Today on our Tech for Business podcast, Todd, our COO and CISO and Nate, our Director of
Cybersecurity and V.C.
So, are back again to answer our Cybersecurity Cores audience questions.
And two questions I didn't put on the list, but were super important to someone in the
audience was Nate, how do you keep your hair looking so good after a long day at the Tech
Fair?
Lots of hair gel.
Lots of hair gel, lots of hair gel, lots of hair spray.
Are you a hair spray guy or is it just gel?
I don't know, just one of those pomades.
Yeah, hop out of the shower, put it in your hair, go forward and don't really give it
a second thought, right?
I love it.
I mean, these are the burning questions we need to like.
And then Todd, they were asking, you know, we, I see that we're both rocking our little
uniform from that day, these amazing little vests.
And they asked, how come Todd looks the best out of all of us, out of 40 employees that
were there, you were rocking the best?
I don't know why that is not in my hair.
That would not be anything I would, I could do with the Kirk Cousins things if anybody
who's a Viking fan, my wife dresses me.
She doesn't, but it sounds good.
Yeah.
Well, the marketing team kind of dressed you that day.
They did, yeah, they did.
Are vests kind of a go-to thing for you or was that just on that day?
No, it was just that day.
And I actually am wearing it today too for those that don't have video, but no, I actually
don't really understand vests.
It is, I don't, and here I am wearing it today, but I think they're weird in general just
because from my perspective, I'm like, if you're cold, you usually put on a sweatshirt
or something along that line and everybody even responds as well, it's when your core
gets cold and I was like, does your core get cold, but not your arms?
That doesn't happen to me.
I'm totally with you.
I usually hate vests, but when marketing goes and gets a North Face vests, they're pretty
great.
Yeah, we gotta wear them.
And they look stylish.
I hate the fluffy, poofy vests and these are the nice thin, sporty ones.
Well, speaking of core, we're jumping into a cybersecurity course.
Last week we talked MFA and passwords and we covered a little bit of policy.
And this week we're talking a lot about Threat Locker because we had very specific questions,
but also some end user training, some AI, lots of different things.
So just to jump in, it feels like it's maybe going to be a little bit of a sales pitch
for Threat Locker.
So we can broaden it out if you want, but a lot of people asked about Threat Locker,
how it's stacking up to Microsoft, PAM, how it's handling those custom coded softwares,
and then how do we see Threat Locker and breach detection like Huntress, which I do not know
what that is, but playing into your best practices.
So kind of however you want to take that.
Okay, I do want to know.
Can I start real quick?
Of course.
Okay.
It's been a little bit from our end since we had the security cores conversation, but
just kind of refresher.
There are a couple of things that we were requiring as the non-negotiables and just on a real
brief if anybody missed those, their endpoint detection response, multi-factor authentication,
cybersecurity awareness training and or phishing simulations.
And then the last one was kind of doing audits.
And so you kind of got to do those things and then to get into part two, if you're doing
that thing, what's next, I'm going to kind of repeat what I said the last item was, is
you kind of need to reassess.
And we actually go out of our way to do that every single year.
And if you've looked at what's been happening over the years, there's a good reason for
it.
Everything changes and a 12 month period in cybersecurity unfortunately is an extremely
long time.
So a good example of this is a couple of years ago ransomware attacks where we're just going
to encrypt your data.
We're going to send you a ransom note.
That's the end of it.
And people said, okay, well, one of the best ways to combat that is having really good
backups.
Well, great.
They pivoted and said, well, I'm not only am I going to do that, I'm going to infiltrate
your data, show you that I have it.
So even if you can restore, I still got you.
And those kinds of things are just constantly changing and updating.
And we need to be making sure that we're doing what we can to protect ourselves, our customers,
et cetera.
So that reassessment to me is a very, very big deal is you just kind of have to reset
and say, where are we today?
What's happened in the world?
Just a quick example of what we've actually seen changing here.
