บทถอดความฉบับเต็มของ Smarter Vulnerability Management

things that you had to go back and adjust or change for it to work properly for you? 00:04:59.680 --> 00:05:00.240 Oh, sure. 00:05:00.399 --> 00:05:00.639 Yeah. 00:05:00.800 --> 00:05:02.160 Uh we discovered a lot of problem. 00:05:02.480 --> 00:05:05.519 I mean, I'll give you an example with a lot of legacy applications. 00:05:05.680 --> 00:05:08.160 Um, I I can I'll speak about Java. 00:05:08.879 --> 00:05:17.120 It's it's a horrible, horrible code, but um, they update it frequently, and we had a lot of legacy applications running on Java. 00:05:17.600 --> 00:05:20.240 And uh when we would patch it would break that. 00:05:20.560 --> 00:05:26.079 So we realized that since it's a production environment, we had to roll back the patching. 00:05:26.160 --> 00:05:29.680 But what we did was we introduced the RAF, the risk risk acceptance form. 00:05:30.240 --> 00:05:37.519 So the owner of that particular application had to sign that and asked the CIO and the CISO to sign it. 00:05:37.600 --> 00:05:43.839 And the odds of the CIO assisto signing it without some sort of timeline tied to it were near zero. 00:05:44.079 --> 00:05:47.759 So it forced the update of a lot of a lot of the legacy applications. 00:05:47.920 --> 00:05:54.879 Um and the business is trying to push forward, so getting them to backpedal and update things was the challenge. 00:05:55.199 --> 00:06:00.800 But we had, you know, bi-weekly meetings to see what the progress was with that particular partner. 00:06:01.040 --> 00:06:02.720 And the first couple of times there's no progress. 00:06:02.800 --> 00:06:05.360 And he goes, Well, the next time we patch this, we're not rolling it back. 00:06:05.439 --> 00:06:08.160 So, you know, you need to be thinking about what you're gonna do to update this. 00:06:08.240 --> 00:06:09.920 So we really had to drive them. 00:06:10.079 --> 00:06:15.120 Uh, and once we got there and we had the, you know, we got them in the mindset that they knew there was a problem. 00:06:15.279 --> 00:06:18.319 The rest of the teams that knew they had legacy stuff started to hear about it. 00:06:18.399 --> 00:06:26.240 So they they got after it before we got to some of their some of their applications, not all Java, but there's, you know, that's the one example I'm sharing. 00:06:26.480 --> 00:06:26.800 Okay. 00:06:27.120 --> 00:06:31.439 Now it seems like it's really critical for all the stakeholders to be on board. 00:06:31.680 --> 00:06:38.319 What advice do you have as far as communication and having good keeping those channels open and communicating effectively? 00:06:38.720 --> 00:06:40.800 Well, I think you have to have you have to meet with the teams. 00:06:41.279 --> 00:06:44.480 And first of all, you have to have leadership support, um, and which I did. 00:06:44.560 --> 00:06:53.040 I had the CIO and the system at the time in the meetings in the beginning, they were involved and they sat down and I said my piece, and this is what the goal is, this is what we want to do. 00:06:53.120 --> 00:06:59.839 We set new SLAs from patching daily to weekly, still bi-weekly, uh monthly, depending on what it was. 00:07:00.000 --> 00:07:06.720 Uh, we made some exceptions for some production devices, and with the exception of critical vulnerabilities, they got patched. 00:07:06.800 --> 00:07:07.199 That was it. 00:07:07.360 --> 00:07:17.920 I mean, if there was a critical, we sent out an email, we have a distribution list, it gets hit, and everybody in the beginning would stomp their feet, you know, we had a patch tonight and validate tonight, but you know, now it's just commonplace. 00:07:18.079 --> 00:07:22.000 So once they get used to it, it's just normal, it's business as usual. 00:07:22.399 --> 00:07:23.040 Absolutely. 00:07:23.279 --> 00:07:29.360 Well, as you know, all these technologies, especially AI, are advancing so rapidly. 00:07:29.600 --> 00:07:35.839 So for your company specifically, what are you looking at next as far as how to harness the technology? 00:07:36.319 --> 00:07:42.240 In terms of AI, well, uh we're still looking for an AI tool to support what we're doing. 00:07:42.399 --> 00:07:46.720 Not that we don't have something that we're using now, but uh we want something we can use long term. 00:07:47.600 --> 00:07:52.399 So, you know, the issue is you're using AI to battle AI. 00:07:52.560 --> 00:07:58.879 You know, the threat actors are now what it from click to compromise, I think it's seven minutes where it used to be. 00:07:59.040 --> 00:08:00.720 Click to compromise was 21. 