November 2022 Summaries

In an episode of the Future of Security Operations podcast, Thomas interviews Madhav Gopal, a seasoned cybersecurity expert and CISO at a fintech start-up, who shares insights from his extensive career, including his previous role as VP of Cybersecurity Operations at Comcast Cable. With over 25 years of experience, Madhav discusses the intricacies of managing security operations and infrastructure at scale, emphasizing the importance of protecting key business functions while fostering collaboration between security teams and other organizational units. He offers perspectives on the current state of security operations amidst rapid technological advancements, strategies for managing risk, and methods to reduce manual tasks through engineering. Additionally, Madhav provides advice for security leaders and highlights qualities to seek in a competent CISO, drawing from his advisory roles with organizations like Save the Children US and Citadel Banking.

No-code automation can significantly alleviate the burden of alert overload on security teams by streamlining the management and remediation of alerts, allowing teams to focus on strategic tasks rather than being overwhelmed by a constant influx of alerts. Tools like Tines offer robust solutions that not only detect and block serious attacks but also facilitate cross-collaboration and prevent information silos without technological barriers. By automating tasks such as identifying urgent alerts, escalating them appropriately, and suppressing unimportant ones, security teams can improve their overall effectiveness and return on investment, particularly benefiting junior analysts and non-developers. Tines' Story Library provides a range of customizable automation workflows that can connect to both custom and off-the-shelf security tools, enabling organizations to take a proactive approach to alert management and focus on essential activities like updating documentation and patching vulnerabilities. When selecting a SOAR solution, it is crucial to assess an organization's specific needs and thoroughly test the chosen solution before implementation.

The document provides a detailed guide on using Tines to manage application credentials by connecting with HashiCorp Vault through AppRole authentication. It is divided into two main parts: the first part guides users on authenticating to the HashiCorp Vault to obtain a token using AppRole, requiring the configuration of Vault address, namespace, and AppRole credentials. The second part explains how to retrieve a specific Vault secret using a configured HTTP request credential, ensuring the system is properly set up to match example configurations for successful API calls. Throughout the process, users are advised to ensure that their resources and credentials are consistently named and correctly placed within the code, with example configurations provided for both authentication and secret retrieval processes.

Tines has introduced formulas as a new feature to enhance interaction with data in automated workflows, drawing inspiration from the familiar interface of spreadsheets like Excel and Google Sheets. This feature allows users to apply classic functions such as SUM and IF, along with an extensive library of specialized functions like HMAC_SHA256, CSV_PARSE, and CHUNK_ARRAY, which are particularly suited for security applications. In Tines, these formulas operate by referencing data from upstream actions, making them intuitive for users familiar with spreadsheets. As a no-code platform, Tines empowers users who understand the processes best to build and maintain automation, echoing the user accessibility that spreadsheets have historically provided. The excitement around the creative applications of formulas by users reflects the potential for innovation within the platform.

Tines enables users to automate complex manual tasks without coding, addressing a gap in the cybersecurity industry where automation of repetitive processes is still emerging. Despite skepticism about its efficacy, Tines aims to demonstrate the power of no-code automation through its comprehensive resources like blogs, videos, and example Stories. The introduction of Tines Labs signifies a commitment to advancing no-code solutions by researching and developing innovative workflows, templates, and API interactions to benefit both customers and the community. Tines Labs will adapt quickly to market trends and customer needs, ensuring the availability of diverse automation solutions. The initiative encourages collaboration and input from users, partners, and independent research, aiming to maintain the relevance and utility of Tines' offerings. Tines Labs is also expanding its team and invites interested parties to apply or contribute ideas for new automation stories.

In an episode of the Future of Security Operations podcast, Thomas interviews Kristian Kivimägi, Head of Security Operations at Pipedrive, to explore various facets of modern security operations. Kivimägi, who has expanded Pipedrive's Information Security team to 20 members and teaches at Tallinn University of Technology, shares insights on the current state of security operations, offering advice on talent retention and team building. He discusses strategies for minimizing manual tasks like handling phishing emails and highlights priorities for those looking to establish security teams. The conversation also covers methods for measuring team success and performance, addressing team well-being and mental health, and anticipates the evolution of security operations teams and the technologies they will adopt over the next five years.

Saul Whitton, Recruitment Lead at Tines, plays a pivotal role in the company's global staffing strategy by collaborating with team leaders to fulfill hiring needs and enhance the candidate experience throughout the recruitment process. With a rich background in agency recruitment and in-house roles at major tech companies like Oracle and Salesforce, Saul brings a wealth of experience to Tines, significantly contributing to the company's growth from 60 to over 150 employees in just a year. Outside of work, Saul enjoys running, having participated in numerous marathons, and has recently taken up Pilates to complement his active lifestyle. He shares insights into his daily responsibilities, emphasizing the importance of sourcing the best talent to drive Tines' success and innovation, and encourages new employees to actively engage and contribute to the company’s culture and growth. Saul highlights the transformative power of Tines' no-code platform, which offers users extensive opportunities to automate workflows, and recommends downloading the Community Edition to experience the advantages firsthand.

