>> Live from San Francisco,
it's theCUBE covering RSA Conference 2019.
Brought to you by Forescout.
>> Hey, welcome back everybody.
Jeff Frick here, with theCUBE.
We're in the Forescout Booth at RSA in Moscone Center.
40,000 people walking around talking about security.
It's by far the biggest security event in the world.
We're excited to be here and welcome back a CUBE alumni.
He's been playing in the security space
for a very long time.
He's Brad Medairy, the EVP from Booz Allen Hamilton.
Brad, great to see.
>> Hey, thanks for having me here today.
>> Absolutely.
>> I've already walked about seven miles today
and just glad to be here to have a conversation.
>> You have a Fitbit and the walking trackers
love this place right?
You fill your circles in a very short period of time.
>> I feel very fit after today so thank you.
>> But it's pretty interesting right?
So you're in a position where you're advising companies,
both government and commercial companies.
You know, to come into an environment like this
and just be overwhelmed by so many options, right?
And you can't buy everything here
and you shouldn't buy everything here.
So how do you help your clients kind of navigate
this crazy landscape?
>> Yeah, it's interesting, you mentioned 40,000 people.
As you can see on the showroom floor behind us,
thousands of product companies
and frankly our clients are confused.
There's a lot of tools, a lot of technologies.
There's no silver bullet and our clients are asking
a couple of fundamental questions.
One, how effective am I and then once I'm effective,
how can I be more efficient with my cyber-security spend?
>> So it's funny, effective?
How are they measuring effective, right,
'cause that's a changing morphous thing to target as well.
>> That's the key question in cyber-security,
is how effective am I?
You know there's lots of tools and technologies,
we do a lot of instant response both commercially
and federally, and in general when looking at past breaches
it's not a tool problem, in most cases everyone has
the best of the best in tools and technologies
but either they're drowning in data
and/or the tools aren't configured properly.
So we're spending a lot of our time helping our clients
baseline their current environment.
Help them look at their tool configurations,
help them look at their security operations center.
Helping them figure out
can they detect the most recent threats
and how quickly can they respond.
>> Right, and then how do they prioritize?
That's the thing that always amazes me,
'cause in the end you can't do everything
and it's fascinating with the recent elections
and the state funded threats,
is that what the bad guys are going after, excuse me,
isn't necessarily your personal identifier information
or your bank account, but all kinds of things
that you may not have thought were that valuable yesterday.
>> Right, and you know it's funny, we talk a lot about
these black swan events and you look at NotPetya,
and with NotPetya there was some companies
that were really hit in a very significant way,
and everyone is surprised, right.
And we see it time after time folks caught off guard
by these unanticipated attack factors.
It's a big problem but I think our clients
are getting better, they're starting to be more proactive,
they're starting to become more integrated communities
where they're taking intelligence and using that to better
tune and tailor their security operations programs.
And they're starting to also take the tools and technologies
in their environment, better tie them and integrate them
with their operational processes and getting better.
>> Right, so another big change in the landscape.
You said you've been coming here for years since IOT, right
and Cisco called Industrial IOT,
or as you call it, internet of things.
Lot more devices should or should not be connected,
well are going to be connected, they weren't necessarily
designed to be connected,
and you also worked on the military side as well, right?
I mean these have significant implications,
these things do things, whether it's a turbine,
whether it's something in the hospital
that's monitoring your heart,
or whether it's something in the military scenario.
So how are you seeing the adoption of that,
obviously the benefits far outweigh the potential downfalls
but you got to protect for the downfalls.
>> Yeah, we view OT as one of the most pressing
cybersecurity challenges that our clients face today.
It's funny, when we first started engaging in the OT space,
there was a big vocabulary mismatch.
You had the CISO organizations that were talking
threat actors and attack factors,
and then you had head of manufacturing
that were talking uptime availability and reliability,
and they were talking past each other.
I think now we're at a turning point
where both communities are coming together to recognize
that this is a real and imminent threat
to the survival their organization
and that they've got to protect their OT environment.
They're starting by making sure
that they have segmentation in place
but that's not enough.
And it's interesting when we look into a lot
of the OT environments, I call it the Smithsonian of IT,
and I was looking at one of our client environments
and they had a lot of Windows NT devices.
I'm like, that's great, I'm a Windows NT expert,
I was using that between 1994 and 1996.
>> That's everybody's favorite vulnerability right?
I'm not even a hacker.
>> I'm your guy and so one of the challenges
that we're facing is how do we go into these legacy
environments that have very mission critical operations
and
integrate cyber security to protect
and ensure their mission.
And so we're working with companies like Forescout,
that provide agent less capabilities that'll allow us
to better one, understand what's in the environment
and then be able to apply policies to be able
better protect and defend them.
But certainly it's a major issue that everyone's facing.
We spend a lot of time talking about issues in manufacturing
but think about the utilities, think about the power grid,
think about building control systems HVAC.
You know, I was talking to a client
that has a very critical mission and I asked them,
I was like what's your biggest challenge that you face today
and I was thinking they were going to be talking
about their mission control system
or some of the real critical assets they have
but he said, my biggest challenge is my HVAC.
And I'm like really?
And he's like, if my HVAC goes down
my operations going to be disrupted,
and I'm going to have to coup half way across the country
and that could result in loss of life.
It's a big issue.
>> Yeah, wow, triggered all kinds of,
I think of Mike earlier today
said that a lot of the devices you don't even know
you're running NT, it's like a little tiny version
of NT that's running underneath this operating system
that's running this device so you don't even know it.
