The ART of Security Summit: Strategic Risk Management for CISOs | Colby DeRodeff, CEO

Clips
More from The ART of Security Summit: Strategic Risk Management for CISOs

Colby DeRodeff

CEO & Co-Founder

Abstract Security

play_circle_outline Abstract Security helps visualize data in security architecture to reduce risk exponentially.

play_circle_outline The volume of security data has grown exponentially over the years.

play_circle_outline Moving detection to the left reduces mean time to respond and detect threats.

play_circle_outline Benchmarking against industry peers can help frame security as a competitive advantage.

Info

Colby DeRodeff, CEO

Colby DeRodeff

CEO & Co-Founder Abstract Security

search

>> Welcome back to the Art of Security Summit. I'm Jackie McGuire, Practice Leading Principal Analyst at Security for theCUBE and SiliconANGLE. We are here today to talk about reducing risk, and so this is going to be the part in the process where you've already avoided everything you can, and now it's time to reduce anything that does manage to get through your first line of defense. I'm really excited because today I have with me Colby DeRodeff, who is Co-Founder and CEO of Abstract Security. And Abstract does a lot to help with visualizing the data flowing through your security architecture and reducing that risk. So Colby, welcome. Thank you for joining me today.

>> Jackie, thanks. Really glad to be here. Good to see you again.

>> Likewise. All right, so we're here to talk about reducing risk. And I think for me, one of the things that was interesting for me when I got into security was really, the volume of data that's flying around. And then understanding that several years ago when I got into security and then looking at now that we're generating exponents of data, whether through AI or just regular monitoring and things like that, the sheer amount of data that security teams have to collect and process and look at is just a little bit overwhelming. So, I'm hoping that you can give people kind of a brief overview of what Abstract does, and I guess why you founded the company based on your previous experience and the challenges that you were looking to address there.

>> Yeah, absolutely, and I mean, I think you hit the nail on the head. It's funny, when I got started in the whole SIM space back in 2000, 2001 at a company called ArcSight, a large deployment of ArcSight back then was maybe like 50,000 events per second, 70,000 events per second, that was really big. And folks were collecting firewall data and IDS data and things like that. And now that is a tiny, tiny instance. We see customers in the millions of events per second, terabytes and petabytes of data per day. And so, that data has just grown exponentially. And really, the kind of current SIM infrastructure that is out there and has been around for the last decade or more, really isn't scaling from either a cost or data volume perspective. And so when we thought about what to do next in this space, we came up with some very abstract ideas, and hence the name of the company kind of originated from that. But really, what we wanted to focus on was abstracting away all of the complexities of the data itself and really focusing on solving security use cases for the security ops folks and for incident responders and threat hunters. So if you look at our platform, basically we focus on data collection, data pipelines, streaming correlation, streaming threat detection if you will, and then security operations.

>> Awesome. Yeah, when I discovered when I started working with SIMs, so my first data science job was building a SIM. And then when I moved over to working with customers who were actually running SIMs, is that a lot of them, there was really no policy that said this is what you should do, this is the logs that go in which tools. It was basically just like, we collect all this data and either we would just shove it raw into our SIM and hope for the best or we don't collect it, because we can't afford to put it in our SIM. And those were kind of the only two ways that people were looking at managing their security data. Not really, what are the outcomes we're looking to achieve and what data do we need to be able to achieve those outcomes? It's just, can we afford to put this log source into our SIM or can we not?

>> Right. Well, then ultimately folks make some pretty bad decisions because the question of, can I afford to put this data in the SIM? It's really like in some cases, can I afford not to?

>> Exactly.

>> Right? But you're dealing with license constraints and you're dealing with this... There's always the needle in the haystack analogy, right? Well, all we're always doing is making the haystack bigger and bigger and bigger. The haystack's never getting smaller, right? And we really need to focus on the data that matters for threat detection, because I'll tell you what, most of it doesn't, right? So, why make the haystack bigger?

