WEBVTT
00:00:06.320 --> 00:00:07.599
Hello everyone.
00:00:08.160 --> 00:00:08.960
It's Friday.
00:00:09.119 --> 00:00:11.519
Welcome to my podcast, The Cybersecurity Bridge.
00:00:11.599 --> 00:00:13.039
I'm your host, John Woltsik.
00:00:13.919 --> 00:00:19.199
And if you haven't seen my podcast, really, really?
00:00:19.519 --> 00:00:20.399
It's been great.
00:00:20.719 --> 00:00:21.839
You gotta watch it.
00:00:22.559 --> 00:00:28.960
Each episode we dedicate to an area of cybersecurity, and we're breaking into three parts.
00:00:29.199 --> 00:00:33.280
In the first part, we talk about the present of that area of cybersecurity.
00:00:33.439 --> 00:00:36.960
In the second, we talk about the future of that area of cybersecurity.
00:00:37.039 --> 00:00:39.359
And in the third, the cybersecurity bridge.
00:00:39.439 --> 00:00:41.520
How do we get from here to there?
00:00:42.399 --> 00:00:47.920
And so I've got a great guest today, as I always do, but I'm especially excited about this.
00:00:48.240 --> 00:00:52.799
So Colby DeRodif, the CEO of Abstract.
00:00:53.439 --> 00:00:54.000
Welcome.
00:00:54.240 --> 00:00:56.159
Can you introduce yourself to our audience?
00:00:56.479 --> 00:00:57.359
Yeah, hey, John.
00:00:57.439 --> 00:00:58.159
Thanks for having me.
00:00:58.240 --> 00:00:59.600
It's great to be on your podcast.
00:00:59.679 --> 00:01:02.079
And yeah, where are those people that haven't seen it?
00:01:02.240 --> 00:01:05.040
Um, you know, looking forward to today's conversation.
00:01:05.120 --> 00:01:12.000
Uh, I'm Colby DeRotiff, I'm the CEO and one of the co-founders at Abstract, and uh really, really excited to be here today.
00:01:12.079 --> 00:01:14.799
So um looking forward to our conversation.
00:01:15.599 --> 00:01:18.640
As am I, I've got tons of questions for you.
00:01:18.719 --> 00:01:23.359
But before we get into that, are you, Colby, ready to play cybersecurity trivia?
00:01:23.599 --> 00:01:25.120
Oh man, let's go.
00:01:25.760 --> 00:01:26.079
Okay.
00:01:26.799 --> 00:01:33.040
This might be a layup for you, but uh given your background, but uh I'm gonna try anyway.
00:01:33.120 --> 00:01:38.959
So I'm gonna name some companies that were early entrance in the sim market.
00:01:39.200 --> 00:01:44.159
Even I think even before we called it sim, or we called it sim, but not SIEM.
00:01:44.640 --> 00:01:48.799
Tell me which one is not, was not a sim vendor.
00:01:49.040 --> 00:02:02.079
So number one, net forensics, number two, e-security, number three, network intelligence, number four, mazu networks, and number number five, high tower security, and number six, log logic.
00:02:02.239 --> 00:02:07.599
Which one was not a an SIEM player?
00:02:08.879 --> 00:02:15.680
Well, that's um, so I've I guess there's depends on how you defined sim back then.
00:02:15.840 --> 00:02:17.199
That was going way back.
00:02:17.439 --> 00:02:20.879
Um you know, I definitely remember eSecurity.
00:02:21.039 --> 00:02:22.800
We competed against them pretty heavily.
00:02:22.879 --> 00:02:24.479
I have a very funny story about that.
00:02:24.560 --> 00:02:26.400
This is back in my arc site days.
00:02:26.639 --> 00:02:30.719
Um NetForensics definitely competed against them.
00:02:30.960 --> 00:02:38.319
Um, you know, network intelligence, hightower, um, and log logic.
00:02:38.400 --> 00:02:41.680
So I'm gonna have to go with my what you said, Mazu.
00:02:42.240 --> 00:02:43.199
Mazu networks.
00:02:44.080 --> 00:02:46.879
So I'm gonna go with Mazu was not a sim.
00:02:47.599 --> 00:02:48.800
You are correct.
00:02:48.879 --> 00:02:52.879
I and I think my guests are on a roll here of getting it correct.
00:02:52.960 --> 00:02:56.240
Yeah, they were uh a network behavior anomaly.
00:02:56.400 --> 00:02:59.280
I think some people, maybe even Gartner, called it NBAD.
00:02:59.520 --> 00:03:00.000
NBAD.
00:03:00.719 --> 00:03:04.960
They were kind of in the space, so that was a little bit of a tricky question, but you nailed it.
00:03:05.120 --> 00:03:10.879
Yeah, and High Tower was I would say Hightower borderline, they were interesting for a little bit.
00:03:10.960 --> 00:03:13.280
Um, they got acquired by McAfee, right?
00:03:13.360 --> 00:03:14.479
If I recall.
00:03:14.800 --> 00:03:18.000
I don't remember that, but I was definitely throwing you curveballs.
00:03:18.159 --> 00:03:18.800
Yeah, you were.
00:03:19.199 --> 00:03:20.800
I would expect nothing less.
00:03:21.120 --> 00:03:23.759
So I've got, like I said, I've got a list of questions.
00:03:23.840 --> 00:03:29.360
Um, we're gonna talk about abstract and and security operations, but let's start.
00:03:29.439 --> 00:03:33.120
Just give me your perspective on what's the current state of security operations.
00:03:34.159 --> 00:03:37.599
Um, well, I mean, frankly, it's a mess.
00:03:37.759 --> 00:03:51.919
Um, I think that over the last you know decade, organizations have just really experienced a tremendous increase in cost and a tremendous decrease in value.
00:03:52.319 --> 00:04:10.560
Um, and that's you know, through conversations that I have with CISOs and you know, industry folks like yourself and whatnot, um, it it just seems that, you know, kind of the legacy sim has really run its course and it's really time for something new.
00:04:10.719 --> 00:04:12.960
Um, that that's what I'm seeing.
00:04:14.080 --> 00:04:20.879
Yeah, and I I was reading through something you sent me, and uh you said sim is like Machiavelli.
00:04:21.439 --> 00:04:23.839
Can you can you elaborate on that?
00:04:24.079 --> 00:04:26.399
Well, you know, it's always faking its own death, right?
00:04:26.480 --> 00:04:28.399
I mean, we how many times have we heard?
00:04:28.480 --> 00:04:39.519
I mean, going back to probably you know, 2010, sim is dead, sim is dead, it's all gonna be XDR, it's gonna be this, it's gonna be that, and you know, now we're hearing Sim is dead again.
00:04:39.680 --> 00:04:43.519
Um I I don't think Sim actually dies.
00:04:43.920 --> 00:04:58.319
Like, I think it's important to think about what Sim does, and maybe the system that we have all known over the last 20, 25 years is maybe changing, reinventing itself.
00:04:58.480 --> 00:05:08.800
But it's it's certainly a capability that organizations need centralized, you know, capability within their security operations center.
00:05:09.040 --> 00:05:10.800
So where is that going to come from?
00:05:10.959 --> 00:05:16.079
And you maybe it's not even called sim, but you know, the the capability still needs to exist.
00:05:17.759 --> 00:05:19.680
Well, tell me what's driving that.
00:05:19.839 --> 00:05:22.319
Is it the just deluge of data?
00:05:22.480 --> 00:05:24.319
Is it new types of threats?
00:05:24.480 --> 00:05:26.639
Is it the emergence of AI?
00:05:26.800 --> 00:05:28.000
Is it all of the above?
00:05:28.319 --> 00:05:35.120
Oh, I think a little bit of all of the above, but I think you know it's important to think about what happened to SIM along the way, right?
00:05:35.199 --> 00:05:42.639
So if you go back, you know, to the early days, like when we first met, you know, sim was really a security tool, right?
00:05:42.720 --> 00:06:02.399
It was a tool that let you collect all of the alerts from your IDSs, from your firewalls, from your, you know, host-based IDs back when those existed, um, you know, and bring all of that data into a centralized view so that you're not doing swivel chair analytics, right?
00:06:02.560 --> 00:06:04.240
It was single pane of glass.
00:06:04.399 --> 00:06:07.120
I mean, a lot of different analogies we used to hear.
00:06:07.279 --> 00:06:32.160
Um, you know, and what happened, in my my opinion, was compliance came along, and you know, back in the kind of mid 2000s, whatever, 2006, 5, 4, whatever, PCI, Sarbanes Oxley, you know, HIPAA, these different regulations said, you know, to these organizations, like, you have to collect and store all this data from all these different systems.
00:06:32.319 --> 00:06:49.360
And that created, you know, that really created what SIM evolved into, which was much less of a security-focused tool and much more of a regulatory compliance, collect all this data, make sure it's searchable type approach.
00:06:49.680 --> 00:06:56.399
And what we ended up with was like, you know, massive data swamps of unusable data.
00:06:56.560 --> 00:06:58.800
You know, it just wasn't being used for anything.
00:06:58.959 --> 00:07:04.480
But organizations were paying super high tariffs to store this data for years.
00:07:04.639 --> 00:07:09.360
I mean, some of the regulations were saying seven years that you had to store this data.
00:07:09.439 --> 00:07:13.360
And I mean, that's longer than we have to store like our tax records and stuff, right?
00:07:14.319 --> 00:07:17.680
So yeah, it was it it was crazy.
00:07:17.839 --> 00:07:29.360
I mean, what I remember was CISO saying that they dedicate a huge percentage of their security budget to sim, and they always blow through it like within six months.
00:07:29.519 --> 00:07:33.360
And uh, and and that certainly wasn't a good situation.
00:07:33.600 --> 00:07:42.399
Now you talk about composable sim, and I love that because it reminds me so much of what I I saw in 2016 with SOP.
00:07:42.959 --> 00:07:49.279
Um, so talk about what it what is composable sim, and throw in the word soap as much as you want, by the way.
00:07:49.439 --> 00:07:49.920
Yeah, yeah.
00:07:50.000 --> 00:07:52.319
SOPA, um, SOPA, sopa, sopa.
00:07:52.560 --> 00:08:00.560
But you know, I think the idea is really that, you know, going back to kind of sim is a capability, right?
00:08:00.800 --> 00:08:04.319
It's not necessarily an individual product.
