Cybersecurity's BIG Problem. Why it needs to change.

Key Takeaways

attackers are getting really really good at emulating legitimate user behavior and legitimate application Behavior so if you're only looking at email if you're only looking at web security if you're only looking at EDR on the endpoint you're missing more than half the picture so if you can see those patterns together be like huh Tom got an email from his buddy the friendly Prince went to a website we've never seen before Powershell ran on his machine strange new process any one of those is knock rounds for conviction but when you lay them together it's clearly this is a ransomware attack foreign it's David Bumble coming to you from Cisco live back with a very special guest Tom welcome thank you Tommy you've been in this game for a while yes you've seen a lot of changes yes sir my thing that I've seen is it looks like the attackers are still winning yeah I think that's very clear unfortunately right if you look at both the frequency and severity of ransomware attacks they've increased significantly in the past year yes so I mean based on your experience and what you what you think what's the solution to this well so let's let's take a step back and look at how we get where we are um for decades the way the industry has worked is there's just physics behind the fact that small companies can innovate faster than big companies that's just sort of how it works and and so a new security problem would pop up and maybe a little cluster of companies that would form to solve that problem I was part of that I was part of the founding team of a company called ironport we stopped spam that's all we did we're really really good at stopping spam and so so the strength of these Focus let's call them Point Solutions allowed you know sort of Rapid adoption from the part of the customer the problem is after 20 years of this the customer has built up quite a tool set like many big Enterprise customers will have 150 different security tools and if you talk to Security Professionals a good buddy of mine is the CEO of a company called attack IQ they measure you're familiar with them right they measure the effectiveness and preparedness of a customer along the miter attack framework and he'll tell you it's not that people don't have tools deployed it's that they don't have them deployed correctly so so tool sprawl is a big problem you know and again if you use kind of the Common Sense factor of like hey this has been going on for decades you know there's ubiquitous deployment of state-of-the-art EDR Solutions state of the art Next Generation firewall sort of advanced identity solution and I bought a you know Cloud cnap right Cloud native application platform yet we see the frequency and severity of ransomware increasing so we've got to think differently and the alternative approach here is what we call a platform approach okay now if you've been in the industry for a while as I have you you may approach that with a little skepticism I used to you know I'm a security startup person and I listen to Big vendors like Cisco talking about platforms I'm like that's code for like buy all the stuff from me the reason why I think there's been a significant shift in the industry is that what we're seeing is that the signal to noise ratio in any one domain is so low that it's very very difficult to say I caught this stuff very very difficult right and the reason for that is that attackers are getting really really good at emulating legitimate user behavior and legitimate application Behavior so if you're only looking for example at email if you're only looking at web security if you're only looking at EDR on the endpoint or you're only looking at netflow you're missing more than half the picture and so you know there's a fair amount of evidence from customers from analysts if you can look broadly across all of these domains and lay these events side by side that's what the patterns emerge and it's this is what's driving this movement towards security platforms at the end of the day it's efficacy which means which means we stop ransomware more effectively than you would with the combination of a you know best of breed email filter a best of breed EDR solution a best of breed firewall and a best of breed identity right those the individual pieces are not adding up to best of breeds uh uh protection so talk us through that framework because I've heard you mentioned that before like Nigerian prince or someone yeah these days you know that guy too yeah I've made it unbelievably friendly did you get the money he wanted to give me money you know all I just had to do is give my bank account right like yet laughable uh email and yet still someone out there oh he's a wonderful oh he was so helpful you know like wow they're clicking on it right so 80 of the rent we have an incident response business a pretty large one and so 80 of our Telus correct 80 of the ransomware attacks we saw last year started with a phishing email and so um uh the phishing email takes you to a website and more and more this website looks like just like a real website right it's indistinguishable from the domain name is hard to read and then exactly Google domains make it worse with a zip and all the rest of it you got it right but it but does this domain just appeared 24 hours ago right so you don't know that it's bad you don't know that it's good you just it's unknown you click on the link thinking it's a photo share site and something starts running on your machine you don't know what it is all of a sudden Powershell is running right Powershell spawns some new process that we've never seen before you can't just delete a process because it came out of Powershell that would be like me telling your audience that Powershell is the root of all evil it's not well maybe it is but it's like a lot of people like Powerpuff exactly right um uh no Powershell is a legitimate tool where people use system administrators use it but just like with the phishing email eighty percent of the ransomware attacks we saw last year came from an unknown process meaning not known bad not known good just like this new process which in turn spawned from Powershell so if you can see those patterns together be like huh Tom got an email from his buddy the the friendly Prince went to a website we've never seen before Powershell ran on his machine strange new process any one of those is knock rounds for conviction but when you lay them together it's clearly this is a ransomware attack right and then that process is trying to reach the customer database and asking for 500 000 credit card numbers for example right so if you have that end-to-end view you can drive much higher levels of efficacy and you could say well