CrowdStrike Fal.Con 2024 | Tom Etheridge | Crowdstrike

theCUBE.net

Clips
News
More from CrowdStrike Fal.Con 2024

Thomas Etheridge

Chief Global Services Officer

CrowdStrike

MDR in action: Analyzing CrowdStrike’s approach to protecting the digital frontier

As enterprises battle relentlessly against constant cyber threats, CrowdStrike Inc.’s multifaceted services have been positioned to safeguard businesses from growing threats by erecting perimeters along the digital frontier.CrowdStrike’s Tom Etheridge discusses MDR’s evolution with theCUBE.“Our job in services is to focus on two things,” said Tom Etheridge (pictured), chief global professional services officer of CrowdStrike. “One is the customer

play_circle_outline Tom Etheridge's role as Chief Global Professional Services Officer at CrowdStrike

play_circle_outline Pioneering Managed Detection & Response Services: Prioritizing Customer Value and Platform Integration for Breach Prevention

play_circle_outline Automation and AI integration in services for efficiency and speed

play_circle_outline Recruitment of diverse skill sets including former CISOs and incident responders

Info
Transcript

Tom Etheridge | Crowdstrike

Thomas Etheridge

Chief Global Services Officer CrowdStrike

TheCUBE's live coverage of Fal.Con 2024 features Tom Etheridge, Chief Global Professional Services Officer at CrowdStrike. He oversees global services, including incident response, training, and education. CrowdStrike focuses on helping customers prevent breaches through consulting and advisory services. They offer managed detection and response, using automation and AI to improve efficiency. CrowdStrike hires diverse talent, emphasizing the human element of cyber threats. Recent trends include identity compromises and insider threats. They aim to help smalle... Read more

explore Keep Exploring

What are the responsibilities of the Global Services organization at CrowdStrike? add

What is the focus in services when it comes to helping customers prevent breaches in their environment? add

What capabilities are being leveraged on the MDR and consulting sides to increase efficiency in incident triage and remediation at scale? add

What types of professionals does our advisory practice recruit to help organizations with regulatory compliance, cybersecurity, and incident response? add

bolt Powered by CUBE AI

Tom Etheridge | Crowdstrike

search

Rebecca Knight

>> Hello everyone and welcome back to theCUBE's live coverage of Fal.Con 2024 here at the Aria Resort and Casino in Las Vegas, Nevada. I'm your host, Rebecca Knight, alongside my co-host and co-analyst, Dave Vellante. We've got a very good friend of theCUBE joining us for this session. He's Tom Etheridge, Chief Global Professional Services officer here at CrowdStrike. Thank you so much for coming back on.

>> Thanks. Nice to be here, Rebecca. Dave, good to see you again.

Dave Vellante

>> Hey Tom. Good to see you again.

Rebecca Knight

>> So for those viewers who have not watched all your highlight reels, just set the scene for us in terms of what you do as Chief Global Professional Services Officer.

>> So at CrowdStrike, I run the Global Services organization that includes our professional services business as well as our managed services business. Really, we run the IR forensics business globally. We have assessment and advisory services team. We do training and education, specifically around the platform, but also around specific skills like threat hunting and incident response. I also own our managed services, Fal.Con Complete Business, our MFDR.

Dave Vellante

>> So services, it's where real stuff really happens. It's where you build loyalty. I used to say rubber meets the road. I still say that. But you're a product company, and so I'm always interested when I talk to executives who run services organizations at product companies, how that works and what the balance looks like. Maybe it's different in cyber, but I wonder if you could address that, Tom.

>> So I think our job in services is to really focus on two things. One is the customer. Our job is to make sure that we're helping the customer stop breaches from happening in their environment. Whether we do that through effective incident response and forensics investigatory work, or we do that through advisory and assessment and delivering some of the cybersecurity consultative experiences to help customers get better at both detecting and responding to incidents that they have in their environment. We're really focused on the customer delivering that value and driving the platform into those accounts so that they get the value of not just the consulting work, but a solution that's going to protect them long term.

Dave Vellante

>> So it's obviously not a big part of the P&L by design. So what kind of freebies can the customer take advantage of?

>> Freebies, we publish a lot of blog material, a lot of content about the things that we are uncovering in our investigations, about what we see in the threat landscape as well as what we typically advise customers on in terms of preparedness and response-related activities. So it's a lot of free consulting that we offer to all of our customers in that regard.

Rebecca Knight

>> Well, I definitely want to dig into what you're finding, but first I want to ask you about this category that CrowdStrike really pioneered the managed detection and response, and this is really where the company's roots are. Can you talk a little bit about how this has shaped the company's outlook and mindset in terms of how you consult with customers?

