The Power of a Threat Aware Network with Mike Spanbauer

Welcome to the Test Guild Security Podcast where we all get together to learn more about security testing with your host, Joe Calantonio.

Hey, it's Joe. And welcome to another episode of the Test Guild Security Podcast. Today we'll be talking with Mike all about the power of Threat Aware Networks and other security related topics. Mike is a technology evangelist for Juniper Security. Mike's work and expertise in network and security advisory consulting and product strategy over the last 25 years. He provides a breadth of perspective across network and security execution as well as approaches to solving many operational and governance needs that organizations face. He most recently served as Vice President of Research Strategy for NSS Labs, driving the enterprise research and consulting practices for NSS Global clients. And prior to that, Mike also held leadership roles at Current Analysis and HP and Research Strategy and Competitive Intelligence. So as you can tell, he really knows his stuff. Really excited to have him on the show today. You don't want to miss this episode. Check it out. Before we get into this episode, if you haven't already, I highly recommend you head on over to secureguild.com and grab your security testing ticket now. It's an online conference dedicated 100% to helping you succeed with all your security testing efforts. It's a great, great event for beginner security testers, folks that may not be hardcore security hackers, but want to add more testing techniques to the toolkit. This is the online event for you. Mike actually will be joining us as the closing keynote for the whole event with a session on developing a security test methodology. Mike has been there, he has done that, he is an expert, so he's going to be wrapping up everything you learned during the event and actually make an actual plan you could put into place as a methodology to help your teams actually create a security test plan. And as I mentioned, this conference is completely tester focused. So even though it's security, it's security with a tester in mind where we're completely tester friendly. Head over to secureguild.com and register today. It's no secret that the number and complexity of applications are growing, but what is alarming is that 90% of security incidents result from exploits and against defects in software. The need for better application security has never been higher and micro Focus Fortify is here to help. Fordify is the recognized market leader in application security and it is the most comprehensive and scalable application security solution that works with your current development tools and processes. With Fortify, you could start security applications in a single day, including custom code, open source or commercial components and scale as your needs grow with an on premise as a service or hybrid implementation. Check them out. Head on over to micro focus.com app security hey Mike, welcome to the Guild.

Well, thanks Joe for having me.

Awesome to have you on the show. Is there anything I missed in your bio, Mike, that you want the Guild to know more about?

No, I think that you did a good job covering it. I've been working with enterprises and organizations of all types, all sectors around the world for the last 20 to 30 years around infrastructure and security, and the number of conversations that I've had have been exciting and challenging and really just happy to share.

Awesome. So as you mentioned, you have a ton of experience, which I love. So is anything in this space that you've been seeing over and over again you're like, I can't believe like 20, 30 years later we're still addressing this in the security space.

I think there's a host of areas that I see us not making a lot of progress as an industry or as a macro. Some of them involve continuing to think that security is separate from networking, and largely these are false premises or disciplinary areas that perhaps are holdovers from ages ago when there was discrete requirements and capabilities that demanded dedicated teams because the complexity was just beyond what any single organization could handle. But if you look back over the last 10 to 15 years, the convergence has been occurring. The fact of the matter is that whether organizations are managing it that way or not, the technologies are one, especially when you bring into focus the cloud context and as a result to manage them as discrete disciplines without considering the overlap in policies, the overlap in capabilities, and frankly the visibility that those combined functions provide. Both the security organization, but also the network organization is both share a common goal for business continuity and ultimately reduced risk.

So do you see then DevSecOps as a real thing where they're merging, basically the whole team getting involved, or do you actually see it still as you still need a separate security team and a network team, you just need them to communicate more with one another about it.

So I'm not sure that there's just one answer for that. It's a great question, and I think it depends on the organization's own maturity regarding their security policy and processes, where is their risk disposition or tolerance, and how aggressive or how conservative is their cloud or physical site strategy for consolidation and for links. So, you know, for some it indeed may be the combined or unique capabilities of a cloud architect, for example, that does require mastery of both network and security disciplines as well as to A fair degree, application and architecture all rolled into one or do you keep them as separate disciplines? In the case of MVNOs or carriers and service providers who demand incredible insight into the tolerance of specific links, which is its own mastery and requires incredibly deep discipline and expertise to manage the network infrastructure where you have the sister team of the security capabilities sitting alongside, working closely and collaborating on both incident awareness, visibility to activities and really collaborating on outcomes as a joint function. So I think there's more than one path, but many possible success avenues for organizations.