And these are examples from just the past month is in the past, when we're talking about
Office 365 and Azure and the entire Microsoft ecosystem there is what we've seen is there's
also been a transition.
So while phishing attacks and that's the stuff will never stop, what we've seen a little
bit is rather than a lot of the spam and that kind of activity or trying to encrypt the
actual on-premise infrastructures as more and more people move to the cloud.
In the last month, we've seen a lot more resource hijacking essentially in Azure.
And so what this means is that your credit card is already associated with your Microsoft
account.
And so if someone can get in with admin permissions and go in and spin up new virtual disks, virtual
servers in your Azure environment, it's on your credit card, right?
And so they didn't have to pay anything to go set up a spam relay, something to further
their phishing attacks.
And then it all comes from your tenant, which makes it under risk of Microsoft trying to
suspend your account there because you're doing malicious activity.
And so we've actually seen quite a few of those in the last month or so in different
flavors.
So I won't go too deep into that, but getting back to the need of regularly tuning your
audits to address the modern threats.
Yeah, the one thing that I would kind of tally off of that is saying, again, what's next?
I was reading an article somewhat recently and I can find it and we can post it in our
notes too.
But one of the articles I was reading recently was talking about how your insurance organization
is becoming your new auditor.
And it does make sense, right?
I mean, most regulated organizations, the reasons why they have audits is because they're typically
insured by somebody else.
So banking, you're looking at FDIC, et cetera.
And this is not different when it comes to cybersecurity insurance.
And when they get their information, what are they doing?
They're looking to what already exists and they're saying, well, why would I reinvent
the wheel?
But they see kind of like us to a large degree.
They see what's changing in the industry.
They see what's being exploited.
They get all that information and their whole job is to mitigate risk.
And so when they're coming to you and saying, hey, I think you need to do, you know, two
years ago was multifactor.
And then we're saying, OK, well, now it's EDR.
The next big one, Ariel already touched to us already.
It's going to be a privilege access management.
So I'll tip the hand a little bit.
But the word that's coming from is they're saying, what's going on in the industry?
What do we need to do?
I did throw CIT into this bucket as well, because as an organization, we work with
a cross industry, health care, finance, education, you name it, we do it.
And so we see everything.
And you can quickly pick up trends.
This is the way people are getting exploited.
Here's the weaknesses and defenses.
Here's why this organization got attacked and that one didn't.
So when we're coming up with recommendations and whatnot, that's what's driving it.
That's partly what we see, but we're also looking and working quite frankly in lockstep
with the insurance organizations to make sure that customers, companies are getting what
they need to help mitigate the risks that are being presented.
Again, how it changed from a year ago to now.
And then just one last tally on that.
And then we can actually chat about some of those tools and stuff is the as we're working
with those insurance organizations.
The other thing is that when we see a few insurance questionnaires start to adapt new
language, those are early indicators of where the rest of the industry is going to go.
And so that's where we tend to take those early indicators and help start communicating
that to the customer.
So that way, when the insurance renewals do come out, you're already prepared for them.
And I'm going to throw one more thing on there because my favorite catchphrase is one more
thing is that there are some insurance organizations that do lag behind and some organizations say,
well, I'm not being forced to.
So I'm going to push that off.
I would remind you when you hear things like this coming up, or at least sit highly recommend,
you do kind of pay attention to what's happening in the industry.
While you're not necessarily forced to do it, it again was designed to reduce the risk
to your organization.
It's not because somebody made you.
It's because we're trying to basically eliminate or minimize the likelihood of a bad day.
So you kind of answered my last question, which was if you added something to this core,
it would be this PAM solution.
And again, to avoid too much of a sales pitch, but how does Threat Locker kind of stack
up to other ones or is kind of dealing or fits into best practices?
Yeah, so I can kind of take one step back just to build the foundation and then we'll
come into Threat Locker or any of the other solutions out there.
