ESW #292 – Dan Neault, Eric Tice
Full Audio
View Show IndexSegments
1. The Current State of Cloud Security: What You Need to Know – Dan Neault – ESW #292
Fast-paced business initiatives require applications and workloads to migrate to the cloud. While the data remains the same, there are significant differences between securing on-premises and cloud environments. In this discussion, Dan Neault shares what organizations need to know about securing data in the cloud and how to migrate to the cloud without compromising on security.
This segment is sponsored by Imperva. Visit https://securityweekly.com/imperva to learn more about them!
Sponsored By
Announcements
Don't miss any of your favorite Security Weekly content! Visit https://securityweekly.com/subscribe to subscribe to any of our podcast feeds and have all new episodes downloaded right to your phone! You can also join our mailing list, Discord server, and follow us on social media & our streaming platforms!
Guest
Dan Neault is an accomplished technology executive with over 20 years of experience. He helped build and grow some of the most recognizable technology companies in the world as a senior leader at Microsoft, AWS, NetApp, and Samsung, and later as founding CEO of Stellus Technologies.
At Imperva, Dan helps customers solve complex data security challenges, bringing new data-centric security products and solutions to market for protecting, managing, and using data.
Dan holds a B.S. in Electrical Engineering with Liberal Arts Honors from Gonzaga University, and a M.B.A. in Finance and Marketing from The University of Chicago Booth School of Business.
Hosts
2. The State of Software Supply Chain Security and Trends in Managing Threats – Eric Tice – ESW #292
Discuss the current state of the industry as it relates to the threats to application usage of open source. Understand what is being done to define risk, improve education and provide ways to proactively mitigate those risks.
Segment Resources: OpenSSF.org, https://openssf.org/oss-security-mobilization-plan/, slsa.org, https://github.com/ossf/wg-best-practices-os-developers, https://github.com/ossf/education/tree/main/plan, https://github.com/ossf/sirt, https://www.brighttalk.com/webcast/15811/528611?utmsource=brighttalk-portal&utmmedium=web&utmcontent=eric%20tice&utmterm=search-result-3&utmcampaign=webcasts-search-results-feed, https://www.brighttalk.com/webcast/534/527431?utmsource=brighttalk-portal&utmmedium=web&utmcontent=eric%20tice&utmterm=search-result-2&utmcampaign=webcasts-search-results-feed,
Announcements
We're always looking for great guests for all of the Security Weekly shows! Submit your suggestions by visiting https://securityweekly.com/guests and completing the form!
Guest
Eric is a Global Director of Strategic Technical Consulting and the COE Lead for the Wipro Lab45 Architecture Team. He provides strategic consulting services to assist clients with strategic planning, transformation, and the ideation and design of custom solutions leveraging innovative and emerging technologies. Eric has a rich experience of over 20 years in the IT industry and has played varied roles as well as being a thought leader in areas such as DevSecOps, Observability, and open source governance. His interest in open source, security, and automation goes back to his developer days and over the years he has gained considerable tact and expertise in leveraging open source to deliver business value and drive business agility for customers.
Hosts
3. Cyber Nutrition, IT & Sec Funding, Private Equity Firms, & The Splunk/Cribl Battle – ESW #292
Finally, in the enterprise security news: Don’t worry! IT and Security funding is OK and we have the proof in the form of 16 funding announcements, Private Equity firms are taking advantage of the dip in valuations to make a few acquisitions: KnowBe4 and ForgeRock Legal Drama! We’ll discuss the Joe Sullivan case, the Splunk/Cribl battle, Crypto Drama! Another week, another Crypto exchange losing half a billion, new insights on breaches and ransomware in two new reports from Cyentia Labs, Cybersecurity leaders have a hard time keeping companies secure, and Cyber Nutrition labels!
Announcements
Don't forget to check out our library of on-demand webcasts & technical trainings at securityweekly.com/ondemand.
Hosts
- 1. FUNDING: Arctic Wolf Announces the Closing of a $401 Million Convertible Notes Offering – Arctic Wolf$401M Convertible Note offering, led by Owl Rock. Arctic Wolf is an MSSP/MDR firm with over 3000 customers and 1100 channel partners. The core of its offering is an XDR platform designed for SOC use with a concierge model, where Arctic Wolf's team helps out as needed.
