mWise Conference 2024 | Greg Bell | Corelight

theCUBE.net

Clips
News
More from mWise Conference 2024

Gregory Bell

Co-founder & Chief Strategy Officer

Corelight, Inc

Democratizing network security with AI and open-source collaboration

Amid the overwhelming surge of data and telemetry, enterprises are recognizing that network security is essential to cybersecurity.As cyber threats grow more advanced, network security company Corelight Inc. has shown its commitment to democratizing cybersecurity by diving deeper into network traffic, according to Greg Bell (pictured), the company’s co-founder and chief strategy officer.Corelight’s Greg Bell talks to theCUBE about the vitality of network security.“The big idea of our company is that we’re taking the techniques and tooling that elite defenders were using in the National Lab system, DOD and DHS, and democratizing them,” Bell said

play_circle_outline Corelight's mission is to democratize elite defenders' techniques for Global 2000 organizations.

play_circle_outline Networking innovation with AI, dissolution of boundaries between networking and security.

play_circle_outline Embrace of Kubernetes in security, visibility for containerized applications, threat risks.

play_circle_outline The Critical Role of Open-Source Communities in Cybersecurity: Collaboration vs. Competition Among Attackers

Info
Transcript

Greg Bell | Corelight

Gregory Bell

Co-founder & Chief Strategy Officer Corelight, Inc

In Denver, Colorado, the cybersecurity community gathers for day two of mWISE. Savannah Peterson interviews Greg from Corelight, who aims to democratize cybersecurity tools by focusing on network traffic visibility. Corelight provides valuable insights for all users, integrating open-source tools with AI capabilities to accelerate SOC workflows and improve detection coverage. Greg emphasizes the impact of the cloud on networking and security, highlighting the importance of network telemetry. The discussion also covers the integration of networking and securit... Read more

explore Keep Exploring

What is the big idea and mission of the company mentioned in the text? add

What is Cisco's bold new vision regarding networking and security? add

What are some of the bigger threat risks specifically for containers and containerized applications? add

What is the importance of open-source communities and culture in relation to building products and civil society? add

bolt Powered by CUBE AI

Greg Bell | Corelight

search

>> Cool. Hey, .

>> Good morning, cybersecurity community, and welcome back to the Mile High City. We are here on day two of mWISE in Denver, Colorado. My name is Savannah Peterson. Delighted to be hosting these fantastic conversations with John Furrier. John, what do you think has been the most unexpected topic this week?

>> Ransomware.

>> I will say that we have certainly fed our AI everything we could possibly feed it about ransomware.

>> There is so much ransomware. I think that the topic that's not being talked about a lot is this next segment we're going to do on networking. There's such a holistic view end-to-end workloads up and down the stack from silicon to the application and everywhere in between, has to be evaluated and detected and looked at. The data corpus is getting bigger. It's real time, so I think we're in this inflection point, this wave. I think the big story is, what's coming? There's a tsunami of more data, more telemetry, and then all these reasoning engines are coming out. So I think there's a blue sky around the corner, but right now, a little foggy.

>> It's a little cloudy.

>> So the next segment I'm excited for, because I think networking is where the answers are. And I think that's always been the last area that gets worked on, in my opinion. So when you see networking stuff happening, you know we're getting close to some good solutions.

>> Speaking of good solutions, I am very excited to welcome Greg from Corelight to the stage. Greg, thanks so much for being here with us.

>> Hey, it's my honor. Thank you so much.

>> Yeah, what a joy. You are a threat hunter. You are an engaging person to chat with. Tell us before we dig in, what's going on at Corelight right now? You guys have been around for a while. I'm assuming the threat hunting landscape has evolved a bit.

>> It's evolved a lot and you were mentioning blue sky. I'm kind of a blue sky person. I'm an optimist. I think networking does provide-

>> We need that in this industry. It's important.

>> We need it global.

>> Just period in the world.

