1
00:00:00,000 --> 00:00:12,720
Welcome to Logically Speaking, where we discuss the latest trends and challenges in cybersecurity
2
00:00:12,720 --> 00:00:15,440
with the top experts in their field.
3
00:00:15,440 --> 00:00:19,640
You're going to learn how to keep your data safe, your operations sound, and your business
4
00:00:19,640 --> 00:00:21,600
ready for whatever comes next.
5
00:00:21,600 --> 00:00:23,840
This is Logically Speaking.
6
00:00:23,840 --> 00:00:27,400
Today we're speaking with Ben Denkers of Quiet AI.
7
00:00:27,400 --> 00:00:31,440
And Ben, thank you so much for spending some time with us today.
8
00:00:31,440 --> 00:00:36,360
Wanted to just start out by asking if you wouldn't mind sharing your role and your experience
9
00:00:36,360 --> 00:00:37,360
in cybersecurity.
10
00:00:37,360 --> 00:00:38,360
Yeah, absolutely.
11
00:00:38,360 --> 00:00:39,840
Steve, I appreciate the opportunity.
12
00:00:39,840 --> 00:00:41,520
It was great to catch up.
13
00:00:41,520 --> 00:00:43,640
As Steve mentioned, my name is Ben Denkers.
14
00:00:43,640 --> 00:00:48,320
I'm the Chief Services Officer here at Quiet AI.
15
00:00:48,320 --> 00:00:53,520
My background has been in security consulting for the last 20 years with an emphasis on application
16
00:00:53,520 --> 00:00:57,720
security, incident response, and overall risk management.
17
00:00:57,720 --> 00:01:05,000
I have had the pleasure of working in all industries, finance, manufacturing, healthcare,
18
00:01:05,000 --> 00:01:11,960
helping organizations not only identify vulnerabilities and potential risks, but helping them mature
19
00:01:11,960 --> 00:01:14,840
their security and application programs.
20
00:01:14,840 --> 00:01:16,760
So it's great to be here, Steve.
21
00:01:16,760 --> 00:01:17,760
Yeah.
22
00:01:17,760 --> 00:01:24,320
Why don't we start out just by starting with why is it that you specifically wanted to
23
00:01:24,320 --> 00:01:32,920
work in DevSecOps, a rather unique niche part of cybersecurity, and wondering why wasn't
24
00:01:32,920 --> 00:01:36,840
that attracted you to DevSecOps?
25
00:01:36,840 --> 00:01:40,640
For me, maybe it's a glutton for punishment, I suppose.
26
00:01:40,640 --> 00:01:45,520
But realistically speaking, I think the more appropriate answer is if you take a look at
27
00:01:45,520 --> 00:01:52,920
applications in risk in general, where fundamentally they begin is within coding.
28
00:01:52,920 --> 00:01:56,840
So you can have vulnerabilities without an application, and you can have an application
29
00:01:56,840 --> 00:01:59,920
without doing development of said application.
30
00:01:59,920 --> 00:02:06,200
And so for me, figuring out where I can have the most impact on change, DevSecOps is a great
31
00:02:06,200 --> 00:02:11,240
example of where I would want to start.
32
00:02:11,240 --> 00:02:16,800
As somebody who's interested in APSEC security, they want to have the most positive impact
33
00:02:16,800 --> 00:02:21,200
as it relates to security or maturity of an organization.
34
00:02:21,200 --> 00:02:26,760
And you mentioned vulnerabilities in the application arena.
35
00:02:26,760 --> 00:02:31,760
What are some of the greatest weaknesses that you see today that companies are struggling
36
00:02:31,760 --> 00:02:34,840
with addressing or identifying?
37
00:02:34,840 --> 00:02:38,120
What are some of those weakest areas in that arena?
38
00:02:38,120 --> 00:02:42,880
Yeah, I mean, that's a very long list, but I'll give you some ideas.
39
00:02:42,880 --> 00:02:49,720
I think for some of the top of mind that are, I should say, some of those weaknesses that
40
00:02:49,720 --> 00:02:55,520
come or at the top of mind include things like lack of security awareness and training.
41
00:02:55,520 --> 00:03:00,400
You have developers and other stakeholders that may not be well-versed in secure coding
42
00:03:00,400 --> 00:03:02,760
standards and the latest threats.
43
00:03:02,760 --> 00:03:07,000
Obviously, if you're not, then this can lead to security vulnerabilities being inadvertently
44
00:03:07,000 --> 00:03:08,840
introduced in applications.
45
00:03:08,840 --> 00:03:14,720
So you're writing code, you're not sure how to most effectively write code in a secure
46
00:03:14,720 --> 00:03:21,920
manner and that results down the line into vulnerabilities and potential compromises.
47
00:03:21,920 --> 00:03:27,200
I think also a lot of organizations have inadequate security policies and processes.
48
00:03:27,200 --> 00:03:33,920
This can be clearly defined security programs or APSEC programs.
49
00:03:33,920 --> 00:03:39,080
These are all examples of areas of weakness that a lot of organizations have, especially
50
00:03:39,080 --> 00:03:41,800
if they're doing active development.
51
00:03:41,800 --> 00:03:47,480
I think if you take a look at the security testing of the applications within the environment
52
00:03:47,480 --> 00:03:53,360
as well, oftentimes organizations aren't doing enough primarily due to resource constraints,
53
00:03:53,360 --> 00:03:58,840
but relying solely on manual testing and not conducting security testing at all obviously
54
00:03:58,840 --> 00:04:04,680
results in vulnerabilities going undetected, putting applications at risk as well.
55
00:04:04,680 --> 00:04:12,800
If we move into kind of the more generic security controls, we often find that a lot of organizations
56
00:04:12,800 --> 00:04:16,640
have controls that are in place that aren't properly configured.
57
00:04:16,640 --> 00:04:21,720
Misconfiguration of those controls such as your typical firewalls, access controls, even
58
00:04:21,720 --> 00:04:28,640
encryption settings often leave application vulnerable to attack as well.
59
00:04:28,640 --> 00:04:34,320
In development or DevSecOps, a lot of times developers are relying on third-party components
60
00:04:34,320 --> 00:04:39,680
and we find all the time that many applications that rely on those third-party libraries or
61
00:04:39,680 --> 00:04:44,840
components often introduce vulnerabilities that the organization isn't even aware of.
62
00:04:44,840 --> 00:04:50,400
They're leveraging something as part of their code base that is obviously potentially vulnerable
63
00:04:50,400 --> 00:04:56,440
as well, yet they don't have the ability or skill set to identify prior to being introduced
64
00:04:56,440 --> 00:05:00,000
into the application.
65
00:05:00,000 --> 00:05:05,360
Other areas that I could talk about are things like legacy systems, outdated technology, and
66
00:05:05,360 --> 00:05:07,840
just more standard process.
67
00:05:07,840 --> 00:05:14,920
Think about how instant response within an app sec environment might play into effect.
68
00:05:14,920 --> 00:05:19,160
So an application gets compromised, do the organizations have those instant response
69
00:05:19,160 --> 00:05:24,560
plans in place in order to properly identify or be able to respond to those instances?
70
00:05:24,560 --> 00:05:26,600
How quickly can that code be changed?
71
00:05:26,600 --> 00:05:29,360
Oftentimes that's not a trivial thing.
72
00:05:29,360 --> 00:05:35,080
You have applications that have complex APIs and those APIs introduce risk.
73
00:05:35,080 --> 00:05:40,040
And then lastly, one of the biggest challenges that we see is just culture in general.
74
00:05:40,040 --> 00:05:46,240
So think about it like organizational culture, a culture that does not prioritize security
75
00:05:46,240 --> 00:05:51,880
or really foster collaboration between not only the development or engineering teams,
76
00:05:51,880 --> 00:05:59,040
but the security teams often hinder the effectiveness that that organization, that organization's
77
00:05:59,040 --> 00:06:05,360
application security or DevSecOps program, how effective it is from a general perspective.
78
00:06:05,360 --> 00:06:13,920
Yeah, I wanted to just interject something because in my experience, I find that developers
79
00:06:13,920 --> 00:06:23,360
typically want to provide an end user experience that's easy to use, the user interface is
80
00:06:23,360 --> 00:06:29,160
accessible, but security isn't always front of mind.
81
00:06:29,160 --> 00:06:31,120
Do you find that as a challenge as well?
82
00:06:31,120 --> 00:06:36,320
And how do you suggest that people address that during the secure lifecycle development
83
00:06:36,320 --> 00:06:37,560
of an application?
84
00:06:37,560 --> 00:06:42,040
Well, I think sometimes you have competing priorities or the perception of competing
85
00:06:42,040 --> 00:06:47,240
priorities, but at the end of the day, when you realize and you have this collaborate,
86
00:06:47,240 --> 00:06:51,880
you have this environment of collaboration between security, between product and between
87
00:06:51,880 --> 00:06:57,400
the business needs, I think if you have that open form and are discussing what do the developers
88
00:06:57,400 --> 00:07:02,240
need in order to do their job the best that they can, what does security need, and how
89
00:07:02,240 --> 00:07:07,360
do we apply the resources to ensure complete coverage that everybody gets what they want?
90
00:07:07,360 --> 00:07:10,280
I think that's really the best answer.
