Sign Kansas Banking RFP Secure

Industry sign banking kansas rfp secure

breaches and cybersecurity incidents are making headlines every day what are you doing to be prepared welcome to the tripwire cybersecurity podcast brought to you by tripwire the show that explores cybersecurity forward the enterprise and how to identify and protect against cyber threats before they happen listen for techniques and best practices to harden your defenses against hackers now here's your host Tim urlan welcome everyone to this episode of the tripwires cybersecurity podcast I am Tim Allen vice president of product management strategy at tripwire and today I am joined by mark helped the CSO for data bank mark welcome thank you very much I'm glad to be here data bank is a managed services provider and you're the CSO there can you tell us a little bit about what that entails how is that different from being a CSO for another type of organization yeah sure so databank is a managed services and colocation center colocation data center provider so in my experience of being a both a chief technology officer in a chief information security officer in other organizations the difference here is that we have such a broad range of compliance items that we have to deal with in an enterprise type of environment or an environment where a company is is singularly focused on a product or a series of products you can really kind of focus your your compliance needs and your security needs on to those types of environments whereas in a managed services provider I'm dealing with the financial industry the healthcare industry the PCI side of things GLBA SEC types of things federal government related items and the list can go on so it's it's it makes our security world if you will a very broad topic that we have to keep up on and then we have to understand and what does it mean to be a C so for that type of organization what do you what do you your time doing or were you responsible for so a lot of my time is spent with helping customers enter into a managed services type of agreement and into the managed services environment a lot of our customers are coming from enterprise on on-site type of situations and they're not yet completely comfortable with the cloud so to boil it down I do a lot of sales work but I don't look at it as sales I look at it more as a consultative approach type of type of work where I sit down with the customers I understand their needs I find out what they need from a compliance and security perspective and I provide them with the matched materials the matched documents they need the the the various products that they need from in order for them to be secure and what I've found a lot in this type of environment is the customers are coming to us not completely understanding the security environment that they need to protect themselves so we've had a lot of situations where customers are coming in they're being told by their customers through RFPs or other types of contractual obligations that they need to comply with a particular type of security or compliance environment most typically we found that with FedRAMP or PCI and the customers are coming to us they're SMBs or they're even sometimes larger enterprises that have yet to have those kinds of things put on their plate by a contractual obligation and they need to be walked through that process everything from understanding exactly what that compliance document the or the compliance requirement is to how those tools and materials and documents that we produce for them of the audits and things like that are put into place on their environment that's interesting I mean I think we talked to you know a lot of customers at tripwire large enterprise organizations where you know information has has to deal with multiple compliance standards obviously with the threat environment as it changes and and yes they're focused on their business but they still have a bit of that that multiplicity it sounds like in your role you basically end up with the the aggregate of everything that that all of the customers might might have to deal with in terms of security and compliance is that is that right that is absolutely true and even after the sale so to speak we get a lot of customers coming back to us and you know when they have new contracts coming down the pipe and they start asking us well hey I was just told I need to be ITAR compliant or I was just told I need to be CMMC compliant or NIST 801 71 or even ISO compliant they come to us and they say we don't know what those things are can you help us how can we be compliant in our current environment without having to buy or stand up a whole new environment so that that's absolutely true what you're saying so with such a broad range of you know regulations and standards that you have to be familiar with how do you keep up to date I mean that sounds like a serious challenge well it is a very serious challenge and the way that I keep up to date is like is a couple of things I spend a lot of time in the evenings glancing over and and reading the various news articles if you will that are out there so that I'm at least familiar with the the various new terms that are coming out and then as a customer approaches me quite frankly a lot of times I'll go do a little bit of a little bit of research to either brush up on my existing knowledge or to make sure that the requirements haven't changed if I if it's been something I haven't dealt with in quite a while so it is a challenge sometimes it's kind of I would somewhat call it playing like whack-a-mole where if something pops up I need to go do some research on it I gain a little bit knowledge on it and other times it's a it's a standard approach of just constant we spending an hour or so or more a day reading what's out there what's available and going and searching for it specifically so you know top of my reading list the past couple of weeks a couple of months actually has been the gnudi Department of Defense the DoD could maturity model the CMM see and the reason for that is because there's a lot of myths out there even the DoD just this past week had to come out with a statement about some of those myths and the fact that they have not certified anybody yet to actually certify a provider like us so they don't have a third-party assessment organization yet that can assess an organization like databank so we can move forward with CMMC certification and the reason they had to come out with that is because there's been a lot of companies a lot of assessment notic companies that are out there claiming to be able to certify a company against CM FC and that's just not the truth so one of the biggest challenges that I have is sifting through the truth versus you know the fact versus a fiction type of thing and one of the ways I do that is I always go back to the source I have a I have some experience if you will doing intelligence analyst work and we always graded our sources and so I always try and find my a1 sources to make sure that those sources are are based in fact and they are coming from the the people that are responsible for it so that's this week with the CMMC situation I went back to the DoD head of that or that portion of the organization and I looked at that person's tweets and other social media posts and I found exactly what I was looking for in that article that's really interesting I the idea of you know in this this