So privilege access management is essentially limiting administrative access to different
software or anything like that until you absolutely need it.
Same thing of applications don't need to necessarily run unless you've given them approval to run
and then you can contain the behavior of them into what's intended.
So for example, we want to be able to run PowerShell for checking the name of a computer,
right?
There's nothing malicious about that.
Now we don't want PowerShell to go call into the internet and download new scripts.
And if we do want it to go out to the internet, can we contain it to the areas where we know
we need it to connect to essentially, right?
So that's the premise of an application white listing privilege access management tool.
There's a lot of different flavors out there.
Some free, some that are licensed.
And so the two most common ones that I'm going to kind of touch about here is going to be
something like App Locker, which Microsoft is now switching it to WDAC, I believe.
Don't ask me the acronym because I just live in acronyms.
But it's essentially the App Locker component of Windows.
And so what App Locker just for the rest of the podcast here today, I'm just going to
keep saying App Locker.
That's Microsoft's free solution.
So in App Locker, the premise of that is you have to go to each device, run a PowerShell
script, inventory all the software on the environment, and then go back to the server,
the system, and build the policies surrounding that.
And so then if there's new changes in software, let's say there's various updates or something
like that, you have to go re-approve those, modify your policies, that kind of stuff.
So while it's free on the licensing, what you do is you pay for it on the labor side.
And so for small businesses where they don't have IT resources to be able to dedicate that
time, that labor cost can greatly exceed the value that they would want to put into play
there.
Where the Threat Locker comes into play is it's doing the same application wait listing
that App Locker can do, but what it does do is that it automatically inventories the software
and system drivers and everything like that when it's first installed.
And it goes into what they call a learning period for a bit.
And so when it's sitting in a learning period, it's dynamically building all those policies
for you, which is the labor intensive component.
And then the other thing is that App Locker doesn't have a audit log, essentially, of
all the software that's trying to run on these systems.
You'd have to go either to those different desperate systems and try and figure that
out if something was blocked.
Threat Locker, you can go into a single pane of glass for all systems and figure out what's
going to be blocked if I start securing these devices, essentially, right?
So you can quickly tune the policies if needed to ensure that you're not going to cripple
your environment once you actually secure them into a better state.
The other quick component or difference between the solutions is going to be App Locker doesn't
do anything for local admin privileges.
So that's a whole different skew that Microsoft knows how to price out and nickel and dime
us all.
That's where it's built into Threat Locker.
If this piece of software, to be able to install it, let's say it's AutoCAD, right?
We know that AutoCAD always requires local admin to be able to run and do updates.
You can give it just that admin access for that one application, but everything else
that the user does doesn't have admin.
And so you can greatly protect the core resources of that system.
That's the biggest general overview between the two.
I'm super passionate about it, and I am very, very familiar with these.
So I'm not going to go into too much depth.
More depth.
Yeah, for, again, for the general audience, we're not trying to sell Threat Locker per
say, but it is a very powerful tool.
There's a good reason organization like CIT would use something like Threat Locker, and
one of the biggest benefits for us as an organization is you do get a lot of bang for the buck, which
is what Nate was highlighting very heavily on the monetization part of Microsoft.
But there are other pieces that we get that we are able to leverage to.
So as we work with a lot of organizations and having tool sets that allow us to deal
with multi-tenanted companies, meaning we can look at multiple people and manage at
large scale, if you will, in a method that works well.
That works well for us.
That isn't something that every company can go out and do.
But some of the benefits that we get is we can deploy policies, as Nate was mentioning
globally, or we can get very specific to specific companies or even specific applications.
Where that gets beneficial is for an organization like us, if we're working with the banks,
we can say, we know this particular core banking app runs this weird obscure batch file because
it happens.
In case anybody doesn't remember what a batch file is, it's pretty old technology.
Almost nothing does it anymore, but the core banking app in this particular instance does.
You wouldn't normally expect that.
If it were happening, it would typically look like something that's malicious.
