theCUBE & NYSE @RSA 2024 | Lindsey Havens | Finite State

theCUBE.net

Clips
News
More from theCUBE & NYSE @RSA 2024

Lindsey Havens, M.A.

VP of Marketing

Finite State

RSA Conference 2024 goes beyond AI-powered security to securing AI itself

The past week’s RSA Conference 2024 was crowded, buzzy, vibrant and chaotic, underscoring the very nature of the cybersecurity industry.This market has a kind of self-propelling energy with a dynamic that blends tons of money, an ever-present and capable adversary, technical innovation, public policy, geopolitics and a smashing together of the digital and physical worlds. Despite a logical need to consolidate tooling and simplify, organizations find themselves constantly searching for answers to new problems that they face every day, week, month and year

play_circle_outline Securing Interconnected Devices in Critical Infrastructure: An Insight into Finite State's Binary Analysis Methodology

Info

Lindsey Havens | Finite State

Lindsey Havens, M.A.

VP of Marketing Finite State

search

>> Welcome back to theCUBE after dark. It's really not that dark, but we're here at San Francisco. This is part two of day one of theCUBE at RSAC 2024. Really excited to have Lindsey Havens here. She's the Vice President of Marketing at Finite State IO Security company, doing some pretty cool things, protecting critical infrastructure. Lindsey, great to see you. Thanks for spending some time with us.

Lindsey Havens, M.A.

>> Great to see you. Thank you for having me.

>> So tell us about Finite State. That's a really humble name. Infinite State would be really a little bit overdone. Finite State feels like I can get my arms around it. Tell us about your company.

Lindsey Havens, M.A.

>> Yeah. So Finite State does software supply chain security. Yeah. We're focused on protecting all things IOT and OT, embedded device security. That's what we're all about.

>> Okay. When did the company start? When did it get founded?

Lindsey Havens, M.A.

>> Yeah. So we're about seven years old now.

>> So before the famous SolarWinds hack that everybody realized, "Wow. We've got to protect the supply chain." Were you in that business prior to the SolarWinds hack and saw this coming?

Lindsey Havens, M.A.

>> Yeah. Our CEO was at Battelle for a long time prior, and he saw that a lot of cyber security was really just not keeping up with the digital era. So things were getting connected, coming online, everything was interconnected and he saw that there was a big gap in security around that. So that's where-

>> Most critical infrastructure, in the old days, it was air gapped, so you didn't have to worry about it. And then somebody had the brilliant idea, I guess tongue in cheek, let's connect the electric grid to the internet, which would bring so many other benefits. Wow. Okay. So how do you guys solve this problem?

Lindsey Havens, M.A.

>> Yeah. I mean, so everything is connected now. I mean the device that I wear around my wrist to a lot of health monitoring systems like my Peloton for instance, everything is connected.

>> Like car?

Lindsey Havens, M.A.

>> A car, medical devices in the healthcare space. We need to secure all of those things. And Finite State is helping to look deep inside of those devices, make sure that everything in those devices is actually, we understand the vulnerability that is living within those devices. So we're looking at a very deep... We use binary analysis to break down every component of every software, firmware, everything within that device to make sure that it's secure.

>> So it's software supply chain.

Lindsey Havens, M.A.

>> That's right, software.

>> So you're not dealing with the hardware. So it's all the different clones that feed into that code. Okay. An Apple Watch, it's sophisticated, but when I think about nuclear power plants or rail systems or water supplies, there's all kinds of software connecting the physical world to the digital world. And I would imagine we can't even imagine the complexity of all that.

Lindsey Havens, M.A.

>> You don't want to see any of that go offline, and it could be first-party code. There's just so many means of getting different codes. I mean, that's important. We need all of those components, but we also need to know that they're very safe and very secure. So that's what we're doing.

>> I was plowing my driveway one day and I plugged into headphones and I was listening to the Sonal on a16z, and she did an awesome, I keep coming back to SolarWinds. It's an awesome anatomy of the SolarWinds hack. And the thing that blew me away is the security pros were patching their systems, doing the very things that were supposed to keep them safe, but they were just patching with malware. I couldn't believe it. I was like, "Wow. How do you protect against that?" I still don't know how you protect against that. How do you protect against that?

Lindsey Havens, M.A.

>> Yeah. I mean, at Finance State, one of our benefits is that we look at what is hurting you the most. So we have a scoring methodology and a prioritization that helps you understand what is actually exploitable, what has been weaponized, what is actually out there in the wild today. So that's the methodology that we use. There's vast amounts of data, so you have to be able to extrapolate the data that really matters that you really need to patch or protect and that you need to focus on today. And that's what we are-

>> Are your customers... It sounds like a real mix. I mean, the diversity of critical infrastructure or wearables, it's all over the place.