>> Yeah, and I think for most... My first job as a data scientist, I was like, oh, I'm going to write all these really crazy algorithms. And no, it was regex, it was literally just trying to... And regex, sorry for those who get annoyed about the soft G, But yeah, it was literally just syslog, sysmon, and me and regex, and just trying to get it into a JSON dictionary just to start doing something with it. The sheer volume is overwhelming, and I've seen companies do crazy things to try to manage that volume. I think it's a pretty widely known fact in the security community that if you're going to try to breach an enterprise, the last several days of the month are a really good time to do it because they start turning logs off if they're hitting their licensing cap on their SIM. Yeah, so it's kind of crazy. So in the context of reducing risk, all right, let's say I've got all my identity policies dialed in, my teams are all fully knowledgeable, but something happens, right? Somebody gets in, they start moving laterally. So usually when I think of where we're talking about reducing risk, the things that really play into that are, what data do you have access to? How quickly can you process it? And how quickly can you become aware that something's going on? So, can you talk about when you're adding that layer of abstraction, you're kind of collecting all of that security data. How do you think about that, in terms of incident response and what types of data and data sources you're actually pulling into those logs to make it possible for security teams to respond more quickly to incidents?

>> Yeah, yeah, good question. So I mean, I think I always go with the kind of approach of, assume compromise. Right? You are compromised in one way or another, right? It may not be a full breach, but there's likely some access, there's likely things going on that you're not aware of. The other thing to always keep in mind is the kind of average adversary breakout time. Right? And so CrowdStrike talks about this in their yearly reports and we see the average times going down, so getting quicker to break out. And so that means what you need to do there... And there was always a quote that I liked that was this little cartoon that was on my grandma's fridge and it said, "Don't walk across a river just because the average depth is three feet." Right? And so if the average adversary breakout time is 62 minutes or whatever it is, something around there, that means there are a lot of breakouts that happen much quicker, right? And so anything you can do to move detection to the left, shift detection to the left so that you are reducing your mean time to response, your mean time to detect. Because ultimately what that does is if you detect it quicker, you can respond to it quicker, you can remediate quicker, and you can reduce risk. Right? The longer the dwell time in the environment, the more likely it is that they're going to find the data that they're looking for and they are going to exfiltrate it.

>> Absolutely, and I would guess, so what I found when I started working in data processing and data pipelines for security, what I found was that by doing the hard work up front and really kind of doing the work it takes to effectively integrate all of your data together, what you find is that on the other side, when you're trying to respond as quickly to an incident as possible, if you haven't already done that work to sort through the high value data versus the low value data, and then adding the enrichment that you need to the high value data, it also takes exponentially longer to respond. And realistically, most of these companies, if you're having trouble correctly setting up your SIM, you probably don't have a great incident response team. So you're going to be paying somebody to respond to that incident. And the dollar values that I've seen, you go from, oh, we don't have an extra 10K a month to put these logs in our SIM, to, oh, it's going to cost an extra $10 million for this incident response team because our logging was so trash. So, you've been in security for a long time. What do you think is the best way to get, and I know I didn't prep you for this question, so. What do you think is the best way to help your executive teams really understand how valuable investing in reducing risk in the enterprise is? Because I think a lot of times it's like, oh, well we might get breached and if we get breached, the cost might be this. So are there techniques that you've found that are more effective and persuasive when it comes to talking about risk with your executive team and achieving better results proactively addressing risk before it's an issue?