91
00:07:10,280 --> 00:07:17,640
And as easy as that, putting that into practice obviously can be more difficult, but ultimately
92
00:07:17,640 --> 00:07:22,280
it's about recognizing what the business needs are and then adjusting priorities based on
93
00:07:22,280 --> 00:07:23,280
that.
94
00:07:23,280 --> 00:07:26,680
Yeah, I appreciate you mentioning that.
95
00:07:26,680 --> 00:07:33,840
I want our listeners to know because I'd love for you to explain kind of this concept of
96
00:07:33,840 --> 00:07:40,360
DevSecOps and how it differs from the more traditional DevOps practices, right?
97
00:07:40,360 --> 00:07:46,080
Because I think it's an evolution, but I want to get your kind of your opinion on how you
98
00:07:46,080 --> 00:07:49,960
would explain that concept between DevSecOps and traditional DevOps.
99
00:07:49,960 --> 00:07:50,960
Yeah, for sure.
100
00:07:50,960 --> 00:07:56,360
I mean, DevSecOps is really the integration of security practices into the DevOps process,
101
00:07:56,360 --> 00:07:57,520
right?
102
00:07:57,520 --> 00:08:02,120
It's aiming to kind of make security an integral part of that software development and deployment
103
00:08:02,120 --> 00:08:03,120
lifecycle.
104
00:08:03,120 --> 00:08:08,720
So, traditional DevOps focus on collaboration between development and operation teams, whereas
105
00:08:08,720 --> 00:08:11,360
DevSecOps brings security into the mix.
106
00:08:11,360 --> 00:08:16,200
Really the point of that is to enable kind of this continuous concept of security throughout
107
00:08:16,200 --> 00:08:18,560
the development process.
108
00:08:18,560 --> 00:08:19,560
That's great.
109
00:08:19,560 --> 00:08:20,560
Thanks.
110
00:08:20,560 --> 00:08:26,720
I want to do a little shift because I know that your company, Quiet AI, is very much focused
111
00:08:26,720 --> 00:08:30,440
on the integration of artificial intelligence.
112
00:08:30,440 --> 00:08:37,120
So can you talk a little bit about the role that AI plays in that integration of security
113
00:08:37,120 --> 00:08:41,080
practices along with kind of AppSecDevSecOps lifecycle?
114
00:08:41,080 --> 00:08:42,280
Yeah, absolutely.
115
00:08:42,280 --> 00:08:44,440
So for us, AI is the future, right?
116
00:08:44,440 --> 00:08:50,520
It's not even like there's no question, which is why we've developed as part of our product
117
00:08:50,520 --> 00:08:57,080
models that allow us to enhance security by finding what we would like to call pre-zero
118
00:08:57,080 --> 00:08:58,680
vulnerabilities, right?
119
00:08:58,680 --> 00:09:04,840
So the idea is if we're so early in the development process in terms of being able to analyze code
120
00:09:04,840 --> 00:09:09,040
and to identify vulnerabilities, that we want to identify those vulnerabilities before they
121
00:09:09,040 --> 00:09:12,680
even become zero days, let alone anything else.
122
00:09:12,680 --> 00:09:19,360
And one of the ways that we do that is leveraging advanced AI models that allow us to not only
123
00:09:19,360 --> 00:09:25,800
be more effective, but scalable, especially with organizations that have thousands of
124
00:09:25,800 --> 00:09:29,880
applications, large code bases, et cetera.
125
00:09:29,880 --> 00:09:33,560
So this is just something that came up.
126
00:09:33,560 --> 00:09:41,600
Is that then becoming even more predictive than what your traditional kind of signature-based
127
00:09:41,600 --> 00:09:43,680
systems are able to detect?
128
00:09:43,680 --> 00:09:46,840
Are you anticipating those?
129
00:09:46,840 --> 00:09:48,280
It's night and day different, right?
130
00:09:48,280 --> 00:09:54,360
So from our perspective, the efficiency that the models are getting in terms of not only
131
00:09:54,360 --> 00:10:00,240
vulnerability identification, but just the reduction in false positives is absolutely
132
00:10:00,240 --> 00:10:01,240
fantastic.
133
00:10:01,240 --> 00:10:06,840
And so think about if you're doing a manual code review as an example, all of the opportunities
134
00:10:06,840 --> 00:10:11,040
that the human element or human error could potentially introduce.
135
00:10:11,040 --> 00:10:18,600
And so while you have to have a person reviewing code in this particular example, if you're
136
00:10:18,600 --> 00:10:21,920
reviewing a million lines of code, that's not going to be very efficient.
137
00:10:21,920 --> 00:10:23,640
It's going to take a long time.
138
00:10:23,640 --> 00:10:29,520
But if you can train models and have applications that do the heavy lifting for you, imagine
139
00:10:29,520 --> 00:10:33,040
the amount of coverage that you're going to be able to have.
140
00:10:33,040 --> 00:10:37,760
And then you have the reliability of the AI model to identify those vulnerabilities.
141
00:10:37,760 --> 00:10:41,360
It's really the way of the future, in my opinion.
142
00:10:41,360 --> 00:10:45,160
And you talk a little bit about that a little bit further.
143
00:10:45,160 --> 00:10:49,040
How are AI-powered tools enhancing that security?
144
00:10:49,040 --> 00:10:55,280
You mentioned it, can you give a couple of examples of maybe beta testers, customers
145
00:10:55,280 --> 00:11:00,040
of yours that are actually utilizing that to enhance their security?
146
00:11:00,040 --> 00:11:06,600
Yeah, so today we have AI built into the product as it is.
147
00:11:06,600 --> 00:11:11,520
And so anyone who's leveraging the product has that capability.
148
00:11:11,520 --> 00:11:16,200
Quiet AI specifically evaluates code during the development process.
149
00:11:16,200 --> 00:11:21,800
So we want to make it easier to address potential issues, find vulnerabilities very early on
150
00:11:21,800 --> 00:11:24,040
in that development process.
151
00:11:24,040 --> 00:11:30,320
So we integrate within the CIDI pipeline, analyze essentially large code bases, not
152
00:11:30,320 --> 00:11:37,440
only quickly but accurately, leveraging AI as part of that process to ensure security
153
00:11:37,440 --> 00:11:40,160
is built in from a continuous perspective.
154
00:11:40,160 --> 00:11:43,040
And then we also highlight what vulnerabilities are reachable.
155
00:11:43,040 --> 00:11:48,240
And I think that's primarily one of the coolest things that we offer other than the AI is
156
00:11:48,240 --> 00:11:55,440
you have a lot of, you might have a lot of vulnerabilities or issues that you might identify
157
00:11:55,440 --> 00:11:57,960
as part of kind of static code analysis.
158
00:11:57,960 --> 00:12:02,800
But not everything is necessarily exploitable or reachable within the application.
159
00:12:02,800 --> 00:12:07,120
And so we kind of take it a step further and say, hey, we've identified all of these thousands
160
00:12:07,120 --> 00:12:12,960
of vulnerabilities that you need to address, but then we help prioritize leveraging obviously
161
00:12:12,960 --> 00:12:20,760
AI and then the concept of reachability to have a tailored focus view on what an organization
162
00:12:20,760 --> 00:12:25,040
needs to do to fix from a prioritization perspective.
163
00:12:25,040 --> 00:12:31,440
You brought up an interesting topic and I want to kind of shift the conversation into
164
00:12:31,440 --> 00:12:37,160
the maturation of the security application program.
165
00:12:37,160 --> 00:12:43,720
If you could share, so our listeners can learn what make up the key components of a mature
166
00:12:43,720 --> 00:12:49,240
application security program, how do they work together to maintain that robust security?
167
00:12:49,240 --> 00:12:51,560
Yeah, I mean, there's a lot, right?
168
00:12:51,560 --> 00:12:58,720
But I would say the key components include things like a well-defined security policy.
169
00:12:58,720 --> 00:13:02,120
You have threat modeling, secure coding practices.
170
00:13:02,120 --> 00:13:04,800
Obviously security testing plays a role.
171
00:13:04,800 --> 00:13:09,840
Just monitoring, you have all of the kind of ancillary services as well, like things
172
00:13:09,840 --> 00:13:12,720
like instant response and ongoing training.
173
00:13:12,720 --> 00:13:17,720
To me, these components work together to really create a comprehensive and proactive approach
174
00:13:17,720 --> 00:13:21,840
to not only application security, but DevSecOps in general.
175
00:13:21,840 --> 00:13:29,320
And with the ultimate goal of obviously reducing vulnerabilities and risk and help if the organization
176
00:13:29,320 --> 00:13:35,920
happens to be compromised by a vulnerability, then you have a clear set of processes or
177
00:13:35,920 --> 00:13:41,200
in place like from an instant response perspective to quickly identify and then mediate.
178
00:13:41,200 --> 00:13:42,200
That's fantastic.
179
00:13:42,200 --> 00:13:48,200
And how does Quiet AI help organizations kind of assess their maturity?
180
00:13:48,200 --> 00:13:53,440
Let's say they have an existing application security program.
181
00:13:53,440 --> 00:13:57,520
How can you walk in and assess that and help them mature that?
182
00:13:57,520 --> 00:13:58,640
Yeah, absolutely.
183
00:13:58,640 --> 00:14:03,720
So part of our consulting practice is really around helping organizations evolve or mature
184
00:14:03,720 --> 00:14:09,160
their application security or DevSecOps programs or practices.