So the fact that we've gone through this, we've experienced it, we've known it, we can just
automatically apply that, hey, you're a bank, we know this is a possibility, we're just
going to go ahead and white list it and push it through.
So there are a lot of benefits for those kinds of things that are out there as well.
That doesn't mean there aren't other good tools.
As Nate mentioned, there are great tools out there.
And a little housekeeping on the acronym we dropped, Kelsey founded Forrest.
It's Windows Defender Application Control, which is an absolute mouthful, but at least
in this particular instance, Microsoft's stable defender, which is surprising.
It was funny that you mentioned that bank because that was the exact scenario that I
was thinking of of saying, these actually do solve business problems as well.
It's not just security trying to push more security, especially in your regulated industries.
So in the bank that I had in mind, I don't know if it's the same one that Todd had, but
we helped a bank that had about 300 users and everyone had local admin to their systems.
And for those that are sitting in a bank right now, maybe listening to this, you go, why
would you ever do that?
The problem is that their core banking application required local admin to be able to run properly.
Well, now you have your auditors coming to you saying, you can't do that.
Well, now you're at a pickle saying, well, I still need to be able to run my bank, but
my auditor says I can't do that.
So that's where the solution at least fell in the middle of that and said, we can remove
local admin, let the tool do the elevation of that one core banking application.
And now they meet both the business needs and the regulation, the regulatory needs.
So I'm going to go off on a little bit of a tangent and kind of zoom out a little bit
because you mentioned these PAM solutions and there's paid and then there are free and
different things you can do.
So when you are going through these audits, I know the answer is going to be it depends.
But is it better just to jump right into it depends?
It depends.
Sorry, I was just asking the actual question.
Is it better to just jump right into the paid version or not?
When you're talking about needing to get cybersecurity insurance and meet your audits,
it depends.
Next question.
Yeah, the biggest thing I'd just say is assess how much time you want to spend tuning it
is and implementing it because if you that's like the number one thing that I hear concerns
about is everyone I've asked in the past, do you use AppLocker?
No, or they say yes.
And how is it?
It's a pain in the side because it's a lot of work.
And so it's just one of those things where if your business says we can't afford the
licensing of a solution to do the labor for us, but you're okay spending that labor, maybe
you have a cheap labor outsourced labor, whatever it is that you can make up for that.
And do that, but just be aware that you're trading out saying, do I want this person
focused on application approvals and tuning a system or do I want them focused on maybe
a different business project that can drive the business a little more forward?
Right?
I tend to say let the tools do the grunt work and let your people use their minds to improve
the business.
Yeah, I agree.
I mean, the phrasing I've always used is automate what you can and then use your people for
the highly strategic work.
There's things that your technical individuals should be doing that are driving you forward
that are making the difference in the world, not day to day fixing antivirus things.
Those things can be automated.
You don't need to spend a lot of time patching your systems anymore.
Again, in my opinion, and this will be a little bit of a pro-CIT thing, but there are organizations
out there that we've seen that we've done that.
We can help you with that.
We can eliminate the friction.
That's why we use tools like this to get you going down that path.
I want to back up real briefly again because I really want to emphasize the privilege access
management.
It is a really big deal.
It used to be something that was so difficult as Nate said.
When you're looking at 300 people, you're going, how do I get there from here?
Tools like this exist.
They are there to help you through the process.
Then when you get into the ring fencing piece as well or the application white listing, this
is stuff that it used to be like that's incredibly difficult.
It's extremely hard to get there from here.
Your maturity needs to be very high to get that next piece in place.
That was true two years ago.
It's not anymore.
Again, you've got to constantly reevaluate.
Where am I at?
What's the next step?
The world's changed.
I need to address this.
Those two are by far.
It's not even close.
They're way up there as things that need to be addressed much sooner than they used to
be.
Ariel said she's going to throw a little tangent in there and I'll do this one really, really
quickly, but I'm going to contain it as much as I can.
