Latest / Identity at the Center / #259 - The SOCs Role In Identity Security

Transcript

#259 - The SOCs Role In Identity Security · Identity at the Center

0:05
This is identity at the center. If it has anything to do with
0:10
IAM, this is the go to podcast now your hosts Jim McDonald and
0:17
Jeff Stedman. Welcome to the Identity at the
0:23
Center podcast. I'm Jeff and that's Jim.
0:24
Hey, Jim. Hey, Jeff, how are you?
0:26
Not so bad yourself. Good.
0:27
I'm trying to hold back my giggles because what I wanted to
0:30
say was I was surprised you showed up for the podcast today
0:34
and you don't have the new Apple Vision Pro on your face.
0:39
That's what I was expecting, man.
0:41
I have one on order. It will arrive in three to four
0:44
weeks. Allegedly.
0:45
We'll see. I'm curious.
0:47
I've read, I've, I've probably watched every video, you know,
0:50
review. I'm cautiously optimistic.
0:52
I got to be honest, it's going to have to really blow me away
0:55
for me to part with $3400 of this thing on my face, but it
1:00
looks. Really cool.
1:02
Yeah right. I can see you sitting at
1:04
Chili's, having your chips in queso, wearing your headset and
1:09
looking all over the place, maybe getting getting some work
1:12
done. I mean, you are the early
1:15
adopter of early adopters. I am an early adopter, but it's
1:19
more like in secret. I don't like.
1:22
I don't want to be like that guy out there wearing Vision pro
1:26
skating around New York City like Casey Neistat from from
1:30
YouTube or anything like that. I'm more of a subtle kind of
1:33
early adopter. At home I'll nerd out all day
1:35
long, but in public I try to keep it to a minimum.
1:39
I'm enough of a nerd. I don't need to amplify it any
1:41
more than I already AM. So what I wanted to to ask you
1:44
about early adoptership, does that carry over into your IEM
1:50
life? In other words, are you an early
1:52
adopter of IEM technology? Like if you think ITDR is like
1:58
it, are you in and are you an early adopter of vendors?
2:04
So in other words, maybe there's a a dominant vendor or two.
2:09
Do you consider the ones that are not the dominant?
2:12
Or maybe they're new? Or you don't have a whole lot of
2:15
reference points? Yeah.
2:16
And it's a really good question. I would say no, I'm not
2:19
typically an early adopter. I think I'm approached a little
2:21
more pragmatically. I have to separate my thought
2:25
that, oh, that's a really cool piece of technology.
2:27
I really like that with the business side of my brain.
2:31
That is what is, does it make sense, You know, what does it
2:35
cost? How does this fit into my
2:36
current stack of technologies that are going to be?
2:39
I have to separate that from the boy, that's really cool.
2:43
So I I would say I'm not an early adopter in in the real
2:47
world when it comes to identity, but it's not because I don't
2:50
appreciate the technologies. It's more of a fiscal, you know,
2:53
responsible saying, OK, great, if I had a limited budget, sure,
2:56
I'd throw stuff in price all the time.
2:57
I don't. Most people don't.
2:59
There's limited time, limited resources and there's just not
3:03
enough time in the world to try and keep up with every single
3:05
Technet that's out there. Some I think are better than
3:08
others, or at least more media like ITDR has been hot for the
3:11
last couple years. Yeah, I think if you've got, you
3:15
know, everything else solved seems to be like a a natural
3:17
evolution to go that way. What do you think?
3:19
Well, I think when it comes to new technology, well, well,
3:23
First off, I just think it's like a personality trait.
3:26
I lean toward being more conservative.
3:29
I think both of my grandfather's were accountants, right?
3:32
And the accountants are about as conservative as you can get.
3:35
I spent most of my career working in more conservative
3:39
organizations. But since I've been in
3:41
consulting, which is over a decade now, I've seen a lot of
3:46
technologies come to come and go.
3:48
I've also seen where certain technologies, when they hit,
3:52
they just hit and address a problem that the industry has.
3:58
So I think in my oddly enough, in my old age, I think I'd learn
4:04
more toward being a little more experimental and new
4:07
technologies. When it comes to new vendors, I
4:11
feel like you've got to be a little more adventurous.
4:17
You have to look at those mainline like, you know the the
4:22
saying like nobody got fired for choosing IBMI.
4:26
Don't buy into statements like that.
4:28
But at the same time and no rail against them might kind of think
4:32
like OK, you need to look at that quote UN quote IBM, but you
4:36
also need to look at some of the up and comers.
4:39
So I think if you are an earlier adopter, you can get in at a
4:43
better price position, you can do things for your organization,
4:46
you can use your logo for clout in terms of becoming more or
4:51
less a premier customer. Whereas some of those like
4:54
flagship products, the you know, entrenched vendor, your logo may
4:59
not provide as much value to them.
5:01
I mean obviously depending on your, your organization it.
5:05
Surprises me a little bit. I guess only for do you have
5:08
money that you're carrying around for the just in case you
5:11
find something cool on the shelf at Best Buy of Identity.
5:14
Yeah right. I don't know many organizations
5:16
that do. I mean some do, right.
5:18
And that's great. I just it's interesting that
5:20
we're a little bit opposite in that regard.
5:22
Like I'm not, I'm not afraid to go all in with it if I have the
5:24
money to do it, but I generally don't have the money or the
5:27
resources. I feel like I'm in the majority
5:29
in this case. Yeah, You're probably in the
5:31
majority, but you also say something somebody that's kind
5:37
of like one of those flagship products now sale point, they
5:40
were the young up and Comer at one point, right.
5:43
Enough people had to kind of buy into that story and kind of like
5:48
that's what they leverage growing up.
5:51
Now if you're one of those early ones in, those are probably
5:54
still the customers that have influence that know the
5:57
executives at the top of the organization that you know, I
6:02
can't say that they're they're bossing them around or anything,
6:05
but we're getting a lot more respect than they would get if
6:08
they were just buying it now. Yeah, I can see that you get to
6:10
wield a little more influence. I wonder if there's a little bit
6:13
of a back in my day, you know, X product cost $20 and now it's
6:17
like you know, $400.00 or like you know what you know, where
6:21
did all this this price increase come from?
6:24
Yeah, exactly. So I think we should mention,
6:31
mention conferences. You know we got Identity Week
6:35
America, I guess that's the summer, but really need to be
6:38
planning for these things in advance.
6:41
So Identity Week, Europe and Amsterdam, June 11th and 12th,
6:46
Identity Week America which you and I are going to play an
6:50
active part personally in that's going to be in DC September 11th
6:54
and 12th and then Identity Week, Asia and Singapore, October 22nd
7:00
and 23rd. And our listeners get 30% off of
7:04
these, the IDAC 30 conference or I'm sorry, discount code.
7:10
Yeah, it's a pretty sweet deal, that conference code or discount
7:13
code. And you got me saying it now
7:14
works for all of the conferences around the world.
7:16
So whether you're going to Europe, America, Asia, IDAC 3
7:19
zero, 30% off. Very.
7:21
Cool. I was at last year's.
7:23
We talked about the last episode.
7:24
I'm looking forward to again this year.
7:25
I think like you said, we'll be active participants.
7:28
I think I'm going to host the panel again of some sort.
7:31
Last year's was awesome, so we had like a real who's who of
7:35
identity and looking forward to doing something somewhere.
7:38
And of course we'll be doing podcasty things while we're
7:41
there that are still to be determined.
7:43
I. Think that's one of my favorite
7:45
parts about doing the podcast overall is just you know being
7:49
part of the conference circuit, bringing the conference to
7:51
people who can't be there, interacting with people who are
7:55
there and bringing that to the podcast community.
