040
injection attacks where you're, you know, you're actually have to decode from hex to
110
00:07:17,040 --> 00:07:19,200
text to see, oh, this is a SQL query.
111
00:07:19,200 --> 00:07:21,760
What are they trying to do with a SQL query in a web packet?
112
00:07:21,760 --> 00:07:23,320
Right.
113
00:07:23,320 --> 00:07:27,400
So that's sort of where like when I started that that was like the in thing, right?
114
00:07:27,400 --> 00:07:29,760
This is early 2000s, I would say, right?
115
00:07:29,760 --> 00:07:34,720
The in things, intrusion into external systems and being able to get access to them.
116
00:07:34,720 --> 00:07:39,360
Not that malware wasn't popular, but the challenge I think that existed at the time was how do
117
00:07:39,360 --> 00:07:41,120
you get the malware to the user?
118
00:07:41,120 --> 00:07:42,120
Right.
119
00:07:42,120 --> 00:07:44,680
You still have to try to get a vulnerability exploit and maybe plug it into a server or
120
00:07:44,680 --> 00:07:45,680
something.
121
00:07:45,680 --> 00:07:54,800
Why? Because a lot of the broader mass of people weren't already completely on the internet.
122
00:07:54,800 --> 00:08:01,760
And then over time, as more people at workspaces at home started moving their machines, you
123
00:08:01,760 --> 00:08:03,400
know, using laptops a lot more.
124
00:08:03,400 --> 00:08:08,160
I remember when I got a laptop in 2000, you know, 2004, it was the biggest deal of my life.
125
00:08:08,160 --> 00:08:10,120
Wow, I have a laptop.
126
00:08:10,120 --> 00:08:11,120
Right.
127
00:08:11,120 --> 00:08:12,120
Right.
128
00:08:12,120 --> 00:08:15,640
And, and, you know, so lapsed.
129
00:08:15,640 --> 00:08:17,200
Lapsed stops started getting more prevalent.
130
00:08:17,200 --> 00:08:19,400
People started going to various places.
131
00:08:19,400 --> 00:08:21,800
Security layers started getting a little fuzzy.
132
00:08:21,800 --> 00:08:22,800
Right.
133
00:08:22,800 --> 00:08:24,040
Everybody's not just in the network.
134
00:08:24,040 --> 00:08:28,600
There are now various other places you can get people are using more mobile drives.
135
00:08:28,600 --> 00:08:34,200
People started doing things like social engineering a lot more, you know, things like fishing,
136
00:08:34,200 --> 00:08:39,400
fishing, wailing, all of that started getting a little more popular where they're trying
137
00:08:39,400 --> 00:08:42,800
to target users because of their behavior.
138
00:08:42,800 --> 00:08:47,920
So, you know, classic attacks that we've heard off in the past where, you know, someone calls
139
00:08:47,920 --> 00:08:52,360
you from a call center and says, Hey, you know, we're calling from XYZ Bank and your
140
00:08:52,360 --> 00:08:54,040
password is expired.
141
00:08:54,040 --> 00:08:55,440
Would you like to set a new password?
142
00:08:55,440 --> 00:08:56,440
Tell me what it is.
143
00:08:56,440 --> 00:08:58,360
And we'll set it for you.
144
00:08:58,360 --> 00:08:59,360
People fell for it.
145
00:08:59,360 --> 00:09:00,360
Unfortunately.
146
00:09:00,360 --> 00:09:01,360
Right.
147
00:09:01,360 --> 00:09:08,040
And the challenge that you see over there is that enterprises weren't necessarily as mature.
148
00:09:08,040 --> 00:09:12,760
And so I remember working at one point for a project for implementing a sock for a banking
149
00:09:12,760 --> 00:09:14,920
customer banking, no less.
150
00:09:14,920 --> 00:09:15,920
Right.
151
00:09:15,920 --> 00:09:19,760
Banking customer and they were getting targeted by fishing attacks.
152
00:09:19,760 --> 00:09:21,160
Right.
153
00:09:21,160 --> 00:09:26,680
So fishing attacks where the URL is posing as their bank and it's going to their customers
154
00:09:26,680 --> 00:09:29,400
as email.
155
00:09:29,400 --> 00:09:34,320
And the head of IT security at that time, no less is questioning us as to why the sim
156
00:09:34,320 --> 00:09:37,880
is not able to detect this.
157
00:09:37,880 --> 00:09:38,880
And I had to explain it.
158
00:09:38,880 --> 00:09:40,760
We're not monitoring our users.
159
00:09:40,760 --> 00:09:41,760
We're monitoring our employees.
160
00:09:41,760 --> 00:09:42,760
Right.
161
00:09:42,760 --> 00:09:44,360
I mean, how do we know they're getting the email?
162
00:09:44,360 --> 00:09:47,800
I mean, you'd have to ask us to hack into Gmail or something of that sort.
163
00:09:47,800 --> 00:09:48,800
Right.
164
00:09:48,800 --> 00:09:53,240
So, so this, so this as the proliferation of attacks started and the complexity of attacks
165
00:09:53,240 --> 00:09:57,360
started to get increasing, the maturity wasn't really going up there as much.
166
00:09:57,360 --> 00:10:02,520
And I think the real turning point in my opinion were two events.
167
00:10:02,520 --> 00:10:05,960
Number one, I will say today, stocks net.
168
00:10:05,960 --> 00:10:06,960
Right.
169
00:10:06,960 --> 00:10:07,960
So, right.
170
00:10:07,960 --> 00:10:14,040
Stocks net and how they went about taking what was at that time just called a virus.
171
00:10:14,040 --> 00:10:15,040
Right.
172
00:10:15,040 --> 00:10:21,480
And took down a nuclear reactor, which was later revealed to be potentially a state
173
00:10:21,480 --> 00:10:22,480
sponsored attack.
174
00:10:22,480 --> 00:10:26,080
Like, look at the number of changes of it.
175
00:10:26,080 --> 00:10:31,200
In an industrial system that nobody really understands through a removal device that
176
00:10:31,200 --> 00:10:36,120
was an attack vector that people didn't understand as much yet from a threat actor that was state
177
00:10:36,120 --> 00:10:37,120
sponsored.
178
00:10:37,120 --> 00:10:39,880
Like, how does this, I've only heard of this in movies, Terminator or someone like that
179
00:10:39,880 --> 00:10:42,360
actually talks about governments getting involved.
180
00:10:42,360 --> 00:10:43,360
Right.
181
00:10:43,360 --> 00:10:44,360
This is real.
182
00:10:44,360 --> 00:10:46,560
Stocks net just made the whole thing real.
183
00:10:46,560 --> 00:10:47,880
That was number, event number one.
184
00:10:47,880 --> 00:10:53,280
And that's when the whole concept of APT and an advanced persistent threat started getting
185
00:10:53,280 --> 00:10:54,280
popular.
186
00:10:54,280 --> 00:10:55,280
Right.
187
00:10:55,280 --> 00:10:56,280
Right.
188
00:10:56,280 --> 00:11:00,160
So, you know, then there was this whole marketing and thought about signature based AV not being
189
00:11:00,160 --> 00:11:04,160
good enough and malware is getting more and more popular.
190
00:11:04,160 --> 00:11:07,760
And then, you know, underground dark criminals, et cetera.
191
00:11:07,760 --> 00:11:11,920
Then the second event that changed a lot of things ransomware.
