[Music]
all right we'll get started here um
thank you guys for joining us I'm really
excited um for years I've been wanting
to come to to this event I've known Mike
for a couple years years this week was
always I was in Chicago so it was spring
break for Illinois and I was always it
away with the kids I live in Florida now
so this is the first opportunity I had
to come back so I'm really excited today
um we're going to talk a little bit
about Zer day and Zer Day events and
attacks and you know the theme we picked
was you know the Mandalorian um so we're
going to draw some parallels there it's
just a fun topic some of them might be a
stretch so again bear with us uh it's
the first time that John and I are doing
it together so again bear with us but I
think it's going to be fun and if you
guys got questions feel free to raise
your hand interrupt at to it I think you
know if we can make it interactive
totally open to that so let's jump into
it here um we'll do a quick intro so
maybe John we can start sure John moar
I'm an IT security manager at American
Family Insurance been in the security
industry for a little over 20 years uh
done a little bit of everything thing um
I started in manufacturing moved on to
critical
infrastructure uh did a little sales and
Consulting and now I'm in the insurance
industry I've known Anders for about 10
years through our shared passion around
third party uh cyber risk management and
for my own risk management uh my
participation in this uh presentation is
in no way endorsement of bit Site
Services or products itself
Andrew all good yeah so I do work at
bitsight now um I'll tell you the story
but so that's me that was pre starting a
business that's what I looked like so if
you want to know what it like what it
does to you to start a startup like
that's a pretty good uh good thing right
there so I started a company called
third part of trust out of Chicago but
I'd like to say like my second home was
really Milwaukee because I went through
the generator accelerator very very
early it really when I got like you know
so a lot of the funding I ended up
getting was from from like the right
around here right so Midwest fond is
right like they LED my first round but
even earlier than that the generator and
some other folks um and also great
customer base so you know at some point
aan was a customer Rock
automation
um I met someone here from Northwestern
Mutual their CTO I met through generator
he told that very early told the ceso
for US Foods like you got to buy anders'
which he did so I got my first
Fortune 100 customer so again I'm very
grateful to to Milwaukee and and all the
support that I that I got so it took 7
years to build a business we grew it to
120 140 customers is and we we just sold
it to bitsight about 7 months ago that
was kind of announced so I have a lot of
startup experience like you know that
roller coaster if you guys have
questions or want to know more about it
I've a lot of good and not so good
memories um and again building some from
scratch is incredibly painful but at the
end it actually ended up being worth it
I don't know if there was a long way
along the line I just wasn't sure if it
was but at the end it definitely was um
yeah and I'm a bitsight now so bitsight
if you guys are familiar with primarily
it's you know they're known for like
their cyber rating it's really doing
outside in scans it does relate really
closely to this topic zero days and I'll
kind of kind of um describe that as we
go along
but the key you know my job right now is
I'm still Building Product I'm still
building Tech so I run my old solution
which is very around like vend risk
management but also again their
continuous monitoring Solutions I'm
bringing those two together that's what
I do on a dayto basis so um okay also I
forgot to say the the Mandalorian way of
saying hello is SAR and you know it's a
greeting but it literally means glad to
see that you're alive and I joke with my
friends down in Chicago because I'm
pretty sure the way crime's going like
very soon like that is what you're going
to be saying to each other like man I'm
so glad you're still alive here so uh
first slid what's the biggest dat of
reach in history you know there's a bit
of a hint on the picture but what do you
think it
was but clearly it
was not Target it was not Equifax it was
not any of those it was definitely
the deaths are being blown up right and
if you think about it like you know
there's a whole movie that ended up
happening called Rogue one that came
later it's not nearly as good as like
the early ones that I was sitting at
this like the edge of my seat as a kid
watching but Rogue one was all about
again how they stole the plants and
episode 4 that's when they actually
starts right after that and that's when
they Beed up the plants to um again the
Diplomatic ship that was going to endon
or whatever that was but anyway we think
about it so again there was like there
were commences that happened they stole
the uh the you know the plants and there
they found a vulnerability again it was
like a port they had you know they
created the delivery mechanism which was
like the torpedo that just just went
down and then again from there you know
it went horizontal they end up blowing
up saying that's the iconic image of
death St blowing up right there but
in some ways again this was an unpatched
vulnerability on the death St that they
took advantage of and that was the end
result okay
so um for CPE reasons you know this is
kind of the mustad so you can kind of
read that but what are we going to learn
here you know looking at maturity or
cyber
security improving the detection
response around breaches and then how do
we mitigate them so learning objectives
so for CP reasons boom we got
it all right my inspiration as we're
kind of thinking about this again we
always wanted to make it a little bit
more interesting a little bit more fun
related to something so the res on there
like those are the six tenants of the
Mandalore so I'd imagine a lot of folks
in there watched the Mandalorian I'm on
season 3 now I'm not come through it but
um you know we are taking those and
trying to relate it back best we can the
second piece this is really the Verizon
bre reports I read that every single
year it's it's I would say it's a
required reading the new one's going to
come out pretty soon it's the best
resource I found that kind of gives me
an idea like where's the the market you
know the direction of the market like
where are the like pain key pain points
or Focus areas and then man had a really
good specific report around zero days
too so you'll see some of those stats
coming in through like the presentation
but these are really the three key
things that you know we're ground a lot
of information around and speaking to it
so all right um so a couple other Ser
days and like actually the one that's
worth mentioning that's not up here
because I it just we just got known on
Wednesday it's like the 3cx I don't know
if you guys heard about it but it's like
a voice over IP solution I guess like
600,000 companies or so are using it and
it's got an own Zer like you know
exploit right now uh they don't you they
don't have they hav't done the full