7:58
I I just think the whole thing is like it's it's really, I
8:03
don't know I feel like we're we're providing a service to the
8:06
community if you will. The man on the street, the man
8:10
in the field, you should get like one of those like reporter
8:14
flak jackets. They have a press on the front
8:16
and like a helmet and then like go into like Identiverse or
8:20
Identity Week America or something like that with old
8:21
microphone. Yeah.
8:23
Oh, you're not supposed to. If you're in a war zone like
8:26
that, you're not supposed to shoot the person with that
8:28
jacket on. So you're safe.
8:30
That's why you need the big press logo, like on your chest
8:32
and on your back, so people know.
8:35
Yeah, absolutely. So what are we going to talk
8:37
about today? We're going to talk about the
8:40
role of a systems operation center or a SoC as it's commonly
8:44
referred to when it comes to identity security.
8:46
So I think this is an area that we really haven't touched on yet
8:49
on the podcast. I think people have probably
8:52
heard about it, but they're not really sure maybe what it is or
8:55
what goes on in there. As Jim must say, what would you
8:57
say you do here when it comes to a SoC perspective?
9:01
So we're very fortunate that we actually have experts that we
9:04
work with on set every day as part of our SMS team.
9:07
So I want to welcome from the RSM managed security practice.
9:10
First up, we've got Steve Kane, Managing Director.
9:12
Welcome to the show, Steve. Thank you guys.
9:15
Thank you. And we've also got Todd
9:18
Willoughby. He's a director with the same
9:20
practice. Welcome to the show, Todd.
9:22
Glad to be here guys. So before we get started, I'm
9:27
going to ask a bunch of questions around this and we
9:29
kind of want to build expertise and knowledge in this.
9:32
But before we do that, I always like to hear origin stories of
9:35
how people got into infosec and identity and just things at
9:39
large. Steve, we'll start with you.
9:41
How did you get into the Infosec space?
9:44
I guess when did you realize you were in the Infosec space?
9:46
Sometimes that's a question too. Well, it's actually a really
9:50
good question because sometimes you end up there and you don't
9:54
even realize that you were headed down that path.
9:57
For me it really started about 25 years ago.
10:03
I have always been an IT person at heart.
10:06
You know when I was younger I was always the the go to person
10:09
in the family to go figure out things, computers obviously
10:13
being newer back in my day it was always a an interesting
10:19
dilemma and conversation with with friends and family.
10:24
But I started in IT really at healthcare facility.
10:30
So we were in an elder care situation where I was working at
10:35
the health guys and I was fielding all the calls initially
10:39
and that kind of grew into understanding more about
10:43
applications about health systems work and from there
10:47
ended up moving in the direction of financial services.
10:50
So I ended up at a large regional banking provider where
10:57
I ultimately was responsible for managing all of the application
11:03
technology components, software updates and security updates.
11:08
We had to deal with a lot of audits and everything else, so
11:13
security really started to come into focus at that point.
11:16
Then moved back into the healthcare space, which is
11:19
really where I have a yes, personal passion for.
11:25
So from there I was responsible for not only the IT components
11:31
of several hospitals, but also I was the HIPAA Privacy and HIPAA
11:35
Security Director for those facilities.
11:38
So before I knew IT, security was part of everything that I
11:41
was doing and then subjectly ended up for the last 15 years
11:47
managing clients and SoC and growing business etcetera.
11:54
So here I am now, you know helping RSM kind of grow into
12:00
that space as well. And really, it's ever changing,
12:05
ever evolving and constantly keep showing your toes.
12:09
I bet. I think one of those things is,
12:12
do you consider yourself an infosec person now at this point
12:15
with your experience and kind of grown to that, or do you still
12:18
see as like a specialist in a certain area?
12:21
I I have to consider myself an into a sick person with this
12:25
many years in one discipline like that.
12:29
But you'd never really forget the the roots.
12:31
You still want to tinker around every now and then on some, you
12:35
know home equipment or friends or family that might have stuff
12:39
laying around. Or if you happen to get extra
12:42
time working on something, you know within your organization
12:45
where there's test environments and stuff, so you still want to
12:49
to work things and and actually hands on keyboard and be the
12:54
intelligent hands like that more so than just monitoring, doing
13:00
incident response activities etcetera.
13:02
So definitely more of a infosec person than an IT person at this
13:08
point, but you never forget your roots.
13:11
Todd, how about yourself? How did you get into this space?
13:15
That's a long, that's a long story.
13:16
I'll I'll try to give you the abridged version.
13:18
But much like Steve, you know I started working at a ADSL help
13:24
desk in college. It's pretty old technology but
13:27
still out there. It exists for a large DSL
13:30
provider. And then from there I went into,
13:33
you know, it's not, you know, pay your bill or turn off your
13:36
route or turn it back on again type of deal literally that to
13:39
doing acceptable use policy violations and helping fulfill
13:44
subpoenas and warrants from local law enforcement agencies
13:46
for people doing nefarious things, you know, with our
13:49
services at the ISV at that time.
13:51
And then from there I went into a large early stage of my career
13:56
doing government contracting mainly around computer network
13:59
and defense for various government agencies, the Army,
14:02
the Navy, working intelligence as well there too.
14:05
And then where I met Steve all these years ago, Steve and I,
14:09
Steve and I have been together for a long time, almost a decade
14:12
now. And you know we were at a large
14:15
BIG4 and Steve and I ran that practice there.
14:18
Essentially we had 200 sock analysts, threat hunters, sock
14:22
managers running that operation from large Fortune 50 clients.
14:27
And then Steve and our friend Daniel convinced me to leave
14:30
everything that we built over there and do it all over again
14:33
here from scratch. So here we are.
14:35
Sounds like a very similar story.
14:37
You guys have worked together for a long time.
14:38
Jim and I have worked together for a long time and now the four
14:41
of us have worked for a much shorter time, I think probably a
14:43
year and a half year roughly. For those who aren't familiar
14:47
with what RSM brings to here, I don't want to turn this into a
14:50
commercial for RSM, but give us the elevator pitch for what does
14:53
the managed security practice do?
14:55
What are some of the things that come out of it?
14:56
I know we've you we we've had internal conversation around
14:59
those things like RSM Defense and Unit 26, but tell us a
15:02
little bit about what those are for sure.
15:06
We not only focus on you know the low level monitoring
15:11
aspects, what we're trying to do for our clients is provide a end
15:16
to end security stack of solutions that meet clients
15:20
where they need to be met right now in their journey.
15:24
So for us it's as simple as having the the conversations
15:31
with our clients to really understand where what their
15:34
needs are because as a consulting firm we have the
15:38
ability to expand and and pull in the right resources at the
15:42
right time. But from a managed security
15:44
perspective, what we want to do is take the burden of day-to-day
15:50
operations in various stages of our clients so that they can go
15:55
focus on more high value, high demand type of activities.
16:00
And we have everything from doing security monitoring all
16:05
the way up through instant response activities, all the way
16:08
through DC service services etcetera that are all related to
16:14
what we do from a a managed security perspective.
16:16
So we're really trying to help meet the clients where they are.
16:21
So the name RSF Defense is that basically our term for the
16:24
managed SoC. Yes, that is the the trademark
16:28
name of our managed security or managed SoC, yes.
16:32
I can appreciate a trademark name as we have trademark RN as
16:34
well. How about unit 26?
16:36
Where does Unit 26 fall into this?
16:39
I'll let Todd give that story, but it's it is tied to the RSM
16:43
history a little bit, but I'll let Todd give that one.
16:46
Yeah, so you're not, you're not really a cool security team if
16:49
you don't have a cool, witty name, right?
16:50
That's that's pretty much a industry standard.