- 2. FUNDING: Expel Increases Series E To $171.3M
- 3. FUNDING: Securiti launches data security cloud and announces $75M Series C
- 4. FUNDING: Immersive Labs Secures $66 Million in New Capital and Expands its Leadership Team to Accelerate Growth$66M Venture Round that isn't labeled as a Series D, but follows a larger $75M Series C from 14 months ago. Led by Ten Eleven Ventures. I'm a big fan of training defenders with realistic simulations - Immersive has services that look somewhat similar to Recon InfoSec and Rangeforce (who we had on recently - episode 287!).
- 5. FUNDING: Stairwell Announces $45M Series B Funding Round$45M Series B, led by Section 32. Malware discovery, analysis, and detection platform designed to complement AV and EDR tools. Great demo of the tool available on YouTube, hosted by Risky Biz's Patrick Grey here: https://www.youtube.com/watch?v=VgYoEzY6R04
- 6. FUNDING: DataGrail Raises $45 Million, Empowers Businesses to Meet Growing Consumer Expectations with Automated Data Privacy Solutions$45M Series C, led by Third Point Ventures. Seems like an enterprise data privacy tool. Claims to integrate with over 1000 tools and streamlines the process of completing data subject requests (DSRs). This is one of the key features built into GDPR, where individuals have the right to request a copy of all data a company stores about them.
- 7. FUNDING: RealDefense Closes $30 Million in New Financing To Accelerate Acquisitions and Growth
- 8. FUNDING: IriusRisk lands $29M to automate threat modeling for apps
- 9. FUNDING: Endor Labs Launches with $25M Seed Financing to Tackle Massive Sprawl of Open Source Software (OSS)$25M Seed, led by Lightspeed Venture, Dell Tech Capital, and Sierra Ventures. IMO, this has "competitive Snyk ambitions" written all over it. The "SCA is not enough" line has been a familiar one over the past year, as we've seen new AppSec/software supply chain startups emerge. Star Wars reference?
- 10. FUNDING: Why Canapi is Leading Elpha Secure’s $20M Series A – Canapi$20M Series A, led by Canapi. Cyber insurance MGA - has an agent that, when installed on endpoints, alerts when it finds issues, which, when fixed, can raise a security score, which will lower insurance premiums.
- 11. FUNDING: Oort Announces $15M in Seed and Series A Funding Round$15M combined Series A and Seed, co-led by .406 Ventures and Energy Impact Partners. Oort appears to be an identity-specific Attack Surface Management play. They both look for configuration issues and potential threats, as well as publicly leaked or exposed credentials.
- 12. FUNDING: CrowdSec announces €14M in Series A funding to combat cybercrime – The open-source & collaborative IPS
- 13. FUNDING: Narf Industries Raises GBP9.8 Mln via Premium Private Share Placing
- 14. FUNDING: Qunnect raises $8 mln in funding round led by Airbus Ventures
- 15. FUNDING: Tidal Cyber Closes $4M Funding Round to Continue Making Threat-Informed Defense Achievable
- 16. FUNDING: Saporo Receives a Fit Digital Growth Loan
- 17. ACQUISITIONS: Cybersecurity firm KnowBe4 to go private in $4.6 billion deal with Vista Equity PartnersVista Equity's latest take private is a $4.6B deal to acquire KnowBe4. The deal comes a few weeks after the initial take private offer went public. This follows a $16.5B acquisition of Citrix in January.
- 18. ACQUISITIONS: ForgeRock to be Acquired by Thoma Bravo for $2.3Bhttps://investors.forgerock.com/press-releases/detail/353/forgerock-to-be-acquired-by-thoma-bravo-for-2-3b
- 19. TRENDS: Finally, Some Good News for Enterprise-Tech Startups: Battery Ventures Survey Finds Tech Spending Holding Steady, Even Increasing Despite Market Downturn – Battery VenturesYeah... we can tell! Look at how many funding announcements we have this week!!
- 20. TRENDS: Global VC Pullback Is Dramatic In Q3 2022
- 21. CRYPTO DRAMA: Binance Blockchain Hit by $570 Million Hack, Exposing Crypto VulnerabilitiesThe attack details are interesting, but that's not what I want to focus on here. What I'm trying to understand is how Binance loses over half a billion dollars while claiming "no users had lost money in the hack". How is the company absorbing a loss like this? It's unclear how much funding Binance has received, but it doesn't appear to be much, and the company doesn't appear to have done a raise since 2018. There were rumors that even Crypto.com had to raise some additional funding to cover the $30M they lost earlier this year. Afterwards, they implemented a $250k guarantee, copying the FDIC guarantee for banking customers. Does Binance make enough revenue from exchange fees to absorb this? Or do they have to dip into customer funds? This may partially be my ignorance, but I didn't think that crypto exchanges were like banks that are only required to have 10% of customer funds on hand at any given time? We've seen so many customers lose funds from crypto exchanges going bust (Celsius and Voyager, most recently), I can't imagine customers would be comfortable with this practice in 2022.
