Detection at Scale

What does it take to shape an early-stage security project into a product that solves real problems?  Understanding your customers is a key first step. Knowing the personas who can use your product and the leverage they can get out of it, it's what ultimately brings value to security teams and even other teams that can seize their benefits. We had a great conversation with Joren McReynolds who is the VP of Engineering, IT and Security at Panther Labs. In today's episode he shares the experiences and lessons over the course of his journey at Facebook, Airbnb, and how they shaped his knowledge on what building a great product takes. Topics discussed: What led to the creation of osquery and why open source. What the progression was to build that as an MVP. Joren's approach to building the IR Team at Airbnb. How different Airbnb's cloud-based environment was from Facebook's. How Joren's past experience at Facebook influenced his work at Airbnb. Joren’s thought process around implementing security monitoring. What inspired StreamAlert. 3 pieces of actionable advice to security teams looking to excel in detection at scale.

Clint Gibler is the Head of Security Research for r2c, the company behind SEMGREP, a popular open-source static analysis security scanning tool used by teams all over the world. He joined r2c to help build and shape the future of AppSec; one that includes secure defaults along with lightweight enforcement of those defaults. In today's episode, Clint talks about SEMGREP, operationalization of tools for security teams, intersection between AppSec and D&R as well as tips to succeed in AppSec at scale.   More topics discussed in this episode: SEMGREP's origin story and benefits. The security startup creation pattern of recent years. Trend shift to developers operating security problems at scale. r2c's mission and products in addition to open source. How application logs are useful in detection and response. Type of vulnerabilities Clint is seeing more often. Application security developments he is most excited about. Other resources: tl;dr Sec Newsletter: tldrsec.com

Robin Smith is the Head of Cyber and Information Security at Aston Martin and he brings a fresh and unique voice to the security industry. He advocates for a lean, progressive security mindset where it's crucial thinking around processes to make sure that organizations are not unnecessarily wasting resources while committing to continuous improvement at the same time. Tune in to learn more about what lean security is, why Robin has always seen security as an asset, and how you can embed that value into your organization. Topic discussed in this episode: How Robin arrived in information security. Why he believes we need new voices in the industry. The time he wrote 'The Lean Information Management Toolkit'. Why he considers security as an asset and how to embed that value across an organization. What the concept of lean security implies. How lean security applies to security monitoring and detection. Desired outcomes for security detection platforms. Metrics for a lean security program. The approach of practicality when deploying technology. 3 Pieces of advice to succeed at effective detection at scale.

Kathy Wang is the CISO at Discord, an internationally-recognized malware expert who has researched, developed, evaluated, and operationalized various solutions for detecting and preventing client-side attacks used by advanced persistent threats (APT).  As a security executive and leader, Kathy has a strong background in project management, research, and business development. She has worked in government, commercial, and technology startup environments, and currently advises security services/products startup companies. In today’s episode, Jack and Kathy discuss the talent pool in cybersecurity.   Topics discussed in this episode: What made Kathy want to go from researcher to security leader  The impact remote work and remote teams has had on cybersecurity teams  What Kathy looks for when hiring security professionals  Why transparency and multi-modal communication is mission critical for cybersecurity teams  How attacks have changed in the past 5 years  The tools Kathy is paying most attention to  What she enjoys most about working in security  Kathy’s advice for security professionals, especially early in their career    Keep in touch with Kathy on LinkedIn at: https://www.linkedin.com/in/kathywang/

If you were building a detection program today, what would be your top resources to start with? As we head into a cloud-based future, the ability of handling increased data sets becomes crucial, teams need to have processes in place that cover the entire detection lifecycle, and develop skills necessary to help build, grow and improve a successful detection program. In today's episode, we had an insightful conversation with Snowflake’s Global Threat Intelligence and Detection Engineering Leader, Haider Dost and Senior Security Engineer, Daniel Wyleczuk-Stern where we discovered why data and being able to query that data is a critical first step. Topics discussed in this episode: Haider's and Daniel's background in security. The precursors and skills necessary to becoming an engineer. A high level approach to building strong detection teams. The importance of collecting and correlating log sources for a proper incident response. How to be proactive when building your detection baseline. What a detection lifecycle process is and why every team should have one. What the biggest challenges of building a detection program are. Why it’s critical that responders or analysts have a sense of ownership on the detections that are being built. How security teams at Fortune 500 and Silicon Valley companies differ from each other.