192
00:11:11,920 --> 00:11:17,200
Because now the thing with mount with viruses in general was it, it almost felt like you're
193
00:11:17,200 --> 00:11:19,640
doing it because you just want to tickle someone.
194
00:11:19,640 --> 00:11:20,640
Right.
195
00:11:20,640 --> 00:11:21,640
You want to annoy them.
196
00:11:21,640 --> 00:11:22,640
I mean, what are you really getting out of it?
197
00:11:22,640 --> 00:11:28,560
All you do, you are, it's not so easy to obviously go and get into every stocks in every time.
198
00:11:28,560 --> 00:11:30,120
But ransomware was simple enough.
199
00:11:30,120 --> 00:11:31,600
I encrypt your data.
200
00:11:31,600 --> 00:11:33,280
You want it back, pay me money.
201
00:11:33,280 --> 00:11:35,880
It became financially motivated.
202
00:11:35,880 --> 00:11:36,880
Right.
203
00:11:36,880 --> 00:11:41,520
And it didn't help that cryptocurrency just blew up at that time because that became
204
00:11:41,520 --> 00:11:45,840
the number one source for how these criminals are getting paid.
205
00:11:45,840 --> 00:11:48,160
So ransomware had its run for a long time.
206
00:11:48,160 --> 00:11:52,960
So evolution of malware evolution into ransomware that all has kind of changed the game quite
207
00:11:52,960 --> 00:11:53,960
a bit.
208
00:11:53,960 --> 00:11:59,640
And I think in the last couple of years, some things, some of that has started reducing.
209
00:11:59,640 --> 00:12:05,800
You know, a lot of those two events increased awareness and increased awareness all the
210
00:12:05,800 --> 00:12:11,080
way up to boards and businesses, at least for a large number of enterprise organizations
211
00:12:11,080 --> 00:12:14,560
to the point that investment in security became important.
212
00:12:14,560 --> 00:12:18,440
And as investments started increasing, it started getting harder for these attackers
213
00:12:18,440 --> 00:12:19,760
to get around.
214
00:12:19,760 --> 00:12:24,200
So what we're seeing now, and that some of that data is in our report is that volumes
215
00:12:24,200 --> 00:12:29,240
of ransomware are actually starting to dip a little bit.
216
00:12:29,240 --> 00:12:33,960
volumes of malware after five years are actually dipping as well.
217
00:12:33,960 --> 00:12:39,800
What is increasing is what I saw back in 2000, early 2000s, the traditional intrusion
218
00:12:39,800 --> 00:12:44,600
detections and vulnerability exploits on these environments.
219
00:12:44,600 --> 00:12:48,160
But the attack surface has changed.
220
00:12:48,160 --> 00:12:55,840
The pandemic has put people anywhere, has put data anywhere, has put applications anywhere,
221
00:12:55,840 --> 00:13:01,960
and has created an explosion of devices ranging from my laptop to my phone to my printer to
222
00:13:01,960 --> 00:13:10,960
my camera to my Alexa to my washing machine to my television to my home security system.
223
00:13:10,960 --> 00:13:14,000
And all of these could be attacked and compromise your machine.
224
00:13:14,000 --> 00:13:15,000
Why?
225
00:13:15,000 --> 00:13:18,560
Because I'm right now sitting at home on the same Wi-Fi as all these devices and one
226
00:13:18,560 --> 00:13:20,960
of them gets compromised, they can get to my laptop.
227
00:13:20,960 --> 00:13:26,480
Yeah, so you've touched on a couple of things that I wanted to discuss with you because I
228
00:13:26,480 --> 00:13:32,680
was very much interested in the proliferation of the Internet of Things.
229
00:13:32,680 --> 00:13:36,440
And when I got into the industry, that was just a pipe dream, right?
230
00:13:36,440 --> 00:13:40,520
So I started in cybersecurity in the 90s.
231
00:13:40,520 --> 00:13:45,560
You and I probably crossed paths because I was at Verizon and we were reselling logic
232
00:13:45,560 --> 00:13:56,160
calluses, managed services, and so I remember, I think it was Vincent Surf, who calls himself
233
00:13:56,160 --> 00:14:00,760
the grandfather of the Internet, speak about the proliferation of these devices.
234
00:14:00,760 --> 00:14:07,560
He tells a story about how his doctor wants to know when he weighs himself so the scale
235
00:14:07,560 --> 00:14:11,640
is going to be Internet enabled and then eventually your fridge will be Internet enabled to tell
236
00:14:11,640 --> 00:14:16,720
you what you need to shop for and what you're missing when you go low on eggs.
237
00:14:16,720 --> 00:14:21,320
And well, eventually he'll step on the scale, his scale will email his fridge and then he
238
00:14:21,320 --> 00:14:25,480
won't be able to open his fridge because he's gained too much weight.
239
00:14:25,480 --> 00:14:31,040
And we used to laugh about that back in the 2000s, but this is now becoming a reality.
240
00:14:31,040 --> 00:14:39,520
And like you said, all of these devices are sharing that same Wi-Fi, which now becomes
241
00:14:39,520 --> 00:14:40,720
an attack vector.
242
00:14:40,720 --> 00:14:45,240
It becomes a launching pad for future attacks.
243
00:14:45,240 --> 00:14:50,600
I mean, this is something that I was reading in the report, right?
244
00:14:50,600 --> 00:14:54,320
In your report, you're talking about the Internet of Things is really going to be that next
245
00:14:54,320 --> 00:14:57,520
wave of kind of what we have to protect.
246
00:14:57,520 --> 00:15:03,240
What can you share with our listeners that are some best practices when it comes to their
247
00:15:03,240 --> 00:15:09,560
corporate entity and protecting the mobility of all those devices you touched on laptops,
248
00:15:09,560 --> 00:15:12,960
but then there's data is growing feet and going everywhere.
249
00:15:12,960 --> 00:15:16,520
So what are some of those best practices that you could share with our listeners?
250
00:15:16,520 --> 00:15:17,520
Sure, sure.
251
00:15:17,520 --> 00:15:23,320
So I think a lot of the best practices isn't magic, right?
252
00:15:23,320 --> 00:15:26,360
It's really about hygiene.
253
00:15:26,360 --> 00:15:30,600
And I know it's a really overused word and a lot of people think, well, if I could figure
254
00:15:30,600 --> 00:15:33,480
out hygiene and patch management, then we never really have a problem.
255
00:15:33,480 --> 00:15:39,520
But the thing that I've seen the most, really the most important, and I want to hit on IoT
256
00:15:39,520 --> 00:15:46,560
for a second because that's relevant to this is because when IoT and its explosion started,
257
00:15:46,560 --> 00:15:51,400
most people looked at it as an enterprise problem to solve.
258
00:15:51,400 --> 00:15:56,800
But from the angle off, the IoT devices that you're using in your office, right?
259
00:15:56,800 --> 00:16:02,880
So as an example, I remember reading at a time, there were a series of attacks of how
260
00:16:02,880 --> 00:16:08,400
organizations got hacked because they were able to get into the building control system.
261
00:16:08,400 --> 00:16:10,800
Right?
262
00:16:10,800 --> 00:16:11,800
And that was connected.
263
00:16:11,800 --> 00:16:17,200
So that has happened and probably still can happen.
264
00:16:17,200 --> 00:16:22,440
But I think the change that's happened is that because of more people working remote, the
265
00:16:22,440 --> 00:16:25,960
attack surface is not that building control system.
