mWise Conference 2024 | Kerry Matre | Google Cloud

theCUBE.net

Clips
News
More from mWise Conference 2024

Kerry Matre

Head of Mandiant PMM, Mandiant

Google Cloud

‘The Defender’s Advantage’ explores the blueprint to intelligence-driven cybersecurity

Cybersecurity incidents are inevitable, but the way organizations prepare for and respond to these events can make all the difference. This notion underpins the content of “The Defender’s Advantage” book, a collaborative effort among 40 contributors that advocates intelligent cybersecurity, with in-depth analyses of key strategies and lessons learned from countless security breaches.Google’s Kerry Matre discusses intelligent cybersecurity

play_circle_outline Crisis Communication Tactics and Decision-Making in Cybersecurity Operations

play_circle_outline Maximizing Value: Feedback on Digestible Book Format as Justification for Budget

play_circle_outline Two Decades of Cybersecurity Progress: The Crucial Role of Industry Collaboration

play_circle_outline Advice for evaluating risk and building secure foundation for startups

Info
Transcript

Kerry Matre | Google Cloud

Kerry Matre

Head of Mandiant PMM, Mandiant Google Cloud

The cybersecurity community convenes for day two of mWISE in Denver, Colorado. Kerry, a famous author, joins John Furrier to discuss "The Defender's Advantage," a collaborative effort with Mandiant focusing on cybersecurity challenges and solutions. The book emphasizes the importance of intelligence, response strategies, and the need for effective communication during crises. Key themes include the role of cyber defense, threat intelligence, and the necessity of mission control in orchestrating incident responses. Red teaming exercises and tabletop simulation... Read more

explore Keep Exploring

What is the process for understanding and adopting a new tech stack and how is design architecture being re-looked at in the context of new advancements in technology like AI clusters and supercomputing? add

What has been the feedback from small organizations using the book on AI architecture in cybersecurity? add

What are some observations about the advancements and challenges in cybersecurity over the past 20 years? add

What are some recommendations for cybersecurity measures that small organizations can take to protect their business? add

bolt Powered by CUBE AI

Kerry Matre | Google Cloud

search

>> Good morning, cybersecurity community, and welcome back to day two of mWISE. We're here in Denver, Colorado. My name is Savannah Peterson, joined with John Furrier for our second day of awesome learnings and outstanding guests.

>> Well, we've got a famous author here on theCUBE to give us the lowdown on The Defender's Advantage, and among other things.

>> I know, I'm very excited. Kerry, thank you so much for taking the time to hang out with us this morning.

Kerry Matre

>> Thank you for having me.

Kerry Matre

>> Very busy week for you though, at least in your home state of Colorado.

Kerry Matre

>> Yes, yes, I'm glad that you guys came to my home state.

Kerry Matre

>> We'll come hang out with you anytime.

Kerry Matre

>> Awesome.

>> I saw signage for your book on the way in this morning, I'm very excited to be holding onto it right now. We have The Defender's Advantage, I believe this is the second edition of the book, is that correct?

Kerry Matre

>> It is the second edition, yes.

Kerry Matre

>> So what's going on in here? What is everyone going to learn?

Kerry Matre

>> Well, first, I want to say that there's about 40 contributors to this, so I'm one of the authors, but this comes out of Mandiant.

>> That's an amazing collaboration-

Kerry Matre

>> Yeah, yes....

>> 40 writers on one thing, that in itself is a sign of the collaboration in the cybersecurity community.

Kerry Matre

>> Exactly. And so, what it is is Mandiant sees organizations on their worst days, we see what they're going through, how they're going to recover, how they're going to stop the breaches, so we've taken that knowledge and worked backwards to say, "If organizations only did their operations this way, they could maybe avoid that worst day or minimize the impact of that pain, really."

>> You're like the ER doctors. It's the work backwards-...

Kerry Matre

>> of the security world, yeah.

>> Take these two pills and call us in the morning. What are some of the key themes that come through in this, some of the big mistakes that people have made or situations they've found themselves in?

Kerry Matre

>> Yeah. Well, the book itself is structured into six critical functions, and the first one is intelligence. So what we see is organizations that are just doing things, they've set up a SIEM, they maybe have some EDR solutions, and that's all that they're doing. They're not intelligence-led, they don't know who's even targeting them. You're not going to be able to fight unless you have that intelligence to drive it. So intelligence is the first critical function, which then informs the other five critical functions. So that's one thing that we see. Another thing that we highlight in there is response. You can do a response very poorly. A lot of people say, "Oh my gosh, worst day, start making changes immediately." Not knowing exactly what to do makes it worse.

