Latest / Full Tech Ahead / Smarter Vulnerability Management

Transcript

Smarter Vulnerability Management · Full Tech Ahead

• 0:29
  SPEAKER_00: Hello and welcome to Full Tech Ahead.
• 0:31
  SPEAKER_00: I'm your host, Amanda Rosani, and I'm excited to be here today with Tom Scheffler, the security manager of CentOS.
• 0:37
  SPEAKER_00: How are you doing?
• 0:38
  SPEAKER_01: Wonderful, glad to be here.
• 0:40
  SPEAKER_00: Happy to have you talking with me today.
• 0:42
  SPEAKER_00: Um, so can you share a little bit about yourself and CentOS?
• 0:46
  SPEAKER_00: What services does CentOS provide?
• 0:48
  SPEAKER_01: It's a pretty broad variety.
• 0:49
  SPEAKER_01: So uh uniforms, obviously, that was first and foremost.
• 0:53
  SPEAKER_01: Fires, it's we've a tremendous amount of the fire division is just huge.
• 0:58
  SPEAKER_01: Safety, we have a safety division, we have water, uh, sanitizer, everything you can think of.
• 1:05
  SPEAKER_01: We in a ton of acquisitions, which are mostly fire, and they're looking for new lines to get into as well.
• 1:11
  SPEAKER_01: But I'm not privy to that information.
• 1:13
  SPEAKER_01: So wonderful.
• 1:15
  SPEAKER_01: I hope that answers your question.
• 1:16
  SPEAKER_00: Yes.
• 1:17
  SPEAKER_00: Well, whenever I'm at these conferences, I like to find case studies and user experiences that I can share more about with my audience.
• 1:25
  SPEAKER_00: And so I would love to hear about your experience.
• 1:30
  SPEAKER_00: And I would like to start with what issues were you facing that made you look to Qualis?
• 1:39
  SPEAKER_01: Oh, well, that's pretty easy.
• 1:41
  SPEAKER_01: I mean, we were very disorganized when it comes to um vulnerability management.
• 1:47
  SPEAKER_01: Now, I will tell you that Qual, I I've been with Synthos, I'm in my 10th year, so we already had Qualist when I started.
• 1:55
  SPEAKER_01: So my boss, uh Greg Bowman, brought them on, brought Qualas on board with Centaz, but he was a one-man security team.
• 2:02
  SPEAKER_01: So they brought me on, and then that's when we started to really get into the the Qualist platform uh and realize what we were facing.
• 2:10
  SPEAKER_01: So we had a lot of challenges.
• 2:12
  SPEAKER_01: The teams weren't on board.
• 2:14
  SPEAKER_01: You know, we have the server teams and desktop teams and you know, production teams, and they all have servers in the production environment, or they're using them in just the the server environment in general.
• 2:25
  SPEAKER_01: Uh, end users, some 23,000 end-user devices that just weren't really getting batched and weren't really being monitored properly.
• 2:33
  SPEAKER_01: So that was kind of my goal is to keep that under control.
• 2:36
  SPEAKER_00: Okay.
• 2:37
  SPEAKER_00: And of course, I see this with any company when they're integrating some new technology to solve a problem.
• 2:45
  SPEAKER_00: There's always bottlenecks or roadblocks.
• 2:49
  SPEAKER_00: What did you experience?
• 2:50
  SPEAKER_01: The biggest challenge is breaking old habits.
• 2:52
  SPEAKER_01: Um, so I don't know how familiar you guys are.
• 2:55
  SPEAKER_01: Well, I I guess I'll start with patching because that's the most recent thing, the challenge that we had.
• 2:59
  SPEAKER_01: You know, teams get used to doing things a certain way, and changing that habit is difficult when they've been doing it for several years.
• 3:05
  SPEAKER_01: And my goal was to get the business to work around patching instead of patching work around the business.
• 3:11
  SPEAKER_01: So in order to do that, I had to get support from the leadership team.
• 3:14
  SPEAKER_01: So I I met with the leadership team after coming to a Qualis conference and seeing a patch demo, and just to explain what what I wanted to do, which was roll it out, test it, see if it was worth its weight, and uh it turned out to be.
• 3:28
  SPEAKER_01: So here we are.
• 3:31
  SPEAKER_00: Another problem I often see is timeline.
• 3:34
  SPEAKER_00: How quick was the turnaround for this?
• 3:37
  SPEAKER_00: And when did when did you see it working?
• 3:40
  SPEAKER_01: So my exposure again was a QSC before it was rock on, and that was Greg Dabowski.
• 3:44
  SPEAKER_01: He was uh he's a former Qualos employee, and he's the one that said give it a shot.