>> Yeah, I mean, I think it really starts with having clear communication at the board level, making sure that the board is bought into security in general as a program, which these days it's probably pretty uncommon if they're not. 15 years ago security was kind of a, yeah, we should probably have some of that, but not really a requirement. But I think the best thing to do is use examples of similar organizations and the things that we are aware of that have occurred with similar organizations. And then really kind of do a comparison of what the sort of industry best looks like and where we measure up to that, and what kinds of things can be done to kind of enhance our score, if you will, against like-peers. And so I think one of the best things that I've seen is being part of organizations like the ISACs that are really specific to your industry. So if your financial services, you're FS-ISAC, if you're healthcare, H-ISAC. And these ISACs do phenomenal work, right? I mean, they really bring the community together so that organizations can learn from each other and they can share these stories in a private, secure kind of manner. And obviously, people are sharing all the details, but they talk about different breaches that they see in attack methods and things like that and strategies for presenting to boards. And I think that having those relationships, having CISO to CISO relationships at other like-organizations where you can share best practices and things to really kind of get everybody thinking about this problem in the same way.

>> That's a fantastic tip. I think benchmarking, if you are benchmarking against your competitors from a revenue perspective, I think it's a really good idea to also benchmark against, not competitors necessarily, but peers from a security perspective. Because I think if you're a smart security leader, you could actually frame a proactive security posture as being a competitive advantage. All of our competitors at some point are going to get breached, and by investing this amount now, we avoid the revenue disruption that the inevitable breach causes down the road. So, why wouldn't we take advantage of this competitive advantage if we can?

>> Absolutely, 100%. And that's why I think while the companies may be competitive in the market when it comes to security, there is a level of collaboration that is necessary and welcomed, I think, by these organizations. And I think a lot of that is due to these kind of collaborative organizations like the ISACs that kind of bring everybody together as a community.

>> Absolutely, and I think that's also one of the places where I find that security teams struggle and ISAC is a great place to refer them is, no two enterprises in the world are the same. It's one of the really strange things about working in security, is if you work in auto insurance, there's only so many different ways vehicles are built. And yes, every now and then somebody kind of redneck engineers something, but for the most part, and it's just not the case. You've got these hyper complex, it's almost as if every airplane in the world was built differently and we're trying to come up with rules to regulate all of them. So, that's fantastic. Colby, thank you so much for the insight there. Actually, that's a new thing that I can write about now, is the competitive advantage of a security program-

>> Absolutely....

>> As a revenue defense.

>> I'm glad I could help, Jackie. I'm glad I could help.

>> Yeah. Awesome. Now I want to talk about something even more fun. So we have RSA coming up and I know you guys have a handful of things going on. So I remember that you said that you're going to be at Southside Spirit House on Tuesday, and I think you said you're there all afternoon. We're going to have to drag you out?

>> Yeah, the team will be there. I will be in and out. I'm also triple booked with meetings during that time, but I'm definitely going to be there for a bit. And we're also partnering with Sentinel One and doing a tequila tasting at the SPUR building on Mission, Tuesday, 5:00 to 7:00 or something like that, so.

>> Awesome.

>> Other than that, it's like jam packed with meetings and triple bookings, trying to sort out calendars.

>> Girl, name. Yeah, I know. I usually get at least one or two really good charlie horses in my calves during RSA, just because I think it's literally a mile to walk from one end of Moscone to the other. So, it's always a... The one year that I had torn my ACL-

>> I always like to ask people, what's your best advice for people heading into RSA? That's always a good question.

>> Yeah, so my advice is to go in with a strategic plan. So that's actually the whole reason that I put this summit together, is that I felt the first couple years I went to RSA, I'm like, I'm just wandering around Moscone hoping I bump into vendors who can explain what they do and I understand it. Whereas I think the years that I went in with a, here's where the industry's at right now, here's the reality security teams are dealing with, and here are the vendors who are actually tackling those problems. So the abstract problem, the problem you're tackling is this kind of, I have this insane amount of data, none of it has the same value, and its value is dynamic and changes over time. So, rather than wandering around the show floor collecting, not that we don't all love stress balls and t-shirts, but actually figuring out, okay, these are the two or three vendors who are doing really interesting things in this space and creating a strategic plan to meet with them. I think you'll get a lot more out of RSA, and if your employer is footing the bill and you can come back and talk about some really strategic interactions you had, it's a lot more likely your employer will foot the bill next year.

