CrowdStrike Fal.Con 2025 | David Black, SiteOne Landscape Supply

Clips
More from CrowdStrike Fal.Con 2025

David Black

CISO

SiteOne Landscape Supply

play_circle_outline Introduction of David Black, CISO of SiteOne Landscape Supply, discussing company overview.

play_circle_outline SiteOne's shift from John Deere to independent operations and security program building.

play_circle_outline Navigating Ransomware: Leadership's Role in Resilience and Resource Allocation in Modern Data Recovery Strategies

play_circle_outline Collaboration with CrowdStrike post-attack to enhance security measures and incident response.

Info
Transcript

David Black, SiteOne Landscape Supply

David Black

CISO SiteOne Landscape Supply

Broadcasting straight from Las Vegas, Nevada, theCUBE brings you exclusive coverage from Fal.Con 2025 at the MGM. In this must-watch interview, hosts Rebecca Knight and Dave Vellante sit down with David Black, CISO at SiteOne Landscape Supply, to unpack how his team confronted a ransomware attack head-on and why CrowdStrike has become a trusted partner in resilience.

Black reveals how nearly 700 North American branches kept business running during the July 2020 incident, how recovery went from four days with tape to 15 minutes with modern backup syst... Read more

explore Keep Exploring

What is SiteOne Landscape Supply and what do they specialize in? add

What company was started by John Deere and how did its ownership and branding evolve? add

What were the circumstances and outcomes of the ransomware incident discussed? add

What are the potential benefits of using AI in the workplace, particularly in relation to employee engagement and job satisfaction? add

bolt Powered by CUBE AI

David Black, SiteOne Landscape Supply

search

Rebecca Knight

>> Welcome back everyone to theCUBE's live coverage of Fal.Con 2025 here at the MGM. I'm your host, Rebecca Knight, alongside my cohost and analyst, Dave Vellante. This is it.

Dave Vellante

>> Good week.

Rebecca Knight

>> This has been a fabulous show.

Dave Vellante

>> Really good.

Rebecca Knight

>> Really good conversations, and we have saved the best for last. The best one, I would like to welcome David Black. He is the CISO of SiteOne Landscape Supply from Atlanta, Georgia. Thank you so much for coming on.

David Black

>> I appreciate it. Thanks for having me.

Rebecca Knight

>> So tell our viewers a little bit about SiteOne Landscape Supply.

David Black

>> SiteOne Landscape Supply is one of the biggest companies you've probably never heard of. I know I had never heard of when I got the call from a recruiter. We are in the green industry. We specialize in wholesale distribution to professional landscapers. So we have almost 700 locations in North America. And typically, it is a professional landscaper coming in with a truck and a trailer and getting a lot of product as opposed to just going to a local store and getting a few bags or something. So we do about $4.5 billion worth of business in that space, and we're only in North America and Canada.

Rebecca Knight

>> Okay. So talk to me a little bit about what your security posture was like before CrowdStrike and now what it's like today and how you began working with CrowdStrike, let's say.

David Black

>> Gotcha. Actually, the company was started by John Deere, so it was John Deere Landscapes for a while, and it was a unique-

Rebecca Knight

>> That's a company everyone .

David Black

>> Yeah, everyone knows that one. So we were like a subsidiary under that, and the company took off and took off, and John Deere got to the point where it wasn't part of their core business, so they wanted to sell it off and spin us to go public. And so CD&R acquired 60% of the company. We rebranded to SiteOne and then we had to build everything from scratch, because we had been leveraging John Deere's programs. We had our own data centers and other things, but their policies, their procedures. So it was really, when I came on board, build a security program that is both compliant to Sarbanes-Oxley, SEC, and PCI compliance. Those were the main things we had to do. So as quickly as possible, I hired a team of four people. We started building out the program, putting the things in place that we needed to put in place. And we got to a point where we had the basics and we wanted to do a little bit more, but you get to that point where it's all risk management. And are you going to invest these millions, or do you live with a little bit of that risk? And we lived with a little bit of that risk, and it bit us. In 2020, we were hit by a ransomware attack, and-

Dave Vellante

>> When in 2020, pre-COVID?

