Latest / Merryn Talks Money / Security, Bookmarked: Finance (Sponsored Content)

Transcript

Security, Bookmarked: Finance (Sponsored Content) · Merryn Talks Money

• 0:02
  Speaker 1: We can go back to a quote from the Depression
• 0:04
  Speaker 1: era bank robber Willie Sutton. He had this infamous quote
• 0:08
  Speaker 1: that said, like, I rob banks because that's where the
• 0:10
  Speaker 1: money is.
• 0:11
  Speaker 2: Old fashioned bank heights aren't so common today, but modern
• 0:15
  Speaker 2: financial institutions protect more than just money, and finance is
• 0:19
  Speaker 2: consistently in the top three most targeted industries when it
• 0:22
  Speaker 2: comes to cyber attacks.
• 0:23
  Speaker 1: There's accounts, but there's also a lot of strategic information
• 0:27
  Speaker 1: with regards to transactions and the likes, and that's what
• 0:32
  Speaker 1: continues to make financial institutions a target for this.
• 0:37
  Speaker 2: That's JF Lego.
• 0:38
  Speaker 1: I'm w chief Information Security Officer at JP Morgan Chase.
• 0:42
  Speaker 2: As a leader of cybersecurity operations for the bank and
• 0:45
  Speaker 2: its clients, JF thinks constantly about every opportunity that an
• 0:49
  Speaker 2: attacker could exploit, from software bugs to natural disasters.
• 0:53
  Speaker 1: Whether the scenario will be a technology outage, whether it
• 0:57
  Speaker 1: be whether a threat actor could use that as a lure.
• 1:00
  Speaker 1: We've actually seen, you know, like fake donation sites. When
• 1:05
  Speaker 1: there's a natural disaster right where people are looking to
• 1:08
  Speaker 1: donate to earthquake relief for hurricane relief, the.
• 1:13
  Speaker 2: Bad guys are there and by setting up fake disaster
• 1:16
  Speaker 2: relief websites, the bad guys can harvest any credentials that
• 1:19
  Speaker 2: come with those well meaning donations. This is just one
• 1:22
  Speaker 2: scenario and a bigger trend that JF seeing where cyber
• 1:26
  Speaker 2: attackers set traps to compromise team accounts.
• 1:28
  Speaker 1: We're seeing more and more threat actors using you know,
• 1:32
  Speaker 1: search engine optimization to present fake websites. When somebody's doing
• 1:38
  Speaker 1: an online search, the website will come up at the
• 1:42
  Speaker 1: top versus a legitimate when they're looking for and then
• 1:44
  Speaker 1: they get the ability to deliver malicious software. So that's
• 1:48
  Speaker 1: like a really interesting trend that people should think about.
• 1:52
  Speaker 1: You know, we'll use to train people to look for
• 1:55
  Speaker 1: phishing based on like grammar and urgency and things like that.
• 2:00
  Speaker 1: That's changing.
• 2:02
  Speaker 2: Fishing and browser based attacks are evolving to catch us
• 2:05
  Speaker 2: where we spend our money, our attention, and our working hours,
• 2:09
  Speaker 2: and as work itself happens more consistently in web browsers.
• 2:13
  Speaker 2: JF sees the role of a cybersecurity leader evolving too.
• 2:16
  Speaker 1: I've been doing this for like twenty five years now.
• 2:19
  Speaker 1: That overall evolution, and we used to call it computer security.
• 2:22
  Speaker 1: Network security was very infrastructure focused, and then there was
• 2:26
  Speaker 1: an evolution to information security. You know, when I look
• 2:31
  Speaker 1: at the role today, a lot of it and most
• 2:34
  Speaker 1: of it is really how do you secure a business?
• 2:36
  Speaker 1: And I think that's where strong cybersecurity leaders are evolving towards,
• 2:41
  Speaker 1: is like how do you interface with your business? How
• 2:43
  Speaker 1: do you understand the practices? There's an evolution in a
• 2:48
  Speaker 1: variety of technologies that help bad guys sell. You also
• 2:53
  Speaker 1: need to adapt based on the evolution of just the world.
• 3:02
  Speaker 2: From Bloomberg Media Studios and Chrome Enterprise, this is Security Bookmarked.