16:53
But no, it it really came, you know, the team wanted to, you
16:57
know, we have a big team aspect of what we do here and making
17:00
sure that we recognize that and the team themselves picked that
17:03
name right. 1926 is when RSM was initially founded.
17:07
Unit 26, unit being a team, right?
17:09
That's what we went with. That's where it came from.
17:12
It's really the long and short of it.
17:14
So when we're talking about socks, we're not talking about
17:17
Sarbanes-Oxley. We're not talking about those
17:20
things you put on your feet. We're talking about SoC.
17:25
So Steve, what does SoC stand for and what is it like?
17:29
Make it as simple as so people. Everyone can.
17:31
Understand. SO SoC stands for Security
17:35
Operations Center. Its primary purpose is to
17:40
provide infrastructure, people, process, technology surrounding,
17:46
monitoring your infrastructure in your client's environment,
17:52
your in your particular environment in a secured fashion
17:58
with let's say refined processes and procedures and executing
18:05
against those processes and procedures.
18:08
So it's about having a softening unit of professionals that are
18:15
there watching when when nobody else is.
18:20
And I think Todd uses this phrase quite often.
18:22
But a lot of times the people that are in the sock are the
18:27
smart people in the basement type of thing.
18:29
That when there's an incident that's that's coming or has
18:34
occurred, these are the people that you want on your side
18:38
defending you and trying to understand where patient zero is
18:43
and and take all the necessary steps to respond and recover
18:47
from a security incident to cybersecurity incident.
18:50
Yeah, I mean, it's funny. Use the term patient zero.
18:53
Sound fault very much like like a military term in a lot of ways
18:58
but I I know, I know it's not military but more like OK versus
19:03
virus or sickness starting. But it's I mean the the amount
19:08
of attacks that are happening today right.
19:10
I mean, Todd, tell us like, you know, is, is it like a new ball
19:14
game now than it was maybe a decade to go with like, you
19:18
know, instead of being attacked a couple of times a week, you're
19:22
getting attacked 24 hours a day. What's the deal?
19:26
Yeah, Jim, that's a great question.
19:29
Business is movement if you have somebody of questionable moral
19:32
ethics, right? No, I mean and frankly the the
19:38
IT hasn't changed all that much in my opinion, right.
19:40
I some people will think so and I'm sure there's some, you know,
19:42
larger edge cases that support that the volume of them and the
19:45
ease of them have certainly increased their be made easier
19:50
over time, right. Since the, you know, the last 15
19:53
years, correct. There's more connected systems
19:55
than ever where things are, you know, out there unsecured than
19:58
ever. There's more applications, your
20:00
identities are controlling a lot more of this access to the data,
20:04
right than they were ever before and distributed systems that
20:06
people particularly don't have visibility around.
20:09
So yes, there's also a lot of things around, you know,
20:13
fishing. Fishing is still one of the.
20:15
The top three ways that cyber attacks occur, breaches occur,
20:19
right and we've had Fishing point solutions out on the
20:21
market now for the last 20 years and nothing has seemingly got
20:24
better. It's only gotten worse or made
20:27
made more easily and readily accessible to threat act, right.
20:30
So I think the answer is yes and no there Jim.
20:33
I think the other the other things that you know help
20:36
establish those ease of attack factors is again
20:41
vulnerabilities. Now back in the you know I say
20:43
back in the day or what I can date myself but you know usually
20:47
when you would patch things right you're 30 days right.
20:49
You know deployed to a non product system test it right.
20:51
That's that's sadly not the case anymore patching around high you
20:56
know CVE related vulnerabilities almost needs to be a tier one
20:59
security institute right. I mean, there are threat actors
21:02
developing capabilities faster than ever before to turn around
21:05
vulnerabilities and exploits and maybe weeks, days instead of,
21:09
you know. Months.
21:10
You know, I always thought that SOCKS SoC would focus on
21:16
activities like our network is being scanned, there's a DDoS
21:21
attack. Is there more than that?
21:23
I mean you mentioned phishing, is the SoC also important in in
21:28
those types of attacks? Yeah, absolutely.
21:31
Phishing is one of the I got the biggest vectors on breaches and
21:34
how they occur in incidents in general.
21:37
Business e-mail compromise is another big one on that list.
21:39
I didn't get involved in e-mail, just like phishing does.
21:41
But also what they're doing, the threat actors, is subverting the
21:45
trust models of these companies and corporations.
21:48
And they're going after the, I would say the weakest links of
21:51
those change, right? Why would I, as a threat actor,
21:54
try to breach your, you know, $1,000,000 firewall solution,
21:57
right, When I can just send an e-mail and ask you for a pass,
22:00
right? It's a lot easier.
22:01
Same thing goes with animals, right?
22:02
You're I'm a I'm a hunter. I like going hunting things like
22:05
that. Animals don't walk straight
22:07
uphill, they walk up on angles. They take the paths of least
22:09
resistance. They may escalate to those more
22:12
sophisticated types of attacks, but they're definitely going to
22:15
try the low hanging fruit 1st to get in right.
22:18
So it's it's become a a game of kind of cat and mouse too,
22:22
especially the way once they do get in the way, they move around
22:26
inside. They're using legitimate
22:27
applications and programs that you already used today to
22:30
administer your systems. So it's being able to find out
22:34
what the anomaly is. And you know some of them are
22:36
pretty tall tale signs. EDR certainly got a lot better
22:39
and changed the game in that sense about making detections
22:41
around endpoints. Sure, you know the users use
22:44
endpoints, right. So that's that's where we want
22:46
to focus a lot of the attention, not all of it, but most of it,
22:49
yeah, it's it's gotten I would say easier enough.
22:51
And I've got to think that the identity based attacks are, I
22:55
mean you've you've got to be focusing on on that at some
22:59
degree, right, Because really it's about getting in the front
23:03
door, moving laterally, escalating privileges, seeing
23:07
how far you can get right. How is identity affecting or
23:12
fitting into what the SoC does? Its core.
23:16
It's absolutely core. We have to have identity
23:18
information to be able to do a a good job at what we do every
23:21
day. You know, you know identity is
23:24
evolving, right? I mean I think you guys talk
23:26
about that every week on here. You know, not only do people
23:29
have identities, but devices have identities, applications
23:32
have identities, services now have identities.
23:36
So the identity space, in that sense, the attack, the attack
23:39
space is growing, right? So we have to we have to know
23:42
how those identities are being used to be able to detect
23:44
anomalies, to be able to start incidents and detect breaches.
23:48
Steve, when would I? I know whether or not I can do a
23:52
better job of doing my own security operations first when I
23:58
would outsource it. And is it black and white or is
24:01
there Shades of Grey? As with everything, there are
24:05
Shades of Grey in different areas, but in general terms,
24:10
it's an expensive proposition to build a a sock for your own
24:17
organization by yourselves. You're looking, you know to do
24:21
it the right way 24/7, have the right controls in place, have
24:25
the right technologies in place to support that.
24:28
You know you're generally looking north of 1,000,000 to
24:32
$2,000,000 just to even kind of get started.
24:35
Now obviously there are certain organizations that have
24:38
compliance regulations or you know specific personnel
24:42
requirements that that mandate that they must go and make this
24:46
investment. And then you know they are
24:48
obviously controlled and governed by frameworks such as
24:52
NIST and and fed ramp and and everything.
24:55
So there are different needs for different companies in in their
25:01
different states but nine times out of 10 it is not a worthwhile
25:08
cost efficiency to to go and build your own socket.
25:11
You want to leverage the the scalability and the cost
25:16
favorability of a of a managed solution in that spot, Jim.