>> Need a little more optimism. So I spend most of my career in the National Laboratory System at Lawrence Berkeley National Lab where the technology that Corelight is commercializing was invented and that where it first started to thrive, and then it kind of took off. It's open-source tech, it became widely adopted all around the world. And the big idea of our company is that we're taking the techniques and tooling that elite defenders were using in the National Lab System, and in DOD and DHS, and democratizing it and making it available to the mere mortals of the Global 2000 and further down. And that's kind of the mission of the company, that's what we're up to. We do focus on network traffic, as you mentioned, and that provides a breadth of visibility for organizations, and it's an increasingly important part of the landscape for defenders.

>> So first of all, I love democratizing security. It's been a bit of a theme that we've talked about here a lot. I think it really matters. It makes my human soul churn when I think of people being left out because of an economic situation or something else, or just not having access to those tools. Languages have been barriers. There's so many things that can stand in the way here. How do you, and maybe this is simple, but how do you get to unlock that insights and the learnings and the research from the DOD, and from these bigger organizations to filter that out to the rest of us just mere mortals?

>> Yeah. It's part of the quest of a lot of open-source companies that as you take a power tool, something that's super configurable, super flexible, it's sometimes a platform, it's a toolkit. And you turn it into a product that's just as powerful but has an easy mode. So it's easy for defenders to make use of immediately. We produce masses of very programmable, extensible data, and lots of detections. But we're also really careful to make sure beginners can make use of that immediately. We have a new SaaS platform that is a big step in that direction. But the key thing and the tricky thing is to make sure that the expert users can still take advantage of what we offer.

>> Greg, I want to get into the decade-long journey you guys had as a startup. Obviously, came out of Berkeley, the tech alpha geeks kind of building out great tech and network visibility. The cloud impact has been significant. I remember where early days on cloud computing it was like, "Oh, it's not secure." Now, it's pretty damn secure. So how has the networking paradigm from your standpoint, affected with cloud? Because they control a lot of traffic in and out of the cloud to on-prem and now that the edge is there. So obviously, service area is a big concern in security and guess what the packets run on? Networks.

>> Yeah.

>> So take us through the impact of cloud and where we are today. And what's the current situation relative to security network's position and role in that?

>> I think the conventionalism a few years ago is that the cloud providers will take care of security and there'll be some kind of inherent boundary between on-prem workflows in the cloud. And most defenders have figured out they need to pay real attention to network security in the cloud. And attackers don't care about the difference. They don't care about whether you're an Azure, a GCP or AWS, they're happy to pivot from your data center to AWS. Our customers really appreciate that when they deploy our products in the cloud, they get the same format of data. They get the same sort of moment of dissections wherever they occur. We do adapt our products for the cloud and we enrich our data with context. It's important for defenders in the cloud, and we can do that differently for each cloud provider and differently for Kubernetes. It's been a journey, but I think the world is waking up to the fact that network telemetry and network detection is still really relevant in the cloud.

>> Yeah. And maybe not relevant because networks and server networking compute will always be around, just what form do they shape into?

>> Yeah. The cloud is someone else's network and there are different APIs for accessing it, different ways to monitor it, but it's still a critical ground truth that needs to be integrated into .

>> So turn us through the relationship with Google with you guys. You're here at to show, how are you guys working with them? And Google has a good network, so I'm sure you have a great relationship. What is the positioning with you guys and Google? And what does that look like from a product integration and a solution, value proposition? What's the benefit to the customers?

>> Sure. I would say first it began with Mandiant and so our relationship started with Mandiant even before the acquisition, and there's a lot of common culture and common heritage with Mandiant, fed, mission-oriented to the core. So we feel the Mandiant team is sort of our kind of people and I think it's mutual. We began working with them to integrate our network sensors into their service offerings. They're the people you call if something really bad happens, if you've been breached by, the FBI just announced yesterday the takedown of this Flax Typhoon botnet, and one of the big headlines from the last couple of days. So if you had been breached by some fearsome nation-state backed botnet like that, you might call Mandiant to figure out how bad is it? When did it happen? How can I get rid of that? And once I'm rid, how will I know that I'm fully remediated? And when they go through that process, they need network telemetry and network data. So they partnered with us to provide the technologies through that entire workflow. Now we're fully integrated into Managed Defense, one of their offerings, which means we can be-

>> Yes, this is the official integration.

