mWise Conference 2024 | Charles DeBeck | Google

theCUBE.net

Clips
News
More from mWise Conference 2024

Charles DeBeck

Threat Intelligence Strategy Lead, Google Cloud

Google

Three insights you might have missed from mWISE 2024

Integrating artificial intelligence into enterprise systems has brought immense opportunities and challenges, making cybersecurity resiliency crucial as organizations harness AI for efficiency and innovation while addressing the rapidly evolving threat environment.This duality requires a proactive approach, blending advanced security strategies with operational resilience to ensure protection across dynamic, diverse infrastructures.John Furrier and Savannah Peterson of theCUBE Research discuss the future of cybersecurity with AI

How serverless architecture is reshaping cybersecurity defenses in a new threat landscape

Today’s cybersecurity environment is changing rapidly. Punctuated by the move toward serverless architecture, the technology presents operational opportunities and unprecedented security challenges.As businesses continue to embrace serverless, security professionals are sounding the alarm, urging organizations to recognize the growing threats in these environments, according to Charles DeBeck (pictured), threat intelligence strategy lead, Google Cloud, at Google LLC.“It’s interesting because, from a threat actor perspective, we’re not seeing a ton of activity here just yet, but we have started to see them looking at this space as a potential avenue for exploitation,” he said

play_circle_outline Serverless security challenges with threat actors exploiting vulnerabilities

play_circle_outline Utilizing automation and AI to scale security capabilities effectively

play_circle_outline Trend of threat actors exfiltrating data instead of encrypting it for easy profit

play_circle_outline Importance of compliance and collaboration in serverless architecture

play_circle_outline The Crucial Role of Passion in Cybersecurity: Navigating the Ever-Evolving Landscape

Info
Transcript

Charles DeBeck | Google

Charles DeBeck

Threat Intelligence Strategy Lead, Google Cloud Google

The conversation focused on serverless security, threats to cloud environments, and strategies to protect organizations, emphasizing the challenges of scaling up in serverless environments and the importance of compliance and collaboration for effective security measures. The discussion also touched on the evolving nature of cybersecurity, the value of passion and diverse skill sets in the industry. Recommendations were given for entering the cybersecurity field, including exploring interests and utilizing programs like the NSF Cybersecurity Scholarship for S... Read more

explore Keep Exploring

What are the potential threats and risks associated with threat actors targeting serverless environments? add

What are some of the challenges in securing serverless environments compared to other areas of business? add

What potential shift could threat actors make in their tactics regarding exfiltrating data from organizations instead of encrypting it? add

What are the key concepts of compliance and collaboration that organizations need to consider when utilizing serverless architectures? add

What is a common trait among all guests during cybersecurity conversations? add

bolt Powered by CUBE AI

Charles DeBeck | Google

search

>> Good evening, cybersecurity community, and welcome back to the Mile High City. We are talking microbrews, the servers, ransomware, LLMs, and cybersecurity here at mWISE. My name is Savannah Peterson, joined with John Furrier for what has just been a thrilling and educational day.

>> AI technologies are here. People are trying to harness it for operational benefits, but the security challenge is still very high. It's a high bar and a lot of great tactics, and I won't say caution, I'm just saying pragmatic caution around using GenAI with humans in the loop for securities. Next one will be great because threat intelligence. And you should say that automation will be great.

>> I know. I'm super excited. We've got an expert in the house. Please welcome Charles. Charles, thanks for taking the time today.

Charles DeBeck

>> Thanks so much for having me. Excited to be here.

>> I got to say your energy when you walked up here is exactly what everybody needs at 5:00 PM. You are still serving. I love it.

Charles DeBeck

>> This is the peak time for us to have these conversations. Right at the end of the day, everyone's tired, and this is where we got to get right down to it. What matters, how can we make it better?

>> Yes. I love... Well, speaking of, you just gave a presentation this afternoon before joining us. Can you give us some of the highlights?