25:19
Yeah, I would imagine that it's, you know, I, I think from a
25:22
business standpoint, the way to look at insource versus
25:26
outsource is I want to direct my own personnel to areas that
25:32
provide business differentiation, business
25:36
advantage or value versus my competitors.
25:39
It seems like this kind of fits more into the infrastructure at
25:44
some level and below, but that there is some business
25:47
differentiation at some point where you know it does make
25:50
sense to have some of your own people.
25:53
Is that what you're seeing a lot of organizations doing?
25:55
In a perfect world, you definitely have some of your own
25:59
folks, especially on the, I'll say a Level 3 triage incident
26:05
response side of the house because you want your own people
26:10
to know exactly where to go, what to do, and be able to react
26:15
in a split second. And while a managed security
26:17
team can do, you know do that well for most organizations,
26:23
you're never going to be as intimately familiar with your
26:25
own, with an external entity as you would be on your own
26:31
internal side. So there's definitely where we
26:35
find the the best examples of successful security teams is
26:43
where there is a blend of pulling in you know managed
26:47
security or external help in the appropriate areas while still
26:51
maintaining your own, you know small core security team to help
26:56
out. So definitely and something back
27:00
to to add to Todd's notices. So from where we sit, the
27:07
avenues of how threat actors get in are still the same ways.
27:13
Meaning it's still the low level tasks that need to be done, the
27:17
patching, making sure that users are not clicking on things.
27:21
It's the basic hygiene that will stop the majority of the
27:25
threats. And Todd talked about all that.
27:27
But being a little bit older than the rest of you all can
27:32
call it still goes way back to to early times in in watching
27:38
and managing security. It's checked your front door.
27:42
Make sure there's you know as little gap as possible and you
27:47
know, make sure that you use armed your own personal team,
27:50
your your staff and all the business partners to understand
27:56
where the risks come from and set that priority accordingly.
28:00
But at the end of the day it's it's always the basic hygiene
28:03
stuff that that gets a lot of our clients.
28:06
I'm the master of analogies here, and one of the things I
28:08
like to accord you back to is, you know, look it, if you were
28:12
going to, if you were going to commit a criminal act, right?
28:14
Especially like breaking and entering or something like that.
28:16
Would you rather break into a house and has a bunch of
28:18
security, lighting and fences around it, or would you have to?
28:21
Or would you be more advantageous to break into a
28:23
house that's got a bunch of overgrown bushes, no lighting,
28:26
perimeter lighting, things like that?
28:27
Well, that's obviously going to be the the target of opportunity
28:30
there at that point. And I I I've written several
28:33
times about this on our RSM blog.
28:35
But you have to make yourself just sometimes unattractive
28:37
enough to waste time so that they move on to easier targets
28:42
sometimes. And doing those small things is
28:45
a big piece of that. Yeah, we've talked about this
28:47
where you have to you don't have to be faster than everyone else,
28:49
just faster than your friends when the bears chase.
28:51
That's right. Exactly that, that that is true
28:54
for a lot of us. I mean to be be honest, like it
28:56
does seem kind of cliche and funny, right?
28:58
But that is you know, if you're if you have a a semblance of
29:03
roadblocks or making it difficult for threat actors to
29:06
achieve their goals on objectives.
29:08
I mean, time is money to them just like it is time is money to
29:11
us in the business world sometimes, right.
29:12
So you move on to deals that are more lucrative and going to, you
29:16
know, return your investment. Super, right?
29:18
I think it's probably worth calling out that there's
29:21
different types of attacks, right?
29:22
If you are, you know, a random recipient of something like
29:26
that, that might be. But if you're a target, somebody
29:29
is literally targeting your organization.
29:31
Now we're talking about a different level of threat,
29:33
right? Really doesn't matter how much
29:35
faster you are because they are looking to specifically get into
29:38
your place. How does that play into the work
29:43
that the SoC does? They become aware that, oh,
29:45
there is a target, you know, that there is specific target on
29:48
someone's back when it comes to this?
29:49
Or does that get discovered as you go through this process?
29:52
Walk me through what they're like.
29:53
Absolutely. So one of the components of our
29:55
service, we have a, you know, a very good threat intelligence
29:58
apparatus in our team. We have people that spent years
30:02
doing threat intelligence for the government, things like
30:04
that, right. Yeah.
30:06
We do run across through some of our open sources of
30:09
investigation that or a pending attacks clients are trying to
30:13
purchase and broker access into these certain client
30:16
environments and things like that.
30:17
And we do get heads up on those. Hey, you're correct Jeff.
30:20
The and the one thing I'll say is you know once you do have a
30:22
target on your back and you're not a victim of I would say some
30:25
commodity drive by malware, right, or ransomware, you have a
30:29
serious problem on your hands. Because if depending on the data
30:33
that you have and what you have and what they want right is good
30:36
enough or great enough, like they will continue to come back,
30:39
right. And they will not continue to
30:40
come back and just attacking you directly.
30:42
They'll come at your compliances or regulatory bodies.
30:45
They will come at you through third parties and vendors, right
30:48
to try to gain access and the the attack surface just
30:51
continues which if you have somebody that is confirmed
30:54
action targeting you or the data that you have at that point you
30:58
have seriously. Steady.
31:00
I mentioned a long history in this, and that's something I
31:01
want to ask you before is, have you seen the evolution of how a
31:05
sock operates change over the years or is it still
31:09
fundamentally? The same the demands and the
31:13
stress on a sock nowadays is I'll say tenfold just because of
31:21
the expansion of where the the threat sources can come from,
31:25
where the threat actors are targeting.
31:27
And as we have progressed moving from on Prem equipment to the
31:34
cloud back to on Prem back to cloud and cloud really taking a
31:40
hold right now with everything we do, you know with SAS based
31:43
platforms etcetera. The, the number of
31:48
investigations and the number of sources of potential threats is
31:53
exponentially larger than it was even 10 years ago.
31:58
So that evolution will continue until there's until the threat
32:03
actors are gone, which is never going to happen at this point
32:06
because again, they're driven, they're a a business just like
32:10
anything else. And as long as they have some
32:14
motivating factors whether it be political, financial or
32:17
whatever, it's still going to still going to happen At the end
32:21
of the day we're we're human for right now until AI takes over at
32:25
some point. But we're we're human right now,
32:28
and things are going to be accessible and all the good
32:35
intention that we can possibly do is not going to prevent every
32:39
single attack. One thing to expand on there
32:41
real quick is you know I think Steve had a a big point there
32:44
right is we on the defensive side of the house and this was
32:47
even true. You know back in the day we're
32:49
working out the government stuff like that was we have to get
32:51
right all the time, right. And we have levels of, say,
32:54
bureaucracy that we have to go through to plug in a proverbial
32:57
Ethernet cable, right. They, these people don't have
33:00
that level of bureaucracy. They're very agile.
33:02
They're very, again, motivated. They don't have to ask for
33:05
permission and they just have to get it right once.
33:07
Right. So the stakes are high.
33:09
And also what Steve mentioned too is, you know, at the ongoing
33:13
relation to data, right. There is so much data out there,
33:15
right. And that's that's one thing I
33:16
try to stress their clients is, you know, you know, they want to
33:19
collect this data source. They collect that data source.
33:21
And sometimes you have to ask, well, why?
33:23
Because now we have to secure it.
33:24
There's, there's some good use cases for that, right.
33:26
And there's some good use cases for not collecting.
33:29
But you don't have to secure it. Steve, I want to make this
33:31
actionable for our listeners, something that they can take
33:34
away and maybe something that if they are responsible for
33:39
security operations that they can do something to improve
33:42
their world. And I started off the question
33:45
of when should I build my own sock and when should I go to the
33:49
manage service route. It sounds like there's this,
33:52
it's really a shade of Gray in a lot of cases.
