RSA Podcasts

Byron Acohido · Post RSA Conference 2021 takeaways

Last Watchdog podcast: Unwrapping ‘resilience’ guidance discussed at RSA Conference 2021

By Byron V. Acohido

Resilience was the theme of RSA Conference 2021 which took place virtually last week.

I’ve been covering this cybersecurity gathering since 2004 and each year cybersecurity materially advances. By the same token, the difficulties of defending modern IT systems has redoubled as organizations try to balance security and productivity.

The outside pressures are indeed as daunting as ever. Migration to cloud infrastructure is accelerating; reliance on wide-open, modular software development is deepening; and the shortage of skilled security analysts is wider than ever. Meanwhile, deep, damaging network breaches persist, affecting companies of all sizes and in all industries.

I visited with Bruce Snell and Setu Kulkarni from NTT Security to discuss this.

Snell is vice president of security strategy; his resume includes a stint as McAfee’s cybersecurity and privacy director.

And Kulkarni joined NTT Security last fall as vice president of corporate strategy, coming over with NTT’s acquisition of WhiteHat Security, where he was VP, Corporate Strategy & Business Development (Editor’s note: an earlier version misstated this title.) For a lively debrief of RSA Conference 2021, please give the accompanying podcast a listen.

Acohido

Pulitzer Prize-winning business journalist Byron V. Acohido is dedicated to fostering public awareness about how to make the Internet as private and secure as it ought to be.

MY TAKE: How SASE has begun disrupting IT — by shifting cybersecurity to the ‘services edge’

By Byron V. Acohido

One of the hottest topics at RSA Conference 2021 taking place virtually this week is the Secure Access Services Edge (SASE) security framework.

SASE (pronounced sassy) essentially is a roadmap for infusing privacy and security deeply into the software coding that gives life to our smartphones, IoT devices and cloud infrastructure, i.e. at the “services edge,” where all the action is taking place.

Coined by Gartner in late 2018, SASE is gaining momentum as a generational disruptive force. It calls for organizations to start proactively managing the myriad new attack vectors they’ve opened up in the pursuit of digital agility — by embracing a bold new IT architecture that extends network security far beyond the traditional perimeter

However, disruption doesn’t happen without displacement. And at this early stage, things are a bit chaotic. As established and newer cybersecurity vendors scramble to catch the SASE wave, marketing messages have sometimes been less than clear.

From the customer’s point of view, some early-adopter enterprises have experienced buyer’s remorse trying out SASE services that don’t really make the grade, says Mike Spanbauer, security evangelist at Juniper Networks, a Sunnyvale, Calif.-based supplier of networking technology.

“What we’ve heard from out in the marketplace is that a number of SASE solutions that supposedly could deliver everything as promised, were found to be lacking in many capacities,” Spanbauer says.

Byron Acohido · A cloud security primer on 'CWPP' and 'CSPM'

RSAC insights: Introducing ‘CWPP’ and ‘CSPM,’ new frameworks to secure cloud infrastructure

By Byron V. Acohido

A greater good has come from Capital One’s public pillaging over losing credit application records for 100 million bank customers.

In pulling off that milestone hack, Paige Thompson took advantage of CapOne’s lack of focus on cloud security as the banking giant rushed headlong into leveraging Amazon Web Services. Luckily, Thompson left an easy trail for the FBI to follow and affect her arrest in August 2019.

The lone wolf hacker’s lasting legacy may be that she gave the cybersecurity industry an impetus to double down on its efforts to help enterprises get a grip on cloud security.

A slew of new cloud-security frameworks have gained traction since the Capital One hack. I recently had the chance to sit down with Kevin Simzer, chief operating officer of Trend Micro, to discuss two of them: Cloud Workload Protection Platform (CWPP) and Cloud Security Posture Management (CSPM.) For a full drill down on our conversation please give the accompanying podcast a listen. Here are the key takeaways:

Cloud migration risks

The summer of 2019 was a heady time for the financial services industry. Capital One’s valuation hit record highs at a time when its senior executives bragged on Wall Street about how the bank’s aggressive adoption of AWS-supplied infrastructure would boost both profits and security. In reality, the bank wasn’t paying close enough attention to its shared responsibility for keeping its cloud-stored assets secure.

Byron Acohido · Good threat intelligence triggers effective response to cyber attacks

RSAC insights: Deploying SOAR, XDR along with better threat intel stiffens network defense

By Byron V. Acohido

Much attention has been paid to the widespread failure to detect the insidious Sunburst malware that the SolarWinds hackers managed to slip deep inside the best-defended networks on the planet.

But there’s also an encouraging ‘response’ lesson SolarWinds teaches us, as well.

Reacting to the disclosure of this momentous supply-chain hack, many of the breached organizations were able to deploy advanced tools and tactics to swiftly root out Sunburst and get better prepared to repel any copycat attacks. It was an opportunity to put their security orchestration and automation and response (SOAR) solutions, as well as endpoint detection and response (EDR) tools, to the test.

In that sense, SolarWinds validated the truckloads of investment that has been poured into developing and deploying SOAR and EDR innovations over the past five years. I had the chance recently to visit with Leon Ward, Vice President of Product Management, at ThreatQuotient, provider of a security operations platform with multiple use cases including serving as a threat intelligence platform (TIP). We discussed current developments that suggest SOAR and EDR will continue to improve and make a difference.

For a full drill down on our conversation, please give the accompanying podcast a listen. Here are my key takeaways:

Leveraging richer intel

It was by happenstance that analysts at FireEye, a leading supplier of intrusion detection systems, stumbled into a copy of the Sunburst Trojan ever-so-stealthily embedded in FireEye’s own copy of SolarWinds’ Orion network management software. That was on Dec. 13, 2020.