It is another one of the tenants that you need to start thinking about as you start
looking at your infrastructure on the long-term scene.
Where am I going from here?
I'll throw out the phrase zero trust.
This is one of the ways that you start the ball rolling down the hill is how do I get
on that train?
How do I get going on it, et cetera?
These are things that you need to have in the back of your head as well.
Unfortunately, zero trust isn't a single product tool, whatever you buy, you implement,
you have it, but there is a path forward and this is one of those things that can help
along that path.
Sorry.
One last thing of why I wanted to talk about why a application way listing privilege access
management tool is going to be the next cybersecurity core is that we are seeing more and more
of these regulations adopt language into knowing the application sprawl within your environments
and who's using them because we've seen the federal government, everyone saying supply
chain risk is a massive threat to today.
We see that.
For example, those that remember things like log for J, the move a hack, anything like
that, vendors compromise or they push malicious after, then it becomes compromised in your
environments.
That's where these tools come into play to kind of again, isolate that from just being
automatically updated if something has changed or unsigned by a developer.
And then also, especially things like the banks and healthcare and everything like that
is do you know all the software in your environment because if there is ever, especially like
the governmental, small local government, CMMC, contractors, anything like that is you need
to know where is the software running, who's running it, maybe the country of origin of
some of the software as well.
So if you're running something like seven zip and there's a lot of IT people just squirming
right now, did you know that's a Russian company?
So those are the types of things that the DoD and everything is going to be looking for.
Yeah.
And again, here we go.
I love tangents, but I won't go into this too much because I think we probably are running
out of time, but I do agree with what Nate's bringing up here in regards to awareness of
your tools.
Again, when we're talking about doing assessments, one of the course to that is do you know what
you have?
You can't protect it if you don't know what you got.
And so we're starting to see this bit of an uptick in SaaS management.
I was actually at a conference a couple of weeks ago and they threw out a statistic that
said that an average company of 100 employee has no less than 150 SaaS tools.
In case anybody doesn't know what that is, it's software as a service.
There will also be your sales force, your office, you name it, anything that's cloud-based.
And I was like, 150, that's a lot.
But then you start going through your catalog of things and you're going, wow, my teams
are Zoom, my this, that, it adds up extremely quickly.
And to Nate's point, if you don't know what it is, you don't know who's using it, you
don't have the ability to detect that, you're going to be in a bad spot.
So there are tools for those kinds of things too.
I would say that one's starting to be a little bit more of an emerging thing because not
everybody is cloud-based yet.
But you can look at something that the example they used at this conference was just setting
up a meeting today and assuming it's Zoom, you're probably typically using about seven
SaaS tools to make that meeting happen.
And it's kind of mind-blowing as you start to think about that and go, yeah, right, that's
certainly possible.
My sales team could be doing this.
My marketing team could be doing this.
Who knows?
Even in teams, you want to send a GIF off to someone that's using a third-party provider
called Giffy to send that GIF, right?
So you start seeing all those start compiling on top of each other.
Yeah, wow.
Yeah, right.
Those two kind of add up.
I was trying to calculate in my head what I even knew of, but gosh.
I could tell you because we monitor it.
Oh my God.
I feel like Todd gave me the number at one point.
And oh man, that is a lot here at CAT.
But we might have to do the next core cybersecurity core podcast because I would love to sort
of move on to this next question, which affects everyone.
And I just love this question so much because I feel the frustration as I read it because
it's end user training.
And how do you get these end users to actually learn and not just click through?
It doesn't matter what industry you're in.
You are doing some level of end user training, I hope.
And how do you really get it to stick?
I'll take the first one.
I mean, I think there's a couple of things that you do.
The easy low-hanging fruit answers are you find tools that are engaging.
So as an example, at CIT, we use NOBA4 as our main training tool set, and they've got
a component of their training that's called the inside man.
