RSA Conference 2023 | Raj Rajamani

News
More from RSA Conference 2023

Raj Rajamani

Chief Product Officer, DICE

CrowdStrike

Stopping cloud breaches: CrowdStrike combines agent-based and agentless methods to ensure data security

Adversaries view the cloud as a soft target, riddled with vulnerabilities and misconfigurations to exploit. Ending cloud breaches requires covering the entire spectrum.Since CrowdStrike Inc. is primarily focused stopping breaches, the company offers a more comprehensive cloud-native application protection platform solution by tying identity pieces and runtime protection using both agent-based and agentless methods, according to Raj Rajamani (pictured), chief product officer of data, identity, cloud and endpoint at CrowdStrike.“We embrace both agent and agentless approaches,” Rajamani said

Info

Raj Rajamani | Crowdstrike

Raj Rajamani

Chief Product Officer, DICE CrowdStrike

(relaxing upbeat music)

>> Hi everybody. Welcome back to theCUBE's coverage of RSA 2023. We're here at Moscone West. All the action is going on. The keynote action is here, south and north is insane. I mean, it's just vendor booths and the traffic of the practitioners and the vendors and the technologists and the consultants and the analysts. It's just out of control. Raj Rajamani is here. He's the Chief Product Officer of DICE, which is CrowdStrike and want to learn more about what you guys have going on. Data Identity Cloud and Endpoint is what DICE stands for. Raj, welcome to theCUBE. Good to see you.

>> Thanks Dave. Thank you for having me.

>> Yeah, our pleasure. So you're, you were, you're telling me off camera, you're relatively new to the company.

>> Raj: Yes.

>> Why'd you join CrowdStrike?

>> I think CrowdStrike over the years has tackled some of the most relevant and deep cybersecurity challenges and proven that they can scale it and protect most of the brands that we all use every day. So when I had the opportunity to join this winning team, it was a no-brainer for me to bring my craft to a company that will allow me to paint on a much broader canvas than I had earlier.

>> So you guys talk about cloud native application protection scene app. We're going to talk about that, but I'm going to, before we get into it, it's like why is protecting apps so difficult?

>> I think there's a tremendous amount of diversity in apps, as well as, you know, when they get deployed into the cloud, how companies are approaching the cloud. Many of them are taking a multicloud strategy in order to have some level of pricing control and leverage, as well as, you know, making sure that they don't have all their eggs in the same basket. So when you add all of these components together, Dave, the complexity just explodes to the point where you cannot really be managing security with a few, you know, few simple solutions. And that has led to an proliferation of point products and solutions like CSPM, like CIEM, and that's where I think things have kind of gone a little too far. And I suspect in the next few years we expect things to kind of come together and consolidate a little bit and in an effort to solve the cloud security challenges.

>> Well, the other thing too is customers, you know, they want different tooling and may, that might exist on different cloud. Somebody like say, I really like BigQuery, so I want to, you know, do some stuff with Google and I want to use their AI. Or now, you know, hey, I want to go to Azure 'cause they got, you know, GPT now. And so that, you know, as much as we think that that might stop, it's probably not going to stop. So that's probably good news for you guys, but what's your CNAP strategy kind of vision and your story?

>> Okay, in one single sentence, we stop breaches. And this is something that CrowdStrike coined this particular phrase or tagline well over a decade ago. And it is very timeless and very elegant, so appropriate to what we are actually doing. And this is also the reason why we've been so successful in cloud security, right? So I mentioned Dave, that because of the complexity, it has given rise to a number of point products like CSPM products like this, Orca, EmeriCon and so on. And the number of them have solved a very, very important subset of problems like identifying misconfigurations and exposures and vulnerabilities.

>> Dave: Right.