forensics like but right now that
exploit is in the wild and their
recommendations actually that you
uninstall the solution but it's you know
that's easier set than down tily
disrupted but
also
um the thing is like voice RP it's going
to be open to the internet I mean that's
again you're calling so again it's
someone for someone to be able to call
into you you're going to have to make it
open to the Internet so again it's
highly highly you know available right
now so like that's a zero day like if
you want to draw to a more recent one
like that's one that you can think about
the other big ones that that really
shook the market though was um probably
solar winds so again that's where they
um they were able to get into code code
repo they were able to to install some
malicious code and then that code then
got deployed on to all the customer
instances and that's like a good example
of like a spy tack it's like you only
have to you can hack solar wi you can
actually you know in extension and up
pack in a couple thousand customers and
once that that's ass Sol right then you
could prob for that you can then like
ran some whereare of those companies the
other one was log for J and not last a
second like how at at your companies
like what the pain like you guys called
but log for day was like a a it's a
library that you installed on your job
applications for logging right and you
know in terms of like it's pervasiveness
like I have a friend that runs like
Library like codependency and Library
like analysis he told me that 100% of
the Java applications like that his
customers had was using log forj so
basically if you're running a Java
application which is very common this uh
you know vulnerability was
there and and it's estimated like
according to man like 44% of like
networks ended up actually getting
probed for for this so not everyone has
Java applications but they can see like
somebody's trying to hit U these
Solutions so again they have that data
so that was again almost half of all
corporate networks were getting probed
for the log for J issue so again it's a
good example now you know we'll talk a
little bit more about the different
steps but that's how gra these things
are one vulnerability can actually like
in today's day and like spread very very
fast right could have like huge
implications again 3cx just a recent
example so John I mean tell me a little
more about again did you live through
either solar wi or Vlog for day or one
of these other ones and you know tell me
how that was yeah across across a couple
of our organizations uh certainly
impacted by both from you know an
exploration but I think one of the
biggest challenges was understanding
what our exposure to each of these were
so you know in a few slides talk a
little bit about some of your security
best practi practices and how we're so
dependent on other groups within the
organization like it so if you want to
know your exposure to log for J you have
to have a pretty solid Asset Management
program for a security group to be able
to look for those vulnerabilities and
guide the rest of the organization Med
mediation efforts so yeah certainly you
know these these were prevalent and in
many of the organizations that I've
worked at and some of the best efforts
are around how how solid you were from
an asset management perspective to be
able to understand your exposure to some
of these vulnerabilities yeah and and
we'll we'll also talk more about like
your supply team that's really I focused
a lot of my time over the last seven
plus years but you know what we found
our customers like when solar ons
happened like it was kind of like a drop
everything type scenario because you
know for yourself you can scan for
things you can understand like are we
impacted yes or no you can get that that
answer but what about the hundreds of
third parties that you utilize that have
the same potential
vulnerability and again this is where
I'm thinking a lot about is like those
those situations keep happening very
very frequent how can technology be a
part of solving that so at bitsight what
I'm building is this concept of like hey
if you tell me what you know who your
third parties are I'm going to do my
best to figure out if they're running
particular piece of software so 3cx is a
good example we could tell you like hey
out of your 100 these 20 are running
that piece of
technology let them know that that they
that that exploit is a while let them
know that they got to take action and
communicate back and forth so those are
the things that we're thinking about
solving you technology for our customers
around this particular um topic anything
else you have on this job yeah I mean
maybe moving from the technology
perspective if I didn't mention in the
intro I'm I'm more in the risk
management space this part of my career
than the hands on keyboard so I'm not
finding and remediating zero days on
that patching systems and more from the
the programming risk management
perspective but pull it up a little bit
you know as third party dependencies
continue to grow and organizations
decide to to buy more versus build less
the reality is we're just blending um or
extending our it areas across different
parts of the internet so the
accountabilities for the organization
around managing risk don't change
depending on how many different third
parties that you work with and our risk
uh that we need to manage for the our
customers do not shift to those third
parties as well so we need to treat our
third parties just like we would secure
ourselves uh and use the proper controls
uh to protect our
environments so a lot of people ask me
what is z what was even named z like the
name comes from the fact that once it
happens like once it's known you've had
zero days to patch it that's where the
name comes from so I yellow box around
it like hey I'm aware like I've had zero
days to fix it and that that's the we we
call the window of vulnerability but go
back to the beginning right attackers
discover
vulnerability right so the one the 3cx I
think is going to be North Korea they're
saying that that's where it's coming
from but there are a lot of folks in a
lot of places are constantly probing and
looking for different vulnerabilities
just like the rebels did on the death
store right how do we blow this thing up
like you're constantly looking and
searching for it and once they find it
then they start creating you know the
explo like so that's
like we I said like the torpedo but some
way to to get in and exploit those
systems and you know that's the second
step now there it's not always like the
folks that create exp don't always
execute them because I it's very
um you know it's very dangerous to do
again if you're doing it from the US
again you're are going to go to jail and
so like what they actually do instead
like you'll see in the black market you
can buy exports and depending how good
they are you can get like 1 to two
million I think the highest one that
supposed they was sold was like $10
million exploit so again there's a lot
of money to be made to find these things
and then sell them on the black market
and then of course like somebody buys it
and that's when they they'd launch an
pack right so that could be brand
