Welcome to the quick 10 podcast brought to you by quick track, focusing on all things
fed con and cyber defense from different perspectives and different personalities, all in 10 ish
minutes. Here's your host, Derek White.
Our guest today is Patrick Colantonio, Vice President at Nectar Labs. Patrick, how you
doing? Doing pretty good, Derek. Glad to be on the flagship episode of this podcast.
So it's pretty exciting. Well, thanks for joining. You know, for those
that don't know, and there probably aren't many that do, but we go way back, I mean,
I want to say 2017, probably when we first started talking with you and your team. And
it's amazing in call it seven years, which sucks to say that out loud how quick that
went, how things are a little bit different than they were specifically in our space,
but cybersecurity and compliance world together. You talk a little bit about Nectar and where
you guys are today, maybe from where you were, you know, five, six, seven years ago, and
then we'll get into the topic right away. Yeah. Well, I mean, you know, back in 2017,
when DoD was really serious the first time rolling out their CUI initiative seven years
later, here we are. But in first and foremost, I mean, anything we're doing starts with a
pun, right? So I really love the title we're going for here. I can't promise good puns
in every title for this podcast, but this one was easy. You got to set the bar. You
got to, I mean, any good pun is also worth forcing, right? So if the other episodes you
force it, that's okay. It comes with the territory. But yeah, in terms of Nectar, I mean, where
we are as a company, where the product has been has come a long way. But I mean, in terms
of our core goals and focus of supporting small business, small business in the defense
industrial base, trying to provide meaningful products that add value and also help them
to adhere to compliance. You know, we've been doing that since day one, since we got our
start in 2016 for the NIST 800171 initiative, trying to build a platform of products that
we thought small businesses would be lacking or outside of regulation wouldn't typically
go and get. Of course, mid and large and enterprise companies have either regulatory things to
meet or just best cyber security. So they kind of already have those tools in place.
So we wanted to come out with SIM or SIM, come out with inventory, come out with vulnerability
scanning and yeah, we've been working together for a long time trying to thread the needle
and provide products to small business. So it seems you don't have a SIM, like a SIM
card or anything like that at Nectar Lab? Yeah. Yeah, it goes, I, what I try to, I try
to go both ways with it just because some people, but at the end of the day, it's all
logging, logging and aggregation. Yeah. It's all logging, right? So I mean,
well if this was the quick 60 podcasts and we can go on for our terrible jokes for a
lot longer, longer than that. So, no, no. So well, thanks for, thanks for spending some
time here in, you know, again, we're not looking to spend a week talking about a topic here,
but want to just roll through a couple of things with you, keep this very cordial. So
first and foremost, there are people out there who probably aren't overly familiar with,
you know, what the SIM is, what is it, what is it truthfully? Like, like what does it
do? Why is it important before getting into some more of the details? So can you just
give a very brief, brief definition of what it is and then we'll get into some more further
details more specific to how Nectar does it. Yeah. I mean, a SIM from a big picture standpoint
is going to provide insight into your environment, your organization by essentially it's going
to be pulling in logs and log data and other insights from all of the different applications,
all of the different endpoints, servers, cloud environment, whatever you're defining as your
scope of your entirety of the organization, it's going to be pulling and presenting information
to indicate potential areas of compromise, areas of inefficiency. It's really just going
to be painting a broad picture of what is happening in my network today. And especially
if in tandem with other tool sets, if they flag something, if you have an EDR or antivirus
that has a preventative measure, SIM is really going to allow you to go back and rebuild
what happened at that moment in time, either from a forensic standpoint or just to clue
you into what's happening. Right on. And when it comes to the importance of that, so say
it's 2024 now, right? So where were things in your opinion, three, four, five, six years
ago, just as an industry as a whole, not maybe specific to just where Nectar Labs spent their
time, but the importance of why do what you just said?
Yeah. I mean, in terms of SIM and capability, I mean, the capability has increased tenfold
over the past five to six years. I mean, just looking at the landscape in general of why
SIM is important or why similar tools like SIM are important, I mean, prior to 2020,
I mean, there's always been breaches and there's always been a lot of compromise at the consumer
level with a lot of different broad consumer products. I mean, just look at the Marriott
breach. But between now and the last, you know, since 2019, there's been at least a
bajillion breaches at the federal and the agency level. I mean, one of the biggest things
that you know where, because private industry is always going to lead the charge, you know,
they're always going to be at the tip of the spear. And then when you have regulation come
into play or especially when there's stuff coming out of the White House, regardless
of the administration, I mean, there's been several executive orders about specifically
that seem capabilities regarding aggregation of logs and reporting and incident response.
There's been several executive orders. There's been agency level directives, which are just
going to trickle down into private industry as mandates just because, I mean, to put it
bluntly, the federal government's been embarrassed the past five years with multiple breaches
of not just from the military, but also personnel. I mean, the OMB breach, you know, comes to
mind. So where things are going from a capability standpoint before SIM was really just to kind
of shoot a flare, raise a flag, let you know that something has transpired. But as we move
forward, especially as traditional infrastructure moving down to the endpoint and protection
of the endpoint has changed, especially with endpoint detection and response with EDR,
you really see where EDR paired with SIM paired with especially getting seasoned with machine
learning or especially AI reactive, protective and preventative measures. That's really going
to be the future of how quickly can we thwart a breach as soon as there is a, you know,
detected potentially malicious or even just an incident that can get quarantined and reviewed.
Maybe it wasn't malicious, but it was definitely something that was out of the ordinary and
anomaly. So that's really where SIM is moving in the future.