>> So this started actually in professional services, the managed services felt like a complete part of our business. One of my incident response directors after about 14 lost weekends in a row, came in and said, "I don't think I can do this anymore." And we sat down and said, "What's at the root of the problem?" And really there were a couple of areas we dove into. One area is that a lot of organizations and victims out there, they knew they were having a problem and they were working within the confines of their organizational structure and the tooling that they had to try to mitigate that attack from having a big impact. And we would get the call on Friday after a week or more of work where they couldn't stop the attack and we would go in and deploy our tooling and we would deploy the expertise to actually take action on behalf of the customer. So we said, "How do we operationalize that in a managed services capability?" And thus we started building out our MDR. So the purpose of our MDR is to really monitor 24/7, 365 on threats that are occurring on first-party data. First-party data for us is identity endpoint and cloud. Triaging incidents that we see in the environment very, very quickly. Talk about the threat report. I'm sure Adam's probably talked about it. Breakout time's very, very quick. We're seeing 62 minute breakout time. So being able to triage and understand an incident very quickly is important, but more importantly is actually remediating that incident. So taking the corrective action on the first-party data and structure so that you stop the attack from progressing. And that's really what our MDR is capable of doing.

Dave Vellante

>> Wow. I mean, picking up here-

Rebecca Knight

>> It sure is, yeah.

Dave Vellante

>> You were talking earlier about, "Well, getting deep into the program." But it really is hopping here. Tom, I want ask you about... I mean, every person in the planet is or should be thinking about how do I apply AI to become more efficient? Services is obviously a great example of where you can continue to automate and raise the bar. Almost the step function now is in front of us. How are you thinking about applying automation to the next level and AI to your business?

Rebecca Knight

>> On the MDR side in particular, we've been leveraging Charlotte and a lot of the tooling that we've built internally to take advantage of speed, increasing the speed in which we're able to triage incidents, to contextualize incidents with the intelligence that the company produces and to be able to build and automate some of the runbooks that the team has built around remediation in particular. So really taking advantage of those capabilities to make more efficient and speed up the time we're able to actually triage and remediate some of these incidents at scale. That's on the MDR side. On the consulting side, we are taking full advantage of what we've built into the product and what we've announced this week in terms of incident workbench capabilities that exist in the product today to make the analysts that are doing this investigatory work much more efficient. And doing that at scale, we even talked this morning in one of the keynotes about the incident workbench and being able to have multiple analysts working in the same incident but be able to collaborate online in the platform. So really powerful capabilities around automation, integration, improving communications, and leveraging the powers of AI.

Dave Vellante

>> In your service organization, what are the types of people that you bring in? What are the skill sets? Who are you hiring in that organization?

>> In our advisory practice as an example, we're pulling in some former CISOs and folks that have worked in the security function, directors of security, to help organizations understand what they need to be thinking about from a regulatory and a compliance perspective, as well as from a cybersecurity perspective. On the incident response side, we have a very robust internship program. So we recruit from some of the top universities in the States and abroad, run them through eight to twelve week program where they get to see all of the types of services that we deliver, and then they can pick and choose really what they want to focus on. We bring them on board. We have a pretty good success rate of pulling interns through and we recruit some of the top incident responders out there, people that have great systems engineering and architecture backgrounds, folks that understand data and understand how threat actors are working in the environment.

Rebecca Knight

>> What about non-traditional backgrounds too? Because we've had a number of guests talk about how you really need people who understand humans, understand their foibles, can sort of work backwards from the social engineering aspect and understand the kinds of mistakes they would make wittingly or not? And really have to think like a criminal too, because there's that kind of understanding of manipulative behaviors that are the way our adversaries think.

>> Our red teaming capabilities on the services side, we have folks that are very adept at social engineering. So they're pretty good at being able to use some of the psychological tools and use the social interactions to be able to convince organizations to either give them access or open up access. And we're using some of the AI and some of the toolings that we're building on the red teaming side as well, really building some robust capabilities around how do we build that into some of the attack capabilities that our red team is leveraging.

Dave Vellante

>> Do people in your organization name these bad guys, the Chollimas and the-

>> That is our SVP of Threat Intel, Adam Myers, that's his group. He does ask for support in naming the threat actors.

Dave Vellante

>> Did you guys know what a Chollima... I don't even if I'm saying it right. Did you know what a Chollima was before-

Rebecca Knight

>> No, I didn't. No.

Dave Vellante

>> Do you know what it is?

Rebecca Knight

>> No.

Dave Vellante

>> It's like a mythical figure. It's very popular... It's like a winged animal and it's very popular in North Korea, so it's actually quite clever.

Rebecca Knight

>> Yeah, no, they're very imaginative and creative names. Absolutely.

Dave Vellante

>> They're fantastic.

Rebecca Knight

>> Yeah. So you need those kind of people on your team too. You need those English literature PhDs.

Dave Vellante

>> We really try to humanize these threat actors because like Adam has said multiple times, you don't have a malware problem, you have a threat actor problem. There are humans behind these threats. And I think what we've been reporting this week with famous Chollima and some of the identity insider attacks that we're seeing in the market, that's been pretty impactful over the last 60 plus days.