Byron Acohido · A primer on SASE - pushing security to the 'services edge'

RSAC insights: ‘SASE’ disrupts networking by meshing security, connectivity at the services edge

By Byron V. Acohido

It’s accurate to say that security has been bolted onto modern business networks.

It also has become very clear that we won’t achieve the full potential of digital transformation without security somehow getting intricately woven into every layer of corporate IT systems.

We’re still a long way from achieving that, but a promising roadmap has emerged. It’s a new model for architecting enterprise IT systems, dubbed Secure Access Service Edge (SASE), a term coined by top security analysts at tech advisory firm Gartner.

I had the chance to visit with Kelly Ahuja, CEO of Versa Networks, a supplier of SASE systems. For a full drill down on our discussion on why SASE could be game changer, please give a listen to the accompanying podcast. Here are the key takeaways:

Connectivity vs. security

Corporate networks exist to connect users to applications. Traditionally this was done by setting up a datacenter at company headquarters, and having employees enter the building and access applications using company-managed equipment. Thus, local area networks, or LANs, were born.

Then along came wide area networks, or WANs, as a means to securely connect several LANs set up in geographically dispersed branch offices. Over time WANs proved to be expensive and inflexible, so they began to be replaced with software-defined wide area networks, or SD-WANs, which offered heightened data-transfer efficiencies.

However, the first-generation of SD-WAN solutions were notable for one key thing: they were solely focused on improving connectivity and did little to account for security.

Byron Acohido · How security-by-design can be done early in the software development cycle

RSAC insights: Security Compass leverages automation to weave security deeper into SecOps

By Byron V. Acohido

In a day and age when the prime directive for many organizations is to seek digital agility above all else, cool new apps get conceived, assembled and deployed at breakneck speed.

Software developers are king of the hill; they are the deeply-committed disciples pursuing wide open, highly dynamic creative processes set forth in the gospels of DevOps and CI/CD.

In this heady environment, the idea of attempting to infuse a dollop of security into new software products — from inception — seems almost quaint. I recently sat down with Rohit Sethi, CEO of Security Compass, to discuss why this so-called “product security” gap inevitably must be narrowed, and why there are encouraging signs that should be what happens, going forward, albeit incrementally.

For a full drill down on our wide-ranging conversation, please give the accompanying podcast a listen. Here are key takeaways.

History of product security

It has become all too common today for an organization to commit to what Sethi calls a “fast-and-risky” approach to building new software products. In a race gain a competitive edge, companies do whatever it takes to deploy new software products as quickly as possible. As a nod to security, nominal static analysis and maybe a bit of penetration testing gets done just prior to meeting a tight deployment deadline.

This, in fact, was the same general approach to developing and deploying new software that existed in early 2002 when Bill Gates slammed the brakes on all Windows development to focus on implementing Trustworthy Computing. Microsoft, at the time, was on the brink of getting swallowed up by potent self-spreading Windows worms like SirCam, Code Red, ILoveYou and Nimbda. So Gates directed billions of dollars towards the adoption of Security Development Lifecyle, or SDL, a systematic approach to infusing product security at the start of the Windows development process.

Byron Acohido · A primer on CIEM, 'cloud infrastructure entitlement management'

RSAC insights: How the ‘CIEM’ framework is helping companies manage permissions glut

By Byron V. Acohido

A permissions glut is giving rise to an explosion of new exposures in modern business networks.

Related: Securing digital identities

Companies are adopting multi-cloud and hybrid cloud infrastructures and relying on wide-open app development like never before. In doing so, permissions to make myriad software connections are proliferating. Taken together these man-to-machine and machine-to-machine connections result in cool new digital services. But they’ve also dramatically expanded the attack surface and left it wide open to threat actors.

Now comes an emerging security discipline to help companies get a grip on all of these permissions. It’s called “cloud infrastructure entitlement management,” or CIEM, not to be confused with security information and event management, or SIEM, which is something else altogether.

Last Watchdog visited with Raj Mallempati, chief operating officer of CloudKnox Security, aSunnyvale, Calif.-based cybersecurity firm, to get a better understanding of emergent CIEM systems. For a full drill down on our discussion please give a listen to the accompanying podcast. Here are key takeaways:

The permissions glut

Managing permissions in a way that doesn’t unduly tax agility has become a Gordian Knot security challenge. To start, the raw volume of permissions continues to rise exponentially. Consider that global spending on cloud infrastructure services jumped 32 percent to nearly $40 billion in the last quarter of 2020. This reflects the rise in remote work and schooling, as well as spikes in online shopping, gaming and media streaming over the past 12 to 18 months.

Older Articles »

The Last Watchdog

RSA Podcasts

Last Watchdog podcast: Unwrapping ‘resilience’ guidance discussed at RSA Conference 2021

By Byron V. Acohido

MY TAKE: How SASE has begun disrupting IT — by shifting cybersecurity to the ‘services edge’

By Byron V. Acohido

RSAC insights: Introducing ‘CWPP’ and ‘CSPM,’ new frameworks to secure cloud infrastructure

By Byron V. Acohido

RSAC insights: Deploying SOAR, XDR along with better threat intel stiffens network defense

By Byron V. Acohido

RSAC insights: ‘SASE’ disrupts networking by meshing security, connectivity at the services edge

By Byron V. Acohido

RSAC insights: Security Compass leverages automation to weave security deeper into SecOps

By Byron V. Acohido

RSAC insights: How the ‘CIEM’ framework is helping companies manage permissions glut

By Byron V. Acohido