00:08:04.560 --> 00:08:17.040
Um, composable or SOPA, whatever you want term you want to use, really gives organizations the ability to kind of decouple the fundamental components of sim.
00:08:17.439 --> 00:08:30.480
And so when I when I look at that and what we've done with our platform is we've actually broken apart the key, what are in my mind the the key fundamental um components, which is you know, you have to be able to collect data, right?
00:08:30.639 --> 00:08:32.159
You gotta get the telemetry.
00:08:32.399 --> 00:08:46.720
So break out collection, break out detection, break out storage and long-term retention, and then break out the security layer, the interface, the analyst interface, right?
00:08:46.879 --> 00:08:49.440
The you know, in the old days we'd always call it the console, right?
00:08:49.600 --> 00:08:54.639
Break out the console, and like that's where security operations lives.
00:08:54.879 --> 00:09:05.279
You have detection where detection engineering lives, you have data engineers that are leveraging, you know, security data pipelines and storage data lake technologies.
00:09:05.679 --> 00:09:22.240
And the idea behind SOPA, you know, or composable interchangeable words there really is that you can use different pieces, different components from different vendors based on your architectural or business needs, right?
00:09:22.399 --> 00:09:39.840
So, for example, let's say you have a large contract with a particular hyperscaler and you get really efficient storage uh you know savings by using that particular hyperscaler and maybe one of their data lake technologies.
00:09:40.159 --> 00:09:49.759
Why wouldn't you want to use that instead of a you know proprietary back end from some monolithic provider where you're locked in?
00:09:50.000 --> 00:09:50.320
Right.
00:09:50.559 --> 00:10:01.519
It's all about really freedom of choice and freedom of architecture and really the ability for organizations to use best of breed technology that fits right for them, right?
00:10:01.600 --> 00:10:08.720
Not every tech piece of tech is a good fit for a particular business, right?
00:10:09.039 --> 00:10:24.000
And some of that could do with their policies, how they're architected, um, you know, who they use for a hyperscaler, what other technologies are surrounding in that ecosystem can drive a lot of you know the fit, right?
00:10:25.600 --> 00:10:26.799
Yeah, absolutely.
00:10:26.960 --> 00:10:32.080
And uh before we move on to the future, I do have to ask you one devil's advocate question.
00:10:32.159 --> 00:10:39.840
And as we know, there are a lot of very large vendors who would say, well, we do everything in the composable stack or the SOPA stack.
00:10:39.919 --> 00:10:41.840
And so just buy everything from us.
00:10:42.000 --> 00:10:43.679
Um, what's your quick answer?
00:10:43.759 --> 00:10:48.159
What's what's the danger or what's the um what caution would you have about that?
00:10:48.480 --> 00:10:57.759
Well, I mean, I'll I'll give you my snarky answer, which is I think we all saw this play out with Symantec and McAfee back in the 2000s, right?
00:10:58.000 --> 00:11:02.879
Um, you know, they platformatized, that's a tongue twister, right?
00:11:03.120 --> 00:11:10.639
Um, you know, starting with antivirus, and they saw, you know, what vendors like ArchSite and others were doing in the sim space.
00:11:10.720 --> 00:11:26.799
They decided they would have a sim, then they decided they'd have a web gateway, then they decided they'd have a, you know, an IDS, and pretty much they ended up having an entire suite of basically inferior products to what was best to breed out there on the market.
00:11:27.039 --> 00:11:49.679
And so some organizations I remember who had large contracts with Symantec would, and this was back again in ArcSite days when I was competing, you know, there in the early sim space, um, you know, Symantec would really push their uh their sim, which they named ESM also, which was what Arcsite SIM was called, um, but they, you know, used the name also.
00:11:50.080 --> 00:11:56.320
And they really pushed that hard on customers that had, you know, kind of enterprise contracts with Symantec.
00:11:56.799 --> 00:12:06.320
And it really was just not a superior product to what you could get from Arcsite or some of the other um independent, you know, sim providers out there.
00:12:06.399 --> 00:12:16.000
And I really think it goes back to like a Switzerland type approach where you really want that independence if you want to have you know best of breed capabilities in your organization.
00:12:17.279 --> 00:12:18.240
Yeah, I'm with you.
00:12:18.320 --> 00:12:30.720
Um the way I always answer that question is though there will there will be some smaller enterprises, some SMBs who uh platform fits, but if you're a large enterprise, uh the threats are going to be very diverse.
00:12:31.200 --> 00:12:38.000
And IT, and especially with AI development, um, is going to run faster than your security platform can run.
00:12:38.159 --> 00:12:49.360
So you need those specialized detection engines, you need um data pipelining because you need to keep up and and and you'll have to do that independently.
00:12:49.679 --> 00:12:51.200
But let's move on to the future.
00:12:51.440 --> 00:12:57.600
Um John, one one other one other quick point on the on the SOPA architecture that I failed to mention.
00:12:57.679 --> 00:13:09.600
Um, and one thing that I think is is a real driver of it is you know, the the idea of only having one detection engine, right, is silly, right?
00:13:09.679 --> 00:13:23.519
You you might want to get a best of breed detection engine that's doing you know statistical and anomaly detection, and then another one that's doing you know more of the uh you know logic-based detection, right?
00:13:23.600 --> 00:13:28.639
And and maybe another one that's doing more, you know, insider threat potentially detection, right?
00:13:28.799 --> 00:13:30.320
U EBA type stuff.
00:13:30.639 --> 00:13:43.360
Having the flexibility to plug in different analytical capabilities into a common data fabric just gives you so much more opportunity, right, for really increasing your threat coverage.
00:13:44.240 --> 00:13:45.440
Yeah, I totally agree.
00:13:45.519 --> 00:13:47.919
And we see that we see innovation in that area.
00:13:48.000 --> 00:14:01.600
So we see cloud detection and response, we see identity detection response, data detection response, browser, and they're going to be very focused on a particular area, and but somehow you have to pull all that together.
00:14:01.679 --> 00:14:05.279
And I don't mean centralized, you need a global view.
00:14:05.440 --> 00:14:07.200
So I think you're you're right.
00:14:07.360 --> 00:14:09.279
Um, but let me move on to the future.
00:14:09.360 --> 00:14:13.519
And I mentioned AI briefly, but you haven't talked about AI.
00:14:13.679 --> 00:14:16.799
What role does AI play in the composable sim?
00:14:18.000 --> 00:14:27.919
I mean, I think it's you know, I I typically don't lead conversations with AI because I think at this point, in my mind, AI is a given, right?
00:14:28.159 --> 00:14:43.679
It's just really, if you're not using AI in any part of what you're building, you're really kind of you're missing the the capabilities and and the opportunity to make the users' lives easier.
00:14:43.840 --> 00:14:52.320
So from my perspective, the way it works is AI is embedded into all aspects of composable sim, right?
00:14:52.480 --> 00:14:55.440
It's I want AI to help me with data collection.
00:14:55.519 --> 00:14:57.200
And how how does how can it do that?
00:14:57.360 --> 00:15:00.080
Well, AI can normalize data for me, right?
00:15:00.240 --> 00:15:02.320
It can map data to schemas.
00:15:02.399 --> 00:15:24.159
It, you know, if you take a well-documented schema like an OCSF or you know, a uh you know, ECS or any, you know, you name it, as long as there's like generally enough documentation on the schema, AI can really be a powerful asset in normalizing um you know telemetry data to these schemas.
00:15:24.320 --> 00:15:34.159
And you know, we've seen, you know, I going back in the old days, you know, I spent a lot of time categorizing events uh manually.
00:15:34.320 --> 00:15:51.039
I mean, we built a little application in Perl that helped us like categorize events, but I mean you're talking about you know normalizing and categorizing events from hundreds of vendors with hundreds of event types each, like that is a massive undertaking and you're bound to make mistakes.
00:15:51.200 --> 00:15:53.440
And we did, uh, for sure.
00:15:53.600 --> 00:15:56.480
And you know, AI definitely helpedful there.
00:15:56.639 --> 00:16:10.879
Um, you know, when you're doing things like analyzing which data I might be using for detection versus just reporting or compliance, like I can make decisions on data routing, where I'm gonna store particular data using AI.
00:16:11.120 --> 00:16:21.279
Um, you know, and then when it comes to like security operations, all of the capability that AI can help with there from a triage and you know alert perspective.
00:16:21.440 --> 00:16:32.159
So I think it's really baking AI in where it makes sense to make the job easier for the human.
00:16:33.600 --> 00:16:34.559
Yeah, I agree.
00:16:34.639 --> 00:16:41.679
And you wrote about AI in investigations, triage, response, analytics workflow, and you you kind of covered that.
00:16:41.840 --> 00:16:43.360
Anything else you want to add?
00:16:43.919 --> 00:16:51.759
Well, I mean, I I think it's interesting, and maybe we'll touch on this a little bit with kind of all of the activity around AI SOC.
00:16:52.159 --> 00:16:56.480
Um, you know, that's a pretty hot topic these days.
00:16:56.720 --> 00:17:02.159
Um, I'd kind of love to hear your thoughts on on that, um, where you see that going.
00:17:02.240 --> 00:17:06.559
But I have my own opinions, um, which I'm happy to share.
00:17:08.000 --> 00:17:08.960
Yeah, go ahead.
00:17:09.680 --> 00:17:11.119
Yes, you're my guest.
00:17:11.440 --> 00:17:11.839
All right.
00:17:11.920 --> 00:17:22.240
Well, I mean, I think if you look at AI SOC, um it's getting a lot of attention right now, as I mentioned, a lot of funding from venture, right?
00:17:22.480 --> 00:17:32.640
Um and really it seems to be going very much down the same path that SOAR went down um about a decade ago.
00:17:32.960 --> 00:17:37.200
So, you know, it's always it's funny, right?
00:17:37.279 --> 00:17:38.480
How how things evolve.
00:17:38.640 --> 00:17:47.359
A lot of a lot of innovation and startups are formed when a larger platform is missing a capability, right?
00:17:47.519 --> 00:17:50.160
So, you know, Oracle, great example, right?
00:17:50.240 --> 00:17:58.240
They they built a fantastic database back in the day, and there were capabilities that were missing from their overall platform.
00:17:58.400 --> 00:17:59.440
So, what did they do?
00:17:59.599 --> 00:18:05.680
Other entrepreneurs went out and built those capabilities, and then Oracle acquired them and rolled them into the platform.
00:18:06.000 --> 00:18:14.559
Same thing happens in security, especially with Sim being this SIM being like the center point of security operations, right?