185
00:14:09,160 --> 00:14:14,320
And we do that by really leveraging NIST and OWASP frameworks to evaluate how effective
186
00:14:14,320 --> 00:14:21,480
what they're doing today is and if there are gaps that might exist as it relates to things
187
00:14:21,480 --> 00:14:23,800
like best practices.
188
00:14:23,800 --> 00:14:28,520
Really we're looking at processes in place, technology, what training is happening.
189
00:14:28,520 --> 00:14:35,720
And then kind of like the collaboration between security and engineering to help steer or build
190
00:14:35,720 --> 00:14:39,080
a roadmap for those organizations to say, OK, these are the types of things that you
191
00:14:39,080 --> 00:14:43,280
need to do in order to have a more effective and more mature program.
192
00:14:43,280 --> 00:14:48,000
And here's either the resources or technologies that you can implement to kind of solve some
193
00:14:48,000 --> 00:14:49,600
of those systemic issues.
194
00:14:49,600 --> 00:14:53,440
Yeah, that's a great point.
195
00:14:53,440 --> 00:14:59,400
Can you discuss a little bit more about how a company could take advantage of various
196
00:14:59,400 --> 00:15:05,200
types of consulting services if they're looking to improve or build an actual application
197
00:15:05,200 --> 00:15:06,360
security program?
198
00:15:06,360 --> 00:15:10,560
Yeah, I mean, so so app second DevSecOps is full of opportunities, right?
199
00:15:10,560 --> 00:15:16,040
I mean, most organizations, you know, they have minimal skill sets, but really the biggest
200
00:15:16,040 --> 00:15:17,960
challenge is just resources.
201
00:15:17,960 --> 00:15:23,560
And so, you know, consulting opportunities include things like security assessments,
202
00:15:23,560 --> 00:15:28,760
gap analysis, policy development, risk assessments, pen testing, threat modeling.
203
00:15:28,760 --> 00:15:31,680
I mean, the list is really goes on and on and on.
204
00:15:31,680 --> 00:15:36,440
But the goal here is really to not only, you know, help assess where an organization is
205
00:15:36,440 --> 00:15:42,720
and kind of that maturity, you know, of the program, but also potentially help them assess
206
00:15:42,720 --> 00:15:49,560
the technical aspects of maybe their applications, their environment, their users, to really
207
00:15:49,560 --> 00:15:54,480
identify, first of all, do they have the proper security controls in place?
208
00:15:54,480 --> 00:15:59,720
And second, how effective are those security controls in protecting against various types
209
00:15:59,720 --> 00:16:01,840
of risks and threats, et cetera?
210
00:16:01,840 --> 00:16:03,440
No, that's great.
211
00:16:03,440 --> 00:16:06,040
I appreciate you sharing it.
212
00:16:06,040 --> 00:16:16,560
In your opinion, Ben, why should an organization invest in AppSec or DevSecOps and maybe even
213
00:16:16,560 --> 00:16:19,960
talk about kind of the barriers of entry?
214
00:16:19,960 --> 00:16:21,160
Why wouldn't they?
215
00:16:21,160 --> 00:16:24,440
So first, why should they and then why wouldn't they?
216
00:16:24,440 --> 00:16:29,280
Well, I would say the first thing, and this again, long list, but you have it's really
217
00:16:29,280 --> 00:16:31,480
to protect since sensitive data, right?
218
00:16:31,480 --> 00:16:36,800
I mean, you know, applications often handle sensitive data such as PII, maybe financial
219
00:16:36,800 --> 00:16:40,480
transactions, you know, or even IP.
220
00:16:40,480 --> 00:16:45,000
Investing in AppSec and DevSecOps helps really protect this data from obviously unauthorized
221
00:16:45,000 --> 00:16:49,440
access, potential breaches, ensuring, you know, maybe even ensuring compliance with data
222
00:16:49,440 --> 00:16:54,880
protection regulations and really ultimately maintaining customer trust, right?
223
00:16:54,880 --> 00:17:00,160
But if you want to talk about a little further than that, right, you have things like mitigating
224
00:17:00,160 --> 00:17:01,960
security risks, right?
225
00:17:01,960 --> 00:17:08,360
You have improving deployment efficiency, you know, so by integrating security practices
226
00:17:08,360 --> 00:17:14,120
within the deployment process, DevSecOps specifically can help kind of identify and resolve some
227
00:17:14,120 --> 00:17:15,800
of those issues earlier.
228
00:17:15,800 --> 00:17:21,720
So for investing in security and DevSecOps is identifying vulnerabilities and threats
229
00:17:21,720 --> 00:17:26,840
prior to, say, an application going live, well, the downstream effects of that are just
230
00:17:26,840 --> 00:17:31,800
multiplied, right, because now you're identifying vulnerabilities before it even reaches a production
231
00:17:31,800 --> 00:17:38,840
stage and therefore the users aren't impacted, the data is impacted and your risk of compromise
232
00:17:38,840 --> 00:17:41,600
is significantly obviously goes down as well.
233
00:17:41,600 --> 00:17:46,640
And so, you know, ultimately, like, if you're going to build it, build it right and introducing
234
00:17:46,640 --> 00:17:53,560
security as early as possible in any program or process, just overall helps ensure that
235
00:17:53,560 --> 00:17:57,520
DevSecOps customers can trust what you're doing, so on and so forth.
236
00:17:57,520 --> 00:17:58,520
Yeah.
237
00:17:58,520 --> 00:18:03,880
I want to pivot a little bit on and talk a little bit about data privacy rights.
238
00:18:03,880 --> 00:18:13,200
And you're aware, lots of states are coming out with regulations about data privacy.
239
00:18:13,200 --> 00:18:21,600
How does application security address the data privacy rights or things like GDPR in your
240
00:18:21,600 --> 00:18:22,600
opinion?
241
00:18:22,600 --> 00:18:28,480
Yeah, so, I mean, obviously, application security really or really app sec programs in general
242
00:18:28,480 --> 00:18:33,440
should ensure that the sense of data such as PI is, you know, like encrypted both in
243
00:18:33,440 --> 00:18:39,680
transit and, you know, at rest and you have those kind of basic blocking and tackling.
244
00:18:39,680 --> 00:18:44,720
But you also have application security that controls things like access control, right?
245
00:18:44,720 --> 00:18:51,320
And so those applications making sure that, you know, when proper access control or making
246
00:18:51,320 --> 00:18:55,960
sure that I should say access control is properly implemented also helps ensure that only obviously
247
00:18:55,960 --> 00:18:59,920
authorized individuals can access or modify data.
248
00:18:59,920 --> 00:19:05,240
You know, these are all types of things that help ensure the safety and integrity of the
249
00:19:05,240 --> 00:19:06,480
data itself, right?
250
00:19:06,480 --> 00:19:12,840
So secure storage, you've got obviously privacy by design where you might be incorporating
251
00:19:12,840 --> 00:19:19,120
privacy considerations, whether they are regulatory or not, into the application process from
252
00:19:19,120 --> 00:19:20,120
the beginning, right?
253
00:19:20,120 --> 00:19:25,240
And so again, if we take a look at where, you know, if you want to have the most effective
254
00:19:25,240 --> 00:19:30,560
app sec or DevSecOps program, and in this case, privacy by design, doing that from the beginning
255
00:19:30,560 --> 00:19:36,440
really helps establish, you know, what needs to be done when and where, right?
256
00:19:36,440 --> 00:19:42,160
And so it really helps allow if you if you want to follow the concept of privacy by design
257
00:19:42,160 --> 00:19:46,280
to do it from the beginning because it gets so much harder if you're trying to bolt it
258
00:19:46,280 --> 00:19:47,280
on later.
259
00:19:47,280 --> 00:19:53,120
And I would also say like data minimization is also another big deal, right?
260
00:19:53,120 --> 00:19:58,920
So as it relates to privacy, being able to ensure that the application in question, right,
261
00:19:58,920 --> 00:20:03,360
is only collecting minimal data, it's only retaining minimal data, and you're not, you
262
00:20:03,360 --> 00:20:09,560
know, introducing additional risk by collecting too much and storing it in proper mechanisms,
263
00:20:09,560 --> 00:20:11,640
I should say.
264
00:20:11,640 --> 00:20:21,080
You know, I was thinking about and interested in your thoughts about application development
265
00:20:21,080 --> 00:20:28,400
in cloud infrastructures and or, you know, infrastructure as a service, does that introduce
266
00:20:28,400 --> 00:20:36,440
any inherent vulnerabilities or security concerns if it's done in the cloud versus on-prem?
267
00:20:36,440 --> 00:20:39,640
Do you see a difference in that at all?
268
00:20:39,640 --> 00:20:45,320
So I mean, anytime you're talking about the cloud, you have your own set of security concerns
269
00:20:45,320 --> 00:20:46,320
as well, right?
270
00:20:46,320 --> 00:20:50,320
So there's certainly going to be additional things that organizations need to look at
271
00:20:50,320 --> 00:20:55,960
in order to, you know, maintain a secure environment.
272
00:20:55,960 --> 00:21:00,600
And so that could be things like how are developers accessing that particular environment?
273
00:21:00,600 --> 00:21:05,880
Do you have things like defense and depth strategy or using two-fact authentication,
274
00:21:05,880 --> 00:21:11,360
you know, principle of least privilege, right, into those environments?