>> But they have also in the very recent past, in the last three months, essentially kind of said, hey, there is more to cloud security than just misconfigurations, than exposures and vulnerabilities. You need runtime protection. So what are these vendors who excel at a one trick product doing? They're all partnering with different vendors like SentinelOne to try bolting together or bringing together a more comprehensive CNAPP product or solution to the market. And that's where I think CrowdStrike has played the long game over the years. We have always focused on stopping breaches and we are also one of the preeminent incident response vendors or service providers for anyone that is compromised, that has a breach. So when we go in, we actually do a lot of analysis and the metrics are very compelling. We have seen a dramatic increase in the number of adversaries that are trying to recon or understand your cloud assets anthropology, there has been a 95% increase in the number of cloud-based exploits here over year. They're also using a lot of identity-based attacks. So if you look at the tip, most common reasons why cloud security gets compromised, Dave, the number one reason is misplaced or lost credentials. Number two, are various misconfigurations. I'm sure you've read about some company that put their customer data into an S3 bucket that someone else was able to read.

>> I've seen some data protection companies actually do that. (Dave laughing) Yes.

>> And number three is classic exploit of the vulnerabilities. So you need to cover the entire spectrum. And of course, over the last few years there's also been an increasing concern around supply chain attacks, right?

>> Dave: Right.

>> So there are very, very few solutions that are able to cover the spectrum, entire spectrum, starting from scanning the code, to make sure that they do not have any back doors, any malware, any hidden secrets before they get deployed into the workloads. Products that can also protect you in runtime against runtime attacks, protect you against credential theft and lateral movement of these attacks, as well as the classic misconfigurations and runtime and the exposures and vulnerabilities. And that's where we come in by pulling all of these things together into a single platform, which is our Falcon platform. And the beauty of this whole solution, Dave, is that every piece of data that we collect essentially goes into three different places. It's a, if it's thread related, goes into a thread graph, if it's asset related, it goes into an asset graph. And if it's an activity log, it goes into our XDR back plane or data plane, right? And using these three, we are able to kind of stitch together correlate attacks across multiple different vectors. So if there was a misconfiguration or a vulnerability which got exploited by an attacker, we are able to actually string those together and provide you fewer alerts that actually lead to better results for the customer.

>> Okay. Lots unpacked there. I'll start with, we stop breaches. I hear George on the radio all the time. George Kurtz is the CEO of CrowdStrike, talking about it. So it's kind of, I like when the CEO gets on and says, you know, I'm going to stand behind my product. So that's a good thing. Let's go back to sort of cloud security in general. So people I think, have this perception that, well, it's in the cloud so it's secure, but as you're pointing out, there's a lot of misconfigurations. There's certainly a number of like hard coded secrets in code. It's a lot of the same sort of alerts that are causing most of the problems as we know. So when you think about the fundamental principles or the first principles of cloud security, what, how do you guys think about that?

>> So I, one of the core principles is you stop and try to identify and discover problems as early in the chain as possible because that is the best way for you to keep your costs low. And hence, I mentioned that we have one of the best code repository scanning technologies in the market today. We integrate with 16 different repositories, whether it be Docker Hub, GitHub, you know, Amazon's ECR, the Google Azure versions of it, or even Mirantis J Frock. When, even before the code gets deployed, we can actually scan the code to make sure that there are no vulnerabilities, no malware, no back doors. And if you can prevent something that is, that has a known backdoor from even getting deployed, that is the best time to stop the attack, right? Because, you know, attackers have one less easy way to kind of get in the door. However, we also believe in defense in depth or defense in layers because no one solution is going to stop all kinds of attacks, right? And I think this is what the CSPM vendors are starting to realize that, hey, while it's great to identify all the misconfigurations and vulnerabilities, that by itself is not enough to prevent breaches. A lot of the incident response services or activity that we get pulled into Dave, are the same companies that are using one of these CSPM products. So for us to be able to go in and see this, you know, tells us that hey, one product, there are no silver bullets, you need to kind of layer your security and you need to try stopping attacks as slowly in the chain as possible.

>> Yeah, I always say, if I said it once, I said it a hundred times, the bad security practices will trump good security every time, right? So, but that notwithstanding, what are you seeing in terms of the greatest, the biggest vulnerabilities, specifically in cloud security? Where should we be paying attention? Where are those gaps?

