Cyber Resiliency Summit Encore Presentation | Grant Bourzikas, Cloudflare

Clips
News
More from Cyber Resiliency Summit Encore Presentation

Grant Bourzikas

SVP & CSO

Cloudflare

Inside Cloudflare’s security strategy: Evolving security in a shifting threat landscape

A rigid focus on known defense techniques proves ineffective as attackers evolve novel attack tools, practices and vectors aimed squarely at the enterprise. As such, cybersecurity isn’t just about defense; it’s about constant evolution and transparency.Cloudflare Inc. has adopted the radical transparency mindset as it secures a global network that serves 22% of internet traffic while fostering collaboration and radical transparency in a competitive, ever-changing industry, according to Grant Bourzikas (pictured), chief security officer of Cloudflare Inc.Cloudflare’s Grant Bourzikas outlines the company’s evolving security approach as threats rise

play_circle_outline Responsibilities of a chief security officer

play_circle_outline Protecting Distributed Networks: Cloudflare's Approach to Nation State Attacks and Zero Day Vulnerabilities

play_circle_outline Protecting against threats using Cloudflare's infrastructure

play_circle_outline Securing the Supply Chain: Lessons Learned for Transparency in Security Incidents

Info
Transcript

Grant Bourzikas, Cloudflare

Grant Bourzikas

SVP & CSO Cloudflare

Grant Bourzikas, the senior vice president and chief security officer at Cloudflare, discusses his role in protecting Cloudflare's infrastructure and working with product teams to develop new features. The concept of the "super cloud" is introduced, emphasizing the distributed nature of Cloudflare's network and the challenges of securing it. Bourzikas shares insights on dealing with nation-state attackers, building immutable infrastructure, and managing supply chain security. He also highlights Cloudflare's approach of radical transparency in handling inciden... Read more

explore Keep Exploring

What are the main responsibilities of the speaker in their role at Cloudflare? add

What makes a super cloud network unique and how does it pose challenges in terms of security and defense? add

What are some of the behaviors and tactics attackers are currently using on the platform in question? add

What is the approach to analyzing and learning from outages in critical infrastructure systems? add

bolt Powered by CUBE AI

Grant Bourzikas, Cloudflare

search

>> Hi, everybody. Welcome back to day one of NYSE + theCUBE Wired. We're going wall-to-wall coverage with our CXO series. This is Media Week, and we're super excited to have Grant Bourzikas here. He's the senior vice president and chief security officer at Cloudflare. Welcome to the studio here. It's great to see you. Thanks so much for coming in.

Grant Bourzikas

>> Thank you. This place is awesome.

>> Yeah, thank you. Well, okay, what's the difference between a CISO and a CSO? Help me understand that.

Grant Bourzikas

>> It's a good one. So CISO is C-S-O, chief security officer, which usually would imply there would be physical security in it. Chief information security officer would be just information, not including physical, but I think in a lot of ways it's people flipping words around and they kind of mean the same thing.

>> But they're coming together.

Grant Bourzikas

>> Yes. Yes.

>> Okay. So your role as the chief security officer, of course we live in an industry of acronyms, which is part of the reason why I ask, but the real reason is I want to understand how you spend your time. Is it mostly hardening the Cloudflare infrastructure? Are your sales guys like dragging you around the country trying to get you to help them close business? How do you spend your time?

Grant Bourzikas

>> Yeah, so I always think, what did Matthew hire me to do? Why am I working at Cloudflare? Super easy. So you're right. One is to protect Cloudflare. So I protect all the infrastructure for Cloudflare. So the edge network, the core networks, the 22% of the internet that comes through us, that's one. Two, then working with the product teams, trying to figure out what things we should be developing. We also have customer zero, which we run all of our products, which really lines up nicely with a third part, which is sitting down with customers, talking about how our products work, talking about security strategy, anything in those three lines. The one thing that a customer do also want to talk with me about is I have the Cloudforce One threat intelligence team underneath me. So all of the threat intelligence that Cloudflare has comes through my organization as well.

>> So we use the term super cloud and Matthew uses the term super cloud, and we love the term not only because it gets a lot of attention and a lot of people don't like it, but that actually creates conversation. So we love that as media, but more importantly, it connotes a distributed cloud, a distributed network. It's not just a bunch of remote services up in some single data center in the cloud or even multiple data centers. It's everywhere. And so how do you think about securing such a distributed network?

