[MUSIC PLAYING]
NIMMY REICHENBERG: Hi, everyone.
Welcome to Next, and welcome to the Security Track at Next.
My name is Nimmy Reichenberg.
I head Security Operations Product Marketing
here at Google Cloud Security.
And in today's session, we're going
to take a look at one company's journey
to transform their security operations with Google Cloud
and Chronicle.
And with that, it is my pleasure to introduce our co-speaker,
Mike Orosz, Chief Information Security
Officer at Vertiv Corporation.
MIKE OROSZ: Thank you, Nimmy.
I'm really glad to be here and walk you through our journey.
NIMMY REICHENBERG: Excellent.
So to get us started, maybe you can tell us a little bit more
about Vertiv Corporation.
MIKE OROSZ: Absolutely.
Vertiv is a company that supplies
critical infrastructure to most of the Fortune 1000.
We're located in approximately 100 countries,
and we have almost 24,000 employees worldwide.
NIMMY REICHENBERG: Excellent.
And I believe one of the claims to fame of Vertiv
is you invented the first data center cooling system?
MIKE OROSZ: That's absolutely right, Nimmy.
A company which started out as Liebert Corporation
back in 1965 built that first cooling center AC unit,
and that's what was the spearhead for starting Vertiv.
NIMMY REICHENBERG: Well, data centers sure
have come a long way since.
MIKE OROSZ: They sure have, absolutely.
NIMMY REICHENBERG: Excellent.
So before we zoom-in right on security operations,
maybe tell us a little bit about the entire security
function at Vertiv.
What are you in charge of?
How is that structured?
MIKE OROSZ: Yeah, absolutely.
I lead many functions that comprise security.
It includes identity and access management,
security operations, security architecture,
and product security.
NIMMY REICHENBERG: Excellent.
And maybe talk a little bit about the size
of the team, where they're located,
the breadth of the team.
MIKE OROSZ: Sure.
Our team is located in every geographic region.
We have teams in Asia, Europe, as well as the US
and parts of Latin America.
And we're tasked with maintaining and monitoring
all our systems to ensure everything
is running as expected.
We're providing assurance to our internal stakeholders
and to our customers.
NIMMY REICHENBERG: Excellent.
All right, so let's talk about security operations
and talk about some of the challenges
that I believe many of you that are watching this session
are faced with.
So I'd like you to describe what the situation was
like before when it comes to security operations.
And we've kind of divided that into three main topics, maybe
the first one being the trade-offs
that so many people in security, and security
operations specifically, have to deal with.
So maybe talk a little about data ingest, cost,
scale, trade-offs.
What was that like for you at Vertiv?
MIKE OROSZ: You're absolutely right.
So trade-offs exists all the time in cybersecurity.
It's all about money and speed.
Frankly, no one wants to make those decisions.
But a common trade-off is what exactly we're
going to log, what we're going to monitor,
what we can monitor based on what we bought.
No one likes to be constrained in those ways.
NIMMY REICHENBERG: So in many senses,
you almost have to kind of pick which blind spots you're
willing to live with, right?
MIKE OROSZ: It can be that situation.
No one wants to be in a position where
they have to decide what they won't monitor just because they
can't afford to procure the right system.
NIMMY REICHENBERG: Got it.
And of course, with security increasingly becoming a data
problem, being able to make sure you can ingest and analyze
as much data as possible is ultimately
key to being able to detect and investigate threats.
MIKE OROSZ: You're absolutely right, Nimmy.
Now more than ever, data is proliferating.
And proliferation of data means you
have to analyze more information to get to the basic outcome
of an investigation.
And with that, you never want to be constrained
by a platform that essentially is so complex to operate
that you can't get to the end of the investigation.
You're always tweaking that platform
to get it to work and give you the results you need.
NIMMY REICHENBERG: Great.
So I think that's a great segue to the next point that we
want to discuss, which is complexity, right?
Not just-- cybersecurity is complex.
Hopefully, the tools that we use should
be as simple as possible, especially
given how hard it is to find very skilled
and experienced cybersecurity professionals these days.
Talk about complexity, how that affected you before you
embarked on this journey.
MIKE OROSZ: That's right, Nimmy.
So it's important to realize, a lot of traditional SIEM
platforms, you have to learn all this complex language
and scripting in order just to call data and get the results
from your queries.
And oftentimes, you have to write
queries that might take many hours to execute.
No one wants to be in a position where
you have to sit around and spend most of your time
learning how to operate a complex system,
instead of just picking it up, conducting your search,
getting results, dispositioning your investigation.
NIMMY REICHENBERG: All right.
And I guess that every minute or hour or day that you spend
on dealing with that complexity is time that you're not
actually spending on--
MIKE OROSZ: Doing investigations.
NIMMY REICHENBERG: --protecting the organization, right?
MIKE OROSZ: Yeah.
So you're spending time learning the platform.
You can't just pivot if someone leaves the team
and moves on to another role somewhere else.
You actually have to have some downtime and train someone.