• 3:48
  SPEAKER_01: So we did how long?
• 3:51
  SPEAKER_01: Man, relatively quickly, only because our CISO was uh so directly involved, and we had meetings with uh various teams, you know, server team, desktop team, etc.
• 4:02
  SPEAKER_01: And you know, I stated what our goal was in terms of accomplishing patching and getting you know criticals under control.
• 4:08
  SPEAKER_01: And uh he set a goal of like patching all critical patches within 24 hours, and everybody just dropped their chins drop.
• 4:16
  SPEAKER_01: And and he just said, get used to it.
• 4:18
  SPEAKER_01: That's the new that's the new SLA for critical vulnerabilities.
• 4:21
  SPEAKER_01: And everybody was frustrated, and you know, but you know, very honestly, it's just people don't adjust to change very well.
• 4:29
  SPEAKER_01: And once they adopted to change, now it's just it's just everyday business.
• 4:34
  SPEAKER_01: So it probably took 60, 90 days, roughly.
• 4:39
  SPEAKER_00: So fairly quick.
• 4:40
  SPEAKER_00: Now, for other leaders out there who are looking for solutions to their problems, always what I've noticed too is there might be some adjustments or adaptation you have to do once everything is in place.
• 4:54
  SPEAKER_00: Were there any things that you had to go back and adjust or change for it to work properly for you?
• 4:59
  SPEAKER_01: Oh, sure.
• 5:00
  SPEAKER_01: Yeah.
• 5:00
  SPEAKER_01: Uh we discovered a lot of problem.
• 5:02
  SPEAKER_01: I mean, I'll give you an example with a lot of legacy applications.
• 5:05
  SPEAKER_01: Um, I I can I'll speak about Java.
• 5:08
  SPEAKER_01: It's it's a horrible, horrible code, but um, they update it frequently, and we had a lot of legacy applications running on Java.
• 5:17
  SPEAKER_01: And uh when we would patch it would break that.
• 5:20
  SPEAKER_01: So we realized that since it's a production environment, we had to roll back the patching.
• 5:26
  SPEAKER_01: But what we did was we introduced the RAF, the risk risk acceptance form.
• 5:30
  SPEAKER_01: So the owner of that particular application had to sign that and asked the CIO and the CISO to sign it.
• 5:37
  SPEAKER_01: And the odds of the CIO assisto signing it without some sort of timeline tied to it were near zero.
• 5:44
  SPEAKER_01: So it forced the update of a lot of a lot of the legacy applications.
• 5:47
  SPEAKER_01: Um and the business is trying to push forward, so getting them to backpedal and update things was the challenge.
• 5:55
  SPEAKER_01: But we had, you know, bi-weekly meetings to see what the progress was with that particular partner.
• 6:01
  SPEAKER_01: And the first couple of times there's no progress.
• 6:02
  SPEAKER_01: And he goes, Well, the next time we patch this, we're not rolling it back.
• 6:05
  SPEAKER_01: So, you know, you need to be thinking about what you're gonna do to update this.
• 6:08
  SPEAKER_01: So we really had to drive them.
• 6:10
  SPEAKER_01: Uh, and once we got there and we had the, you know, we got them in the mindset that they knew there was a problem.
• 6:15
  SPEAKER_01: The rest of the teams that knew they had legacy stuff started to hear about it.
• 6:18
  SPEAKER_01: So they they got after it before we got to some of their some of their applications, not all Java, but there's, you know, that's the one example I'm sharing.
• 6:26
  SPEAKER_00: Okay.
• 6:27
  SPEAKER_00: Now it seems like it's really critical for all the stakeholders to be on board.
• 6:31
  SPEAKER_00: What advice do you have as far as communication and having good keeping those channels open and communicating effectively?
• 6:38
  SPEAKER_01: Well, I think you have to have you have to meet with the teams.
• 6:41
  SPEAKER_01: And first of all, you have to have leadership support, um, and which I did.
• 6:44
  SPEAKER_01: I had the CIO and the system at the time in the meetings in the beginning, they were involved and they sat down and I said my piece, and this is what the goal is, this is what we want to do.
• 6:53
  SPEAKER_01: We set new SLAs from patching daily to weekly, still bi-weekly, uh monthly, depending on what it was.
• 7:00
  SPEAKER_01: Uh, we made some exceptions for some production devices, and with the exception of critical vulnerabilities, they got patched.
• 7:06
  SPEAKER_01: That was it.
• 7:07
  SPEAKER_01: I mean, if there was a critical, we sent out an email, we have a distribution list, it gets hit, and everybody in the beginning would stomp their feet, you know, we had a patch tonight and validate tonight, but you know, now it's just commonplace.