266
00:16:25,960 --> 00:16:28,720
It is your personal device.
267
00:16:28,720 --> 00:16:32,640
So now the onus of hygiene has shifted.
268
00:16:32,640 --> 00:16:38,040
It's shifted from the admin of the enterprise to the end user.
269
00:16:38,040 --> 00:16:43,040
And as an end user sitting at home with my corporate laptop, my organization is not going
270
00:16:43,040 --> 00:16:48,640
to be able to do anything about my home Wi-Fi or my home devices.
271
00:16:48,640 --> 00:16:52,160
The best they can do is to keep my device secure.
272
00:16:52,160 --> 00:16:53,660
Right?
273
00:16:53,660 --> 00:16:56,480
So and I'll talk about that, what we could do in those measures as well.
274
00:16:56,480 --> 00:17:00,200
But as an end user, there are a few things that you really, really want to be careful
275
00:17:00,200 --> 00:17:01,200
about.
276
00:17:01,200 --> 00:17:02,200
Right?
277
00:17:02,200 --> 00:17:06,360
We talk about two different things that will work in the enterprise, but also work at home.
278
00:17:06,360 --> 00:17:14,160
Number one, never, ever, ever use default settings on devices.
279
00:17:14,160 --> 00:17:21,440
How many of you have logged into your D-Link router with admin admin?
280
00:17:21,440 --> 00:17:22,640
And it still works.
281
00:17:22,640 --> 00:17:24,240
Yeah, it's so true.
282
00:17:24,240 --> 00:17:27,760
So if you go to show that, it's just nuts.
283
00:17:27,760 --> 00:17:28,760
Right?
284
00:17:28,760 --> 00:17:31,240
You'll find so many writers out there and I'm sure you people could probably hack in the
285
00:17:31,240 --> 00:17:32,600
half of them.
286
00:17:32,600 --> 00:17:34,000
Right?
287
00:17:34,000 --> 00:17:38,880
So get rid of default settings, number one, number two, be extremely careful with your
288
00:17:38,880 --> 00:17:39,880
credentials.
289
00:17:39,880 --> 00:17:47,840
Please, please, please do not use your corporate password to log into Facebook or Instagram
290
00:17:47,840 --> 00:17:54,400
or something like that because that data will get leaked and you are done for it at that
291
00:17:54,400 --> 00:17:55,800
point.
292
00:17:55,800 --> 00:18:01,200
The third thing, we talk about micro segmentation a lot, but how many of us actually practice
293
00:18:01,200 --> 00:18:02,200
it at home?
294
00:18:02,200 --> 00:18:04,920
People actually have a firewall at home that will do micro segmentation.
295
00:18:04,920 --> 00:18:06,920
It's not a really common thing.
296
00:18:06,920 --> 00:18:07,920
Right?
297
00:18:07,920 --> 00:18:12,080
But the easiest thing you could do to actually separate some of this traffic is everybody's
298
00:18:12,080 --> 00:18:18,800
got broadband, high speed broadband and super high speed Wi-Fi routers at home, 5 gigahertz,
299
00:18:18,800 --> 00:18:23,480
2.5 and usually dual band, quad antenna, all that fun stuff.
300
00:18:23,480 --> 00:18:29,880
The least you could do is to keep two separate Wi-Fi networks, one for your personal devices
301
00:18:29,880 --> 00:18:31,720
and one for your corporate device.
302
00:18:31,720 --> 00:18:33,760
That's the least you could do.
303
00:18:33,760 --> 00:18:35,000
And it's very simple to do that.
304
00:18:35,000 --> 00:18:36,560
It's not rocket science.
305
00:18:36,560 --> 00:18:43,480
So I think at a personal level, making sure that we maintain our own hygiene of network
306
00:18:43,480 --> 00:18:47,800
and information security at home is going to be really, really important.
307
00:18:47,800 --> 00:18:50,240
Now where do enterprises come in place?
308
00:18:50,240 --> 00:18:54,200
So enterprises have to come into play because humans are humans.
309
00:18:54,200 --> 00:18:57,960
We all know that the biggest problem security is layer eight.
310
00:18:57,960 --> 00:19:00,400
So there have to be measures put in place.
311
00:19:00,400 --> 00:19:05,000
So obviously all the usual things, endpoint security has to be intact.
312
00:19:05,000 --> 00:19:08,240
I won't even say up to date because we're beyond signatures at this point.
313
00:19:08,240 --> 00:19:11,400
So it has to be intact, has to be covered.
314
00:19:11,400 --> 00:19:14,720
Zero trust is big.
315
00:19:14,720 --> 00:19:20,200
Never trust the fact that the user sitting at home with the corporate laptop is actually
316
00:19:20,200 --> 00:19:23,600
safe because the device could be infected.
317
00:19:23,600 --> 00:19:26,160
How do you know?
318
00:19:26,160 --> 00:19:30,600
You know because when you apply as your trust framework, you could use device posture.
319
00:19:30,600 --> 00:19:34,200
You could determine if the machine actually is infected or not and then you could restrict
320
00:19:34,200 --> 00:19:38,200
their access or block their access altogether.
321
00:19:38,200 --> 00:19:40,560
That's why endpoint security is important because you need to have coverage.
322
00:19:40,560 --> 00:19:43,000
You need a visibility.
323
00:19:43,000 --> 00:19:46,160
You need to be also able to make some of the hard decisions.
324
00:19:46,160 --> 00:19:50,680
Yes, everybody wants flexibility, but do you want to allow everybody to use all the personal
325
00:19:50,680 --> 00:19:53,200
devices to access all your corporate resources?
326
00:19:53,200 --> 00:19:54,440
Zero trust would say no.
327
00:19:54,440 --> 00:19:56,440
Why?
328
00:19:56,440 --> 00:19:57,440
Because you don't know what they're doing with their personal devices.
329
00:19:57,440 --> 00:20:01,400
Think about all the recent news you've been hearing about chat GPG apps that are fake
330
00:20:01,400 --> 00:20:02,400
but actually malware.
331
00:20:02,400 --> 00:20:07,440
I open up my phone and I go to my VPN, log in and I get my corporate data.
332
00:20:07,440 --> 00:20:11,160
There's all my customer data in it and well, I have an app here that's stealing all that
333
00:20:11,160 --> 00:20:12,160
data.
334
00:20:12,160 --> 00:20:13,160
Well, you're done for.
335
00:20:13,160 --> 00:20:17,480
Well, then don't allow them to get to that kind of data using your VPN.
336
00:20:17,480 --> 00:20:18,480
You want to use a VPN?
337
00:20:18,480 --> 00:20:22,000
Use the corporate laptop where we have a lot more control and visibility.
338
00:20:22,000 --> 00:20:23,000
I love BYOD.
339
00:20:23,000 --> 00:20:24,000
Absolutely.
340
00:20:24,000 --> 00:20:28,880
I totally love BYOD, but it has to be rolled out with discretion.
341
00:20:28,880 --> 00:20:32,200
Yeah, that's a really good point.
342
00:20:32,200 --> 00:20:36,680
I wanted to shift gears a little bit to talk a little bit about your experience in building
343
00:20:36,680 --> 00:20:44,080
security operation centers because a lot of our listeners are deciding whether they build
344
00:20:44,080 --> 00:20:53,720
a sock in the mid-market space and then the challenges with resources or out task that
345
00:20:53,720 --> 00:20:57,360
and go to a provider.