And that right there takes away from security
because you're not committing resources on task.
You're spending time doing ancillary tasks like training,
which is just superfluous towards your objective
of securing an organization or your company.
NIMMY REICHENBERG: Right.
And finally, maybe we can talk a little bit about speed.
Speed is everything in cybersecurity.
It's usually not about trying to prevent everything,
but how quickly you can detect and respond to threats.
So maybe talk about some of the challenges around speed
that you encounter.
MIKE OROSZ: That's right.
Well, there's three core elements to any SIEM.
It's ingest, it's storage, and compute.
You can't be constrained in any way.
And compute is the key ingredient
when it comes to executing fast queries and searches
and getting results in a timely manner.
There were times historically where
I would wait until the next day to get the results of a query.
And when you're in a crisis situation or a situation
where you need to really focus and get results
so you can understand what exactly happened,
you can't wait that long.
It's not something you can do.
NIMMY REICHENBERG: Excellent.
So obviously, a lot of challenges, a lot of pain
which, I think, caused you to go out and embark on this journey
to better security operations.
So maybe you can share what are some of the things
that you were looking to change, how
you evaluated different solutions,
and what were, again, the criteria that you were looking
for to start embarking on this journey
and get to a better state.
MIKE OROSZ: Well, anyone who goes and buys any security
tool will automatically go out and have
to compare and contrast across all
the solutions on the market.
The right thing to do is do your due diligence
and your homework.
And a few of the things that we couldn't live with or without,
we didn't want to make trade-offs.
We didn't want to sacrifice how much we logged
and how much data we had to access when
conducting an investigation.
We didn't want to trade-off ease of operations, and the fact
that we wanted to commit more people on task
of conducting security work and doing security
work versus actually being trained
on how to use a complex tool.
That's very different.
And we wanted to improve speed.
We wanted to ensure that when we needed to investigate
something, we don't have to wait around for a couple of days
to go by just to get to that moment
where we can close an investigation--
NIMMY REICHENBERG: Right.
And I think--
MIKE OROSZ: --when we know what went on.
NIMMY REICHENBERG: --with trade-offs,
what I hear is not only about how much data you can invest
and how much compute power you can harness to analyze it,
but it's also retention, right?
Talk, maybe, about the importance
of retention and going back and looking back
at threats that may have been discovered now
but have been around for 6 to 9 months.
I think Log4j is a great example of that.
So maybe talk a little bit about that.
MIKE OROSZ: Yeah, you're right.
You can't-- just because something made it in the news
and it became public, like a security threat,
it doesn't mean that threat hasn't existed for a period
of time.
And I don't know where I heard the statistic,
but many incidents and breaches, the attacker
has been in your network for many months.
And what that means is you need to have more than just a couple
of months data to investigate when
you conduct your investigation.
Honestly, I want a year.
I want a year highly available.
I want a year of data where I can just push a button
and I can get results.
I want to be able to do it myself.
I want it to be so that any member of my team
can pick up this tool and actually get results just as
fast as I can do it myself.
And I set the bar pretty low for myself, so.
NIMMY REICHENBERG: Excellent.
So maybe tell us a little bit about the selection process
or the bake-off process before we
move into what life looks like after you've made a selection
and embarked on this journey.
MIKE OROSZ: So the key elements that I
wanted when we selected this product was I wanted a year
retention highly available.
I wanted unlimited compute resources.
And we want ease of use, where it's
no harder to search something on the internet
like in a typical search engine.
I want it to be the same ease of use for the SIEM platform.
NIMMY REICHENBERG: Yeah, you probably want all of that
without breaking the bank, I would assume.
MIKE OROSZ: That's right.
I want it all for a low monthly fee.
NIMMY REICHENBERG: Which is probably even more important
in this economic climate--
MIKE OROSZ: It is.
NIMMY REICHENBERG: --as it's been in a while.
MIKE OROSZ: That's right.
NIMMY REICHENBERG: Excellent.
So let's move on to the current situation.
So we talked about three big goals for this journey--
avoid the trade-offs, simplify and ease operations,
and do everything faster and become more agile.
Let's talk about the trade-offs.
Maybe share with us, with the audience, where you are today
in terms of, how much data were you able to ingest?
How long do you retain it for?
Where are you now?
I believe it's been 18 months since you started.
MIKE OROSZ: 18 months, you're absolutely right.
So when it comes to onboarding with Google and Chronicle,
it was a very impressive feat which we accomplished.
We were previously logging a certain amount,
and we were constrained by our historical platform.
And in other roles, I've been constrained the exact same way,
where we had to pick and choose what we wanted to log.
We went, in a period of three months,
from 0 logs ingested into Chronicle
to over 20 different data sets.
And that's amazing.
And some of these data sets are very prolific from a logging
perspective.
We're talking endpoint detection and response software.
It's very noisy.
That alone, in most traditional SIEMs,
might use up all your allocated ingest capability.
So that was really great.
And we went from, day one, being able to conduct simple queries,
get results immediately.