33:56
But I also want to know like what are the economics?
34:00
And putting it to the point like, OK, maybe I have a soccer
34:05
ready. It's something I run in house,
34:09
maybe it's partially I'm using some managed services.
34:13
How do I look at that? But also like if I'm Greenfield,
34:17
I don't have this today, you know, how do I approach this
34:21
from, you know, whether or not to start from scratch and built
34:25
on my own versus going to manage route.
34:30
So a a lot of things to consider, Jim, in that question
34:34
and for the listeners on this podcast, it's it's imperative
34:40
that you understand there's no right or wrong way to do this.
34:44
At the end of the day, as long as you are meeting the security
34:49
objectives of your organization, you can do this in whichever way
34:53
makes the most sense to to achieve those objectives.
34:57
But the first thing you need to do is understand what is
35:01
governing the outcomes from your security perspective.
35:06
Meaning are you compliance driven, are you driven by merger
35:12
and acquisition targets? Are you driven by your own data?
35:16
Are you driven by your intellectual property?
35:21
Like there are various ways that you could be governed by and
35:27
once you understand what that is then come back and say OK, I
35:32
have a team of three people currently they're doing you
35:36
know, some IT, some security and you know some running around
35:40
field service type activity. You don't have a full-fledged
35:44
stock because again, three people are not going to cover 24
35:47
hours a day and the misnomer that threats only happen 8 to 5
35:52
long time out the window. So organizations that only that
35:57
think they're protected just because they are doing it while
36:02
they're working. Most of the time your threat
36:05
actors are ten time zones over and they are just getting
36:10
started. Oh, it's imperative that you
36:12
also realize that if your environment, if your business is
36:18
doing any kind of digital transaction of any kind, then
36:23
you're susceptible. No matter how small or how large
36:27
you are, and a lot of times the smaller organization don't
36:31
realize how susceptible they are because they're they could
36:36
affect companies upstream based on how many you know what third
36:43
parties are involved in the process.
36:45
So once you identify what your objectives are, what your
36:51
current basis is, at the end of the day it comes down to people
36:56
and or technology to support the effort.
37:00
While you can do this with you know traditional Sims or cloud
37:03
based services or XDR or you know pick your acronym of
37:07
choice, you still need to make investment in people to
37:11
understand what that is. Right now, there are things that
37:15
AI is going to help with certainly down the line as that
37:19
gets smarter and adapts to threat active models etcetera.
37:24
But for right now, it still needs to have some level of
37:29
human involvement to to make the right executions for the
37:33
business at hand. A lot of times, you know, like I
37:38
said you you're going to need north of $1,000,000 probably
37:41
just to get started between having enough staff, having the
37:44
tools to do it and writing and training all of the people
37:50
writing the policies for all the folks constantly updating and
37:54
training to stay abreast of current threats.
37:58
So there's a lot of things to really consider that I want the
38:02
the audience to understand that it's not, this is not you turned
38:06
it on tomorrow and then you're ready to go.
38:10
We want to make sure that, you know, folks are successful
38:14
wherever they are in whatever fashion they want to do.
38:17
That's a great answer. You covered a lot of ground
38:19
there, Todd. I was kind of like keying off of
38:22
some of the technologies that Steve mentioned there early on.
38:27
I guess one of my fundamental questions is you know when you
38:30
look at a sock, what are you doing?
38:32
Are you like doing that, that SIM function like pulling in the
38:37
logs from systems is it that plus some walk us through that
38:42
what you know more or less it's kind of like how do I get
38:45
started but it's more just explain to folks like how's the
38:50
SoC thing done. Yeah, Jim, that's a good
38:54
question. There could be a long answer
38:55
that could be a short answer. And the short answer I'll give
38:58
you is as a General practitioner in the SoC, I would want as much
39:03
data backing up my analysis and investigations as possible.
39:06
So data from whatever disparate sources or systems or stack
39:10
tools that you may have, you know, including Identity, even
39:14
tools that people wouldn't think would be relevant to security
39:17
operations. I can assure you it's 2:00 in
39:20
the morning and something's going on, They are 100%
39:23
relevant. If I if it requires me as the
39:26
the operator there to make a determination to bring down a
39:30
domain controller because something's weird going on or
39:32
disable AVIP user in the middle of the night, right.
39:36
The more context is better, right?
39:37
That's one of the things that Identity is helping doing is
39:40
bring context to a lot of the security alerts, right,
39:43
especially around what the roles are, the permissions that may be
39:46
in the organization. Identity is is key to bringing
39:50
along that context in that we need to make those decisions
39:52
ultimately sometimes within 15 minutes and less depending on
39:56
what SLA's are and things like that.
39:58
But you know again at the other side of that, you know Jim is
40:02
you know what we're doing is monitoring, detecting.
40:05
Responding and trying to prevent threats, rights, and monitoring
40:09
requires bringing in all that data, right?
40:10
We don't have the data, and especially if you don't have it
40:12
brought in into a normalized taxonomy, you're also going to
40:16
have a problem there from a stock perspective.
40:17
So a lot of the SIM systems do a lot of good job with that today.
40:22
And then the detection piece is also hard to do right just
40:25
because you go out and spend a bunch of money on a SIM system.
40:28
It's just a framework, right? Same thing with a bunch of EDR
40:30
tools. You can go get the new shiny EDR
40:33
that's off the shelf and Black Hat, right?
40:35
And it's still not going to really do all that good for you,
40:39
right. I mean there are it had gotten
40:40
better but if you don't have a threat detection engineering
40:44
team or something like that writing rules for what is bad or
40:46
what known is known bad environments, it's going to make
40:50
that tool less and less effective, right.
40:51
And less ROI and you're end up going to ripping it out and
40:53
replace it for another blinky shiny box, right.
40:58
So yeah, there's a lot of work as Steve said going into that,
41:00
right. And but yeah, I mean those the
41:03
data is the most important thing, right?
41:05
And having the data normalized, when we're searching username or
41:08
source ID, it's searching across all of those systems in these
41:11
these taxonomies so that we know what we're applying to and we
41:15
see all the whole context. Yeah, to add to what Todd's
41:19
saying because he's 100% correct, but being that this is
41:22
an identity podcast, we want to make sure that we keep bringing
41:25
back the role of not only the user, but the asset that ties
41:31
everything together as well. The understanding what is normal
41:37
behaviour from abnormal behaviour is such an important
41:42
piece of what the SoC is monitoring.
41:44
Knowing that they ordinarily a person accesses these five
41:49
applications every single day, well, all of a sudden on day six
41:54
they access something that they have never done before and it's
41:57
not in their business context to do so.
42:01
That should send up a red flag immediately, and it does.
42:04
If you're configured properly in the underlying systems, it will
42:10
raise a flag as far as changing the risk score of that
42:13
particular user. A lot of alerts come from
42:19
identities logging in from remote locations that they're
42:23
not usually coming in from, and a lot of it is noise because of
42:27
VPNs and people are travelling. We're, you know, we're global
42:30
society at this point, so a lot of it is noise.
42:33
However, unless somebody is visiting Nigeria or Japan or
42:40
China or whatever, like why would somebody be locking in
42:44
from those places? And your VPN's are not going to
42:47
be sourced in those countries. So that's the time that you want
42:53
to at least investigate. Well wait a minute.
42:55
You know, Joe Smith has never left the country while
42:59
somebody's locking into here, so it is super imperative and has
43:05
been an increasingly necessary data source for any suck at this
43:12
point given the proliferation of of how identities are used.
43:17
And just to lay on to that, even a more tactical perspective,
43:19
right, a lot of these, it's good to know that Joe is logging in
43:23
from Laos, right, or Vietnam or something like that.