00:18:14.640 --> 00:18:15.839
This focal point.
00:18:16.079 --> 00:18:20.319
Um, you know, sim was really missing a response capability, right?
00:18:20.640 --> 00:18:26.799
So a lot of organizations, a lot of smart entrepreneurs went out and built the first generation of SOR.
00:18:26.960 --> 00:18:32.640
And you saw companies like Phantom and Demisto and you know, Simplify and others.
00:18:32.960 --> 00:18:38.319
And all the Sim vendors looked back and said, Oh yeah, that really makes a lot of sense.
00:18:38.559 --> 00:18:41.119
Why wouldn't that just be part of the larger platform?
00:18:41.200 --> 00:18:45.759
And then what happened is all those companies got acquired and rolled into Sim.
00:18:46.480 --> 00:18:51.759
So then you have the next generation of SOAR companies, you know, get started, right?
00:18:51.839 --> 00:19:02.400
You have the Torques and the Tynes and you know, folks like that that are doing fantastic and really um have brought that capability to the next level.
00:19:02.559 --> 00:19:07.359
Um, and now they're leveraging the the benefits of AI.
00:19:07.680 --> 00:19:21.359
And you have AI SOC companies who have just been started recently doing very focused on you know the alerts, triage, the detection, investigation pieces, the hunting.
00:19:21.599 --> 00:19:27.440
Um and to me, that is not a standalone platform necessarily, right?
00:19:27.599 --> 00:19:50.079
To me, that is a capability that you want in your larger central focal point of security operations because all of those products, in my mind, independently um without data, are just going to be an additive thing to your overall security operations program, right?
00:19:50.160 --> 00:19:54.240
They need the data, so they're only as good as the alerts that you send them, right?
00:19:54.400 --> 00:19:59.599
And so that's where it makes sense for that to be part of this architecture, right?
00:19:59.759 --> 00:20:13.279
And again, in a composable architecture, it doesn't mean that you have to use the AI sock tools from the vendor that's giving you, you know, the data or that's giving you the other pieces.
00:20:13.359 --> 00:20:14.480
You can compose, right?
00:20:14.559 --> 00:20:19.839
You can build with best of breed and plug in the stuff that makes sense for your environment.
00:20:21.519 --> 00:20:28.480
Yes, uh, and as an analyst, and I'm sure just an industry, we would always say that's a feature, not a product.
00:20:28.720 --> 00:20:33.279
And uh and what you're describing is an AI feature, not a product.
00:20:33.920 --> 00:20:38.880
Absolute important capability, but doesn't necessarily have to be standalone.
00:20:39.200 --> 00:20:45.920
So um we're kind of on the cusp of talking about the cybersecurity bridge, but one more question.
00:20:46.079 --> 00:20:49.920
How much in the future, how much do you think the SOC is automated?
00:20:50.079 --> 00:20:55.759
Um, what does the composable SIM do for skill sets, any new skill sets that are needed?
00:20:55.920 --> 00:20:58.480
If you could just kind of give me your thoughts quickly on that.
00:20:58.799 --> 00:21:00.000
Yeah, so quick thoughts.
00:21:00.079 --> 00:21:03.119
I mean, I think more and more is automated every day.
00:21:03.279 --> 00:21:10.400
Um, from a skill set perspective, I think you obviously need skilled engineers to be responsible.
00:21:10.640 --> 00:21:14.480
Um, you know, call it keeping the AI in check.
00:21:14.559 --> 00:21:20.319
Um, you know, oversight, but maybe not doing as much of the hands-on work that was being done before.
00:21:20.480 --> 00:21:22.480
Um, it's just like writing code, right?
00:21:22.640 --> 00:21:28.319
You can have AI generate code for you, but if you don't know what you're doing, you don't want to run that code in production.
00:21:28.480 --> 00:21:32.000
Um, it, you know, it's full of hallucinations and all kinds of crazy stuff.
00:21:32.160 --> 00:21:38.799
And so you still need to actually understand how computers work in order to leverage AI coding tools.
00:21:38.880 --> 00:21:43.759
Um, from you know, if you want to write real performant production level code, right?
00:21:43.839 --> 00:21:48.240
You can spit out a bunch of garbage, but um, it's gonna be the same in anything.
00:21:48.400 --> 00:21:54.400
Like you still need the human who actually understands the outcomes that you're looking for.
00:21:54.640 --> 00:21:59.599
And so, from a data engineering perspective, right, with pipelines, like maybe you don't need to hire, you know, 50.
00:22:00.160 --> 00:22:05.599
Data engineers, but you still need some data engineers that are responsible for the system, right?
00:22:05.680 --> 00:22:06.960
To make sure that it's working.
00:22:07.119 --> 00:22:09.359
From a detection perspective, same thing.
00:22:09.599 --> 00:22:12.319
Are you really going to turn over all your detection logic to AI?
00:22:12.480 --> 00:22:13.440
I don't think so.
00:22:13.759 --> 00:22:17.680
Somebody needs to understand what threat you're looking for, right?
00:22:17.759 --> 00:22:24.799
They need to understand the threat landscape in order to tell the system what threat logic to build, right?
00:22:25.359 --> 00:22:27.519
AI is not going to know that by itself.
00:22:32.960 --> 00:22:34.880
And then from a response perspective, right?
00:22:34.960 --> 00:22:41.440
I mean, helping with triage, yeah, you're getting some, you're definitely getting like skills benefit, right?
00:22:41.680 --> 00:22:49.440
Force multiplication when it comes to your team, um, removing kind of the redundant tasks, right?
00:22:50.720 --> 00:22:51.920
Yeah, absolutely.
00:22:52.160 --> 00:22:55.119
And uh I think that's a great way to look at it.
00:22:55.200 --> 00:23:00.000
I think you wrote that AI is an enabler, it's not a replacement for humans.
00:23:00.240 --> 00:23:02.000
Uh, and I couldn't agree more.
00:23:02.240 --> 00:23:06.079
But let's move on to the cybersecurity bridge, how we get from here to there.
00:23:06.319 --> 00:23:11.200
So, one issue that I'd really like you to address is complexity.
00:23:11.440 --> 00:23:16.160
So, someone could say, ah, composable sim, that's gonna be a lot of products.
00:23:16.240 --> 00:23:20.160
I have to do custom integration, I have to learn all these different products.
00:23:20.319 --> 00:23:23.359
What do you what do you respond to someone who thinks that?
00:23:23.920 --> 00:23:26.000
Well, there's there's different approaches, right?
00:23:26.079 --> 00:23:28.799
Some organizations really love to build.
00:23:29.039 --> 00:23:41.759
Um, you know, they love to architect things themselves and they love to piece things together and you know, leverage a lot of the uh open source tools that are out there, which there's fantastic, you know, software developed by the community.
00:23:42.000 --> 00:23:48.160
Um, and for them, this idea of composability like really resonates, right?
00:23:48.240 --> 00:23:57.119
They're like, oh, cool, I can use my my Kafka cues that I already have, and I can hook those into the data lake and I can build on top of that with this, and they love that.
00:23:57.359 --> 00:24:03.119
Other organizations are like, I don't want to touch any of that stuff, just give me a turnkey system, right?
00:24:03.200 --> 00:24:14.160
And so that's the beauty of what we've built at abstract is not to go vendor pitchy here, but the idea was always you can break it apart or you can just have the whole thing, right?
00:24:14.240 --> 00:24:17.599
And that that's really the idea behind composability.
00:24:18.799 --> 00:24:19.119
Okay.
00:24:19.680 --> 00:24:23.920
Um talk about the data deluge.
00:24:24.160 --> 00:24:34.720
So you talk your data pipelining, if you can elaborate on that a little bit, because there's just so much data that's security data now.
00:24:34.799 --> 00:24:38.640
And as you say, some of it's more valuable than other data.
00:24:38.960 --> 00:24:44.960
And so moving from the present to the future, how do you determine what data to collect?
00:24:45.119 --> 00:24:46.880
Where to how to route the data?
00:24:47.119 --> 00:24:48.559
Do you need data engineers?
00:24:48.720 --> 00:24:51.920
Just kind of randomly thoughts on on those topics.
00:24:52.240 --> 00:24:57.519
Yeah, well, I I think first of all, it's really having a data strategy, right?
00:24:57.599 --> 00:24:59.440
Um, is where it all starts.
00:24:59.759 --> 00:25:06.799
Understanding what is the business outcome, what is the reason I am collecting this data, right?
00:25:07.599 --> 00:25:14.559
We can't live in a world where you know you have a conversation with somebody like, what's what's your business case?
00:25:14.720 --> 00:25:18.720
Well, I want to collect data from all these 250 different sources.
00:25:18.960 --> 00:25:21.759
Okay, well, why do you want to, why do you want to collect that?
00:25:21.920 --> 00:25:24.000
Well, just because I need to.
00:25:24.240 --> 00:25:31.200
And it's like, okay, that is, you know, I like to jokingly, I like to call that the log limbing approach.
00:25:31.440 --> 00:25:36.319
It's like, you know, I'm just gonna do it because I heard that I should, right?
00:25:36.799 --> 00:25:39.039
It's that is not a data strategy.
00:25:39.200 --> 00:25:47.039
What a data strategy means is you're understanding the business outcomes on the right, and that determines what you do with the data on the left, right?
00:25:47.279 --> 00:26:03.759
So having the ability to take individual data sets and fork them to different destinations based on use case is what really starts to give organizations the ability to implement a data strategy, right?
00:26:03.920 --> 00:26:07.680
And so you start thinking about what do I use this data for?
00:26:07.839 --> 00:26:09.839
Is this data useful for detection?
00:26:10.000 --> 00:26:12.240
Like take Windows logs, for example.
00:26:12.480 --> 00:26:18.559
There's probably like 10 events, 10 event types that are useful for actual detection work, right?
00:26:18.640 --> 00:26:23.440
You're looking at authentications, privilege escalations, account changes, things like that, right?
00:26:23.680 --> 00:26:25.359
Very useful for detection.
00:26:25.599 --> 00:26:35.119
Then you have all the just application logs that are being generated on a constant basis that tell you absolutely nothing, and no human even understands what those events mean.
00:26:35.359 --> 00:26:41.200
Sure, you might want to have those if there was a breach on that system, you might want to look through everything that happened.
00:26:41.359 --> 00:26:42.240
Fantastic.
00:26:42.480 --> 00:26:49.440
So when you have that stream of Windows events, why not take the ones that are useful for detection, send those into your detection engines?
