Enterprise Security Weekly (Video)

"Identity security has been around forever though", you might be thinking. Allow me to clarify. Identity is the largest cybersecurity product category, but most of it is focused on identity governance, authentication, multi-factor, etc. Very little of it is focused on operational identity security. It's this trend, where we recently (within the last 2 years) started seeing the ITDR (Identity Threat Detection and Response) acronym that we'll be focused on today. Particularly:

• Why is this trend/spike occurring now?
• What was or is missing to do identity security properly?
• What does the future of securing identity look like?

And it's difficult to do better for this conversation than Will Lin. He spent the last half decade as a VC. On a daily basis, he was looking at the big picture of cybersecurity markets and trends. He discussed security challenges with CISOs and other security buyers on a regular basis, both directly and through the Security Tinkerers community he founded. All this led to a decision to quit the VC world to become a founder himself. Of all the categories he could have chosen, he chose identity security, and that's why we're happy to have him for this conversation.

Segment Resources:

• The Future of Identity AKA Identity promo video focused on the future of Identity

Show Notes: https://securityweekly.com/esw-364

In this interview, join Swimlane Chief Information Security Officer, Mike Lyborg, and host Akira Brand as we discuss the value of cybersecurity marketplaces from a CISO perspective. Through insightful discussions, unpack the connection between outcomes-driven solutions and tangible business KPIs.

This segment is sponsored by Swimlane. Visit https://securityweekly.com/swimlanersac to learn more about them!

The past two years have witnessed an unprecedented surge in the adoption of generative artificial intelligence (AI) across various industries. And while this presents new efficiencies, with these benefits come significant security concerns. The widespread integration of AI applications increases the risk of data breaches and intellectual property theft, while also expanding organizations' vulnerability to malicious data injection and other AI-driven cyberattacks. During this interview Jim will explore why it's imperative to implement robust security measures to mitigate these evolving risks effectively, and how working alongside an MSSP can benefit your overall security posture.

Segment Resources: https://go.directdefense.com/2023-Security-Operations-Threat-Report

This segment is sponsored by DirectDefense. Visit https://securityweekly.com/directdefensersac to learn more about them!

In recent years, ransomware attacks have undergone a transformative evolution, shifting from indiscriminate, mass-distributed assaults to highly targeted, sophisticated campaigns. Kris Lahiri is able to discuss the dynamic landscape of ransomware and dive into the techniques he has seen cybercriminals employ, the motivations behind these attacks, and the escalating impact on individuals, businesses, and critical infrastructure.

Segment Resources: https://www.egnyte.com/solutions/ransomware-detection https://www.egnyte.com/guides/governance/ransomware

This segment is sponsored by Egnyte. Visit https://securityweekly.com/egnytersac to learn more about them!

Show Notes: https://securityweekly.com/vault-esw-11

Organizations today are overwhelmed with the sheer magnitude of potential cybersecurity threats and there is plenty of vendor buzz around AI in Security products, but what is the reality? Threat detection and incident response (TDIR) strategy and execution have never been more critical and are essential in maintaining cyber resilience and strengthening the security posture of every organization. TDIR aims to identify potential threats and respond before they can impact a business. A layered defense focuses on identifying threat activity, prioritizing investigations, and measuring risk. As a result, organizations can take the appropriate threat mitigation steps. These security strategies and protocols signify a step forward with a TDIR strategy where everyone from the CISO to the security analyst wins.

This segment is sponsored by Graylog. Visit https://securityweekly.com/graylogrsac to learn more about them!

Axur is a cost-effective external cybersecurity solution that empowers security teams to handle threats beyond the perimeter. Our platform detects, inspects, and responds to brand impersonation, phishing scams, dark web mentions, threat intel vulnerabilities, and more.

This segment is sponsored by Axur. Visit https://securityweekly.com/axurrsac to learn more about them!

Segment Resources: https://www.axur.com/en-us/partners https://www.axur.com/en-us/outsourced-takedown https://www.axur.com/polaris/home

Vendors, sales channels, partners and other kinds of third parties are essential to most businesses. Ensuring that the information security risks of those other companies don't impact your own is the remit of Third Party Cyber Risk Management (TPCRM) teams. It is increasingly evident, however, that the existing practices and tools are not up to the challenge. They make the process even more adversarial than it needs to be, are focused on risk transfer and/or acceptance rather than reduction; are based on limited and low quality signals; and are often excruciatingly manual. We can do better as an industry, and in this conversation we are going to explore a new paradigm for TPCRM and its advantages for third and first parties.

Segment Resources: Alice in Supply Chains is a monthly marketing-free newsletter with curated news and commentary on TPCRM: https://www.linkedin.com/newsletters/alice-in-supply-chains-6976104448523677696/

This segment is sponsored by Tenchi Security. Visit https://securityweekly.com/tenchirsac to learn more about them!

