Collectors’ Arif Basha on Proactive Security and Attack Surface Management

Historically, Attack Surface has been parameter like, oh, we used to have a network and secure the network. Life was good, but now there is no parameter. I think identity is the new parameter. So everybody is everywhere. And that sprung up a huge new industry in cyber with multi factor authentication, access and all of that. So that is our weakest link. And it has opened up to us to a new range of attacks where companies found significant trouble trying to address those challenges.

Welcome to the Ahead of the Breach podcast where we are dedicated to empowering security experts and practitioners with the knowledge, insights and actionable strategies to lead the future of cybersecurity. Here's your host, Casey Camilleri, CEO and founder of Sprocket Security. Now let's dive into today's episode.

Welcome to the Head of the Breach podcast where we talk everything offensive security with experts and leaders in the industry. I'm your host Case Camilleri and today we have Arif Basha with us. Arif has 15 years experience in cyber security and is a VP of Information Security at Collectors. Arif has spearheaded numerous enterprise transformations in cyber security. Arif, thanks for coming on.

Thank you for having me.

So we were talking earlier about Attack Surface management. Why is that important to you and your organization?

Attack Surface management is. We have always looked at that as our most critical threat vector risk factor for our companies everywhere. I worked at few of the breaches I was involved in because of our Attack Surface exposed Attack Surface orphan systems on our external Attack surface. That has been our biggest shortcoming as an industry and now it's a global environment. There are a lot of geopolitical tensions and they all have an impact on security posture of the company. That's where I feel like we have to keep our up to snuff on our Attack surface. And all the cyber insurance companies have reported that from their analytics that Attack Surface management of a company along with batch cadence determines the probability of a breach at a company. So these are the fundamental things we have been struggling to fix over the last 20 years as an industry and we are still working on that.

Yeah. Now I mean you need to know what your Attack surface is before you can even understand if there's vulnerabilities there. Do you find that usage of like cloud environments DevOps things changing a lot? The fact that your primer is maybe slightly dissolving as in all other places with hosting providers. Is that the reason why Attack Surface management is important?

Historically Attack Surface has been parameter like, oh, we used to have a network and secure the network life was good but now there is no Perimeter, I think identity is the new perimeter. So everybody is everywhere. And that sprung up a huge new industry in cyber with multi factor authentication, access and all of that. So that is our weakest link. And it has opened up to us to a new range of attacks where companies found significant trouble trying to address those challenges.

Yeah. And what are you doing with proactive security? What are you doing to kind of get ahead and test your systems?

Yeah, I think my role, I have always been focused on proactive. We do as much as we can, we focus on that and then we have reactive and we have support services and the proactive services, we do everything we need to do as an industry, as a company or everything we should be doing all the fundamentals. Right. So keep your systems patched, harden your systems, train your employees, don't click on emails, links, whatever they're coming from. But despite our best efforts, the proactive security is not 100% secure. That's why we have proper processes. How do we react to a breach or an incident and how quickly we recover. That goes into resiliency and planning for myriad risk scenarios and rare black swan events, those kinds of things. But proactive security is the only way to stay ahead of the game. And it's not about 100% security. And we also cheat in the industry, like just make it enough hard for bad guys to go after you. So we know what to do, we know where our dirty laundry is. We need to do just basic things, the fundamental things. Just patch on time.

And why do you think as an industry we struggle to get the fundamentals right?

I think the honest answer is it's very hard to do the foundational things and we get sidetracked by all the sensational things, like this deep fake video that came up that SEO got defect and someone transferred $25 million. That is such a rare event, but that consumes our entire conversations with the boards and in the industry, in the media.

Right.

But the hardest part, most of the vulnerabilities, most of the breaches, they're not using deepfake, they're all using just foundational tech. Just making sure you have proper controls in place, good hygiene, good culture in companies. And I have been doing this for intact about 20 years in cyber. For more than 15 years we've been talking about the same topics. If you look at the theme, they're common over the last 20 years, same thing. Oh, patch your systems on time, harden your systems, don't publish unnecessary services and misconfigs. Same things. It gets boring after that. And that's also boring. That's why nobody wants to do that work.

Exactly right. That's the boring work that has to continuously be done. That's not that fun compared to creating a deep fake. Right. Now, in your experience, you've had to deal with multiple incidents. Right. Just given your role in what you do in the incident response, what are some things that you've learned? What advice could you give to others?

Yeah. As someone who is smarter than me has said, there are two kinds of companies who the companies are already hacked and the companies that will be hacked. And there's another variation of that, companies that know they're hacked and those that don't know they're hacked. I don't want to go there because I don't want to like create a scare sensation.

Again, change of heart, the mindset. Right. It goes back to when people say it's not a matter of if, it's a matter of when. Right. Assumed breach, all these things. Right.

And that is inevitable. I think despite our best efforts. We have bad things happening to us and we are in the news for the good or bad. Only when things go wrong, only when there's a breach or they find out who the CSO is, who the team is, and that's when we are dusting off all of our resiliency plans, doctor Plans, those kinds of things. So from my experience, the best practices I have found is attack surface management, how we keep it current, keep it up to date. And when bad things happen, you need to have proper incident response plan, one of the first set of policies for a company, have a solidly formulated documented incident response plan, incident response policy procedure and a tabletop exercises, all those things. That's also another boring part of cyber security documentation. Those kinds of things. Have them run exercises. So you at least have some experience. Internal. Every tabletop has resulted in findings in my career. So always some things we could do better, we could be more resilient. That's one thing. And having a retainer with anybody. There are a lot of companies providing $0 retainers along with depending on the SLAs and have a retainer that you can depend on as a company and go from there. And the last thing would be cyber insurance. Insurance has been going up over the last 10 years. Cyber insurance, they have been paying out a lot of money. Now in the last couple of years, the insurance rates have sort of stabilized. But insurance does not cover the entire cost of your breach, depending on your coverage, whatever you negotiate. So those are the basic, I would say Three things you should focus on.

