TechSpective Podcast

Inner Circle Podcast Episode 015

Dr. Galina Datskovsky--an expert in the fields of compliance and information governance, and CEO of Vaporstream--joins me to talk about secure messaging. More specifically, we discuss the fixation on encryption and the ways that encrypted email still falls short of the goal of secure messaging.

There is a lot of focus on encryption--as there should be. Encryption is fine. Effective encryption is important to secure and protect data and email communications as they traverse across the public internet from Point A to Point B. The question is, how secure is your data once it arrives at Point B?

If I send an email with a sensitive file attachment--perhaps confidential information about an upcoming product release, or sensitive data like financial projections or employee salary details--I definitely want that data to be encrypted in transit. Once the recipient receives the message, though, it is typically decrypted seamlessly and automatically and now sits on the recipient's computer...unencrypted. The recipient might be able to screenshot or forward the information, and I would never know. If the recipient's PC is vulnerable or insecure and gets targeted by an exploit or malware, my confidential or sensitive material is now at risk.

Encryption is great, but secure messaging goes a step further. What can you do to restrict or limit what the recipient can do with the message or data once it is received. Can you terminate permission to view or access data after the fact? Is there anything you can do to prevent an attacker from accessing your data if the recipient's PC is compromised? Listen to the podcast to find out.

Inner Circle Podcast Episode 014

My guest for this episode of the Inner Circle podcast is John Sawyer, Associate Director of Services at IOActive. Are you secure? Sure, you've invested a lot of time, money and effort to security and you've implemented firewalls, spam filters, antimalware solutions, intrusion detection and other security tools, and you've developed and implemented security policies--but are you sure they're effective? Are you confident that you can detect or block an attack right now?

A Red Team assessment would help you answer that question. Sawyer's focus is on "Red Teaming". Companies hire him and his team from IOActive to act as attackers and try to gain access to their network, servers, applications and data.

I want to be part of a Red Team when I grow up. I met John at RSA earlier this year and we talked about some of the exciting things he's done and the interesting things he's encountered as a function of doing Red Team assessments. It sounds like a super cool job.

The value for the company in hiring a team like IOActive to conduct a Red Team exercise is peace of mind. Hopefully your security measures and IT security personnel will be able to detect and thwart the Red Team attack. Even if they are, though, in most cases the Red Team will still be able to provide valuable insight to help identify weak spots that can be improved. 

It's also something that should be done on an ongoing and regular basis. Environments change. Attack techniques change. New exploits are developed. The threat landscape is dynamic and constantly shifting. Just because you pass a Red Team exercise today, doesn't mean you would be successful next week.

Inner Circle Podcast Episode 013

When attackers can consistently crack or compromise the credentials of legitimate users to gain access to your network, it is less and less feasible to trust a user based solely on that initial authentication. For this episode of the Inner Circle podcast, I am joined by Den Jones, director of enterprise security for Adobe, to talk about Project ZEN -- Adobe's implementation of zero trust.

ZEN is an acronym for "Zero-Trust Enterprise Network". Adobe wanted to improve its security posture and take action to try and ensure proactive cybersecurity for Adobe employees and their data. Jones and Adobe have determined that the most effective way to do that is to adopt a zero trust mentality.

The core concept is that nothing is inherently trusted. Rather than authenticating a user at initial login and assuming that all actions from that point forward are authorized and benign, Project ZEN (or zero trust in general) constantly monitors and verifies each action and interaction to ensure it still meets with established policies and does not seem inherently suspicious or malicious.

To learn more about zero trust and Adobe Project ZEN, listen to this episode of the Inner Circle podcast. You can also check out this blog post from Adobe that provides more detail. Feel free to comment below to share your thoughts on zero trust security and this episode of the Inner Circle.

Inner Circle Podcast: Episode 012

Chris Bray, senior vice president and general manager for consumer products at Cylance, is my guest for this episode of the Inner Circle podcast. Chris joins me to talk about the new offering Cylance has for the consumer market, and what sets Cylance Smart Antivirus apart from competitors in the consumer antimalware space.

Antimalware is primarily reactive--attackers get the first move and then security vendors race to reverse-engineer the new threat and develop a signature that will enable customers to detect and avoid that threat in the future--assuming they've updated and applied the latest signatures.

Cylance was created to break that model and come up with a more proactive defense. Cylance has been leading new innovation in antimalware and endpoint protection since the company first launched. Mathematical algorithms and machine learning give Cylance a unique edge over competing antimalware and endpoint protection solutions--a predictive advantage that enables Cylance to identify and block emerging threats even if the software hasn't been updated for months--or years.

Chris and I also talk about the pricing for Cylance Smart Antivirus. Many consumers are jaded about antimalware in general after having various options forced on them as bloatware when they purchase new computers, and they're tired of the sort of bait-and-switch pricing deals that often come with things like antimalware products, internet service, cable TV, wireless service and other consumer goods and services. Everybody likes to get a good deal, but nobody likes it when the deal ends a year later and the price jumps sharply higher.

Listen to this episode to learn more about what sets Cylance Smart Antivirus apart from competing antimalware solutions. For some reason, the audio from my end is a bit choppy at times. My apologies in advance for the poor audio quality.