wait a minute let's imagine I've got an EDR solution it it sees every single process and I've got an ndr solution it sees every single network connection and I'm going to capture all this stuff in logs so you know I would say to you good luck yeah I mean it's getting worse because what about like AI rather than a Nigerian badly written email yeah users are going to click on AI generated this stuff is indistinguishable from from real content but my point about the logs is that that logs have been around forever yeah it doesn't solve the problem because by definition of log is a summary it's summary data right and so when you have these really really sophisticated attacks that look like real stuff you need to be as close to the data path as you possibly can so the difference between a traditional Sim which is a log aggregator and what we're doing which is xdr is that that a Sim thinks in days weeks months even years you're storing that data a Sim is looking at summary data right an xdr is as close to real time as possible an xdr is not looking at summary data it's looking at every I want to see every packet I want to see every process I want to see the not just the email I don't see the mime encoding of the email I want to know like the the metadata around the email right I want to see every click on the website so I want to see as much resolution as possible and then I want to throw that data away I want to process it assimilate it and what comes out of an xcr is a high fidelity alert stream right and those are just two fundamentally different philosophies so I mean the products that we announced today we can start with something simple like a firewall but I want to talk about some of the other products yeah yeah so yeah to be clear the xdr or something we announced just a few weeks ago at RSA right now the products we announced today are tied in to the xdr coming back to this security platform or system right system of subsystem so here's what we announced today we announced two things they share a common philosophy which is zero trust and so the first thing we announced is Cisco secure access and it allows a zero trust or least privileged connection between a user and corporate applications the second thing we announced is we call our multi-cloud defense and that allows least privileged communication app to app and so sometimes people forget that servers are people too meaning that they have identity and they should have privilege and you can't just allow any any connectivity in the data center because in a zero trust model you have to assume the attackers have found a way to get into the data center so if you allow any any connectivity that's giving the attackers permission to roam about the data center until they find the data they're looking for right lateral movement so we're able to implement a lease privilege model for both of them makes sense yeah okay so maybe I'll start by talking about what we do with Cisco secure access so so the principle of zero trust Network access ztna has been around for years it's not a new idea at all and I had a room full of customers today and I asked them show hands who has a zero trust program underway already every single hand went up in the room and so you know there might be a few that haven't started but but pretty much everyone has done something and I said okay cool um now another show of hands who is also running a VPN and every single hand went up in the room right so why right why is that well here's why typical Enterprise is going to have a large population of applications and you know businesses are all driven by you know Mark Andreessen famously said software is eating the world right so businesses are driven by these software applications and they're making custom apps and sometimes it's a little dumb app it's like oh it's the thing that schedules the metal delivery that we need to make the bezels on our watches or whatever well okay but it's without that you don't schedule the metal delivery and production is impacted right so the way those apps were architected they were built in a world where you had a data center it was the old trust model right so when you're on network your trust did and you had full connectivity and and if you're off Network you use a VPN to get on the network and you have full connectivity that model died officially in my opinion the day that that a HVAC vendor at Target you know what I'm talking about right an HVAC vendor had an affected machine and the attackers came through you know a heating vendor and they were able to get into the point of sale system to one of the largest retailers in the world not good right and so then we realized okay we've got to put the zero trust Frameworks in place where we kind of put like watertight compartments so we want the IT team to access it apps we want the sales teams to be able to access sales apps but we don't want sales people getting into those it apps Common Sense the problem is in order to implement that you need a thing called an app connector and an app connector is a fancy name for a proxy or a Gateway proxies these days are all built around HTTP and so web traffic but many of those applications like that thing that schedules the metal you know bezels or what have you they may be built in a world that didn't anticipate proxies and they don't work nicely with a proxy so apps like sap that are multi-channel are not going to work in an app connector apps that do server-side initiation so if you're doing software distribution not going to work in an app connector so you can put some of your apps in the xero trust framework but you know virtually every customer I've met still has to have a VPN for like the long tail of apps and so you're presenting the user with this two-headed dog right one of them is a zero trust model the other is is you know sort of the traditional model and the analogy I always make is if you were a user and you went to get a glass of water could you imagine if someone asked you would you like that water delivered with an iron pipe or a copper pipe or today we have a special we're delivering with plastic pipes like what who cares who cares I turn the tap on I fill my glass I turn the tap off I'm off for the next task so so we're asking a user to choose what is effectively a tunnel or pipe and so this is the kind of the punch line at Cisco is that the company that brought you the VPN is killing the VPN right we're plumbers whether it's an ipsec connection terminating into a VPN concentrator or an HTTP connection terminating into a zero trust Gateway that's copper pipe versus Plastic Pipe user doesn't know doesn't care shouldn't be asked to choose the exact type of plumbing and they're going to make the wrong choice yeah exactly well I'll