>> Yeah.

Kerry Matre

>> It's going to make the impact of that breach much, much worse.

>> Kerry, at the keynote yesterday, first of all, Kevin's keynote, I'm a big fan of, he's always on point, one of the things he said, I want to get your reaction to, he said, the question he said, "What do CEOs wish they did before the breach?" It's one of his questions he brings up. And it's interesting, his answer was resilience recovery.

Kerry Matre

>> Yep.

>> And I'm like, we're back in recovery recovery on the main stage, cyber resilience has evolved. What do people think about when they get that mulligan, to use the golf metaphor, or that opportunity to look back and say, "Okay, what would I work backwards from if I can get a do-over?"

Kerry Matre

>> Right.

>> What's the common dialogue, what's the post-mortem, what's the analysis?

Kerry Matre

>> What's interesting, it's never about technology. Going back that mulligan situation, They don't bring up technology. They say, "Oh my gosh, I wish I would've known, I wish I would've practiced this." So doing a tabletop exercise is probably the easiest thing that you could do to practice, oh, no. And not just from the technology standpoint of how you're going to fix your environment, but how are the executives going to communicate? You've got one chance to make your statement to the public, you want to make sure that it's right.

>> Yeah.

Kerry Matre

>> How are you going to do that? Working with cyber insurers, when do you want to bring them in? Your legal counsel. These are things that are not necessarily top of mind-

>> Yeah....

Kerry Matre

>> until somebody's breached, and they say, "Oh, shoot, I wish I would've had that lined up."

>> It's interesting, he said, "Do more red teaming." He loves the tabletops-

Kerry Matre

>> Yeah....

>> because he obviously emphasized the hell out of that. But he said a term, maybe I wrote it down wrong, but I think he said, "Practice red lever events." Where was he going with this? Simulation, I get. Did he mean target certain events that happen over again? What does red teaming simulation mean if you have the opportunity to do that right?

Kerry Matre

>> Yeah. I'm not sure what the red lever is, but red teaming, it's not just, oh, no, we got breached, it's how we got breached in a certain scenario. So just because you've walked through a ransomware, red teaming engagement, you need to do other ones too. You need to look at your critical infrastructure. We have an ICS team that says, "Nobody knows that they're an ICS company, but they all are because all using this operational technology." So it's making sure that you're practicing all of these things, because they're all different. Common threads, but different in how you're going to react.

>> So the question I get a lot is cyber defense and security operations? We've got a team that does this, but now we have a threat intelligence defense team.

Kerry Matre

>> Yep.

>> How do you describe that? How do organizations look at that? What's your take on that?

Kerry Matre

>> So I've been in the industry a long time, and a lot of times people just want to group everything into, well, I have a SOC, it's fine. Cyber defense is so much more. Cyber defense is that intelligence, whether you're curating that inside your organization or you're bringing it in from a partner, it's that crisis communications. How are you going to talk to other organizations? One of the critical functions in the book is called mission control, and in that, it's how are the different critical functions in the cyber defense going to talk to each other, but how are you going to communicate outside, so well beyond just the identify, investigate, mitigate, inside of a SOC?

>> Explain the mission control. I think that's a really key point, because there's many stakeholders-

Kerry Matre

>> Yes....

>> but this coordination, can you just double-click on that?

Kerry Matre

>> Yeah. The mission control function typically is made up of people, resources, from the different critical functions that come together. This is where you're going to come up with your processes, your procedures, your communication plans. But during a major incident, they're really that center, that brain, of they need their finger on the pulse, they need to know what's going on, and they're the orchestrators. And so, one of the big things about mission control is making sure that they have the authority to act, because a lot of times, what we can see in breaches is the security team knows that a technical control needs to be fixed, the IT team doesn't seem to think it has as much urgency as the security team does. So giving that mission control the authority to act and say, "We need to do this right now," understanding the business, that's all part of that mission control.

Kerry Matre

>> Absolutely. And understanding we're in a special circumstance right now, where the traditional day-to-day processes may not be the process or the standard.

Kerry Matre

>> Right.

>> You brought up something that we haven't a chance to talk enough about this week that really tickles me. In my other life, I've done a lot of severe crisis communications, and I love that you just touched on that, because you're right, you get one chance-

Kerry Matre

>> Yep....

>> to say the right thing. And I'll just speak for myself in this scenario, we see the ball dropped in that particular step a lot of the time, or that ball dropped very incompassionately towards those affected users-

Kerry Matre

>> Yes....

