KOPYA NG SALIN 🔗
WEBVTT
00:00:29.600 --> 00:00:31.839
Hello and welcome to Full Tech Ahead.
00:00:31.920 --> 00:00:37.679
I'm your host, Amanda Rosani, and I'm excited to be here today with Tom Scheffler, the security manager of CentOS.
00:00:37.840 --> 00:00:38.399
How are you doing?
00:00:38.719 --> 00:00:39.840
Wonderful, glad to be here.
00:00:40.159 --> 00:00:42.159
Happy to have you talking with me today.
00:00:42.320 --> 00:00:45.679
Um, so can you share a little bit about yourself and CentOS?
00:00:46.000 --> 00:00:47.920
What services does CentOS provide?
00:00:48.240 --> 00:00:49.439
It's a pretty broad variety.
00:00:49.600 --> 00:00:53.359
So uh uniforms, obviously, that was first and foremost.
00:00:53.679 --> 00:00:58.640
Fires, it's we've a tremendous amount of the fire division is just huge.
00:00:58.799 --> 00:01:05.439
Safety, we have a safety division, we have water, uh, sanitizer, everything you can think of.
00:01:05.519 --> 00:01:11.760
We in a ton of acquisitions, which are mostly fire, and they're looking for new lines to get into as well.
00:01:11.840 --> 00:01:13.599
But I'm not privy to that information.
00:01:13.760 --> 00:01:14.879
So wonderful.
00:01:15.120 --> 00:01:16.239
I hope that answers your question.
00:01:16.560 --> 00:01:16.879
Yes.
00:01:17.040 --> 00:01:25.200
Well, whenever I'm at these conferences, I like to find case studies and user experiences that I can share more about with my audience.
00:01:25.359 --> 00:01:29.920
And so I would love to hear about your experience.
00:01:30.159 --> 00:01:38.879
And I would like to start with what issues were you facing that made you look to Qualis?
00:01:39.359 --> 00:01:41.120
Oh, well, that's pretty easy.
00:01:41.280 --> 00:01:47.200
I mean, we were very disorganized when it comes to um vulnerability management.
00:01:47.359 --> 00:01:55.200
Now, I will tell you that Qual, I I've been with Synthos, I'm in my 10th year, so we already had Qualist when I started.
00:01:55.359 --> 00:02:02.319
So my boss, uh Greg Bowman, brought them on, brought Qualas on board with Centaz, but he was a one-man security team.
00:02:02.480 --> 00:02:10.800
So they brought me on, and then that's when we started to really get into the the Qualist platform uh and realize what we were facing.
00:02:10.960 --> 00:02:12.800
So we had a lot of challenges.
00:02:12.960 --> 00:02:14.319
The teams weren't on board.
00:02:14.400 --> 00:02:25.199
You know, we have the server teams and desktop teams and you know, production teams, and they all have servers in the production environment, or they're using them in just the the server environment in general.
00:02:25.280 --> 00:02:33.520
Uh, end users, some 23,000 end-user devices that just weren't really getting batched and weren't really being monitored properly.
00:02:33.680 --> 00:02:36.240
So that was kind of my goal is to keep that under control.
00:02:36.719 --> 00:02:37.039
Okay.
00:02:37.520 --> 00:02:45.759
And of course, I see this with any company when they're integrating some new technology to solve a problem.
00:02:45.919 --> 00:02:48.879
There's always bottlenecks or roadblocks.
00:02:49.120 --> 00:02:50.319
What did you experience?
00:02:50.719 --> 00:02:52.719
The biggest challenge is breaking old habits.
00:02:52.879 --> 00:02:55.520
Um, so I don't know how familiar you guys are.
00:02:55.599 --> 00:02:59.599
Well, I I guess I'll start with patching because that's the most recent thing, the challenge that we had.
00:02:59.840 --> 00:03:05.439
You know, teams get used to doing things a certain way, and changing that habit is difficult when they've been doing it for several years.
00:03:05.680 --> 00:03:11.039
And my goal was to get the business to work around patching instead of patching work around the business.
00:03:11.280 --> 00:03:14.400
So in order to do that, I had to get support from the leadership team.
00:03:14.560 --> 00:03:28.800
So I I met with the leadership team after coming to a Qualis conference and seeing a patch demo, and just to explain what what I wanted to do, which was roll it out, test it, see if it was worth its weight, and uh it turned out to be.
00:03:28.879 --> 00:03:29.919
So here we are.
00:03:31.199 --> 00:03:34.479
Another problem I often see is timeline.
00:03:34.800 --> 00:03:36.960
How quick was the turnaround for this?
00:03:37.039 --> 00:03:39.919
And when did when did you see it working?
00:03:40.240 --> 00:03:44.560
So my exposure again was a QSC before it was rock on, and that was Greg Dabowski.
00:03:44.719 --> 00:03:48.719
He was uh he's a former Qualos employee, and he's the one that said give it a shot.
00:03:48.800 --> 00:03:50.719
So we did how long?
