May 2022 Summaries

Tines offers a versatile no-code automation platform that can be deployed either in the cloud or as a self-hosted solution, catering to the diverse needs of different organizations, including those in regulated industries such as finance, insurance, and government. Most enterprises favor their cloud option due to the convenience of not managing hardware or operational issues, and the benefit of automatic updates and new features. However, Tines also provides the Tines Tunnel feature, enabling secure connections between on-premise systems and their cloud service without altering firewall rules, which is particularly useful for mission-critical systems on private networks. While self-hosting offers data control and compliance benefits, it may complicate troubleshooting and scaling. Tines emphasizes data security with their SOC2 Type 2 certification and regular penetration tests, encouraging best practices for customer data protection. Ultimately, the choice between cloud and self-hosted solutions should consider factors like timing, flexibility, scalability, and cost, ensuring that organizations modernize their infrastructure without compromising on security or missing out on innovations.

In the fifth episode of the Future of Security Operations Podcast, Thomas interviews Dylan White, an Information Security Engineer at KnowBe4, to explore various aspects of cybersecurity. They discuss KnowBe4’s role in enhancing organizational security through awareness training and highlight the prevalent tactics used by hackers to deceive users. Dylan shares insights into his most successful phishing test and emphasizes the importance of fostering a security-conscious culture where employees feel comfortable acknowledging mistakes. The conversation delves into making security accessible across organizations and examines the current and future potential of security automation. Dylan elaborates on how automating routine tasks has significantly boosted his team's efficiency, making them five times more effective, and provides guidance for security leaders on leveraging automation successfully.

Tines and Elastic have announced a partnership aimed at enhancing security operations for their joint users by integrating their respective platforms. Elastic offers high-speed, cloud-scale detection, prevention, and response capabilities, while Tines provides a no-code automation platform to optimize workflows and reduce the workload on security analysts. The collaboration allows security teams to reduce dwell times, mean time to respond, and false-positive rates, thereby improving their agility and impact. Through this partnership, SOC teams can leverage Elastic's scalable detection and alerting with Tines' automation for continuous monitoring, threat detection, alert enrichment, and incident response. The integration enables streamlined automated workflows, reducing manual steps and allowing security analysts to quickly access enriched alert information for decision-making. Additionally, the partnership supports human interaction during automation processes, ensuring that critical actions like user lockouts or IP blocking are approved by team members. The partnership aims to provide users with a more robust security posture and maximize the value of their existing security investments.

In the fourth episode of the Future of Security Operations podcast, Thomas interviews Johannes Gilger, the CEO and founder of urlscan, a tool that scans URLs and websites to reveal the individual resources requested during site loading. Johannes discusses his transition from managing the Threat Intelligence Automation team at CrowdStrike to founding urlscan, highlighting the collaborative nature of the security community and the transformative role of automation in security investigations. He shares insights on common misconceptions about automation among urlscan users, offers advice for security operations teams starting with automation, and provides strategies for customer-facing brands to minimize their risk exposure. Additionally, Johannes speculates on future security challenges and emphasizes the importance of automation in preparing for these evolving threats.

Security teams face significant mental health challenges, exacerbated by the complexity of threats, business constraints, understaffing, and inadequate tools, leading to alert fatigue and burnout. A survey of 1,027 security team members from the U.S. and Europe highlighted these struggles, revealing that many professionals find it hard to maintain their wellbeing despite increased awareness of mental health issues. At Tines, initiatives such as company shutdown days, an Employee Assistance Program, and team-building activities aim to support employee mental health, fostering resilience and productivity. The company also offered 400 cybersecurity professionals a free 12-month subscription to Headspace to promote mindfulness and prevent burnout. The efforts underscore the importance of addressing mental health within the cybersecurity community to ensure both employee wellbeing and the provision of high-quality services.

Cyber threat intelligence (CTI) professionals generally find satisfaction in their roles, enjoying tasks like investigation and communication, despite challenges such as manual data processing and inconsistent formats. According to a SANS Institute survey, many CTI teams still rely on spreadsheets and homegrown solutions, with a significant portion of SOC analysts dedicating over half their time to tedious work. One solution to these inefficiencies is the integration of Pulsedive and Tines, which offers hybrid automation to streamline the analysis process by automating the collection and contextualization of threat intelligence data. This integration allows for real-time enrichment workflows, enabling analysts to efficiently analyze Indicators of Compromise (IOCs) and improve collaboration, thereby focusing on more strategic aspects of threat intelligence. Users can begin with free versions of both platforms and expand their capabilities as needed, leveraging tools like Pulsedive for scanning and Tines for automation to enhance their security programs.