EP240 Cyber Resiliency for the Rest of Us: Making it Happen on a Real-World Budget

Security running.

Hi there. Welcome to the Cloud Security Podcast by Google. Thanks for joining us today. Your hosts here, as ever, are myself, Timothy Peacock, the Senior PM for Detection Platform, UEBA, and Risk in Google SecOps. And of course, Anton Chuvakin, a reformed analyst and senior staff in Google Cloud's Office of the CISO. At this point, he's almost a long-reformed analyst. It's been a while for him.

I'm reformed. I'm thoroughly reformed.

Thoroughly reformed.

We should use the term thoroughly reformed. It's not like lightly reformed.

It's thoroughly reformed.

Deeply reformed. Yes, thoroughly reformed.

He's really mended his ways. But you can find and subscribe to this podcast wherever you get your podcasts, as well as at our website, cloud.withgoogle.com/cloudsecurity/podcast. I bet, listeners, you didn't realize we tape this fresh every week, but we do. I've read the script 250 times. If you enjoy our content and want it delivered to you piping hot every Monday, please do hit that subscribe button. Really, please do subscribe. You can follow the show, argue with us and the rest of our Cloud Security Podcast listeners on the Google Cloud Security Community page, and of course, on all the social media. Anton, we're talking about resilience today, which is a topic that we've touched on before. It's a great topic. And we're also talking about ISACs, which somehow we got 250 episodes into a security podcast without talking about ISACs, which seems surprising.

I think you managed to miss the most important part, actually.

Oh, go on.

I'm sorry to do like jabbing you with a light cattle prod here, but— I'll take it. I think it's resilience on a budget.

Ah, yes.

It's the key part, I think, because we do see, I mean, if you search for Google Cloud resources on resilience, you'd see a lot of how to do things in a modern way. Of course, the NIST talks about resilience. Resilience is all over the place. It became fashionable in the land of cyber a good number of years ago. But a lot of stuff is just very high-minded and very high-budgety, and it feels like You have to be a PhD in resilience to do resilience well, and you have to have a team of PhDs, and only then maybe you have a shot.

Yes.

But here we have the opposite. Like, how do you do resilience on the smallest amount of money you can imagine?

When your security leader spends their Friday mornings cutting the lawn.

I think you are spoiling a little bit, but—

Okay, spoiler alert. This episode involves a lawnmower, and not in a Mad Men kind of way.

It does involve a lawnmower. Yes, correct. Like, when we say low budget, we mean like low budget. Imagine the lowest budget And then 10 divided by 10. It's like not the 10x, it's like the 1/10.

You mean even lower budget than our podcast?

No, no, no, no, no, not lower than that. That's actually an absolute zero of Kelvin temperature.

All right, well, listeners, without any further ado, let's turn things over to today's very resilient to our questioning guest. Today we are joined by Erol Wyse, the Chief Security Officer for the Health Isaac. Errol, thank you so much for joining us today. Delighted to have you on the show. We're talking about digital resilience and how important it is to people. And we've kind of talked about resilience in the past. We, we had this like minimum viable enterprise concept, but could you tell us about adding digital resilience and how to get people to care about it? How do you get people to dig in on this one? Give us the rundown on it.

Yeah, I think we've got a few, I'll say marketing events that are really kind of driving the need toward resiliency that have happened over the last year. Just as an example. But I'd say in general, like, really the push in the industry in cybersecurity for, like, really probably for the last 15 years has really been toward the idea that, hey, I can't protect the entire enterprise. So I've gotta have the mindset that we need to detect these incidents fast and we've gotta recover even quicker. And what I alluded to in the beginning was, like, we're almost at exactly a year ago from the CrowdStrike episode.

Mm-hmm.

The faulty update that happened.

Was that already a year ago?

Yeah, it's incredible.

Wow, time flies.

And I think from that episode, it was just the realization that it's not just about securing the enterprise, but we've got to take a look at what happens when systems aren't available and how do we react to that. So, you know, it's kind of my joke about, you know, we've had the marketing events that have demonstrated the need for resilience, but I mean, it really drives home the point.

