RSA Coverage Includes Automation, MSSP & The Onerous Threat Landscape

The 2018 RSA Conference, held at the Moscone Center in San Francisco, Calif., has been packed with relatable security content/sessions, and its trade show floor is populated by some of the biggest names in cyber security, as well as emerging brands and other market leaders.

The conference provides an opportunity for security practitioners to both network and be exposed to thought-leading voices. Some booths, with DIY features, allow attendees to work in a virtual SOC or initiate incident response protocols. Scheduled sessions have tackled cryptocurrency, GDPR – the biggest acronym in security at the moment – and other hot topics.

The RSA website says that the conference allows professionals to “learn new approaches to info security” and “discover the latest technology and interact with top security leaders and pioneers.”

It reads, “Hands-on sessions, keynotes and informal gatherings allow you to tap into a smart, forward-thinking global community that will inspire and empower you.”

The Cyber Security Hub was on the ground floor of this event, quite literally, and aims to relay some useful bits of information from Tuesday’s agenda.

Trend Micro, Inc.’s Chief Cyber Security Officer, Ed Cabrera, spoke about the company’s focus on threat and vulnerability research. Current areas of importance for Trend include AI, IoT, smart cities and the manufacturing space, especially with the propagation of the WannaCry strain last year. Cabrera spoke about the impact of automation in cyber security, as well as the impact of intricate social engineering ploys. In describing the sort of cyber arms race between white hats and black hats, Cabrera said that “criminal automation is just as good as ours.” This means enterprise security officials must be cognizant of the power of these threat actors. Further, Cabrera described AI innovation in the enterprise (for security purposes) as a useful asset but not a “silver bullet.” He also praised the continued usage of human ingenuity in security.

Trend Micro was also fresh off the announcement of their Tech Accord membership. Trend, along with 33 other tech firms, have signed a cyber security pledge to commit to making the digital world safer.

On this accord and its aim to streamline info-sharing and security operations, Trend Micro’s Chief Operating Officer, Kevin Simzer, said, “The real-world consequences of cyber-threats have been repeatedly proved. As an industry, we must band together to fight cyber-criminals and stop future attacks from causing even more damage.”

Bay Dynamics: In a meeting with Vice President of Strategy, Steven Grossman, the surging importance of user behavior analytics (UBA), as well as risk management as a whole was shared. The new Symantec Information Centric Analytics tool, powered by a Bay Dynamics platform which consolidates the latest ICA prospect-facing content in one place for Symantec DLP specialists, was a focus. According to Bay’s website, it “compliments the detailed technical content on the Granite system.”

What’s more, Centrify, a company whose focus lies in Identity and Access Management (IAM) and Privileged Access Management (PAM) to secure networks and cloud computing environments, is pushing into the electoral space, as well as DevOps, as more security elements are getting baked into the developmental phase. Centrify’s “Secure the Vote” initiative aims to secure various election formats.

With its presence in Managed Security Services, AT&T Business aims to be a one-stop shop for users, who come to rely on AT&T across various functions. AT&T offered RSA attendees a comprehensive run-through of its security platform on transparent panel display screens.

In literature distributed at the event, AT&T writes that, “In a world of rapidly changing threats, cyber security is increasingly difficult to maintain across mobile endpoints through networks and to the cloud. We collaborate with you to enhance your networks, infrastructure, and devices with cyber security products and services to help you contain risk, embrace change, and elevate trust. This includes a rich ecosystem of technologies and partnerships, global oversight, and threat intelligence.”

One of our last meetings on Day 1 brought us a newly coined phrase from Cavirin, which provides security management across physical, public and hybrid clouds. With a focus on their “cyber posture intelligence” platform, the company’s tool helps gauge security posture in real time and aims to improve cyber hygiene for its users via actionable intelligence.

See Related: GDPR, Cryptocurrency Take Center Stage At RSA

Breaches Are Here To Stay

In another event entitled “CISO Security Panel: Can Data Breaches be Stopped?” security professionals discussed some of the most pressing cyber issues – including training, awareness, the threat landscape, incident response, compliance and more.

Panelists included David Bradbury, CSO of Symantec, Chris Camacho, Chief Strategy Officer of Flashpoint, Kim Green, CEO and Founder of Kazo Security, Kurt Lieber, VP and CISO of Aetna, Jack Miller, CISO of Open Systems, Hussein Syed, CISO of RWJBarnabas Health and David Tsao, CISO of Veeva.

On assessing the threat landscape against security posture, Green said the “basics” of security have gotten lost.

Bradbury said that remedying that issue will involve investing and creating a heightened “culture of security.” Green called for legislators to become more involved in the regulation of cyberspace, so that compliance and technical security can link up and prove more useful for enterprises.

Lieber said that some companies rely too heavily on compliance frameworks – the “checkbox approach” – and that risks must be more fully understood so that security ops can adapt to them.

“Data breaches are here, and they’re here to stay,” Green added, before saying that cyber security will “be okay” so long as the basics are covered.

Open Systems' Miller also spoke about the concept of leveraging technology to enhance all aspects of cyber security. He said that for some, business availability may trump security, so long as there is only a baseline to adhere to.

The consensus around the “talent crisis” seemed to be that there is, in fact, a struggle to fill the ranks with qualified candidates. The CISO panel said that a more concerted effort to train said professionals could only help the space.

In Closing

Overall, the first full day at RSA proved to be immensely eye-opening, both in terms of the visual flare, as well as the topics discussed. Security practitioners broached issues such as automation and machine learning, as well as GDPR compliance and comprehensive risk management. Despite the close proximity of the data privacy regulation (May 25, 2018) for enterprises, it remains a wholly important concern. Some security pros also believe that despite the measure's best efforts, no company will be fully compliant with GDPR.

Altogether, the RSA Conference (Tuesday, April 17) offered snackable content and soundbites, as well as intricate booth designs -- some multi-level and others segmented by function or display. Some booths offered Funko POP! toys, while others lured attendees over with video games and giveaways. Each effort, no matter how captive, came as a way for security vendors to boast cutting-edge tactics and capabilities. Day 1 of RSA was certainly a hit!

Stay tuned to CSHub.com for more RSA coverage!

Be Sure To Check Out: Know Your Systems: Cyber Security Tips For Board-Level Execs