>> because someone is trying to be reticent or coy about how severe a breach was. The reality is if it's going to affect the end user, we're all going to find out anyway.

Kerry Matre

>> Right.

>> So how do you help people prep for when that moment might happen, or coach them through that when they intersect you when it's happening?

Kerry Matre

>> Yeah, a lot of it's basic communication plans. Who are the stakeholders? Who needs to be involved? Telling them examples of, "Here's one company that handled the breach and their communications one way, and this was the effect and it was terrible. Here's a good way to handle it." So those examples really help people settle in. We have organizations that run to say, "Oh gosh, we want full transparency, we're going to tell you everything we know." And while you want to get information across, you don't want to jump to that.

>> Yeah.

Kerry Matre

>> So coming up with who are the stakeholders, how are you going to do it? Maybe run it through some scenarios, just like a tabletop. And then, sometimes you can pre-script some things. And then, one example of something that you can do very, very easily is set up... If there's a breach, you want one place where the message is, so know where that place going to be, whether it's on your website, probably, because what you don't want is to send out an email to every one of your 20,000 employees and say, "Here's your talking points." You do not want them talking.

Kerry Matre

>>

>> Web link, you'll find it.

>> No, no, no. Or just an errant tweet or whatever.

Kerry Matre

>> Right.

>> There's a lot that can happen there. Yeah. No, you're absolutely right. So same with that mission control, central point of communication.

Kerry Matre

>> Yep.

>> I've got to ask you, because one of the things that always comes up every year, the surface area is expanding. GenAI is a dream scenario-

Kerry Matre

>> Yeah....

>> on both sides, even the defenders are commercializing it. Certainly, ransomware's got product market fit for a long time.

Kerry Matre

>> Yeah.

>> They're doubling down, ransomware as a service, exfiltration, other extortion, Mega selling data back. So EDR yesterday we talked about, but then we said, okay, there's no E, What else is there? Now, there's detection response. Situationally, there's other things going on in the world, what's behind that API, that SaaS vendor. You have interconnections now with data, a lot new patterns of traversing distributed computing architectures, from network, from silicon, all the way up to the app. What is that blank DR... You've got the EDR endpoint everyone gets that. How do you guys look at that? Because I can imagine it's an important part of the defense intelligence piece to be aware of filling that letter.

Kerry Matre

>> Yeah, right. And the world is still trying to figure all this out. So what I'm saying today may not be to answer that I would tell you five days from now.

>> That's an honest way of phrasing it though.

>> I'll call you five days from now.

>> It's iterative though. That's an important one, it's a basic part of the industry.

Kerry Matre

>> Right. But what I would say is just like the adoption of cloud or the adoption of mobile apps-

>> Yeah....

Kerry Matre

>> we've seen this before, we've seen technology come along, and so there's certain things that we already know how to do. Your training data is your crown jewels, so how are you going to protect your crown jewels?

>> Yeah.

Kerry Matre

>> Just like you do in the cloud, just like you do anywhere else.

>> Yeah.

Kerry Matre

>> We're building applications on top of the AI models. You need to test out those applications, just like we do mobile apps.

>> Yeah.

Kerry Matre

>> So we need to take the lessons of, we've seen this episode before-

>> Yeah....

Kerry Matre

>> let's make sure that we're applying that, and then we'll see if there's technologies that come out that are that blank DR.

>> The application security AppSec reviews have been happening.

Kerry Matre

>> Correct.

>> Okay, now it's just another extension, it's a new element. Is there any observations that you could observe as GenAI comes in, is there any intrinsic new things popping out of that review process that people should pay attention to?

Kerry Matre

>> Well, right now, when we're doing our assessments, big things that come out are governance. Oh goodness, how are we going to put the guardrails on? We don't want to tell developers no.

>> Yeah.

Kerry Matre

>> Again, we've seen this episode.

>> Yeah.

>> One of the harder conversations in a not traditionally sexy space right now is governance.

Kerry Matre

>> Yeah.

>> It's a fun time, actually.

Kerry Matre

>> Can we just block it out? No, you can't just block it out.

>> Yeah.

Kerry Matre

>> One of the things that comes out is if you have a third-party app that you're using, it's a black box. There's no logging that comes out of it, you don't know what happens. I had a conversation with someone who was working with a third-party vendor, they got their application, something went wrong and they couldn't see inside of it, so then they had to go and pay more funds to the vendor to get access to what they needed to see. Not good.

>> Yeah.

>> That's clunky.

Kerry Matre

>> It's a little bit clunky.

>> Yeah.