346
00:20:57,360 --> 00:21:02,680
In your opinion and your experience, when do you see there's a break even point where
347
00:21:02,680 --> 00:21:10,000
it actually makes sense for someone to build a sock or leverage a third party?
348
00:21:10,000 --> 00:21:18,000
I think really the break even comes in terms of how much of a budget are you willing to
349
00:21:18,000 --> 00:21:20,000
spend on tech and people?
350
00:21:20,000 --> 00:21:21,000
That's number one.
351
00:21:21,000 --> 00:21:22,800
That's a big thing, of course.
352
00:21:22,800 --> 00:21:28,000
That ties back to what is the financial motivation to actually do this?
353
00:21:28,000 --> 00:21:34,320
For example, if you look at cyber insurance, a few years back, it was really probably a
354
00:21:34,320 --> 00:21:36,400
thing of the enterprise organizations.
355
00:21:36,400 --> 00:21:40,920
The enterprises have bigger budgets and so they're able to go and invest in people process
356
00:21:40,920 --> 00:21:45,640
technology to build a stack that will give you security operations.
357
00:21:45,640 --> 00:21:48,960
Now, none of that is easy.
358
00:21:48,960 --> 00:21:52,760
Even process is not easy because people are going to ask you, well, how do I hunt for
359
00:21:52,760 --> 00:21:53,760
the latest thread?
360
00:21:53,760 --> 00:21:54,760
I don't know.
361
00:21:54,760 --> 00:21:55,760
You're the expert.
362
00:21:55,760 --> 00:22:00,240
You should know how to do that.
363
00:22:00,240 --> 00:22:02,440
Or well, what is the latest thread?
364
00:22:02,440 --> 00:22:03,440
I don't know.
365
00:22:03,440 --> 00:22:07,360
Well, how do I use XYZ sock tool to do that?
366
00:22:07,360 --> 00:22:08,480
I don't know.
367
00:22:08,480 --> 00:22:12,000
That's the real question that most people are making these investment decisions are going
368
00:22:12,000 --> 00:22:14,600
to be asking.
369
00:22:14,600 --> 00:22:18,520
Enterprise organizations have the money to go and buy the skill and they've done that
370
00:22:18,520 --> 00:22:22,160
in the past.
371
00:22:22,160 --> 00:22:26,120
Cyber insurance now making it down to the lower, I should say the mid-market here is
372
00:22:26,120 --> 00:22:30,080
an even maybe even to the some of this, you know, the upper end of SMB if you want to
373
00:22:30,080 --> 00:22:33,240
call it that, right?
374
00:22:33,240 --> 00:22:36,520
Has started to make it more urgent.
375
00:22:36,520 --> 00:22:38,440
Urgent to the fact that it's not just about time.
376
00:22:38,440 --> 00:22:40,200
I mean, not about money.
377
00:22:40,200 --> 00:22:41,640
It's about time as well.
378
00:22:41,640 --> 00:22:43,840
I can build a sock, but it'll take me 18 months.
379
00:22:43,840 --> 00:22:48,000
Well, am I going to be remaining unprotected without proper insurance or do I want to be
380
00:22:48,000 --> 00:22:51,440
paying those high premium rates of insurance for that much time?
381
00:22:51,440 --> 00:22:52,440
Not really.
382
00:22:52,440 --> 00:22:53,440
Right?
383
00:22:53,440 --> 00:23:01,560
So I think with mid-market and lower mid-market, I would highly recommend that start looking
384
00:23:01,560 --> 00:23:09,000
at providers first because the job of building a sock is a true sock, right?
385
00:23:09,000 --> 00:23:13,000
Now there are some providers who will say they have socks, but all they're really doing
386
00:23:13,000 --> 00:23:16,400
is managing firewall policies and deploying endpoint software.
387
00:23:16,400 --> 00:23:21,280
I mean, that is a function, potential function of the sock, but the real sock today is one
388
00:23:21,280 --> 00:23:23,600
that does detection response.
389
00:23:23,600 --> 00:23:27,520
People who can actually do true real-time detection response or near real-time detection
390
00:23:27,520 --> 00:23:30,560
response, that's really the one that actually runs the sock, right?
391
00:23:30,560 --> 00:23:32,680
24-7, all those things.
392
00:23:32,680 --> 00:23:37,120
A lot of MSPs don't want to get in that space because they don't have the money.
393
00:23:37,120 --> 00:23:38,680
These are not cash rich organizations.
394
00:23:38,680 --> 00:23:42,160
They run on recurring revenue and that's really where their profit really comes from, the
395
00:23:42,160 --> 00:23:44,160
month-to-month profits that they make.
396
00:23:44,160 --> 00:23:47,320
So they can't make big investments, right?
397
00:23:47,320 --> 00:23:52,880
They also have to pay now increased monthly amounts for insurance premiums because that's
398
00:23:52,880 --> 00:23:56,480
just, you know, if they don't have the insurance premium, the next attack that hits them, they
399
00:23:56,480 --> 00:24:01,120
have to pay out or they'll pay for all the data breaches that they've done, you're in
400
00:24:01,120 --> 00:24:02,560
trouble, right?
401
00:24:02,560 --> 00:24:08,880
So mid-market organizations are probably in a better place to start looking at providers
402
00:24:08,880 --> 00:24:14,380
who are specialists at this or who have already made the investments to build and run the
403
00:24:14,380 --> 00:24:20,360
sock, build the credibility, have the people and have probably also have the engineering
404
00:24:20,360 --> 00:24:27,080
layers to build productivity enhancements because with it, you can't just say, I'm going
405
00:24:27,080 --> 00:24:28,560
to hire 100 people and run a sock.
406
00:24:28,560 --> 00:24:30,680
It's not going to work.
407
00:24:30,680 --> 00:24:31,680
It's not going to be scalable.
408
00:24:31,680 --> 00:24:36,440
Well, yeah, not only that, but you're also competing with some of the largest organizations
409
00:24:36,440 --> 00:24:42,080
and institutions in the world that can pay better and then cybersecurity groups that
410
00:24:42,080 --> 00:24:45,400
are hiring away as well.
411
00:24:45,400 --> 00:24:48,000
So I wanted to, it's really good point.
412
00:24:48,000 --> 00:24:52,560
I also wanted to take a look at, you know, going back to the report that you guys have
413
00:24:52,560 --> 00:24:53,800
just published.
414
00:24:53,800 --> 00:24:59,680
I was reading the report and it looks like, you know, of the top data breaches from last
415
00:24:59,680 --> 00:25:05,000
year, the top five, it looks like three of them were government.
416
00:25:05,000 --> 00:25:10,360
And we do have a part of our listener base that are part of state, local, education,
417
00:25:10,360 --> 00:25:12,760
municipalities.
418
00:25:12,760 --> 00:25:17,840
What can you say about that trend that in the top, you know, five, three of them were
419
00:25:17,840 --> 00:25:23,840
large government, you know, entities that were breached last year?
420
00:25:23,840 --> 00:25:29,160
So I think with government entities getting breached, they're usually, I don't believe
421
00:25:29,160 --> 00:25:32,800
they're financially motivated because it's not like they can pack into a government agency
422
00:25:32,800 --> 00:25:35,840
and steal a bunch of money or ransomware them out to pay something.