• 7:18
  SPEAKER_01: So once they get used to it, it's just normal, it's business as usual.
• 7:22
  SPEAKER_00: Absolutely.
• 7:23
  SPEAKER_00: Well, as you know, all these technologies, especially AI, are advancing so rapidly.
• 7:29
  SPEAKER_00: So for your company specifically, what are you looking at next as far as how to harness the technology?
• 7:36
  SPEAKER_01: In terms of AI, well, uh we're still looking for an AI tool to support what we're doing.
• 7:42
  SPEAKER_01: Not that we don't have something that we're using now, but uh we want something we can use long term.
• 7:47
  SPEAKER_01: So, you know, the issue is you're using AI to battle AI.
• 7:52
  SPEAKER_01: You know, the threat actors are now what it from click to compromise, I think it's seven minutes where it used to be.
• 7:59
  SPEAKER_01: Click to compromise was 21.
• 8:00
  SPEAKER_01: So AI has reduced that window significantly.
• 8:03
  SPEAKER_01: So if you're not patched and you're not using Qualists and you're not paying attention to the vulnerabilities and the criticals, the threat actors are taking advantage of um basically the partners, the end user, because they'll and email still remains our number one threat factor.
• 8:17
  SPEAKER_01: But what you're seeing now, what versus what you used to see is the spelling errors and the things that would give the phishing emails away.
• 8:25
  SPEAKER_01: We don't see that anymore.
• 8:26
  SPEAKER_01: So now we have to tell people, you know, if if you don't know who it came from or it's not a familiar, you know, it and the other problem is too, you have compromised customers.
• 8:36
  SPEAKER_01: We don't run security for a million plus customers, so we get compromised customers.
• 8:42
  SPEAKER_01: So we have a supplier, a supplier list that we have visibility into through another platform that helps us with that.
• 8:49
  SPEAKER_00: Yeah, and I feel like that's almost worse, is when your customers get compromised.
• 8:56
  SPEAKER_01: It is because if they get compromised and they have a list of Cyntos partners, they can certainly send those emails up, but we catch most of them.
• 9:03
  SPEAKER_01: Every now and then a few get through.
• 9:04
  SPEAKER_01: But most of the time, you know, the URL's been stripped of anything malicious before it gets to the partners when they click on it, they get a they get a 404 error.
• 9:13
  SPEAKER_00: Well, what's next on the horizon for CentOS?
• 9:16
  SPEAKER_01: To continue to grow and mitigate, uh, true risk eliminate is the platform that we are currently, you know, rolling out and trying to get everybody familiar with because you know it patchless patching is what you're calling it, but it's it's really removing the ability for a threat actor to take advantage of something that there's not a patch for, whether it's closing a port, putting quotes in a in a code pass somewhere to to eliminate the gap so they can't uh get privileged access to a host device.
• 9:44
  SPEAKER_01: I mean, there's a number of things you can do with mitigate to try to help you with that.
• 9:47
  SPEAKER_01: So and then you know, the the score kind of drives what we do, but we don't look at the score as much as we do the vulnerabilities and the ability, you know, the ability to take advantage of it.
• 9:56
  SPEAKER_01: And it may be a vulnerability that is um risky, but if it's not an internet-facing device, it's not quite as critical, right?
• 10:04
  SPEAKER_01: So it really kind of depends.
• 10:06
  SPEAKER_01: So I I hope that answers your question.
• 10:08
  SPEAKER_00: So for teams and business leaders in a similar position, what is the key takeaway you can leave them with today?
• 10:16
  SPEAKER_01: Get on board.
• 10:17
  SPEAKER_01: Because it's happening.
• 10:18
  SPEAKER_01: We bought it, we own it, uh, we're moving in that direction, and you can roll with us or get rolled over.
• 10:23
  SPEAKER_01: I mean, I I'd not we're not rude about it.
• 10:27
  SPEAKER_01: It sounds that way, but uh everybody's old on what the program.
• 10:30
  SPEAKER_01: They understand that it's really it's just a business priority, and we're we're here to protect the business and make sure they can generate revenue in a safe way, keep our partners up and operating and operating safely.
• 10:42
  SPEAKER_00: Absolutely.
• 10:43
  SPEAKER_00: Well, thank you so much for coming here to speak with me today.
• 10:46
  SPEAKER_01: Of course.
• 10:46
  SPEAKER_01: Hope I answered all your questions.
• 10:47
  SPEAKER_00: Yes.
• 10:48
  SPEAKER_00: And thank you to our audience.
• 10:49
  SPEAKER_00: If you have any questions or comments, leave them below.
• 10:51
  SPEAKER_00: As usual, I'll respond back as fast as possible.
• 10:54
  SPEAKER_00: Have a great day.