275
00:21:11,360 --> 00:21:15,840
But now think about, you know, from a cloud perspective, you have generally a larger attack
276
00:21:15,840 --> 00:21:21,160
service you have to worry about and, you know, more accessibility, which makes the efficiency
277
00:21:21,160 --> 00:21:26,920
go up, but potentially also, right, if that environment were to be compromised, it has
278
00:21:26,920 --> 00:21:31,520
its own set of unique, what I would call unique issues that organizations have to be prepared
279
00:21:31,520 --> 00:21:33,520
to deal with.
280
00:21:33,520 --> 00:21:39,080
Yeah, I want to ask you about zero-day attacks.
281
00:21:39,080 --> 00:21:43,480
And I just, you know, I read a report recently that found like 83% of all applications that
282
00:21:43,480 --> 00:21:52,400
were tested by this one provider over 85,000 had at least one security flaw.
283
00:21:52,400 --> 00:22:01,120
And this one provider found over 10 million flaws in the 85,000 that they tested.
284
00:22:01,120 --> 00:22:07,680
There's tons of gaps in application security, which I, that's why you're in the space.
285
00:22:07,680 --> 00:22:16,400
But how would a company, or how would you suggest a company identify zero-day?
286
00:22:16,400 --> 00:22:21,800
Is there a way to prevent that zero-day attack that's not, you know, that exploit that is
287
00:22:21,800 --> 00:22:24,560
not quite, you know, in the wild yet?
288
00:22:24,560 --> 00:22:29,080
Yeah, I mean, for us, we, like I said, I think I mentioned at the beginning, you know, we
289
00:22:29,080 --> 00:22:33,240
kind of coined this concept of pre-zero, which is a little bit cheeky.
290
00:22:33,240 --> 00:22:40,000
But the idea here is, is like leveraging quiet AI as part of a, you know, part of your application
291
00:22:40,000 --> 00:22:46,440
or DevSecOps process ultimately allows us to identify vulnerabilities before they become
292
00:22:46,440 --> 00:22:47,440
vulnerabilities, right?
293
00:22:47,440 --> 00:22:52,920
And essentially before they become a zero-day, you know, that an attacker might have identified
294
00:22:52,920 --> 00:22:58,120
and is now leveraging to compromise, you know, that particular application.
295
00:22:58,120 --> 00:23:03,000
But, you know, outside of that, more generically speaking, you know, preventing zero-day attacks
296
00:23:03,000 --> 00:23:09,120
can obviously be challenging due to the nature, you know, of that most organizations don't
297
00:23:09,120 --> 00:23:12,360
have the proper SDLC processes in place.
298
00:23:12,360 --> 00:23:15,120
They don't have mature DevSecOps processes in place.
299
00:23:15,120 --> 00:23:19,520
So a lot of these get missed during the development cycle, right?
300
00:23:19,520 --> 00:23:25,040
And so my recommendation is, is that if you, if you focus your efforts during that, you
301
00:23:25,040 --> 00:23:32,040
know, as far left as possible during the development phase, you're able to identify potential issues
302
00:23:32,040 --> 00:23:34,640
before they become, you know, large headaches.
303
00:23:34,640 --> 00:23:38,320
And so if you can do that in pre-production, well, guess what?
304
00:23:38,320 --> 00:23:43,080
You've just now potentially saved your organization within an application, right, of having a
305
00:23:43,080 --> 00:23:48,240
vulnerability that could potentially be exploited or compromised.
306
00:23:48,240 --> 00:23:54,880
And so for me, like the focus really needs to be in DevSecOps or, you know, the SDLC process
307
00:23:54,880 --> 00:23:58,000
in terms of identifying and helping prevent that.
308
00:23:58,000 --> 00:24:00,240
Yeah, that's a great point.
309
00:24:00,240 --> 00:24:01,240
All right.
310
00:24:01,240 --> 00:24:05,080
I've got two more for you.
311
00:24:05,080 --> 00:24:12,160
What are the top three challenges in AppSec that you would say would help our listeners
312
00:24:12,160 --> 00:24:15,600
if they had to prioritize?
313
00:24:15,600 --> 00:24:18,920
Because as you said, there's a plethora of challenges that are out there.
314
00:24:18,920 --> 00:24:25,840
And if there are just three that in this space for application security, if they addressed,
315
00:24:25,840 --> 00:24:27,840
they would be better off than most.
316
00:24:27,840 --> 00:24:28,840
Okay.
317
00:24:28,840 --> 00:24:33,280
So I would say like my number one would be integrating security into the development
318
00:24:33,280 --> 00:24:34,280
lifecycle, right?
319
00:24:34,280 --> 00:24:40,680
Because I think that if organizations do that properly, then a lot of the downstream effects
320
00:24:40,680 --> 00:24:43,760
of application vulnerabilities goes away, right?
321
00:24:43,760 --> 00:24:47,600
Because if we can identify it before it becomes production and we can identify it in code and
322
00:24:47,600 --> 00:24:54,080
we're doing things based upon a set of best practices, it inherently helps ensure that
323
00:24:54,080 --> 00:24:56,280
the application is more secure.
324
00:24:56,280 --> 00:25:01,160
And so, you know, making sure that those security practices are seamlessly integrated into the
325
00:25:01,160 --> 00:25:04,840
SDLC process is obviously challenging.
326
00:25:04,840 --> 00:25:09,280
But to me, it's one of the most important things that an organization has to get right.
327
00:25:09,280 --> 00:25:13,520
I would say the second thing, and you kind of touched on it right at the beginning was
328
00:25:13,520 --> 00:25:15,760
is balancing speed and security.
329
00:25:15,760 --> 00:25:21,120
And so, you know, I think there's the concept of managing the business requirements, but
330
00:25:21,120 --> 00:25:26,800
I think also DevSecOps needs to kind of deliver secure applications at a rapid pace, just
331
00:25:26,800 --> 00:25:33,120
in order to make sure that, you know, the organization is meeting those business requirements.
332
00:25:33,120 --> 00:25:36,160
But the challenge is like, what is that right balance, right?
333
00:25:36,160 --> 00:25:37,160
Between speed and security.
334
00:25:37,160 --> 00:25:42,720
And that is often something difficult that organizations struggle with.
335
00:25:42,720 --> 00:25:49,040
But if you can, you know, if organizations, you know, really they should ensure that security
336
00:25:49,040 --> 00:25:51,760
measures do not slow down the development process.
337
00:25:51,760 --> 00:25:56,680
And that's why like QuietAI and building into the kind of that CIDI pipeline and doing it
338
00:25:56,680 --> 00:26:02,840
continuously helps make sure that its, you know, applications can get reviewed and pushed
339
00:26:02,840 --> 00:26:06,120
to code or pushed to production much more quickly.
340
00:26:06,120 --> 00:26:10,080
But obviously that would be probably one of the second things that I would highlight.
341
00:26:10,080 --> 00:26:15,120
And then third, I would say managing third party components.
342
00:26:15,120 --> 00:26:20,920
Applications often rely on kind of those third party libraries and components, which often
343
00:26:20,920 --> 00:26:25,520
times introduce security vulnerabilities, especially if they're not being managed.
344
00:26:25,520 --> 00:26:30,080
And ensuring that all of those kind of third party components are vetted, securely configured
345
00:26:30,080 --> 00:26:35,040
and kept up to date is really essential for reducing kind of security breaches.
346
00:26:35,040 --> 00:26:38,160
Because, you know, developers like to save time, right?
347
00:26:38,160 --> 00:26:40,200
And then it goes back to the speed thing.
348
00:26:40,200 --> 00:26:46,080
And so often they're using snippets of code or libraries that may already have vulnerabilities.
349
00:26:46,080 --> 00:26:51,160
And, you know, introducing that into their applications, obviously, it becomes problematic
350
00:26:51,160 --> 00:26:52,160
very quickly.
351
00:26:52,160 --> 00:26:53,160
Yeah.
352
00:26:53,160 --> 00:26:54,160
No, great point.
353
00:26:54,160 --> 00:26:57,160
Thank you for sharing that.
354
00:26:57,160 --> 00:26:58,160
Final question here.
355
00:26:58,160 --> 00:27:04,160
If you have one kind of tagline for QuietAI, what would it be?
356
00:27:04,160 --> 00:27:05,160
Oh, that's funny.
357
00:27:05,160 --> 00:27:08,800
You know, we hushed the noise and amplified DevSecOps.
358
00:27:08,800 --> 00:27:11,160
That would be kind of my response.
359
00:27:11,160 --> 00:27:13,320
But yeah, for sure.
360
00:27:13,320 --> 00:27:19,680
Our goal really at QuietAI is to, you know, kind of silence the noise and squire, but
361
00:27:19,680 --> 00:27:27,680
amplify DevSec's opportunity and ability to identify vulnerabilities quickly and to ultimately
362
00:27:27,680 --> 00:27:29,840
make the organization more secure.
363
00:27:29,840 --> 00:27:30,840
Excellent.
364
00:27:30,840 --> 00:27:35,600
Ben, thank you very much for taking the time to kind of educate our listeners, but also
365
00:27:35,600 --> 00:27:38,040
sharing just your insights and your experience.
366
00:27:38,040 --> 00:27:41,600
And I want to just thank you for taking the time to be with us.
367
00:27:41,600 --> 00:27:43,520
Well, that's all for this episode.
368
00:27:43,520 --> 00:28:01,400
Make sure you tune in next time to Logically Speaking and Stay Cyber First and Future Ready.