423
00:25:35,840 --> 00:25:41,560
I mean, city of Atlanta or, you know, other states and cities that have been hacked similarly,
424
00:25:41,560 --> 00:25:46,120
that attackers aren't necessarily looking for the money from them.
425
00:25:46,120 --> 00:25:50,560
The bigger problem we have to be worried about is the nation state sponsor attacks.
426
00:25:50,560 --> 00:25:55,920
And if you look at what happened last year, you know, like for example, the, I guess it
427
00:25:55,920 --> 00:25:59,360
was a kill net attack that targeted hospitals in the US.
428
00:25:59,360 --> 00:26:03,680
It's this year, in fact, the late last year, this year.
429
00:26:03,680 --> 00:26:06,680
And they were not motivated by they want to get money from these organizations.
430
00:26:06,680 --> 00:26:17,800
It was determined that the motivation was purely going after countries that were geopolitically
431
00:26:17,800 --> 00:26:20,320
positioned against them.
432
00:26:20,320 --> 00:26:24,320
In this case, it was like the East European situation in the Ukraine war and things like
433
00:26:24,320 --> 00:26:25,320
that.
434
00:26:25,320 --> 00:26:26,320
Right.
435
00:26:26,320 --> 00:26:27,800
So they're not looking for financial motivation.
436
00:26:27,800 --> 00:26:33,480
They're looking to disrupt and deface governments and their credibility by getting into their
437
00:26:33,480 --> 00:26:34,480
networks.
438
00:26:34,480 --> 00:26:37,360
Now, it's not that that's not the only thing, right?
439
00:26:37,360 --> 00:26:41,400
So like when the pandemic happened, NHS got hit and all that, you know, some of the motivations
440
00:26:41,400 --> 00:26:44,080
were of course, you know, they're really vulnerable right now.
441
00:26:44,080 --> 00:26:46,240
This is the time to go and go after them, right?
442
00:26:46,240 --> 00:26:50,280
Want to cry and all shame, shame, shame on these actors for at that time to go after
443
00:26:50,280 --> 00:26:55,760
someone like NHS and use that as a crutch to make money.
444
00:26:55,760 --> 00:27:00,680
And I believe for a period, there was a bit of a unsaid agreement that during the pandemic,
445
00:27:00,680 --> 00:27:01,680
they won't go after hospitals.
446
00:27:01,680 --> 00:27:05,000
I'm not sure everybody actually followed that.
447
00:27:05,000 --> 00:27:11,960
So so government organizations should certainly be a little more worried and it goes all the
448
00:27:11,960 --> 00:27:12,960
way right to the bottom.
449
00:27:12,960 --> 00:27:16,920
Of course, they're holding citizen data and that is the challenge.
450
00:27:16,920 --> 00:27:24,760
So very recently, there was a reach reported right here in India, where in India, when
451
00:27:24,760 --> 00:27:31,360
you get a vaccination, there is an application that you can log into to sign up for a vaccination.
452
00:27:31,360 --> 00:27:34,240
That you get for your COVID essentially.
453
00:27:34,240 --> 00:27:39,400
It was an app that was developed in India with the investment from the Indian government
454
00:27:39,400 --> 00:27:42,640
and a breach has been reported in the application.
455
00:27:42,640 --> 00:27:47,760
The problem with this is that there's a lot of citizen data associated with this application,
456
00:27:47,760 --> 00:27:50,600
personally identify the information as well as personal health information.
457
00:27:50,600 --> 00:27:52,480
Are you vaccinated or not?
458
00:27:52,480 --> 00:27:56,400
What's your what we call the odd higher number, which is kind of like the social security number
459
00:27:56,400 --> 00:28:00,000
in the United States, a unique identity number essentially.
460
00:28:00,000 --> 00:28:05,120
So people are going after governments to get some of this data, maybe people are going
461
00:28:05,120 --> 00:28:08,120
after governments to deface their credibility.
462
00:28:08,120 --> 00:28:14,520
People are going after government agencies because they control nation state infrastructure.
463
00:28:14,520 --> 00:28:18,400
But very rarely are they really going after the fact that they want to make money.
464
00:28:18,400 --> 00:28:23,720
It's just because this is the new way of war.
465
00:28:23,720 --> 00:28:30,400
Yeah, with some other folks have been talking about this new concept of cyber warfare and
466
00:28:30,400 --> 00:28:37,760
how it's kind of changed the game a little bit and disrupting communication, disrupting
467
00:28:37,760 --> 00:28:45,000
the ability to everything seems to default to cyber.
468
00:28:45,000 --> 00:28:49,640
And that just becomes a part of the campaign in cyber warfare.
469
00:28:49,640 --> 00:28:53,640
I mean, how do you see this playing out of the over the next few years?
470
00:28:53,640 --> 00:28:57,080
I mean, do you have a I know you don't have a crystal ball, right?
471
00:28:57,080 --> 00:29:05,480
But but see things changing from a cyber warfare or even how mid market can compete with these
472
00:29:05,480 --> 00:29:12,040
nation states and these other large companies that are consuming mass amounts of the cyber
473
00:29:12,040 --> 00:29:15,840
resources right out of college.
474
00:29:15,840 --> 00:29:21,960
How can the mid market compete with with with that in this kind of new world order that
475
00:29:21,960 --> 00:29:25,440
we see in terms of like cyber attacks?
476
00:29:25,440 --> 00:29:33,480
So I think the big big sort of linchpin to make this a successful, you know, for organizations
477
00:29:33,480 --> 00:29:39,320
that can't actually throw all the money in the world is what we call an India PPP, which
478
00:29:39,320 --> 00:29:43,680
stands for public private partnership.
479
00:29:43,680 --> 00:29:49,440
If the mid markets can obviously withstand the might and the money of these nations,
480
00:29:49,440 --> 00:29:54,960
especially in sponsor state attacks, the people who can are the governments and the governments
481
00:29:54,960 --> 00:30:00,080
in hand with the larger enterprises, whether they're technology companies like ourselves
482
00:30:00,080 --> 00:30:05,880
or their enterprises that one massive security operation teams as well.
483
00:30:05,880 --> 00:30:12,320
Threat intelligence sharing through agencies like the FS Isaac or the retail Isaac are
484
00:30:12,320 --> 00:30:17,400
very effective mechanisms for sharing information about latest threat campaigns, what are those
485
00:30:17,400 --> 00:30:21,520
kind of patterns are seeing out there and what people should be looking out for.
486
00:30:21,520 --> 00:30:27,440
I actually applaud CISA for the amount of work they're doing to actually make that happen.
487
00:30:27,440 --> 00:30:32,760
Not just in the government, but they're actually working with private organizations as well
488
00:30:32,760 --> 00:30:38,440
to be able to share that kind of intelligence and provide advisories on being able to do
489
00:30:38,440 --> 00:30:40,040
these kinds of things.
490
00:30:40,040 --> 00:30:44,360
It's not a common trend that you see across many other organizations as or I should say
491
00:30:44,360 --> 00:30:52,640
other countries, cyber security as a real pillar in the government policy is not found
492
00:30:52,640 --> 00:30:54,640
in a lot of countries.
493
00:30:54,640 --> 00:31:00,760
In some countries, it's still very native or nascent, I should say.
494
00:31:00,760 --> 00:31:02,640
Whereas in others, it's very, very mature.
495
00:31:02,640 --> 00:31:07,600
I can't, I don't think I have enough geopolitical information to say whether the India or United
496
00:31:07,600 --> 00:31:09,720
States, where do they fit in that spectrum.