43:26
But what user agent he's using to do so, comparatively to the
43:30
old ones he's seen on the environment, what Windows device
43:33
or what operating system they're using, things like that are in
43:36
very important context that these identity systems are
43:39
bringing in from the SoC. So help me understand this from
43:43
a step by step process. Can you kind of take me through
43:45
with the anatomy of a breach would look like where does
43:49
what's the SoC doing to to prevent this or to mitigate the
43:53
chances of this happening? Todd, I don't think you were
43:55
kind of talking about maybe putting some examples together.
43:58
I'll hand it over to you. Yeah.
44:01
So great question. I mean, there is going to be a
44:04
couple phases that are always absolutely every, I guess breach
44:07
or incident, right, or cyber attack, however you want to lay
44:10
it out. There's going to be some level
44:12
of reconnaissance that the adversary is going to do against
44:15
you, right. They're going to use that to
44:17
determine weaknesses, vectors of infection, right, attack
44:20
surfaces that they can go after, right.
44:22
It's like any good research, right.
44:24
I mean, you know, and you know, Jim brought this up earlier,
44:26
like a lot of it sounds military because it's kind of like that,
44:29
right? The the methodologies behind it,
44:31
they certainly were like in a lot of ways that's why you see a
44:35
lot of, you know, typically ex military, ex government people
44:39
in, you know, cybersecurity, things like that as well.
44:42
But I digress. But yeah, so there could be some
44:44
sort of a constant stage that they're going to go after to try
44:47
to probe you, essentially or figure out what you're about,
44:50
right? That could be social engineering
44:51
attacks, phishing emails, right? Things like that.
44:55
And then there's going to come a phase of initial compromises
44:57
when they're going to make their vector an infection, right?
45:00
They're either going to exploit some sort of software that
45:02
phishing e-mail they sent. It's going to be successful,
45:05
right? They're going to take advantage
45:06
of, you know, a vulnerability or something like that.
45:10
The third phase of that is really going to be, you know,
45:12
maintaining persistence. Once they got a slip holding
45:15
machine that the next thing I'm going to do is a threat.
45:17
Actors make sure I don't lose access, right?
45:19
And that's where we're also seeing a lot of the monetization
45:22
of attacks nowadays. That's where some people stop,
45:25
right? There's things out there in
45:27
industry, initial access brokers, but that's all they're
45:29
doing, going and getting access and selling that apps.
45:31
They're not actually, you know, encrypting anything, stealing
45:35
anything per SE, right? But they're compromising the
45:38
systems to then send it to somebody or self somebody who is
45:41
going to take that, that next step, right?
45:43
So once they have a foothold in your system, and at this time,
45:45
they're usually either creating new accounts, creating new
45:48
identities, you know, just maintaining access, right,
45:51
creating back doors, web shelves, whatever it may be that
45:53
they're going to use to maintain access.
45:55
They're going to try to move around laterally in the network,
45:58
right? That, you know, expands their
45:59
access to the network. They'll start trying to figure
46:01
out where they are. One of those systems they can
46:03
hit, you know, because you get into a network, you don't really
46:06
know where you're at sometimes, right?
46:08
Or if you're on an an end user machine, you want to get more
46:11
access to see if you can get admin rights, things like that,
46:14
right? There's usually that's going to
46:16
get followed by some sort of like initial attack payload or
46:19
installation of attack, right, installing like exfiltration
46:23
tool tools or remote desktop softwares that we're seeing now
46:26
like this is recording now any guests.
46:28
The incident just happened the other day, things like that,
46:32
right? Or they could be using your
46:33
infrastructure to support their observations for like crypto
46:36
mining and things like that. Usually some sort of malware is
46:39
involved in that in that stage. The last two stages are probably
46:43
the most important ones, right? Is the actions and the
46:46
objective, right? So the actions that they're
46:48
going to take is ultimately stealing the data, disrupting
46:50
your operations, which is also there for where there's a lot of
46:53
this organizations out there that just want to bring down
46:56
services and nothing else, right?
46:57
But this is their actions on objectives, to their goals.
47:00
You're going to start seeing the data getting X filled, right?
47:02
Deploying ransomware, things are going to start getting
47:05
encrypted, right? Mile of service attacks are
47:07
going to start happening. And then finally, the last, the
47:10
last bit of it is the escape plan, right?
47:12
Is getting out right? Destroying evidence, avoiding
47:16
detections, right? And usually that's where a lot
47:19
of breaches and incidents are detected.
47:20
And that's where we don't as a defensive operator, right?
47:23
That's not where we want to catch things when things are
47:26
going off at the end of the day. And essentially at that point,
47:28
you've lost, right? This is where they're erasing
47:31
your evidence, coming to tracks, clearing audit logs, disabling
47:35
other security tools, right, things of that nature.
47:38
That's the general 30,000 foot overview of the Anatomy of
47:41
attack. And you can see there in just
47:44
some of those things I mentioned where identity would play a
47:46
large role in helping provide context and stocks attacks as
47:49
well. Yeah.
47:50
I was thinking as you're going through that, that there are
47:53
certain steps along the way that probably have a certain
47:57
signature or footprint to them where it's like, OK, I've got,
48:01
I'm on a laptop, I've got administrative access.
48:04
Now I connect to a download site on the dark web, quote UN quote
48:10
or in Russia or wherever you're like, Now you go out and connect
48:15
to that site. That's a pretty hot indicator,
48:20
right? Well.
48:21
Jim I I think that's the The thing is like it's even easier
48:25
than that, right? That's what you think is
48:27
happening. That is not what's happening.
48:29
What is happening is they're using the same shared services
48:32
infrastructure that everybody's using.
48:34
If I'm a threat actor and I'm ex filling data to some tour node
48:39
in Russia, like that's that's some rookie level stuff in my
48:42
opinion. Like that's to be serious,
48:44
right. I'm going to spin up a new
48:46
Amazon EC2 instance attack you from infrastructure that's not
48:49
listed on any list. It's not showing out in any
48:51
country using Azure services, right.
48:55
Things like that to pull data to known good IPS.
48:57
And this is how they're good at blending in or provide, you
49:01
know, a back end to a bulletproof hosting
49:03
infrastructure where they can't get taken down.
49:05
They're hosted out of contentious regions like
49:08
Ukraine, South southern Ukraine, right.
49:10
No one's going to go serve a subpoena to take down a server
49:13
and Don stock right now, right? It's just it's just not
49:15
happening. But yeah, I mean, it's even it's
49:18
even simpler than that, right? I mean we've even seen attacks
49:20
where you know we had a a regionalized hospital that was
49:25
based in the Northwest of the United States, like all the
49:29
attacks came from Seattle like where they're located.
49:34
So the adversary again during that reconnaissance phase knows
49:36
where their infrastructure's hosted.
49:37
So that would blend in better to say sending something to
49:40
Nigeria. I mean if that go, if that's
49:41
going to Nigeria or you know Russia, like we're going to pick
49:45
up on that immediately and shut that down making it harder by
49:50
blending in with what is known good, right.
49:52
They're using Amazon, they're using GCP, they're using Oracle
49:54
Cloud, right? Using those infrastructures
49:57
against? Right.
49:59
Yeah, that's cool stuff. I mean it.
50:01
Well, cool from the standpoint, like, I didn't think of.
50:03
I agree. But.
50:04
It's all about not being detected, right?
50:07
Yeah. And that's the some of the
50:08
things. I mean that's where a, you know,
50:10
a sock operator's job and an analyst job is harder, right?