That makes a ton of sense. So what's the ISAC role in this? Because I think of an ISAC as like a— I think it stands for, and listeners, you're gonna make fun of me here, Information Sharing and Analysis Center. Is that right?

Oh, you got it.

Yeah. Ah, heck yeah. Nice. I won the acronym game.

Yeah, that's awesome.

So what's the connection between that and resilience? That sounds kind of disjointed.

Yeah, it's— I mean, I think you can look at the ISAC really as kind of a virtual neighborhood watch program, and it's really about the idea of getting the community together to help each other out. And since I mentioned it, I'll keep building off the CrowdStrike example. That happened thinking all about Errol and living on the East Coast of the US. You know, that happened about 2:00 AM my time. And so by the time I woke up at 8 or got online about 8 o'clock in the morning that day, the problem was identified. People were talking about probably what it was and how to start resolving the issue.

Mm-hmm.

But, you know, the people who were in Australia, for example, you know, they were living life through blue screens of death and repeated, Reboots and whatnot, and they were dealing with all this stuff. And so the ISAC was where they were able to kind of come together and say, hey, we're seeing this, what are you guys seeing, what do you guys know about this? And suddenly you can start seeing the pieces come together and saying like, hey, we just had a CrowdStrike update last night, I wonder if that's what blew it all up. And you start seeing all the people kind of coming together and trying to figure it all out on that forum. So to answer the question, you know, what is an ISAC, you know, the real quick skinny about it is Literally 30 years ago now, gosh, I can't believe it, the U.S. federal government did a study and found that 85% of the nation's critical infrastructure was owned and operated by the private sector. And so they wanted to encourage the private sector to do something meaningful about helping to protect those resources and services. And so the idea, one of several, was create this thing called an ISAC, and Tim, you nailed it, Information Sharing and Analysis Center. And it's all about encouraging each of the critical sectors to share with each other, work with each other, collaborate with each other in the name of security and resilience. So that's really where they all started. First ISAC out of the gate was the Financial Services ISAC in 1999. Health ISAC's been around since, for 10 years now. And what I would say to the audience is there is an ISAC for everybody. Find your ISAC. I've got a resource in the show notes about where to find it, the National Council of ISACs. But I swear you get more out of it than what you contribute to it. It is a great way to learn and network with others.

Is there an ISAC for ISACs?

We're not quite, quite there yet. You're not quite there yet.

I'm going to say yes, there is such a thing called the National Council of ISACs. And this group gets together on a regular basis at the leadership level, at the analyst level, and We compare notes and share with each other. But a lot of us are dealing with the same issues, especially on the cyber side. But there's, you know, the nuances for each of the verticals that make, I think, each one of us special in our own way.

So, I want to pick up on the resilience theme, of course, because I still see a degree of confusion, even with some security leaders who kind of like assume that they are security leaders. And when they hear resilience, some of their minds go straight to BCDR and backups, so like a very narrow view of recovery. Like, do you have any kind of secret tips of how to make people think resilience rather than just cybersecurity? How do you make leaders shift from, oh, we just do encryption and passwords and firewalls, to, oh, we do digital resilience here?

Yeah, I think it's that mindset of looking at that IT environment and understanding what happens when things don't work. And I think the most important part of it all is practicing. Right. So we talk about tabletop exercises a lot, but actually doing it. And, you know, can you pick a few critical systems and literally play like you've burned them to the ground and you need to rebuild it all from scratch? Can you do that once or twice a year? Does that actually work? You know, do all those backups that we've been doing every day, do they actually work? You know, can you check that out a few times a year, practice that out? I see like in the hospitals, for example, that they are literally going to downtime procedures and practicing what that looks like. And it's a struggle. I mean, nobody likes to work like that. The IT systems are there for a reason today, right? They do wonderful things for us, but you need to practice, practice, practice, and learn from that. And I think that's probably one of the big lessons coming out of it.

So, that means that it's a mindset change because it's not about like, what tasks do you do? What is the project around to become more resilient? It is a mindset change. And I agree with that because I've met people who for whom that was the hardest jump. It's like they were still in the firewall and antivirus and encryption mindset and not in the sustaining the digital existence of their company kind of mindset. So, I think that makes sense to me.