• 3:11
  Speaker 2: I'm your host, Kate Fazzini. I've been a cybersecurity professional
• 3:14
  Speaker 2: and journalist for over twenty years, and on this podcast,
• 3:17
  Speaker 2: I'm talking with leaders in gaming, finance, and manufacturing about
• 3:22
  Speaker 2: what security looks like in a workplace that's moved to
• 3:25
  Speaker 2: the cloud. Much of what we think of as cybersecurity
• 3:28
  Speaker 2: was pioneered in financial services. In fact, a bank created
• 3:32
  Speaker 2: the first CISO rule, and banks invented many of the
• 3:35
  Speaker 2: guidelines that are now standard across a range of industries.
• 3:39
  Speaker 2: According to the IMF, around twenty percent of all reported
• 3:42
  Speaker 2: cyber incidents in the past twenty years have affected the
• 3:45
  Speaker 2: global financial sector. So today I'm speaking with JF about
• 3:49
  Speaker 2: what he's learned as a leader of cybersecurity and finance.
• 3:53
  Speaker 1: Really, my role is twofold. One is to represent cybersecurity
• 3:58
  Speaker 1: in the lines of businesses, but it's also to hear
• 4:02
  Speaker 1: where they're heading towards from a business strategy standpoint.
• 4:06
  Speaker 2: And I'll find out why he's flipping the script on
• 4:08
  Speaker 2: enterprise security from simply defending the perimeter to transforming whole
• 4:13
  Speaker 2: teams into early detection networks. Then I'll chat with David Adrian,
• 4:17
  Speaker 2: security product manager for Chrome, about how businesses can implement
• 4:20
  Speaker 2: this kind of strategy and set up a strong monitoring
• 4:23
  Speaker 2: system to protect their teams. Going back to the trend
• 4:30
  Speaker 2: of cyber attackers using fake websites as phishing lures, JF
• 4:34
  Speaker 2: talked me through each step of their attack path.
• 4:37
  Speaker 1: A lot of it starts with the endpoint. It starts
• 4:39
  Speaker 1: via email or web browsing. Credential theft continues to be
• 4:46
  Speaker 1: a driver of this and phishing phishing from two standpoints,
• 4:50
  Speaker 1: either the credential theft that I mentioned, but also delivery
• 4:54
  Speaker 1: of malwer via those channels is normally step one. What
• 4:58
  Speaker 1: we continue to see in terms of exploitation is things
• 5:02
  Speaker 1: like you know, not having multi factor authentication on remote access,
• 5:07
  Speaker 1: on remote log in, or an element of like push fatigue.
• 5:11
  Speaker 1: There are multi factor authentication solutions that send a pop
• 5:15
  Speaker 1: up and then people just end up hitting the yes
• 5:18
  Speaker 1: button somehow because they're just tired of seeing it.
• 5:21
  Speaker 2: But tricking someone into signing into a website is just
• 5:24
  Speaker 2: the first step, and.
• 5:25
  Speaker 1: I think what's important for organizations is that there's multiple
• 5:29
  Speaker 1: steps that are carried out by an actor. I think
• 5:32
  Speaker 1: understanding these attack paths of how actors operate and carry
• 5:37
  Speaker 1: out their activity is hugely important because the more you understand,
• 5:44
  Speaker 1: the more you can design layered control. So what if
• 5:47
  Speaker 1: an actor is able to obtain credentials, Well, those credentials,
• 5:52
  Speaker 1: if you've got multi factor, they won't work right. They
• 5:56
  Speaker 1: might get them part of the way, but they won't
• 5:57
  Speaker 1: get them logged in. Let's say they're able to get
• 6:01
  Speaker 1: logged in. Well, actors are going to start carrying out
• 6:04
  Speaker 1: some element of reconnaissance on the network. So how would
• 6:07
  Speaker 1: you detect that reconnaissance or how would you detect them
• 6:11
  Speaker 1: setting up a foothold on the network. So it's really
• 6:14
  Speaker 1: about as early detection as possible and understanding those early
• 6:20
  Speaker 1: indicators of an adversary being present on the network.
• 6:24
  Speaker 2: One of the biggest threats that JF and I talked
• 6:26
  Speaker 2: about was an ongoing rise in ransomware attacks, where attackers
• 6:30
  Speaker 2: don't go directly after a bank's money or even its data. Instead,
• 6:35
  Speaker 2: they try to paralyze the bank itself, which can have
• 6:38
  Speaker 2: serious consequences for the greater business world.