Inner Circle Podcast: Episode 011

My guest on the Inner Circle podcast this week is Mike Armistead, co-founder and CEO of Respond Software. We talked about artificial intelligence (AI) and the increasingly important role that AI and machine learning (ML) play--particularly when it comes to cybersecurity and the security operations center (SOC).

We all know that robot overlords powered by artificial intelligence (AI) will one day rule the world and subjugate humanity, right? I mean, I've watched the Terminator movies. I've also seen the YouTube clips of robots developed by Boston Dynamics and I am familiar with the concept of the singularity. It's only a matter of time, really.

OK. That day may or may not come, but it's a long way off regardless. The bigger fear today is simply, "Will an AI steal my job?" However, according to Armistead, the more relevant question right now is, "Can I truly trust the AI to do the job I've assigned it?"

AI is not perfect. The functionality and value of an AI is determined both by the quality and volume of the data that is fed into the ML algorithms, and by the coding logic applied to that data. Having a ton of data and an AI is not an automatic recipe for success--it has to be the right data, analyzed in the right way in order to generate useful output.

Armistead and I talked about the role of AI in cybersecurity and the value it has in a SOC environment. Manual processes simply can't keep up with the sheer volume of threats, especially in a vast, dynamic environment like containers in the cloud. AI is crucial in that scenario because it can process exponentially more data in a fraction of the time, and correlate it with previous incidents and data to quickly identify suspicious or malicious activity that deserves more attention. The AI acts as the Level 1 SOC analyst so the human beings can focus only on the issues that are relevant.

All of that assumes the AI is properly tuned, though--and that is an ongoing process. Listen to this episode of the Inner Circle podcast to learn more and share your thoughts in the comments below.

Inner Circle Podcast: Episode 010

My guest on this episode of the Inner Circle podcast is Bill Mann, Chief Product Officer for Centrify. We talk about what Centrify is doing to secure and protect DevOps environments, and then also discuss the Secure the Vote initiative that Centrify is driving in the months leading up to a crucial election this November.

The mantra at Centrify is "Never trust, always verify". The company is focused on providing streamlined and automated identity and access management. Centrify provides a set of solutions designed to enable companies to securely build and deploy applications using DevOps practices. These solutions centralize and automate access controls to developer toolchains and underlying infrastructure, enhance application security, and enable logging and auditing of privileged activity.

Centrify also wants to help protect the integrity of our elections with zero trust security. To everyone outside of the White House or Fox News (or those that actually listen to or believe them), it has been proven and accepted that Russia engaged in aggressive attempts to influence and disrupt elections in the United States in 2016. Although Donald Trump lost the popular vote by 3 million votes, he was able to successfully capture enough Electoral Votes to win the election.

Three states made all the difference, and the total vote difference from all three combined was only 77,744. Trump won the Electoral College with a final tally of 306 to 232. Wisconsin, Michigan, and Pennsylvania combined are worth 46 electoral votes. Had those states gone the other way, President Hillary Clinton would be sitting in the White House with a victory of 278 to 260, and the United States wouldn't be alienating allies, kissing up to adversaries, and aggressively pursuing an agenda to turn the country into Gilead from The Handmaid's Tale.

77,744. That is only six hundredths of a percent of the total votes cast in the election. When you step back and look at what Russian election hacking was able to do through fake news and propaganda ads on social media sites, and its direct hacks of election boards--it seems probable that meddling by Russia changed the election outcome. They don't have to hack the actual voting machines and election results--just alter information or purge voter rolls at election boards. It won't prevent dedicated people from voting anyway, but it sows chaos and you only need six hundredths of a percent of the people to decide it's not worth the effort to debate it and just go home without voting.

Voila! You get President Trump. Thanks, Russia.

To help guard against a repeat of this election hacking this November, Centrify is offering its zero trust security to election boards at no cost with its Secure the Vote offering. Tom Kemp, CEO of Centrify, explained, "It is incumbent upon us to protect our citizens’ information, which starts with voter registrations and election integrity. In order to secure the vote, Election Boards need to protect their election systems, and more importantly, sensitive voter registration information against bad actors. That starts with adopting a new mindset that compromised credentials are the main attack vector."

Check out the podcast to hear what Bill has to say. Subscribe to the Inner Circle podcast on iTunes, or wherever you get your podcasts from. Please rate, review and share the podcast, and feel free to comment below if you have any feedback.

Inner Circle Podcast: Episode 009

Scott Scheferman, a Senior Director of Global Services for Cylance, is my guest on this episode of the Inner Circle podcast. Scott and I discuss what predictive advantage is and why it matters in the context of defending networks and systems against emerging malware threats and exploits.

I've been a CISSP since 2002 and I used to work as a security analyst and security consultant. I spent a number of years focused on antivirus / antimalware--helping to develop and grow the managed antivirus service at EDS. One of the things that I recognized very early on is that the very concept of antivirus--and much of information security in general--is reactive.