Show Notes: https://securityweekly.com/vault-esw-10

As a special treat for this week's vault episode, we set up a conversation with Derek Manky to discuss Fortinet's FortiGuard Labs Threat Report. This is a bi-annual report put out by FortiGuard Labs, and in my opinion, it just keeps getting better and better. The report is chock full of actionable information and insights. It answered all my questions about the current state of threats and attacks, like:

• What is the latest big shift in strategy and focus for ransomware groups?
• I keep hearing that attackers are getting faster and faster - how much time to defenders actually have these days (to patch a critical vuln, for example)?
• What are the latest attack techniques being used? Which are used less, or never used?

There's not a dull moment in this conversation - I hope you enjoy listening to or watching it as much as I did making it!

Segment Resources:

• Fortiguard Labs
• 2H 2023 FortiGuard Labs Threat Report

Show Notes: https://securityweekly.com/vault-esw-9

Qwiet AI provides real time detection of security vulnerabilities in code along with the best AI generated fixes to aid developers in finding and fixing their code with the addition of AI AutoFix.

This segment is sponsored by Qwiet AI. Visit https://securityweekly.com/qwietrsac to learn more about them!

With scores of security tools implemented, configured, and integrated security teams are overwhelmed while knowing there is still a possibility for a breach. As they work to prioritize threat exposures, it is imperative for organizations to have a clear, context-rich, and up-to-date view of their security posture. Picus Security CTO and Co-founder, Volkan Ertürk, explains how consistent security validation allows security teams to pinpoint gaps, prioritize, and quantify risk so they can reduce threat exposure.

Segment Resources: Picus Red Report 2024: https://www.picussecurity.com/hubfs/Red%20Report%202024/Picus-RedReport-2024.pdf

This segment is sponsored by Picus Security. Visit https://www.securityweekly.com/picusrsac to learn more about them!

Platformization could mean reduction in innovation, reduction in the ability to be flexible, and less competition. But it doesn't have to be this way. Like the IT industry, there are ways for the cybersecurity industry to platformize, but also to have this become a net benefit to the industry as a whole.

Segment Resources: Navigating the SecOps Cloud Platform webinar recording: https://www.youtube.com/watch?v=MbzvLX-W2KY

Recon Infosec Case Study: https://info.limacharlie.io/hubfs/Case%20Studies/LimaCharlieReconInfosecMSSPCase_Study.pdf

Blumira Case Study: https://info.limacharlie.io/hubfs/Case%20Studies/LimaCharlieBlumiraCase_Study.pdf

This segment is sponsored by LimaCharlie. Visit https://securityweekly.com/limacharliersac to learn more about them!

Show Notes: https://securityweekly.com/esw-363

The next generation of identity security is not about the popular idea of convergence, but of unification. A single, AI-driven solution that integrates PAM with identity security and access management is the clear path forward to manage and secure all enterprise data through a unified control point.

Segment Resources: • https://www.sailpoint.com/products/identity-security-cloud/atlas/ • https://www.sailpoint.com/press-releases/sailpoint-accelerates-innovation-with-its-identity-security-platform-sailpoint-atlas/ • https://www.sailpoint.com/press-releases/sailpoint-leads-identity-security-evolution-through-relentless-innovation/ • https://www.sailpoint.com/navigate/

This segment is sponsored by SailPoint. Visit https://securityweekly.com/sailpointrsac to learn more about them!

Over the past 15 years, identity has evolved from a perimeter-based security model with clear boundaries to one that is fluid, flexible, and permeates every aspect of digital business. Simultaneously, AI has infiltrated every enterprise, becoming a double-edged sword for defenders, and fueling fraud attacks across every sector.

In this interview, Ping Identity CEO Andre Durand will walk through the evolution of the identity attack surface, and the opportunity decentralized identity has to dramatically improve both security and experience by putting users in control. He'll also discuss the increasing threats to individuals and businesses, given the influx of AI, and why we should consider this the era of "verify more, trust less."

This segment is sponsored by Ping Identity. Visit https://securityweekly.com/pingrsac to learn more about them!

As companies adopt new digital cloud technologies, cybercrime threats are on the rise and becoming more sophisticated. Identity has come under attack in today's digital-first environment and is critical to ensure we can securely connect people to technology. Okta is on a mission to eliminate identity threats and clear the path for organizations to safely use any technology.

Segment Resources: https://www.okta.com/blog/2024/02/introducing-the-okta-secure-identity-commitment/

https://www.okta.com/products/okta-ai/

https://www.okta.com/blog/2024/02/okta-acquisition-advances-identity-powered-security/

This segment is sponsored by Okta. Visit https://securityweekly.com/oktarsac to learn more about them!

Show Notes: https://securityweekly.com/esw-363

Only one funding announcement this week, so we dive deep into Thoma Bravo's past and present portfolio. They recently announced a sale of Venafi to Cyberark and no one is quite sure how much of a hand they had in the LogRhythm/Exabeam merger, and whether or not they sold their stake in the process.

We also have a crazy stat Ross Haleliuk spotted in Bessemer's analysis: "13 out of 14 cybersecurity companies acquired in the past year for over $100M were from Israel". Is this an anomaly? Does it just mean that Israel wasn't shy about selling when the market was down? We discuss.

A number of new product announcements continue to trickle out post-RSA.