- 22. LEGAL DRAMA: Former Chief Security Officer Of Uber Convicted Of Federal Charges For Covering Up Data Breach Involving Millions Of Uber User Records
- 23. LEGAL DRAMA: Splunk Files Intellectual Property Complaint Against Cribl
- 24. LEGAL DRAMA: Cribl CEO Clint Sharp Responds to Splunk’s Lawsuit
- 25. ESSAY: Open source in cybersecurity: a deep dive
- 26. REPORTS: Information Risk Insights Study (IRIS) – Cyentia InstituteThe 2022 Information Risk Insights Study (IRIS) from Cyentia is available. The IRIS series has done some very interesting deep dives into topics like extreme loss events and multi-party incidents (the Tsunami report). This report zooms way out to focus on the big picture insights that can be gleaned from large datasets (77k events) going back a decade.
- 27. REPORTS: Reining in Ransomware – Investigative Cybercrime Series: Vol 2Cyentia's analysts, writers, and data scientists apparently don't sleep (says the guy typing this at half past midnight), so here's another great report from them! This is the sequel to the excellent "Mitigating Ransomware's Impact" report, which also leverages Arete's dataset of ransomware incidents. One of the most compelling insights that came out of the first report was a potential correlation between MFA deployments and reduced likelihood of paying a ransom. I look forward to reading through this volume!
- 28. REPORTS: Cybersecurity leaders are having a hard time keeping companies secure, and there’s no easy solutionAn interesting survey with a significant (900) sample size. Most interesting are some of the article's takeaways and the survey's assumptions, which I think help us understand why we're losing this fight in the first place: security teams may not be focused on the right things. There's a quote in the article: "If you're short-staffed, you can't have someone looking at every alert," said Bob Bragdon, SVP and managing director of Foundry's CSO Worldwide. If your goal is to have someone look at every alert, I'm not sure you're using your resources correctly. I've long wondered if the SOC isn't a symptom of a problem we created. My favorite metaphor is that Vuln Mgmt, IDS, SIEMs and their derivatives (SOAR, XDR, NDR) represent both the haystack AND the needles. Perhaps it's some misguided sense of FOMO that prevents us from ignoring the stuff that doesn't matter, I'm not sure. What I AM sure of is that we're wasting a LOT of time looking at vulnerabilities and alerts that represent no risk or threat to the business whatsoever. I have my doubts that using AI/ML to filter them is the right approach either - it feels too much like throwing even more money on the already blazing pyre of security budgets.
- 29. NEW INFOSEC CONTENT: Accidental CISO starts a YouTubeRemember Wolfgang Goerlich's "Stuck in Traffic" YouTube series? (https://www.youtube.com/c/JWolfgangGoerlich/videos) This is like that, but with an anonymous host, and on a motorcycle.
- 30. NEW FEATURES: r2c blog — It’s time to ignore 98% of dependency alerts. Introducing Semgrep Supply Chain.
- 31. LESSONS LEARNED: Have trouble keeping track of your keys? So does Toyota
- 32. DATA PRIVACY: UK pauses data reform bill to rethink how to replace GDPR
- 33. CONSUMER SECURITY: White House Plans Cyber Labeling System for IoT DevicesWe've been talking about this for a while, but the White House is now actively looking for feedback on a security labeling system for IoT devices. Cyber Nutrition Labels, yum! Actually, Carnegie Mellon has already created some prototypes for security labels: https://www.cylab.cmu.edu/news/2020/05/27-iot-labels-consumers.html And Germany has implemented a similar system, though it's voluntary and has only been implemented by 37 devices and services so far (all email services and broadband routers). https://www.redalertlabs.com/blog/top-10-things-you-should-know-about-german-it-security-label
- 34. SQUIRREL: Elephas – Personal AI Writing Assistant for Mac
- 35. SQUIRREL: AI-generated imagery is the new clip art as Microsoft adds DALL-E to its Office suite