Have you ever thought you could find more assets in your network that you thought you would have? Do you have segments that haven't been scanned yet? Or maybe subnets that you have ignored? These and much more is what asset discovery brings to the table to any security team, helping to prevent the next big incident. In today's episode we sat down with Chris Kirsch, CEO and co-founder of Rumble and chatted about why covering the basics, like having a full inventory of your network with all the managed and unmanaged devices, is a best practice to secure any environment. Topics discussed in this episode: Rumble's founding story and background Why Rumble's engine is very benign to the network Where customers that migrate to Rumble come from Why vulnerability scanners don't tell much about what a particular asset is A two point approach for asset discovery in a cloud environment How customers use Rumble in a response style situation 3 Pieces of advice to succeed at asset management and device security in the future.

Why is SIEM an area of unease for so many security officers? To make detection and response successful, we need tools capable of upscaling the practitioners as well as equipping them to be successful. We need tools we can rely on. In today's episode, we had an inspiring conversation with J Wolfgang Goerlich, Advisory CISO at Cisco Secure. We discussed how trust is a determinant factor in building the security tools of the future, why so many CISOs lost trust over SIEMs and what we can do to rebuild it. Topics discussed in this episode: Wolf's role as advisory CISO. How we can use technology to solve business problems How CISOs perceive SIEMs today and security monitoring as a practice The investigative side versus the detection side of SIEMs How the detection personas have changed with the movement to the cloud Challenges of doing detection in the modern day The story of when Wolf worked in an open source project How Wolf advises CISOs on making a build versus buy decision How detection and response will evolve in the coming years 3 pieces of actionable advice to succeed with building effective detection programs at scale

Securing the environment and scaling operations of the world's leading streaming entertainment service is massive. Srinath Kuruvadi is the head of cloud infrastructure security at Netflix. Before Netflix, he spent more than 15 years building security solutions and leading teams at Google, Facebook, Snapchat, Lyft, and Mapbox. In today's episode, he shares how his leadership skills have evolved over time, where he puts his focus when approaching infrastructure security, and what he believes are the key ingredients any security team should have today. Topics discussed in this episode: How Srinath got his start in security and landed as head of infrastructure cloud security at Netflix  Lessons in leading a team that’s 10+ years old ConsoleMe and why they built it  Srinath’s unique approach to infrastructure security  Why ‘people challenges’ carry more weight than ‘technical challenges’ when it comes to infrastructure security  Why security teams should seek out the open source tools big tech companies use His take on trends and tools in the cloud security space  3 pieces of advice to succeed in detection at scale 

How does anything scale as a leader?  For today's guest, security has always been a puzzle in which the only variable we do get to control is time; specifically, all the decisions that enable us to control how fast we detect threats. Am I going to be agile with this tool? How fast can I deploy detection if something happens today? How many hours is it going to take me to understand if it happens again or if it's still happening?  These are some of the questions Matt Jezorek likes to ask himself. Matt is the Vice President of Security and Platform Abuse at Dropbox,  an Information Security Executive with multinational fortune 50 experience who can think like an attacker and still speak to the business.  Topics discussed in this episode: Matt's background and his number one motivator: "taking care of his family" What he enjoys the most about security (what he likes to call ‘The Grayness of Security’) Why educating others can help scale security How Matt keeps up as a security leader The value of agility in detection at scale What he considers should be prioritized in automation and problem solving How we can maintain customer trust How Matt knows if he is doing a good job as a security leader: hygiene, aspirational and agile metrics. Why time is the only variable we can control Lessons learned from bad management experiences 3 pieces of advice for security teams that are working hard to protect customers

Risk management has shifted from a traditional mindset to an integrated view, where engagement of all departments across an enterprise is crucial to address threats properly. In today's episode we sat down with Miguel Viana from Talkdesk to discuss how security teams provide guidance to identify vulnerabilities and how risk management processes evolve in a fast-paced growing team. Topics discussed in this episode: Miguel Viana's background in the security industry How risk management evolves as company grows Threat modeling in the risk management process Typical security threats that worry Talkdesk the most  The importance of due diligence in third party management Miguel’s advocacy for security education programs How to build a strong security culture in a company

"The people who actually work with me (not for me), do their jobs better" Gusto is a People Platform and as the Chief Information Security Officer, Fredrick Lee (AKA Lee) knows company value starts with your employees. If you don't take care of your employees, you can't take care of your customers. Being a great leader is not only about inspiring your team and making them want to do more but also, and more importantly, is about transparency and building trust. Tune in into today's episode for a master class on how to lead a security organization from the trenches. Topics discussed in this episode: What makes a great security leader The power of transparency in leadership. Why it is important that security leaders have experience practicing beyond management. What inspired Flee to make the jump from being a practitioner to being a leader. How to join a new company and build a security program from zero. What security teams can do when working in a hypergrowth environment. Why Flee trusts people but not computers. 3 Pieces of advice to security leaders that you can't miss!

