Latest / CYBR.Signal / Shadow Security in a World of Shadow IT

Transcript

Shadow Security in a World of Shadow IT · CYBR.Signal

• 0:00
  SPEAKER_00: And hello everybody.
• 0:01
  SPEAKER_00: Happy Cyber Sunday.
• 0:02
  SPEAKER_00: My name is Michael Farnum.
• 0:04
  SPEAKER_00: Hope you're doing well.
• 0:05
  SPEAKER_00: Today I wanted to talk about a term that I don't think a lot of people are using, but I've heard it a couple of times in the last couple of months, and that is shadow security.
• 0:16
  SPEAKER_00: So, what do I mean by shadow security?
• 0:18
  SPEAKER_00: Well, I think we all know, for the most part, if you're on here, that you know what shadow IT is.
• 0:24
  SPEAKER_00: Essentially, you've got different business units or different people within your organization setting up some type of environment, putting a workload on it or some kind of whatever application, whatever that workload may be, typically happens in cloud these days because it's easier easier to set up.
• 0:43
  SPEAKER_00: And the IT department, security department, all those people that need to know those things don't know that it's there.
• 0:50
  SPEAKER_00: So that's shadow IT.
• 0:52
  SPEAKER_00: Obviously, it leads to a bunch of problems, security problems, that kind of thing.
• 0:55
  SPEAKER_00: But what happens when you've got an organization or a business unit within an organization that says goes and sets up cloud, new cloud environment on AWS, Azure, Google, whatever it is, and they actually have some knowledge of security, some knowledge of the responsibility that needs to take place where they keep that environment, they have some type of security built into it.
• 1:20
  SPEAKER_00: And let's say they go out and create a tool or install a tool like a cloud security posture management that does some checking of that of that cloud environment.
• 1:31
  SPEAKER_00: They do that because maybe it's a choice when they were setting up their environment or something, because some of the cloud providers have that.
• 1:39
  SPEAKER_00: Hey, go install some security on here.
• 1:41
  SPEAKER_00: Hey, everything's grand and wonderful and fantastic.
• 1:44
  SPEAKER_00: You've made your security people happy.
• 1:46
  SPEAKER_00: But what ends up happening, well, let me back up.
• 1:49
  SPEAKER_00: You you would think that security is better than nothing, even if the IT department or security department doesn't know that that's there.
• 1:58
  SPEAKER_00: You'd you'd like to say something better than nothing, at least you did something, and I think to a point that's correct, because at least somewhere along the line, somebody has got it in their head, has put it in those people's head that are setting this up that security is important.
• 2:16
  SPEAKER_00: So that in and of itself, I'm gonna claim as something of a victory.
• 2:20
  SPEAKER_00: However, it's not necessarily better than nothing.
• 2:24
  SPEAKER_00: Why do I say that?
• 2:26
  SPEAKER_00: So, one of the reasons is as an organization, if you're in charge of security, hopefully, you've done something to set some security policies in place to say there are minimum standards that must be applied across the board to environments.
• 2:43
  SPEAKER_00: You have no idea whether this has a minimum standard, has met that minimum standard.
• 2:48
  SPEAKER_00: You don't know.
• 2:51
  SPEAKER_00: The people setting that up think they've got something in there, it's better than nothing.
• 2:56
  SPEAKER_00: So now what have they got?
• 2:57
  SPEAKER_00: Possibly a very false sense of security in that environment that it's secure.
• 3:02
  SPEAKER_00: So, what does that enable?
• 3:03
  SPEAKER_00: Oh, well, I've I've done my due diligence on making sure this is secure, haven't met any kind of policies, don't know what I'm really doing here, but I've got a security tool put in there, so I can go put customer data, I can put whatever.
• 3:19
  SPEAKER_00: False sense of security.
• 3:21
  SPEAKER_00: Two, you haven't you still don't have any idea what's going on within that workload, and now you've got security data in that workload.
• 3:30
  SPEAKER_00: You've got some kind of security logs or something, most likely, in there.
• 3:34
  SPEAKER_00: Where there, where are those logs going?
• 3:36
  SPEAKER_00: Are they going anywhere?
• 3:37
  SPEAKER_00: Are they doing anything?
• 3:38
  SPEAKER_00: Are they being stored somewhere by default from this application or the security tool that's been put in there?
• 3:45
  SPEAKER_00: That in and of itself can have sensitive information in it if somebody gets into that environment.
• 3:50
  SPEAKER_00: So you got multiple issues that can happen, even though there's a security tool there.
• 3:57
  SPEAKER_00: So the argument is that my argument is that shadow security can be just as dangerous as shadow IT, maybe even more dangerous depending on what happens and what's in that environment, because you got a false sense of security.
• 4:12
  SPEAKER_00: Maybe they don't even think they need to report anything now to the security organization because this tool is in there and they've got they've got security, they've done their due diligence.
• 4:22
  SPEAKER_00: Hey, everything's grand.
• 4:24
  SPEAKER_00: So it's something to be on the lookout for.
• 4:27
  SPEAKER_00: I think it's happening more often with some of these organizations who we finally managed to get into their brain and say you need to have security, and they go, but I need this workload up, I don't want to go mess with IT and all that, so let me just go get this done.
• 4:43
  SPEAKER_00: They put some kind of security tool on it because that's a best practice, maybe somewhere along the guidance when they were installing this tool that it said you need to have security.
• 4:52
  SPEAKER_00: Here's recommended, so they clicked a button.
• 4:55
  SPEAKER_00: That is not necessarily a good thing.
• 4:57
  SPEAKER_00: Shadow security can be a problem as you're looking for shadow IT and you're finding shadow IT within your organization because I guarantee it exists in there somewhere.
• 5:07
  SPEAKER_00: Make sure you're looking at the whole package and see if there's shadow security going along with it.
• 5:12
  SPEAKER_00: There is, get those tools up to snuff from a policy and procedure standpoint, and then make sure you're collecting the telemetry from them.
• 5:19
  SPEAKER_00: That's it.
• 5:20
  SPEAKER_00: Let me know what you think in the comments.
• 5:22
  SPEAKER_00: Talk to you next time.