00:00:00,000 --> 00:00:12,720
Welcome to Logically Speaking, where we discuss the latest trends and challenges in cybersecurity
2
00:00:12,720 --> 00:00:15,440
with the top experts in their field.
3
00:00:15,440 --> 00:00:19,640
You're going to learn how to keep your data safe, your operations sound, and your business
4
00:00:19,640 --> 00:00:21,600
ready for whatever comes next.
5
00:00:21,600 --> 00:00:23,840
This is Logically Speaking.
6
00:00:23,840 --> 00:00:27,400
Today we're speaking with Ben Denkers of Quiet AI.
7
00:00:27,400 --> 00:00:31,440
And Ben, thank you so much for spending some time with us today.
8
00:00:31,440 --> 00:00:36,360
Wanted to just start out by asking if you wouldn't mind sharing your role and your experience
9
00:00:36,360 --> 00:00:37,360
in cybersecurity.
10
00:00:37,360 --> 00:00:38,360
Yeah, absolutely.
11
00:00:38,360 --> 00:00:39,840
Steve, I appreciate the opportunity.
12
00:00:39,840 --> 00:00:41,520
It was great to catch up.
13
00:00:41,520 --> 00:00:43,640
As Steve mentioned, my name is Ben Denkers.
14
00:00:43,640 --> 00:00:48,320
I'm the Chief Services Officer here at Quiet AI.
15
00:00:48,320 --> 00:00:53,520
My background has been in security consulting for the last 20 years with an emphasis on application
16
00:00:53,520 --> 00:00:57,720
security, incident response, and overall risk management.
17
00:00:57,720 --> 00:01:05,000
I have had the pleasure of working in all industries, finance, manufacturing, healthcare,
18
00:01:05,000 --> 00:01:11,960
helping organizations not only identify vulnerabilities and potential risks, but helping them mature
19
00:01:11,960 --> 00:01:14,840
their security and application programs.
20
00:01:14,840 --> 00:01:16,760
So it's great to be here, Steve.
21
00:01:16,760 --> 00:01:17,760
Yeah.
22
00:01:17,760 --> 00:01:24,320
Why don't we start out just by starting with why is it that you specifically wanted to
23
00:01:24,320 --> 00:01:32,920
work in DevSecOps, a rather unique niche part of cybersecurity, and wondering why wasn't
24
00:01:32,920 --> 00:01:36,840
that attracted you to DevSecOps?
25
00:01:36,840 --> 00:01:40,640
For me, maybe it's a glutton for punishment, I suppose.
26
00:01:40,640 --> 00:01:45,520
But realistically speaking, I think the more appropriate answer is if you take a look at
27
00:01:45,520 --> 00:01:52,920
applications in risk in general, where fundamentally they begin is within coding.
28
00:01:52,920 --> 00:01:56,840
So you can have vulnerabilities without an application, and you can have an application
29
00:01:56,840 --> 00:01:59,920
without doing development of said application.
30
00:01:59,920 --> 00:02:06,200
And so for me, figuring out where I can have the most impact on change, DevSecOps is a great
31
00:02:06,200 --> 00:02:11,240
example of where I would want to start.
32
00:02:11,240 --> 00:02:16,800
As somebody who's interested in APSEC security, they want to have the most positive impact
33
00:02:16,800 --> 00:02:21,200
as it relates to security or maturity of an organization.
34
00:02:21,200 --> 00:02:26,760
And you mentioned vulnerabilities in the application arena.
35
00:02:26,760 --> 00:02:31,760
What are some of the greatest weaknesses that you see today that companies are struggling
36
00:02:31,760 --> 00:02:34,840
with addressing or identifying?
37
00:02:34,840 --> 00:02:38,120
What are some of those weakest areas in that arena?
38
00:02:38,120 --> 00:02:42,880
Yeah, I mean, that's a very long list, but I'll give you some ideas.
39
00:02:42,880 --> 00:02:49,720
I think for some of the top of mind that are, I should say, some of those weaknesses that
40
00:02:49,720 --> 00:02:55,520
come or at the top of mind include things like lack of security awareness and training.
41
00:02:55,520 --> 00:03:00,400
You have developers and other stakeholders that may not be well-versed in secure coding
42
00:03:00,400 --> 00:03:02,760
standards and the latest threats.
43
00:03:02,760 --> 00:03:07,000
Obviously, if you're not, then this can lead to security vulnerabilities being inadvertently
44
00:03:07,000 --> 00:03:08,840
introduced in applications.
45
00:03:08,840 --> 00:03:14,720
So you're writing code, you're not sure how to most effectively write code in a secure
46
00:03:14,720 --> 00:03:21,920
manner and that results down the line into vulnerabilities and potential compromises.
47
00:03:21,920 --> 00:03:27,200
I think also a lot of organizations have inadequate security policies and processes.
48
00:03:27,200 --> 00:03:33,920
This can be clearly defined security programs or APSEC programs.
49
00:03:33,920 --> 00:03:39,080
These are all examples of areas of weakness that a lot of organizations have, especially
50
00:03:39,080 --> 00:03:41,800
if they're doing active development.
51
00:03:41,800 --> 00:03:47,480
I think if you take a look at the security testing of the applications within the environment
52
00:03:47,480 --> 00:03:53,360
as well, oftentimes organizations aren't doing enough primarily due to resource constraints,
53
00:03:53,360 --> 00:03:58,840
but relying solely on manual testing and not conducting security testing at all obviously
54
00:03:58,840 --> 00:04:04,680
results in vulnerabilities going undetected, putting applications at risk as well.
55
00:04:04,680 --> 00:04:12,800
If we move into kind of the more generic security controls, we often find that a lot of organizations
56
00:04:12,800 --> 00:04:16,640
have controls that are in place that aren't properly configured.
57
00:04:16,640 --> 00:04:21,720
Misconfiguration of those controls such as your typical firewalls, access controls, even
58
00:04:21,720 --> 00:04:28,640
encryption settings often leave application vulnerable to attack as well.
59
00:04:28,640 --> 00:04:34,320
In development or DevSecOps, a lot of times developers are relying on third-party components
60
00:04:34,320 --> 00:04:39,680
and we find all the time that many applications that rely on those third-party libraries or
61
00:04:39,680 --> 00:04:44,840
components often introduce vulnerabilities that the organization isn't even aware of.
62
00:04:44,840 --> 00:04:50,400
They're leveraging something as part of their code base that is obviously potentially vulnerable
63
00:04:50,400 --> 00:04:56,440
as well, yet they don't have the ability or skill set to identify prior to being introduced
64
00:04:56,440 --> 00:05:00,000
into the application.
65
00:05:00,000 --> 00:05:05,360
Other areas that I could talk about are things like legacy systems, outdated technology, and
66
00:05:05,360 --> 00:05:07,840
just more standard process.
67
00:05:07,840 --> 00:05:14,920
Think about how instant response within an app sec environment might play into effect.
68
00:05:14,920 --> 00:05:19,160
So an application gets compromised, do the organizations have those instant response
69
00:05:19,160 --> 00:05:24,560
plans in place in order to properly identify or be able to respond to those instances?
70
00:05:24,560 --> 00:05:26,600
How quickly can that code be changed?
71
00:05:26,600 --> 00:05:29,360
Oftentimes that's not a trivial thing.
72
00:05:29,360 --> 00:05:35,080
You have applications that have complex APIs and those APIs introduce risk.
73
00:05:35,080 --> 00:05:40,040
And then lastly, one of the biggest challenges that we see is just culture in general.
74
00:05:40,040 --> 00:05:46,240
So think about it like organizational culture, a culture that does not prioritize security
75
00:05:46,240 --> 00:05:51,880
or really foster collaboration between not only the development or engineering teams,
76
00:05:51,880 --> 00:05:59,040
but the security teams often hinder the effectiveness that that organization, that organization's
77
00:05:59,040 --> 00:06:05,360
application security or DevSecOps program, how effective it is from a general perspective.
78
00:06:05,360 --> 00:06:13,920
Yeah, I wanted to just interject something because in my experience, I find that developers
79
00:06:13,920 --> 00:06:23,360
typically want to provide an end user experience that's easy to use, the user interface is
80
00:06:23,360 --> 00:06:29,160
accessible, but security isn't always front of mind.
81
00:06:29,160 --> 00:06:31,120
Do you find that as a challenge as well?
82
00:06:31,120 --> 00:06:36,320
And how do you suggest that people address that during the secure lifecycle development
83
00:06:36,320 --> 00:06:37,560
of an application?
84
00:06:37,560 --> 00:06:42,040
Well, I think sometimes you have competing priorities or the perception of competing
85
00:06:42,040 --> 00:06:47,240
priorities, but at the end of the day, when you realize and you have this collaborate,
86
00:06:47,240 --> 00:06:51,880
you have this environment of collaboration between security, between product and between
87
00:06:51,880 --> 00:06:57,400
the business needs, I think if you have that open form and are discussing what do the developers
88
00:06:57,400 --> 00:07:02,240
need in order to do their job the best that they can, what does security need, and how
89
00:07:02,240 --> 00:07:07,360
do we apply the resources to ensure complete coverage that everybody gets what they want?
90
00:07:07,360 --> 00:07:10,280
I think that's really the best answer.