>> I would say the biggest gap right now if, when I talk to my customers is having the identity pieces tied to your runtime protection, right? There are very, very few products that are actually bringing together aspects of credential theft, securing the credentials. This goes back to my earlier observation Dave, that the number one reason for exploits and attacks and compromises in the cloud is due to stolen or misplaced credentials, right? Because that's the easiest way for anyone to get in. And there are very, very few products that are able to kind of string together and correlate the information, the activity of users, their service accounts to the different types of changes that are happening in the environment to the runtime attacks that they may be observing, and also to some of the vulnerabilities that may be out in the open.

>> So do you get there, that Rohit guy had a keynote identity crisis, which I thought was very clever, in fact, I stole it, but I gave him credit and a couple of posts that I wrote. But so, but how do you do that? You partner with, you know, identity players like in Okta to achieve that or others? How do you, you know, where the seams and where the gaps and how do you?

>> Yeah, so let's actually talk about one of the best kept secrets of cloud security. So over the last few years, we've organically built a lot of these capabilities. There were one or two acquisitions that we also made, the most notable one being preempt security.

>> Dave: Yeah.

>> Which is how full, fully integrated into our Falcon platform. And what Preempt does is really helps us understand attacker activity. If they get a foothold on your network, if they're performing recon, if there are, you know, certain risks and even misconfigurations of your active directory. For instance, are there users with SPN, Service Principle Names, right? Are there certain inactive accounts? Because a lot of times customers do not have the clean hygiene that it, that is required to make sure that when someone leaves the organization, their accounts are disabled, deleted, whatever, right? And we are able to assess the risk of active directory. We are able to monitor the activity of the users. If someone uses a password that we know has been stolen, we can actually, you know, we have a list of all the compromised passwords and we can tell you that that is a weak password, while that is happening. When we detect certain types of malicious activity, we can immediately jump in and either block it or ask the user for a multi-factor authentication, thereby preventing a lot of the interactive dis, interactive intrusion attempts that are happening, which we definitely have reported about in our G, global threat report. There's been a significant increase in those type of attacks by our adversaries.

>> Dave: You'll do that in real time?

>> Yes.

>> Yeah, we've all experienced that. Oh, I can't get in or it's going to validate me with an MFA.

>> Raj: That's right.

>> It's me, it's okay. How about this issue of agent versus agentless? You guys have a, I think you call it a lightweight but powerful agent. I think if that's the terminology that you use, people hear agent, they go, oh no, something else that has to be managed. At the same time, if you're agentless, you have some deficiencies. So maybe explain that.

>> I think, you know, we embrace both agent and agentless approaches and there are different times when an agent based approach is superior to an agentless one. And there are times when an agentless one is probably the best or the only available option, right? Let's take the classic example of looking for vulnerabilities, right? A lot of times, you know, at least earlier, we used to scan for vulnerabilities from the network. There was also an option to put as an agent, or as we call it, the sensor to discover the vulnerabilities. And that gives you the most high fidelity as well as realtime information about vulnerability. So let's say you have a version of an application, you upgrade to a newer version. We know that that vulnerability no longer exists and we know that in real time without you having to perform a scan. But then when many of these concepts moved into the cloud, Dave, customers were struggling with both these concepts. They were struggling to put the agent, they were also struggling to scan, which is where the CSPM vendors came in and had a very innovative solution called side scanning or an agentless scanning. Fundamentally, they were, you know, mounting the devices or the virtual machine images and scanning for it in a different place, not necessarily in the production environment that reduce the load or any kind of imperfections that you may have when you're scanning or probing a live production workload, but gave the same level of information or insights that customers were looking for. And that I thought, was a very cool, innovative way of identifying vulnerabilities. However, in our case, because we have a sensor that also offers runtime protection, which is absolutely critical to preventing breaches, we do recommend, we make it very, very simple for our customers to deploy the sensor wherever it is supported. However, there are many, many instances where the sensor is just not supported. Let's start, take a couple of examples, right? If you look at functions, you know, Lambda or Google functions or Azure functions, those do not have a sensor concept. There is no place to deploy an agent to. So what do you do in those situations? We effectively would use an agentless approach, and we are totally good with it, right? We want to use the right tools, not because they are an agent or an agentless approach, but because we want to stop the breach and we will use any number of those techniques. We have no religion here other than to stop breaches.