Lindsey Havens, M.A.

>> It is.

>> So it could be big device manufacturers, it could be power plants. I mean, is that who your customers are?

Lindsey Havens, M.A.

>> Exactly. So it's from personal device manufacturers to energy sector, to automobiles, to medical device manufacturers. Those are all of our customers. I mean, anywhere that there could be a major impact to health, human safety or the electrical grid, those are our customers.

>> As somebody who has been following this for a while, expert in the field, I would consider you, I hate to ask this question, but I got to ask it. On a scale of one to 10 where 10 is completely protected and a one is oh crap, where are we in the spectrum of critical infrastructure? I know we're closer to oh crap, are we beyond one?

Lindsey Havens, M.A.

>> I mean, it depends on the specific sector. I mean, there have been a lot of regulations that have been coming out more recently. Specifically the FDA has come out with... For medical devices, if you're putting something out in the market, you're going to have to pass through some very strict regulatory requirements that the FDA is approving. So it really depends. I would say from... It varies. I don't want to throw any vertical under the bus, but I think we can all understand some are a little more behind than others.

>> All right. I won't put you on the spot. So basically saying there's a wide spectrum of readiness that actually varies. Is it vary by industry or does it more vary by company?

Lindsey Havens, M.A.

>> I would say it's both. I mean, there are some front-runners. We typically do business with the modern more front-runner. I want to use security as a differentiating factor. They're usually coming to us because they're ahead of the game. Generally, that's who we're looking for to do business with us. But as a whole, look, we really need to level with ourselves. This is truly a matter of national security. We need to take this very seriously. And I think it's going to become very commonplace that just like today, we go to the store and there's a label with every single ingredient on whatever we're purchasing. That's the future state. We need to understand exactly what's in our device, how secure is their device, open policy. They're doing everything that they can to help make sure that policies are in place to help me and you and consumers and critical infrastructure to, we need to catch up. Look, we need to take this very seriously.

>> Yeah, open policy and doing some amazing work. Are there industries that are... There are, obviously they're doing a better job. I hope defense is one that is pretty in tune. I hope our airlines are on top of things. So what attracted you as a woman in tech to cyber security? This is not an industry, a sector that is... I mean, it seems to me it's probably less women in cyber than there are in other sectors of IT. And it's probably, IT is less than 20% of our industry is women. I think it's even lower than that in cyber. Maybe that's true. Maybe it's not. What attracted you to this superhero world?

Lindsey Havens, M.A.

>> Yeah, a few things. So cybersecurity has always been intriguing to me. One, I find it very interesting. Two, I actually have a master's degree in forensic psychology, so I've always been drawn to the dark side a little bit. So understanding why do cyber criminals do what they do and how can we protect ourselves? I take it really personal when it comes to an attack on me or somebody in my life or the nation that I live within. I take it really personally. So I want to work in an industry and for a company that's just doing the right thing and that's what we're doing. I mean, I want to make a difference in this world, and I feel like I'm working at a company and within an industry that's making an impact, doing the right thing.

>> Did you ever want to be like an FBI profiler? Was that-

Lindsey Havens, M.A.

>> That's funny that you say that. Actually I was having a good conversation with, I will not name the government agency here, but yes, my intent I was going to be a profiler, or I was going to be a trial consultant. So the profiler was definitely the top of my list. I wanted to work at an agency.

>> How about superhero? When you were a kid, did you ever have a superhero that you modeled yourself after?

Lindsey Havens, M.A.

>> No, I didn't think not. But Superwoman is always there.

>> But I mean, a lot of cyber pros, they said they gravitated towards superheroes. They're going to help to your point, protect the world. And that's what you guys are doing.

Lindsey Havens, M.A.

>> We're trying. One day at a time.

>> So what's next for you guys? What's happening here at RSA and then what's next?

Lindsey Havens, M.A.

>> Yeah. I mean, it's super exciting to be here at RSA. I love just the collaboration with partners and with people like Open Policy, they're doing awesome things. I'm personally super excited about AI and what it's going to do for us as an industry in cyber security. We need to embrace it. We don't need to be afraid of it, and we just need to take to the next level. This is our opportunity to get ahead and not be just play a whack-a-mole and just waiting and being reactionary. This is our opportunity and we need to embrace it. We need to leverage. I was in the innovation that started the whole sandbox this morning, and there were several companies that are doing a lot around AI data security. So I think if we all work together, we're going to be able to get ahead of the game and really leverage AI to our advantage.