Grant Bourzikas

>> Yeah, it's a good question. I like super cloud, because I think it's a cool term. One of the things I always think is do people understand what we do or how the network works? When we say super cloud, why are we a super cloud? Why are we a super network? Some people might say we're the largest global ISP in the world. Well, we operate in 320 cities, 120 countries, 22% of the internet comes through us, and every piece of software we write is on every server in every data center. And so it's like a true platform. So when we think about the super cloud and how to protect it, what makes it a little easy in some ways, but super difficult is everything is running that's identical in all the data centers. And so that's super unique. So all of our web applications, firewalls run here in New York, they run in Chicago, they run in Sydney. And it makes this a very interesting way to do it. To defend that is there's great challenge in this because everybody wants to get into the network. We have so much interesting traffic, huge customers that rely on us every day to run their business, comes through our network. And I think when you think about that, it's this amazing job, this amazing technology. We use our own technology, that's part of customer zero. We use our own technology to defend ourself, which also helps make our products better, which is really cool as well.

>> So I want to make sure I understand it. So you're saying that your network is, the components are homogeneous, it's identical across the network, which presumably makes it easier to protect. Not easy, but easier than if you had a mishmash. Is that fair?

Grant Bourzikas

>> Yep, it does. So we know what runs on the servers. We know how the server is supposed to operate. We understand what that looks like. So while the attackers are super sophisticated, we also have a high level of sophistication with our own organization to make sure we're protected.

>> So when you think about things like nation states attacking you with highly capable adversaries, very well-funded, how are you evolving the way that you're dealing with zero day vulnerabilities and reducing risk?

Grant Bourzikas

>> Yeah, it's a good thing. Using our products is one of the things. I think the other thing that we think that is very interesting from a security strategy is how do we build immutable infrastructure? This is something that I think about when you think about 20% of the internet coming through us, that's a lot of risk. That's a lot. Huge target. Name the nation state, they want to get in. Name the attacker, they want to get a name. The APT, they want to get in. And so when we think about this is how do we build, when I say immutable infrastructure, infrastructure that only thing that could change is through our pipeline and so that we can watch all the logs, we can monitor, we can drive it. That's what we're building. We're very close to where things are today. Immense technology footprint. The engineering team has started to build this not a year ago or two years ago, but this is something that was built from Matthew and team 10, 15 years ago when the company was . If you're going to have this amount of traffic and responsibility, you have to protect it like it is critical infrastructure. And so we even think ourselves as we're mission-critical infrastructure for the internet. And we have to think about that that way.

>> It is critical infrastructure. Now you've got the network, but you're constantly, Matthew and team, are adding new capabilities, database. You guys have funny names like R2 and D2?

Grant Bourzikas

>> R2 and D1.

>> And D1. Right, D1 is your first database, right? So who named that? I love it. But as you add capabilities, storage, database, compute, how does that fit into that homogeneous approach? Doesn't it create seams? How do you protect those seams? How does that make your job harder?

Grant Bourzikas

>> So that's a great question. And I think how this workers platform, this development platform with D1, our structured database, R2 our file storage became was we needed a development platform to be able to run ourself. And so you want to have this very simple layer of application residing on a server, but it's actually very complicated when you try to apply it and you have thousands of developers working on it. And so we built a workers platform and as part of workers as you say is it sits on top of the entire cloud layer component. So workers and D1 and R2 all sit on the same server that our web application firewall sits on, or zero trust applications or our API protection and our API shield all sit on that same thing. And so when we think about it from protecting, we think about it in a process standpoint of how do we make sure that our infrastructure is solid, how do we make sure our product security is solid and then make sure that we do everything we can to protect the organization.

>> So your cloud first, basically ubiquitous. So bad guys can use Cloudflare, they can try to do things like live off the land. You mentioned threat intelligence before. So how do you balance your need to protect and what are you seeing with threat intelligence in terms of bad guys actually trying to use your own infrastructure against you and your customers?

Grant Bourzikas

>> So bad guys are very creative-

Grant Bourzikas

>> ....

Grant Bourzikas

>> and they do use our platform and we've gotten really good, we spent a lot of time on this just lately on observing behaviors of attackers on our platform, listening to our customers, building automation to shut down phishing sites, those types of things. What it's creating is more ingenuity out of the attackers. So one of the things we're seeing just of recent is they may use our infrastructure for hosting a webpage, but they're using another file storage to store the file. They're coming from one of the other hyperscalers to log into our systems. They're masking their entire infrastructure through three or four providers. And that's something that I think is super interesting because before I'll just stand it up on Cloudflare or I'll just stand it up on AWS or Google. I'll stand up on Digitalocean. But what they're doing is it makes one person like us easy to shut it down. And so now they're trying to distribute it. So now they're relying on our networks, our relationship with a GitLab or AWS or a Digitalocean or somebody, Box.com that they're hosting this mass infrastructure and they're building complicated infrastructure so that it's harder to shut them down.