Security teams can enhance their defenses against both known and unknown threats by leveraging the combined capabilities of Tines and Stairwell Inception. Tines, a no-code automation platform, allows users to build and manage complex security workflows without coding, facilitating seamless integration across disparate tools. By pairing Tines with Stairwell Inception, a SaaS-based security platform, organizations gain access to automated threat detection and analysis that enriches their data insights and improves decision-making. Inception automatically collects and securely stores files from an organization, running them through a comprehensive research-grade analysis that includes YARA intelligence, AV scanning, variant discovery, and both static and dynamic analysis. This integration enables security teams to revisit and enrich existing evidence as new intelligence becomes available, optimizing threat detection and response capabilities. A practical application of this integration is demonstrated through a workflow where Tines retrieves threats from SentinelOne’s threat API, feeding them to Inception for enrichment, showcasing how the platforms work together to provide context and insights across security systems. This seamless connection allows for actionable knowledge and automated responses, empowering security teams to protect their organizations more effectively.

The Security Orchestration, Automation, and Response (SOAR) market is undergoing a significant transformation as next-generation tools emerge to address core security challenges faced by organizations. Traditionally, SOAR solutions have been all-in-one platforms that often fell short in functionality and user experience. As cyber threats become more complex and organizations increasingly adopt cloud infrastructure, the demand for flexible, robust, and intuitive SOAR tools has grown. A survey of 205 security professionals, commissioned by Tines, highlighted common challenges such as integration issues, deployment complexities, and platform stability with current SOAR solutions. Many respondents expressed a preference for standalone, laser-focused SOAR products over bundled solutions, citing customization and better integration capabilities as desired features. The survey also revealed that deploying SOAR platforms can be resource-intensive, with integration of external services and technical support being significant barriers. As the landscape evolves, security teams are looking for innovative solutions that offer seamless integration and efficient response capabilities to safeguard their networks effectively.

Tines, a company specializing in no-code automation, has appointed Terry Tripp as its new Chief Revenue Officer during a period of significant growth, highlighted by a recent $55 million Series B extension and a projected record revenue year. Terry brings extensive experience from his previous leadership roles at companies such as PTC, BMC, and Mulesoft, where he played a crucial role in a successful IPO and acquisition by Salesforce. His expertise is expected to drive Tines' business scaling and revenue growth, with the goal of becoming a market leader in no-code automation. The company remains focused on enhancing product and user experience, leveraging Terry's sales and marketing expertise to enable customers to efficiently automate critical workflows.

Managed Security Service Providers (MSSPs) are increasingly relying on advanced tools like Tines and Logz.io Cloud SIEM to enhance their security operations and manage client environments effectively. The use of these tools allows a Canadian MSSP to streamline its processes by providing real-time data visibility, automation, and integration capabilities, which are crucial for managing growing and complex security demands. By employing cloud-native services, the MSSP can efficiently address the fluctuating requirements of clients using a centralized platform that offers full network visibility and rapid issue resolution. Tines' no-code automation streamlines tasks such as log collection, event correlation, and reporting, enabling the MSSP to focus on securing clients' cloud infrastructures and ensuring compliance with security regulations. The integration of these technologies permits faster and more scalable responses to threats, enhancing the MSSP's ability to maintain security and compliance consistently.

Security incidents pose significant risks to organizations, prompting the need for swift response times, a priority for security operations centers (SOCs). Barracuda XDR, an extended detection and response platform, enhances cybersecurity by partnering with Tines and Elastic to streamline monitoring, enrich threat intelligence, and reduce response time. This collaboration, highlighted in a white paper by Merium Khalid and John Port, demonstrates the integration of Tines' no-code automation with Elastic to quickly detect and neutralize threats, thereby protecting sensitive assets. The partnership addresses the challenges of evolving threats and the limitations of traditional monitoring tools, which often result in false positives and missed alarms, by improving detection rates and enriching alerts. This enhancement allows SOC analysts to engage in more proactive tasks like threat hunting, offering Barracuda's partners and customers improved security outcomes.

In an episode of the Future of Security Operations, Thomas interviews Andrew DiMichele, Director of Security Operations at Redis, who shares insights from his extensive career spanning the US Air Force Reserves, CISCO, banking, IBM, and Citrix. The discussion covers the evolution of cybersecurity across various organizations, strategies to maintain employee engagement in cybersecurity, and the prevalent issue of short tenures in the industry due to burnout and mental health concerns. Andrew emphasizes the role of automation in reducing manual tasks and navigating approval processes, while highlighting the importance of cross-departmental collaboration to ensure the security team earns respect by effectively showcasing its work. He offers advice for new security leaders and provides his perspective on the future of security teams, including emerging technologies and preparation strategies for upcoming challenges.