world of you know questionable information sometimes disinformation that idea of grading sources and having a mental model for quickly assessing how close to the original source your information is and the skills to go find the original source if you can I think that's valuable inside of information security outside of information security it makes a lot of sense to me it's something I haven't really thought of before oh absolutely and you know I'll just give a lot of people you know on this podcast a you know a and definitely go and do that figure it out go on Wikipedia and understand how two great sources because one of the biggest problems we're dealing with right now a lot of people don't realize how much this this coronavirus kovat 19 situation is a information security problem because we're a lot of us are responsible for our business continuity plans and and continuity of operations plans and one of the things I do for my team on a daily basis my management team is I send out a daily brief and I grade the Intel sources on that so they know how they should view the article that I placed on there whether it's considered you know hard gospel is you know it's a it's a law or or a directive by a governor or if it's just a summary that's been put together by a media source the grading on that Intel is absolutely important for my management to be able to make the right decisions and it that's true not just with the coronavirus Cova 19 situation but it's true with all the data that we put together you know going back to CMC CMMC situation if I came out and I said well I saw that this particular third-party Assessor claims to be able to do this and I ran with that without validating the information I could be giving my customers bad information it could be spreading fiction and and directing people in in the wrong direction and and now I have to eat my words later if if I'm not getting the information from it an a.1 graded source yeah the idea of having as a C so providing your your stakeholders your executives with that kind of a daily briefing with graded sources is something I think that's something pretty actionable that people could actually actually just go do and it would you know improve the internal perception of their role and and you know how they their level of you know how form they are about information security and changes that go on so I like that right I've found it increases my credibility with my leadership if they know the the grading of the source and and know you know how I view it in that in that grading process know so you mentioned a couple of different compliance standards before and given that you're in a shared tenant environment and you know I have this the statement that there's no such thing as compliance without audit I have to assume that you end up dealing with auditors and auditing you know across the board in your in your role is that right absolutely well I deal with five different audits a year you are listening to the tripwires cybersecurity podcast thousands of organizations rely on tripwire to serve as the core of their cybersecurity programs why because we detect suspicious activity before it becomes breech our systems work on-site and in the cloud defined monitor and minimize a wide range of threats with deep system visibility and automated compliance we help you shorten the time it takes to catch vulnerabilities and ensure your organization is following the absolute best practices in cybersecurity today for more information visit tripwire comm that's tripwire dot-com now back to your host Tim Erlin what are your what's your best advice for operating effectively an environment with multiple audits like that because I know a lot of organizations have multiple compliance needs and they may have internal and external audit and then be in a similar situation although not across multiple tenants mm-hmm yeah so there's a couple of strategies that I take number one so I've already mentioned I have five audits a year so I've looked at my audits and tried to group them together so we could do some of them simultaneously so I cannot do my FedRAMP audit at the same time as the others the the ability to do that from a a workload perspective is not there typically the 3p AOS that do the FedRAMP audits are they maybe able to do assess I'm sorry an SSA 18 on it or or another type of audit but they typically will not do those simultaneous with the seven same evidence there's different evidence pieces artifacts that are collected so I break them out and I do the FedRAMP audits in the spring and I do my PCI my HIPAA and my SS 18 audits in in the fall because the HIPAA PCI and SSA 18 we can reuse artifacts so if I submit one one piece of evidence it could be used for all four of those environments those all four of those audits and it's it can be done by the same auditor so that's one strategy that I've applied to the situation second strategy I've applied to the situation is use a common baseline for security controls so we're at NIST 800-53 revision for security control shop and so everything that I do is geared towards complying with NIST because that's our our highest standard and if there is a particular control in another standard that causes me to raise that that I will for that one control so an example is that the NIST standard asks you to do a penetration test on an annual basis where PCI asks it to be done twice a year so we raise it to that twice a year level so break up your audits and and it will group them but break them up if you can in the types you're doing do it based upon one standard and then you know finally you know be able to have a message that goes out to your team that they understand the importance of these audits and and have a continuous monitoring process in place that allows you to collect as many artifacts as you can without bothering other people throughout the organization so do automation do standardized reporting on a monthly basis for for various pieces of your environment so that you could just go into a ticketing system or go to a repository has an audit artifact collector and grab the information that's out there without bothering people you know multiple times a year the data should already be out there so do you do you aim to be essentially continuously audit ready in that sense yes so you know hard at the heart of continuous monitoring is that you're essentially audit ready for for most of your organization so we do daily weekly monthly and quarterly continuous monitoring and so we should be able to take those reports that we develop for those you know timed events had turned them over to our auditors and you know we kind of gear the controls within way for our auditors towards those reports and vice versa yeah and then the other challenge that might be interesting to talk about a bit there is that that you've got a you know shared infrastructure you've got tenant specific infrastructure and then of course the the customers have their own infrastructure so there are some interesting boundaries there to deal with in terms of audit and compliance I imagine right absolutely and so you know one of the one of the best things that's come out of PCI is the requirement to have a boundary diagram as part of it as well as a document in our case a spreadsheet that identifies the boundaries that are responsible by for data banks responsible for and what the customer is responsible for so that