>> There you go, there you go. For sure, for sure.

>> All right. Well Colby, I will be seeing you in just a few days at RSA. For Jackie McGuire and theCUBE and SiliconANGLE, we will be back with more information about reducing and transferring risk.

Colby DeRodeff, CEO

search

>> Welcome back to the Art of Security Summit. I'm Jackie McGuire, Practice Leading Principal Analyst at Security for theCUBE and SiliconANGLE. We are here today to talk about reducing risk, and so this is going to be the part in the process where you've already avoided everything you can, and now it's time to reduce anything that does manage to get through your first line of defense. I'm really excited because today I have with me Colby DeRodeff, who is Co-Founder and CEO of Abstract Security. And Abstract does a lot to help with visualizing the data flowing through your security architecture and reducing that risk. So Colby, welcome. Thank you for joining me today.

>> Jackie, thanks. Really glad to be here. Good to see you again.

>> Likewise. All right, so we're here to talk about reducing risk. And I think for me, one of the things that was interesting for me when I got into security was really, the volume of data that's flying around. And then understanding that several years ago when I got into security and then looking at now that we're generating exponents of data, whether through AI or just regular monitoring and things like that, the sheer amount of data that security teams have to collect and process and look at is just a little bit overwhelming. So, I'm hoping that you can give people kind of a brief overview of what Abstract does, and I guess why you founded the company based on your previous experience and the challenges that you were looking to address there.

>> Yeah, absolutely, and I mean, I think you hit the nail on the head. It's funny, when I got started in the whole SIM space back in 2000, 2001 at a company called ArcSight, a large deployment of ArcSight back then was maybe like 50,000 events per second, 70,000 events per second, that was really big. And folks were collecting firewall data and IDS data and things like that. And now that is a tiny, tiny instance. We see customers in the millions of events per second, terabytes and petabytes of data per day. And so, that data has just grown exponentially. And really, the kind of current SIM infrastructure that is out there and has been around for the last decade or more, really isn't scaling from either a cost or data volume perspective. And so when we thought about what to do next in this space, we came up with some very abstract ideas, and hence the name of the company kind of originated from that. But really, what we wanted to focus on was abstracting away all of the complexities of the data itself and really focusing on solving security use cases for the security ops folks and for incident responders and threat hunters. So if you look at our platform, basically we focus on data collection, data pipelines, streaming correlation, streaming threat detection if you will, and then security operations.

>> Awesome. Yeah, when I discovered when I started working with SIMs, so my first data science job was building a SIM. And then when I moved over to working with customers who were actually running SIMs, is that a lot of them, there was really no policy that said this is what you should do, this is the logs that go in which tools. It was basically just like, we collect all this data and either we would just shove it raw into our SIM and hope for the best or we don't collect it, because we can't afford to put it in our SIM. And those were kind of the only two ways that people were looking at managing their security data. Not really, what are the outcomes we're looking to achieve and what data do we need to be able to achieve those outcomes? It's just, can we afford to put this log source into our SIM or can we not?

>> Right. Well, then ultimately folks make some pretty bad decisions because the question of, can I afford to put this data in the SIM? It's really like in some cases, can I afford not to?

>> Exactly.

>> Right? But you're dealing with license constraints and you're dealing with this... There's always the needle in the haystack analogy, right? Well, all we're always doing is making the haystack bigger and bigger and bigger. The haystack's never getting smaller, right? And we really need to focus on the data that matters for threat detection, because I'll tell you what, most of it doesn't, right? So, why make the haystack bigger?