Kerry Matre

>> What are some other themes that are coming up? A lot of it's around that crown jewels, the data security.

>> Yeah.

Kerry Matre

>> And then, what we find during our assessments is if you have poor IT security, you're definitely going to have poor AI security.

>> Yeah, yeah. Process is a big thing. Adopting a new tech stack is one thing, but understanding the new process becomes another one, to your point-

Kerry Matre

>> Right....

>> just because IT ran LAMP stacks two decades ago and they got a bolt-on some front end-

Kerry Matre

>> Right....

>> poor design. So is that whole design architecture being re-looked at? We're seeing an inflection point now with the silicon work being done around AI clusters, a lot of infrastructure work's going on around more supercomputing-like for the masses.

Kerry Matre

>> Yeah.

>> So very much a democratization trend coming. Does that help you guys out in the field and the intelligence side? Because more horsepower, more data crunching.

Kerry Matre

>> Right.

>> What's your take on that? I know that's really off-topic, but it is relevant, you can process the data faster and then do better reasoning and inference.

Kerry Matre

>> Right. They go faster, we go faster, they go faster, we go faster, it's as simple as that. But one of the things that we don't know yet are all the use cases. So I used to be in application security, I used to tear them apart.

>> Yeah.

Kerry Matre

>> Before that, I was an application developer, I made things work. It wasn't until I got into security that I was like, oh no, this is all the ways that it couldn't work. So I think with AI-

>> Yeah....

Kerry Matre

>> we're learning from the past, we know how to make our AI systems, our platforms, secure, but what are all the use cases?

>> Yeah.

Kerry Matre

>> How is it going to be used? We don't know. And that's why, in five days from now, the answers may be different.

>> So the book is written, second edition. You mentioned things are changing fast, and the one topic, five days, we'll call you, maybe ping you on LinkedIn. As this book is getting ready for the third revision, is there anything popping on your plate now that you say, okay, I'm starting to pull some stuff in, start getting my thoughts and wrangling some data concepts together, that's for the next edition, what's going to be on your horizon here in that book?

Kerry Matre

>> Well, what we've done right now is we've done a supplement document that's all about AI, how defenders using AI, and not just AI's built into this tool or that tool, but hey, let's get down and dirty, and let's figure out how you're going to write a rule here and a rule there. We also did one on OT security, because I think that that's highly overlooked. It runs most of our trade around the world.

>> They run Windows applications.

Kerry Matre

>> That's a great point you just brought up, yeah.

Kerry Matre

>> And the other thing is we launched the first edition three years ago, so we actually have feedback from the readers that have implemented it and really brought it into their organizations, and so pulling that into, here's how people are using it, and if they're different sized organizations, they use it differently. So large organizations have gotten feedback that it's an operating model. They said, "Well, I was already doing all this before, it just wasn't organized and I didn't know how to talk about it." And if they organize like this, they can figure out where the apps are. And so, it's really interesting they're using it.

>> Yeah. It's interesting, yesterday again, a couple of dots connected for us on theCUBE was there's playbooks and there's formulas and mechanisms, software, technologies, but the idea of being craftful, situational awareness, understanding what's out there, having a security mindset, threat intelligence first. So what is the train craft that's the creative side of it. I use the word art yesterday, it wasn't the right word, but I can follow up playbook-

>> You got scolded on that one.

>> Well, I back pretty fast, trust me. I didn't mean you're painting art. But you've got to look at data, you've got formulas, but it's craftful, situationally aware, and then make calls, right?

Kerry Matre

>> Yeah, and it's not a checklist. Yes, these are capabilities that you should have within the six functions, but then you've got to ask yourself, why? Why do I actually need these things? Well, because this triggers this, triggers that, and then hopefully avoiding that worst day. But it's really the creativity of saying, "Why are we actually doing this?" And that's what's laid out in the book, this is why they need to work together.

>> What's been the biggest feedback from people obviously operating it? Has there been some suggestions, any other commentary on the book from people implementing it, reading it, and diving in?

Kerry Matre

>> Yeah. The first book, we were told we need more.

Kerry Matre

>> Oh, yeah.

Kerry Matre

>> Which when when I first suggested, "Hey, guys, we're going to write a book," it was, "Nobody reads books anymore. Why would you do that?"

Kerry Matre

>> I read books all the time.

>> You should do a video series too, match it up with video.

>> Well, it's a really digestible size too.

>> Yeah.

>> I feel like it becomes actionable.

Kerry Matre

>> Right, right.