Yeah.

So, the question comes up that sometimes this resilience discussion is probably easier for people with big budgets. And here in this podcast, we wanted to cover a little bit about how to be the most resilient given the resources. And of course, Tim pointed out that it's not that, it's how to be most resilient given the small resources. So any advice on this type of resilience on a budget and whether cloud plays any role in this?

Yeah, absolutely. I mean, I think there's a few things that I would point out there. You know, there are a ton of free and open source resources that are out there. So one, start taking advantage of that. Just to name a quick few here, like CISA, has the Known Exploited Vulnerabilities Catalog. I mean, that really helps in terms of prioritizing where you're going to apply some of those resources sometimes. CISA also has a free external scanning service looking for security vulnerabilities that I know a lot of people subscribe to. And then I'll also point to the Health Sector Coordinating Council. There are a ton of resources up there, cybersecurity practices and other guidelines, incident response guidelines, matrices, checklists, etc., that people can take advantage of. And I know, again, that link's in the show notes. Take a look at those resources there. And then I'm a big fan of the Cyber Performance Goals, and we'll talk about some hygiene, basic hygiene later on. But, you know, again, those are all free. The implementing basic cybersecurity hygiene would be one of them. Training staff, having an incident response plan. It boggles my mind how many organizations don't have a plan.

They don't.

So when the poop hits the fan, do they know what to do? No. You know, I'm a big proponent of info sharing. I spent 13 years of my career in the banking and finance sector. I was a big user of the financial services ISAC. I can tell you some stories from there. I mean, it was a great experience and helped save a lot of help, a lot of work back in the day. I've talked about tabletop exercises, and then I think about, like, you know, collaboration and leveraging smart resources, and I would put cloud in that category. I mean, I think the whole idea about using cloud services, taking advantage of the security that's there, the resources that are there, the ability to scale quickly when you need to or shrink when you need to, but all of that there. And again, you know, always want to put the word out there in terms of like shared responsibility. You can't just put it down on the cloud and forget it, right? There is responsibility on both sides, but I like to rely on the fact that you've got a much bigger infrastructure to manage and worry about and help keep secure than is possible for these smaller organizations who just don't have the staff to do that.

Yeah, I think that's one of the really cool things about cloud that people maybe understood early on or maybe forget about. You get to make Google's reliability team a part of your infrastructure. Like, we've got some of the best SREs in the world keeping Google Cloud up and running, and you can't afford to hire those people in most cases, but if you use our cloud, You're hiring them implicitly.

Like, again, looking at healthcare and the struggles that those organizations have when it comes to resources, I mean, they're struggling to have the IT teams and they're blessed even if some of them have a security person that's full-time. I mean, it's just one of the biggest struggles that I think that hospitals and small organizations face is being able to get the right people and have the talent to do these kinds of things.

And is that struggle because it's hard to hire in rural places or because they lack the budget or both? What makes it so tough?

Yeah, it's all of the above, really. Yeah. And again, I can— I know specifically in healthcare, you know, some of the problems that we have in terms of budget, having the right budget for the last 30 years, we've struggled with the issue that in the mid-1990s when medical records were starting to be digitized and HIPAA came out, I think the focus was on compliance and not necessarily security. We could probably have a whole nother episode about the difference between compliance and security.

Oh, we've had that episode.

Yeah, not once, so maybe we need it more times.

Yeah, no, doing that episode again, that's like the beatings will continue until security improves. No thank you.

Oh my gosh, great, great topic.

So I do want to shift topics a little bit and talk about making yourself a smaller target. This is one of the ways that you can reduce your risk as an organization. And so in the healthcare sector, what have you seen as a way to help organizations make themselves a smaller target?