David Black

>> It was July.

Dave Vellante

>> Okay. So post-lockdown.

David Black

>> Yeah. And I recall because I just moved into a new house. And for the first three months, I never left the basement because it was worth the incident. And if no one's ever gone through that, I pray they don't have to. It was quite the ordeal. Now, thankfully with us, we were able to identify the issue, contain it before it spread through our entire environment. But our outside council recommended that we bring in CrowdStrike to help us ensure that they were out, that we've contained it, we've mitigated it, we understand how it happened. And as we restore things, we're not worried that suddenly they're going to get re-encrypted because we didn't get them all the way out. So we took their advice, we called CrowdStrike. Thankfully, they were available and they assigned some of the most amazing resources we've ever worked with to help us through this. I mean, we were literally working 22 hours a day for seven days a week for two weeks, and it was 20 hours a day for the next two weeks, and it was 18 hours a day and it went on and on.

Dave Vellante

>> This is during COVID, when everybody was stressed out working ridiculous hours.

Rebecca Knight

>> That is rough.

Dave Vellante

>> So take us back to the moment that you found out that you had been attacked. What was that like?

David Black

>> It was 2:30 in the morning and, basically, our monitoring had gone off that some servers had gone offline that were tied to our point of sale system. And obviously, that's critical for someone like us with almost 700 locations, so it was all hands on deck. And as we started looking at it, we realized this is not a normal outage, this is ransomware. And at the time, you could see the files that they would leave behind as artifacts. We understood what that was. We were able to capture the signature, block it with our tools. Unfortunately, the tool we had at the time classified it as a low when the breach actually took place. So it was with 100,000 other lows, so we didn't really know it was something significant when it first started, but we were able to contain it at that point, stop the spreading, but the damage had already been done. So our branches were down for one day, they wrote paper tickets for our customers, because they know our customers when they walk in the door. So once the systems were back up, they were able to start using them. So it really didn't have a financial impact on us. It just had the impact on the resources to get ... We fell over to our secondary data center and had everything up and running, but then it was rebuild, the primary data center, and then fell back to that. And then one team's working on that while we're working on how did this happen and how do we make sure that they can't get back in.

Dave Vellante

>> So lucky. So you had an operational impact, obviously, and it was a productivity killer, but you had very minimal ... You didn't have a direct financial impact other than that one day, you've lost transactions right by hand. But you got all your data back?

David Black

>> Yes.

Dave Vellante

>> Which is actually often victims of ransomware attack don't get their data back.

David Black

>> We were lucky, we had a great support from our executive team and our board of directors for investing in the technologies around resiliency and recovery. When I started, we had tape backups and we had one incident where we lost some data and it took four days to recover the data from tape. It took us 15 minutes to recover from the ransomware incident where all the data was encrypted. So it's night and day story when it comes to resilience and recoverability.

Dave Vellante

>> Still use tape?

David Black

>> No, no, no, no. We're on a much better system now.

Dave Vellante

>> No? But not even as a last resort?

David Black

>> No, get rid of all those.

Dave Vellante

>> Tapes gone. Okay. And so you didn't pay the ransom?

David Black

>> No, thankfully.

Dave Vellante

>> What was that like? Did they contact you and say ... Did they have their help desk contact you?

David Black

>> It was amazing to me, and I did not know at the time that there were organizations that worked with companies like CrowdStrike and outside council that negotiate. So they get an account from us, and they're the ones that talk directly with the ransomware folks to negotiate what the ransom's going to be. It may start at 20 million, they may talk them down to 10. Thankfully, in our case, we didn't have to pay the ransom.

Dave Vellante

>> So a lot of times, attackers will exfiltrate data, you get your data back, but then they still have your data. It's a bigger deal in healthcare with HIPAA, financial services, with account, Social Security numbers, et cetera. But the data that they exfiltrated wasn't sensitive data. You said, "Go ahead, publish it on Reddit, it didn't really matter." Is that right?