someware or whatever right depending on
what it is 3cx looks like it's like uh
like data exfiltration like your
password and your c browser those are
going to come out um
so that's I can again the tax launch
people start noticing it again that's
the awareness and that's really again we
three caxs today right so on Wednesday
it was it was it was known they got to
build a patch a patch doesn't exist
right and you know that takes a while
it's got to go through and make sure
that it's not creating further
vulnerabilities or whatnot but so that
takes a while then they got a distribut
the patch right that is also not that
easy like they have 600,000 customers
that means that 600,000 companies like
each one of them have to install their
patch it's not automatic like think
about your Mac or Windows machine it's
not even like that's not even automatic
just Happ like someone has to take
action so they distribute that patch and
then once that's done and everyone's
defended like okay now we're done now
now we've kind of wrapped a nice bow
around it but you the truth is that that
even like known seesi exploits are still
out there like they're still out there
today people don't patch uh for whatever
reason they're just
unaware and this will go again just some
of the mandore tenants is you know we'll
go to a little bit next but that's kind
of the general basics of like the zero
day from beginning to end how it works
and again a lot of these are popping up
so all right so how can the Mandalorian
principles help you protect your
organization so again it's going to be a
stretch you know and don't take him
literally because then you'll do a lot
of odd things so next
slide so the first one actually of the
code of honor is is wearing armor and um
I kind of scratched my head when I saw
this one like really that's the first
one like you know to wear something but
um I thought about you know my own
family so the noro family like we have a
very similar first code which ours were
like to my kids like 9 and 12 when they
were small we really struggled with this
and that was like we're your underwear
every day you got to we your underwear
you did an underwear check so that was
always like again so I kind of get it
but there was a need for this but we're
in your armor like I like that to the
cyber security but again what how are
you protecting yourself again as he went
on and for further he kept building up
as armor right um so that's again in
terms of wearing armor for for companies
we also have to wear our you know we
can't just turn the Blind Eye we got to
start protecting ourselves and and
adding like
in now John did you have anything to say
there yeah for each of these principles
or the elements of code of honor I'm
hopeful that I can just provide some
perspectives of what I've learned uh
throughout my career so you know when we
talk about security best practices it's
not it's not that simple to just go and
take a list and the framework and be
able to implement all those controls so
only you and your organizations will
know what the the best security best
practices are for you uh and based on
the
often times uh security best practices
or the ability to implement those best
practices you'll be dependent on other
groups in the organization whether it's
it groups Human Resources legal
procurement so just some examples of
where security you can't do it on their
own a best practice you know if someone
is being terminated in the organization
would be a timely replication of access
so where does that start you starts with
a manager and then HR and then hopefully
at some point early on you within you
know the first few minutes security gets
involved so once again best practice is
timely revocation but it's not something
that security can can drive or start
with another good example you know we're
talking about zero day vulnerabilities
how about vulnerability management we
talked earlier about log 4J well if you
don't have a a you good practices around
Asset Management you won't be able to
find where those assets are where you
need to manage the
vulnerabilities security typically isn't
responsible for Asset Management you're
looking at other other groups within
information
technology and the last example around
third party risk management or cyber
risk
management often times you know third
party cyber risk management or third
party risk management is an afterthought
when procuring goods or services so
building a relationship with your legal
group who's writing or approving
contracts and your procurement group
that's working with the business owners
to buy that software to buy those goods
and buy those Services is where you want
to embed your processes so it's a you
know it can a correlated effort
some other things um um often
organizations may have Regulatory
Compliance and sometimes that's the only
best practice that you are able to uh
Implement throughout the organization
based on any number of reasons uh some
examples there so maybe you're
struggling to secure the rest of your
environment but you have card holder
data well tools that are used to secure
PCI zones could be extended if you're
creative enough you could have Network
segmentation used for other areas of
your environment you could use
encryption for other areas of your
environment as well another example so
tools used to log monitor uh and report
on malicious loging attempts for
critical
infrastructure why not extend that to
your other secureity areas as well and
in some of the previous organizations I
worked on or worked in the focus was
very heavy in regulations so where
you're getting funding budget you know
awareness around being compliant see if
you can maximize that to your other as
well or at least extend those
Technologies um mentioned before some of
the Partnerships but your ability to
deploy some of the best practices that
you choose will only go as far as your
ability to build out those relationships
with information technology HR legal
procurement uh there's opportunities you
know once you've selected some sort of
framework to perform a self assessment
you know one of the most popular ones is
the this cyber security framework you
can perform a self assessment you can
get a baseline for your organization is
at and that'll be helpful for you as you
look to secure funds for today's
problems or in the future as you
continue to grow to show how you're
progressing against a cyber security
framework couple interesting stats here
right so you see rans on the left the
star Sho shooting up to the right so
again it's it's about like you know in
branches between over time you can see
it's going way up
and I bet you watch when this comes
around like the next report it would be
even
higher and if you think about it like
it's changed a lot you know when when I
started ther trust like s years ago
there was a lot of focus on primarily
like credit cards uh but also some
healthcare records and that's what
people really wanted right they wanted
it so they can reuse it but the
ransomware it's like it's a little
different because like you know so John
like you have four kids imagine if
someone Ransom your pictures of your
kids as babies like you really really
care about you want to pay a lot of
money to get them back the same thing