• 6:41
  Speaker 1: The financial services ecosystem interfaces with utilities, infrastructure, all of
• 6:47
  Speaker 1: the clearing and settlement, payment providers, the third parties that
• 6:51
  Speaker 1: we rely on day to day.
• 6:53
  Speaker 2: And protecting that entire ecosystem at a global scale that's daunting.
• 6:58
  Speaker 2: So I asked Ji of how to secure a high
• 7:01
  Speaker 2: stakes perimeter that goes way beyond the bank.
• 7:03
  Speaker 3: Fauld.
• 7:04
  Speaker 1: What's made this so interesting for bad guys is when
• 7:07
  Speaker 1: you look at organizations that are historically stored sensitive information
• 7:11
  Speaker 1: or process sensitive information, they have been highly regulated, they've
• 7:16
  Speaker 1: had a lot of focus in terms of building up
• 7:19
  Speaker 1: security controls. But by focusing on the disruption the availability
• 7:25
  Speaker 1: aspect right like, ransomware, operators are now able to target
• 7:30
  Speaker 1: a variety of organizations that don't store transactional information, that
• 7:35
  Speaker 1: don't store personally identifiable information, and that causes broader disruption
• 7:40
  Speaker 1: and I think that's why we take our role incredibly
• 7:43
  Speaker 1: seriously in securing the broader financial ecosystem.
• 7:47
  Speaker 2: That is a great answer because I think to the
• 7:49
  Speaker 2: consumer or the banker who needs availability, it kind of
• 7:53
  Speaker 2: doesn't matter if it's down because of ransomware or a hurricane.
• 7:57
  Speaker 2: It's just wait, is it coming back up? And what
• 7:59
  Speaker 2: is the alternate?
• 8:00
  Speaker 1: Yeah, and I still remember back in my early days,
• 8:04
  Speaker 1: we had one vendor that had a data center in
• 8:06
  Speaker 1: Florida and another women in California. So you basically have
• 8:09
  Speaker 1: a data center in hurricane territory and you have another
• 8:13
  Speaker 1: one in earthquake territory. And you might go like, why
• 8:17
  Speaker 1: is this part of your role to think like site
• 8:19
  Speaker 1: resiliency strategy with clients, Well, our clients operate in a
• 8:24
  Speaker 1: bunch of different industries and if they can't move money
• 8:27
  Speaker 1: because people can't go into the office and they can't
• 8:29
  Speaker 1: work from home, that has a direct impact on their
• 8:33
  Speaker 1: day to day operations if they can't move money. And
• 8:36
  Speaker 1: I think that's why ransomware has had such an impact
• 8:39
  Speaker 1: because it attacks confidentiality, and integrity and availability, so actually
• 8:45
  Speaker 1: three elements of the CIA triad, and that causes broader
• 8:50
  Speaker 1: disruption and I think that also gains more focus because
• 8:55
  Speaker 1: organizations are actually stricten as a result of these attacks.
• 8:58
  Speaker 2: You know, businesses are always online now, especially after COVID,
• 9:02
  Speaker 2: lots of people working remotely having to be on at
• 9:04
  Speaker 2: all times. Customers expect you to be available at all times.
• 9:08
  Speaker 2: Another source of constant surprises, I imagine is the third parties
• 9:12
  Speaker 2: that you had to work with, and the hundreds and thousands,
• 9:15
  Speaker 2: maybe hundreds of thousands. So how do you manage resilience
• 9:20
  Speaker 2: when there are all of these other factors in the
• 9:23
  Speaker 2: form of vendors and other companies that you're hinging your
• 9:26
  Speaker 2: operations on. How do you deal with that in terms
• 9:30
  Speaker 2: of resilience.
• 9:31
  Speaker 1: You know, you mentioned the pandemic. The pandemic was a
• 9:35
  Speaker 1: vector for adversaries. Everybody was after information for the pandemic, right,
• 9:39
  Speaker 1: so it became a very interesting lure for bad guys
• 9:43
  Speaker 1: to send like phishing emails, set up fake websites, So
• 9:46
  Speaker 1: it became like a lure for social engineering. And then
• 9:49
  Speaker 1: companies shifted very very quickly to work from home, and
• 9:53
  Speaker 1: by doing so, they may have exposed infrastructure that may
• 9:58
  Speaker 1: not has been as secure as it should to be
• 10:02
  Speaker 1: exposed to the Internet and that gave threat actors a
• 10:06
  Speaker 1: path into some organizations, but it also affected business practices.