Traditional antivirus / antimalware solutions rely on giving the attacker the first move. There has to be a "patient zero" that gets infected, or some other means of detecting a threat in the wild before there can be a defense against that threat. The antimalware companies capture and reverse engineer the threat to develop a signature that recognizes and blocks it...once the signature is available and deployed on your system. Before that point, you're still vulnerable. During the lag time between the threat being detected and you applying the appropriate signature, you're still vulnerable.

That's where predictive advantage comes in. Cylance takes a proactive approach to identifying and avoiding threats that is completely different than the traditional antimalware model. Rather than being rendered essentially useless until a new signature is developed, Cylance software that hasn't been updated in months--or years--is still capable of recognizing and detecting emerging threats. That is the predictive advantage that makes Cylance a superior method of defending against malware and exploits.

Listen to the podcast to learn more.

Quick "It's a small world" side note. Prior to starting the actual podcast, Scott and I were just chatting and I asked him where he is based out of. I assumed it would be somewhere in California--most likely near San Francisco. Nope. He said he is from The Woodlands--a little north of Houston. As it turns out, I am also in The Woodlands--a little north of Houston. Scott and I actually live within 10 minutes of each other. Who knew?

Inner Circle Podcast: Episode 008

On this episode of the Inner Circle podcast, I am joined by Matt Alderman, Chief Strategy and Marketing Officer for Layered Insight. We’re both thankful that we’ve moved on to greener pastures, but I worked under Matt not long ago when we were both at Tenable—prior to the Great Marketing Purge of 2017. At Layered Insight, Matt is focused on effective container security—and how to address and overcome the challenges that face most of the existing container security strategies.

With every hot new technology, there’s a period of meteoric growth where early adopters all jump on board and it gains some mainstream momentum. At some point, it hits a critical mass and it suddenly occurs to everyone that we should probably also think about how to secure the new technology. Containers are no different. Docker emerged to bring mainstream traction to containers, and as container adoption has taken off we find ourselves in that same, familiar situation of trying to retroactively consider the question of security.

There are a number of strategies and approaches that have been introduced to address the issue, but many—most, really—have their own issues and create as many problems as they solve. The most prevalent container security concepts seem to rely on kernel plugins or privileged access containers—both of which require root access to the underlying OS and break some of the most important functionality of using containers in the first place.

In the podcast, Matt talks about the realities of trying to retrofit security and points out that initial attempts at container security attempt to apply old security models to a new technology, and it simply doesn’t work. Container environments are too dynamic for any security solution to be applied externally—which is why Layered Insight takes a container native approach of embedding security within the containers themselves.

Inner Circle Podcast: Episode 007

My guest for this episode of the Inner Circle podcast is Daniel Miessler, Director of Advisory Services for IOActive. Daniel presented a session at IOAsis a few weeks ago while we were in San Francisco attending the RSA Conference. I was not able to attend, but the session title--"Machine Learning Demystified: Separating the Magic from Marketing"--piqued my interest.

If you read through enough tech and security vendor websites and it will quickly feel like the whole world revolves around machine learning (or ML) and machine learning and machine learning algorithms are magic technologies that are going to transform the whole world. That is true to some extent, but there's also a lot out there about ML that is either exaggerated or just plain false. There is also a fair amount of confusion and misperception about what machine learning is or isn't, and how it is different from and/or works with artificial intelligence.

There are a number of things machine learning is great at, and a few that it is uniquely suited to fundamentally change the way we process and leverage data. If used improperly, though, machine learning can also provide results that simply tell you what you want to hear, or create issues if customers place too much trust in ML output.

The challenge for businesses and consumers, though, is how to see through buzzwords and marketing spin and figure out which companies or products are actually doing something worthwhile with ML. As I mentioned above, every company seems to talk about machine learning as if they're all doing the same thing with it. If you don't know any better and don't understand what you're looking for, it would be very easy to feel like ML is just a commodity technology that doesn't provide a competitive advantage. Daniel provides a set of key questions you can use to quickly separate the snake oil from the real deal.

Inner Circle Podcast: Episode 006

My guest on this episode of the Inner Circle podcast is Corey Williams, Senior Director of Product Management at Centrify. The focus of our chat is next-gen access, and how the principle of zero trust security is a better approach for identity and access management.

I think we can all agree at this point that the perimeter is gone--at least what we traditionally considered to be the perimeter. The idea of an invisible wall at the edge of your network that separates "us" from "them" doesn't fit with the reality today. The proliferation of mobile devices, IoT devices, and other technologies obliterated the "perimeter" so there is no "inside" and "outside", really.

The threat landscape has shifted as well. Attack techniques continuously evolve, and the reality is that most attacks are "inside attacks" these days. Whether it's a disgruntled employee, a naïve or lazy employee, or a malicious attacker using hacked or stolen credentials, the suspicious and malicious activity on your network is most likely coming from someone you "trust".

In this episode of Inner Circle, Corey and I talk about why the philosophy of "Trust but verify" is no longer adequate. Companies need to approach security from the perspective of "Never trust, always verify."

The zero trust security philosophy is at the heart of next-gen access. Rather than assigning a level of trust and providing access to resources and data and just assuming the individual will behave as expected, next-gen access authenticates access and validates activity every step of the way.