91
00:07:10,280 --> 00:07:17,640
And as easy as that, putting that into practice obviously can be more difficult, but ultimately
92
00:07:17,640 --> 00:07:22,280
it's about recognizing what the business needs are and then adjusting priorities based on
93
00:07:22,280 --> 00:07:23,280
that.
94
00:07:23,280 --> 00:07:26,680
Yeah, I appreciate you mentioning that.
95
00:07:26,680 --> 00:07:33,840
I want our listeners to know because I'd love for you to explain kind of this concept of
96
00:07:33,840 --> 00:07:40,360
DevSecOps and how it differs from the more traditional DevOps practices, right?
97
00:07:40,360 --> 00:07:46,080
Because I think it's an evolution, but I want to get your kind of your opinion on how you
98
00:07:46,080 --> 00:07:49,960
would explain that concept between DevSecOps and traditional DevOps.
99
00:07:49,960 --> 00:07:50,960
Yeah, for sure.
100
00:07:50,960 --> 00:07:56,360
I mean, DevSecOps is really the integration of security practices into the DevOps process,
101
00:07:56,360 --> 00:07:57,520
right?
102
00:07:57,520 --> 00:08:02,120
It's aiming to kind of make security an integral part of that software development and deployment
103
00:08:02,120 --> 00:08:03,120
lifecycle.
104
00:08:03,120 --> 00:08:08,720
So, traditional DevOps focus on collaboration between development and operation teams, whereas
105
00:08:08,720 --> 00:08:11,360
DevSecOps brings security into the mix.
106
00:08:11,360 --> 00:08:16,200
Really the point of that is to enable kind of this continuous concept of security throughout
107
00:08:16,200 --> 00:08:18,560
the development process.
108
00:08:18,560 --> 00:08:19,560
That's great.
109
00:08:19,560 --> 00:08:20,560
Thanks.
110
00:08:20,560 --> 00:08:26,720
I want to do a little shift because I know that your company, Quiet AI, is very much focused
111
00:08:26,720 --> 00:08:30,440
on the integration of artificial intelligence.
112
00:08:30,440 --> 00:08:37,120
So can you talk a little bit about the role that AI plays in that integration of security
113
00:08:37,120 --> 00:08:41,080
practices along with kind of AppSecDevSecOps lifecycle?
114
00:08:41,080 --> 00:08:42,280
Yeah, absolutely.
115
00:08:42,280 --> 00:08:44,440
So for us, AI is the future, right?
116
00:08:44,440 --> 00:08:50,520
It's not even like there's no question, which is why we've developed as part of our product
117
00:08:50,520 --> 00:08:57,080
models that allow us to enhance security by finding what we would like to call pre-zero
118
00:08:57,080 --> 00:08:58,680
vulnerabilities, right?
119
00:08:58,680 --> 00:09:04,840
So the idea is if we're so early in the development process in terms of being able to analyze code
120
00:09:04,840 --> 00:09:09,040
and to identify vulnerabilities, that we want to identify those vulnerabilities before they
121
00:09:09,040 --> 00:09:12,680
even become zero days, let alone anything else.
122
00:09:12,680 --> 00:09:19,360
And one of the ways that we do that is leveraging advanced AI models that allow us to not only
123
00:09:19,360 --> 00:09:25,800
be more effective, but scalable, especially with organizations that have thousands of
124
00:09:25,800 --> 00:09:29,880
applications, large code bases, et cetera.
125
00:09:29,880 --> 00:09:33,560
So this is just something that came up.
126
00:09:33,560 --> 00:09:41,600
Is that then becoming even more predictive than what your traditional kind of signature-based
127
00:09:41,600 --> 00:09:43,680
systems are able to detect?
128
00:09:43,680 --> 00:09:46,840
Are you anticipating those?
129
00:09:46,840 --> 00:09:48,280
It's night and day different, right?
130
00:09:48,280 --> 00:09:54,360
So from our perspective, the efficiency that the models are getting in terms of not only
131
00:09:54,360 --> 00:10:00,240
vulnerability identification, but just the reduction in false positives is absolutely
132
00:10:00,240 --> 00:10:01,240
fantastic.
133
00:10:01,240 --> 00:10:06,840
And so think about if you're doing a manual code review as an example, all of the opportunities
134
00:10:06,840 --> 00:10:11,040
that the human element or human error could potentially introduce.
135
00:10:11,040 --> 00:10:18,600
And so while you have to have a person reviewing code in this particular example, if you're
136
00:10:18,600 --> 00:10:21,920
reviewing a million lines of code, that's not going to be very efficient.
137
00:10:21,920 --> 00:10:23,640
It's going to take a long time.
138
00:10:23,640 --> 00:10:29,520
But if you can train models and have applications that do the heavy lifting for you, imagine
139
00:10:29,520 --> 00:10:33,040
the amount of coverage that you're going to be able to have.
140
00:10:33,040 --> 00:10:37,760
And then you have the reliability of the AI model to identify those vulnerabilities.
141
00:10:37,760 --> 00:10:41,360
It's really the way of the future, in my opinion.
142
00:10:41,360 --> 00:10:45,160
And you talk a little bit about that a little bit further.
143
00:10:45,160 --> 00:10:49,040
How are AI-powered tools enhancing that security?
144
00:10:49,040 --> 00:10:55,280
You mentioned it, can you give a couple of examples of maybe beta testers, customers
145
00:10:55,280 --> 00:11:00,040
of yours that are actually utilizing that to enhance their security?
146
00:11:00,040 --> 00:11:06,600
Yeah, so today we have AI built into the product as it is.
147
00:11:06,600 --> 00:11:11,520
And so anyone who's leveraging the product has that capability.
148
00:11:11,520 --> 00:11:16,200
Quiet AI specifically evaluates code during the development process.
149
00:11:16,200 --> 00:11:21,800
So we want to make it easier to address potential issues, find vulnerabilities very early on
150
00:11:21,800 --> 00:11:24,040
in that development process.
151
00:11:24,040 --> 00:11:30,320
So we integrate within the CIDI pipeline, analyze essentially large code bases, not
152
00:11:30,320 --> 00:11:37,440
only quickly but accurately, leveraging AI as part of that process to ensure security
153
00:11:37,440 --> 00:11:40,160
is built in from a continuous perspective.
154
00:11:40,160 --> 00:11:43,040
And then we also highlight what vulnerabilities are reachable.
155
00:11:43,040 --> 00:11:48,240
And I think that's primarily one of the coolest things that we offer other than the AI is
156
00:11:48,240 --> 00:11:55,440
you have a lot of, you might have a lot of vulnerabilities or issues that you might identify
157
00:11:55,440 --> 00:11:57,960
as part of kind of static code analysis.
158
00:11:57,960 --> 00:12:02,800
But not everything is necessarily exploitable or reachable within the application.
159
00:12:02,800 --> 00:12:07,120
And so we kind of take it a step further and say, hey, we've identified all of these thousands
160
00:12:07,120 --> 00:12:12,960
of vulnerabilities that you need to address, but then we help prioritize leveraging obviously
161
00:12:12,960 --> 00:12:20,760
AI and then the concept of reachability to have a tailored focus view on what an organization
162
00:12:20,760 --> 00:12:25,040
needs to do to fix from a prioritization perspective.
163
00:12:25,040 --> 00:12:31,440
You brought up an interesting topic and I want to kind of shift the conversation into
164
00:12:31,440 --> 00:12:37,160
the maturation of the security application program.
165
00:12:37,160 --> 00:12:43,720
If you could share, so our listeners can learn what make up the key components of a mature
166
00:12:43,720 --> 00:12:49,240
application security program, how do they work together to maintain that robust security?
167
00:12:49,240 --> 00:12:51,560
Yeah, I mean, there's a lot, right?
168
00:12:51,560 --> 00:12:58,720
But I would say the key components include things like a well-defined security policy.
169
00:12:58,720 --> 00:13:02,120
You have threat modeling, secure coding practices.
170
00:13:02,120 --> 00:13:04,800
Obviously security testing plays a role.
171
00:13:04,800 --> 00:13:09,840
Just monitoring, you have all of the kind of ancillary services as well, like things
172
00:13:09,840 --> 00:13:12,720
like instant response and ongoing training.
173
00:13:12,720 --> 00:13:17,720
To me, these components work together to really create a comprehensive and proactive approach
174
00:13:17,720 --> 00:13:21,840
to not only application security, but DevSecOps in general.
175
00:13:21,840 --> 00:13:29,320
And with the ultimate goal of obviously reducing vulnerabilities and risk and help if the organization
176
00:13:29,320 --> 00:13:35,920
happens to be compromised by a vulnerability, then you have a clear set of processes or
177
00:13:35,920 --> 00:13:41,200
in place like from an instant response perspective to quickly identify and then mediate.
178
00:13:41,200 --> 00:13:42,200
That's fantastic.
179
00:13:42,200 --> 00:13:48,200
And how does Quiet AI help organizations kind of assess their maturity?
180
00:13:48,200 --> 00:13:53,440
Let's say they have an existing application security program.
181
00:13:53,440 --> 00:13:57,520
How can you walk in and assess that and help them mature that?
182
00:13:57,520 --> 00:13:58,640
Yeah, absolutely.
183
00:13:58,640 --> 00:14:03,720
So part of our consulting practice is really around helping organizations evolve or mature
184
00:14:03,720 --> 00:14:09,160
their application security or DevSecOps programs or practices.
