Latest / CYBR.Signal / Sweating the Small Cyber Things

Transcript

Sweating the Small Cyber Things · CYBR.Signal

• 0:00
  SPEAKER_00: And hello everybody.
• 0:01
  SPEAKER_00: Happy Cyber Sunday.
• 0:02
  SPEAKER_00: Michael Farnum here.
• 0:03
  SPEAKER_00: Hope you're doing well.
• 0:04
  SPEAKER_00: Wanted to talk about the small things in cybersecurity.
• 0:09
  SPEAKER_00: So, what do I mean by that?
• 0:10
  SPEAKER_00: Well, I live in Houston and driving over here tonight to grab some dinner.
• 0:15
  SPEAKER_00: And there's flooding going on around the area.
• 0:18
  SPEAKER_00: And if you know anybody from Houston, ask them.
• 0:20
  SPEAKER_00: There's always flooding, or a lot of times there's flooding around here.
• 0:23
  SPEAKER_00: It's not a lot of flooding, it's more localized.
• 0:27
  SPEAKER_00: And there's this website we have here called Space City Weather that has kind of a scale from one to five.
• 0:34
  SPEAKER_00: And one being the kind of nuisance flooding, that kind of thing.
• 0:38
  SPEAKER_00: But what's interesting is as I was driving over here, there was some pretty pretty heavy water on one of the roadways, and a car was just coming up really fast.
• 0:49
  SPEAKER_00: Thought they were going to hit it.
• 0:50
  SPEAKER_00: They actually did hit it pretty hard, but they were okay.
• 0:52
  SPEAKER_00: But they basically just weren't paying attention.
• 0:56
  SPEAKER_00: And you know, it's just a small spot.
• 0:58
  SPEAKER_00: Everything else looked open, but it was a small spot.
• 1:01
  SPEAKER_00: So I started thinking about that.
• 1:03
  SPEAKER_00: I was like, well, the small things in cybersecurity are a lot of times just as important as big things in cybersecurity, at least what you kind of consider a small thing.
• 1:13
  SPEAKER_00: So an instance of that is I was talking to a vendor this week, and they have um a product that does a lot.
• 1:23
  SPEAKER_00: They've got a lot of features within their product, but they've got one specialized use case that really could help some customers of my my day job at Set Solutions with in very limited environments generally, um, probably like air-gapped OT type of environments, and it could help there.
• 1:45
  SPEAKER_00: And while, you know, for for some of our customers, that's a really big deal.
• 1:49
  SPEAKER_00: Obviously, it's critical infrastructure, that kind of thing.
• 1:52
  SPEAKER_00: In some of our customers, they may have OT environments that aren't that big, maybe manufacturing or have a manufacturing arm or something like that.
• 2:00
  SPEAKER_00: And they need to protect that environment just like they need to protect other environments.
• 2:04
  SPEAKER_00: Yes, you got the risk equation, how much do you put into it, yada yada yada.
• 2:08
  SPEAKER_00: But if you've got a specialized product that can fit something in there, is not terribly expensive, is probably something you should look at.
• 2:15
  SPEAKER_00: And that's kind of an example of a small area maybe within your environment that you need to you need to pay attention to.
• 2:22
  SPEAKER_00: You don't need to just need to ignore it.
• 2:24
  SPEAKER_00: Again, there's risk equations.
• 2:26
  SPEAKER_00: What do you look at first?
• 2:27
  SPEAKER_00: What do you look at later?
• 2:28
  SPEAKER_00: What how do you prioritize things?
• 2:29
  SPEAKER_00: I get that, but you shouldn't just ignore it.
• 2:32
  SPEAKER_00: That's a small thing in cybersecurity.
• 2:34
  SPEAKER_00: Another instance would be let's say you're doing a tabletop exercise.
• 2:38
  SPEAKER_00: The I guess temptation for tabletop exercises is to focus on nothing but large issues.
• 2:48
  SPEAKER_00: Your how do we respond to a ransomware attack across a whole organization?
• 2:55
  SPEAKER_00: And that's extremely important, obviously.
• 2:58
  SPEAKER_00: But you don't have to do tabletop exercises with everybody in your organization, all the stakeholders in your organization.
• 3:06
  SPEAKER_00: You can focus on smaller things with tabletop exercises and say, okay, let's see, we just have a uh an instance, something happening here, some kind of incident, probably not a false positive, probably probably a true positive, and we want to see how we react to that, but it's going to be isolated in this environment, yada yada yada.
• 3:29
  SPEAKER_00: I'm saying yada yada yada a lot.
• 3:31
  SPEAKER_00: It's watching too much Seinfeld.
• 3:33
  SPEAKER_00: So you need to pay attention to that.
• 3:37
  SPEAKER_00: You need to know how you're going to react in the small things as much as the large things.
• 3:44
  SPEAKER_00: Another instance or example of this.
• 3:47
  SPEAKER_00: So I've got on my truck here, I've got motion sensors and you know, all around, so I don't wreck into stuff.
• 3:53
  SPEAKER_00: And I've got a sensor in the front that is having a problem.
• 3:57
  SPEAKER_00: I gotta get it fixed hopefully Tuesday when I take my truck in, and it keeps popping out of the housing, and all of a sudden I get this alert.
• 4:08
  SPEAKER_00: For as far as the safety of the truck goes, it's important, but it's it's still a small thing.
• 4:14
  SPEAKER_00: So it's not only just small things that may have limited issues, but it may be a small thing that could have a much bigger impact.
• 4:23
  SPEAKER_00: So when I'm driving this, it's when I'm trying to drive around and get into parking lots and stuff, it it's constantly beeping at me, telling me that there's something in front of my truck, even though it's not, it's it's getting confused because it's out of its housing.
• 4:39
  SPEAKER_00: That's the small thing I need to pay attention to because it caused a much bigger issue.
• 4:43
  SPEAKER_00: So not only do you have to pay attention to the small things that may have a small impact, but you have to pay attention to the small things that could have a much larger impact.
• 4:52
  SPEAKER_00: So those that's what I mean about having or paying attention to small things.
• 4:57
  SPEAKER_00: Small impact, large impact could lead to a larger impact.
• 5:01
  SPEAKER_00: Pay attention to those things, don't forget about them.
• 5:03
  SPEAKER_00: Obviously, prioritize as you need to to make sure your businesses stand up and you're putting the effort in the most important places, but don't just ignore the other things.
• 5:13
  SPEAKER_00: All right.
• 5:14
  SPEAKER_00: Hope that makes sense.
• 5:15
  SPEAKER_00: Let me know what you think in the comments.
• 5:17
  SPEAKER_00: Talk to you next time.