And it's funny you talk about the HVAC,
there was keynote earlier today where they talked about
if a data center HVAC goes down,
I think she said 60 seconds,
stuff starts turning off. >> That's right.
>> So depending on what that thing is powering,
that's a pretty significant data point.
>> Yeah, I think where we are in the journey in the OT is,
you know we started by creating the burning platform,
making sure that there was awareness around,
hey there is a problem, there is a threat.
I think we've moved beyond that.
We then moved into segmenting the IT and the OT environment,
a lot of the major nation state attacks
that we've seen started in the enterprise
and moved latterly into the OT environment.
So we're starting to get better segmentation in place.
Now we're getting to a point where we're moving into
the shop floors, the manufacturing facilities,
the utilities, and we're starting to understand
what's on the network, right.
In the IT world this is a problem we've been struggling
with for years and have started to overcome,
but in the OT environment it's still a problem.
So we're understanding what's connected to the network
and then building strategies
for how we can really protect and defend it.
And the difference is it's not just about protecting
and defending, but it's about ensuring
continuity of mission, it's about being resilient.
>> Right and being able to find if there's a problem,
shut down the problem cause we're almost numb
to the data breaches, they're in the paper everyday.
I mean, I think FICO was probably the last big one
everyone had a conniption fit, now it's like oh okay,
it's another data breach.
So it's a big issue. >> That's right.
>> One of the things you talked about, last time we had John,
was continuous diagnostic and mitigation.
I think it's a really interesting take
that's pretty clear in the wording,
that it's not a buy something, put it in and go on vacation.
This is a constant and ongoing process
that you have to be really committed to.
>> Yeah, I think that our clients,
both federally and commercially,
are moving beyond compliance and if you rewind the clock
many years ago everyone was looking
at these compliance scores and saying good to go,
and in reality if you're complaint
you're really looking in the review mirror.
It's really about putting in programs
that's continually assessing risk,
continuing to take a continuous look at your environment
so that you can better understand what are the risks,
what are the threats.
And that you can prioritize activity and action.
And I think the federal government is leading the way
with some major programs like DHS continuous diagnostic
and mitigation where they're looking to up armor.gov
and really take a more proactive approach
to securing critical infrastructure.
>> I'm just curious because you kind of split
the fence between the federal clients
and the commercial clients.
Everybody's points of view impacts the way they see
the world, I'm wondering if you can share
kind of maybe what's more of a federal centric view
that wasn't necessarily shared on the commercial side
that they prioritized and then what's one
on the commercial side that the feds are missing.
I assume you want to get them both thinking
about the same thing
but there's got to be different set of priorities.
>> I think after some of the major commercial breaches
we saw the commercial entities go through
a real focused effort to take the tools that they have
and the infrastructure to make sure
that they're better integrated
because in this mass product landscape there's lots of seams
that adversaries live in.
And then better tie the tooling
and the infrastructure with security operations.
And on the security operations side,
take more of an intelligence driven approach.
Meaning that you're looking at what's going on in the wild,
taking that information, be able to enrich it
and using that to be more proactive
instead of waiting for an event to pop up on a screen,
hunt for adversaries in your network.
Now we're seeing the commercial market
really refining that approach
and now we're seeing our government clients
start to adopt and embrace commercial best practices.
>> Right, so I'm curious.
I love that line, adversaries live in the seams,
we're going to an all hybrid world, public cloud
is kicking tail, most people have stuff in public cloud,
they have stuff in their own cloud.
You know it's a very kind of hybrid ecosystem
that sounds like it's making a whole lot of seams.
>> Yeah, just when we think we're getting there,
we're getting the enterprise under control,
we've got asset management in place,
we're modernizing security operations,
we're being more hunt driven, more proactive.
Now the attack service's expanding.
Earlier we talked about the OT environment,
that's introducing a much broader and new attack service.
But now we're talking about cloud
and it's not just a single cloud,
there's multiple cloud providers and now we're talking
about software as a service
and multiple software's as service providers.
So it's not just what's in your environment now,
it's your extended enterprise,
it includes cloud software as a service, OT,
IOT and the problem is getting much more complex.
And so it's going to keep us busy for the next couple years.
>> I think job security is okay.
>> I think we're going to be busy.
>> Alright Brad, before I let you go
just talk trends that you're thinking about,
what you guys are looking at as a company
as we head into 2019.
>> Yeah, a couple things.
Booz Allen being deeply rooted in defense and intelligence,
we're working to unlocking our trade craft
that we've gained through years of dealing with adversary
and working to figure out
how to better apply that to cyber defense.
Things like advanced threat hunting,
things like adversary red teaming,
things like being able to do base lining
to assess the effectiveness of an organization.
And then last but not least, AI, AI is a big trend
in the industry.
It's probably become one of the most overused buzzwords
but we're looking at specific use cases
around artificial intelligence.
How do you better accelerate tier one, tier two
event triaging and azar.
How do you better detect adversary movement
to enhance detection in your enterprise
and AI is
a very
major term that's being thrown out
at this conference, but we're really looking at how
to operationalize that over the next three to five years.
>> Right, right and the bad guys have it too.
And never forget Amara's Law, one of my favorite
not quoted enough laws,
we tend to overestimate in the short term
and underestimate in the long term.
So maybe today's buzzword,
but three to five years AI is going to be everywhere.
>> Absolutely.
>> Alright well Brad thanks for taking a few minutes
of your day to stop on by. >> Thank you.
Good to see you again.
Alright he's Brad, I'm Jeff, you're watching theCUBE.
We're at RSA Conference in downtown San Francisco.
Thanks for watching, we'll see you next time.
(electronic music)