Yep. And as a leader, it's your job to kind of read that cyber liability policy and understand what it's going to cover as part of your program.

Yeah.

And I think so many times no one wants to do that. It's boring.

Right.

But like it has to be done.

It has to be done. And we partner with folks in the legal and our privacy teams. They should be part of the conversation. And the last part of that is also communication, which I would say as part of our tabletop exercises, we make sure we have proper communication templates, documented, published internally, externally, for external communications, for investors, press. So that will save us a lot of headache. They're like having suspenders. If you need to use them, you won't crash and at least you can use that parachute and fly to hopefully some safe, safe zone.

So now that the fundamentals are out of the way, we've talked about that. Let's talk about some of the new age stuff, right. AI and how that's changing and how you think about that. Share your experience with AI.

AI is the buzzword. In the last couple of years we've been. And everybody who's listening and also I'm sure you as well are tired of talking about AI. It's everywhere, every news site, every article talks about AI because it is one of those sensational items that consume most of the bandwidth in my experience. I have been hearing about AI ML for more than 10 years. It has always been a lot of ML, more so than AI to this day. It's sort of moving towards AI but still we're not fully AI maturity wise. We still have a long way to go and these models are not 100% correct or 100% accurate. They still need us to validate everything they are creating. But there is a glimmer of really fast progress in the AI field in security in the last year or so there's so many AI bots people are able to develop, train their own models, their open source models and I've seen a lot of bots we've been using as bots for SOC manager, prioritizing vulnerabilities and Google has a couple of a models that they published. On the third intel side there are a lot of automated bots. So it is helping us to shave off some time from our analysts and my future hope or prediction would be in the next couple of years we will exponentially mature in the space and taking care of a lot of stuff. We do a lot of automation currently using SOAR platforms and automation built into our various ecosystems. They will be very well integrated with AI assisted decision making which will result in instant response and real time detections and response, hopefully freeing up our tier one people focus on something more meaningful.

Now you mentioned that you're using it for your SOC analysts and it's helping them save time. What exactly is it doing? Is it augmenting, enriching some of that data that they're looking at to make a decision or what does that look like?

Currently what it's doing is very similar to what we are accomplishing using our SOAR platform, which is it collects the information and compiles from various sources. And that data with our AI bot SOC manager can give us some interpretation of the data. So that is a starting point for our analysts. So they could look at it and they can infer a lot of things from there. And that also helps us train the models as well. But we are not there yet. We are basically on the receiving end of consuming end of these models as in my experience and building models, all of that very intensive, CPU intensive GPU incentive, expensive process. And I don't think as a company we will ever get there, but we will use those.

What are the boardroom conversations like?

Yeah, historically security has been limited to tech a long time ago. So when I started I had a full head of hair like you. That's when we were talking about security is a problem.

It's going gray, next it'll be gone.

You're way, I'm way ahead of you. It was part of the technology IT team, security part of the IT team. And then things have slowly progressed for the last 15 years into it became part of the broader than it in part of the business teams. And now security news is covered in the main channels, on TV news channels, IT becoming a mainstream news. So most people are aware of cybersecurity. Everyone has a story about cybersecurity. So boards are becoming more aware of it. We still have a long way to go to add the right folks to the board mix to security. But there has been a much broader attempt I have seen in the industry to seek out security folks to add to boards both for profit and nonprofit. So they're hearing that when they talk among themselves or their own sources. So they are asking questions, what is our situation? And I also worked at places where they just want you to take the problem away. But increasingly that has been less and less. So people are curious to see where we stand.

They want to understand a little bit more to make better informed decisions.

Yep. Exactly. And that's part of my role as well. So educate them. See as a company what is our risk appetite, so how much we're willing to accept before something bad happens. And there are a lot of discussions about, oh, we can quantify the risk, tell me what's the risk. And that's we've been doing those exercises for decades now, potential impact of business and loss expectancy, those kinds of things. But generally now they're asking us and we give them information that they need to know. A lot of us make a mistake of providing the information that they don't understand. That's another challenge with the board since we provide useful information that they can interpret. They don't need to know your control efficacy or control how good they're doing or attack surface management results. But they do need to know what are top 10 risks, top 5 risks and what are we doing and is that enough? So we need to get their buy in so they're not trying to shoot us when something bad happens. We need to keep them in the loop so they are part of the decision making body that we accept these risks and we transfer these risks and we mitigate these risks.

Yeah, that's solid advice for anyone that needs to prepare to present at the boardroom and things to think about. Yeah, Arif has been a great conversation. If someone wants to get in touch with you, learn more, follow your work, where can they do so?

At this time I'm primarily on LinkedIn, so definitely my name is Arif Pasha. A R A F B A S H A. You'll find me on LinkedIn and that's the best place to follow me. Nice.

Thanks, Reef.

Yep. Appreciate it. Thank you for having me.

Thank you for listening to another episode of the Ahead of the Breach podcast. If you enjoyed today's episode, please leave us a review on Apple Podcasts or Spotify. If you're interested in exploring how Sprocket is shaping the future of offensive security, be sure to check out our website@sprocketsecurity.com thank you again for joining us. See you on the next episode.