00:03:51.280 --> 00:04:01.439
Man, relatively quickly, only because our CISO was uh so directly involved, and we had meetings with uh various teams, you know, server team, desktop team, etc.
00:04:02.000 --> 00:04:08.800
And you know, I stated what our goal was in terms of accomplishing patching and getting you know criticals under control.
00:04:08.879 --> 00:04:15.439
And uh he set a goal of like patching all critical patches within 24 hours, and everybody just dropped their chins drop.
00:04:16.000 --> 00:04:17.920
And and he just said, get used to it.
00:04:18.000 --> 00:04:21.600
That's the new that's the new SLA for critical vulnerabilities.
00:04:21.839 --> 00:04:29.759
And everybody was frustrated, and you know, but you know, very honestly, it's just people don't adjust to change very well.
00:04:29.920 --> 00:04:34.560
And once they adopted to change, now it's just it's just everyday business.
00:04:34.959 --> 00:04:38.800
So it probably took 60, 90 days, roughly.
00:04:39.279 --> 00:04:40.560
So fairly quick.
00:04:40.800 --> 00:04:54.319
Now, for other leaders out there who are looking for solutions to their problems, always what I've noticed too is there might be some adjustments or adaptation you have to do once everything is in place.
00:04:54.560 --> 00:04:59.279
Were there any
Load full transcript
things that you had to go back and adjust or change for it to work properly for you?
00:04:59.680 --> 00:05:00.240
Oh, sure.
00:05:00.399 --> 00:05:00.639
Yeah.
00:05:00.800 --> 00:05:02.160
Uh we discovered a lot of problem.
00:05:02.480 --> 00:05:05.519
I mean, I'll give you an example with a lot of legacy applications.
00:05:05.680 --> 00:05:08.160
Um, I I can I'll speak about Java.
00:05:08.879 --> 00:05:17.120
It's it's a horrible, horrible code, but um, they update it frequently, and we had a lot of legacy applications running on Java.
00:05:17.600 --> 00:05:20.240
And uh when we would patch it would break that.
00:05:20.560 --> 00:05:26.079
So we realized that since it's a production environment, we had to roll back the patching.
00:05:26.160 --> 00:05:29.680
But what we did was we introduced the RAF, the risk risk acceptance form.
00:05:30.240 --> 00:05:37.519
So the owner of that particular application had to sign that and asked the CIO and the CISO to sign it.
00:05:37.600 --> 00:05:43.839
And the odds of the CIO assisto signing it without some sort of timeline tied to it were near zero.
00:05:44.079 --> 00:05:47.759
So it forced the update of a lot of a lot of the legacy applications.
00:05:47.920 --> 00:05:54.879
Um and the business is trying to push forward, so getting them to backpedal and update things was the challenge.
00:05:55.199 --> 00:06:00.800
But we had, you know, bi-weekly meetings to see what the progress was with that particular partner.
00:06:01.040 --> 00:06:02.720
And the first couple of times there's no progress.
00:06:02.800 --> 00:06:05.360
And he goes, Well, the next time we patch this, we're not rolling it back.
00:06:05.439 --> 00:06:08.160
So, you know, you need to be thinking about what you're gonna do to update this.
00:06:08.240 --> 00:06:09.920
So we really had to drive them.
00:06:10.079 --> 00:06:15.120
Uh, and once we got there and we had the, you know, we got them in the mindset that they knew there was a problem.
00:06:15.279 --> 00:06:18.319
The rest of the teams that knew they had legacy stuff started to hear about it.
00:06:18.399 --> 00:06:26.240
So they they got after it before we got to some of their some of their applications, not all Java, but there's, you know, that's the one example I'm sharing.
00:06:26.480 --> 00:06:26.800
Okay.
00:06:27.120 --> 00:06:31.439
Now it seems like it's really critical for all the stakeholders to be on board.
00:06:31.680 --> 00:06:38.319
What advice do you have as far as communication and having good keeping those channels open and communicating effectively?
00:06:38.720 --> 00:06:40.800
Well, I think you have to have you have to meet with the teams.
00:06:41.279 --> 00:06:44.480
And first of all, you have to have leadership support, um, and which I did.
00:06:44.560 --> 00:06:53.040
I had the CIO and the system at the time in the meetings in the beginning, they were involved and they sat down and I said my piece, and this is what the goal is, this is what we want to do.
00:06:53.120 --> 00:06:59.839
We set new SLAs from patching daily to weekly, still bi-weekly, uh monthly, depending on what it was.
00:07:00.000 --> 00:07:06.720
Uh, we made some exceptions for some production devices, and with the exception of critical vulnerabilities, they got patched.
00:07:06.800 --> 00:07:07.199
That was it.
00:07:07.360 --> 00:07:17.920
I mean, if there was a critical, we sent out an email, we have a distribution list, it gets hit, and everybody in the beginning would stomp their feet, you know, we had a patch tonight and validate tonight, but you know, now it's just commonplace.
00:07:18.079 --> 00:07:22.000
So once they get used to it, it's just normal, it's business as usual.