185
00:14:09,160 --> 00:14:14,320
And we do that by really leveraging NIST and OWASP frameworks to evaluate how effective
186
00:14:14,320 --> 00:14:21,480
what they're doing today is and if there are gaps that might exist as it relates to things
187
00:14:21,480 --> 00:14:23,800
like best practices.
188
00:14:23,800 --> 00:14:28,520
Really we're looking at processes in place, technology, what training is happening.
189
00:14:28,520 --> 00:14:35,720
And then kind of like the collaboration between security and engineering to help steer or build
190
00:14:35,720 --> 00:14:39,080
a roadmap for those organizations to say, OK, these are the types of things that you
191
00:14:39,080 --> 00:14:43,280
need to do in order to have a more effective and more mature program.
192
00:14:43,280 --> 00:14:48,000
And here's either the resources or technologies that you can implement to kind of solve some
193
00:14:48,000 --> 00:14:49,600
of those systemic issues.
194
00:14:49,600 --> 00:14:53,440
Yeah, that's a great point.
195
00:14:53,440 --> 00:14:59,400
Can you discuss a little bit more about how a company could take advantage of various
196
00:14:59,400 --> 00:15:05,200
types of consulting services if they're looking to improve or build an actual application
197
00:15:05,200 --> 00:15:06,360
security program?
198
00:15:06,360 --> 00:15:10,560
Yeah, I mean, so so app second DevSecOps is full of opportunities, right?
199
00:15:10,560 --> 00:15:16,040
I mean, most organizations, you know, they have minimal skill sets, but really the biggest
200
00:15:16,040 --> 00:15:17,960
challenge is just resources.
201
00:15:17,960 --> 00:15:23,560
And so, you know, consulting opportunities include things like security assessments,
202
00:15:23,560 --> 00:15:28,760
gap analysis, policy development, risk assessments, pen testing, threat modeling.
203
00:15:28,760 --> 00:15:31,680
I mean, the list is really goes on and on and on.
204
00:15:31,680 --> 00:15:36,440
But the goal here is really to not only, you know, help assess where an organization is
205
00:15:36,440 --> 00:15:42,720
and kind of that maturity, you know, of the program, but also potentially help them assess
206
00:15:42,720 --> 00:15:49,560
the technical aspects of maybe their applications, their environment, their users, to really
207
00:15:49,560 --> 00:15:54,480
identify, first of all, do they have the proper security controls in place?
208
00:15:54,480 --> 00:15:59,720
And second, how effective are those security controls in protecting against various types
209
00:15:59,720 --> 00:16:01,840
of risks and threats, et cetera?
210
00:16:01,840 --> 00:16:03,440
No, that's great.
211
00:16:03,440 --> 00:16:06,040
I appreciate you sharing it.
212
00:16:06,040 --> 00:16:16,560
In your opinion, Ben, why should an organization invest in AppSec or DevSecOps and maybe even
213
00:16:16,560 --> 00:16:19,960
talk about kind of the barriers of entry?
214
00:16:19,960 --> 00:16:21,160
Why wouldn't they?
215
00:16:21,160 --> 00:16:24,440
So first, why should they and then why wouldn't they?
216
00:16:24,440 --> 00:16:29,280
Well, I would say the first thing, and this again, long list, but you have it's really
217
00:16:29,280 --> 00:16:31,480
to protect since sensitive data, right?
218
00:16:31,480 --> 00:16:36,800
I mean, you know, applications often handle sensitive data such as PII, maybe financial
219
00:16:36,800 --> 00:16:40,480
transactions, you know, or even IP.
220
00:16:40,480 --> 00:16:45,000
Investing in AppSec and DevSecOps helps really protect this data from obviously unauthorized
221
00:16:45,000 --> 00:16:49,440
access, potential breaches, ensuring, you know, maybe even ensuring compliance with data
222
00:16:49,440 --> 00:16:54,880
protection regulations and really ultimately maintaining customer trust, right?
223
00:16:54,880 --> 00:17:00,160
But if you want to talk about a little further than that, right, you have things like mitigating
224
00:17:00,160 --> 00:17:01,960
security risks, right?
225
00:17:01,960 --> 00:17:08,360
You have improving deployment efficiency, you know, so by integrating security practices
226
00:17:08,360 --> 00:17:14,120
within the deployment process, DevSecOps specifically can help kind of identify and resolve some
227
00:17:14,120 --> 00:17:15,800
of those issues earlier.
228
00:17:15,800 --> 00:17:21,720
So for investing in security and DevSecOps is identifying vulnerabilities and threats
229
00:17:21,720 --> 00:17:26,840
prior to, say, an application going live, well, the downstream effects of that are just
230
00:17:26,840 --> 00:17:31,800
multiplied, right, because now you're identifying vulnerabilities before it even reaches a production
231
00:17:31,800 --> 00:17:38,840
stage and therefore the users aren't impacted, the data is impacted and your risk of compromise
232
00:17:38,840 --> 00:17:41,600
is significantly obviously goes down as well.
233
00:17:41,600 --> 00:17:46,640
And so, you know, ultimately, like, if you're going to build it, build it right and introducing
234
00:17:46,640 --> 00:17:53,560
security as early as possible in any program or process, just overall helps ensure that
235
00:17:53,560 --> 00:17:57,520
DevSecOps customers can trust what you're doing, so on and so forth.
236
00:17:57,520 --> 00:17:58,520
Yeah.
237
00:17:58,520 --> 00:18:03,880
I want to pivot a little bit on and talk a little bit about data privacy rights.
238
00:18:03,880 --> 00:18:13,200
And you're aware, lots of states are coming out with regulations about data privacy.
239
00:18:13,200 --> 00:18:21,600
How does application security address the data privacy rights or things like GDPR in your
240
00:18:21,600 --> 00:18:22,600
opinion?
241
00:18:22,600 --> 00:18:28,480
Yeah, so, I mean, obviously, application security really or really app sec programs in general
242
00:18:28,480 --> 00:18:33,440
should ensure that the sense of data such as PI is, you know, like encrypted both in
243
00:18:33,440 --> 00:18:39,680
transit and, you know, at rest and you have those kind of basic blocking and tackling.
244
00:18:39,680 --> 00:18:44,720
But you also have application security that controls things like access control, right?
245
00:18:44,720 --> 00:18:51,320
And so those applications making sure that, you know, when proper access control or making
246
00:18:51,320 --> 00:18:55,960
sure that I should say access control is properly implemented also helps ensure that only obviously
247
00:18:55,960 --> 00:18:59,920
authorized individuals can access or modify data.
248
00:18:59,920 --> 00:19:05,240
You know, these are all types of things that help ensure the safety and integrity of the
249
00:19:05,240 --> 00:19:06,480
data itself, right?
250
00:19:06,480 --> 00:19:12,840
So secure storage, you've got obviously privacy by design where you might be incorporating
251
00:19:12,840 --> 00:19:19,120
privacy considerations, whether they are regulatory or not, into the application process from
252
00:19:19,120 --> 00:19:20,120
the beginning, right?
253
00:19:20,120 --> 00:19:25,240
And so again, if we take a look at where, you know, if you want to have the most effective
254
00:19:25,240 --> 00:19:30,560
app sec or DevSecOps program, and in this case, privacy by design, doing that from the beginning
255
00:19:30,560 --> 00:19:36,440
really helps establish, you know, what needs to be done when and where, right?
256
00:19:36,440 --> 00:19:42,160
And so it really helps allow if you if you want to follow the concept of privacy by design
257
00:19:42,160 --> 00:19:46,280
to do it from the beginning because it gets so much harder if you're trying to bolt it
258
00:19:46,280 --> 00:19:47,280
on later.
259
00:19:47,280 --> 00:19:53,120
And I would also say like data minimization is also another big deal, right?
260
00:19:53,120 --> 00:19:58,920
So as it relates to privacy, being able to ensure that the application in question, right,
261
00:19:58,920 --> 00:20:03,360
is only collecting minimal data, it's only retaining minimal data, and you're not, you
262
00:20:03,360 --> 00:20:09,560
know, introducing additional risk by collecting too much and storing it in proper mechanisms,
263
00:20:09,560 --> 00:20:11,640
I should say.
264
00:20:11,640 --> 00:20:21,080
You know, I was thinking about and interested in your thoughts about application development
265
00:20:21,080 --> 00:20:28,400
in cloud infrastructures and or, you know, infrastructure as a service, does that introduce
266
00:20:28,400 --> 00:20:36,440
any inherent vulnerabilities or security concerns if it's done in the cloud versus on-prem?
267
00:20:36,440 --> 00:20:39,640
Do you see a difference in that at all?
268
00:20:39,640 --> 00:20:45,320
So I mean, anytime you're talking about the cloud, you have your own set of security concerns
269
00:20:45,320 --> 00:20:46,320
as well, right?
270
00:20:46,320 --> 00:20:50,320
So there's certainly going to be additional things that organizations need to look at
271
00:20:50,320 --> 00:20:55,960
in order to, you know, maintain a secure environment.
272
00:20:55,960 --> 00:21:00,600
And so that could be things like how are developers accessing that particular environment?
273
00:21:00,600 --> 00:21:05,880
Do you have things like defense and depth strategy or using two-fact authentication,
274
00:21:05,880 --> 00:21:11,360
you know, principle of least privilege, right, into those environments?