David Black

>> Thankfully, one of our tools, we were able to look at that data and we were able to see that about probably 80% of the data was images from our website, which are publicly available anyway. So we were able to tell which data was taken as we went through it. There really wasn't anything that sensitive in the data.

Dave Vellante

>> Okay. So, you actually-

David Black

>> We were very lucky....

Dave Vellante

>> really, really lucky. And it sounds like you actually had a decent defense in place. Was it a phishing attack?

David Black

>> No. What's interesting with this one is there were four credentials, four of our employees' credentials that were purchased off the dark web by this threat actor group, and they used that to log onto a portal that we had that was externally facing, and it did not have MFA at the time. And that was kind of one of the projects we were working on. My team and I were using MFA to do everything we were doing and testing it and wanting to do the proof of concept. So it worked out well in that all we had to do after the incident was buy additional licensing and roll out Okta Verify.

Rebecca Knight

>> So you said that your outside counsel recommended you bring in CrowdStrike, and then you got to, as you say, work with some of the most amazing resources. So now, you are still working with CrowdStrike on a regular basis. You've also said that your board and the rest of leadership was really supportive and really wants this to be a priority. Can you talk a little bit about what it's like to work with CrowdStrike now? And especially now that we're hearing about all the fabulous new products that they've announced at this conference and what kind of support you hope and expect you'll get from leadership. As you say, we need to do this, this is important.

David Black

>> That's been one of the most amazing thing for me is a lot of times when the company is as good as CrowdStrike and gets as big as CrowdStrike, they start to weaken. They start to make acquisitions that they don't fully integrate or they start lowering the bar on their credentials for hiring people and they aren't as good. And what I've been amazed with is despite the growth and the expansion in products and the acquisitions, everything that they're doing is just as good as the first thing they did, and that's not common. And I was sitting on the customer advisory board today for the services side, and that was my biggest recommendation is don't lower the bar. I mean, you're going to be tempted to, or you're going to be tempted to spread into some vertical in IT and start doing something that really isn't in your wheelhouse, like stay in your wheelhouse. Because every year, what they announce here, that's what makes it so exciting is it's not that we jumped into this other thing and now we want to replace this in your company. It is, "Oh, we're adding everything, AI agents and all these other things that we desperately need to be able to defend against the threat actors that are using those same technologies already." So that was, to me, the most ... I don't know. What got me the most pumped about being here was what they announced and how they're going to help us continue. And again, staying in their lane, doing amazing things with amazing people.

Dave Vellante

>> So the agentic SOC resonated with you? How do you envision actually implementing that?

David Black

>> Well, one of the things we had to rely on was Falcon's complete service. So they're doing OverWatch and Complete. So they're basically, in a sense, outsourced our SOC to them. And so that's part of the excitement for me is understanding how these new tools will be used by their team that helps us, and then understanding where my team will take the baton and go forward. So I'm excited because I want my guys to get to use this because they're all looking at it as the fun stuff. Like this is the stuff you want to do. You don't want to do the boring stuff. And that's what's exciting about some of the AI as well is you can have it take care of some of that boring stuff and let your people do the more exciting, fun things so that they enjoy their jobs more.

Rebecca Knight

>> How has the culture around security changed since 2020, since the incident? Are employees and not just your team of four, but the employees at large at SiteOne thinking about security differently now?

David Black

>> I think so, and it's tough. We're in primarily a blue collar industry, and I hate the term knowledge workers because that's what they want to ... They want to call the people that sit at ... We call it field support, but the corporate offices, knowledge workers, and then the people in the field. And I'm like, "These are the most brilliant people you could know. They know the chemicals and fertilizers and all these other things and how to do drainage ditches." And so I kind of struggle with that.

Dave Vellante

>> That's so true.

David Black

>> But I'll say this that if you look at quarterly phishing results and things, the things that when we first started and we had a 30% failure rate, after that breach, it was down to below 5% and it stayed there. People started to understand how significant this could be. Even though it didn't affect them that much, just that one day is all they heard about, but then we talked about cyber insurance and we talked about the time it took us to recover things, and they really grabbed a hold of it. It's still a little challenging to me that in the day that we live in today, most people still don't understand the basics of information security. But I feel like the associates that we have at SiteOne do, and a lot of it ties back to 2020.