50:13
It is. I tell people, I've I've done a
50:15
lot of sock analyst interviews in my time and I tell people
50:18
like it is the most rewarding and thankless job at the same
50:22
time, right? Because your job is difficult,
50:25
right? If something, what one little
50:26
thing gets through, it's coming down on you right to some
50:29
degree. Hopefully you have leadership
50:31
that'll help stable that for you.
50:33
But you know, essentially right, you have to get it right all the
50:36
time, right? And that's that's where they
50:38
just have to get it right once. Equated to equate it to a
50:42
football game, You're on defense.
50:44
You have no idea what play is being called on the offense side
50:47
and you asked to prevent them from getting to the end zone or
50:51
scoring. That's in essence, the job on
50:54
the sock side is to make sure that you've laid out all of your
51:00
defenses possible to try and prevent them from staging
51:05
forward. And it's it is never going to be
51:10
100% effective. But it's your job is to keep as
51:14
many of the the bogeys out of the end zone as possible.
51:18
And Todd's right, it is a super rewarding job.
51:22
It is super hard, but a lot of organizations don't, you know,
51:29
they don't always provide the the backing and support for
51:32
folks in that role. So it is a high burnout you
51:36
know, type of. Role it's It's an easy
51:37
apparatus. Yeah.
51:38
It's an easy apparatus to blame when something goes wrong.
51:40
Right. When there's, you know, systemic
51:42
problems above that, right, From a program standpoint, you know,
51:46
a maturity standpoint, things like that, right?
51:48
Yeah. I hope you're picking up like
51:50
our passion for what we do, because it doesn't matter the
51:54
organization, it like this is a necessary item to protect
52:00
yourself, your clients, your customers, etcetera.
52:04
And unless you have some level of passion for it, it's not
52:07
going to be done right. So that's when you you really
52:10
need to look and say is this what we really should be
52:14
spending our efforts on or do we rely on some experts to kind of
52:17
help us with that. So you'll you'll get the sense
52:20
of Pad and I probably should do our own podcast at some point,
52:24
but you'll get the sense that we have passion for this topic
52:27
because it is super important for us and and what we do.
52:31
I got an idea. Sock at the center there.
52:33
You go something like that. I got two final questions then
52:37
we'll end on a lighter note. You kind of touched on my first
52:40
one, which is what happens when things breakdown?
52:43
Nothing is perfect. What happens when something gets
52:47
missed? I mean it's got to happen in the
52:49
real world, right? What's I guess, Steve, what
52:52
happens when you know the service fails?
52:56
So dependent upon the threat actor and the type of vector
53:00
that they're getting in, it could be.
53:05
Let me take a step back, This is why you don't have one layer of
53:09
defence. You have multiple layers of
53:11
defence. So if they get through the first
53:14
layer then your secondary control should take into effect.
53:19
So say an end user clicks on a fishing link, so they first
53:25
first layer destroyed, they got through.
53:27
But your second layer, your DNS, your endpoint, your your e-mail
53:34
threat protection, that should be your second layer of defence
53:38
protecting you from any further home.
53:41
Well now if you have a third like they get through that
53:44
somehow because your controls were not as effective.
53:46
Now you have a third layer of defence where use isolated
53:51
networks to control that. OK, so if somebody actually did
53:54
get in, it's only going to affect these 20 assets right
53:59
here. So it's important to implore or
54:05
you know that perform a defence in in depth kind of strategy as
54:10
it relates to protecting environments because no single
54:14
line of defense is ever perfect and you want to make sure that
54:18
you are at least isolating your critical assets away from
54:22
anything that could be impacted. So that critical fountain jewel
54:27
is defined by the organization as you know, IP formulas,
54:33
secrets, trade secrets, etcetera.
54:35
Like you need to keep them as quote, UN quote air gapped as
54:41
possible such that they do not get exposed because ultimately
54:45
that could be not only brand reputation but.
54:49
You know, long term effects of of impact to the group.
54:53
Yeah. Making catastrophic to the
54:54
business, Yes. Trying to avoid that.
54:57
All right. So you guys have sufficiently
54:59
scared me. But what if I'm not scared and I
55:02
want to become a sock analysts? What would you recommend for
55:05
somebody who's listening out there?
55:06
It's like, oh, that sounds interesting.
55:07
How do I get into that world as a as a newbie or a beginner in
55:10
the space? A Todd, I don't know.
55:13
Maybe we'll start with you. Yeah, you got to you got to be
55:18
curious. I think that's the thing, right?
55:20
A lot of, and this could be a whole other episode on, you
55:23
know, kids that are graduating out of the the education
55:27
programs around Cybersecure. There's a there's a worldwide
55:30
industry talent shortage. I can understand some of that.
55:34
But a lot of them aren't coming prepared out of school to be SoC
55:38
analysts. But you have to be curious,
55:41
right? If you think you're going to sit
55:42
back and wait for these tools to make detections for you and
55:47
you're not going to understand the fundamentals of how those
55:49
detections were formulated and made and things like that, like
55:52
you're going to have a hard time.
55:53
I think at least here at at RSM, you're going to have a hard
55:56
time. But yeah, you got to, you got to
55:59
understand you also have to check your ego at the door,
56:01
right. There's things that you and
56:02
Jeff, you know, Jim know that I don't know.
56:04
There's things that I know that we, you know, you don't know.
56:06
We have that kind of mantra in the security operations center
56:10
here at RSM is, you know, everybody knows something,
56:13
everybody brings something different.
56:14
It's a real a real team aspect around that and we have to we
56:18
have to parlay off each other and you have to be OK with
56:20
getting it wrong. So as long as you're doing and
56:22
what your actions are doing at the time and your analysis to
56:25
justifiable and defensible you know trying to protect and do
56:28
what's right for the clients. I don't think you're ever you're
56:30
a problem out of me right. But it's when you're not doing
56:32
anything right that's the problems.
56:34
But yeah, I mean you got to again, this is another thing is
56:38
like I don't know what I would do if I had to do this job over
56:43
again. And like I I don't want to seem
56:44
like this is belittling or anything, but like if I had to
56:47
put steering wheels on that like a car manufacturing, like I
56:50
think I'd go insane like every day doing the same job over and
56:53
over. This job is very repetitive.
56:55
But what changes every day is the tactics and techniques in
56:58
there. So you're constantly having to
56:59
learn new ways to make detections, see the activity,
57:03
see the traffic you're going out.
57:05
So it's very exciting from that point that they're they're
57:08
always trying to game one up on your right, the red active,
57:11
right. So it's a constant learning
57:13
battle. Your learning never stops.
57:15
And you know, frankly, a lot of the, you know, if you're going
57:18
to get into the sock business, you know, understand like it is
57:21
a tough game as well too. There's rotating schedules.
57:23
Like we don't shut down, right? We're like 7-11.
57:25
We're always out. That's hard on people too, or
57:29
especially working overnight shifts.
57:30
When I first started doing this, I I, I worked in a sock full
57:33
time and went to college full time.
57:35
So I would work 5:00 PM to 2:00 AM every night, class the next
57:40
day. It's very rough, but you got to
57:41
want to do it. It's got to be a passion of
57:42
yours and we definitely see a a difference in the people that
57:46
have a passion for it versus people that want to do it.
57:49
So you have to be willing to be wrong.
57:51
You got to continuously learn and you got to put yourself out.
57:53
Steve, anything to add? No, he he stole my Thunder for
57:58
me the when I'm doing interviews and obviously Todd and I are yin
58:03
and Yang on on interviews. So what I'm looking for is I can
58:09
teach most people anything. So from a technical perspective,
58:14
unless worried about did you go to this SANS course or did you
58:19
learn this particular thing or did you get this, you know, SEC
58:24
plus certification, etcetera. Like we can teach people that if
58:28
you aren't a fast learner and curious about why a certain
58:34
thing happens, your success as a sock analyst will be difficult
58:39
because it's that curiosity that drives your thought patterns on
58:44
where to look for things. And once we would teach you the
58:51
the past to look for, then it's up to you to to put all of that
58:55
together and say OK, now A does equal BC and then I goes to a
59:01
letter that I don't know yet, but I know that it's not, it's
59:05
not something that is correct or a positive outcome.