responsibility matrix in in my type of environment it is is paramount to success because it limits what my auditors audit it clearly documents and defines for my customers what they're what they need to go and do and they need their auditors need to do you could even transfer that easily over into a into an enterprise environment where you define through that that responsibilities matrix which departments within your organization are responsible for which layers of the environment yeah we've seen I mean with PCI we've seen a significant push to you know reduce the the size of the cardholder data environment specifically to avoid the you know the the burden of audit but there's no reason that that type of approach or method couldn't apply to other you know standards I mean you've got a you know some kind of scope for that audit and the more you can reduce it or at least articulate it clearly the the more you can be sort of continuously prepared what about the difference between you know different size of customers you know small customers versus you know large enterprises I think you end up dealing with with all of them across the board or are there specific verticals that are particularly interesting or challenging from a you know security standpoint yeah it's not the verticals that are challenging it's the size of the corporation you would think that the larger the corporation the more people they have watching you the bigger the problem hat they will be and that's absolutely not true actually the bigger they are the more cooperation we get because they understand where the boundaries are and they understand their responsibilities better where I found the biggest challenge is the smaller the company and the less less technical the company is the more that they are or the less that they're informed on what they should be doing I've had a number of situations where SMBs who are very good at what they do in their vertical let's just say as an example a healthcare type of vertical where HIPAA HIPAA applies and possibly PCI as well that a number of SMB type of customers come to us and believe that if they put all of the HIPAA related data and all of the PCI cardholder data into our environment that that absolves them whatsoever of being responsible for HIPAA and we've had a couple situations where I'd literally have been on the phone with the CEO of that company and their lawyer and their lawyer has gone to the CEO said you know what their chief information security officer is correct we still have to comply with HIPAA that you know that company our customer is still considered the covered entity because they're responsible for the data a lot of people do not understand that the managed service provider never assumes or takes responsibility for the data it's still the customer's responsibility yeah I mean that's a challenge we've seen with you know movement to the cloud as well as you know managed service providers this idea that somehow Amazon or Microsoft is suddenly responsible for securing your data when in fact they are very clear about what they're responsible for and what they're not it's just a matter of you you know maybe not having read it as a customer that's correct the MSAs are very important and understanding them is very important to running an SMB type of situation now so from your perspective you know as a CSO for a you know shared tenant kind of environment a managed service provider what do you see is the the biggest changes that are coming in terms of the the attack surface what what we be looking forward to and with you know if not with worry but you know with foresight and planning that we should be prepared for well I think the biggest change that's coming is not necessarily an attack surface but is is in privacy there is a bill that's been placed before the Senate by Senator Moran out of Kansas that is somewhat countering some of the state laws that are out there that have been developed the CCPA for example and to bring a little bit more of maturity if you will from the federal side of think California consumer Privacy Act right right yes the California consumer Privacy Act so there's a federal bill that's on the table right now that was introduced in the past week to to deal with that if you will or to to address that now as far as actual attack services ransomware is huge DDoS protection offices actually are on the rise and a lot of people don't realize that because there's such an old attack method so those two items I think are going to be the biggest things that we have to deal with in the next six months to a year and then there's always the advanced persistent threat or the nation-state attackers that are out there and those situations change from day to day month to month you know you know right now with this Co vid situation we have a little bit of a some rhetoric if you will going on between China and the United States and their leaders about the source of this virus well the the words that have been used on both sides are words that can result in cyber attacks in response we've seen those kinds of things before so those are the biggest things that I'm looking for you know right now you know that can change in a matter of days or even months but right now it's ransomware is DDoS attacks and it's anything that a nation-state wants to throw as a result of situations and you know frankly we've had two of those already in 2020 we've had the situation with Iran at the beginning of the year where there was a major cyber threat that existed and/or could have existed and and now with the the rhetoric between Washington and and Beijing there's a real reality that there's a cyber threat that exists there yeah I think the you know the changes in attack techniques or attack types is something that sort of goes on constantly your point about legislative changes around privacy that's something that that I don't I don't think is always on our radar but has material impact on the business I mean that's that's where compliance and auditing you know become a significant burden for organization so that that's well worth paying attention to as well absolutely especially this law not only addresses privacy but it puts a burden upon all companies of all sizes to have and I quote robust security controls in place and those robust security controls are open for definition of what that means you know I've actually had contact with Senator Moran's office and have suggested that they be a little more clear on what robust security controls mean does that mean nest 853 does that mean I so to I mean you know NIST 801 71 for for that matter it would be very helpful if we had a better idea of what quote-unquote robust security controls means all right well mark it looks like we're at the end of our time I I certainly appreciate you spending the time with us it was a very interesting conversation lots to pick a part in there I think we could actually keep talking for quite a long time yes we both like you thank you so much for your time I hope it was a helpful and enjoyable and interesting for everyone and please join us again on the next tripwire cybersecurity podcast thank you you have been listening to the tripwires cybersecurity podcast join us next time as we explore stories of people protecting people and techniques and best practices to harden your defenses against hackers we'll talk to you next time on the tripwire cybersecurity podcast [Music] you