497
00:31:09,720 --> 00:31:12,960
But they're both doing pretty well in that space.
498
00:31:12,960 --> 00:31:18,320
The least you could do is have a national cert that keeps an eye on these things and
499
00:31:18,320 --> 00:31:23,160
lets you know which is what happens in India and what happens in the US as well.
500
00:31:23,160 --> 00:31:27,800
Public private partnership is really, really important.
501
00:31:27,800 --> 00:31:29,200
Second is everything else.
502
00:31:29,200 --> 00:31:30,720
Everything else still matters.
503
00:31:30,720 --> 00:31:34,920
All the best practices, the hygiene, continue to invest in being security.
504
00:31:34,920 --> 00:31:39,520
I think education to customers also becomes important, especially if you're a managed
505
00:31:39,520 --> 00:31:41,080
services provider.
506
00:31:41,080 --> 00:31:44,760
The challenge that a managed services provider is always going to have is, and this has been
507
00:31:44,760 --> 00:31:51,360
on for decades, is that if you think about information technology or applications or
508
00:31:51,360 --> 00:31:57,200
even cloud for that matter, it's really easy to quantify what the financial benefit is.
509
00:31:57,200 --> 00:32:04,200
Hey, I'll implement automation to save 10 people's jobs or I'll move my CRM from on-prem
510
00:32:04,200 --> 00:32:08,160
where I'm spending so much money on application and so I'll go to the cloud and cut my cost
511
00:32:08,160 --> 00:32:10,440
by X percent whatever it is.
512
00:32:10,440 --> 00:32:11,760
How do you quantify security?
513
00:32:11,760 --> 00:32:16,800
Because the only time you actually see the value is when a breach happens.
514
00:32:16,800 --> 00:32:21,480
So the closest thing, seemingly the closest thing that you can actually do to help quantify
515
00:32:21,480 --> 00:32:28,480
your security investment is an insurance premium.
516
00:32:28,480 --> 00:32:33,520
If I don't have the right security, my premium goes from, I don't know, $5,000 to $50,000.
517
00:32:33,520 --> 00:32:39,760
I don't have the money to pay that remaining $45,000, but if I invest 20,000 more, it
518
00:32:39,760 --> 00:32:41,920
keeps my premiums down.
519
00:32:41,920 --> 00:32:42,920
Simple math.
520
00:32:42,920 --> 00:32:43,920
Right?
521
00:32:43,920 --> 00:32:48,880
So, I mean, those are some ways and I think that's the hardest thing that organizations
522
00:32:48,880 --> 00:32:49,880
are going to have to do.
523
00:32:49,880 --> 00:32:55,800
So this, I like the fact that cyber insurance is being taken more and more seriously even
524
00:32:55,800 --> 00:33:00,400
as you go down from the highly regulated and large enterprise organizations because the
525
00:33:00,400 --> 00:33:06,960
least it's doing is making a financial business case for investing in security.
526
00:33:06,960 --> 00:33:14,960
No, it's really important what you just laid out because I think that is the challenge,
527
00:33:14,960 --> 00:33:15,960
right?
528
00:33:15,960 --> 00:33:23,040
Is there really is no return on investment of security until you have an incident.
529
00:33:23,040 --> 00:33:29,280
And some of our customers and partnerships, we find that they say, well, nothing's happened.
530
00:33:29,280 --> 00:33:33,040
You've told me all these things that could have happened but didn't happen.
531
00:33:33,040 --> 00:33:39,880
And now justifying or quantifying that to the CFO and the board where they're looking
532
00:33:39,880 --> 00:33:45,040
to reduce costs is somewhat of a challenge.
533
00:33:45,040 --> 00:33:51,960
So in a case like that, how do you recommend that quantification take place?
534
00:33:51,960 --> 00:33:56,360
I mean, how is it that you're, you know, the reports are great.
535
00:33:56,360 --> 00:33:59,400
I mean, third party attestation is always great, right?
536
00:33:59,400 --> 00:34:05,160
And a third party like Sonic wall say, this is what we're seeing.
537
00:34:05,160 --> 00:34:06,160
These are the trends.
538
00:34:06,160 --> 00:34:11,840
This is how you need to protect helps because then you go to your board or your CFO and say,
539
00:34:11,840 --> 00:34:15,760
we need to put these countermeasures in place to protect against this.
540
00:34:15,760 --> 00:34:20,640
Here's the increase in malware that, you know, a provider like Sonic wall is seeing.
541
00:34:20,640 --> 00:34:24,200
But how would you recommend those conversations take place?
542
00:34:24,200 --> 00:34:26,840
So it's what we're seeing as a trend, right?
543
00:34:26,840 --> 00:34:28,760
And it's very interesting.
544
00:34:28,760 --> 00:34:33,200
When we talk to our customers and partners, and I'm comparing this against what I've heard
545
00:34:33,200 --> 00:34:35,920
like some years ago, right?
546
00:34:35,920 --> 00:34:41,880
When you offer a security service, everybody, you know, is expecting or if you're, whether
547
00:34:41,880 --> 00:34:44,080
you're in-house or external, right?
548
00:34:44,080 --> 00:34:48,360
Your business stakeholders who are looking to invest in security are looking for some
549
00:34:48,360 --> 00:34:51,520
kind of a report, right?
550
00:34:51,520 --> 00:34:56,800
Weekly monthly something that says, you know, basically where you prove what you did.
551
00:34:56,800 --> 00:35:03,040
And back in the day, the expectation was that the report's going to come back saying, green,
552
00:35:03,040 --> 00:35:05,680
green, green, green, green, green, green, green, green, green, you're awesome, right?
553
00:35:05,680 --> 00:35:07,440
Which doesn't really mean that you actually did a great job.
554
00:35:07,440 --> 00:35:08,840
It probably means nothing happened.
555
00:35:08,840 --> 00:35:11,000
So you're going to do it.
556
00:35:11,000 --> 00:35:16,160
But what's changing now is that the kind of intelligence that our customers are expecting
557
00:35:16,160 --> 00:35:19,680
to see are the reports is not just that everything looks stupid.
558
00:35:19,680 --> 00:35:25,200
Show me that if something was green, it's because it was red and we changed your green.
559
00:35:25,200 --> 00:35:29,000
For example, there was a malware attack, but we took care of it.
560
00:35:29,000 --> 00:35:31,520
There was a surge in certain types of traffic.
561
00:35:31,520 --> 00:35:35,080
We found black IP, we blocked it.
562
00:35:35,080 --> 00:35:41,800
This level of intelligence and to be able to measure and report that school report is
563
00:35:41,800 --> 00:35:44,640
essentially what organizations are looking for.
564
00:35:44,640 --> 00:35:50,240
And, you know, we started off with a concept in Sonic wall that we call the risk meter,
565
00:35:50,240 --> 00:35:51,360
right?
566
00:35:51,360 --> 00:35:55,720
And the risk meter was essentially a mechanism to say, you know, we take our global threat
567
00:35:55,720 --> 00:36:04,440
intelligence and we compare that against what you, Mr. customer or Ms. customer have for
568
00:36:04,440 --> 00:36:08,720
security, at least from Sonic wall, and then eventually we expanded out for other products
569
00:36:08,720 --> 00:36:09,720
as well.
570
00:36:09,720 --> 00:36:10,720
So do you have a firewall?
571
00:36:10,720 --> 00:36:11,720
Do you have email security?