59:10
So it really comes down to how curious you are about learning
59:16
and what the next thing is. So just like a a four year old
59:22
or whatever asking the constant why that's the that's the kind
59:26
of mentality that actually will do well as not only a sock
59:31
house, but as an Internet responder and as other areas in
59:35
the detect and respond side of the house you.
59:39
Got to have an investigation mindset, an investigation based
59:42
mindset, right? I I equivalent a lot of it too.
59:44
And I tell this to the sock team, especially the new people
59:47
that have never worked in a sock is you know, you're a police
59:49
officer you show up to a crime scene, there's it's just you and
59:52
whatever's in front of you and the crime scene, right.
59:55
What do you do? Well, you got to start asking
59:56
neighbor, right? I start canvassing the area,
59:58
looking for cameras, looking for evidence, right?
1:00:00
There's there's a bunch of things that in that
1:00:02
investigatory mindset that you have to have and it's the same
1:00:05
thing translates into stock, right?
1:00:06
An alert goes off. That's just the genesis and
1:00:08
where you need to begin. Like where do I need to go find
1:00:10
fire on logs? Who is this user?
1:00:12
What are they doing on the network?
1:00:13
What access roles do they have, right.
1:00:16
You got to go through all that very quickly too.
1:00:17
All right. So we're up over an hour.
1:00:19
We're going to start to wrap it up.
1:00:21
We got a little serious there at the end.
1:00:22
So we got to, we have to end on a lighter note.
1:00:25
Steve, you brought up a Super Bowl or football analogies.
1:00:28
We're going to talk about the Super Bowl.
1:00:29
Here's my my question for all of you.
1:00:32
So by the time people listen to this, it's going to be Monday,
1:00:35
February 12th. the Super Bowl would have taken place last
1:00:38
night. We're recording this a week in
1:00:40
advance. Who is going to win the Super
1:00:42
Bowl and why is it going to be the 49ers?
1:00:45
Todd, we'll start with you. Well-being a Philadelphia sports
1:00:50
fans, I hope none of them win. I'll say that.
1:00:54
But I think the I think the Chiefs are going to win.
1:00:58
I think their their offense is too potent.
1:01:00
Their defense has been stepping up recently in the last couple
1:01:03
of weeks here, especially in the playoffs.
1:01:06
I think equally could be said about the 49ers, but I just
1:01:08
don't think they have the the talent there on the offensive
1:01:11
side to get it. Done Boo.
1:01:12
Wrong answer, Jim. How about yourself?
1:01:13
Who are you picking between the 49ers and the Chiefs?
1:01:18
I was hoping not to even have this conversation with you,
1:01:20
Jeff, because obviously you're biased.
1:01:22
OK, but I. Don't know what you're talking
1:01:24
about. We're vendor neutral here.
1:01:26
Vendor neutral will accept. When it comes to NFL, I'm going
1:01:31
with the Chiefs and the reason why is Patrick Mahomes.
1:01:34
I mean look at all those Super Bowls that the Patriots won.
1:01:39
And I think it came down to Tom the GOAT.
1:01:42
And yeah, that's. I just think that Mahomes is
1:01:47
going to find a way to win. Sorry to tell you that, Jeff.
1:01:50
I don't think it's going to be a blowout, but I do think he's got
1:01:53
the edge. All right.
1:01:55
Oh, for two, Steve. All right.
1:01:56
So why are the 49ers going to win?
1:01:58
So everyone's. Ignoring the elephant in the
1:02:01
room, the reason the Chiefs are going to win is because of
1:02:03
Taylor. That is the reason that they're
1:02:06
going to win. At least that's the way the
1:02:08
media will have you believe. Finally, a real NFL analysis
1:02:12
getting done here. I think she just won a Grammy
1:02:16
last night. Obviously I'm I'm unfortunately
1:02:18
not in the United States so I can't see the the Grammys from
1:02:21
where I am and in El Salvador currently did win.
1:02:25
Besides the fact as a loyal Philadelphia fan and
1:02:30
unfortunately Jeff you're you've got three of us on the call here
1:02:34
on the podcast today. I don't know how you did that
1:02:38
and witnessing what happened last year when the Eagles should
1:02:43
have won that flipping football game in the Super Bowl, there's
1:02:48
no way Kansas City loses the game again.
1:02:51
It will not be a blue out, a blow out, but I I just they got
1:02:57
hot at the right time of the year.
1:02:59
They were really mediocre or horrible in the beginning part
1:03:02
of the year, but they turned it on at the right time and I think
1:03:06
it's it's just a matter of time to to complete that.
1:03:09
So, unfortunately, it will not be the 49ers.
1:03:12
It will be Kansas City Chiefs. You know, it's a real shame to
1:03:15
have so many smart people on this podcast and not be able to
1:03:19
to to pick the right team here. Ruin it in the last 30 seconds.
1:03:22
That's right. I'm going to cut this out.
1:03:24
Since I do all the editing, I'm going to make you guys say, Oh
1:03:26
yeah, the 49ers going to win. I obviously I'm going for the
1:03:29
49ers going to stand forever. It will continue to be so I
1:03:33
think they win 3528. I think it'll be a close game.
1:03:36
I don't want it to be a blowout. I want it to be a good.
1:03:39
I think that's yeah, the lock it in, get those bets in and don't
1:03:44
hold me accountable. This has been a great
1:03:46
conversation. We're going to leave it there.
1:03:48
I know that there's all kind of a lot to cover.
1:03:50
This is kind of the the beginnings of it.
1:03:52
But I'm glad you guys were able to make some time for us to talk
1:03:54
through this. I think this is an area that
1:03:55
again a lot of people hear about, but they don't really
1:03:58
kind of get to peel back and look behind the curtain
1:04:00
sometimes. So I appreciate you guys taking
1:04:02
the time with us. We'll have some links in our
1:04:04
show notes for people to check out.
1:04:05
You know, Todd, you mentioned some blog stuff that you've
1:04:08
written. So we'll get a a link to that in
1:04:09
our show notes if you want to check that out.
1:04:11
And then if you guys want to connect, we always put LinkedIn
1:04:14
profiles so you can connect with Todd and Steve as well as Jim
1:04:18
and myself as we go through that.
1:04:20
And then we're on the web, idacpodcast.com, Twitter at IDAC
1:04:24
Podcast, Mastodon at IDAC Podcast at infosec, dot
1:04:29
exchange. Still don't like the way Macedon
1:04:31
does their names, but nothing to be done about it right now.
1:04:35
Like subscribe to all that stuff, keep sharing with it.
1:04:37
I continue to see a Reddit thread that keeps talking about
1:04:40
how people enjoy the show. So hats off to the folks who are
1:04:43
in that thread. Not that I was checking or
1:04:45
anything while recording, but it was kind of cool to see that.
1:04:48
So with that, we'll go ahead and leave it for this week.
1:04:50
Thanks everybody for listening and we'll talk with you all in
1:04:52
the next one. You've been listening to
1:04:55
Identity at the Center. We hope you've enjoyed the show.
1:04:59
Make sure to like, rate and review and we'll be back soon.
1:05:04
But in the meantime, hit the website at
1:05:06
identity@thecenter.com and find us on Twitter at IDAC Podcast.
1:05:13
See you next time on Identity at the Center.