Not so long ago security was 'more manual' and therefore, riskier. Important systems would drift in their configuration, people would go on and change things manually. Over the past decade, there has been a shift from tools that were doing infrastructure as code to immutable infrastructure. Technology now allows you to be updated, gives you the ability to retrain, and have a repeatable process.  Gilbert Martin is the Head of Cloud Security at OutSystems and a big believer in taking a developer first approach to a lot of the things that we do in security. One of those is creating an image pipeline. In today's episode, Gilbert walks us through the idea of how using the right tools can help you promote better cloud infrastructure security. Topics discussed in this episode: Gilbert’s background in security. What the cloud environment was when he started. How immutable infrastructure has helped remove unpredictability and insecurity. Why it's important for any organization to have a software asset inventory. Gilbert's approach to dealing with systems that he finds some issue/ violation. How he uses Kubernetes and Serverless: pros and cons. Why visibility is essential for doing security at scale. Keys to interact with instant response teams. How to succeed at applying cloud security at scale in the future.

Cyber security is difficult. It's asymmetric and the advantage falls on the attacker side. When Omer Singer realized this, he felt inspired to join the military service in Israel. After what he saw by being on the offensive side, moving to the defense was challenging. How would he reconcile both sides of the same coin?  Omer Singer is now Head of Cyber Security Strategy at Snowflake and in this episode, he shares what was the game changing approach that made him flip into doing detection.  Listen to Omer for great insights and advice on how to break into today's data driven cyber security industry. Topics discussed in this episode: Omer's beginnings and background in penetration testing. How Omer made the flip into doing detection. How joining Snowflake changed his perspective about being on the defense side. The power of data in security and how it tells you things you didn't know how to ask for. When Snowflake started their security journey. Omer's approach on building a high fidelity system and retaining high fidelity alerting. Advice on how to build a strategy around data when you're starting from scratch. How security programs and systems scale along with data growth. First objectives when he started leading Snowflake cyber security. 3 Pieces of actionable advice to succeed at detection at scale.

Cassio Goldschmidt is the Senior Director and CISO at ServiceTitan. Awarded for his leadership in cyber security, he has over 20 years of experience in various technology companies. He has been a speaker at the most respected international conferences and even helped improve the security integrity of Brazil's voting system.  In today's episode, Cassio shared unique insights on the importance of bringing the right people for your company needs, whether you are a startup or a fortune 500.  Who is best for what? When is the right time for outsourcing? What kind of experts should you bring to your team in the beginning? We asked Cassio these questions and also dove into leadership, decision making, and what the future demands for security teams will be. Topics discussed in this episode: How Cassio got into security and became a security leader. The differences of building a modern security team in established companies and startups. How to decide when it’s the right moment to do it yourself as a first security hire vs hiring other teams. What kind of experts you want to bring in to your team at early stages. Recommendations on the composition of a detection team. Cassio's approach for getting around false positives. Major challenges with implementing SIEMs. Metrics to gauge the effectiveness of a detection program. How security demands will evolve over time. 3 pieces of actionable advice to succeed at effective detection at scale.

'Don't make assumptions. Ask the question.' That's what today’s guest advises to her team on how to differentiate what's normal from abnormal in an evolving threat environment. Cynthia Moore is the Senior Director of Information Security at BlackLine but she started out in infrastructure operations building telecoms systems. Coming from a non-traditional security background has given Cynthia a true leverage and the versatility not only to better empathize with clients' needs but also to speak their language. In today's episode, you will get to understand the mindset of a great security leader and learn her secret recipe on how to encourage teams to turn 'impossible' problems into possible outcomes. Topics discussed in this episode: The biggest differences in running security for Disney and BlackLine. Building and staffing a team out in a cloud-based environment. What challenges Cynthia is facing as a security leader in BlackLine. How to detect, respond, and prevent breaches. The value of having transparency and an open dialogue with clients in SaaS businesses. How speaking a language that is not purely security helps empathize with clients and creates a feedback loop. Cynthia’s thoughts on tools to be successful at scale.  Keys to augmenting your security team: outsourcing vs hiring. How you don't always need to hire security people to do security