00:26:49.599 --> 00:27:00.400
And you know detection engines are running at higher compute ratios, um, higher storage costs for quick access to data, et cetera.
00:27:00.880 --> 00:27:17.359
So take a subset of the data, send it into that very expensive infrastructure, and then take the bulk of it, which you're never even going to look at, and send that into object-level storage where if you need access to it, you can access it, but it's not clogging up the pipes.
00:27:18.559 --> 00:27:19.759
Yeah, that's good.
00:27:20.240 --> 00:27:31.440
Good advice and uh kind of dovetails into my next question, and that is pretty uh dogmatic debate in our industry.
00:27:31.599 --> 00:27:35.920
Is the future of security operations centralized or is it distributed?
00:27:36.000 --> 00:27:37.200
What's your feeling?
00:27:37.680 --> 00:27:41.200
Oh boy, this that's a that's a hot button one right now, John.
00:27:41.440 --> 00:27:42.400
Is it federated?
00:27:42.480 --> 00:27:43.599
Is it centralized?
00:27:43.839 --> 00:27:44.160
Exactly.
00:27:44.400 --> 00:27:48.000
How about how about my answer is it's both?
00:27:48.720 --> 00:27:54.079
Um, I I think again, there is no cookie cutter answer to this.
00:27:54.160 --> 00:27:56.880
It's not a it's not an either or, quite frankly.
00:27:57.039 --> 00:28:00.720
It's a again, what is the business outcome?
00:28:00.960 --> 00:28:02.480
What's the data?
00:28:02.960 --> 00:28:06.799
What makes the most sense from my operating environment, right?
00:28:07.039 --> 00:28:13.680
So I think there's some value in federation.
00:28:14.079 --> 00:28:24.720
Um, you know, like one of the things that I've always fundamentally believed is that you should try to run analytics as close to the data source as you can.
00:28:25.359 --> 00:28:29.839
And that closeness depends on what you're trying to do.
00:28:30.079 --> 00:28:38.640
If I'm running analytics on just simply one data source, like my Windows logs, well, I want to run it as close to my Windows logs as I possibly can.
00:28:39.200 --> 00:28:42.880
Efficiency, speed, MTTD, all of those good things.
00:28:43.119 --> 00:28:57.680
Now, if I want to correlate my Windows logs and my firewall logs, I need to get those things kind of near each other in order to do, I mean, you could do search-based correlation that's going to have delay and you know, 10-minute, 30-minute lag.
00:28:57.920 --> 00:29:06.079
But if you want to do like streaming, actual detection in real time, those data sources need to converge a little bit so you can do that analysis cross-stream.
00:29:06.400 --> 00:29:11.039
Um then you have the geopolitical aspect of all this, right?
00:29:11.200 --> 00:29:14.000
Which is some data and data residency, right?
00:29:14.079 --> 00:29:15.920
Some data can't leave certain areas.
00:29:16.079 --> 00:29:23.359
So you need to do your analytics, and that data needs to be stored, you know, in a particular geography, right?
00:29:23.440 --> 00:29:30.720
Like maybe it can't leave the EU, um, you know, or it can't leave a particular country, you know, in the Middle East or what have you.
00:29:30.880 --> 00:29:42.000
Um, and then you have data that, you know, is in the US, and you don't want those things mixing, except for maybe certain alerts that need to bubble up across um, you know, things like that.
00:29:42.240 --> 00:29:49.839
But um I I really think the answer and what you know our thesis at Abstract is is that it's both.
00:29:50.079 --> 00:30:02.880
And that's you know, really the flexibility that we give our customers is the ability to make the right choice for the business based on their data strategy and their business outcomes that they're looking for.
00:30:03.200 --> 00:30:10.960
Um there's you know been a lot of debate on the federated um, you know, thing lately.
00:30:11.279 --> 00:30:20.000
And I I've been really digging into what would a 100% federated environment look like.
00:30:20.640 --> 00:30:28.720
And what, and I I first of all, I don't think a 100% centralized environment necessarily makes sense anymore, right?
00:30:28.960 --> 00:30:41.119
With the way things are distributed, um, you know, on-prem, multiple clouds, like you don't want to be moving data between Amazon and Microsoft and Google and back and forth and all across.
00:30:41.200 --> 00:30:45.440
I mean, you pay tremendous data transmission costs to do that, right?
00:30:45.759 --> 00:30:59.519
Um, and so in a world where you're kind of dual-honed, you know, partially federated, partially um, you know, centralized, I think makes the most sense.
00:30:59.680 --> 00:31:05.759
Um, and as I dug into like fully federated, I just think there's there's a lot of pitfalls there, right?
00:31:06.000 --> 00:31:11.759
Um happy to go into some of those details of of what my thoughts are on that, if you'd like.
00:31:12.240 --> 00:31:15.200
I'd love you too, but we're we're almost at a time.
00:31:15.359 --> 00:31:21.680
Uh my my quick uh response is yeah, I I I totally agree with what you were saying.
00:31:21.759 --> 00:31:32.559
So I think distributed analytics, distributed data, centralized visibility, and centralized investigations, meaning the ability to bring all that data together.
00:31:32.720 --> 00:31:37.359
So before I I let you go, let me ask you a couple quick lightning round questions.
00:31:37.519 --> 00:31:37.920
Oh boy.
00:31:38.160 --> 00:31:42.079
So if you can keep your just keep your responses as as tight as you can.
00:31:42.319 --> 00:31:48.799
So um the role of uh miter attack in your composable set.
00:31:49.839 --> 00:31:50.480
Yes.
00:31:51.359 --> 00:31:52.480
Yes, I'm just kidding.
00:31:52.640 --> 00:31:53.599
I can give you a longer answer.
00:31:53.759 --> 00:31:54.319
I was just kidding.
00:31:54.720 --> 00:31:57.359
Um I was I was for the lightning round.
00:31:57.440 --> 00:32:00.480
Um look, I think miter attack has relevance, of course.
00:32:00.559 --> 00:32:08.559
It from my perspective, it's it's really the you know, the ground truth on your detection coverage and how you map and manage threats.
00:32:08.720 --> 00:32:11.200
So absolutely relevant.
00:32:11.599 --> 00:32:12.720
Okay, context.
00:32:12.880 --> 00:32:15.200
What's your what's your feedback on context?
00:32:15.519 --> 00:32:16.079
More.
00:32:16.799 --> 00:32:18.480
Um gotta have context.
00:32:18.640 --> 00:32:32.960
So I I think it is absolutely crucial to be able to leverage, you know, asset identity, vulnerability, threat, um, you know, all of this kind of context when you're dealing with your um operating environment.
00:32:33.039 --> 00:32:35.279
Um, and everybody's operating environment's different, right?
00:32:35.359 --> 00:32:37.680
So you need context specific to your organization.
00:32:38.000 --> 00:32:40.160
And is that part of your pipelining?
00:32:40.960 --> 00:32:47.920
In a way, uh, it's really it does come through pipelines, but it's it's stored and treated differently, right?
00:32:48.000 --> 00:32:52.880
So it's more of a model-based approach on context.
00:32:54.319 --> 00:32:54.880
Got it.
00:32:55.039 --> 00:33:03.519
And um and then uh shifting left, sort of predicting instead of reacting to threats, predictability.
00:33:03.599 --> 00:33:05.359
Do you see that in the future?
00:33:05.920 --> 00:33:12.000
I mean, I I think that that is something that as an industry we all need to be striving towards um getting better.
00:33:12.160 --> 00:33:15.519
We've we've for 25 years we've been reactive, right?
00:33:15.839 --> 00:33:20.400
Um 25 years is how long I've been in security, and it's been reactive the entire time.
00:33:20.640 --> 00:33:25.680
Um, I think figuring out how to get better predictability.
00:33:25.839 --> 00:33:31.599
I think some of the research I see coming out of you know the intelligence groups is promising.
00:33:31.759 --> 00:33:38.079
I I do think we've made progress in predictability um with looking at early warning indicators.
00:33:38.160 --> 00:33:47.839
Um, but I think getting better and better about that, and it's become more important as you know, the adversaries are leveraging, you know, AI tools, they're moving faster.
00:33:48.000 --> 00:33:49.519
Like we got to get ahead of that.
00:33:49.599 --> 00:33:54.000
You know, we we really can't be sitting behind the eight ball on those things.
00:33:55.359 --> 00:34:02.079
Couldn't agree more again, and uh, I'm doing the same type of research into what's going on in the threat intelligence world.
00:34:02.240 --> 00:34:03.920
So uh really easy question.
00:34:04.079 --> 00:34:05.119
Will you be at RSA?
00:34:05.680 --> 00:34:07.359
Absolutely, wouldn't miss it.
00:34:07.680 --> 00:34:12.639
It's been uh what, I don't know, since it used to be in San Jose every other year.
00:34:12.880 --> 00:34:14.480
So it's been a while.
00:34:15.039 --> 00:34:17.840
This is my 20th, uh, and I will be there too.
00:34:17.920 --> 00:34:28.639
So final question I ask every guest um what's the one piece of advice that you'd give to cybersecurity professionals around SOC, SIM, composable SIM, your choice?
00:34:29.920 --> 00:34:48.000
Honestly, I would say get comfortable with being uncomfortable and you know, get your mind around, you know, getting into a more modern architecture and a more modern capability set than you know what you've had to put up with for the last two, you know, two decades.
00:34:49.760 --> 00:34:50.880
That's great advice.
00:34:51.039 --> 00:34:59.440
And I would imagine that uh the architects who can take their organizations on that journey um will have great opportunities.
00:34:59.760 --> 00:35:01.119
Absolutely, 100%.
00:35:02.880 --> 00:35:06.239
Well, Colby, it's been a delight talking to you.
00:35:06.400 --> 00:35:14.719
This is uh, you know, it's SOAPA's 10 years old this year, and so I'm passionate about it and and our our thoughts are aligned.
00:35:14.880 --> 00:35:17.760
So thanks very much for being a guest on my podcast.
00:35:18.000 --> 00:35:18.800
Absolutely, John.
00:35:18.960 --> 00:35:23.280
Always great chatting with you, and uh look forward to seeing you again soon at RSA.
00:35:23.920 --> 00:35:26.239
Yeah, I'll see you at RSA and everyone else.
00:35:26.400 --> 00:35:32.320
I'll see you in two weeks with another edition of the Cybersecurity Bridge podcast.