Charles DeBeck

>> Yeah, so we talked a little bit about serverless security. What can we do to help protect serverless environments from threat actors? How are threat actors targeting cloud environments and what are they doing once they're there, and what can we do to make ourselves more secure as organizations?

>> What's the progression of serverless? Because everyone that you see like Databricks of the world, they go on all serverless. Is that an opportunity for the threat actors or is it more of a challenge? What does that shift do on the infrastructure side for the actors?

Charles DeBeck

>> Well, it's kind of interesting because from a threat actor perspective, we're not seeing a ton of activity here just yet, but we have started to see them looking at this space as potential avenue for exploitation. Realistically, it's tougher to get into serverless environments in some ways because it's just not as common. It's not something that they use as often, but we have historically seen examples of threat actors wrapping traditional malware in a way so it could be taken advantage of in a serverless environment. And the risk to organizations, it just might not be somewhere they're looking. They might not have defenses in place like they do for other parts of their cloud environment. And so the concern for me is if you're not looking for it, if you don't have that visibility or that detection in place, how are you going to know if something's happening? And so my big thing-

>> You're not.

Charles DeBeck

>> Exactly. So, I want people to really start looking at this, and understanding threat actors know this is a potential vector and they're potentially going to take advantage of it in the future.

>> Absolutely. Is the security approach similar to serverless from a fundamental perspective or is it dramatically different than when we're securing other avenues of our business?

Charles DeBeck

>> I think a little bit of both. I think in some ways it's similar. The key concepts of identity access management and making sure that you have permission and configuration in place is the same as what we see in other parts of cloud environments, but from serverless, a key component here is scalability from compute resources can be very, very sudden and dramatic. And we can see that an infection can go from a small thing to a huge thing much faster than potential other parts of cloud environments, especially right now. Exactly.

>> So, scaling up can be for good guys and the bad guys.

Charles DeBeck

>> Exactly. The benefit of serverless is that you can scale up very quickly, you can abstract away a lot of the risk, but the downside to that scaling capability is that threat actors also get it if they get in.

>> What are some of the challenges you're seeing that people are starting to pay attention to? What were some of the questions you got in your talk and what are some of the questions you get a lot around this area?

Charles DeBeck

>> I think one great question I had was around if we're going to start seeing threat actors taking advantage of cloud infrastructure... I'm sorry, of serverless infrastructure to start exfiltrating information rather than encrypting it. I think there's been a big trend in the overall threat actor environment where rather than engaging in encryption activities, now they're starting to realize it's easier to take data out and then sell that back to the organization rather than try to encrypt stuff. And there's a couple of reasons for that. It turns out encryption's kind of tough, and also decryption is very challenging. And so you run this issue as a threat actor. Should I do a encryption effort and then have to make a decrypter and then have to sell it back to them and they may not want to buy it? That's a lot of work. Or should I take all their data and then say, "I'm going to post this on the internet."? That's super easy. That takes a quick tweet and you're done.

>> And the salesman is like, Hey, that cuts into our margin." Because that's what it's like.

Charles DeBeck

>> And it's not public. It's not something that-

>> margins.

Charles DeBeck

>> It immediately escalates. You don't have to worry about the CEO hearing about it, because they'll hear about it, and so your chance of getting paid way higher. So from a threat actor perspective, why would I waste all my time with this encryption stuff when I could just steal the stuff and call it a day? So, I think that trend will be a really interesting one to watch over time.

>> How is it impacting the ecosystem? Because we've been having a lot of talks about what's behind the API, what's behind the SaaS vendor, he might have multiple third parties. So, third party integration, big party cloud, serverless to Aussie there too, you start to see that crossover. How do you look at that kind of space?