>> Yeah, and I think for most... My first job as a data scientist, I was like, oh, I'm going to write all these really crazy algorithms. And no, it was regex, it was literally just trying to... And regex, sorry for those who get annoyed about the soft G, But yeah, it was literally just syslog, sysmon, and me and regex, and just trying to get it into a JSON dictionary just to start doing something with it. The sheer volume is overwhelming, and I've seen companies do crazy things to try to manage that volume. I think it's a pretty widely known fact in the security community that if you're going to try to breach an enterprise, the last several days of the month are a really good time to do it because they start turning logs off if they're hitting their licensing cap on their SIM. Yeah, so it's kind of crazy. So in the context of reducing risk, all right, let's say I've got all my identity policies dialed in, my teams are all fully knowledgeable, but something happens, right? Somebody gets in, they start moving laterally. So usually when I think of where we're talking about reducing risk, the things that really play into that are, what data do you have access to? How quickly can you process it? And how quickly can you become aware that something's going on? So, can you talk about when you're adding that layer of abstraction, you're kind of collecting all of that security data. How do you think about that, in terms of incident response and what types of data and data sources you're actually pulling into those logs to make it possible for security teams to respond more quickly to incidents?

>> Yeah, yeah, good question. So I mean, I think I always go with the kind of approach of, assume compromise. Right? You are compromised in one way or another, right? It may not be a full breach, but there's likely some access, there's likely things going on that you're not aware of. The other thing to always keep in mind is the kind of average adversary breakout time. Right? And so CrowdStrike talks about this in their yearly reports and we see the average times going down, so getting quicker to break out. And so that means what you need to do there... And there was always a quote that I liked that was this little cartoon that was on my grandma's fridge and it said, "Don't walk across a river just because the average depth is three feet." Right? And so if the average adversary breakout time is 62 minutes or whatever it is, something around there, that means there are a lot of breakouts that happen much quicker, right? And so anything you can do to move detection to the left, shift detection to the left so that you are reducing your mean time to response, your mean time to detect. Because ultimately what that does is if you detect it quicker, you can respond to it quicker, you can remediate quicker, and you can reduce risk. Right? The longer the dwell time in the environment, the more likely it is that they're going to find the data that they're looking for and they are going to exfiltrate it.

>> Absolutely, and I would guess, so what I found when I started working in data processing and data pipelines for security, what I found was that by doing the hard work up front and really kind of doing the work it takes to effectively integrate all of your data together, what you find is that on the other side, when you're trying to respond as quickly to an incident as possible, if you haven't already done that work to sort through the high value data versus the low value data, and then adding the enrichment that you need to the high value data, it also takes exponentially longer to respond. And realistically, most of these companies, if you're having trouble correctly setting up your SIM, you probably don't have a great incident response team. So you're going to be paying somebody to respond to that incident. And the dollar values that I've seen, you go from, oh, we don't have an extra 10K a month to put these logs in our SIM, to, oh, it's going to cost an extra $10 million for this incident response team because our logging was so trash. So, you've been in security for a long time. What do you think is the best way to get, and I know I didn't prep you for this question, so. What do you think is the best way to help your executive teams really understand how valuable investing in reducing risk in the enterprise is? Because I think a lot of times it's like, oh, well we might get breached and if we get breached, the cost might be this. So are there techniques that you've found that are more effective and persuasive when it comes to talking about risk with your executive team and achieving better results proactively addressing risk before it's an issue?

>> Yeah, I mean, I think it really starts with having clear communication at the board level, making sure that the board is bought into security in general as a program, which these days it's probably pretty uncommon if they're not. 15 years ago security was kind of a, yeah, we should probably have some of that, but not really a requirement. But I think the best thing to do is use examples of similar organizations and the things that we are aware of that have occurred with similar organizations. And then really kind of do a comparison of what the sort of industry best looks like and where we measure up to that, and what kinds of things can be done to kind of enhance our score, if you will, against like-peers. And so I think one of the best things that I've seen is being part of organizations like the ISACs that are really specific to your industry. So if your financial services, you're FS-ISAC, if you're healthcare, H-ISAC. And these ISACs do phenomenal work, right? I mean, they really bring the community together so that organizations can learn from each other and they can share these stories in a private, secure kind of manner. And obviously, people are sharing all the details, but they talk about different breaches that they see in attack methods and things like that and strategies for presenting to boards. And I think that having those relationships, having CISO to CISO relationships at other like-organizations where you can share best practices and things to really kind of get everybody thinking about this problem in the same way.