extends into the Enterprise so what
you're seeing is like I don't even care
what I what I like what I throw the
ransom around what I lock down it could
be again the accounting files could be
anything like without that like
companies like really struggle now like
to run things manually so we've seen it
in some hospitals like to go back to
manual processes meaning paperwork it's
really really difficult and I think
there there was one instance of uh a
person you know not making it because
you know that happening so bottom line
with BR somewhere they can encrypt
whatever files they want they have to be
like the crown jewels necessarily if
it's operationally like impacting the
business you know there's a lot of money
to be made right and if they don't have
backups or whatnot like a lot of people
choose to to pay right it's an easy
choice right you just do like cost
benefit analysis and it's a very easy
choice to decide to pay so that's why
one one side like right there the other
side what Manny is doing is tracking
like you know the increase in in zero
days over time right so it's not quite
you know just up to the right but the
the last year right there that they
measured
2021 was the highest by far right and
you know this is kind of the nature of
the Beast if you will uh the more and
more their parties that are being the
more and more Technologies being like
utilized Enterprise the more and more
exploits are going to have so that's
that is just kind of the nature of it um
yeah okay and then in another graph
we'll kind of cover this you know which
is is like where are those 80ish coming
from you you kind of be surprised but
we'll get to that a little bit
later all right the the second tenant
it's speaking the language right so
again internally how do we talk about
cyber security again it's it's not just
the you know one team it's not just the
Cyber team or the IT team it really goes
top to bottom again again it's nobody's
not affected by cyber at this point
right so how do you speak that across
the business
um John you want to add some stuff here
love the
TR um security become so broad with so
many technology so many different
threats vulnerabilities uh it's really
hard for me to even keep up these days
with the different acronyms and threat
groups you know we really have to you
know we we always want everyone else to
understand security but how often do we
invest the time to understand the
business so we really have to understand
what our business does how the how money
is made within our organizations and the
critical processes that support that to
really know where we need to prioritize
those protections we have to understand
how security impacts those business
processes from onboarding new employees
to provisioning new software so we can
really appreciate the security culture
within and the appetite for change
and every organization that's
represented in the room here will have a
limit of how much security impact that
you're willing to tolerate so you can
only go so
far uh we have to put in the effort to
communicate about our Security Programs
when we're not having a crisis or we're
not participating in an audit it was a
really easy analogy working at a a power
utility um to equate security so when
you flip a light switch at home and the
power goes on you know everyone's happy
but when you have a power outage and you
flip that that light switch and nothing
happens people will tend to be angry
with the power company or similar things
can be thought about with security when
someone is reading their email and they
click on a link to a hopefully valid URL
and they go to a working website they're
happy but when you put in a control
there's some sort of incident or
disruption and the next time they go to
click a link and they can't get to the
website they're going to have a negative
you know negative lasting thought with
the security
department so try to try to talk about
security during the Happy Times try to
talk about security when there isn't an
incident try to talk about security when
there's an audit use examples where your
security organization your it
organization where you've prevented
something or you've improved a process
or you've reduced or you've increased
the efficiencies in existing processes
because of what the security department
has
done I'll give you another example um
one of my previous organizations we were
very heavy on the safety being in
critical infrastructure you know people
can you know be severely injured or die
based on what your organization does so
we did a lot of training on safety so
you want to look for some of those
correlations so from a safety
perspective uh we all in this room
should avoid distractions when walking
downstairs we shouldn't be looking at
our phones we shouldn't be you know
maybe chewing gum or eating or having
things in our hands we want the same
thing when people are reading emails
right we want to train them to not be
distracted or playing moral while
they're reading emails which may
um increase the odds that they're going
to collect on a malicious link right so
that's one simple analogy that you know
allows us to speak the language of our
organization we did a lot around safety
so why not talk about cyber security
from a safety
perspective uh but bottom line you know
find creative ways to align the security
uh language to what your organization
does or find someone that can help you
do
it yeah and and security is also you
know whether we like it or not he's
going to be not an inhibitor it's going
to be an enabler of business so Gartner
had this study by 2025 like I think oh
my gosh 63% I think I don't know what it
was but a lot a lot of companies the
number one reason they will take to
choose to engage with another company
the number one reason not price not
product it's going to be again their
security posture why because they cannot
introduce more risk into the Enterprise
right so in terms of the language I
would say cyber security again is the
enable your business that's going to
propel it into like the Next Generation
for sure um all right we got the Razor
press up there so the first thing um
forgot to like mention the reference but
in episode two get BR s has been around
for a long long time and now we talk
about a lot but even in episode two the
job was actually put Ransom on on the
parts right they they stripped the the
razor Quest and then they held it for
ransom and that was a whole Quest around
like episod two was for him to get it
back now the ra re Quest here if you
see uh again this is like where do we
tribute the zero days like out of that
report where are they coming from and
actually you can tell there's three main
players here it kind of makes sense so
the biggest but three main players it's
Microsoft it's number one apple and and
Google they make up like 75% so again
almost all the way up to the right
engine it's just those
three and again the threats that are
leading to these breaches like you know
according to to the Horizon report like
IAL fishing vulnerabilities so those are
the top three
now
uh no okay so the one thing is like
these two providers I would say like if
you're using them for identity access
management credentials right email
that's that's fishing another one that