00:07:22.399 --> 00:07:23.040
Absolutely.
00:07:23.279 --> 00:07:29.360
Well, as you know, all these technologies, especially AI, are advancing so rapidly.
00:07:29.600 --> 00:07:35.839
So for your company specifically, what are you looking at next as far as how to harness the technology?
00:07:36.319 --> 00:07:42.240
In terms of AI, well, uh we're still looking for an AI tool to support what we're doing.
00:07:42.399 --> 00:07:46.720
Not that we don't have something that we're using now, but uh we want something we can use long term.
00:07:47.600 --> 00:07:52.399
So, you know, the issue is you're using AI to battle AI.
00:07:52.560 --> 00:07:58.879
You know, the threat actors are now what it from click to compromise, I think it's seven minutes where it used to be.
00:07:59.040 --> 00:08:00.720
Click to compromise was 21.
00:08:00.879 --> 00:08:03.279
So AI has reduced that window significantly.
00:08:03.439 --> 00:08:17.519
So if you're not patched and you're not using Qualists and you're not paying attention to the vulnerabilities and the criticals, the threat actors are taking advantage of um basically the partners, the end user, because they'll and email still remains our number one threat factor.
00:08:17.839 --> 00:08:25.120
But what you're seeing now, what versus what you used to see is the spelling errors and the things that would give the phishing emails away.
00:08:25.279 --> 00:08:26.639
We don't see that anymore.
00:08:26.959 --> 00:08:36.320
So now we have to tell people, you know, if if you don't know who it came from or it's not a familiar, you know, it and the other problem is too, you have compromised customers.
00:08:36.720 --> 00:08:42.240
We don't run security for a million plus customers, so we get compromised customers.
00:08:42.399 --> 00:08:49.200
So we have a supplier, a supplier list that we have visibility into through another platform that helps us with that.
00:08:49.600 --> 00:08:55.440
Yeah, and I feel like that's almost worse, is when your customers get compromised.
00:08:56.000 --> 00:09:02.720
It is because if they get compromised and they have a list of Cyntos partners, they can certainly send those emails up, but we catch most of them.
00:09:03.039 --> 00:09:04.639
Every now and then a few get through.
00:09:04.799 --> 00:09:13.039
But most of the time, you know, the URL's been stripped of anything malicious before it gets to the partners when they click on it, they get a they get a 404 error.
00:09:13.519 --> 00:09:16.000
Well, what's next on the horizon for CentOS?
00:09:16.320 --> 00:09:44.240
To continue to grow and mitigate, uh, true risk eliminate is the platform that we are currently, you know, rolling out and trying to get everybody familiar with because you know it patchless patching is what you're calling it, but it's it's really removing the ability for a threat actor to take advantage of something that there's not a patch for, whether it's closing a port, putting quotes in a in a code pass somewhere to to eliminate the gap so they can't uh get privileged access to a host device.
00:09:44.399 --> 00:09:47.440
I mean, there's a number of things you can do with mitigate to try to help you with that.
00:09:47.600 --> 00:09:56.879
So and then you know, the the score kind of drives what we do, but we don't look at the score as much as we do the vulnerabilities and the ability, you know, the ability to take advantage of it.
00:09:56.960 --> 00:10:04.639
And it may be a vulnerability that is um risky, but if it's not an internet-facing device, it's not quite as critical, right?
00:10:04.720 --> 00:10:05.919
So it really kind of depends.
00:10:06.000 --> 00:10:07.759
So I I hope that answers your question.
00:10:08.399 --> 00:10:16.000
So for teams and business leaders in a similar position, what is the key takeaway you can leave them with today?
00:10:16.399 --> 00:10:17.600
Get on board.
00:10:17.919 --> 00:10:18.879
Because it's happening.
00:10:18.960 --> 00:10:23.759
We bought it, we own it, uh, we're moving in that direction, and you can roll with us or get rolled over.
00:10:23.919 --> 00:10:27.120
I mean, I I'd not we're not rude about it.
00:10:27.200 --> 00:10:30.799
It sounds that way, but uh everybody's old on what the program.
00:10:30.879 --> 00:10:42.480
They understand that it's really it's just a business priority, and we're we're here to protect the business and make sure they can generate revenue in a safe way, keep our partners up and operating and operating safely.
00:10:42.799 --> 00:10:43.440
Absolutely.
00:10:43.600 --> 00:10:45.679
Well, thank you so much for coming here to speak with me today.
00:10:46.000 --> 00:10:46.320
Of course.
00:10:46.480 --> 00:10:47.519
Hope I answered all your questions.
00:10:47.759 --> 00:10:48.000
Yes.
00:10:48.080 --> 00:10:49.200
And thank you to our audience.
00:10:49.360 --> 00:10:51.360
If you have any questions or comments, leave them below.
00:10:51.440 --> 00:10:53.840
As usual, I'll respond back as fast as possible.
00:10:54.000 --> 00:10:55.279
Have a great day.