00:08:00.879 --> 00:08:03.279 So AI has reduced that window significantly. 00:08:03.439 --> 00:08:17.519 So if you're not patched and you're not using Qualists and you're not paying attention to the vulnerabilities and the criticals, the threat actors are taking advantage of um basically the partners, the end user, because they'll and email still remains our number one threat factor. 00:08:17.839 --> 00:08:25.120 But what you're seeing now, what versus what you used to see is the spelling errors and the things that would give the phishing emails away. 00:08:25.279 --> 00:08:26.639 We don't see that anymore. 00:08:26.959 --> 00:08:36.320 So now we have to tell people, you know, if if you don't know who it came from or it's not a familiar, you know, it and the other problem is too, you have compromised customers. 00:08:36.720 --> 00:08:42.240 We don't run security for a million plus customers, so we get compromised customers. 00:08:42.399 --> 00:08:49.200 So we have a supplier, a supplier list that we have visibility into through another platform that helps us with that. 00:08:49.600 --> 00:08:55.440 Yeah, and I feel like that's almost worse, is when your customers get compromised. 00:08:56.000 --> 00:09:02.720 It is because if they get compromised and they have a list of Cyntos partners, they can certainly send those emails up, but we catch most of them. 00:09:03.039 --> 00:09:04.639 Every now and then a few get through. 00:09:04.799 --> 00:09:13.039 But most of the time, you know, the URL's been stripped of anything malicious before it gets to the partners when they click on it, they get a they get a 404 error. 00:09:13.519 --> 00:09:16.000 Well, what's next on the horizon for CentOS? 00:09:16.320 --> 00:09:44.240 To continue to grow and mitigate, uh, true risk eliminate is the platform that we are currently, you know, rolling out and trying to get everybody familiar with because you know it patchless patching is what you're calling it, but it's it's really removing the ability for a threat actor to take advantage of something that there's not a patch for, whether it's closing a port, putting quotes in a in a code pass somewhere to to eliminate the gap so they can't uh get privileged access to a host device. 00:09:44.399 --> 00:09:47.440 I mean, there's a number of things you can do with mitigate to try to help you with that. 00:09:47.600 --> 00:09:56.879 So and then you know, the the score kind of drives what we do, but we don't look at the score as much as we do the vulnerabilities and the ability, you know, the ability to take advantage of it. 00:09:56.960 --> 00:10:04.639 And it may be a vulnerability that is um risky, but if it's not an internet-facing device, it's not quite as critical, right? 00:10:04.720 --> 00:10:05.919 So it really kind of depends. 00:10:06.000 --> 00:10:07.759 So I I hope that answers your question. 00:10:08.399 --> 00:10:16.000 So for teams and business leaders in a similar position, what is the key takeaway you can leave them with today? 00:10:16.399 --> 00:10:17.600 Get on board. 00:10:17.919 --> 00:10:18.879 Because it's happening. 00:10:18.960 --> 00:10:23.759 We bought it, we own it, uh, we're moving in that direction, and you can roll with us or get rolled over. 00:10:23.919 --> 00:10:27.120 I mean, I I'd not we're not rude about it. 00:10:27.200 --> 00:10:30.799 It sounds that way, but uh everybody's old on what the program. 00:10:30.879 --> 00:10:42.480 They understand that it's really it's just a business priority, and we're we're here to protect the business and make sure they can generate revenue in a safe way, keep our partners up and operating and operating safely. 00:10:42.799 --> 00:10:43.440 Absolutely. 00:10:43.600 --> 00:10:45.679 Well, thank you so much for coming here to speak with me today. 00:10:46.000 --> 00:10:46.320 Of course. 00:10:46.480 --> 00:10:47.519 Hope I answered all your questions. 00:10:47.759 --> 00:10:48.000 Yes. 00:10:48.080 --> 00:10:49.200 And thank you to our audience. 00:10:49.360 --> 00:10:51.360 If you have any questions or comments, leave them below. 00:10:51.440 --> 00:10:53.840 As usual, I'll respond back as fast as possible. 00:10:54.000 --> 00:10:55.279 Have a great day.