tell you this is a true story yeah we're riffing a little bit here right so let's go uh past life I used to work at VMware until very recently and we had a zero trust framework and I was using it and it was during the pandemic so we're all working from home campus was closed and my boss uh was the CEO he's like hey I need something I need you to get this piece of information and it was stored in jira which is running on-prem and I had to launch a VPN it wasn't a Cisco somebody else's VPN and I never use this thing so I couldn't get it to like launch you know I'm like damn it what's the password is your Technical and if you struggled with that yeah exactly what about all the other people exactly exactly exactly this is this is so you know what I had to do I had to like get in my car I had to drive to campus campus was closed but I had to like get up right next to the building and get on the Wi-Fi and then I could access crazy the the jira and I said to myself like I will make it my life's work to never have this happen to anyone ever ever again so by unifying traditional VPN and zero trust we're able to deliver an end user experience that that I call it the world's most boring demo open your laptop go to work right whether you're going to Legacy app new app whether you're on-prem or remote the experience is the same we're unique in being able to do this there are other people if you listen to Palo Alto you listen to Z scalar they're going oh no we do the same thing the devil's in the details like you actually are able to run a VPN connection in a zero trust together no is the answer we think this is a unique point of differentiation evidenced by the fact that so many customers are running VPN and zero trust side by side did you want to talk about some more of the products yes I don't I don't want to stop your floor I love you going okay cool so so what we talked about is a the way to deliver that zero trust user to app at scale right across every configuration old apps new apps SAS apps premise-based Etc mobile devices this is another thing we announced is that we've been working with apple to build this capability into iOS so no client necessary no thing to download so just automatic yeah just automatic yeah yeah and so uh it's called iCloud private Gateway terminates into the Cisco security cloud and so seamless end user experience the goal is to frustrate the attackers not to frustrate the users I mean that's the problem uh you just think of like different users I mean if you couldn't get a piece of software to work how can you expect people not to click on some AI generated email or something right right no we make the assumption that that you know people are going to click and the users are in that's why zero trust exists right like there's no way you can train humans not to make mistakes I love humans I'm one of them like we constantly click on dumb things now let's talk about that app to app connectivity so so people have been putting apps on the public Cloud for like a decade more right and there are all kinds of ways to build a direct connection from a private Cloud to a public Cloud there's a thing called a direct connect right so the connectivity is in place but generally it's it's it's a VPN style connectivity where anything running on the public Cloud can talk to anything running in the private cloud and so I had a customer that had hundreds of vpcs that they were running on Amazon they had another hundreds of them on uh Azure and then like 50 on Google and in one of those vpcs the had internet access a developer put an instance and left the default password also I don't know that specific story but go on you can guess on GitHub yeah exactly right and so there's Bots that are out there that are just looking for this they found it landed code on that box and then from that you know oops I just it's a development environment but I had internet access the attackers were able to get all the way back into their premise and into their source code no bueno right and so so so we need to put those watertight compartments in place just like we do user to app app to app needs a least privileged model yeah you think that's easy it's not and here's why is that everything in the private cloud is built around some form of IP address right a VLAN a network segment a verf you know however you're describing the application there's an IP address as the source of identity when you go to the public Cloud a workload could be made up of redshift and Lambda and you know S3 there's no IP address in that at all it's identity it's the identity of these services and so as you want to make a least privileged connection from one one to the other you need a translation layer that speaks IP address on one side and identity on the other this is what we've introduced so it's called Cisco multi-cloud defense and allows you to describe a workload in the language of the workload on Amazon or on Google or on like Microsoft Azure and then conversely you can describe the target you know in a private Cloud customer database in the language of the private Cloud so it's a little drop down I want this workload here described here click click click to talk to this customer database here that works in this IP verf you know API URL whatever it is um and then brings those two things together so this is something that I think has Universal appeal for anyone that has any sort of hybrid Cloud at scale if you only have one app on Amazon you don't need this if you have tens or hundreds on Amazon and also stuff on on-prem this is a problem I think you'll understand any more you want to do uh well let's see so those so there's those two now so here's what I think is one of the more interesting capabilities that we have in the current product and when you start thinking about it you'll realize that the security impact on this is huge um one of our Engineers had the idea that said you know what for every network connection we should look at which process initiated the connection and in fact we should capture the hierarchy of that process so that pattern we're looking for is that when I talked about earlier of like huh this process that's making this network connection we don't know yeah and it's just spawned out a Powershell so we append that information to every flow and that gives us we're able to pull that not from an EDR solution we pull that information from this next Generation you know network connectivity thing we call Cisco secure client it's a it's an evolved version of any connector our you know VPN that we killed to make the new VPN right so here's an interesting example where you have a Access Control decision that's being made but we're harvesting security Telemetry at the process level and I have just found over