that's coming up a lot is like RDP or
remote desktop protocols any of those
three across those three providers like
inter L those are kind of the first
things you want to lock down and look at
from like a Zer
perspective all right let's move on to
the next tenant defend yourself and your
family so like this is very closer to
what I think about but protect members
of your supp fighting as if they were
your own family right so like in today's
day and age John mentioned it briefly
but like again the company I started
third party trust like we focused on
third party risk management right so
that that just means I'm engaging
another company I'm giving them access
I'm giving them data somehow I'm
creating a relationship that's got risk
in it right you're got to manage that
risk over time especially when you're
seeing a couple things happening like
compliance around it meaning government
mandating that you manage the risk so
you have compliance risk but also you
have you know the sheer volume of third
party so like 10 years ago any company
you guys are at like if you ask them
like you know compare the number of
third parties you had back then to now
everyone's going to say like we have way
more right it's gone into every single
business unit like HR has her own set of
third parties like workday or whatever
payroll providers um finan other like
QuickBooks and others it's it's kind of
everywhere and that's like just part and
parcel of being a modern business like
if you try to do everything in house you
just can't compete so again there's this
big push towards like a digital supply
chain operating your business here so
we've seen that go way up and because of
that you really have to think about your
T surface totally different it used to
be hey these are my four walls I'm going
to manage it and I know everything
that's going on um your attack surface
is really still that but it also is your
entire extended supply chain all those
third parties that are holding critical
data or access you can't just ignore it
so again defend yourself and your family
again those vendors are really part of
you know your business they partners and
that is how you're growing in the
Enterprise that is how you're operating
and ultimately delivering service so
like the Adent of this digital supply
chain is like new and you know this
traditional supply chain has been around
for thousands of years at this point the
new one and the digital one it's just
kind of cropping up and it's going very
very fast so uh we got a couple stats on
this next but John what are your
thoughts on it yeah I mean everyone in
this room working for an organization
you know nonprofit for-profit you know
anything of that sort we all have
different third parties supporting
various aspects of our organization with
various levels of security maturity and
when I looked at this this principle
defending yourself and your family
thinking of a third party as a family I
really struggled to identify a way of
which my organization or any
organizations in the past that really
tried to you know protect the the
supplier because typically you think of
a supplier needing to protect against
them but I I was able to remember in one
of the previous organizations we had a
third party with remote access and as
part of our diligence in you reviewing
the security we were performing uh a
third party scan and you have a question
yeah um so in recent years so I do
databases I've had a lot of clients who
wanted to sell data to their
suppliers as a way of like you know
providing additional value so suppliers
will buy data about their sales
especially if they're a distributor and
it seems like what you're describing is
that there's a security risk associated
with doing that do you have any thoughts
on how an organization would decide whe
selling data to their suppliers is worth
the risk of their suppliers than having
that
data jump in yeah let me just Define the
terms here so again that this is a great
example like in that case where you're
like he's asking like hey um we want to
sell data to a supplier really like I
would turn on the head and say that
they're a customer of yours then but
you're selling them data but and you
want to make sure that that data that
you sold them that they I don't they
don't repurpose in the ways they
shouldn't or they're not breach and it
goes out because that's could be a lot
of the value that's actually why we call
it third party risk management not vend
risk management because in that scenario
they're not a vendor to you so it's
vendor risk management it's a bit of a
misnomer so third party risk management
is a little bit better because again
they're just a third party to and you
have a relationship with that third
party and there's some amount of risk
that you are creating as part of that uh
engagement yeah go ahead maybe dive a
little bit into the data itself really
evaluating what's the sensitivity of it
and who really owns that that data or
that information if it was created by
your organization and it's important to
you then you have 100% of the risk to
manage as you sell it to your customers
and understand how they may then turn
around and use that information for for
their own needs but if you're an
organization where that information or
data belongs to you know humans or other
customers
then you have a duty to those customers
to evaluate the sensitivity and the
protection needed and probably the
notification and agreement before you
can distribute that to other
organizations for other
purposes yeah we've seen this too pretty
common in healthcare so what they end up
doing is research agreement so like
they're not definitely not a vendor but
you're doing some sort of research
agreement with another hospital system
for example right but you can't just
take your patients data and like
willingly share it with that other
system like you own that data so you own
the responsibility and that
responsibility extends to you being if
you share with a third party right so
like that's where actually security
needs to be brought in because you
better make sure that the controls that
that you know research partner of yours
has is good enough again that it meets
your minimum based blank criteria
otherwise you should not be engaging in
business doesn't matter if it cure
cancer like first and foremost it's
going to be uh patient safety and um
security first and then later you know
there going to be other partners that do
it or my point on this SL is also going
to be has always been large
organizations like John's and others
kind of has like this obligation like
when it comes to protecting your family
like you want to share knowledge right
you're going to work with your partners
like you want to tell them like so again
for us what we try to do it bit again we
will identifi like they'll tell you
okayy this third party has this 3cx
vulnerability for example click a button
and immediately tell them like which IP
it lives on what the evidence is and
communicate with them that it's happened
and ask them for mediation to
communicate
back that's an example of like our
customers which tends to be larger
Enterprises leveraging this technology
providing service to their to their to