275
00:21:11,360 --> 00:21:15,840
But now think about, you know, from a cloud perspective, you have generally a larger attack
276
00:21:15,840 --> 00:21:21,160
service you have to worry about and, you know, more accessibility, which makes the efficiency
277
00:21:21,160 --> 00:21:26,920
go up, but potentially also, right, if that environment were to be compromised, it has
278
00:21:26,920 --> 00:21:31,520
its own set of unique, what I would call unique issues that organizations have to be prepared
279
00:21:31,520 --> 00:21:33,520
to deal with.
280
00:21:33,520 --> 00:21:39,080
Yeah, I want to ask you about zero-day attacks.
281
00:21:39,080 --> 00:21:43,480
And I just, you know, I read a report recently that found like 83% of all applications that
282
00:21:43,480 --> 00:21:52,400
were tested by this one provider over 85,000 had at least one security flaw.
283
00:21:52,400 --> 00:22:01,120
And this one provider found over 10 million flaws in the 85,000 that they tested.
284
00:22:01,120 --> 00:22:07,680
There's tons of gaps in application security, which I, that's why you're in the space.
285
00:22:07,680 --> 00:22:16,400
But how would a company, or how would you suggest a company identify zero-day?
286
00:22:16,400 --> 00:22:21,800
Is there a way to prevent that zero-day attack that's not, you know, that exploit that is
287
00:22:21,800 --> 00:22:24,560
not quite, you know, in the wild yet?
288
00:22:24,560 --> 00:22:29,080
Yeah, I mean, for us, we, like I said, I think I mentioned at the beginning, you know, we
289
00:22:29,080 --> 00:22:33,240
kind of coined this concept of pre-zero, which is a little bit cheeky.
290
00:22:33,240 --> 00:22:40,000
But the idea here is, is like leveraging quiet AI as part of a, you know, part of your application
291
00:22:40,000 --> 00:22:46,440
or DevSecOps process ultimately allows us to identify vulnerabilities before they become
292
00:22:46,440 --> 00:22:47,440
vulnerabilities, right?
293
00:22:47,440 --> 00:22:52,920
And essentially before they become a zero-day, you know, that an attacker might have identified
294
00:22:52,920 --> 00:22:58,120
and is now leveraging to compromise, you know, that particular application.
295
00:22:58,120 --> 00:23:03,000
But, you know, outside of that, more generically speaking, you know, preventing zero-day attacks
296
00:23:03,000 --> 00:23:09,120
can obviously be challenging due to the nature, you know, of that most organizations don't
297
00:23:09,120 --> 00:23:12,360
have the proper SDLC processes in place.
298
00:23:12,360 --> 00:23:15,120
They don't have mature DevSecOps processes in place.
299
00:23:15,120 --> 00:23:19,520
So a lot of these get missed during the development cycle, right?
300
00:23:19,520 --> 00:23:25,040
And so my recommendation is, is that if you, if you focus your efforts during that, you
301
00:23:25,040 --> 00:23:32,040
know, as far left as possible during the development phase, you're able to identify potential issues
302
00:23:32,040 --> 00:23:34,640
before they become, you know, large headaches.
303
00:23:34,640 --> 00:23:38,320
And so if you can do that in pre-production, well, guess what?
304
00:23:38,320 --> 00:23:43,080
You've just now potentially saved your organization within an application, right, of having a
305
00:23:43,080 --> 00:23:48,240
vulnerability that could potentially be exploited or compromised.
306
00:23:48,240 --> 00:23:54,880
And so for me, like the focus really needs to be in DevSecOps or, you know, the SDLC process
307
00:23:54,880 --> 00:23:58,000
in terms of identifying and helping prevent that.
308
00:23:58,000 --> 00:24:00,240
Yeah, that's a great point.
309
00:24:00,240 --> 00:24:01,240
All right.
310
00:24:01,240 --> 00:24:05,080
I've got two more for you.
311
00:24:05,080 --> 00:24:12,160
What are the top three challenges in AppSec that you would say would help our listeners
312
00:24:12,160 --> 00:24:15,600
if they had to prioritize?
313
00:24:15,600 --> 00:24:18,920
Because as you said, there's a plethora of challenges that are out there.
314
00:24:18,920 --> 00:24:25,840
And if there are just three that in this space for application security, if they addressed,
315
00:24:25,840 --> 00:24:27,840
they would be better off than most.
316
00:24:27,840 --> 00:24:28,840
Okay.
317
00:24:28,840 --> 00:24:33,280
So I would say like my number one would be integrating security into the development
318
00:24:33,280 --> 00:24:34,280
lifecycle, right?
319
00:24:34,280 --> 00:24:40,680
Because I think that if organizations do that properly, then a lot of the downstream effects
320
00:24:40,680 --> 00:24:43,760
of application vulnerabilities goes away, right?
321
00:24:43,760 --> 00:24:47,600
Because if we can identify it before it becomes production and we can identify it in code and
322
00:24:47,600 --> 00:24:54,080
we're doing things based upon a set of best practices, it inherently helps ensure that
323
00:24:54,080 --> 00:24:56,280
the application is more secure.
324
00:24:56,280 --> 00:25:01,160
And so, you know, making sure that those security practices are seamlessly integrated into the
325
00:25:01,160 --> 00:25:04,840
SDLC process is obviously challenging.
326
00:25:04,840 --> 00:25:09,280
But to me, it's one of the most important things that an organization has to get right.
327
00:25:09,280 --> 00:25:13,520
I would say the second thing, and you kind of touched on it right at the beginning was
328
00:25:13,520 --> 00:25:15,760
is balancing speed and security.
329
00:25:15,760 --> 00:25:21,120
And so, you know, I think there's the concept of managing the business requirements, but
330
00:25:21,120 --> 00:25:26,800
I think also DevSecOps needs to kind of deliver secure applications at a rapid pace, just
331
00:25:26,800 --> 00:25:33,120
in order to make sure that, you know, the organization is meeting those business requirements.
332
00:25:33,120 --> 00:25:36,160
But the challenge is like, what is that right balance, right?
333
00:25:36,160 --> 00:25:37,160
Between speed and security.
334
00:25:37,160 --> 00:25:42,720
And that is often something difficult that organizations struggle with.
335
00:25:42,720 --> 00:25:49,040
But if you can, you know, if organizations, you know, really they should ensure that security
336
00:25:49,040 --> 00:25:51,760
measures do not slow down the development process.
337
00:25:51,760 --> 00:25:56,680
And that's why like QuietAI and building into the kind of that CIDI pipeline and doing it
338
00:25:56,680 --> 00:26:02,840
continuously helps make sure that its, you know, applications can get reviewed and pushed
339
00:26:02,840 --> 00:26:06,120
to code or pushed to production much more quickly.
340
00:26:06,120 --> 00:26:10,080
But obviously that would be probably one of the second things that I would highlight.
341
00:26:10,080 --> 00:26:15,120
And then third, I would say managing third party components.
342
00:26:15,120 --> 00:26:20,920
Applications often rely on kind of those third party libraries and components, which often
343
00:26:20,920 --> 00:26:25,520
times introduce security vulnerabilities, especially if they're not being managed.
344
00:26:25,520 --> 00:26:30,080
And ensuring that all of those kind of third party components are vetted, securely configured
345
00:26:30,080 --> 00:26:35,040
and kept up to date is really essential for reducing kind of security breaches.
346
00:26:35,040 --> 00:26:38,160
Because, you know, developers like to save time, right?
347
00:26:38,160 --> 00:26:40,200
And then it goes back to the speed thing.
348
00:26:40,200 --> 00:26:46,080
And so often they're using snippets of code or libraries that may already have vulnerabilities.
349
00:26:46,080 --> 00:26:51,160
And, you know, introducing that into their applications, obviously, it becomes problematic
350
00:26:51,160 --> 00:26:52,160
very quickly.
351
00:26:52,160 --> 00:26:53,160
Yeah.
352
00:26:53,160 --> 00:26:54,160
No, great point.
353
00:26:54,160 --> 00:26:57,160
Thank you for sharing that.
354
00:26:57,160 --> 00:26:58,160
Final question here.
355
00:26:58,160 --> 00:27:04,160
If you have one kind of tagline for QuietAI, what would it be?
356
00:27:04,160 --> 00:27:05,160
Oh, that's funny.
357
00:27:05,160 --> 00:27:08,800
You know, we hushed the noise and amplified DevSecOps.
358
00:27:08,800 --> 00:27:11,160
That would be kind of my response.
359
00:27:11,160 --> 00:27:13,320
But yeah, for sure.
360
00:27:13,320 --> 00:27:19,680
Our goal really at QuietAI is to, you know, kind of silence the noise and squire, but
361
00:27:19,680 --> 00:27:27,680
amplify DevSec's opportunity and ability to identify vulnerabilities quickly and to ultimately
362
00:27:27,680 --> 00:27:29,840
make the organization more secure.
363
00:27:29,840 --> 00:27:30,840
Excellent.
364
00:27:30,840 --> 00:27:35,600
Ben, thank you very much for taking the time to kind of educate our listeners, but also
365
00:27:35,600 --> 00:27:38,040
sharing just your insights and your experience.
366
00:27:38,040 --> 00:27:41,600
And I want to just thank you for taking the time to be with us.
367
00:27:41,600 --> 00:27:43,520
Well, that's all for this episode.
368
00:27:43,520 --> 00:28:01,400
Make sure you tune in next time to Logically Speaking and Stay Cyber First and Future Ready.
