Latest / CYBR.Signal / Security Champions: Secret Weapon Against Shadow IT

Transcript

Security Champions: Secret Weapon Against Shadow IT · CYBR.Signal

• 0:00
  SPEAKER_00: And hello everybody, Michael Farnum here.
• 0:02
  SPEAKER_00: Happy Cyber Sunday, and I hope you're doing well.
• 0:05
  SPEAKER_00: So I wanted to talk about a topic that I've been talking about with my customers a good bit, and that's around shadow IT.
• 0:14
  SPEAKER_00: Now, I don't know if that is going to be what the term is, like when we go to RSA this week.
• 0:20
  SPEAKER_00: I don't know if you're going, but I'll be there from Monday to Friday if you want to say hello.
• 0:25
  SPEAKER_00: And what it is specifically, I think kind of from a technology perspective, is around discovering SAS apps that your different business units have, you know, for a lot of ways legitimately put into their organization or putting their business unit, meaning that somebody has approved it, somebody on the the chain of authorization or authority has approved that to be there, but IT doesn't know about it, security doesn't know about it.
• 0:53
  SPEAKER_00: So it's a big problem.
• 0:55
  SPEAKER_00: And shadow IT has been a problem for a long time, and there's technology that's built now that is very, very focused on the SaaS apps being put into an organization.
• 1:05
  SPEAKER_00: But what I thought was interesting when I was talking to some customers of mine is that they're combating that with something that's kind of an old method, which is putting in security champions or security advocates or security evangelists, whatever you want to call that, within those different business units.
• 1:21
  SPEAKER_00: And that could be a security person, an actual security person.
• 1:24
  SPEAKER_00: That could be just somebody who maybe that works in that business unit and has an aptitude for security or whatever.
• 1:32
  SPEAKER_00: But they're creating those roles uh within those business units, tacking that onto somebody's job that they already have, and then using that to outside of just the technology, discover shadow IT within that organization to educate those business units on why that is a bad thing, and then use that I guess opportunity once they've discovered it and once they've been able to educate them on why it's bad, to say here are the security policies that we can apply to that now that we know it's there.
• 2:13
  SPEAKER_00: So it's it's kind of a two-pronged approach.
• 2:17
  SPEAKER_00: If you want to approach it, one from the technology perspective, let's use technology to discover this.
• 2:23
  SPEAKER_00: This could be this new technology that I'm talking about, and there's a couple of couple or three of them out there, too.
• 2:28
  SPEAKER_00: I can name off are Obsidian and Grip, and maybe I know there's some other ones.
• 2:32
  SPEAKER_00: I think App Omni does that, if I'm not mistaken.
• 2:35
  SPEAKER_00: And then on top of that, you have security champions within those organizations who are, you know, some people might call it spying, but I don't really think it's that way.
• 2:47
  SPEAKER_00: They're just looking out for that to see if it's there, and not just immediately saying, Oh, you can't do that, that's bad.
• 2:53
  SPEAKER_00: Stop doing that, take that off the network.
• 2:55
  SPEAKER_00: It's seeing what the legitimate purpose, business use is for that application, and then figuring out how to secure it, and those could be through methods of like uh federating the ID, bringing that into the organization where you can do single sign-on, you can do change of passwords, those kind of things, and then you can take it down when that employee leaves the organization if it's no longer needed for whatever reason.
• 3:22
  SPEAKER_00: Um, so I just thought it was kind of an interesting use.
• 3:25
  SPEAKER_00: So, an old, a new problem, a new style of problem, shadow IT has been a problem.
• 3:31
  SPEAKER_00: So, let me sum up.
• 3:32
  SPEAKER_00: Shadow IT has been a problem for a long time, but SaaS apps and cloud apps and all of that offer a very new way for that to become even a bigger problem, and then you apply a fix like new technologies, like I'm talking about, to help fix that, but then you use an old method of security champions, security advocates within the business units to also fight a new problem.
• 3:58
  SPEAKER_00: So, all of that is just an interesting concept to me, how that's all starting to come together to fight something like shadow IT, but not automatically go, no, you can't do that.
• 4:09
  SPEAKER_00: Have a new attitude about it and say, why are you using it?
• 4:14
  SPEAKER_00: If it's a legitimate purpose, let's fix the problem instead of just cutting it out and saying no.
• 4:19
  SPEAKER_00: So, anyway, I hope that I think that's going to be a big topic from a technology perspective.
• 4:24
  SPEAKER_00: I don't know about from a talk perspective.
• 4:27
  SPEAKER_00: Maybe I'll put something together on that for a talk in the future.
• 4:30
  SPEAKER_00: Just thought it was an interesting uh conversation I had with my customers and let me know what you think.
• 4:35
  SPEAKER_00: Talk to you next time.