Yeah, I think, you know, the whole idea there to me falls under that, what I mentioned before about basic cybersecurity hygiene. You know, you have got to do the minimums to make yourself less of a target. And if I had to pick 3, I would say it's patching, stay up to date on patching. 2, backup, backup, backup, and test those backups like I talked about before. And then using multifactor authentication. I mean, when it comes probably at least to healthcare, I think one of the biggest threats we're worried about is ransomware. And if you could do those things, I think you're going to make yourself a much harder target when it comes to malware and ransomware. Some of the big incidents that we saw in 2024 all came down to root cause about a failure to have multifactor authentication on all of the accounts. And so big part there, you know, the rest of the minimum cybersecurity standards, I would say, and again, I call out those cyber performance goals that HHS released last year in health, and there's other places to go look. But, you know, I'd say start there. There's 10 basic cybersecurity guidelines that they have there and 10 enhanced ones. And I say chip away at those as much as you can.

And again, I think you'll make yourself a So, it sounds like some of the smaller target measures is what others would call basic security. But what we observe in real life is that some of the basics are, like, super hard. You brought up patching. Again, back in my Gartner days, we would observe the patching timelines, and we can tell people that, hey, if you're doing criticals in 30 days, you're not doing a good job. And by the way, that's a really good point. not meant to represent a specific organization. This is sort of an example inspired by a real story. Somebody says, oh, yeah, we have criticals in 30. And I'm like, criticals in 30?

That's bad.

That's not good. That's bad. And they say, well, wait till you hear about the mediums. But the point is that they have organizational reasons, IT reasons, business reasons, personnel reasons why It's 30. And sometimes telling them, hey, guys, I think a good one for criticals on a public-facing wound is 48 hours. They'd be like, we agree, 30 days, not hours. So, how do you make some of this actually work? Do you have any tips on hygiene or basics of small target things that people can push through at those small rural hospitals specifically?

Yeah. And I think like, you know, like you said, that, you know, that 30-day issue, I mean, I saw that. I lived that on the banking side as well. And I think it's the larger organizations. Yeah. You've got a server that's running hundreds, maybe thousands of different applications, and you've got to make sure that there's going to be no breakage when you update that server. Right. So that's why they're asking for 30 days. And I'm hoping that the smaller organizations don't have that level of bureaucracy and aren't running thousands of apps on a server and they can turn it around much faster. But I would say that, you know, 2 things. One is if you're going to take 30 days, then maybe there's a countermeasure or some monitoring that you can put in place to see, are they coming after me? And at least be able to detect it quickly. Like I, like I talked about before, so you at least know what's happening. And then the second part of it is taking advantage of like one of the resources I mentioned before, that the Known Exploited Vulnerability Catalog from CISA. Hey, what are the bad guys abusing right now? What's being attacked today? And use that to prioritize that list that you're going after in terms of, you know, the vulnerability remediation. And I think, you know, doing both of those makes sense.

Right. I mean, I think that 30, which basically gets us back to maybe 30 days for some criticals that are not commonly exploited, is acceptable for some organizations under some circumstances. But these things that show up on commonly exploited lists, You absolutely cannot wait for 30 days, or you cannot keep it in that bucket. Is that roughly the logic or not? So, prioritization.

I think so. And then, you know, Anton, I mean, you look at that list and you see, like, you know, 2015 in there on some of these vulnerabilities, and you're like, oh my gosh, why is it taking 10 years for people to patch this stuff? That doesn't make any sense.

Yeah. So, it's not 30 days, it's actually 10 years. So, forget 30 days. It's not the 30 days that gets you, it's the 10 years. So, any other themes on the— apart from patching, like, what are the— what other ways are there to make it actually happen? You can talk about segmentation or firewalls or system updates or even the MFA that you brought up. Like, MFA is an example. We can tell MFA, you can tell MFA, say MFA, Tim can say MFA, and then people still have a password and username for some servers in some circumstances. So, how do we actually make it happen is, to me, the challenge. trickier part.