and over and over again that that process level Telemetry is the most interesting and most important because whether it's on a machine or think about an Apache server we pretty much know what to expect in Apache it doesn't have to say there's not going to be a new process but if there is we should treat that with some suspicion so having process level visibility and being able to follow that through the network to correlate it with lateral movement is an extremely rich interesting area we're going to continue to be investing continue to be exploring and I think imagine a world where we could actually keep track of a weird looking process that did something weird made a connection on the network and then moved to another connection another connection we could use a blockchain approach to create a hierarchical identity at the process level so we have capabilities that are shipping today that do this on a laptop but being able to extend that to pretty much any form of compute I think it's going to create a really really rich set of signals for security that allow us to identify friend of foe more accurately than you could do without that and that goes to xdr it's 100 goes to xdr and let's call it security analytics in general I think in the data center we can do really really great things if we understand process level and network level communication and put those two together like in real time you know not trying to harvest that out of logs because it's talk about a needle in a haystack right there's a lot of processes and there's a lot of connections and if you're trying to correlate them that's the damage is already done and the Damage exactly to be like oh by the way I want to let you know that last week you got broken into you know thanks a lot yeah yeah wonderful yeah yeah yeah yeah so the last thing we haven't talked about is the rule of AI now every vendor in the planet is like oh my God AI this and AI that but there's a good reason for that right in that if you think about what happened in the past you know just a few months computers now have the ability to process natural language and just the more you think about it you realize this is going to be transformative so what we showed our demos where we can use large language models to allow a firewall administrator to greatly simplify policy management in a firewall have you ever been inside a firewall yeah I I used to configure pixels and all those I could tell all the pain on your face you're like oh my god I've actually done this yeah exactly I I routinely talk to customers they have hundreds of thousands crazy I've talked to customers that have over a million firewall rules can you imagine editing that Rule table uh here it is rule number 567. there it is it is it's like assembly code you know it'd be like the problems you don't know what offer those are because you and you don't want to take them out because it might have fake some app you you stole my line right no no it's right on the money is is you know the guy that wrote them retired yeah yeah so the rules just build up build up kind of useless exactly right and so so so now we have the ability we show demos of this we can actually talk to the firewall and you do it you're typing it but imagine we could put we could put a voice translation and be like hey Tom is uh uh just joining Cisco we need to give him access to this this and this but not that it'll be like okay here are the rules and conversely you can read the rules and it can tell you I can say does Tom have access to jira because he probably shouldn't these days right you're like you don't want him getting in there don't want him messing with source code and so yeah having the ability to dramatically simplify AI firewall rule Administration big deal same thing applied in a sock so remember in AI there's kind of two pieces to the puzzle there's the algorithms themselves and then there's the data you train them on and so one unique set of data that we have is we've been in the incident response business for decades Talos right and so imagine if we took all of the write-ups of all of the incidents that we've encountered and fed them through this you know llm capability so that we can create a sock assistant that understands patterns oh you know what I've seen this before this looks like uh you know a lateral movement and I suggest we turn on packet capture and you know set up a honey net right and so a human can go do that but look the computer can do 10 times fast five days too late five days too late right so so we think we can create an order of magnitude increase in efficiency for a sock operator that's why there's a lot of Buzz about AI because it's not just smoke like you can see the impact that this stuff is going to have on those two examples and those are like obvious so as we start to really dream about like man what can we do where computers understand words it it gets really really interesting so can you summarize we've covered all the point products right yes okay so all the different pieces so yes let me ask it again can we can you summarize this idea from what we discussed in the beginning like all these different vendors selling all of these products yeah what it what is Cisco doing xdr was announced yes so what's the full picture today yeah so so uh our view of Cisco is we want to be great we're security meets the network and you can think of that in three buckets there's a bucket of functionality that's around users so that Cisco secure access that I talked about is a very integrated solution that has a firewall a web proxy browser isolation you know it's got digital experience management right all that is integrated into one single solution so you could have five or six point Solutions instead you get one console from us we're going to continue the integration we've got email in our user Suite we've got EDR in our in our user Suite so bringing these things together so they're easier to deploy lower cost but at the end of the day how do we start this whole conference station efficacy right we'll deliver a better outcome better catch rate better protection than you would get if you deployed even really really good point solutions for email web you know EDR and connectivity so that's the that's the vision yeah that's brilliant okay Tom thanks so much for sharing it yeah but before we wrap up anything else you want to say before we close we love security I I just want to say this I've seen a lot of your talks yeah and um what I really like is you've been in the game a long time you cut out all the noise and you like just give it straight and that's what I really really appreciate it well you see you seem to understand yeah yeah good bro okay thanks Tom yeah thanks for having me thank you [Music]