>> Official integration.

>> Congratulations, very exciting.

>> We're really excited. So when they go to do their investigations, they can use our technology and that technology is fully integrated into their solutions that are considered SecOps, formerly known as Chronicle, including VirusTotal, their intel offerings. It's all one highly integrated package we're excited to be able to deliver together.

>> I love that, and it's exciting and it's nice that all these tools can come together. This actually parlays into something I was going to talk to you about. You mentioned these end-to-end workflows, doesn't matter if you're in the cloud, on-prem, what's going on, you're able to help folks out. This comes down to a user experience game and having a really congruent user experience game. It feels like that must be a priority for you with all your partners and making sure that your customers are able to easily, to your point, have that easy button. Call it easy mode at least, or congruent mode across systems to be able to identify and get context as quick as possible.

>> Yeah. I think this is a very underappreciated aspect of cybersecurity and it's also, maybe we'll talk about AI at some point, but it's a big part of how you integrate AI into tooling. The user experience is almost as important as the AI capabilities. For us, we talked to so many customers who were disappointed at having to rely on dozens of tools. We talk about the chair swivel effect of going from one tool to another, and from the beginning we tried to just integrate seamlessly into our customers' preferred architectures. So if it's SecOps or Chronicle, that's great. Also, there are other potential SIEMs or XDRs or data lakes and we want to make sure that the data and detections we produce are valuable wherever and however customers want to consume them. I don't want to speak ill of potential competitors, but often they don't have that view. They want to sort of lock up the eyeballs into one interface. I think, because we were operators and we consumed a lot of products 15 years ago, we don't believe that's the way to build.

>> Give some examples of some customer wins or examples of where you guys have made an impact and influenced the outcome with your data and your intelligence from the network side. Give us some use cases, share with us the key areas and examples.

>> Yeah, there's a few story classic use cases. One of them is just ROI, TCO, we can take legacy network sensors, four or five different kinds and wrap them up, integrate them into one traditional sensor and we can basically sit-

>> That in itself is really great. No one wants to deal with their legacy systems and make it easier. And if you're going to do that for me, that's awesome.

>> Yeah, it's not kind of the sexiest thing we can talk about. It's not directly confronting, make -

>> It's also very pragmatic.

>> And again, we're former operators, so we like that we could say we'll take out four of those legacy tools and you'll have one highly modern system that's data-centric, so that's one. We also accelerate SOC workflows. We help the process of investigating detections be a lot more satisfying emotionally to the SOC analyst, and also just a lot faster, which is satisfying to the leadership chain as well. We improved detection coverage, so in the last week, I've talked to CISOs of a major utility, a major bank, like top 10 in both globally in both sectors. They're both really concerned about visibility gaps. They know they have significant gaps in coverage and we help close those gaps, so that's another use case.

>> So we do a lot of these CUBE interviews. We get a lot of data, the very horizontally, scalable observation spaces we call it. Talk to a lot of experts. And the whole gen AI wave, you hear all kinds of cliches. Security for AI, AI for security, networking for AI, AI for networking, and this is a double-sided coin. I get that. It's cliche, I'm not really getting down on them, I appreciate that, but networking's hard. It's a lot of install base. You got the Ciscos and the Junipers, you got Arista Network boxes, you have routes that have been established from the early days of the internet. So as networking is still obviously the plumbing, it's still, I'm almost saying it's antiquated, but it's networking. It's like plumbing. So how do you innovate in networks? If I'm a customer, I got an install base of a lot of Cisco gear, top-of-rack switches. I'm going through transformation now with NVIDIA and other powering new data centers and new cloud architectures. As that's going on, I got to run my security.

>> Yeah.

>> Where's the innovation with AI and networking? How should customers think about? Because I see Cisco kind of trying to figure that out for themselves. Okay, parsing logs. Okay, not really, whatever.

>> Yeah, yeah, yeah.

>> Where's the innovation in networking with AI?