00:00:06.320 --> 00:00:07.599
Hello everyone.
00:00:08.160 --> 00:00:08.960
It's Friday.
00:00:09.119 --> 00:00:11.519
Welcome to my podcast, The Cybersecurity Bridge.
00:00:11.599 --> 00:00:13.039
I'm your host, John Woltsik.
00:00:13.919 --> 00:00:19.199
And if you haven't seen my podcast, really, really?
00:00:19.519 --> 00:00:20.399
It's been great.
00:00:20.719 --> 00:00:21.839
You gotta watch it.
00:00:22.559 --> 00:00:28.960
Each episode we dedicate to an area of cybersecurity, and we're breaking into three parts.
00:00:29.199 --> 00:00:33.280
In the first part, we talk about the present of that area of cybersecurity.
00:00:33.439 --> 00:00:36.960
In the second, we talk about the future of that area of cybersecurity.
00:00:37.039 --> 00:00:39.359
And in the third, the cybersecurity bridge.
00:00:39.439 --> 00:00:41.520
How do we get from here to there?
00:00:42.399 --> 00:00:47.920
And so I've got a great guest today, as I always do, but I'm especially excited about this.
00:00:48.240 --> 00:00:52.799
So Colby DeRodif, the CEO of Abstract.
00:00:53.439 --> 00:00:54.000
Welcome.
00:00:54.240 --> 00:00:56.159
Can you introduce yourself to our audience?
00:00:56.479 --> 00:00:57.359
Yeah, hey, John.
00:00:57.439 --> 00:00:58.159
Thanks for having me.
00:00:58.240 --> 00:00:59.600
It's great to be on your podcast.
00:00:59.679 --> 00:01:02.079
And yeah, where are those people that haven't seen it?
00:01:02.240 --> 00:01:05.040
Um, you know, looking forward to today's conversation.
00:01:05.120 --> 00:01:12.000
Uh, I'm Colby DeRotiff, I'm the CEO and one of the co-founders at Abstract, and uh really, really excited to be here today.
00:01:12.079 --> 00:01:14.799
So um looking forward to our conversation.
00:01:15.599 --> 00:01:18.640
As am I, I've got tons of questions for you.
00:01:18.719 --> 00:01:23.359
But before we get into that, are you, Colby, ready to play cybersecurity trivia?
00:01:23.599 --> 00:01:25.120
Oh man, let's go.
00:01:25.760 --> 00:01:26.079
Okay.
00:01:26.799 --> 00:01:33.040
This might be a layup for you, but uh given your background, but uh I'm gonna try anyway.
00:01:33.120 --> 00:01:38.959
So I'm gonna name some companies that were early entrance in the sim market.
00:01:39.200 --> 00:01:44.159
Even I think even before we called it sim, or we called it sim, but not SIEM.
00:01:44.640 --> 00:01:48.799
Tell me which one is not, was not a sim vendor.
00:01:49.040 --> 00:02:02.079
So number one, net forensics, number two, e-security, number three, network intelligence, number four, mazu networks, and number number five, high tower security, and number six, log logic.
00:02:02.239 --> 00:02:07.599
Which one was not a an SIEM player?
00:02:08.879 --> 00:02:15.680
Well, that's um, so I've I guess there's depends on how you defined sim back then.
00:02:15.840 --> 00:02:17.199
That was going way back.
00:02:17.439 --> 00:02:20.879
Um you know, I definitely remember eSecurity.
00:02:21.039 --> 00:02:22.800
We competed against them pretty heavily.
00:02:22.879 --> 00:02:24.479
I have a very funny story about that.
00:02:24.560 --> 00:02:26.400
This is back in my arc site days.
00:02:26.639 --> 00:02:30.719
Um NetForensics definitely competed against them.
00:02:30.960 --> 00:02:38.319
Um, you know, network intelligence, hightower, um, and log logic.
00:02:38.400 --> 00:02:41.680
So I'm gonna have to go with my what you said, Mazu.
00:02:42.240 --> 00:02:43.199
Mazu networks.
00:02:44.080 --> 00:02:46.879
So I'm gonna go with Mazu was not a sim.
00:02:47.599 --> 00:02:48.800
You are correct.
00:02:48.879 --> 00:02:52.879
I and I think my guests are on a roll here of getting it correct.
00:02:52.960 --> 00:02:56.240
Yeah, they were uh a network behavior anomaly.
00:02:56.400 --> 00:02:59.280
I think some people, maybe even Gartner, called it NBAD.
00:02:59.520 --> 00:03:00.000
NBAD.
00:03:00.719 --> 00:03:04.960
They were kind of in the space, so that was a little bit of a tricky question, but you nailed it.
00:03:05.120 --> 00:03:10.879
Yeah, and High Tower was I would say Hightower borderline, they were interesting for a little bit.
00:03:10.960 --> 00:03:13.280
Um, they got acquired by McAfee, right?
00:03:13.360 --> 00:03:14.479
If I recall.
00:03:14.800 --> 00:03:18.000
I don't remember that, but I was definitely throwing you curveballs.
00:03:18.159 --> 00:03:18.800
Yeah, you were.
00:03:19.199 --> 00:03:20.800
I would expect nothing less.
00:03:21.120 --> 00:03:23.759
So I've got, like I said, I've got a list of questions.
00:03:23.840 --> 00:03:29.360
Um, we're gonna talk about abstract and and security operations, but let's start.
00:03:29.439 --> 00:03:33.120
Just give me your perspective on what's the current state of security operations.
00:03:34.159 --> 00:03:37.599
Um, well, I mean, frankly, it's a mess.
00:03:37.759 --> 00:03:51.919
Um, I think that over the last you know decade, organizations have just really experienced a tremendous increase in cost and a tremendous decrease in value.
00:03:52.319 --> 00:04:10.560
Um, and that's you know, through conversations that I have with CISOs and you know, industry folks like yourself and whatnot, um, it it just seems that, you know, kind of the legacy sim has really run its course and it's really time for something new.
00:04:10.719 --> 00:04:12.960
Um, that that's what I'm seeing.
00:04:14.080 --> 00:04:20.879
Yeah, and I I was reading through something you sent me, and uh you said sim is like Machiavelli.
00:04:21.439 --> 00:04:23.839
Can you can you elaborate on that?
00:04:24.079 --> 00:04:26.399
Well, you know, it's always faking its own death, right?
00:04:26.480 --> 00:04:28.399
I mean, we how many times have we heard?
00:04:28.480 --> 00:04:39.519
I mean, going back to probably you know, 2010, sim is dead, sim is dead, it's all gonna be XDR, it's gonna be this, it's gonna be that, and you know, now we're hearing Sim is dead again.
00:04:39.680 --> 00:04:43.519
Um I I don't think Sim actually dies.
00:04:43.920 --> 00:04:58.319
Like, I think it's important to think about what Sim does, and maybe the system that we have all known over the last 20, 25 years is maybe changing, reinventing itself.
00:04:58.480 --> 00:05:08.800
But it's it's certainly a capability that organizations need centralized, you know, capability within their security operations center.
00:05:09.040 --> 00:05:10.800
So where is that going to come from?
00:05:10.959 --> 00:05:16.079
And you maybe it's not even called sim, but you know, the the capability still needs to exist.
00:05:17.759 --> 00:05:19.680
Well, tell me what's driving that.
00:05:19.839 --> 00:05:22.319
Is it the just deluge of data?
00:05:22.480 --> 00:05:24.319
Is it new types of threats?
00:05:24.480 --> 00:05:26.639
Is it the emergence of AI?
00:05:26.800 --> 00:05:28.000
Is it all of the above?
00:05:28.319 --> 00:05:35.120
Oh, I think a little bit of all of the above, but I think you know it's important to think about what happened to SIM along the way, right?
00:05:35.199 --> 00:05:42.639
So if you go back, you know, to the early days, like when we first met, you know, sim was really a security tool, right?
00:05:42.720 --> 00:06:02.399
It was a tool that let you collect all of the alerts from your IDSs, from your firewalls, from your, you know, host-based IDs back when those existed, um, you know, and bring all of that data into a centralized view so that you're not doing swivel chair analytics, right?
00:06:02.560 --> 00:06:04.240
It was single pane of glass.
00:06:04.399 --> 00:06:07.120
I mean, a lot of different analogies we used to hear.
00:06:07.279 --> 00:06:32.160
Um, you know, and what happened, in my my opinion, was compliance came along, and you know, back in the kind of mid 2000s, whatever, 2006, 5, 4, whatever, PCI, Sarbanes Oxley, you know, HIPAA, these different regulations said, you know, to these organizations, like, you have to collect and store all this data from all these different systems.
00:06:32.319 --> 00:06:49.360
And that created, you know, that really created what SIM evolved into, which was much less of a security-focused tool and much more of a regulatory compliance, collect all this data, make sure it's searchable type approach.
00:06:49.680 --> 00:06:56.399
And what we ended up with was like, you know, massive data swamps of unusable data.
00:06:56.560 --> 00:06:58.800
You know, it just wasn't being used for anything.
00:06:58.959 --> 00:07:04.480
But organizations were paying super high tariffs to store this data for years.
00:07:04.639 --> 00:07:09.360
I mean, some of the regulations were saying seven years that you had to store this data.
00:07:09.439 --> 00:07:13.360
And I mean, that's longer than we have to store like our tax records and stuff, right?
00:07:14.319 --> 00:07:17.680
So yeah, it was it it was crazy.
00:07:17.839 --> 00:07:29.360
I mean, what I remember was CISO saying that they dedicate a huge percentage of their security budget to sim, and they always blow through it like within six months.
00:07:29.519 --> 00:07:33.360
And uh, and and that certainly wasn't a good situation.
00:07:33.600 --> 00:07:42.399
Now you talk about composable sim, and I love that because it reminds me so much of what I I saw in 2016 with SOP.
00:07:42.959 --> 00:07:49.279
Um, so talk about what it what is composable sim, and throw in the word soap as much as you want, by the way.
00:07:49.439 --> 00:07:49.920
Yeah, yeah.
00:07:50.000 --> 00:07:52.319
SOPA, um, SOPA, sopa, sopa.
00:07:52.560 --> 00:08:00.560
But you know, I think the idea is really that, you know, going back to kind of sim is a capability, right?
00:08:00.800 --> 00:08:04.319
It's not necessarily an individual product.
00:08:04.560 --> 00:08:17.040
Um, composable or SOPA, whatever you want term you want to use, really gives organizations the ability to kind of decouple the fundamental components of sim.