Dave Vellante

>> And that's where we were teasing Adam's podcast. Adam and... I'm sorry. I don't know his podcast partner, but they did the after dark podcast last night, and that was one of the things they showed, and they showed the keynote today. You saw it, where these insiders were getting access. It was just insidious and amazing real world examples of how relatively easy it is to circumvent the protocol.

Dave Vellante

>> Remote work has opened up the aperture for threat actors to really take advantage of the hiring process and recruiting and pull people into the organization without the requisite checks and balances that probably existed when you had employees coming into an office and sitting down with HR for their onboarding. So it's amazing to see how pervasive that problem... I think reported today was about 150 impacted companies that the services and Intel team have been communicating out to through law enforcement

Dave Vellante

>> And really brazen, of course. Like I said, these were examples of actually North Korean individuals, young people that had clearly had technical backgrounds that were gaining access to laptops and then obviously were credentialed. Well, come on in. But what strikes me is, okay, that's really brazen, but again, you could have somebody internally who's just a criminal.

Rebecca Knight

>> Disgruntled or... Absolutely. But then, these are some pernicious examples, but then there's some business email issues too, that you're seeing a lot of right now. Tell us a little bit more about that.

Rebecca Knight

>> Yeah, one of the things that we've been talking to our partners about, law firm partners and insurance partners about, is that the concept of a business email compromise has been kind of compartmentalized to somebody gains access to a user's inbox or email and then they attempt to extort or defraud that organization through some kind of payment request. In our interviews with folks that are reaching out to ask for support in these cases, one of the things we've been uncovering is that there's certainly cases where somebody will click on a phishing link and open up the aperture for access into the environment. But we've been saying for over a year, "Threat actors aren't breaking in. They're actually just logging in." They gain access to a stolen credential, they access the environment, they happen to be able to get into somebody's inbox, and then they carry out these business email compromises. So one of the threads we pull when we're talking to these victims is, "You may have a business email impact, but you may have an identity impact that you need to really investigate." So we've been talking to a lot of victims about their identity infrastructure. What kind of visibility do they have? Are they managing identities properly? Do they understand what identities may have been compromised or available for purchase? And those are areas we focus in on when we're doing a lot of these investigations.

Dave Vellante

>> And it's not your business, but I heard talk last week actually, Larry Ellison on stage was saying, "We're going to get rid of passwords. Passwords are dumb. It's ridiculous."

Rebecca Knight

>> They are. I hope that they do.

Dave Vellante

>> He says, "Safra Catz doesn't ask me for a password. She just knows me. My son knows me. We're going to get rid of passwords." He sounded like Trump, "We're going to get rid of the debt in eight months." But will we ever get rid of passwords?

Dave Vellante

>> Maybe not in my career. What's left in my career here, I don't see us getting rid of passwords. I think with multifactor authentication, which is a challenge for a lot of organizations still, but being able to roll out additional capabilities to re-authenticate, or challenge a user to make sure that they are who they say they are. I think last year when we were talking, it's not verify than trust. It's now we got to get back to more like trust then verify then trust. So it's really something we're focusing in on. We have a lot of conversations with victims about managing identities and credentialing a lot better. You see situations where they say they have a password management policy, they say they have all the rules in place and good controls, but a lot of these organizations are managed by exception. So for every 500 users in an environment, there's always a handful of people that have an exception to the policy and threat actors love those exceptions.

Rebecca Knight

>> That's where they live. That's where they swim.

>> That's where they live. We had one victim some time ago had told me that's not the intent that they issued that credential that the threat actor took advantage of. And the threat actor doesn't really care what the intent of the credential was, they just know what they can do with the credential. We say it's like, "We gave you card key access to your office, but when we gave you the access key, we actually gave you access to everybody's office." You wouldn't know unless you walked around swiping it on everybody's office, but a lot of these credentials are privileged and they just open up the aperture for access to too much stuff.

Dave Vellante

>> And this is in a customer base that's that's pretty well established.

Rebecca Knight

>> Sophisticated.

Dave Vellante

>> It's pretty sophisticated, but you guys indirectly do a lot of business with small businesses. You've got partnerships with Dell. And small businesses, they don't even think about these things. Now maybe they're not as rich a target, but there's a lot of them.

>> There are a lot of them for sure.

Dave Vellante

>> If you can get money out of them, it scales.

>> Our job is to make sure they don't get breached again. So we try to do our best to make sure that they take advantage of what we can offer, not just from a services perspective, but from a product perspective. And we see a lot of great adoption of the platform, even in the small to mid-market accounts.

Rebecca Knight

>> Excellent. Well, Tom, always a pleasure having you on theCUBE. Thanks so much.

>> Thank you, Rebecca.

Dave Vellante

>> Appreciate it.

Dave Vellante

>> Thanks, Dave. Appreciate it.

Rebecca Knight

>> A great conversation. Pretty scary, but a great conversation.

>> Thank you.

Rebecca Knight

>> I'm Rebecca Knight. For Dave Vellante, keep it right here on theCUBE. We'll be back with more of our live coverage of Fal.Con 2024. You're watching theCUBE, the leader in enterprise tech news and analysis.