>> Networking generally, it seems like every five years, there's a bold proposal to reinvent the internet architecture, so it's easy to get a little cynical and say it's never going to change. These architectures like TCP/IP have been around for 40 years, they're just not going to evolve. But in fact, gradually over time, it is gradually evolving into a more programmable infrastructure. And with more automation and I think LLMs and AI generally can be used to reduce errors and configuration. Cisco's doing that, Juniper is doing that. There's some low-hanging fruit there. Again, it's not super sexy, but it might make networking more stable, easier to model.

>> I don't know. Stuff that makes us more secure and less clunky, is kind of sexy. It doesn't have to have sequin on it to still be sexy in that department.

>> No sequin, but impactful.

>> Yeah.

>> Cisco now has this bold new vision, Tom Gillis' vision of dissolving the difference between networking and security. So I'm interested in that, like putting security as a function in the network. And we're certainly compatible because we can take our product and put in the Kubernetes environments, run it right in the network, and that's a neat idea. It's not here yet, but again, I'm a blue sky person. I can imagine a future internet where the difference between networking systems, security, data analysis is dissolved.

>> You've brought up Kubernetes twice now, so I have to go there, we go to KubeCon.

>> I know, I've been smiling each time he does it. I have all my Kubernetes stickers up here.

>> You do have a lot of stickers.

>> Yeah.

>> Cool. Get you .

>> You must, you must.

>> Okay. Come on over.

>> Yeah, you can see my Kubernetes, right here.

>> Yeah, totally.

>> I'm showing my open-source cloud colors right now. Anyway, carry on.

>> Okay. Yeah, thanks. Kubernetes is getting boring in a good way. It's getting stable, but there's still a lot more work to do in the cloud-native, because now you have microservices. And the big conversation here in the security conference is, don't just adopt a tech stack and then not change your process. There's some still refactoring and redesign going on at the foundational levels up here. How do you guys look at that Kubernetes world? How do you fit in? And what does that community need to do to be successful so people can start building and running large-scale workloads in gen AI and security?

>> Yeah, it's a great question because for a while I think the Kubernetes community also didn't believe network security was that important, but that's beginning to change too. We can run in Kubernetes environments. As far as I know, we protect one of the largest Kubernetes clusters in the world right now and it's related to AI in some way. And we found a way to access traffic and to detect risk models that are relevant to this customer. So we've got that existence proof and we're making great progress there.

>> Do you guys attend KubeCon or the CNCF? Are you guys active in that community?

>> We're not as much as we should. We submitted talks, but we haven't really penetrated that barrier. Because we use Kubernetes internally on our platform, it seems like a natural point of connection.

>> I know. We got to get you-

>> Yeah, we're there.

>> In Salt Lake in November, London in the spring.

>> Happy to do that.

>> We'll have to make the magic happen. No, I think that's a lot of overlap.

>> We should submit a talk.

>> Kubernetes. That's the most under-topped topic here. Not anymore.

>> Well, exactly, but I do think it's relevant. I think what you were talking about is also really pertinent in the sense that when we were figuring out how we were going to be working with containers in the future and what that platform was going to be and even determining if it was going to be Kubernetes that went out, one security was a little bit deprioritized in that moment, because it was, can we, I almost just swore, can we reduce the complexity of this situation and actually make this a little bit easier for folks to use at scale? I do think it's really interesting now to think about we are there. It is at the enterprise. You're able to support that. What are some of the, actually this is fun, what are some of the bigger threat risks specifically for containers and containerized applications?

>> Well, apps, malicious apps can break out of containers. So there's a new class of risks like lateral movement between containers and so you need visibility and detection and you need to be attuned to those risk models to be able to provide value. There's also just a lot of Kubernetes clusters host web applications that are under constant attack, and so you can provide visibility and even in some cases, depending on the architecture of decrypted traffic, because Kubernetes often has to decrypt to load balance. So there's an example where network monitoring can actually be better in a Kubernetes environment than it is outside of Kubernetes environment. There's various nice applications. I'll say one more thing, because our data is open source in origin, it's programmable, it's extensible. It's easy for us to add Kubernetes context to the logs we produce. We can say this log or this detection can't happen. The pod idea, or other Kubernetes metadata, that makes it a lot easier. For instance, a responder to say, oh, I know exactly what caused that. So that's the beauty of open source and of a community working together.