Today's guest shared an eye-opening definition: "Application security is an evolving narrative. It's all about collaborating and interacting with the people building the business." When Ty Sbano started, application security wasn't really called application security. He was fortunate enough to be one of the early folks that had a formal degree in information technology with a focus on security from Penn State University. From JP Morgan to Capital One to the startup field, Ty collects over 15 years of experience in security. Today, he is Chief Trust and Security Officer at Sisense and he sat down with us to discuss all things AppSec, how to build early, robust security teams, and how to lead with empathy in an evolving agile environment. Topics discussed in this episode: Ty’s background in the financial/fintech industry and his current focus on data science and the conversions of security. What application and product security means and why it’s really important to enable businesses to move fast. The importance of choosing one vertical in information security and being an expert at it. How an agile methodology and manifesto help ship product features and engage engineers. How security practical programs differ between large enterprises and startups. Security tooling: Building vs Buying Building early security teams: good patterns that are important to get established in the beginning.  The relationship between an application security function and an incident response function. 3 pieces of actionable advice for security teams.

Attackers are always ahead of the game and today you need more than having a lock on your front door. Modern security requires organizations to think outside the box, re-architect their environment, and be able to scale more efficiently and effectively. In this first episode, we sat down with Brad LaPorte to discuss Endpoint Detection and Response (EDR) in depth. Brad has spent time in US Cyber Intelligence, large technology companies like IBM, research firm Gartner, and today as partner at High Tide Advisors a firm specializing in go-to-market consulting. Topics discussed in this episode: Topics discussed in this episode: How Brad has seen endpoint detection and response evolve over the last 5 years. How attackers are always well financed and resourced. Organizations’ struggles with application control. What caused the shift from AV to EDR products and tools. How detection as code is critical for many reasons. The biggest challenges Brad has seen when deploying EDR in a large organization. The importance of educating your leadership, have a proper plan, use case, and assess your operational readiness when implementing EDR.  Recommendations for engineers looking to build their own version of an EDR platform. Tools and technologies that Brad is paying attention to like zero trust architecture. 3 pieces of advice for security teams looking to succeed at EDR at scale.

In this episode, Jack Naglieri speaks to Jeff Bollinger, Director of Incident Response and Detection Engineering at LinkedIn, who shares valuable insights on his journey in security, key technological shifts he's witnessed, and his approach to threat intelligence, incident response, and monitoring.  Jeff highlights the importance of contextual understanding in security operations and emphasized the critical role of human intuition, adaptability, and creativity in addressing security challenges. He also discussed the need for a balanced team with diverse skill sets and his views on the evolving role of AI in security operations. Topics discussed: Technological shifts in the field of incident response and detection engineering, from the Y2K era to the present. The nuances of monitoring behaviors and moving towards higher-level monitoring: it’s useful but imperfect because humans can be unpredictable. Automation in security operations and how human analysts are still important and relevant because they have intuition that AI does not. Incorporating threat intelligence effectively in security programs: knowing what your scale is and what threats correspond to it. Building effective incident response programs and key considerations in security operations. 

In this episode, Jack Naglieri speaks to Josh Liburdi, Staff Security Engineer at Brex. Josh explains the process of developing their new security data pipeline toolkit, Substation and how it has been working. He also discusses the importance of quality data, highlighting the impact of data transformation.  Josh also shares his insights on the value of human analysis in SecOps and modern incident response strategies, from handling alerts to understanding program gaps.  Topics discussed: The development process of Substation, a security data pipeline toolkit to enhance log collection and data quality for threat detection The importance of quality data in security operations and how sometimes it is helpful to collect it even if you don’t analyze it right away. The data transformation process and its impact on threat detection, as well as how it’s made the team at Brex more efficient. Enhancing the ability to write better rules after implementing Substation. Josh's advice for security practitioners: it’s ok to seek help and “soft skills” are important. 

On this week's episode of the Detection at Scale podcast, Jack talks with Matthew Valites, Director of Threat Detection & Operational Strategy at SAP. They discuss which threat detection approach works the best, what metrics Matthew uses to gauge his programs, and why Matthew is a proponent of using detection as code.  Matthew also looks to the future and gives his prediction on what role technology such as GenAI will play in the security landscape. They close out their conversation with some actionable lessons from Matthew's book, Crafting the Infosec Playbook.  Topics discussed: Which threat-detection approach works the best (hint: it's usually the one that provides the most visibility). How Matthew manages the different logic in different environment using tailored macros. What metrics Matthew uses to gauge his programs and how he keeps track of those metrics. Why Matthew is a huge proponent of using detection as code, including the CIDC element it brings. What makes GenAI so exciting, and what its role might be in the future. How Matthew tries to take care of his team's mental and physical health. Actionable lessons from the book Matthew co-authored, “Crafting the Infosec Playbook”, such as espousing the values of a service-based approach.