572
00:36:11,720 --> 00:36:14,040
Do you have endpoint on the email?
573
00:36:14,040 --> 00:36:17,280
Have you turned on anti-fishing, DLP on the endpoint?
574
00:36:17,280 --> 00:36:22,440
Have you turned on, you know, pre-execution, post-execution analysis, threat hunting capabilities,
575
00:36:22,440 --> 00:36:24,320
whatever it might be, right?
576
00:36:24,320 --> 00:36:29,640
And based on each of those controls that you're using, we calculate, you know, a score of
577
00:36:29,640 --> 00:36:32,120
how risky you are.
578
00:36:32,120 --> 00:36:37,320
Because what we're seeing is, well, last week we just saw the surge in attacks targeting
579
00:36:37,320 --> 00:36:43,240
endpoints where script based set, you know, protection would be very, very valuable because
580
00:36:43,240 --> 00:36:45,400
it's all fileless malware.
581
00:36:45,400 --> 00:36:50,320
But Mr. customer or Ms. customer, you don't, your script based detection engine is turned
582
00:36:50,320 --> 00:36:51,320
off.
583
00:36:51,320 --> 00:36:56,760
So you're at risk because there's an increasing volume hitting your endpoint and you're at
584
00:36:56,760 --> 00:36:57,760
risk.
585
00:36:57,760 --> 00:37:00,560
That's a problem.
586
00:37:00,560 --> 00:37:05,240
So this kind of mechanism, and I think the market is sort of calling it a cyber risk
587
00:37:05,240 --> 00:37:07,640
quantification or something of that sort, right?
588
00:37:07,640 --> 00:37:10,080
There's a few vendors out there playing in the space.
589
00:37:10,080 --> 00:37:13,160
Microsoft done a pretty good job with their platform with the Microsoft secure score.
590
00:37:13,160 --> 00:37:15,280
I got a hand into them, right?
591
00:37:15,280 --> 00:37:20,960
Similar concept in that through this dashboard of report now, you're not just seeing that
592
00:37:20,960 --> 00:37:22,120
it's green.
593
00:37:22,120 --> 00:37:25,120
It could be red, it could be orange, but you also see why.
594
00:37:25,120 --> 00:37:30,120
And you're also getting guidance on what should I do to fix this?
595
00:37:30,120 --> 00:37:31,320
Should I turn on a setting?
596
00:37:31,320 --> 00:37:34,680
Should I get a machine off my network?
597
00:37:34,680 --> 00:37:36,640
Should I turn off the setting?
598
00:37:36,640 --> 00:37:38,000
Should I implement something else?
599
00:37:38,000 --> 00:37:39,240
Or should I go patch a system?
600
00:37:39,240 --> 00:37:43,520
It's a combination of all those things that will ultimately result in, you know, a risk
601
00:37:43,520 --> 00:37:45,720
score for you.
602
00:37:45,720 --> 00:37:51,080
Yeah, I like to shift gears because, you know, one thing that I thought was really interesting
603
00:37:51,080 --> 00:37:59,240
about the report was the increase that you guys saw in PDF based attacks.
604
00:37:59,240 --> 00:38:06,280
And I found that interesting because I'm paranoid by nature, so I don't click on anything, whether
605
00:38:06,280 --> 00:38:07,960
it's a link or a document.
606
00:38:07,960 --> 00:38:11,960
If it's unsolicited, I'm always picking up the phone and calling someone, even internally.
607
00:38:11,960 --> 00:38:15,000
Hey, did you mean to send me this kind of document?
608
00:38:15,000 --> 00:38:18,920
And do you really need me to open it?
609
00:38:18,920 --> 00:38:25,520
So I'm noticing the report that there was like a 35% increase in these attacks.
610
00:38:25,520 --> 00:38:34,320
How can mid markets protect themselves from that being, you know, the attack vector that's
611
00:38:34,320 --> 00:38:36,920
used to penetrate the outer shell?
612
00:38:36,920 --> 00:38:44,360
I mean, PDFs are something that are commonplace, e-signature for contracting.
613
00:38:44,360 --> 00:38:49,840
How would you recommend that companies and organizations protect against that?
614
00:38:49,840 --> 00:38:51,840
Ultimately it has to be a layered approach, right?
615
00:38:51,840 --> 00:38:56,160
Because if you look at the way that they're trying to get to us, think of the journey
616
00:38:56,160 --> 00:38:58,560
of what that's happening over here.
617
00:38:58,560 --> 00:39:00,240
How, who's sending the PDF?
618
00:39:00,240 --> 00:39:04,520
It's usually someone who's like a potentially trusted user who compromised an account or
619
00:39:04,520 --> 00:39:06,800
a spoofing email account.
620
00:39:06,800 --> 00:39:08,440
If it's compromised, you have bigger problems.
621
00:39:08,440 --> 00:39:10,600
Let's, let's, we'll solve that.
622
00:39:10,600 --> 00:39:12,360
You know, so credential theft is a real problem.
623
00:39:12,360 --> 00:39:16,920
You've got to be able to identify if this is a real email address or not.
624
00:39:16,920 --> 00:39:23,080
Basic email social engineering techniques that get used like this can be easily averted
625
00:39:23,080 --> 00:39:25,920
by plain awareness training for your users.
626
00:39:25,920 --> 00:39:32,800
A lot of people are doing things like phishing simulations and email, you know, attack simulations
627
00:39:32,800 --> 00:39:33,800
on users.
628
00:39:33,800 --> 00:39:36,880
So, phishing is still, is one of the largest vectors for threats to organizations.
629
00:39:36,880 --> 00:39:40,280
And that's how these PDFs are getting to you, right?
630
00:39:40,280 --> 00:39:46,080
There's a segment of this that's coming out of like shared links from like a OneDrive.
631
00:39:46,080 --> 00:39:49,480
So I mean, I don't know what, you know, bit.ly, whatever it is.
632
00:39:49,480 --> 00:39:54,240
So I think it's suspicious, but what if it just says office.sonicwall.com because somehow
633
00:39:54,240 --> 00:39:58,480
somebody got access to somebody's OneDrive shared and hosted it over there.
634
00:39:58,480 --> 00:40:01,880
You still want to click on it, right?
635
00:40:01,880 --> 00:40:05,800
So that's a different problem and we need to solve and I'll talk about that in a second,
636
00:40:05,800 --> 00:40:06,800
right?
637
00:40:06,800 --> 00:40:09,880
So, but the first part is, and it feels like the last part, but the first one actually
638
00:40:09,880 --> 00:40:14,920
has to be get your use to be more aware about identifying that an email is bad or not.
639
00:40:14,920 --> 00:40:19,520
Now this is getting challenging because whether you like it or not, chatGPD is going to have
640
00:40:19,520 --> 00:40:22,600
a really bad influence on site security as well.
641
00:40:22,600 --> 00:40:27,600
Good one, but don't forget that the good people aren't the only one using it, right?
642
00:40:27,600 --> 00:40:29,640
Bad people are too.
643
00:40:29,640 --> 00:40:30,760
A lot more.
644
00:40:30,760 --> 00:40:37,360
So it's going to get probably a lot more easier to create an email that looks legitimate,
645
00:40:37,360 --> 00:40:40,280
but you know, put all kinds of stuff in it, right?
646
00:40:40,280 --> 00:40:41,280
Essentially.
647
00:40:41,280 --> 00:40:42,280
So back to the PDF.