>> That's a fantastic tip. I think benchmarking, if you are benchmarking against your competitors from a revenue perspective, I think it's a really good idea to also benchmark against, not competitors necessarily, but peers from a security perspective. Because I think if you're a smart security leader, you could actually frame a proactive security posture as being a competitive advantage. All of our competitors at some point are going to get breached, and by investing this amount now, we avoid the revenue disruption that the inevitable breach causes down the road. So, why wouldn't we take advantage of this competitive advantage if we can?

>> Absolutely, 100%. And that's why I think while the companies may be competitive in the market when it comes to security, there is a level of collaboration that is necessary and welcomed, I think, by these organizations. And I think a lot of that is due to these kind of collaborative organizations like the ISACs that kind of bring everybody together as a community.

>> Absolutely, and I think that's also one of the places where I find that security teams struggle and ISAC is a great place to refer them is, no two enterprises in the world are the same. It's one of the really strange things about working in security, is if you work in auto insurance, there's only so many different ways vehicles are built. And yes, every now and then somebody kind of redneck engineers something, but for the most part, and it's just not the case. You've got these hyper complex, it's almost as if every airplane in the world was built differently and we're trying to come up with rules to regulate all of them. So, that's fantastic. Colby, thank you so much for the insight there. Actually, that's a new thing that I can write about now, is the competitive advantage of a security program-

>> Absolutely....

>> As a revenue defense.

>> I'm glad I could help, Jackie. I'm glad I could help.

>> Yeah. Awesome. Now I want to talk about something even more fun. So we have RSA coming up and I know you guys have a handful of things going on. So I remember that you said that you're going to be at Southside Spirit House on Tuesday, and I think you said you're there all afternoon. We're going to have to drag you out?

>> Yeah, the team will be there. I will be in and out. I'm also triple booked with meetings during that time, but I'm definitely going to be there for a bit. And we're also partnering with Sentinel One and doing a tequila tasting at the SPUR building on Mission, Tuesday, 5:00 to 7:00 or something like that, so.

>> Awesome.

>> Other than that, it's like jam packed with meetings and triple bookings, trying to sort out calendars.

>> Girl, name. Yeah, I know. I usually get at least one or two really good charlie horses in my calves during RSA, just because I think it's literally a mile to walk from one end of Moscone to the other. So, it's always a... The one year that I had torn my ACL-

>> I always like to ask people, what's your best advice for people heading into RSA? That's always a good question.

>> Yeah, so my advice is to go in with a strategic plan. So that's actually the whole reason that I put this summit together, is that I felt the first couple years I went to RSA, I'm like, I'm just wandering around Moscone hoping I bump into vendors who can explain what they do and I understand it. Whereas I think the years that I went in with a, here's where the industry's at right now, here's the reality security teams are dealing with, and here are the vendors who are actually tackling those problems. So the abstract problem, the problem you're tackling is this kind of, I have this insane amount of data, none of it has the same value, and its value is dynamic and changes over time. So, rather than wandering around the show floor collecting, not that we don't all love stress balls and t-shirts, but actually figuring out, okay, these are the two or three vendors who are doing really interesting things in this space and creating a strategic plan to meet with them. I think you'll get a lot more out of RSA, and if your employer is footing the bill and you can come back and talk about some really strategic interactions you had, it's a lot more likely your employer will foot the bill next year.

>> There you go, there you go. For sure, for sure.

>> All right. Well Colby, I will be seeing you in just a few days at RSA. For Jackie McGuire and theCUBE and SiliconANGLE, we will be back with more information about reducing and transferring risk.