Charles DeBeck

>> I think to me there's two key concepts here: compliance and collaboration. When it comes down to it, we need to make sure that organizations have a strong compliance regime in place because while compute scales, compliance doesn't. Just because you can do things faster and easier doesn't mean that your compliance capabilities for having multiple things hosted in serverless architectures is going to be able to scale in the same way. You can't just throw more bodies at that problem. So, I think that's going to be an increasing challenge for organizations. I also think cooperation is a key element here because a visibility gap that comes up a lot of times is you have the cloud provider and you have the organization that's doing stuff, and if they both think the other one's taking care of it, no one's actually looking. And so I think that making sure that you're constantly having that interaction between your provider and your client, and making sure they're working together to be collaborative in their visibility posture is what you're going to need to be able to be effective.

>> Absolutely. That communication is actually nice. We work in a very technical world. Everyone likes to talk about the tech specs and the nerdy bits and the stacks, but the communication here is actually so mission critical, where if no one's communicating about what's going on and everyone assumes it's fine, it's probably not fine.

Charles DeBeck

>> One, visibility is challenging, because you don't know what you don't know. It's a classic unknown unknown. I think that's something that we're trying to really hammer on is that as you get to use scale environments more, as you use these different capabilities, addressing those unknown unknowns and trying to find out where they are, rather just hoping that they don't bother you is what we have to do. We can't just close our eyes, hope it goes away. That's not going to work.

>> How does it-

>> But it feels so easy to do that sometimes.

>> It's so much easier.

>> , Charles.

>> Completely. Charles, how does the observability space, which has been heavily overfunded with cloud native now that as you get into security, checking out these interconnected serverless systems becomes an observability kind of frame, but also networking, so the networking layer, how do you look at that piece? Because again, if you can talk serverless, you're talking about storage compute networking, working together. As things are interconnected and you got the third party, you got observability challenges or evolution, and bubble popping in some areas, and then the network side.

Charles DeBeck

>> Yeah, it's a great question. And I think the big challenge here is it really is an organization by organization basis. There's so many details on how an organization functions from a large org to a small org on what's going to be feasible for them, whether it makes more sense for them to use their observability from a third party, really leverage additional resources from an external vendor, or if they have those resources internally, how they can most effectively and efficiently use those resources to achieve observability in a matter that's cost effective. It's just so tough because it's tough for me to give a good blanket answer here because each case is so different.

>> Well, I think that's one of the bigger challenges though in general with cybersecurity is they are all different. If it was easy, we wouldn't have any issues

Charles DeBeck

>> If it was I'd just set up a booth out here and call it a day, and make my millions of dollars and go home.

>> Yeah. I'm curious, so we're talking a lot about culture and communication and collaboration particularly, obviously essential in the cybersecurity community. You've worked at some interesting places in your history. You've got history on the consulting side with Deloitte, you've been with the NSA, you're now at Google. If you're allowed to speak about it, how is the Google cybersecurity culture? And is it different than some of the more private or government-owned bodies that you've worked with in the past?

Charles DeBeck

>> That's a great question. I think Google's got a really amazing security and privacy-first culture when it comes to approaching things. I've been very impressed, and I say this to my colleagues all the time, that I think Google really takes itself seriously when it comes to security and privacy for its users and for its different capabilities because it wants to be the best in the market. It wants to be the absolute pinnacle of privacy and security, I think. And I think they're doing a great job of it. I think from a cultural perspective, that's really what they're aiming to achieve and I think they're doing a great job of it. It's very fundamental to it. It's tough for me to compare other organizations because my other organizations didn't have as much resources or drive in the same way that this one does.

>> Talk about the scale aspect of Google. Because we had multiple office of CISO execs in, scale comes up as a big thing you're dealing with. And then you have all these new things coming in, which some of the channels, they don't have the scale, but they want to leverage new technologies. You guys have the benefit of scale, and a diverse user base and application environment.

Charles DeBeck

>> Yeah, I think it's interesting because I think Google is both fundamentally focused on scale, which is great. We as a company understand that problems aren't just going to affect one or two people. When we change things that affect millions. And so we are always focused on: how can we scale this out, not just for an edge case, but for as many people as possible? For organizations, I think the challenge of scale is going to be a continually large one. I talked a moment ago about how scaling compliance is going to be challenging. The way we approach it is a lot through automation and using technologies, emerging technologies, especially things like AI and LLMs to figure out how we can most effectively scale out capabilities in a way that where it's not just a matter of more people and seats, but are actually using technology to make things better.