their supply chain and helping them out
right and it's always like I felt that
it's always been a compan on at larger
companies to help third parties like act
as like when you're engaging those like
when you look for that the security
posture doing a consultative and like a
partnership way right like hey these are
the three key gaps that we see that you
can really level up your security if you
if you close these three and you know
whatever it might be right but it's
again the relationship is there it
happens every single day and that's
again the family is extended so again if
you have a big company and you're
running like an information security
like office help your suppliers become
more secure because that ultimately is
going to help you also in the long term
yeah I wanted to jump back into my
example but first thank you thank you
for the question um so we had we had a
third party that had remote access to
our organization and as part of our
diligence We performed a affordability
scan and this is something that they had
never done before um obviously we were
doing it to understand what the
potential uh likelihood of some some
sort of reap with that within that
organization and extending into our
organization um and you know it was an
appreciation for them uh to understand
the harm that they can provide to our
organization and not only some of their
other customers so we were able to come
to a mutual agreement within the legal
contract that we would perform a scan
monthly and had established service
level agreements on timely resolution of
the vulnerabilities we found and then
ended up being you know a win-win
situation for both sides you know our
organization had a higher level of trust
and having that connectivity to that
that third party um and the vendor had a
higher level of security assuming there
were see the things that were found uh
which decreased the odds of disruption
happening uh and impacting our
organization and any of the other
customers now this was a very small
organization um they weren't a
technology organization they W
performing other services so on the flip
side you know your larger software as a
service organizations may be quite the
opposite less willing right less willing
to budge from a contractual agreement uh
their security may even be more mature
than yours uh but because they have the
higher bargaining power in the situation
right they're they're a giant they're
Behemoth and maybe your your Revenue
doesn't affect them that much and you're
not willing to change how they affect
other customers it really means that
while this is talking about defending
yourself and your family sometimes you
have to defend yourself from your family
as well right treating any of those
connections as a hostile Network because
you'll never have the visibility into
those third parties that you would if
that system was installed in your
own you know from a from a risk versus
business perspective you know all of our
organizations have business decisions to
make when they're pring software and
often times the perceived business value
or whatever is being purchased May
outweigh the the security risk exposure
that you're able to maybe sometimes not
able to explain as part of that
diligence process but you know kind of
collectively from what Anders was
talking about it doesn't mean that we
can't as a group continue to push our
third parties to do more put that
pressure on
in our DU diligence processes help them
be better from a security perspective by
increasing their own security
Investments um and all the way you know
even for them to increase holiday
provide
reach I think we question right here
yeah
go
yeah so it's it's very difficult and a
lot of companies struggle because it's
there's two things that change one is
the impact that third party has on you
that changes over time so we have
examples where you engage a marketing
company they're going to build a website
next thing you know they're building
some sort of Solution that's got bog on
it you got 500 users that's an example
of like the impact that that particular
third party has changed
dramatically so that's changing over
time that goes up and down the other
piece is like yeah security posture that
changes so you know we talk a lot of fit
about continuous moning right so you
can't just do a point in time that's
good like you can't Deep dive every day
but the idea is some sort of cadence
risk-based Cadence you deep di so again
you really go and check different
controls like and you TR try narrow
butol matter you can't like a scatter
shot but you got to do that then you do
it continuously so again if it's a zero
day that's a good example like that's in
between these what do you do then you
need some sort of way of managing that
risk and then you reassess on some sort
of cadence a year later or 6 months or
two 3 years right but yeah the first
step like in the maturity curve is this
like to inventory third parties like who
are they like you'll be surprised not
not many folks that the second thing
would be like okay which one's are the
most impactful right so I have some way
of measuring that it's going to be
critical so you can rank from top to
bottom then after that it's like okay
once your security posture okay now you
like in this framework is like impact
times likelihood equals risk right so
like magic numbers to figure that out
right you get an idea around risk um and
then you start doing that more regularly
and some point at the top end of the
maturity curve you're continuously
looking for this data but you're also
like I I built a pretty cool integration
with net scope where what we did is like
we're like we're looking at Network
traffic and we're seeing like hey what
are the new vendors that that our users
are going out to and using right and
it's actually in near real time like
telling me it's like okay you five users
or 10 or 500 or 5,000 and it's measuring
that over time so again it's impact
going up or down your network traffic
can actually do that like this is only
for like SAS venders really but again
those are the majority at this point
so that's one thing and then yeah bit
stuns for a long time sping constantly
looking at different assets of
vulnerabilities and you know patching
like are they patching their servers are
they utilizing encryption are they doing
this after the other that's on the
security side
so Bottom Line This is like a tough
problem but like when John was at ATC
you know you have man through ner you
got to do it it's got to be like
scrutiny like your Finance or insurance
nydfs has got like very strict like very
strict rules around like you can't you
have to do this process and they're
pretty litigious like there's a lot of
cents coming out of that even again it
goes on we're seeing this everywhere so
yeah companies are struggling and again
it's a combination of people process and
tooling that
need so I think I
answer com I think you cover pretty well
cool 15 minutes okay so we'll speed it
up a little bit uh i' love that icon
might I got a designer down in Argentina
that that so um
half is covered here that means that the
majority of breaches that are happening
because I'm do to third party kind of
like I said the tax is like it's getting