We'll also discuss Sam Altman and OpenAI's decision to use Scarlett Johansson's voice against her will and what it could mean for deepfakes, advanced social engineering techniques, and general big tech sliminess.

Do you know what a "product glorifier" is? How about a glowstacker? You will if you check out the second-to-last story in the show notes!

Show Notes: https://securityweekly.com/esw-363

Artificial intelligence isn't a magic wand… but could AI actually solve the alert triage problem every security operations center faces? In this interview with Jim McDonough from Intezer, we'll talk about how 2023 was a tipping point for the maturity of AI tech, what these solutions actually bring to the table, how SOC teams in the real world are automating their processes with new AI tools, and why MSSPs are driving early adoption.

This segment is sponsored by Intezer. Visit https://securityweekly.com/intezerrsac to learn more about them!

This interview examines the state and future of cybersecurity. Join the conversation as a cybersecurity expert delves into the failings of current defenses, the relentless tactics of attackers, and the imperative for innovative solutions. Explore how Lumu's latest announcement delivers the innovation that cybersecurity analysts need to operate cybersecurity and meet the demands of the moment.

This segment is sponsored by Lumu Technologies. Visit https://securityweekly.com/lumursac to learn more about them!

On April 1, Nightwing, formerly a business unit of Raytheon, launched as a standalone company. The company's Vice President of Cyber Protection Solutions, Jon Check, will discuss the transition to Nightwing and its approach to the most pressing cybersecurity challenges, helping customers stay ahead of today's threats.

This segment is sponsored by Nightwing. Visit https://securityweekly.com/nightwingrsac to learn more about them!

Show Notes: https://securityweekly.com/esw-362

The danger of post-breach disruption and downtime is extremely real. And while we should work to prevent these breaches in the first place, we must also be practical and pre-empt any potential incidents. Organisations armed with the most extensive software-based cybersecurity protection today continue to fall prey to hackers, have their operations disrupted and struggle to overcome the loss of data and system corruption. And with more business assets moving to the cloud than ever before - we are just asking for it aren't we? The answer to this lies in advanced engineering at the hardware layer. Easily integrated into enterprise servers and data centers to provide full-stack protection across the entire life cycle of a potential attack.

Segment Resources: https://x-phy.com/flexxon-fortifies-data-center-security-with-x-phy-server-defender/

This segment is sponsored by Flexxon. Visit https://www.securityweekly.com/flexxonrsac to learn more about them!

Over the past two years, we've seen the degree of digital trust in our day-to-day lives being pushed to its limits due to the unintended consequences of innovation. From GenAI to IoT security to quantum computing, we will see a "crescendo of trust" that will push trust to its absolute limits. Here, we will focus on IoT/device trust.

This segment is sponsored by DigiCert. Visit https://securityweekly.com/digicertrsac to learn more about them!

Security needs to be everywhere a potential threat exists – from an IOT device to an OT device, a factory floor, an element of infrastructure, an oil rig, a robotic device or an MRT machine – Cisco recognized that with increased connection comes a greater risk than ever before and that you must bring the security to these workloads...not the other way around. In order to keep up with today's sophisticated and expansive threat landscape, security can no longer be a fence; it needs to be embedded through the fabric of data centers, whether public or private. Cisco Hypershield does just that and gives defenders a fighting chance against adversaries, as now the industry has the advantage.

Segment Resources: Hypershield Keynote: https://newsroom.cisco.com/c/r/newsroom/en/us/a/y2024/m04/unveiling-a-new-era-of-ai-native-security-with-cisco-hypershield.html

Cybersecurity Readiness Index: https://newsroom.cisco.com/c/r/newsroom/en/us/a/y2024/m03/cybersecurity-readiness-index-2024.html

DUO trusted access report: https://duo.com/assets/ebooks/2024-Duo-Trusted-Access-Report.pdf

Jeetu's blog: https://blogs.cisco.com/news/cisco-hypershield-security-reimagined-hyper-distributed-security-for-the-ai-scale-data-center

Official announcement: https://newsroom.cisco.com/c/r/newsroom/en/us/a/y2024/m04/unveiling-a-new-era-of-ai-native-security-with-cisco-hypershield.html

This segment is sponsored by Cisco. Visit https://securityweekly.com/ciscorsac to learn more about them!

Show Notes: https://securityweekly.com/esw-362

Suddenly SIEMs are all over the news! In a keynote presentation, Crowdstrike CEO George Kurtz talked about the company's "next-gen" SIEM. Meanwhile, Palo Alto, who was taken to task by some for not having an active presence on the RSAC expo floor, hits the headlines for acquiring IBM's SIEM product, just to shut it down!

Meanwhile, LogRhythm and Exabeam merge, likely with the hopes of weathering the coming storm. The situation seems clear - there's no such thing as "best of breed" SIEM anymore. It's a commodity to be attached to the existing dominant security platforms. Are the days numbered for the older pure-play SIEM/SOAR vendors out there? Crowdstrike and Palo Alto alone could displace a lot of incumbents, even with a less than stellar product.

Show Notes: https://securityweekly.com/esw-362