• 10:12
  Speaker 1: There were organizations that were ready for it, that had
• 10:15
  Speaker 1: been working their resiliency plans for years for pandemics. The
• 10:20
  Speaker 1: financial services sector is one of those areas where it's
• 10:24
  Speaker 1: basically part of our DNA to build out strong resiliency
• 10:28
  Speaker 1: and recovery mechanisms. And our role is to work with
• 10:32
  Speaker 1: our business to rethink some of the controls and get
• 10:35
  Speaker 1: the message out, the awareness message out to our clients.
• 10:40
  Speaker 1: And it gets really interesting when you start to break
• 10:43
  Speaker 1: down resiliency and recovery for organizations as a result of
• 10:49
  Speaker 1: things like a ransomware event.
• 10:52
  Speaker 2: Then I am also thinking of vulnerability management, which we
• 10:56
  Speaker 2: kind of never it's not very fun to talk about.
• 11:00
  Speaker 1: I think vulnerable management foundational to everything, right.
• 11:04
  Speaker 2: The patching, the kind of day to day You know,
• 11:07
  Speaker 2: there's a lot of talk about alert fatigue, but you
• 11:09
  Speaker 2: have people who need to access the web, who are
• 11:11
  Speaker 2: on their browsers from wherever they are all the time.
• 11:14
  Speaker 2: How do you deal with web browser security? What is
• 11:18
  Speaker 2: sort of the best practices today versus what they were
• 11:21
  Speaker 2: when you first started.
• 11:22
  Speaker 1: That's a great question. I get the point around alert
• 11:25
  Speaker 1: fatigue and volumes. But it's really about thinking through the
• 11:29
  Speaker 1: entire life cycle of that attack. So going back to like,
• 11:33
  Speaker 1: how do you drive awareness for employees not to click
• 11:37
  Speaker 1: on links. If they do click, how are you filtering
• 11:42
  Speaker 1: the sites that they're going to that could be malicious.
• 11:46
  Speaker 1: Interestingly enough, most systems that assist in like categorization of
• 11:53
  Speaker 1: websites have a functionality that blocks. Uncategorized websites mean websites
• 12:01
  Speaker 1: that are too new to have a category associate with them,
• 12:06
  Speaker 1: and oftentimes these are the ones that the threat actors
• 12:09
  Speaker 1: have just recently set up to look like a legitimate
• 12:13
  Speaker 1: website that you know somebody will click on, and you
• 12:17
  Speaker 1: can actually see a significant reduction of that browsing risk
• 12:23
  Speaker 1: if you're eliminating websites that are too new, that have
• 12:27
  Speaker 1: just been stood up, that have like a certificate mismatch
• 12:31
  Speaker 1: and things like that.
• 12:32
  Speaker 2: When you think about enterprise security and finance, and especially
• 12:35
  Speaker 2: about protecting teams, what are the most critical threats that
• 12:38
  Speaker 2: you're watching out for.
• 12:40
  Speaker 1: I think there's two aspects to this. We often talk
• 12:43
  Speaker 1: about how do we protect the workforce, but it's also
• 12:47
  Speaker 1: like how do we use our workforce? As the first
• 12:50
  Speaker 1: indicator of an attack or of targeting. So you know,
• 12:55
  Speaker 1: one of the things that's like hugely important is how
• 12:58
  Speaker 1: do you mine the reports that you're getting from end
• 13:03
  Speaker 1: users around cyber issues or targeting. We test our employees
• 13:09
  Speaker 1: for phishing on a quarterly basis. The first thing we
• 13:13
  Speaker 1: were doing was we were measuring click rates and then
• 13:17
  Speaker 1: we thought to ourselves, well, let's start measuring the reporting
• 13:21
  Speaker 1: rate because what we want to know is if somebody
• 13:25
  Speaker 1: is going to get this, are they going to forward
• 13:27
  Speaker 1: it to us? But then it was also measuring the
• 13:30
  Speaker 1: forward rate, meaning people's reaction often with a phishing email
• 13:37
  Speaker 1: is they send it to their colleagues and they go,
• 13:39
  Speaker 1: is this legit? So they're actually amplifying the adversaries reach
• 13:44
  Speaker 1: by forwarding it to a bunch of people who may
• 13:47
  Speaker 1: click on it who would have never gotten it. So
• 13:51
  Speaker 1: it's really how do you think through the awareness for
• 13:56
  Speaker 1: people with the most common types of attacks, But also
• 14:00
  Speaker 1: so how do you turn your entire workforce into early
• 14:04
  Speaker 1: detection sensors where they're reporting what they're seeing to the
• 14:09
  Speaker 1: cybersecurity organization so they can promptly take action on it.