>> Well, the adversaries are taking advantage of AI, so we are better.

Lindsey Havens, M.A.

>> Exactly. Which is why we have to. Exactly.

>> The good guys and girl are better. Lindsey, thanks so much for coming to theCUBE. It was fantastic seeing you.

Lindsey Havens, M.A.

>> Yeah. Lovely. Thank you so much.

>> Appreciate it. All right. Keep it right there. More action from theCUBE after dark. This is Dave Vellante voices hanging on. Keep right there, be right back.

Lindsey Havens | Finite State

search

>> Welcome back to theCUBE after dark. It's really not that dark, but we're here at San Francisco. This is part two of day one of theCUBE at RSAC 2024. Really excited to have Lindsey Havens here. She's the Vice President of Marketing at Finite State IO Security company, doing some pretty cool things, protecting critical infrastructure. Lindsey, great to see you. Thanks for spending some time with us.

Lindsey Havens, M.A.

>> Great to see you. Thank you for having me.

>> So tell us about Finite State. That's a really humble name. Infinite State would be really a little bit overdone. Finite State feels like I can get my arms around it. Tell us about your company.

Lindsey Havens, M.A.

>> Yeah. So Finite State does software supply chain security. Yeah. We're focused on protecting all things IOT and OT, embedded device security. That's what we're all about.

>> Okay. When did the company start? When did it get founded?

Lindsey Havens, M.A.

>> Yeah. So we're about seven years old now.

>> So before the famous SolarWinds hack that everybody realized, "Wow. We've got to protect the supply chain." Were you in that business prior to the SolarWinds hack and saw this coming?

Lindsey Havens, M.A.

>> Yeah. Our CEO was at Battelle for a long time prior, and he saw that a lot of cyber security was really just not keeping up with the digital era. So things were getting connected, coming online, everything was interconnected and he saw that there was a big gap in security around that. So that's where-

>> Most critical infrastructure, in the old days, it was air gapped, so you didn't have to worry about it. And then somebody had the brilliant idea, I guess tongue in cheek, let's connect the electric grid to the internet, which would bring so many other benefits. Wow. Okay. So how do you guys solve this problem?

Lindsey Havens, M.A.

>> Yeah. I mean, so everything is connected now. I mean the device that I wear around my wrist to a lot of health monitoring systems like my Peloton for instance, everything is connected.

>> Like car?

Lindsey Havens, M.A.

>> A car, medical devices in the healthcare space. We need to secure all of those things. And Finite State is helping to look deep inside of those devices, make sure that everything in those devices is actually, we understand the vulnerability that is living within those devices. So we're looking at a very deep... We use binary analysis to break down every component of every software, firmware, everything within that device to make sure that it's secure.

>> So it's software supply chain.

Lindsey Havens, M.A.

>> That's right, software.

>> So you're not dealing with the hardware. So it's all the different clones that feed into that code. Okay. An Apple Watch, it's sophisticated, but when I think about nuclear power plants or rail systems or water supplies, there's all kinds of software connecting the physical world to the digital world. And I would imagine we can't even imagine the complexity of all that.

Lindsey Havens, M.A.

>> You don't want to see any of that go offline, and it could be first-party code. There's just so many means of getting different codes. I mean, that's important. We need all of those components, but we also need to know that they're very safe and very secure. So that's what we're doing.

>> I was plowing my driveway one day and I plugged into headphones and I was listening to the Sonal on a16z, and she did an awesome, I keep coming back to SolarWinds. It's an awesome anatomy of the SolarWinds hack. And the thing that blew me away is the security pros were patching their systems, doing the very things that were supposed to keep them safe, but they were just patching with malware. I couldn't believe it. I was like, "Wow. How do you protect against that?" I still don't know how you protect against that. How do you protect against that?

Lindsey Havens, M.A.

>> Yeah. I mean, at Finance State, one of our benefits is that we look at what is hurting you the most. So we have a scoring methodology and a prioritization that helps you understand what is actually exploitable, what has been weaponized, what is actually out there in the wild today. So that's the methodology that we use. There's vast amounts of data, so you have to be able to extrapolate the data that really matters that you really need to patch or protect and that you need to focus on today. And that's what we are-

>> Are your customers... It sounds like a real mix. I mean, the diversity of critical infrastructure or wearables, it's all over the place.

Lindsey Havens, M.A.

>> It is.

>> So it could be big device manufacturers, it could be power plants. I mean, is that who your customers are?

Lindsey Havens, M.A.

>> Exactly. So it's from personal device manufacturers to energy sector, to automobiles, to medical device manufacturers. Those are all of our customers. I mean, anywhere that there could be a major impact to health, human safety or the electrical grid, those are our customers.