>> Do you or how do you get involved in supply chain and securing the supply chain? That's a big topic these days. You think you're going to download a patch that's necessary to protect you, and it turns out to be some kind of malicious code that self-forms and does all kinds of terrible things. Can you play a role in helping with that?

Grant Bourzikas

>> Yeah, so I think that the first thing is we always think about our supply chain and how do we do it. We got to make sure that our supply chain's protected, things like digitally signing our BIOS and making sure our BIOS is secure. Making sure that what we run in our environment is secure. I think that's one other component. The other thing we do, and we do a lot of services with third parties that may subscribe to an intelligence service that we can actually help say, what is that vendor doing? Or how are they connecting? Has a vendor been compromised and we'll help you in investigation? And so I think it's an interesting unique component because supply chain is probably the toughest thing to deal with. And I always think about it as the skill shortage of cybersecurity people is immense. And it's not the shortage of people, it's actually the skills of the people. And so every time we do business or transaction with somebody else, do they have the same security posture as I do? And that's something I always think about. And so we get hired a lot or we will talk to people about how we think about supply chain and drive it to helping them get some intelligence that will make them more successful.

>> So because you are critical infrastructure, if you have an outage and you're pretty much ubiquitous, it's widespread and it scales, how do you then go back, look at the root cause, capture lessons learned? I mean it used to be in the security industry, it used to be, oh, you failed, you're fired. Well, that's not the case anymore. I mean, it's impossible to protect everything always. So how do you apply, figure out the root cause and apply those learnings and continuously iterate?

Grant Bourzikas

>> Yep. It's a good question. And back late Q4 last year we had an outage and we talked publicly about it. So one of the things I love about Cloudflare is we talk about everything. We had a security incident, we wrote an 11, 12 page blog detailing everything out that happened. And same thing on the Code Orange, was what was the problem and why did it actually happen? And we didn't have enough capacity in our backup data center to take it on. Well, what did we do? Why did we think about that? What's interesting about this radical transparency that we have, it's kind of awkward. I spent most of my career in banks, and so I would never say, "Hey, we had a security incident. They were in our environment. They did XYZ. This is what they searched for, this is how they did it." That's kind of awkward because we always want to hide those things. And what I thought was very interesting on Code Orange, which was the reliability in Code Red, which was the security was, we were just radically transparent with our customers and they appreciate it. And I always think every organization that I've ever been in has had a issue, had an outage, and has had a security incident that we've not really told people the truth. And I think the thing that I'm most proud here is we do tell the truth regardless of what it is. That's just basic in our DNA. And it actually helps because if I'm telling you the truth about everything and I'm telling you everything, there's nothing to hide. And I was thinking, and I did this when I was in Australia, I did a keynote and said, "Has anybody had an incident?" Everybody raises their hands.

>> 100%, right.

Grant Bourzikas

>> "Has anybody disclosed it?" I'm the only one that had my hand up. As we go through this, the incidents and things is we want to be a role model for organizations on lessons learned. Well, why did that happen? How did that fail? I probably talked to 40 CISOs during our Code Red of what did you do? What did they see? How did you react? We even had an organization that had a large scale breach reach out to me and say, "Can you help us? We want to do what you did." And I think that's kudos to how we manage our environment. Is if there's an issue, we're going to first one to tell you and we're going to tell you everything that there is, because if we don't tell you, then you're going to have to question what we are. Now you know we're telling you.

>> Well, we've seen some of the executive orders come out. I mean, some of that I feel, Grant, is like finger waving, "Come on, do a better job." Some of it I think is legitimate. I think the industry needs to collaborate better and do a better job. What's your feeling on this topic of disclosures? Do you feel like it should be law that you disclose these things?