And what these are is for all intents and purposes, it's a dramatization that's basically
like a TV show, but it's in a small little snippet that's easy to consume.
It doesn't take an enormous amount of time.
You're looking at like a three to five minute investment, but they are very interesting.
So that is something that we found to be extremely successful for us.
And it runs the gamut on issues and threats that are out there.
We also do a fair amount of in-person training.
And to me, I use, probably with no surprise, I use a fair amount of humor to try and make
sure that people are awake and try to catch them and see what's going on.
But part two for me is I try to relate the concerns to their personal lives, unless about
it being a company-related thing.
And the reason being is, well, the company is taking care of its things.
It's got all these tools and solutions in place.
A great example is I've heard companies or employees at companies go, why do my taxes
on my company computer?
Because I know it's secure.
You shouldn't do that.
So the conversations really go back to how do I make this hit home for you specifically
when you're at home and you don't have that extra layer of protection?
And if I can make that connection for you, you're going to do the same behaviors at home
that you're doing at work in vice versa.
Yeah, yeah, my main one was make it fun.
The security training in the past has been so dry and long.
It's sit down for 45 minutes and you do it once a year and it's just brutal.
So here at CIT, this is more of the phishing test rather than the full-on training.
We test weekly.
And so there's regular cadences to the actual training and trying to detect those phishing
threats and it's successful.
So we did our monthly, sorry, I think it was quarterly monthly and then all the way down
to weekly and maybe we should flip to daily at this point.
But when we did each significant drop of increase in frequency, we saw a significant decrease
in the number of people that were actually falling for the phishing test because that
regular cadence makes it more fresh in their mind and everything like that.
Same thing is rather than your annual 45-minute training, break it into monthly five-minute
bites, right?
You actually get more training throughout the year, but it doesn't feel as bad and it's
less impactful.
The other thing that I'd say is when a user does click on phishing, like a phishing email,
what we do is we have a couple of things to where it will actually pop up a page that
says, yes, you failed for a phishing test, but it can show the flags of what to look
for on the next email and why that one was malicious.
And so those are the really important things there.
And yeah, I'd say that just regular training and coaching them through why something was
bad.
Yeah, coaching is a good word to use rather than just...
Parading.
Yeah, yeah.
Yes.
Now, if you fail like four of them in a week or two weeks or whatever it is, because that's
the other thing, if you fail, we put you in a little more of a regular cadence, like short
term with very easy ones and then it pops you back into the normal group.
Now, if you fail multiple times in the easy one, we're going to have a quick chat to again
coach you through that and figure out what happened.
Yes.
Yeah, and Kelsey mentioned, though before, has those leaderboards now that we can see
sort of the departments.
Yeah.
And it's kind of all of these are different approaches.
So it's a little bit of a shotgun because something's going to stick.
Everybody's motivated by something different.
So if you have a lot of different approaches, you're going to motivate and connect with
more people.
Yeah.
One thing I'll throw on here for our leadership too, so I know we do have some leaders that
pay attention to the podcast.
Don't get frustrated if you don't get early adoption.
It's one of the big concerns we usually get when we talk about this is how we're going
to start rolling it out.
We're not doing this to be punitive.
So just hang in there.
Most people will overcome that relatively quickly.
But where I was going with this in particular is there are statistics out there that show
the whole seven times seven ways is the way that you communicate a lot of things to individuals.
By the time that you're absolutely exhausted communicating it, it's when people are starting
to hear it.
Again, hang in there.
It does take time, but you will get the traction.
You will get going where you need to go.
Yeah.
There's always those stragglers, but they will come along.
They will come along.
Yeah, for sure.
So continuing this end user training, they asked a little bit.
The next question is about AI and how AI is going to be incorporated into specifically
what we know before in the phishing training and what we could see down the road for that.
Yeah.
We have it enabled here at CIT and it's brutal sometimes because the way that it works is
that rather than just sending pre-canned templates that we say the services team should always
receive this type of stuff.