>> It's interesting, Charles, is when you talk, I start thinking about the heterogeneous nature of even cloud straight up pure cloud, but as you get distributed, the computing with Edge and other things, data has to be harmonized. All kinds of factors come in, the complexity increases, but now new opportunities are there to abstract that away, so we're kind of in a cool environment for that. As you look at that piece, what are some of the things customers are dealing with it that you talk to and Google too around, "Okay, we want to go as fast as we can, let the chaos rain and then reign in the chaos in a way that's responsible."? How would you answer that or talk about that?

Charles DeBeck

>> Well, I think one thing that... Going back to the serverless component here, part of this idea of serverless is that if I'm an organization and I really want to get this application, I want to be able to go up and running at full speed, full tilt whenever I need it, this is where serverless thrives. The whole point is for be able to put your application onto a serverless architecture and then abstract away all the infrastructure underlying it, and then you can go at full tilt. And the advantage of cloud providers is they provide this capability for organizations that may not want to have... can't stand up all these capabilities on their own, but can take advantage of these underlying defenses that the cloud provider natively hangs.

>> My next question on that thread is... Okay, now one of the things we're taking out of this show on day one, at least for me, is connecting the dot that GenAI is just an application security problem, and the data underneath it, whether it's agents or whatever, it's part of the data layer which runs on the infrastructure. So, you have these teams coming together. There seems to be a gap. I reported today in one of my research notes the gap between security teams and data teams. Traditionally, the data teams were data scientists. Now they're involved. Now you got data engineering going on with the cloud, and then you've got pure infrastructure folks like serverless going, "Hey, I'm going to scale up stuff. That's what I do. I'm done. Or it's not done, it's connected." So, as the teams come together, any thoughts that you share around what you see as gaps and what people are doing to be successful to bring that nexus of skillset, platforms, code?

Charles DeBeck

>> Yeah, so I'll say my background is threat intelligence. I'm a threat intelligence guy through and through. And when you're thinking about threat intelligence and how to best protect an organization proactively, the number one thing you need is data, data that's accessible, usable, and malleable so that you can best understand what the threat landscape looks like for your organization. And to your point, right now we are in an interesting, amazing era where there's a lot of different data sources from cloud provider, from your internal logging systems, from different telemetry sources. There's all sorts of different data sources that you can leverage and pull in, and it's a very noisy and complex environment to use. But that's also beautiful because you can use all that data, and if you can craft it and find a way to wrangle all that data effectively, we have more capability to understand what's happening and more ability to protect ourselves today, I think, than we ever have.

>> And one quick follow-up, and then I'll pass this to Savannah.

Charles DeBeck

>> Sure.

>> That's cool.

>> What data sources do you see now that are available and gettable, attainable that you were using that weren't available just maybe a few years ago, as a threat hunter?

Charles DeBeck

>> That's a great question. I'm a little reticent to answer only because my deep-seeded fear of revealing sources and methods, so I don't want to get into that in too much detail.

>> The answer is yes.

Charles DeBeck

>> There's some great data. I would love to tell you more, but I can't answer that question.

>> But there are new ways probably?

Charles DeBeck

>> There are new forms of data, while there's new data being generated. And we're doing a much better job as an industry, I think, of collating and collecting that data and making it more accessible in a different way.

>> Good answer by the way. Protect your sources. They're the most important. We respect that.

Charles DeBeck

>> No, absolutely. Thank you.

>> Very, very diplomatic there. Your enthusiasm is encouraging me to take this conversation in a slightly different direction. So, let's say someone is listening right now, they're curious about cybersecurity. You said you're a threat intelligence through and through.

Charles DeBeck

>> Yes.

>> What's your advice to someone curious about getting into our industry?