Yeah. And then what I think about, like, with MFA also, as part of that is policy and the controls around that and making sure that it's implemented appropriately. And, you know, to your point, right, that there are no exceptions. And if there are exceptions, let's understand what they are, where they are, and hopefully that they're time bounded. I mean, again, back to some of the big incidents from last year, I'm imagining what may have happened was like, hey, somebody lost their token, they need a password reset. And so You know, they probably got the exception to turn off MFA on their accounts for a little while, but then nobody had the wherewithal to go back and turn that back on when they were back in the office and had their token back. And I think if we're able to look at those controls, do audits on a regular basis, if we're going to require everyone to use MFA on application X, Y, and Z, then let's audit that on a regular basis and make sure it's turned on. It's so important to do that.

I think that's really good advice. And I know that identity governance and auditing that way is really hard. I want to shift gears a little bit and talk about organizations that are particularly resource constrained, like really resource constrained.

Right.

Really resource constrained, both budget, personnel, time, the challenges.

Yeah.

Where do you go first? Where do you put your money first? Where do you put your, like, leadership attention first? Because those are both precious resources.

Yeah, no, that's a good one because again, coming from financial services to health now, 6 years ago, I was just blown away with a couple things. One, that not every organization had a CISO. I came from a highly regulated world that you had to have a CISO to another highly regulated world that you didn't. And I was just shocked by that. 2 is I was talking to someone who was leading IT and also responsible for security at a hospital. And that person also mowed the lawn once a week. So—

What?

Yeah, seriously. Just, I mean, just to show and talk about resource constrained, how many jobs they're doing. They're doing a lot of jobs. It's not just about IT and security, but it's also taking care of whatever else needs to be done around the hospitals. Blew my mind.

So that's wild.

So, so resources. Again, I'm going to start off with the Participate in the InfoSharing Network. I think, again, value for money, huge value. You literally are now tapping into networks of thousands of people. Again, with Health ISAC, there's 15,000 people behind the scenes that you can ask questions to. People are collaborating with each other, helping each other out. I love one of the examples I see internally is we have a CIO that's at a small rural hospice. And she leverages HealthISAC all the time. I see her contributing and asking questions all the time. And I know talking to her, she says that she sees HealthISAC really as an extension of her own team and being able to get answers to questions, opinions on things, and really get some valid input. So great, a good start there. I would also say that number one is about protecting patient safety. That comes first. And I think with that, I'm gonna also say that, you know, we've gotta be focused on ransomware defenses. And I've mentioned it a few times already, but I, again, I just think that especially in healthcare environments, we have gotta take that seriously and we've gotta do everything we can to prevent ransomware from impacting hospitals. Because we see what happens, right? When hospitals get hit, their IT systems go down, ambulances get diverted, procedures get delayed, lab results get delayed. Major human impacts happening, and, you know, nobody wants to see this happen. So those are the top ones. Again, the basic cyber hygiene we talked about, network segmentation, that's another big one to kind of limit the damage and blowout. The incident response plan is huge, being able to have that, practice that. Tabletop exercises are really, really valuable, especially in these environments. People learn so much from each other when they can explore You know, downtime procedures in a safe environment, let's say.

I think tabletops is a good example because it doesn't cost all that much, right? Like, you practice things in a relatively safe environment where you gain awareness about what may happen. I mean, I'm sharing trivial things, but I've met enough people who had major aha moments during tabletops, which if they were just reading the doc on how to do it, they would never come up. No matter how smart they are, how smart the doc is, how smart the doc author is, no, it happens over this coffee-filled room with people having a tabletop. And then suddenly they think, whoa, what if this happens? And everybody's like, no, not that. And then, yeah, I mean, sorry, I'm—

No, it's good. Like you said, they're easy to do. Especially if you do a true tabletop, everybody's literally sitting around the table. There's no keyboards involved. Hey, what do you do if this happens? Who do you call? Do we know who to call over here? Who do we get involved? How do we do this? Do we have people on staff to do that? Just asking those questions out loud and having that conversation. In an hour, you can get a lot done and do those often.

Anton, what do you think? Should we do a whole episode about tabletops?

I think we should do a whole episode on tabletops.

I think we're going to do a whole episode about tabletops, listeners.