The marketing team should always receive this type of stuff.
What it'll do is says it looks like Arial just created or just did some training on fraud.
Right?
So maybe that's something that I want to test just to validate that or maybe it's something
that where she hasn't done her fraud training in a year.
Maybe we should go test her with something related to fraud.
And then also it'll say, well, it looks like Arial has regularly passed one that looks
like it's coming from HR.
I don't need to test that one anymore because we already know that she has that.
But you know what marketing loves?
Gift cards.
Let's send her a card once and see if she fails.
Starbucks cards.
Oh, boy.
Actually, I have a Starbucks gift card in my pocket at the moment.
But yes, let's tune it to the individual needs of that person and try and unfortunately
be a little bit brutal.
But what it does is it expands the scope of their training.
You're not just trying to do the same thing over and over and over again.
So yeah, I mean, I think the benefits you'll see as this continues to happen is you're
going to get better testing, more accurate, more timely, et cetera, et cetera.
So as things change, one of the things that we've historically done a really nice job
of trying to do is hit things that make sense.
So we're going into a holiday.
So you're going to see a bunch of fishing campaigns around Amazon and FedEx deliveries
and your credit card didn't go through.
That's just going to be something you see.
So having simulations that mimic that a little bit ahead of that curve does make sense.
And AI is only going to help with those types of things.
I know that these get posted on YouTube as well.
I realize I totally flashed the numbers on the screen, so I am going to redeem this.
So anyone looking at this on YouTube, it's already claimed.
Don't even try.
Oh man, I was going to say that the AI, it probably gives you a better idea as to what
your company might be struggling with too.
Are we struggling as a whole team with HR emails versus internal versus external and
comes back to that focused training?
What do we actually need?
What should we actually be training our people on?
So we're not spending 45 minutes on everything.
So we talked about a lot from last week to this week.
We covered our cyber security cores.
We covered some new cores that are coming up.
Is there anything?
I think I kind of end here and I'll open it up to anything else you want to add.
Are there any new technologies?
I know we talked about PAM, anything other than that, that people should be taking into
consideration or are overlooking or maybe you see coming down the road, like in 2024,
what we're really going to be focusing on.
And then I'll open it up to any other last words.
I guess the answer for me is, yeah, there's always going to be things.
And this unfortunately does fall into the end.
It depends category because it's not as, I'm sorry, but it's not as easy as this is the
tool for you.
It is in some cases, right?
When we made the shift to EDR, the answer was this is the tool.
Pay attention.
Hey, hey, hey, the world is not ending.
The sky is not falling, but you should do this.
The rest of the stuff as we kind of expand out the cores into the next ring, things get
a little more complicated because everybody's in a little bit of different positions.
So for example, I was talking to an organization that had gone through a GLBA report, and I
would Graham Leach, Bailey, whatever, it doesn't really matter.
And the person that had done that had come back and they made their point, this is what
you need to do and you need to do it as soon as possible.
And then they came to us for some assistance and my response is, that's a good solution,
but I'll tell you from my perspective, I would not do that.
Here's what I would do and here's why.
And so my answer was, yes, it is a good solution.
It just doesn't meet your immediate needs.
And your immediate needs are X, Y, and Z.
And everybody is different.
Everybody is in a different place.
Now that being said, things that I think are coming that are extremely interesting that
I think are going to be, you need to pay attention to this is going to be a game changer, is
it's going to be passwordless, pass keys, that kind of stuff is what's going to be the
next big push that is going to come.
I mean, there are a lot of things out there too.
I mean, we've talked about tools, the acronym of SASE, which allows you to protect your
SAS tools and whatnot, those are extremely important.
But again, not everybody's there.
Not everybody's moved to the cloud.
Not everybody's got the budget for it.
It's complicated.
It depends.
But things that are coming down the pipe would include stuff like key passes, pass keys,
that kind of stuff.
Sorry, I plugged the password manager.
Sorry, my bad.