00:08:17.439 --> 00:08:30.480
And so when I when I look at that and what we've done with our platform is we've actually broken apart the key, what are in my mind the the key fundamental um components, which is you know, you have to be able to collect data, right?
00:08:30.639 --> 00:08:32.159
You gotta get the telemetry.
00:08:32.399 --> 00:08:46.720
So break out collection, break out detection, break out storage and long-term retention, and then break out the security layer, the interface, the analyst interface, right?
00:08:46.879 --> 00:08:49.440
The you know, in the old days we'd always call it the console, right?
00:08:49.600 --> 00:08:54.639
Break out the console, and like that's where security operations lives.
00:08:54.879 --> 00:09:05.279
You have detection where detection engineering lives, you have data engineers that are leveraging, you know, security data pipelines and storage data lake technologies.
00:09:05.679 --> 00:09:22.240
And the idea behind SOPA, you know, or composable interchangeable words there really is that you can use different pieces, different components from different vendors based on your architectural or business needs, right?
00:09:22.399 --> 00:09:39.840
So, for example, let's say you have a large contract with a particular hyperscaler and you get really efficient storage uh you know savings by using that particular hyperscaler and maybe one of their data lake technologies.
00:09:40.159 --> 00:09:49.759
Why wouldn't you want to use that instead of a you know proprietary back end from some monolithic provider where you're locked in?
00:09:50.000 --> 00:09:50.320
Right.
00:09:50.559 --> 00:10:01.519
It's all about really freedom of choice and freedom of architecture and really the ability for organizations to use best of breed technology that fits right for them, right?
00:10:01.600 --> 00:10:08.720
Not every tech piece of tech is a good fit for a particular business, right?
00:10:09.039 --> 00:10:24.000
And some of that could do with their policies, how they're architected, um, you know, who they use for a hyperscaler, what other technologies are surrounding in that ecosystem can drive a lot of you know the fit, right?
00:10:25.600 --> 00:10:26.799
Yeah, absolutely.
00:10:26.960 --> 00:10:32.080
And uh before we move on to the future, I do have to ask you one devil's advocate question.
00:10:32.159 --> 00:10:39.840
And as we know, there are a lot of very large vendors who would say, well, we do everything in the composable stack or the SOPA stack.
00:10:39.919 --> 00:10:41.840
And so just buy everything from us.
00:10:42.000 --> 00:10:43.679
Um, what's your quick answer?
00:10:43.759 --> 00:10:48.159
What's what's the danger or what's the um what caution would you have about that?
00:10:48.480 --> 00:10:57.759
Well, I mean, I'll I'll give you my snarky answer, which is I think we all saw this play out with Symantec and McAfee back in the 2000s, right?
00:10:58.000 --> 00:11:02.879
Um, you know, they platformatized, that's a tongue twister, right?
00:11:03.120 --> 00:11:10.639
Um, you know, starting with antivirus, and they saw, you know, what vendors like ArchSite and others were doing in the sim space.
00:11:10.720 --> 00:11:26.799
They decided they would have a sim, then they decided they'd have a web gateway, then they decided they'd have a, you know, an IDS, and pretty much they ended up having an entire suite of basically inferior products to what was best to breed out there on the market.
00:11:27.039 --> 00:11:49.679
And so some organizations I remember who had large contracts with Symantec would, and this was back again in ArcSite days when I was competing, you know, there in the early sim space, um, you know, Symantec would really push their uh their sim, which they named ESM also, which was what Arcsite SIM was called, um, but they, you know, used the name also.
00:11:50.080 --> 00:11:56.320
And they really pushed that hard on customers that had, you know, kind of enterprise contracts with Symantec.
00:11:56.799 --> 00:12:06.320
And it really was just not a superior product to what you could get from Arcsite or some of the other um independent, you know, sim providers out there.
00:12:06.399 --> 00:12:16.000
And I really think it goes back to like a Switzerland type approach where you really want that independence if you want to have you know best of breed capabilities in your organization.
00:12:17.279 --> 00:12:18.240
Yeah, I'm with you.
00:12:18.320 --> 00:12:30.720
Um the way I always answer that question is though there will there will be some smaller enterprises, some SMBs who uh platform fits, but if you're a large enterprise, uh the threats are going to be very diverse.
00:12:31.200 --> 00:12:38.000
And IT, and especially with AI development, um, is going to run faster than your security platform can run.
00:12:38.159 --> 00:12:49.360
So you need those specialized detection engines, you need um data pipelining because you need to keep up and and and you'll have to do that independently.
00:12:49.679 --> 00:12:51.200
But let's move on to the future.
00:12:51.440 --> 00:12:57.600
Um John, one one other one other quick point on the on the SOPA architecture that I failed to mention.
00:12:57.679 --> 00:13:09.600
Um, and one thing that I think is is a real driver of it is you know, the the idea of only having one detection engine, right, is silly, right?
00:13:09.679 --> 00:13:23.519
You you might want to get a best of breed detection engine that's doing you know statistical and anomaly detection, and then another one that's doing you know more of the uh you know logic-based detection, right?
00:13:23.600 --> 00:13:28.639
And and maybe another one that's doing more, you know, insider threat potentially detection, right?
00:13:28.799 --> 00:13:30.320
U EBA type stuff.
00:13:30.639 --> 00:13:43.360
Having the flexibility to plug in different analytical capabilities into a common data fabric just gives you so much more opportunity, right, for really increasing your threat coverage.
00:13:44.240 --> 00:13:45.440
Yeah, I totally agree.
00:13:45.519 --> 00:13:47.919
And we see that we see innovation in that area.
00:13:48.000 --> 00:14:01.600
So we see cloud detection and response, we see identity detection response, data detection response, browser, and they're going to be very focused on a particular area, and but somehow you have to pull all that together.
00:14:01.679 --> 00:14:05.279
And I don't mean centralized, you need a global view.
00:14:05.440 --> 00:14:07.200
So I think you're you're right.
00:14:07.360 --> 00:14:09.279
Um, but let me move on to the future.
00:14:09.360 --> 00:14:13.519
And I mentioned AI briefly, but you haven't talked about AI.
00:14:13.679 --> 00:14:16.799
What role does AI play in the composable sim?
00:14:18.000 --> 00:14:27.919
I mean, I think it's you know, I I typically don't lead conversations with AI because I think at this point, in my mind, AI is a given, right?
00:14:28.159 --> 00:14:43.679
It's just really, if you're not using AI in any part of what you're building, you're really kind of you're missing the the capabilities and and the opportunity to make the users' lives easier.
00:14:43.840 --> 00:14:52.320
So from my perspective, the way it works is AI is embedded into all aspects of composable sim, right?
00:14:52.480 --> 00:14:55.440
It's I want AI to help me with data collection.
00:14:55.519 --> 00:14:57.200
And how how does how can it do that?
00:14:57.360 --> 00:15:00.080
Well, AI can normalize data for me, right?
00:15:00.240 --> 00:15:02.320
It can map data to schemas.
00:15:02.399 --> 00:15:24.159
It, you know, if you take a well-documented schema like an OCSF or you know, a uh you know, ECS or any, you know, you name it, as long as there's like generally enough documentation on the schema, AI can really be a powerful asset in normalizing um you know telemetry data to these schemas.
00:15:24.320 --> 00:15:34.159
And you know, we've seen, you know, I going back in the old days, you know, I spent a lot of time categorizing events uh manually.
00:15:34.320 --> 00:15:51.039
I mean, we built a little application in Perl that helped us like categorize events, but I mean you're talking about you know normalizing and categorizing events from hundreds of vendors with hundreds of event types each, like that is a massive undertaking and you're bound to make mistakes.
00:15:51.200 --> 00:15:53.440
And we did, uh, for sure.
00:15:53.600 --> 00:15:56.480
And you know, AI definitely helpedful there.
00:15:56.639 --> 00:16:10.879
Um, you know, when you're doing things like analyzing which data I might be using for detection versus just reporting or compliance, like I can make decisions on data routing, where I'm gonna store particular data using AI.
00:16:11.120 --> 00:16:21.279
Um, you know, and then when it comes to like security operations, all of the capability that AI can help with there from a triage and you know alert perspective.
00:16:21.440 --> 00:16:32.159
So I think it's really baking AI in where it makes sense to make the job easier for the human.
00:16:33.600 --> 00:16:34.559
Yeah, I agree.
00:16:34.639 --> 00:16:41.679
And you wrote about AI in investigations, triage, response, analytics workflow, and you you kind of covered that.
00:16:41.840 --> 00:16:43.360
Anything else you want to add?
00:16:43.919 --> 00:16:51.759
Well, I mean, I I think it's interesting, and maybe we'll touch on this a little bit with kind of all of the activity around AI SOC.
00:16:52.159 --> 00:16:56.480
Um, you know, that's a pretty hot topic these days.
00:16:56.720 --> 00:17:02.159
Um, I'd kind of love to hear your thoughts on on that, um, where you see that going.
00:17:02.240 --> 00:17:06.559
But I have my own opinions, um, which I'm happy to share.
00:17:08.000 --> 00:17:08.960
Yeah, go ahead.
00:17:09.680 --> 00:17:11.119
Yes, you're my guest.
00:17:11.440 --> 00:17:11.839
All right.
00:17:11.920 --> 00:17:22.240
Well, I mean, I think if you look at AI SOC, um it's getting a lot of attention right now, as I mentioned, a lot of funding from venture, right?
00:17:22.480 --> 00:17:32.640
Um and really it seems to be going very much down the same path that SOAR went down um about a decade ago.
00:17:32.960 --> 00:17:37.200
So, you know, it's always it's funny, right?
00:17:37.279 --> 00:17:38.480
How how things evolve.
00:17:38.640 --> 00:17:47.359
A lot of a lot of innovation and startups are formed when a larger platform is missing a capability, right?
00:17:47.519 --> 00:17:50.160
So, you know, Oracle, great example, right?
00:17:50.240 --> 00:17:58.240
They they built a fantastic database back in the day, and there were capabilities that were missing from their overall platform.
00:17:58.400 --> 00:17:59.440
So, what did they do?
00:17:59.599 --> 00:18:05.680
Other entrepreneurs went out and built those capabilities, and then Oracle acquired them and rolled them into the platform.
00:18:06.000 --> 00:18:14.559
Same thing happens in security, especially with Sim being this SIM being like the center point of security operations, right?