• 14:14
  Speaker 1: And that is a game changer in the early stages
• 14:18
  Speaker 1: of an attack because people will notice, hey, there's something
• 14:21
  Speaker 1: wrong here. I have never seen this happen before. It
• 14:26
  Speaker 1: might be a glitch, but it also might be a
• 14:30
  Speaker 1: bad guy, a threat actor that's doing something that's absolutely
• 14:36
  Speaker 1: unexpected that just revealed their presence on the network. Organizations
• 14:41
  Speaker 1: need to be ready and continuously adapting to the threat landscape.
• 14:49
  Speaker 2: Jf's strategy called out the importance of monitoring for potential
• 14:52
  Speaker 2: threats and risky activities, but when monitoring means catching a
• 14:55
  Speaker 2: fake disaster relief website leaders need to recognize how opening
• 14:59
  Speaker 2: a browser for work shapes people's behavior.
• 15:02
  Speaker 3: Security certainly isn't top of mind for most users. Most
• 15:05
  Speaker 3: of the time, they're trying to get their work done,
• 15:08
  Speaker 3: and they're probably also trying to get their life done.
• 15:10
  Speaker 2: That's David Adrian, security product manager for Chrome.
• 15:14
  Speaker 3: For most people, browsing the Internet may not seem like
• 15:17
  Speaker 3: a big deal, But if you're an administrator for a
• 15:19
  Speaker 3: bank or other organizations that have a lot of customer data,
• 15:23
  Speaker 3: then keeping your employees safe on the web should be
• 15:25
  Speaker 3: even more top of mind.
• 15:26
  Speaker 2: He told me how he would approach protecting teams from
• 15:29
  Speaker 2: cyber attacks that take advantage of search.
• 15:32
  Speaker 3: Chrome runs a feature called safe Browsing, which attempts to
• 15:36
  Speaker 3: warn on sites that are known to be fishing, sites
• 15:39
  Speaker 3: known to be malware, and it doesn't reveal what sites
• 15:42
  Speaker 3: that you're visiting. You can opt into a version of
• 15:45
  Speaker 3: it called Enhance Safe Browsing, which is able to do
• 15:47
  Speaker 3: the checks in real time by sending them back to
• 15:50
  Speaker 3: the safe browsing server. That could be a good sort
• 15:53
  Speaker 3: of trade off to make if you want additional protection
• 15:56
  Speaker 3: against malware and against phishing, regardless of they're being fished
• 16:01
  Speaker 3: at work or fished at home on their work device.
• 16:03
  Speaker 3: And in fact, safe browsing is like such a popular
• 16:06
  Speaker 3: feature that it's also an open API leveraged by some
• 16:10
  Speaker 3: other browsers.
• 16:11
  Speaker 2: So of course you're dealing with data on these vulnerabilities
• 16:15
  Speaker 2: that is at the scale of Google, So you have
• 16:18
  Speaker 2: access to a great deal of very relevant data about vulnerabilities.
• 16:23
  Speaker 2: And not only that, but what of those vulnerabilities can
• 16:26
  Speaker 2: actually lead to a problem.
• 16:28
  Speaker 3: Absolutely. Yeah, Google is crawling the web every day for
• 16:32
  Speaker 3: its search engine, and as part of that, it's also
• 16:35
  Speaker 3: seeing malware, and that sort of same crawling is powering
• 16:38
  Speaker 3: safe browsing, and safe browsing is something that you just
• 16:41
  Speaker 3: get out of the box with Chrome, among other end
• 16:43
  Speaker 3: user features like site isolation, then we have other features
• 16:46
  Speaker 3: that are built with enterprises and businesses in mind. For example,
• 16:50
  Speaker 3: with Chrome enter Price Premium, you can implement filters based
• 16:53
  Speaker 3: on website categories that you've defined, and you can get
• 16:55
  Speaker 3: reporting that shows how your teams are handling those filters. So,
• 16:58
  Speaker 3: for example, our people get fatigued by their alerts and
• 17:01
  Speaker 3: clicking through regardless. Having that kind of information means teams
• 17:05
  Speaker 3: can get visibility into what's happening in their fleet and
• 17:08
  Speaker 3: they can take action based on their findings.