>> But if I understand it correctly, Raj, if you can use the agent, you will, because.

>> Raj: We would recommend using the agent, yes.

>> It's going to give you better protection, it's going to be a higher probability that you'll stop the breach.

>> Yes.

>> If you can't, then you'll use a scanning technique and that's yours or the clouds or whosever, I mean you'll...

>> It's a combination. So in some cases there are APIs that are available. In some cases we would do a site scanning. So it is absolutely the right horse for the right course.

>> So when you come in as the new chief product officer, what are you looking for? What's the doctor that took the patient and what's the diagnosis say? Like the annual checkup, healthy, but need to lose a little weight. You know, if you want to gain, you got to do some bench presses. What was your diagnosis, doctor?

>> So the diagnosis is that the patient is ready to check out and actually, you know, go win a race, right? And there are a couple of people who've been running this race for a long time and you know, one of them is Nick Cage from Palo Alto and the other is, you know, With, and they've been running this game where they've been talking about a lot of the compliance and things that are doing a lot of things. They're definitely solving a lot of interesting problems. But in terms of outcome, I think customers are still struggling. And that's exactly what I've been hearing the last 48 hours as I've been meeting customers, Dave, and I believe this patient is now ready to check out and go run a race and you'll start seeing us being far more vocal about our cloud security capabilities in the coming weeks and months.

>> Tell me more about what customers are saying. What are those conversations like?

>> So the main conversation, especially with, when it comes to this is that, hey, they've solved one problem. They still do not offer any protection capabilities. Now they're partnering with some other vendor. It's still going to be disjoined. We don't even know when the joint solution will be available and when it is available, what form it'll be available. It definitely is not going to be as well integrated as when everything is coming together in the single platform, which is Falcon, with Prisma customers absolutely love the breadth of capabilities that Prisma has put together, but remember that it actually has come on the heels of about 10 or 11 different acquisitions. Now, while they've brought it all together under Prisma umbrella, there are still some obvious invisible gaps. The most visible gap being that of protection. So their protection agent reports into a different console, the Cortex console and not the Prisma console. That is their biggest weakness. So customers are like, I'm using two different consoles anyways. And that is, that leads to a suboptimal performance. I would much rather get everything in a single platform and have the same level of breadth of coverage. And there is only vendor that, one vendor that is providing it and that is CrowdStrike.

>> Okay, so you, your platform, not product. Okay. We established that long, long time ago. Can you be both best of breed and at the same time an integrated platform? Two part question and B, part B is, do you even have to be?

>> I think you have to be, because what I have observed over the years, Dave, and I've worked in a number of, you know, very iconic companies starting with McAfee back in the day Later Silence, and now more recently here at CrowdStrike. And I have observed that the best product almost always wins. It may take a while, it may take five years, it may take eight years or 10 years, but eventually the best products absolutely win. In terms of how do we become best of breed while remaining, while being a platform, I think we are playing to our strengths in a couple of ways. We are leveraging our investments in our graph technology, which is the thread graph and the asset graph as well as the XDR platform, as well as we are really cultivating and effectively promoting a culture of entrepreneurial excellence. So our teams are operating independently to the extent that they can go work with customers, make them really successful, operate in a very agile fashion to make sure that when we hear about any problem, any new requirements, we are able to jump on it and turn around, provide the response that they might expect only from a small startup. So it's a small division, small BU, small unit, whatever you want to call it, but they're working in a very entrepreneurial mode to go solve the set of customer problems and they get the benefit of solving on top of the Falcon platform, which over the years has, you know, built planet scale technologies in graph and XDR that absolutely help us stitch things together and deliver better outcomes.

>> Yeah. You guys talk about that a lot. Your sort of graph capability. What does that get you from a product stand? Explain that.