People think it's sort of well-known, but for But the amount of insight that comes that's very useful from it is quite amazing. So, I'm going to, instead of gushing, we'll just do an episode on that. I want to shift gears a little bit. And you mentioned shared responsibility, probably in the context of cloud, but there's also shared responsibility in the context of using vendors. And while we've seen examples of people being compromised through security vendors, and of course, you brought up a beautiful example of whole IT being compromised. well, kind of destroyed by a security vendor one year ago. What's your advice for somebody who's under-resourced in this bucket? How do you not be hacked via your vendor? I think in our prep call, you mentioned being a partner, and my reaction was, yeah, yeah, yeah, sure, that's good advice. But how do you actually do that? That's the tougher question.

Yeah.

And I think, you know, another great area, because again, so many of the breaches, incidents that we learn and hear about are Probably caused by third-party issues. And so, you know, I saw this happen. There was a major event in health actually now, probably 6 or 7 years ago at this point. And as part of the recovery, that organization really took the mindset of like, hey, we've got to take the time to get our third-party partners up to speed as well. We can't just push security onto them, especially the smaller suppliers who don't necessarily have their own InfoSec program. Mm-hmm. We're going to have to teach them how to do this. And again, they use the word partner. We're going to partner with them on security, make them a part of this issue, part of this problem. We're going to share resources with them to help them get up to speed and make them part of the solution. And I think that that was a really brave way of going about it because again, going back to like my Citibank days, for example, I just saw like sort of all of that happening in the contract and you never wanted to have like negotiate security terms in a contract because we know how that's going to turn out. Nobody's going to win, right?

And your outside counsel might win some billing hours.

There you go. There you go. Yep. The lawyers, yep, always win. So I just thought it was a really neat, innovative way of taking on that problem by working with those organizations and making them part of that solution. And I guess, you know, the issue here is it's the bigs, right? Sharing with the smalls. So I think, you know, if you're a small organization, you're struggling with security as well. You need that help.

That makes sense. So I hate to have to do this because I've enjoyed talking about resilience all day now. I have to ask our traditional closing questions. And so one, do you have a single tip to help organizations really get started, especially the small guys, especially the resource-constrained guys who are out mowing the lawn? How should they get started on their resilience journey? And 2, do you have recommended reading?

Recommended reading?

Yeah. And it could be anything for recommended reading. It could be not Anton's blog, But it could be, you know, Mary Shelley, Mary Oliver. It could be— I've got a whole box of books, a whole shelf of books here people have recommended over the years.

Yeah. So, on the tip, I'm going to say it really comes down to this, I'll say, risk-based approach. And maybe that sounds a little scary, but I think the idea there is that you've got to know what you're protecting. So, you need to understand what that inventory looks like. What does your surface area look like? What do you look like on the internet? And then attacking the most critical vulnerabilities first. So especially for those smaller organizations, you can't do everything. You've got to start somewhere. So pick the major vulnerabilities first, start there and keep chipping away at it and make your way down, down the list. As a recommendation on reading, one of my favorites, I'm just going to, I'm going to go with Brian Krebs. I mean, I'm just a big fan of what he does.

He's great.

Yeah. And somebody is usually attacking him, so, you know, he's on to something good.

You know, I'm not sure we've had a lot of guests recommend Krebs yet, but that seems kind of crazy that people haven't brought him up.

Yeah, that's a good one. You learn a lot from there. Yeah. Latest and greatest and all kinds of fun stuff there.

All right. Well, Errol, thank you so much for joining us today.

All right. Thanks for having me. It's fun trying to keep up with you guys.

And now we are out of time. Thank you very much for listening and of course, for subscribing. Please subscribe so you can get new episodes piping hot And if you love our content, please drop us a review on your platform of choice.

You can find this podcast on YouTube, Apple Podcasts, Spotify, or wherever you get your podcasts. Also, you can find us on our website, cloud.withgoogle.com/cloudsecurity/podcast. You can argue with us on the Google Cloud Security Community site, googlecloudcommunity.com.

You can follow us on X, x.com/cloudsecpodcast. Tweet at us, email us, argue with us. And if we like or hate what we hear, we can invite you to the next episode.

See you on the next episode of the Cloud Security Podcast by Google.