>> Two follow up questions there, because I love open source and then I have actually from our community. We had a great question come in this morning on LinkedIn. How important is the open-source community to security and our cybersecurity feature?

>> I think it's critical. I mean a lot of the fundamental building blocks of our products and also of civil society are come from open-source communities. It's also the culture of open source that's important. It's not just the developer model, but it's the idea that we're in this together. We have common interests. We can form common cause. It's easier for us to do that than attackers because they often have, with the exception of maybe nation-state attackers, set them aside for a second, but for the criminal attackers, they're also competing with each other. And so as defenders, if we can just break down some troublesome cultural boundaries or barriers, we can work together and open source is one mechanism for doing that. A third thing, open source is really good for people from non-traditional backgrounds who want to advance their careers, because they can get access to completely free tool in technology and training to go faster. Our CISO, Bernard Brantley is a great example of that. He's terrific. It'd be a good interview subject in the future for-

>> Here for it.

>> Yeah.

>> Yeah. And he's just a great poster person for that phenomenon.

>> What did they ?

>> One other question I just want to follow up there, because I thought this was a really interesting, one of our community members chimed in about this, and seeing that security could be the catalyst for AI adoption at the enterprise. Do you think that that might be one of the verticals that drives true adoption and making it real, not just these test cases and hype curve moments we're experiencing right now?

>> It could be. I mean, we were among the first, well, we alerted to the potential of LLMs to do good for our customers, by our customers. That was super interesting and it's a byproduct of being open source. So just a few months after the big hype wave around LLMs, so now about a year and a half ago, at a customer advisory panel, we learned that one of our customers, a big hedge fund, was already using LLMs to make sense of our data and to help their analysts analyze it. And that's because we're open source and so the LLMs had already been our data for 20 years, so we were very quick to be able to integrate that.

>> Wow.

>> Yeah, it's kind of a neat, it's a-

>> And that's innate adoption story. I mean, the fact that somebody was already there. What a fun way to find out. Yeah.

>> That's an example of not having a closed black box approach, but being open to input from the community and from our customers. And we are pretty quickly, and by the way, the use case was seemingly simple but actually really cool. It's explainability. So please explain this log or explain this detection rule. It's something that helps a junior analyst become just punch above their weight, move faster, be happier. We've incorporated a lot of little features like that. Again, using thoughtful user experience into our products now.

>> Oh my goodness. Wow. Well, I think this is cool. We covered a lot of things I wasn't expecting to cover in this one.

>> I know. I was waiting, looking for more to follow up. We don't have enough time. I was going to ask about cyber resilience because that's been an definition. Real quick, how would you define cyber resilience?

>> It's the ability to, you sort of have to assume breach and it's the ability to respond to a whole variety of potential bad outcomes gracefully and maybe not in a completely Teflon way, but to be able to do the best you can given the cards that you're dealt. It's not going to be the same if an amateur hacker versus a nation-state attacker. Resilience is the ability to do the best you can in-

>> Faster. Thank you.

>> Yeah.

>> Well, we're all just trying to do the best we can. Greg, you're clearly leading the way. We'd love to hear more about you and the team at Corelight and we got to get you to KubeCon.

>> Hey, I'd like to do that. We'll bring you a-

>> really fun. Yes, please do. Yes, please do. I will display it proudly. We really appreciate you taking the time.

>> My pleasure. Thank you-

>> Thank you.

>> And dropping some serious knowledge. John, what a fantastic interview.

>> Absolutely.

>> We could have sat here for an hour with him, easily.

>> We went off down a KubeCon rabbit hole there.

>> I know. I know.

>> It's all good.

>> I got all excited. I got a little excited here. It happens. It happens. I hope we're all getting excited at home or wherever we might be watching on this beautiful rock. We're here in Denver, Colorado at mWISE. My name's Savannah Peterson. You're watching theCUBE, the leading source for cybersecurity views.