>> As somebody who has been following this for a while, expert in the field, I would consider you, I hate to ask this question, but I got to ask it. On a scale of one to 10 where 10 is completely protected and a one is oh crap, where are we in the spectrum of critical infrastructure? I know we're closer to oh crap, are we beyond one?

Lindsey Havens, M.A.

>> I mean, it depends on the specific sector. I mean, there have been a lot of regulations that have been coming out more recently. Specifically the FDA has come out with... For medical devices, if you're putting something out in the market, you're going to have to pass through some very strict regulatory requirements that the FDA is approving. So it really depends. I would say from... It varies. I don't want to throw any vertical under the bus, but I think we can all understand some are a little more behind than others.

>> All right. I won't put you on the spot. So basically saying there's a wide spectrum of readiness that actually varies. Is it vary by industry or does it more vary by company?

Lindsey Havens, M.A.

>> I would say it's both. I mean, there are some front-runners. We typically do business with the modern more front-runner. I want to use security as a differentiating factor. They're usually coming to us because they're ahead of the game. Generally, that's who we're looking for to do business with us. But as a whole, look, we really need to level with ourselves. This is truly a matter of national security. We need to take this very seriously. And I think it's going to become very commonplace that just like today, we go to the store and there's a label with every single ingredient on whatever we're purchasing. That's the future state. We need to understand exactly what's in our device, how secure is their device, open policy. They're doing everything that they can to help make sure that policies are in place to help me and you and consumers and critical infrastructure to, we need to catch up. Look, we need to take this very seriously.

>> Yeah, open policy and doing some amazing work. Are there industries that are... There are, obviously they're doing a better job. I hope defense is one that is pretty in tune. I hope our airlines are on top of things. So what attracted you as a woman in tech to cyber security? This is not an industry, a sector that is... I mean, it seems to me it's probably less women in cyber than there are in other sectors of IT. And it's probably, IT is less than 20% of our industry is women. I think it's even lower than that in cyber. Maybe that's true. Maybe it's not. What attracted you to this superhero world?

Lindsey Havens, M.A.

>> Yeah, a few things. So cybersecurity has always been intriguing to me. One, I find it very interesting. Two, I actually have a master's degree in forensic psychology, so I've always been drawn to the dark side a little bit. So understanding why do cyber criminals do what they do and how can we protect ourselves? I take it really personal when it comes to an attack on me or somebody in my life or the nation that I live within. I take it really personally. So I want to work in an industry and for a company that's just doing the right thing and that's what we're doing. I mean, I want to make a difference in this world, and I feel like I'm working at a company and within an industry that's making an impact, doing the right thing.

>> Did you ever want to be like an FBI profiler? Was that-

Lindsey Havens, M.A.

>> That's funny that you say that. Actually I was having a good conversation with, I will not name the government agency here, but yes, my intent I was going to be a profiler, or I was going to be a trial consultant. So the profiler was definitely the top of my list. I wanted to work at an agency.

>> How about superhero? When you were a kid, did you ever have a superhero that you modeled yourself after?

Lindsey Havens, M.A.

>> No, I didn't think not. But Superwoman is always there.

>> But I mean, a lot of cyber pros, they said they gravitated towards superheroes. They're going to help to your point, protect the world. And that's what you guys are doing.

Lindsey Havens, M.A.

>> We're trying. One day at a time.

>> So what's next for you guys? What's happening here at RSA and then what's next?

Lindsey Havens, M.A.

>> Yeah. I mean, it's super exciting to be here at RSA. I love just the collaboration with partners and with people like Open Policy, they're doing awesome things. I'm personally super excited about AI and what it's going to do for us as an industry in cyber security. We need to embrace it. We don't need to be afraid of it, and we just need to take to the next level. This is our opportunity to get ahead and not be just play a whack-a-mole and just waiting and being reactionary. This is our opportunity and we need to embrace it. We need to leverage. I was in the innovation that started the whole sandbox this morning, and there were several companies that are doing a lot around AI data security. So I think if we all work together, we're going to be able to get ahead of the game and really leverage AI to our advantage.

>> Well, the adversaries are taking advantage of AI, so we are better.

Lindsey Havens, M.A.

>> Exactly. Which is why we have to. Exactly.

>> The good guys and girl are better. Lindsey, thanks so much for coming to theCUBE. It was fantastic seeing you.

Lindsey Havens, M.A.

>> Yeah. Lovely. Thank you so much.

>> Appreciate it. All right. Keep it right there. More action from theCUBE after dark. This is Dave Vellante voices hanging on. Keep right there, be right back.