Charles DeBeck

>> I love this question. Well, I'll start with an easy one. If you're a student and you're thinking about getting into it, I recommend checking out the National Science Foundation Cybersecurity Scholarship for Service Program. That's what I did to get into cybersecurity when I graduated. It's through the National Science Foundation. They pay for a degree, either bachelor or graduate degree in cybersecurity. In exchange, you work for the federal government for two years. It's a great way to easily and cheaply get a degree in this field, which a lot of people may not otherwise have access to. And it's a very effective program. Check it out, SFS I believe is the exact acronym.

>> That's awesome. Carry on.

Charles DeBeck

>> Otherwise, if you want to get into this field, there's so many different ways and so many different parts of cybersecurity, I think what I would recommend is take a step back and look at what area of cybersecurity are you really interested in. Do you want to be an instant responder? In which case you should look into: what does instant response look like? How do you approach that? What coursework can you take or what studying can you do? Do you want to be a SOC analyst? Do you want to be looking at alerts and really saying, "This is what matters and what doesn't."? Do you want to be a threat intelligence analyst? Do you want to be looking at what's the cutting edge, what are they doing on dark webs, on dark web investigations, and what are threat actors doing? What are criminals up to? There's so many different avenues. People say, "How do I get into cybersecurity?" But the real question is what do you want to get into in security? It's a huge world.

>> So, on that point, because this is very broad, the aperture is getting bigger and bigger, is there intrinsic skills that someone might have? Not degrees, intrinsic skills. I'm tall enough to play basketball, I can learn, but if I'm not, I can learn about it, but I can't play. That's an old adage. Every job you just listed has an intrinsic superpower.

Charles DeBeck

>> Yeah.

>> Share your thoughts on those different intrinsic capabilities.

Charles DeBeck

>> Yeah, great question. I think I'm actually going to shift it a bit to say that I think that almost any set of skills would fit into some part of the cybersecurity landscape. Are you super detail-oriented? Then you would probably be great at looking at packets as a SOC analyst. Are you super curious and you love diving deep into something, and if you see a thread that can be pulled, you'll pull it? You'd probably be a great threat intel analyst. Are you somebody who really just likes talking to people like myself? Well, I bet you'd be great at briefing boards or briefing CISOs on what's going on. And that's a critical skill, having that communication ability. There's so many different ways to get into cybersecurity, so I don't think there's any one skill that you need. I think I would flip it the other way around and say, "What skills do you have or what would you say are your intrinsic values? And then where does that map most effectively into a cybersecurity profession? That's what-

>> The one thing that I would say is common between all of our guests and all of our cybersecurity conversations, passion. I think in this industry in particular, you got to want to wake up and fight the good fight and really care about it, because it's always out there. There's always going to be bad actors trying to harm us.

Charles DeBeck

>> And it's always changing, which I think... The reason I love cybersecurity is because it's always different. Four years ago when people were saying, "Oh, I think ransomware might be going away, I guess," and then it came back with obvious research. Six years ago, they're talking about crypto miners and how big that was going to be, and then that's never really blown up just yet. But over time you see these trends, these changes in the cybersecurity landscape, and they just keep shifting and moving. And I think that constant freshness and novelty makes cybersecurity a really interesting field to be in.

>> I couldn't agree more. That's why we love our job standing over here.

>> Kevin Mande has said on the keynote what board and execs wants, since you do a lot of board briefings, he said maturity, maturity models, size and resources available, industry kind of dynamics, industry threads that are going on, threats, and then trust and reputation, and then leadership and board risk profile. What's your reaction to that? What are you seeing in terms of as you start to see people go clamping down? Obviously it's a board level conversation, but now it's like bottoms up, top down, coming together.

Charles DeBeck

>> Well, far being for me to say Kevin Mande is not absolutely right in everything he says. I thought his presentation was great this morning. I thought it was one of the highlights of the day, and I thought it was very, very accurate and skilled, so I'm not going to say that anything he said was incorrect.

>> He was right on.