• 17:10
  Speaker 2: This is great because one of the big intractable long
• 17:13
  Speaker 2: time problems in cybersecurity is just a lack of visibility
• 17:17
  Speaker 2: into process and how things are working in the web,
• 17:21
  Speaker 2: apps and web browsers, which is realistically how people are
• 17:25
  Speaker 2: actually working today in the modern office workspace.
• 17:28
  Speaker 3: Absolutely, And like the old way of looking at this
• 17:31
  Speaker 3: would just be what programs did you launch? And it'd
• 17:33
  Speaker 3: be like, oh, well you launched a web browser and
• 17:35
  Speaker 3: it's like okay, well what does that mean? Right? You
• 17:37
  Speaker 3: could have done anything inside of that now, So you
• 17:39
  Speaker 3: need to know what's happening inside.
• 17:40
  Speaker 2: Yeah, and thinking about where the work is actually happening right,
• 17:43
  Speaker 2: because too often, I think in security we've gotten used
• 17:46
  Speaker 2: to looking at the people in a certain way. They're
• 17:49
  Speaker 2: just people making mistakes, people forwarding emails, people clicking on
• 17:52
  Speaker 2: dangerous links. We look at people and see them as
• 17:55
  Speaker 2: weak points. But so we could be treating every one
• 17:57
  Speaker 2: of those people as a point of defense. What do
• 18:00
  Speaker 2: you think about this growing emphasis on resiliency and managing
• 18:03
  Speaker 2: threats and what is the role of teams in creating
• 18:06
  Speaker 2: that resiliency.
• 18:07
  Speaker 3: Yeah, I think this idea of cybersecurity resilience is becoming
• 18:11
  Speaker 3: more and more popular, especially in the financial services sector
• 18:14
  Speaker 3: where the stakes are really high. Breaches are going to happen,
• 18:17
  Speaker 3: and mitigating and responding to them should be something that
• 18:20
  Speaker 3: takes five minutes, not five days or five years. I
• 18:24
  Speaker 3: talked last time about how strong an identity is really important.
• 18:27
  Speaker 3: Once you have strong identity, you can start doing access
• 18:30
  Speaker 3: controls and authorization and limiting who has access to what
• 18:34
  Speaker 3: instead of everyone having access to everything. The more that
• 18:37
  Speaker 3: you can do that, and then you conpair that with
• 18:39
  Speaker 3: audit logs. Audit logs are the key to any security monitoring.
• 18:44
  Speaker 2: Yes, and whenever you compare different pieces of information that
• 18:47
  Speaker 2: you have vulnerabilities. With audit logs, for instance, you start
• 18:51
  Speaker 2: to get that matrixed view which allows you to take
• 18:55
  Speaker 2: action in a much more meaningful way.
• 18:57
  Speaker 3: What you want is that people regular day to day
• 19:02
  Speaker 3: web browsing is instrumented and understood as a baseline, so
• 19:05
  Speaker 3: that when something anomalist happens, it's detected as being anomalists.
• 19:09
  Speaker 3: You can't have an anomaly without a baseline. Ideally, you
• 19:12
  Speaker 3: want that detection to happen automatically, whether that's just because
• 19:17
  Speaker 3: you've it's something very simple like blocking a copy paste
• 19:21
  Speaker 3: from your CRM and it's some sort of public document,
• 19:24
  Speaker 3: or it's something more complicated about detecting a download from
• 19:27
  Speaker 3: a site that normally doesn't have a download. And then
• 19:30
  Speaker 3: where Chrominer price premium can really help is identifying the
• 19:34
  Speaker 3: non standard usage, is the anomalies and remediating those. You
• 19:38
  Speaker 3: can get an audit log of all of the events
• 19:41
  Speaker 3: that are happening in Chrome, all of the user interactions
• 19:44
  Speaker 3: and so on, and that is exposed through the cloud,
• 19:48
  Speaker 3: either directly to you via APIs, or it can integrate
• 19:53
  Speaker 3: with a sort of third party sim provider and hook
• 19:56
  Speaker 3: into your security team's workflow to look for anything out
• 19:59
  Speaker 3: of the ordinary, whether that's through integrating with data loss
• 20:02
  Speaker 3: prevention or just more specific rule sets on hey, this
• 20:07
  Speaker 3: thing looks different than normal. And then in that world,
• 20:10
  Speaker 3: you're not relying on the users to always make the
• 20:12
  Speaker 3: right decision, but you're trying to detect when the users
• 20:16
  Speaker 3: haven't made the right decision or are doing something weird.