so blended it used to be very clear like
my stuff third party and again you be
able to put very boundaries on it put it
inist of buckets it's getting very like
extremely ended but now great so the
more more third parties you have like
the more of them will be attributed to a
third party breach right just like here
U so we're seeing like this is one of
like the pressures on doing third purose
Management in a much more meaningful way
in the companies across not just highly
regulated Industries but others
also all
right um raise your children's and as
MOS right so let's talk a little bit
about education here
John yeah Anders we want to come back to
the the stats later that's fine um you
know when I was thinking about this um
often times you know when organizations
carve out a business function called
cyber
security if that puts an unintentional
maybe indirect um you know
accountability that that's the only
group that will perform security for the
organization now you know not by any
means am I talking about you know we
should eliminate security departments
but we we need to find how each
organization can find the way to
approach security as a shared
responsibility so I have some experience
around security awareness from a couple
different organizations so I wanted to
share you know kind of like the very
large versus a very small and where we
had some success so the first stop I had
in my career was for um a fortune 75 at
the time multinational
organization somehow I was the the
second ever Security hire uh the company
didn't have policies and procedures so
really no basis of which to train the
employees around the the security
behavior is necessary there's no
security awareness program there were no
regulatory requirements around security
or security awareness so the only
opportunity we really had was to utilize
um IT staff at various business units
operating companies uh through world uh
to spread the different you know
awareness that we need from a security
perspective so stop number two uh quite
the opposite a very small organization
based mainly here in Wisconsin around
five physical
locations uh much much different
experience you know to the point that we
had created competition among senior
leaders around uh fishing scores uh and
our fishing awareness program we are
able to tie our our fishing program to
employee annual comp compensation so not
only our our monthly tests as well as
you know did anything real happen and
maybe Mike in the audience will let me
know how that's been going since I've
left um but that company also had really
really strong security um cyber and
physical oversight which you know from
the top down making sure that we didn't
have any regulatory uh incidents really
helped uh spread that message from a
security perspective and now we're I'm
at today and I have around Fortune 250
organization I'm not directly involved
in the security awareness program so I
just wanted to share what I thought was
pretty me you know that that local
access for the previous company being
able to visit all the offices being able
to do presentations being able to see
everyone face to face that's super hard
to scale when you have 10,000 plus
employees across dozen or so uh
locations throughout the us so I like
what the what the team at Anam did is
they created an ambassador program so
they they recruited people that were
curious people that were asking
questions or were interested in security
and used things like Microsoft teams and
Yammer and periodic meetings that just
have conversation around here's what our
employees need to know can you help us
amplify it in your local culture so
maybe a different business unit
operating company different location
throughout the US and really use dozens
of people to get that high touch or that
Personal Touch throughout the
organization but regardless of size of
your organization so like I said I gave
kind of both both ends of the spectrum
you know our employees that are working
within your organizations are more in
the know about security concerns than
ever before so take advantage of that
Curiosity train them be available to
them and let them amplify your message
you know how they would do it within
their local culture but also find the
person or the group within your
organization that knows how to
communicate that is able to effectively
share messages and change the other
organization partner with them we don't
have to be the best Communicator
sometimes we just need to the right
person to do it for us and then no
matter what um connect with your
audience in a way that helps them secure
their personal livs it's something that
I feel was very successful in a previous
organization where if we told them how
to secure their home PCS and their
online accounts and their identities I
think naturally there was like a
dividend or a correlation to them being
able to understand how to protect things
within their organization whether
they're there today or another
organization in the
future yeah and and the stat here kind
of stands out and and I'm so glad that
we no longer do this which is like I I
haven't heard it for a little bit if you
hear like Point child of people that do
it but people that say like oh our
weakest link is our people people don't
like to say that anymore thank God but
but here's the stat right 82 of breaches
well there'll be some involvement that
could be someone clicking Onish my email
or again putting their credential or
by accident installing something there's
a bunch of different ways but vast
majority of breaches again there's some
sort of human element and for me it's
like yeah raise and cyber savy fine but
it's also incumbent on companies to
build systems like this is not really
going to change right so you can do a
lot of things like one is training but
you got to build systems that you again
account for this right those guard rails
have to be in place it's up to you it's
not like you can't just point at the
user to say hey like it's your fault
it's like no
like what are you going to do fire
everyone and get rid of them then you
don't have a company like that your your
employees are your company so again
that's the most critical as that you
have is people not the weakest L right
but this is this is the stat so again
the takeaway is more for me let's focus
on Building Systems so anyone that's
involved setting up email providers or
it support or again you name it you got
to build in the guard rails to protect
from these different events that's
that's on you not on your end user don't
expect them to be acting perfect
everything it's impossible even I click
on fish emails you know something like
by accident right
everyone okay let's go to the next slide
two
more okay so yeah so contributing to the
client's welfare again that's you shout
out to to to Mike for putting this
together events like these are really
really important but again help others
like I think about ways that the bits
side how can we crowdsource of this data
across a customer base how do we
actually bring customers together to
solve these problems everyone in the
side it's really difficult to to to
solve some of these things but the more
more like you work hand in hand the
better it's going to be man's a good
example like he never not a single