Charles DeBeck

>> I'll simply try to add to his good thoughts here and say that I think boards are really interested in understanding, "What's the risk, what's potential impact? How are we going to effectively address the risk and what is the risk?" And that's a really tough question to answer for cybersecurity professionals, because risk traditionally is: what is the probability of impact and what's the cost of impact? But we're not great at answering any of those questions. That's another one of those questions, if I could do it, I'd set up a booth, make my millions .

>> Talking about accepting risk was I thought very provocative because it opens up the door to saying, "Okay, who accepts the risk and what is that risk? And then how does that translate to cyber?" And it's multiple risks. And if you can't affect change, it's a whole open question.

Charles DeBeck

>> I actually really liked it because I think what organizations may have a tendency to do is rather than having somebody accept the risk, specifically a person accept the risk, if they just say, "Well, the organization accepts the risk," they're not going to have somebody who's accountable over time as the landscape constantly changes to step back and say, "Are we still okay with this? Have we changed? Has the landscape changed? Has the general geopolitical environment changed to an extent that we no longer want to accept this?" It's too easy to become complacent if there isn't somebody who says, "This is your job."

>> And their job depends on it.

Charles DeBeck

>> And then was like, "Well, that wasn't my job." To your point about change, huge. But I did appreciate Kevin Mande saying this wasn't somebody who he'd point to crucify. This is somebody who he'd point you to accept the risks so that they're making an informed decision.

>> And understand.

Charles DeBeck

>> I thought that was quite fair.

>> Yeah, no, I think that is it. We're not here to point fingers. We're here to understand the level of complexity of these risks and actually own that, rather than-

Charles DeBeck

>> Because risks is complicated and it's changing. It's ever changing, and that's a big challenge I think.

>> Yes. You talked about some fun myths in the space or patterns we've seen, or things that have happened that haven't quite happened, crypto mining, ransomware coming back. What do you think is the most overhyped thing in cybersecurity right now?

Charles DeBeck

>> Overhyped. Ooh, that's a good question. I don't really have a good answer for it. I think we're in a pretty good spot right now in cybersecurity where I think we have a good sense of the major risks. I honestly think the biggest thing we're doing is we're missing things that could be bigger risks in the future.

>> Ooh, okay.

Charles DeBeck

>> So, for example, I went to a great talk today on hacktivism and the way that's evolved over time. And I thought that talk really highlighted this group that I think most people just don't think about. We think about cyber rules, we think about advanced persistent threat actors, state actors, and then we maybe think about hacktivists, I guess, a lot, but they're usually at the bottom of the list after our pets. No one thinks about it.

>> Unless Anonymous is doing something interesting that's got everyone's attention.

Charles DeBeck

>> Exactly. Unless it's something that headlines. But then we also tend to say, "If it's a hacktivist doing something interesting, well, it's probably just a false front for a state actor." We tend to dismiss things. Or even crypto mining, I think we dismiss crypto mining too easily and say, "Well, it's not that big of a deal," even though it could in fact just be covering up other malicious activity that the threat actor is trying to hide behind this crypto mining guise. So, I would say rather than seeing things that are overhyped, I think there's more stuff that needs more consideration by organizations.

>> Ooh, I love it. Charles, this has been thrilling.

Charles DeBeck

>> Heck, thank you.

>> Yeah.

Charles DeBeck

>> Thank you.

>> We needed you on the stage this time of day. This is great. You're welcome back 5:00 PM anytime or on any show floor.

Charles DeBeck

>> I'm happy to be the happy hour talker anytime. That worked out too well.

>> We will make sure though that we've got some good Fort Collins beer on the side for you as well.

Charles DeBeck

>> That would be excellent. Thank you so much.

>> No, I really appreciate it.

Charles DeBeck

>> Thank you.

>> John, fantastic thread as always. And thank all of you, fabulous security community, for tuning into our full first day of coverage here at mWISE in Denver, Colorado. My name is Savannah Peterson. You're watching theCUBE, the leading source for cybersecurity news.