That is a piece that I think a lot of people want to put into automation and try to lessen
the burden on that. But, you know, how much reliance can you have on something that is
machine learning or, you know, quote AI, it's still going to come down to the human element
because the attacks aren't just, you know, sophisticated digital attacks. There's social
engineering, there's different ways that breaches, as you said, they happen. Some of them are
very embarrassing. I think we've seen some companies seem to spend more time on their
breach response plan than they actually do on their incident response plan. Very impressive
response to a breach, but maybe if they had shifted some of that effort towards this,
the inter 171 CMMC realm that has changed quite a bit since we first started working
together years ago. You know, it's a huge topic. There's a lot of small businesses,
a lot of disadvantaged businesses in the supply chain of the Department of Defense and across
the federal government contracting space. But you guys are tailored for this specific
market so well, but where do you see the struggles from organizations that are looking to achieve
these compliance requirements?
Yeah, I mean, in terms of there's been a lot of different companies that we've worked
with all different sizes. And the commonality across is really when it comes to resources
that they have, whether it's from a monetary standpoint, financial, whether it's from a
personnel standpoint, technical expertise, a lot of the scene vendors that are out there
are definitely tailored towards mid market enterprise. So they're relying upon having
dedicated personnel, dedicated time, and prior experience with a product like theirs in order
to be successful. So when you're looking at not only just the financial cost of purchasing
a product, there's additional man hour time and trial and error. And one of the biggest
things with setting up a scene is having it work for your environment and having to tailor
it. So how long is it going to be before that scene is operational and efficient. And what
we see is more often than not, the seams aren't operational, and they're definitely far and
away, you know, efficient from their setup. So what we try to do with with Nectar is have
a lot of commonality of different vendors that we see in the space, different types
of setups, and then also, of course, what needs to be configured for CMMC, where we
have a lot of things built out of the box and ready to go on day one. Like we've had
we had a client one time where we, we got them the product, we had the procurement,
we shipped our one of our appliances to them to stand up. And I had actually gotten an
email from someone in their purchasing department that was clearly a fish. And I reached out
and I said, Hey, think, think something happened with one of your mailboxes. And they said,
we know, we actually installed Nectar in the afternoon. And we were able to, you know,
pull in our 365 logs and spot that hijacked mailbox on, you know, day one, and it had
happened actually the morning of that of that same day. So they were able to go into Nectar
and do a post op where with other seams, you know, that could have taken longer, or they
might not have ever seen it. Because another issue with seams is just so much log data,
potentially, if it's not set up correctly. And Nectar, Nectar does a lot of pre parsing
to eliminate noise. So you know, that's one example, especially when it comes to this
market, CMMC, a lot of small businesses, this is their first seam purchase. So they don't
know how to evaluate, they don't know even how to really use it. And they definitely
don't have one, you know, full time employee or one FTE person to dedicate to, hey, can
you just babysit this one application? Forever? It's just not, it's not going to happen.
Yeah, and that, I think that's a, that's a great final point there on that topic is,
as it seems so easy to have something in checkboxes that you have, I know, sorry, I can't pass
it up. But the, you know, having having it having something, having it plugged in and
having it and saying I have it in your documentation does not mean that you're using it correctly.
And I think from our perspective, too, that's where we see a lot of eye openers is, oh,
yes. Okay, so now I see why that's important, specifically from the DOD's eyes or the government's
eyes on, yeah, I should be able to have this monitored. And you mentioned scope, if scope
changes, you know, think about how many things changed four years ago in the pandemic hit.
And now we've got people working from home, we've got everyone went to cloud. Maybe that's
one thing we didn't mention where it's just to spend such a shift, seismic shift of everyone
moving from traditional on prem to cloud and not factoring in the massive surface area
that they're introducing with that with that move.
And now we see we're seeing moves of a different type people are consolidating offices and
now they're opening new offices, they're shifting people and locations and migrating together.
And yeah, it's it's, you know, but it is it's a great feeling to be able to know that you
you can see things that are off. You can not not everything is serious, right? That's another
big topic that not everything's a breach. Not every incident is a breach. All that kind
of stuff is being able to have a grip on that. But assigning that responsibility and accountability
is a is a huge deal because what good is identifying a breach if you don't know how to shut it
off and and then learn from that. So well, OK, well, thank you. This was this was the
whole intent of the quick 10 podcast is to try to get through topics like this. So thanks
for thanks for joining us. Again, overall goal here is just to help businesses better
understand the same implementation and you know what's important, what's what's what's
going to change in the future. Changes are coming. You know, they will. They always will.
So thanks for thanks for being a good sport and jumping on here. If people do want to
learn more about Nectar Labs, where would you like them to go, Patrick? Yeah, I mean,
our website is number one first good place to go. So Nectar Labs dot com. Any Q T E
are L.A.B.S. dot com. And we do have monthly webinars where I review new features, do Q
and A. We have a YouTube channel again at Nectar Labs. You can check that out. And then,
of course, I'm always available via LinkedIn or email if you want to hit me up at Pat P.A.T.
at Nectar Labs dot com. Awesome. Well, thank you for that. Probably need to do the disclaimer
here that this was a conversation for education purposes and not legal advice by any means.
So but please reach out to Nectar and you can always visit our website as well at W.W.
dot quick track dot com. Quick is spelled C.U.I. C.K. Just like the title of the podcast.
And we can help you there. So thanks again, Patrick, and for joining us and for future
episodes of the quick track podcast, you can subscribe on Spotify, Apple podcasts, YouTube
and then some other platforms as we continue on. So thank you again, Patrick. And we look
forward to you being on as a guest next time. Thanks, Derek. Thanks for having me. See you.