We don't have to wait around for the results
to take hours or days to come back to us.
So that's something we've increased.
We've increased the mean time to detect
and decreased our response times.
We're now logging and ingesting over 2,200% more
than we did in the past.
NIMMY REICHENBERG: That's pretty mind-boggling.
The good news here is you're handling
three times-- since you're ingesting more data, seeing
more things, you're handling three times more security
events with the same resources.
MIKE OROSZ: With the same resources.
So we actually have zero people that
are tasked with maintaining and keeping Chronicle alive,
which with most traditional SIEMs,
you would have to have at least one or two staff members that
just work on maintaining the infrastructure-- patching it,
ensuring it's current.
No, it's all hosted and updated automatically by Google.
So we went from maintaining the platform to now focusing
on security work.
NIMMY REICHENBERG: Excellent.
So I think that's a great segue into that goal of easing
operations.
So zero full-time administrators for Chronicle SIEM, which,
again, I think is just an unbelievable--
MIKE OROSZ: Shocking.
NIMMY REICHENBERG: Yeah, but also maybe talk
about the ease of use.
How did you find the ease of use of Chronicle?
And especially since getting security experts is so hard
to find, did that impact how you're
able to bring in team members in any way?
MIKE OROSZ: That's right.
Now we have the luxury of bringing in people
and training them how to use our SIEM.
And that pretty much offers the opportunity for many people
in other IT roles, or people who are new out of school who
want to break into cybersecurity and security operations.
They can essentially pick up the tool.
And if they're familiar with using
Google Chrome or any search engine,
they can essentially just take a certain element of information
like an email address or an IP address
and enter that into the search window
and then hit execute, and boom, you've got results right away.
NIMMY REICHENBERG: Yeah.
I think-- and when I hear this from customers and people who
are used to legacy and traditional SIEMs,
to hear them say, hey, if you know how to run a Google
Search, you can get value out of Chronicle, I think that, again,
has pure mind--
MIKE OROSZ: You mean I don't have to write a Python
script to actually get results?
That's shocking.
NIMMY REICHENBERG: And to your point
that you set the bar very low for yourself,
I believe that you yourself even, from time to time,
go into the system and conduct investigations.
So tell us a little bit about that.
MIKE OROSZ: Well, that's great.
I mean, I don't have to harass people and bug people just
to do work when I can just go in and do it myself.
So if I know a task only takes a few minutes to conduct
or execute within Chronicle, I'll just grab something
and I'll search for it myself.
I'll figure out what's going on.
Then I'll go back and forth with my team and I'll validate it.
So it really gets everyone focused more
on the action end of security.
NIMMY REICHENBERG: So easy even a CSO could use it, right?
How is that--
MIKE OROSZ: So easy even a CSO could use it.
You're right.
NIMMY REICHENBERG: Excellent.
And on the last point, let's talk about agility, right?
You want everything to happen faster,
if it's from queries, to response.
Maybe share some of the results again.
18 months into your journey, can you
share some of the agility improvements with us?
MIKE OROSZ: Yeah, exactly.
So not only are we processing more security events,
we now have the ability to build trends and do trend analysis
to determine how we can optimize systems and use
the data from our SIEM to reduce security operations'
investigation times.
And that's really important when you're trying
to process all that data.
So our teams are now processing approximately three
times the amount of events they were doing previously.
And that has really helped us scale.
And scaling is what you want to do
without increasing your costs, and that's
what we've accomplished so far.
NIMMY REICHENBERG: So 2,200% more data
analyzed, 3x the events, 50% faster
with no additional resources?
MIKE OROSZ: That's right.
NIMMY REICHENBERG: Unbelievable.
OK, so you've made a lot of improvements, obviously,
over the last 18 months.
But the work in general, and specifically in cybersecurity,
is never done.
Maybe as final thoughts, share with us
a little bit of what's next.
What are your plans, not just for Chronicle specifically
but for the security operations function, let's say,
over the next 12 to 18 months?
MIKE OROSZ: That's it.
So over the next 12 to 18 months,
our objective is to optimize operations.
It's to take what we have now, the basis of a solid security
operations function, and we want to enhance and optimize
the queries that we run all the time.
Our alerting capability, we want to optimize it.
We want to eliminate false positives.
We want to scale the team more than before.
And we want to embed Chronicle in all of our incident response
processes, which is something that everyone should be looking
to do just to optimize and gain the most value as possible out
of the SIEM platform.
NIMMY REICHENBERG: That's terrific.
Mike, thank you so much for sharing your journey with us.
And thank you, everybody, for watching.
One of the things that we announced at Next
is Chronicle Security Operations,
which is really our integrated suite of products
and capabilities to help you detect, investigate,
and respond to threats with the speed, the scale,
and the intelligence of Google.
If you want to find out more information about Chronicle
Security Operations, please visit chronicle.security.
You'll have everything up there.
And with that, I want to thank you again.
I hope you enjoy the rest of Next and the rest of the day.
Bye-bye.
[MUSIC PLAYING]