Yeah, for me, I think one of the initial things that I totally agree with Todd on all of that
is going to be managing your devices, your workstations in the cloud as well.
And the reason why is that we see more and more organizations adopt things like mobile
device management or MDM solutions for their mobile devices, cell phones, tablets, that
type of stuff.
Microsoft, if you're a Microsoft fan, is pushing that direction as well to be able to have
your devices managed in there rather than on-premise active directory.
One of the big reasons why that is, is, number one, Microsoft wants people to continue moving
to the cloud, especially if you're a small business.
I'm not going to say it's relatively easy, but it is one of those things where smaller
businesses can adapt to that far quicker than someone like a large enterprise.
And so if you are having your devices managed via the cloud or like Intune or Endpoint Manager,
essentially what the benefit you get out of that is that your devices, they have some
great configuration policies, which basically eliminates the need to do all your group policies
to be able to quickly secure your devices.
And then because COVID has kind of shifted the way that people fundamentally work and
we have far more remote employees these days, if your device isn't connected to the home
internet or the business network via VPN or whatever it is, they're not receiving those
security policies that you're trying to push out.
And so that's where having it directly up to the cloud, it's always going to check in,
pull the policies, and then that's where you can get even further into the whole zero
trust that we talk about all the time.
So for example, this isn't my next item necessarily, but all of your wireless, you can move to
certificate based off authentication, remove the need for passwords all the time, for any
connection to the internet, and you're only allowing trusted devices to access your internet
as well.
Kind of going to Todd's point of password list, because for IT admins, what's the number
one cause of lockouts?
It's some type of mobile device where someone changed their password and the wireless is
spamming the network.
Or VPN.
Or VPN, one of the two.
So it essentially eliminates those needs and greatly reduces the admin overhead for lockouts
and stuff.
But it's such a fundamental component to the next steps and evolutions of where your security
maturity is going to go.
And then I'll put a selfish plug in just for identity and access management.
This is one where it's super, super core to my heart and super passionate.
I think we have to have a whole podcast just about this, but essentially, yeah, essentially
identity and access management is far more than just multi-factor.
A lot of people don't understand that.
It's your user directory.
It's how the multi-factor works.
It's the behavioral analysis of the logins.
It's tying all these devices together.
It's the automation, granting access to applications and when they have access to applications
for many small businesses, you give someone access to the network and they have free reign
over everything.
This eliminates all that and says, what do they have access?
And if they move positions, can you automatically revoke access to certain tools that maybe
that position doesn't need?
So that's far more mature.
But I would love for people to start moving that direction because we do see more mature
organizations adopting this all the time.
Yeah.
I mean, both of those items were very deep tenants of Zero Trust as well.
So they do make sense.
They are on the horizon.
We will see more of them.
For what it's worth, we saw a news report that came out of from Cisco that talks about
organizations moving towards Zero Trust.
The numbers I thought were excessively high.
It's not even close to that, but orgs are moving in that direction and these are tenants
that make up with it.
So I mean, excellent points.
The nice thing about the mobile device management tool, especially if you're in the Microsoft
ecosystem is there are some, the organization efficiencies that you get out of going down
that path in the future as well too.
So they've got Autopilot is one of the tools that you can start to get into, which helps
you with the deployment of your devices and so forth as well.
So lots of good security reasons, but there's also great business reasons to go pursue those
kinds of things as well.
I feel like I'm over here just writing down a bunch of podcast ideas that are going to
be filling our next year.
That's cool, man.
Yeah, there's a lot of stuff, a lot of stuff coming down.
And I want to take a moment and thank all of the tech fair attendees who sent in questions.
I really appreciate it and it got this amazing conversation.
If you enjoyed this podcast, please like and subscribe.
Or if you have a question, please reach out to us at info at cit-net.com or head out to
our website, cit-net.com slash podcast.
Thank you to Adam Neick for joining us today and we'll be back next week with an all new
episode.