April 2023 Summaries

In the Future of Security Operations podcast, Thomas discusses with Morey Haber, Chief Security Officer at BeyondTrust, about various pressing topics in cybersecurity, including the evolution of vulnerability management and security operations over two decades, identity-based risks in remote work, and the vulnerabilities of two-factor and multi-factor authentication. Haber, with over 25 years of IT experience and numerous publications, highlights BeyondTrust's focus on privileged access and least privilege principles to maintain transaction integrity, as well as the unique challenges posed by cloud security. The conversation also touches on the importance of self-discipline for mental health to prevent burnout, the potential future of cybersecurity with AI advancements, and the need for security teams to be cautious about ChatGPT. Haber shares insights on staying informed about cybersecurity threats and recalls significant security incidents from his career.

The text introduces the concepts of "cases" and "records," which are tools designed to help users investigate, remediate, and report incidents within a collaborative workspace. Cases are built using records, which allow for the normalization of data according to user-defined structures, facilitating the capture and management of unexpected events. Users are encouraged to try these features with a free 45-day trial. Additionally, the text highlights improvements in formulas based on customer feedback, including new features such as NO MATCH and SET KEY OBJECTS TO CSV, and the introduction of a TOLERANCE feature that enhances the deduplication process by allowing users to specify the number of times a duplicate event can be executed. A minor quality of life update includes an action running indicator that displays a loading spinner on the action card to show ongoing processes.

Automation in cybersecurity has significantly enhanced efficiency by saving time and improving consistency and accuracy in processes. Tines provides tools to measure the time saved through automation down to the second, particularly for actions involving external services or user feedback. Users can view accumulated time savings on a reporting dashboard that includes graphs and sections reviewing the most active stories and actions. To effectively record time savings, it's recommended to start with frequently used workflows and actions, focusing on time-consuming processes like HTTP requests. Estimating time savings can be challenging but provides valuable insights into automation's impact, and it is advised to be conservative in estimates to ensure accuracy. A reporting dashboard helps visualize the value of automation, guiding organizations to refine processes and potentially eliminate low-impact activities, emphasizing that automation should complement rather than replace human efforts.

Tines has introduced a new feature that allows users to build APIs, enabling the creation of more powerful, code-free workflows by connecting various tools and processes. This update facilitates the sharing of API endpoints with both internal and external teams, allowing them to integrate these APIs into their applications without exposing the underlying systems like HR, IT, or threat intelligence tools. Users can create APIs for tasks such as internal employee lookups, IP address enrichment, device owner searches, and IT ticket creation, all while maintaining centralized API key control. Building an API in Tines involves enabling the "send to story" option in workflows and configuring the exit action to return data as an HTTP response. Tines has also developed its own free APIs for users, including utilities like WHOIS information retrieval and reverse IP lookups, which can be accessed without manual authentication. The Tines Toolkit, which includes these APIs, will soon be available to all tenants, with early access available through a form submission.

Security incidents are unavoidable for organizations regardless of size or investment level, as evidenced by a 125% increase in incidents from 2020 to 2021 affecting even major entities like Uber and the US Government. The challenge lies not only in the number of attacks but also in the ability of security teams to promptly respond and neutralize threats without being overwhelmed by false positives and competing priorities. Fixing every vulnerability is unrealistic, necessitating reliance on tools like the Common Vulnerability Scoring System to prioritize risks, but constant reevaluation is crucial as priorities shift rapidly. Security teams often face burnout due to overlapping responsibilities with IT and the need to balance business objectives, such as speed versus security. Proactive security measures, including regular updates, multi-factor authentication, and no-code automation, are essential to prevent breaches. Automation tools like Tines can streamline incident response by connecting disparate technologies and reducing manual workloads, enabling security professionals to focus their expertise on critical threats.

In a podcast episode focused on the future of security operations, Arthur Barnes, the Senior Director of Security Operations at Oracle, shares insights from his extensive 20-year career in cybersecurity, having held positions at Pearson, Dell, and M&S. The discussion covers his transition from government and consulting roles into the security sector and examines the evolution of security over the past decade, highlighting challenges faced by cybersecurity leaders. Barnes offers advice on hiring and promoting the right candidates, addressing mental health in cybersecurity, and reducing repetitive tasks through automation. He also recounts notable forensic investigations and shares his top advice for current security team leaders, alongside predictions for the structure of future security teams.

Security teams are increasingly using automation solutions to enhance response times, requiring secure and efficient methods for sending and reading emails. Traditional email protocols like SMTP are considered outdated and insecure, prompting a shift towards using APIs, which offer greater security and control. For organizations using Microsoft Office 365, Tines provides a solution allowing emails to be sent and read securely via the Graph API, eliminating the need for service accounts. This involves setting up Azure Active Directory with specific permissions and configuring Tines to send and read emails through API calls, thereby maintaining control over email origins and content while adhering to least privilege principles. Although this method isn't foolproof and lacks current support for encryption via Microsoft Information Protection, it significantly mitigates risks by keeping sensitive data within the organization's control.