Grant Bourzikas

>> Yeah, I think it's one that I think it always gets the lawyers involved of can I disclose... If I'm at a bank, can I disclose something? Well, they're already disclosing it to regulators, to the board. And so I think we're missing a tremendous opportunity to share the lessons learned, right? We shared all of our IOCs, we've shared all of the challenges we've had to build an Anycast network, to have every piece of software and every server in 320 cities is crazy. We're going to have issues at some point, but we should be transparent. And so I think this is the one thing that we always miss is I had an incident, but I'm going to sweep it under the table and pretend it didn't happen and the next organization gets hit by it and the next organization gets hit by it. And that's something we even see in our threat intelligence that we did an investigation with a very large bank that had this issue. And as we researched it, we found three other Fortune 500 having the same thing. And we said, "You guys have to be able to talk and communicate that it's there now." We didn't disclose who they were, but we shared all of the intelligence we had, because if we're not sharing that, we're never going to win because one organization isn't going to be able to stop an advance with hacker.

>> Well, that's interesting, because you got two sides to that equation. One is you got a highly competitive technology industry that tends not to be great at collaborating. It's getting better. Definitely. And then you've got customers, particularly in particular industry like finance that they don't talk. So do you feel like we've made progress in that regard in terms of collaboration? And sounds like we've got more to go, but what's your advice in terms of, to the industry broadly, as to how we can better collaborate?

Grant Bourzikas

>> Yeah, I think it goes back to this radical transparency. We have to be honest with what occurs. The only way we're going to stop nation state actors is to share intelligence. We see this in the military. If the Army didn't share with the Navy, the Navy didn't share with the Marines, they're going to end up with challenges. That's how the JSOC was created from an operational standpoint of being able to coordinate attacks. And same thing here is we're fighting a game, each one of us individually, and we're not actually learning lessons from it or sharing it. And even vendors like us that can help, we may not know that somebody had an attack because if you had an attack, then we will help defend the rest of the internet. And it's something we do see. Some customers do come to us and say, "Hey, can you stop this? We're seeing a zero day and we'll put it into our WAF rule so you can protect all our customers." But I think we got to be more transparent with what's going on.

>> When you think about things like GDPR and CCPA and states, each state coming up with a different regulation, different nations, it obviously makes things more difficult, how do you deal with that? And can you affect public policy in a way so that we can have more consistent laws, rules, guidelines?

Grant Bourzikas

>> Yeah, I think the hardest thing... That's great, the bell. .

>> I Love it. I Love the bell ring for you.

Grant Bourzikas

>> . Hey, good job, everybody. One of the biggest problems that we face is complexity, and that could be we force technology choices. I worked in an organization when I came in, there were six web application firewalls, six different kinds. That's not going to help. And so now think about the states. And if you're a global organization, you could have Australia rules, Singapore rules, US, France, UK, and how do you actually build a program that's cohesive? You're spending more time trying to comply versus be secure. And I think it's one that if we could get a common set of controls, this is why a lot of people under the executive order have said, adopt NIST and how do you do NIST? But I think we need more general guidance with where we're going to do, because I think it'll be helpful because to comply with this, this, and this, and there may be competing control issues. Well, how do I do this when they want to do that? It's the opposite. And I think those are things that can really cause complexity, which causes breaches.

>> How'd you get into this business? And when you were a kid, did you have a superhero that you've sort of modeled after to protect the world?

Grant Bourzikas

>> I was a baseball guy.

>> Really? Me too.

Grant Bourzikas

>> I went to college on a baseball scholarship.

>> I didn't.

Grant Bourzikas

>> And after I got burned out and long story, I didn't know what I wanted to be. So my mom said I should be an accountant and you should always listen to your mom. So I became an accountant and started my accounting degree. Decided I hated it, but I started taking some programming courses in college and my dad was around computers and we used to play computers when we were little. And so I started coding C++ in college. Because I'm still listening to my mom, got a job with Arthur Anderson as an accountant. Just hated it. And they said, "We're going to start this." They call it computer risk management. And I'm like kind of technology, security, audit before any of this was cool. And I was probably one of the first 50 people in Anderson's practice, and I've done this since the late '90s.

>> Oh, very cool. Were you a catcher?

Grant Bourzikas

>> No first base.

>> First base, me too.

Grant Bourzikas

>> First base .

>> Lefty or righty?

Grant Bourzikas

>> Righty. Right, .

>> Grant, it was such a pleasure having you on.

Grant Bourzikas

>> Pleasure.

>> I appreciate you making some time for us.

Grant Bourzikas

>> Awesome. Thank you very much.

>> Yeah, great. And keep it right there. We got more content. This is wall-to-wall coverage, theCUBE + NYSE Wired, our CXO series at Media Week. Dave Vellante. Keep right there.