Dave Vellante

>> And you did a table talk exercise. Was that after the ransomware attack?

David Black

>> Yes. We would do them ourselves before, but we ended up signing up for a retainer with CrowdStrike. And one of the services they offer with those retainer hours is a tabletop. And I thought we did a great job with our tabletops, and I don't want to offend my guys, but it stepped up three levels when we started using CrowdStrike because-

Dave Vellante

>> What gaps did you find?

David Black

>> I mean, they came in and learned. They asked the questions. In ours historically, we would say, "Well, we do credit card processing so we could have a credit card breach." So let's say we had that or some other thing that might happen. CrowdStrike resources came in, asked us tons of questions, interviewed tons of people, and came up with a very realistic scenario of how we could be breached. And so not only did it help us to create a tabletop that no one could argue wasn't legitimate, but then I actually had to-dos and goals and objectives coming out of that for things I needed to go fix and address. So it kind of helped me plan the next year and some of the things that we were going to target.

Rebecca Knight

>> Because they think about, "How do I break this?" And then ...

David Black

>> How can I really get in? And they can figure it out. They're smart enough.

Dave Vellante

>> But you don't have unlimited budget.

David Black

>> Oh, no.

Dave Vellante

>> And so what did that do for your plan? You had to reprioritize things presumably, right?

David Black

>> Yeah, it helped me make sure that what I was focusing on was the most important things, like the biggest risks that were out there. And I've done three ... Once a year, I've done the last three years with CrowdStrike, and every single time they've come up with a new way that is a legitimate way that they could get in, whether it's social engineering through the help desk, which is a trend that the threat actors are using now, or a technical thing that they find. I've just been really impressed with the fact that early on with some of the ones we would create, the infrastructure guys might say, "Well, that would never happen because of this." For three years, they haven't been able to say that.

Rebecca Knight

>> What is next for SiteOne's security program? As Dave said, you had to reprioritize. Where are you focusing your efforts?

David Black

>> There's a big piece right now on famous Chollima, which if you guys are familiar-

Rebecca Knight

>> Oh, yes....

David Black

>> North Korean threat actors. We had a scenario similar to that a couple of years ago, but after investigating, we found out it wasn't tied to that. It was really just tied to someone that lived overseas that wanted a US salary, but they were leveraging a laptop farm to do that. And so I was able to leverage the information that CrowdStrike provides in the threat reports, and I created training that we gave our HR team, the recruiting team and the hiring managers on how to look for and spot. And I thought they did a good job just pulling stuff together myself. I shared it with CrowdStrike, and they're like, "Well, you forgot these three things." And they made it even better. So they've helped me with being more proactive going to the business and doing the training that we need to do, but also just around AI in general. What we did when ChatGPT first broke out is we did the traditional information security thing. We blocked it all, because we didn't know what else to do. We looked out, there was no training for information security around AI, so we did our own. We recorded it, we posted it, and we created a process where if you want to use AI, you can use it. You'd have to go through the training, take a quiz, and your manager has to approve it, and they helped with all of that. They helped us make sure that we were doing that well. They went through our documentation and other things to make sure that we were solid. So now, we're able to let people do that and allow it and open it up more than we ever have been before because there's obviously great value in AI. We're getting tremendous value, search engine optimization, data enrichment for our website. I mean, there's so much good. It's just sad that there's also so much bad.

Rebecca Knight

>> Indeed. Well, David, thank you so much for coming on theCUBE. A really illuminating conversation.

David Black

>> It was my pleasure. Thanks for having me.

Dave Vellante

>> You bet.

Rebecca Knight

>> I'm Rebecca Knight. For Dave Vellante, that wraps up theCUBE's live coverage of Fal.Con 2025. We will see you next time on theCUBE. You've been watching theCUBE, the leader in enterprise tech news and analysis.