Mission can go along right he always had
friends so this one is boan right crew I
think um so anyway but every Mission if
you actually look every episode you
never really went out it
um so okay next like I wanted to bring
kind of an internal and external
perspective to this so internally to
your organization and I'd like to think
knowing some of the people most of us
grew up in a
non-security role or two for discipline
um so not only can you provide someone
in your organization knowledge of that
discipline but now you know how to do it
better for security
so we talked a couple times about how
you need to build Partnerships so
outside of techn uh technical knowledge
really rely heavily on some of these
other departments to make secur to work
so what's one way that you can lend the
hand to human resources and then cash in
that that favor in the future when you
need something from them from a security
perspective and then externally know
referencing what Anders is talking about
sometimes it's just as easy as getting
involved in a conversation at a security
conference like this or a local user and
ask questions or give answers right give
back to the community uh and you know
it's largely digital now as well through
social media and and you know you may
have something to offer that you didn't
expect or a connection that can be made
um and don't be afraid to be the one
asking as well there's really so much to
the Le room in the space that we can't
be an expert at everything and if you're
asking the question someone else
probably also has that question that
they'd be curious about as well or you
know have a friend to volunteer you to
speak at a conference for the first time
in your career on your birthday and
maybe that's how I'm contribued back uh
to the clan today myself so it was more
arm twisting happy
birthday let's let's look at these stats
so this is actually like how many
minutes per year are companies like
training their employees so like this
getes you an idea like I don't know
where your company ends up being but
like roughly again it's it's in the one
to two hours I think there's a lot more
there and again it's it's become more
mature but yeah that's kind of this is
the distribution but you're still seeing
a lot of folks in left zero cyber
awareness training like that is just not
going to be sustainable cuz eventually
that's going to lead to bad outcomes Fu
hurt revenues and companies Etc so
awareness is our best weapon build the
most comprehensive protection possible
right and that's the network is your
people and Technology process all the
combined and maybe specific to uh
fishing awareness um often times that
training we'll just focus on not
clicking but wouldn't we want wouldn't
we really like all of our employees to
report malicious emails so we have that
early Insight um the quicker that first
employee can report something the
quicker that our response teams our
Technologies can take a look at that and
have kind of that early warning system
uh and at one organization you know we
built up such uh a good awareness with
our employees that they were reporting
way too much for analysts to handle so
we were actually able to implement
software that would help sift through
some of those reports and then integrate
with our email system so that we can
pull out no malicious emails so that we
could avoid an incident so that we could
you know um earn the higher bonus that I
talked about before and it really
reduced uh time to analyze and became
more efficient all right last
principle
yeah the last one is to Rally to call
there we go there we go all right so
when call Department got Rally from the
Cause right so cyber security is not
just one Department really again top to
bottom everyone's got to you really
really work on it right um everyone's
got a part to play like we say here and
if you remember season season one is is
really when the clan came even though it
was kind of out like out you know on the
outs with them they came and and saved
them um so again it's everyone's job so
John how you seen that impended yeah I
mean I really see security as a as a
team sport um an organization isn't
going to be sucessful the security
department is the only one doing
security right we need to be able to
spread some of that awareness and
responsibilities throughout and that
goes from senior leadership that's uh
securing budget and prioritizing
security work all the way down to each
employee that's staying Vigilant um
everyone has an important role to play
and then given the high demand for cyber
security resources organizations need
find Opportunities to cross train to
really spread that wealth out um you
know from my perspective when every role
organization can impact uh that
organization from a security perspective
we owe it to them to train and provide
tools necessary to
do yeah I'll cover this real quick so
active fast is important it it's kind of
interesting actually the time to breach
on average has gone way down but that's
because the the attackers are they tell
you immediately hey we've Ed we ran some
right give us money but if I even if you
take that out so if you take all the
non-actor disclosure meaning like they
told you it's still going like so
actually way more measured in days or
less where it used to be months or more
so we are seeing companies are much more
Vigilant and again this much more
maturity around detecting this de
automatically and trying to pass you so
next slide so yeah all so we're getting
very close to the end um and you know
this is kind of one of the takeaways
here it's like put the star reference of
course which is like it only takes one
one precise shot in a weak spot so we
got to all work on closing your gaps and
you do that in a variety of ways um to
summarize some of these things right
um having a multi-layer defense like so
defense in depth is important like how
do you protect zero days like it's
patching yes of course like but it's
also you can actually stop things at the
firewall you can also like do your own
like threat scanning or whatnot so again
multi-layer defense and DEP board uh now
highlight the third purpose management
again your tax
services extends to your third parties
and every day more more toer third
parties than previously did continuously
look for these things because they are
going to be popping up on a semi regular
basis as we move forward um be selfless
knowledge share help your peers help
your you know folks around you and then
the last is like you know the quicker
you can detect it the more you can you
to protect against it minimize the
damage
all
right last we have a a quick PLL right
and who would be the best cyber Warrior
show hands uh we got four options up
here Mand queel Brie carg and M so show
hands like who would uh who would go for
Mando all we don't have anyone for Mando
all right what about
que all right the second one feel third
is
sorry grief
car we got a couple for that yeah and
then M so who's going for the the bad
guy all right we have a few for the bad
guy
awesome all right let's see if we can
get it's all right I'm not getting any
signal from you guys right now that was
it all right thanks everyone we really
appreciate the time love being
[Applause]
here