>> A lot of times what ends up happening Dave, is when you're collecting information telemetry, you just effectively lock them into a central place. Maybe it is a Splunk, maybe it's an elastic wherever, right? And each one of those is an event which is kind of independent. And when you give this to some level of, some analyst, the analyst has to go through multiple events, figure out which is the latest, how are these events correlated to one another? How many of these events are part of one single attack chain? By bringing everything together in a single asset or a graph view, what we are able to do is a threat has typically one set of graph visual representation. And we are able to bring together, stitch together all the related events into a single threat and the notes get updated and you can also see a timeline view so that you can say, hey, what did this graph look like maybe two hours ago when the attack just was getting started? As well as what does it look like now? How many new nodes have happened? How many external network connections are happening? How many files or registries or services were modified? Those things are much easier for us to explain by bringing them together and encapsulating it in a pill that as can quickly swallow, as opposed to just giving them a big, big list of events that they have to correlate.

>> So this is a purpose-built capability that you guys have.

>> Absolutely.

>> And it's a graph database underneath it, right? But how do you, do you even need to, so the problem that you've always had with graph databases commercially, broadly, and I know you've got a very specific use case here, but I wonder if how it applies. You want the expressiveness of graph, but you lose the, I'll call it the flexibility or query elegance, simplicity of relational.

>> Raj: Yes.

>> Does that, is that a problem for you?

>> Raj: It's not a problem because...

>> And why isn't it?

>> That's how, that's why where the XDR platform comes in. So we collect the data, we store it both in the graph as well as in the raw telemetry, which is our XDR platform. So if you wanted the raw telemetry, if you just wanted to go see a set of events, you can absolutely do that by going to our investigate page and running the search, looking for IOS, IOCs, whatever, you know, IP addresses that you are looking for, that you're searching for. On the other hand, if you want a simple snapshot, a summary of all the alerts, you go into a different place where you say, hey, this is the graphical representation. How has it evolved over time? And what are the right next steps? Is this a true positive? In which case, what am I going to block and how are, how am I going to prevent this from happening again in the rest of my fleet?

>> Yeah. Okay. Great. Raj, thanks so much for coming on theCUBE, it was great. Congratulations on the new role.

>> Thank you. Thank you for having me.

>> You're welcome. Yeah, our pleasure. All right, keep it right there. This is Dave Vellante, John Furrier, also in the House of Cubes, live coverage of RSA 2023. We'll be right back from Moscone West right up after this short break. (relaxing upbeat music)

Raj Rajamani | Crowdstrike

(relaxing upbeat music)

>> Thanks Dave. Thank you for having me.

>> Yeah, our pleasure. So you're, you were, you're telling me off camera, you're relatively new to the company.

>> Raj: Yes.

>> Why'd you join CrowdStrike?

>> So you guys talk about cloud native application protection scene app. We're going to talk about that, but I'm going to, before we get into it, it's like why is protecting apps so difficult?

>> Dave: Right.

>> I've seen some data protection companies actually do that. (Dave laughing) Yes.

>> Dave: Right.

>> Dave: Yeah.

>> Dave: You'll do that in real time?

>> Yes.

>> Yeah, we've all experienced that. Oh, I can't get in or it's going to validate me with an MFA.

>> Raj: That's right.

>> But if I understand it correctly, Raj, if you can use the agent, you will, because.

>> Raj: We would recommend using the agent, yes.

>> It's going to give you better protection, it's going to be a higher probability that you'll stop the breach.

>> Yes.

>> If you can't, then you'll use a scanning technique and that's yours or the clouds or whosever, I mean you'll...

>> It's a combination. So in some cases there are APIs that are available. In some cases we would do a site scanning. So it is absolutely the right horse for the right course.

>> Tell me more about what customers are saying. What are those conversations like?

>> Yeah. You guys talk about that a lot. Your sort of graph capability. What does that get you from a product stand? Explain that.

>> So this is a purpose-built capability that you guys have.

>> Absolutely.

>> Raj: Yes.

>> Does that, is that a problem for you?

>> Raj: It's not a problem because...

>> And why isn't it?

>> Yeah. Okay. Great. Raj, thanks so much for coming on theCUBE, it was great. Congratulations on the new role.

>> Thank you. Thank you for having me.