>> I won't say who it was, but somebody recently published a book about AI architecture, and it's so thick and so dense, and I thought, lovingly, it is only the academics and researchers amongst us that would ever get through this. Whereas this feels like anyone could read it-

Kerry Matre

>> Yes....

>> which I like. You've made this digestible, which in cybersecurity is one of the more important bridges, I think, for us-

Kerry Matre

>> Right....

>> helping secure smaller companies too, not just enterprise.

>> Yeah.

>> You're a startup and you don't have the money, you've got to make sure you're doing the right things day one.

Kerry Matre

>> Right. Well, I've gotten feedback from small organizations that say they are using it to justify budget.

>> I was wondering if it was ammunition for that.

Kerry Matre

>> Yep.

>> That shows proof.

Kerry Matre

>> "Hey, we do this and this and this, but next, we need to do this." So it's driving their investments in their own programs.

>> Well, I love the title, that's a movie title right there. It's definitely a miniseries, for sure, Defenders... I can see the script right now playing out of in my head, the script-

>> Would you to be cast as one of the characters?

>> I think I want to get the movie rights for this.

>> Yeah, yeah.

>> We're writing the script of the cybersecurity evolution right now, it is hot and heavy. The asymmetry battle continues. We hear it every year up on the keynote. Like you said, it's a game of leapfrog.

Kerry Matre

>> Yeah.

>> How are we doing? Resilience is always elusive, the metrics behind it, cyber resilience, a lot going on. Where are we, how would you peg the progress or status of the fight?

Kerry Matre

>> Well, we're better than we were 20 years ago-

>> Yeah....

Kerry Matre

>> but so are the adversaries-

>> Yeah....

Kerry Matre

>> and so it's that leapfrog ability. I've been in cybersecurity for quite a few years, so from where I started, we are way far ahead of where we were. But with AI coming in, with more cyber physical attacks, we didn't see those 20 years ago. So I think as defenders, there's a lot more collaboration in the industry as we see all around us-

>> Yeah, cool....

Kerry Matre

>> I think that's super important.

>> It's also really refreshing. It's such a theme across private, public, enterprise, smaller startups.

Kerry Matre

>> Yep.

>> Y'all are really coming to a true mind meld to protect the greater good.

Kerry Matre

>> Yep. And it's also interesting to see the next generation coming. There's people very excited about cybersecurity, which maybe before, they didn't even know what cybersecurity really was.

>> Yeah.

Kerry Matre

>> Now, everybody knows. So it's really interesting to see the next generation coming up.

>> Yeah, new players coming out.

Kerry Matre

>> It was almost like in the before, cybersecurity didn't want you to know who cybersecurity was, it was like that VIP, invisible is safe vibe. I'm curious, we've got a really big startup audience and we've talked a lot about enterprise, I suspect you know how to advise on both sides, if I'm an early-stage company, what are the top three things I can do to at least evaluate my potential risk and threat landscape, and build a foundation that could be evolved into continuing to be secure as we scale?

Kerry Matre

>> Yeah. Well, I'm assuming you're not starting at zero-

>> Yeah....

Kerry Matre

>> so you've got your firewalls, you got some EDRs in there.

Kerry Matre

>> Let's assume there's a little bit going on.

Kerry Matre

>> Let's assume that there's a little bit going on. One of the things that startups can always do is find partners for 24/7 monitoring, that sort of thing, I think that's a really good investment. When you have small organizations, you don't have the person who knows every single thing about cybersecurity, find those partners. The other thing is making sure that the head of the organization buys into, hey, this is really important. It's not just about ending up in the headlines, this is actually going to affect your business if you don't do it right. So those are some of the first things to do.

Kerry Matre

>> Yeah.

Kerry Matre

>> I wouldn't say you need to run and invest millions and millions and millions of dollars into all of the technology, but ask yourself, like in the book, ask yourself why you're doing these things, and then it will come.

Kerry Matre

>> Come up for you. I think that makes sense. Get that buy-in, it's going to matter all the way, and understand what matters most to your organization.

Kerry Matre

>> Yep.

>> I love it. Kerry, you've just been a wealth of insights for us. I know that John and I will be reading The Defender's Advantage on the plane while John writes the movie script. It's fantastic. You and the other 39 writers-

Kerry Matre

>> That's right....

Kerry Matre

>> obviously did a great job. Thank you for sharing this with us and taking the time. John, always a pleasure to plot future feature films with you. And thank all of you for tuning in to our two days of coverage here in Denver, Colorado. We're at mWISE. My name's Savannah Peterson. You're watching theCUBE, the leading source for cybersecurity news.