00:18:14.640 --> 00:18:15.839
This focal point.
00:18:16.079 --> 00:18:20.319
Um, you know, sim was really missing a response capability, right?
00:18:20.640 --> 00:18:26.799
So a lot of organizations, a lot of smart entrepreneurs went out and built the first generation of SOR.
00:18:26.960 --> 00:18:32.640
And you saw companies like Phantom and Demisto and you know, Simplify and others.
00:18:32.960 --> 00:18:38.319
And all the Sim vendors looked back and said, Oh yeah, that really makes a lot of sense.
00:18:38.559 --> 00:18:41.119
Why wouldn't that just be part of the larger platform?
00:18:41.200 --> 00:18:45.759
And then what happened is all those companies got acquired and rolled into Sim.
00:18:46.480 --> 00:18:51.759
So then you have the next generation of SOAR companies, you know, get started, right?
00:18:51.839 --> 00:19:02.400
You have the Torques and the Tynes and you know, folks like that that are doing fantastic and really um have brought that capability to the next level.
00:19:02.559 --> 00:19:07.359
Um, and now they're leveraging the the benefits of AI.
00:19:07.680 --> 00:19:21.359
And you have AI SOC companies who have just been started recently doing very focused on you know the alerts, triage, the detection, investigation pieces, the hunting.
00:19:21.599 --> 00:19:27.440
Um and to me, that is not a standalone platform necessarily, right?
00:19:27.599 --> 00:19:50.079
To me, that is a capability that you want in your larger central focal point of security operations because all of those products, in my mind, independently um without data, are just going to be an additive thing to your overall security operations program, right?
00:19:50.160 --> 00:19:54.240
They need the data, so they're only as good as the alerts that you send them, right?
00:19:54.400 --> 00:19:59.599
And so that's where it makes sense for that to be part of this architecture, right?
00:19:59.759 --> 00:20:13.279
And again, in a composable architecture, it doesn't mean that you have to use the AI sock tools from the vendor that's giving you, you know, the data or that's giving you the other pieces.
00:20:13.359 --> 00:20:14.480
You can compose, right?
00:20:14.559 --> 00:20:19.839
You can build with best of breed and plug in the stuff that makes sense for your environment.
00:20:21.519 --> 00:20:28.480
Yes, uh, and as an analyst, and I'm sure just an industry, we would always say that's a feature, not a product.
00:20:28.720 --> 00:20:33.279
And uh and what you're describing is an AI feature, not a product.
00:20:33.920 --> 00:20:38.880
Absolute important capability, but doesn't necessarily have to be standalone.
00:20:39.200 --> 00:20:45.920
So um we're kind of on the cusp of talking about the cybersecurity bridge, but one more question.
00:20:46.079 --> 00:20:49.920
How much in the future, how much do you think the SOC is automated?
00:20:50.079 --> 00:20:55.759
Um, what does the composable SIM do for skill sets, any new skill sets that are needed?
00:20:55.920 --> 00:20:58.480
If you could just kind of give me your thoughts quickly on that.
00:20:58.799 --> 00:21:00.000
Yeah, so quick thoughts.
00:21:00.079 --> 00:21:03.119
I mean, I think more and more is automated every day.
00:21:03.279 --> 00:21:10.400
Um, from a skill set perspective, I think you obviously need skilled engineers to be responsible.
00:21:10.640 --> 00:21:14.480
Um, you know, call it keeping the AI in check.
00:21:14.559 --> 00:21:20.319
Um, you know, oversight, but maybe not doing as much of the hands-on work that was being done before.
00:21:20.480 --> 00:21:22.480
Um, it's just like writing code, right?
00:21:22.640 --> 00:21:28.319
You can have AI generate code for you, but if you don't know what you're doing, you don't want to run that code in production.
00:21:28.480 --> 00:21:32.000
Um, it, you know, it's full of hallucinations and all kinds of crazy stuff.
00:21:32.160 --> 00:21:38.799
And so you still need to actually understand how computers work in order to leverage AI coding tools.
00:21:38.880 --> 00:21:43.759
Um, from you know, if you want to write real performant production level code, right?
00:21:43.839 --> 00:21:48.240
You can spit out a bunch of garbage, but um, it's gonna be the same in anything.
00:21:48.400 --> 00:21:54.400
Like you still need the human who actually understands the outcomes that you're looking for.
00:21:54.640 --> 00:21:59.599
And so, from a data engineering perspective, right, with pipelines, like maybe you don't need to hire, you know, 50.
00:22:00.160 --> 00:22:05.599
Data engineers, but you still need some data engineers that are responsible for the system, right?
00:22:05.680 --> 00:22:06.960
To make sure that it's working.
00:22:07.119 --> 00:22:09.359
From a detection perspective, same thing.
00:22:09.599 --> 00:22:12.319
Are you really going to turn over all your detection logic to AI?
00:22:12.480 --> 00:22:13.440
I don't think so.
00:22:13.759 --> 00:22:17.680
Somebody needs to understand what threat you're looking for, right?
00:22:17.759 --> 00:22:24.799
They need to understand the threat landscape in order to tell the system what threat logic to build, right?
00:22:25.359 --> 00:22:27.519
AI is not going to know that by itself.
00:22:32.960 --> 00:22:34.880
And then from a response perspective, right?
00:22:34.960 --> 00:22:41.440
I mean, helping with triage, yeah, you're getting some, you're definitely getting like skills benefit, right?
00:22:41.680 --> 00:22:49.440
Force multiplication when it comes to your team, um, removing kind of the redundant tasks, right?
00:22:50.720 --> 00:22:51.920
Yeah, absolutely.
00:22:52.160 --> 00:22:55.119
And uh I think that's a great way to look at it.
00:22:55.200 --> 00:23:00.000
I think you wrote that AI is an enabler, it's not a replacement for humans.
00:23:00.240 --> 00:23:02.000
Uh, and I couldn't agree more.
00:23:02.240 --> 00:23:06.079
But let's move on to the cybersecurity bridge, how we get from here to there.
00:23:06.319 --> 00:23:11.200
So, one issue that I'd really like you to address is complexity.
00:23:11.440 --> 00:23:16.160
So, someone could say, ah, composable sim, that's gonna be a lot of products.
00:23:16.240 --> 00:23:20.160
I have to do custom integration, I have to learn all these different products.
00:23:20.319 --> 00:23:23.359
What do you what do you respond to someone who thinks that?
00:23:23.920 --> 00:23:26.000
Well, there's there's different approaches, right?
00:23:26.079 --> 00:23:28.799
Some organizations really love to build.
00:23:29.039 --> 00:23:41.759
Um, you know, they love to architect things themselves and they love to piece things together and you know, leverage a lot of the uh open source tools that are out there, which there's fantastic, you know, software developed by the community.
00:23:42.000 --> 00:23:48.160
Um, and for them, this idea of composability like really resonates, right?
00:23:48.240 --> 00:23:57.119
They're like, oh, cool, I can use my my Kafka cues that I already have, and I can hook those into the data lake and I can build on top of that with this, and they love that.
00:23:57.359 --> 00:24:03.119
Other organizations are like, I don't want to touch any of that stuff, just give me a turnkey system, right?
00:24:03.200 --> 00:24:14.160
And so that's the beauty of what we've built at abstract is not to go vendor pitchy here, but the idea was always you can break it apart or you can just have the whole thing, right?
00:24:14.240 --> 00:24:17.599
And that that's really the idea behind composability.
00:24:18.799 --> 00:24:19.119
Okay.
00:24:19.680 --> 00:24:23.920
Um talk about the data deluge.
00:24:24.160 --> 00:24:34.720
So you talk your data pipelining, if you can elaborate on that a little bit, because there's just so much data that's security data now.
00:24:34.799 --> 00:24:38.640
And as you say, some of it's more valuable than other data.
00:24:38.960 --> 00:24:44.960
And so moving from the present to the future, how do you determine what data to collect?
00:24:45.119 --> 00:24:46.880
Where to how to route the data?
00:24:47.119 --> 00:24:48.559
Do you need data engineers?
00:24:48.720 --> 00:24:51.920
Just kind of randomly thoughts on on those topics.
00:24:52.240 --> 00:24:57.519
Yeah, well, I I think first of all, it's really having a data strategy, right?
00:24:57.599 --> 00:24:59.440
Um, is where it all starts.
00:24:59.759 --> 00:25:06.799
Understanding what is the business outcome, what is the reason I am collecting this data, right?
00:25:07.599 --> 00:25:14.559
We can't live in a world where you know you have a conversation with somebody like, what's what's your business case?
00:25:14.720 --> 00:25:18.720
Well, I want to collect data from all these 250 different sources.
00:25:18.960 --> 00:25:21.759
Okay, well, why do you want to, why do you want to collect that?
00:25:21.920 --> 00:25:24.000
Well, just because I need to.
00:25:24.240 --> 00:25:31.200
And it's like, okay, that is, you know, I like to jokingly, I like to call that the log limbing approach.
00:25:31.440 --> 00:25:36.319
It's like, you know, I'm just gonna do it because I heard that I should, right?
00:25:36.799 --> 00:25:39.039
It's that is not a data strategy.
00:25:39.200 --> 00:25:47.039
What a data strategy means is you're understanding the business outcomes on the right, and that determines what you do with the data on the left, right?
00:25:47.279 --> 00:26:03.759
So having the ability to take individual data sets and fork them to different destinations based on use case is what really starts to give organizations the ability to implement a data strategy, right?
00:26:03.920 --> 00:26:07.680
And so you start thinking about what do I use this data for?
00:26:07.839 --> 00:26:09.839
Is this data useful for detection?
00:26:10.000 --> 00:26:12.240
Like take Windows logs, for example.
00:26:12.480 --> 00:26:18.559
There's probably like 10 events, 10 event types that are useful for actual detection work, right?
00:26:18.640 --> 00:26:23.440
You're looking at authentications, privilege escalations, account changes, things like that, right?
00:26:23.680 --> 00:26:25.359
Very useful for detection.
00:26:25.599 --> 00:26:35.119
Then you have all the just application logs that are being generated on a constant basis that tell you absolutely nothing, and no human even understands what those events mean.
00:26:35.359 --> 00:26:41.200
Sure, you might want to have those if there was a breach on that system, you might want to look through everything that happened.
00:26:41.359 --> 00:26:42.240
Fantastic.
00:26:42.480 --> 00:26:49.440
So when you have that stream of Windows events, why not take the ones that are useful for detection, send those into your detection engines?