648
00:40:42,280 --> 00:40:46,360
So now what happens is if let's say that they, the email is seems legitimate enough and they
649
00:40:46,360 --> 00:40:47,960
get it.
650
00:40:47,960 --> 00:40:52,760
Now as they get it, when it comes through your defenses, you need to have good email security
651
00:40:52,760 --> 00:40:56,960
that can catch these documents, can analyze these documents.
652
00:40:56,960 --> 00:41:00,920
So for example, with Capture ATP, if we pick up one of these documents, we throw it in,
653
00:41:00,920 --> 00:41:06,400
it goes into our Patenton real-time deep memory inspection that kind of tears it apart and
654
00:41:06,400 --> 00:41:11,920
finds a malicious URL or malicious script embedded in it and says, this is a bad file.
655
00:41:11,920 --> 00:41:14,680
This is the reason why we can find these things, right?
656
00:41:14,680 --> 00:41:17,280
And it's not easy, but it has to be done.
657
00:41:17,280 --> 00:41:20,520
And that's why we always encourage you to take advantage of Capture to be as much as
658
00:41:20,520 --> 00:41:21,520
you can.
659
00:41:21,520 --> 00:41:22,960
But you need that layer.
660
00:41:22,960 --> 00:41:27,560
And you need that layer first of the email to catch it when the email comes through.
661
00:41:27,560 --> 00:41:32,440
And then second, let's say the email does get through because you don't have the layer.
662
00:41:32,440 --> 00:41:37,480
User opens up the document and either clicks a URL or the document loads some kind of JavaScript
663
00:41:37,480 --> 00:41:40,800
which makes a call out to the bad world.
664
00:41:40,800 --> 00:41:42,080
Let's call it that.
665
00:41:42,080 --> 00:41:44,640
Then you need a second layer that will actually protect you from that.
666
00:41:44,640 --> 00:41:49,680
So whether it's content filtering, URL filtering that's driven by threat intelligence, or even
667
00:41:49,680 --> 00:41:56,000
the latest craze, which is DNS protection where domains don't even get resolved because
668
00:41:56,000 --> 00:41:59,640
it's a known bad domain.
669
00:41:59,640 --> 00:42:00,960
So that's the second sort of layer.
670
00:42:00,960 --> 00:42:04,760
Now let's say you don't have all that and whatever, you don't have the investment, so
671
00:42:04,760 --> 00:42:06,320
you don't have all that.
672
00:42:06,320 --> 00:42:11,240
You make the call, it hits your, something gets downloaded at that point, right?
673
00:42:11,240 --> 00:42:12,240
Because what's the point of this?
674
00:42:12,240 --> 00:42:13,880
The idea was to make an entry.
675
00:42:13,880 --> 00:42:14,880
What do you do then?
676
00:42:14,880 --> 00:42:18,880
So either you make a command and control call or download something malicious.
677
00:42:18,880 --> 00:42:20,880
That malicious thing then hits your endpoint.
678
00:42:20,880 --> 00:42:22,680
It could be file based, could be fileless.
679
00:42:22,680 --> 00:42:26,960
Either way, you need something on your endpoint to be able to find this.
680
00:42:26,960 --> 00:42:30,840
I'm not going to say that signatures aren't enough anymore because that's old school.
681
00:42:30,840 --> 00:42:33,960
But let's just say static analysis itself is not enough anymore.
682
00:42:33,960 --> 00:42:35,960
You need behavioral AI.
683
00:42:35,960 --> 00:42:40,760
Like what Capture Client has with Sentinel-1 Engine and similar technologies are coming
684
00:42:40,760 --> 00:42:42,040
up from other vendors as well.
685
00:42:42,040 --> 00:42:46,720
But the ability to do, to be able to identify suspicious behavior and then say, this is
686
00:42:46,720 --> 00:42:48,240
bad.
687
00:42:48,240 --> 00:42:53,400
Either it's on your endpoint that is trying to do, make a create persistence or trying
688
00:42:53,400 --> 00:42:58,760
to reach out to get credentials from your machine or maybe make a lack of movement to
689
00:42:58,760 --> 00:43:00,360
other machines as well.
690
00:43:00,360 --> 00:43:03,720
You need to be able to catch that and say, this is bad and blocking.
691
00:43:03,720 --> 00:43:04,840
Yeah.
692
00:43:04,840 --> 00:43:05,840
Great stuff.
693
00:43:05,840 --> 00:43:11,040
I really appreciate just the conversation.
694
00:43:11,040 --> 00:43:16,200
If there were two takeaways that you would recommend that our listeners do today, what
695
00:43:16,200 --> 00:43:17,200
would it be?
696
00:43:17,200 --> 00:43:22,320
And I know limiting it to two is a bit of a step.
697
00:43:22,320 --> 00:43:28,880
Honestly, I think for all users, because, and I said, I would recommend this takeaway
698
00:43:28,880 --> 00:43:32,920
for the simple reason that it's often ignored.
699
00:43:32,920 --> 00:43:39,320
And that is take a look around your house and see what devices are internet enabled.
700
00:43:39,320 --> 00:43:41,320
Are they okay?
701
00:43:41,320 --> 00:43:43,560
Are they patched?
702
00:43:43,560 --> 00:43:45,440
Are they running default settings?
703
00:43:45,440 --> 00:43:49,560
Are they on the same Wi-Fi as the same Wi-Fi that you use for connecting to your corporate
704
00:43:49,560 --> 00:43:50,560
VPN?
705
00:43:50,560 --> 00:43:53,640
Do something about it.
706
00:43:53,640 --> 00:43:58,200
I think I talked about what to do, but definitely do the right things about it.
707
00:43:58,200 --> 00:44:02,200
Get off the default settings, change the Wi-Fi that you're connecting to, make sure they're
708
00:44:02,200 --> 00:44:04,120
patched the latest.
709
00:44:04,120 --> 00:44:10,160
It's not easy, but the onus is on you as a user, not just as an admin.
710
00:44:10,160 --> 00:44:12,160
That's the number one thing.
711
00:44:12,160 --> 00:44:21,440
Number two thing I would recommend is absolutely, if you do not have already a partner or a capability,
712
00:44:21,440 --> 00:44:27,040
today start looking at partners that can offer you managed detection response.
713
00:44:27,040 --> 00:44:29,720
Someone like yourselves, it's you, right?
714
00:44:29,720 --> 00:44:36,280
We can offer the managed detection response services to help you stay asleep, not awake
715
00:44:36,280 --> 00:44:37,280
at night.
716
00:44:37,280 --> 00:44:39,840
I like that.
717
00:44:39,840 --> 00:44:43,080
I think we just found our next tagline.
718
00:44:43,080 --> 00:44:46,160
But Sarup, thank you very much.
719
00:44:46,160 --> 00:44:50,680
I want to encourage our listeners to go out and get Sonic Wall's Cyber Threat Report.
720
00:44:50,680 --> 00:44:52,560
It's a fantastic read.
721
00:44:52,560 --> 00:44:54,560
I learned so much.
722
00:44:54,560 --> 00:44:58,320
Sarup, thank you very much for your time.
723
00:44:58,320 --> 00:44:59,800
That's all for this episode.
724
00:44:59,800 --> 00:45:05,840
Make sure you take time to listen to our next episode of Logically Speaking and stay cyber-first
725
00:45:05,840 --> 00:45:12,840
and future ready.