• 20:18
  Speaker 3: And then if you've paired that with all of the
• 20:20
  Speaker 3: other best practices, then hopefully your time to mitigation is
• 20:25
  Speaker 3: very fast and it's actually a very low impact event
• 20:27
  Speaker 3: if something bad did happen.
• 20:29
  Speaker 2: Yeah, I know, we have so many amazing technology solutions now,
• 20:32
  Speaker 2: but it also reminds me of how difficult it can
• 20:35
  Speaker 2: be for a security team to implement the new technologies
• 20:38
  Speaker 2: that they want to have. And that's where again we
• 20:41
  Speaker 2: go back to the people involved. You really have to
• 20:44
  Speaker 2: have strong leadership who are listening in to their security
• 20:47
  Speaker 2: teams and their experts and able to make the right
• 20:50
  Speaker 2: decisions for the company in terms of what kind of
• 20:54
  Speaker 2: security measures are going to work the best for them
• 20:56
  Speaker 2: and the level of visibility that they want.
• 20:59
  Speaker 3: Absolutely, I think that's this move to management becoming something
• 21:04
  Speaker 3: that the security team or whoever is responsible for security,
• 21:09
  Speaker 3: that the management of the web browser or of a
• 21:12
  Speaker 3: phone or of the device is actually a security product,
• 21:15
  Speaker 3: like rather than just an IT product, because all of
• 21:18
  Speaker 3: sort of modern security operations is about identifying who's logging
• 21:23
  Speaker 3: in a web browser and securing that web browser, whether
• 21:26
  Speaker 3: that browser is on a laptop, that browser is on
• 21:28
  Speaker 3: a phone, it's on a company owned phone, or it's
• 21:31
  Speaker 3: on a personal phone. It's ensuring that whatever device the
• 21:35
  Speaker 3: user is going to, some browser signing it on has
• 21:37
  Speaker 3: some minimum security posture. You've strongly authenticated them, you can
• 21:40
  Speaker 3: wipe data if you need to. And all of these
• 21:42
  Speaker 3: things might have previously been something that you'd just been like, oh,
• 21:46
  Speaker 3: that's something that just it has to deal with for
• 21:48
  Speaker 3: IT related reasons, and it's like, you know, actually, these
• 21:51
  Speaker 3: problems are really deeply central to the security story of
• 21:55
  Speaker 3: a modern workplace as well.
• 21:59
  Speaker 2: To learn more about how the most trusted enterprise browser
• 22:02
  Speaker 2: can help protect your organization, visit Chrome Enterprise dot Google.
• 22:09
  Speaker 2: Next time, on security Bookmarks, i'll talk to Curtis Minder,
• 22:12
  Speaker 2: a renowned ransomware negotiator, about the security challenges he's tackled.
• 22:16
  Speaker 2: In the manufacturing industry.
• 22:18
  Speaker 4: We have been the manufacturer of this particular product for
• 22:20
  Speaker 4: almost one hundred years, and the way that we manufacture
• 22:23
  Speaker 4: this product and the materials we use to manufacture this
• 22:25
  Speaker 4: product are our trade secret. I am concerned that that
• 22:29
  Speaker 4: information has left the building, and I won't know about
• 22:32
  Speaker 4: that risk for some time until a competitor of mine
• 22:36
  Speaker 4: makes the exact same product in five years from now
• 22:38
  Speaker 4: and puts me out of business.
• 22:40
  Speaker 2: Security Bookmarked is a podcast from Bloomberg Media Studios and
• 22:44
  Speaker 2: Chrome Enterprise. Subscribing your podcast app so you don't miss
• 22:47
  Speaker 2: our newest episode. I'm Kate Fazzini. Thanks for listening.