00:26:49.599 --> 00:27:00.400
And you know detection engines are running at higher compute ratios, um, higher storage costs for quick access to data, et cetera.
00:27:00.880 --> 00:27:17.359
So take a subset of the data, send it into that very expensive infrastructure, and then take the bulk of it, which you're never even going to look at, and send that into object-level storage where if you need access to it, you can access it, but it's not clogging up the pipes.
00:27:18.559 --> 00:27:19.759
Yeah, that's good.
00:27:20.240 --> 00:27:31.440
Good advice and uh kind of dovetails into my next question, and that is pretty uh dogmatic debate in our industry.
00:27:31.599 --> 00:27:35.920
Is the future of security operations centralized or is it distributed?
00:27:36.000 --> 00:27:37.200
What's your feeling?
00:27:37.680 --> 00:27:41.200
Oh boy, this that's a that's a hot button one right now, John.
00:27:41.440 --> 00:27:42.400
Is it federated?
00:27:42.480 --> 00:27:43.599
Is it centralized?
00:27:43.839 --> 00:27:44.160
Exactly.
00:27:44.400 --> 00:27:48.000
How about how about my answer is it's both?
00:27:48.720 --> 00:27:54.079
Um, I I think again, there is no cookie cutter answer to this.
00:27:54.160 --> 00:27:56.880
It's not a it's not an either or, quite frankly.
00:27:57.039 --> 00:28:00.720
It's a again, what is the business outcome?
00:28:00.960 --> 00:28:02.480
What's the data?
00:28:02.960 --> 00:28:06.799
What makes the most sense from my operating environment, right?
00:28:07.039 --> 00:28:13.680
So I think there's some value in federation.
00:28:14.079 --> 00:28:24.720
Um, you know, like one of the things that I've always fundamentally believed is that you should try to run analytics as close to the data source as you can.
00:28:25.359 --> 00:28:29.839
And that closeness depends on what you're trying to do.
00:28:30.079 --> 00:28:38.640
If I'm running analytics on just simply one data source, like my Windows logs, well, I want to run it as close to my Windows logs as I possibly can.
00:28:39.200 --> 00:28:42.880
Efficiency, speed, MTTD, all of those good things.
00:28:43.119 --> 00:28:57.680
Now, if I want to correlate my Windows logs and my firewall logs, I need to get those things kind of near each other in order to do, I mean, you could do search-based correlation that's going to have delay and you know, 10-minute, 30-minute lag.
00:28:57.920 --> 00:29:06.079
But if you want to do like streaming, actual detection in real time, those data sources need to converge a little bit so you can do that analysis cross-stream.
00:29:06.400 --> 00:29:11.039
Um then you have the geopolitical aspect of all this, right?
00:29:11.200 --> 00:29:14.000
Which is some data and data residency, right?
00:29:14.079 --> 00:29:15.920
Some data can't leave certain areas.
00:29:16.079 --> 00:29:23.359
So you need to do your analytics, and that data needs to be stored, you know, in a particular geography, right?
00:29:23.440 --> 00:29:30.720
Like maybe it can't leave the EU, um, you know, or it can't leave a particular country, you know, in the Middle East or what have you.
00:29:30.880 --> 00:29:42.000
Um, and then you have data that, you know, is in the US, and you don't want those things mixing, except for maybe certain alerts that need to bubble up across um, you know, things like that.
00:29:42.240 --> 00:29:49.839
But um I I really think the answer and what you know our thesis at Abstract is is that it's both.
00:29:50.079 --> 00:30:02.880
And that's you know, really the flexibility that we give our customers is the ability to make the right choice for the business based on their data strategy and their business outcomes that they're looking for.
00:30:03.200 --> 00:30:10.960
Um there's you know been a lot of debate on the federated um, you know, thing lately.
00:30:11.279 --> 00:30:20.000
And I I've been really digging into what would a 100% federated environment look like.
00:30:20.640 --> 00:30:28.720
And what, and I I first of all, I don't think a 100% centralized environment necessarily makes sense anymore, right?
00:30:28.960 --> 00:30:41.119
With the way things are distributed, um, you know, on-prem, multiple clouds, like you don't want to be moving data between Amazon and Microsoft and Google and back and forth and all across.
00:30:41.200 --> 00:30:45.440
I mean, you pay tremendous data transmission costs to do that, right?
00:30:45.759 --> 00:30:59.519
Um, and so in a world where you're kind of dual-honed, you know, partially federated, partially um, you know, centralized, I think makes the most sense.
00:30:59.680 --> 00:31:05.759
Um, and as I dug into like fully federated, I just think there's there's a lot of pitfalls there, right?
00:31:06.000 --> 00:31:11.759
Um happy to go into some of those details of of what my thoughts are on that, if you'd like.
00:31:12.240 --> 00:31:15.200
I'd love you too, but we're we're almost at a time.
00:31:15.359 --> 00:31:21.680
Uh my my quick uh response is yeah, I I I totally agree with what you were saying.
00:31:21.759 --> 00:31:32.559
So I think distributed analytics, distributed data, centralized visibility, and centralized investigations, meaning the ability to bring all that data together.
00:31:32.720 --> 00:31:37.359
So before I I let you go, let me ask you a couple quick lightning round questions.
00:31:37.519 --> 00:31:37.920
Oh boy.
00:31:38.160 --> 00:31:42.079
So if you can keep your just keep your responses as as tight as you can.
00:31:42.319 --> 00:31:48.799
So um the role of uh miter attack in your composable set.
00:31:49.839 --> 00:31:50.480
Yes.
00:31:51.359 --> 00:31:52.480
Yes, I'm just kidding.
00:31:52.640 --> 00:31:53.599
I can give you a longer answer.
00:31:53.759 --> 00:31:54.319
I was just kidding.
00:31:54.720 --> 00:31:57.359
Um I was I was for the lightning round.
00:31:57.440 --> 00:32:00.480
Um look, I think miter attack has relevance, of course.
00:32:00.559 --> 00:32:08.559
It from my perspective, it's it's really the you know, the ground truth on your detection coverage and how you map and manage threats.
00:32:08.720 --> 00:32:11.200
So absolutely relevant.
00:32:11.599 --> 00:32:12.720
Okay, context.
00:32:12.880 --> 00:32:15.200
What's your what's your feedback on context?
00:32:15.519 --> 00:32:16.079
More.
00:32:16.799 --> 00:32:18.480
Um gotta have context.
00:32:18.640 --> 00:32:32.960
So I I think it is absolutely crucial to be able to leverage, you know, asset identity, vulnerability, threat, um, you know, all of this kind of context when you're dealing with your um operating environment.
00:32:33.039 --> 00:32:35.279
Um, and everybody's operating environment's different, right?
00:32:35.359 --> 00:32:37.680
So you need context specific to your organization.
00:32:38.000 --> 00:32:40.160
And is that part of your pipelining?
00:32:40.960 --> 00:32:47.920
In a way, uh, it's really it does come through pipelines, but it's it's stored and treated differently, right?
00:32:48.000 --> 00:32:52.880
So it's more of a model-based approach on context.
00:32:54.319 --> 00:32:54.880
Got it.
00:32:55.039 --> 00:33:03.519
And um and then uh shifting left, sort of predicting instead of reacting to threats, predictability.
00:33:03.599 --> 00:33:05.359
Do you see that in the future?
00:33:05.920 --> 00:33:12.000
I mean, I I think that that is something that as an industry we all need to be striving towards um getting better.
00:33:12.160 --> 00:33:15.519
We've we've for 25 years we've been reactive, right?
00:33:15.839 --> 00:33:20.400
Um 25 years is how long I've been in security, and it's been reactive the entire time.
00:33:20.640 --> 00:33:25.680
Um, I think figuring out how to get better predictability.
00:33:25.839 --> 00:33:31.599
I think some of the research I see coming out of you know the intelligence groups is promising.
00:33:31.759 --> 00:33:38.079
I I do think we've made progress in predictability um with looking at early warning indicators.
00:33:38.160 --> 00:33:47.839
Um, but I think getting better and better about that, and it's become more important as you know, the adversaries are leveraging, you know, AI tools, they're moving faster.
00:33:48.000 --> 00:33:49.519
Like we got to get ahead of that.
00:33:49.599 --> 00:33:54.000
You know, we we really can't be sitting behind the eight ball on those things.
00:33:55.359 --> 00:34:02.079
Couldn't agree more again, and uh, I'm doing the same type of research into what's going on in the threat intelligence world.
00:34:02.240 --> 00:34:03.920
So uh really easy question.
00:34:04.079 --> 00:34:05.119
Will you be at RSA?
00:34:05.680 --> 00:34:07.359
Absolutely, wouldn't miss it.
00:34:07.680 --> 00:34:12.639
It's been uh what, I don't know, since it used to be in San Jose every other year.
00:34:12.880 --> 00:34:14.480
So it's been a while.
00:34:15.039 --> 00:34:17.840
This is my 20th, uh, and I will be there too.
00:34:17.920 --> 00:34:28.639
So final question I ask every guest um what's the one piece of advice that you'd give to cybersecurity professionals around SOC, SIM, composable SIM, your choice?
00:34:29.920 --> 00:34:48.000
Honestly, I would say get comfortable with being uncomfortable and you know, get your mind around, you know, getting into a more modern architecture and a more modern capability set than you know what you've had to put up with for the last two, you know, two decades.
00:34:49.760 --> 00:34:50.880
That's great advice.
00:34:51.039 --> 00:34:59.440
And I would imagine that uh the architects who can take their organizations on that journey um will have great opportunities.
00:34:59.760 --> 00:35:01.119
Absolutely, 100%.
00:35:02.880 --> 00:35:06.239
Well, Colby, it's been a delight talking to you.
00:35:06.400 --> 00:35:14.719
This is uh, you know, it's SOAPA's 10 years old this year, and so I'm passionate about it and and our our thoughts are aligned.
00:35:14.880 --> 00:35:17.760
So thanks very much for being a guest on my podcast.
00:35:18.000 --> 00:35:18.800
Absolutely, John.
00:35:18.960 --> 00:35:23.280
Always great chatting with you, and uh look forward to seeing you again soon at RSA.
00:35:23.920 --> 00:35:26.239
Yeah, I'll see you at RSA and everyone else.
00:35:26.400 --> 00:35:32.320
I'll see you in two weeks with another edition of the Cybersecurity Bridge podcast.