Absolutely. So have you seen anything that's worked for companies to help foster this collaboration or to actually bump up the visibility like you said, is needed now I.

Think it comes down to understanding which outcomes each team is looking to achieve. There's a lot more shared interest than perhaps some orgs realize. And it's not just that they all roll up under the technology budget. It's the common outcome of ensuring successful secure connections for their users, be that an employee or their customers users in the context of anyone accessing data across the environment. And so the network team shares the same interest. Right. You know where perhaps their priorities list is a little different. There's a lot of shared capabilities and once they have a chance to discuss understand where those differences may lie, then you can develop at least a common communication framework, if not a common strategy that represents both and does achieve the business outcome of a secure and hyper available organizational infrastructure.

Nice. So I did see a title of your black hat session on the power of threat aware networks and it caught my interest. I actually didn't see the session. So I was just curious to know, as I mentioned in the pre show, I am a beginner, what is a aware network?

It's a good question, Joan. So something that we've been pursuing here at Juniper for some time is the concept of connected security. So as I've mentioned that convergence that has been occurring naturally over many years where networking and security are intermingled regardless of how you've organized the people and the processes in the company, the fact is the technologies are codependent and in order to be able to respond to the feat of an adversary of threats today, leveraging the insights that the network telemetry offers, be that perhaps a piece of malware on a client that's making a command and control callback, asking for additional instructions. Right. One of the things that in particular a new infection will often do and potentially then requesting download of a secondary payload that call out of the environment to the remote location that perhaps is a known malware or CNC adversary location. Just that very action of I'm calling the bad guy. The network sees. Now if the security technology is working with the network, then that activity becomes an event that can be an active mitigation and then the network can have a control implemented to cut off that session or the entire client. In the case of there's a clear infection on this particular PC or this whatever the device is, the network contributed to the security intelligence which then resulted in a definitive mitigation action that can happen autonomously from any user interaction and does in fact for our customers on a daily basis. That is the prospect of enabling your network to be threat aware and able to effectively address security risks.

I love how it's autonomous. I think I was watching another session by someone at Juniper and they talked about AI and automation that helps with this. Is this part of a threat aware network?

So today we have a considerable amount of AI or iterative characteristics in our advanced threat prevention or ATP product. We've been dependent on it and most of the security of industry has been using AI for many years as a tool or technique to just more rapidly handle data. But in addition, and I'd wager that the session you heard was from the network folks, we made an acquisition of an incredibly awesome wireless network company last year 2019 called Mist Systems. And Mist is a state of the art wireless LAN system that's designed around the premise of understanding connections of users across the wireless environment to automatically or autonomously adjust for consistent experience. So in that they use AI for that outcome and to determine whether the network can self address or adjust for that optimal experience. Now behind the scenes of course we've been working on that and we're not ready of course to share too much. But I can promise you that the potential and the excitement around what AI will offer for a security solution, as both the existing solutions as well as as we move to the cloud promises is considerable. To be able to move at the pace of again threats, at the pace of business today is ultimately the outcome that we all desire.

So when more and more companies trying to ship software quicker and faster get it out the door, have you seen an increase in security attacks or the surface being increased because people aren't aware that maybe they're consuming an open source library that has something built in that makes it unsecure or anything like that?

Absolutely. Joe, I think the point that you just made about the dependence on code that perhaps is not developed in house shared libraries, common stack pieces, it does expose organizations to perhaps incorporating vulnerabilities that they may not have been aware of. And while that's just arguably part of the software development lifecycle, that has been the case for the industry for ages. It's how fast you can address those vulns when they are discovered, and it's the pace at which you can roll in fixes and patches that challenge most organization. Because the identification of volumes are one thing, but when those volumes become exploits and become exploitable, that's where the weaponization motion occurs and that's where security demands a more heightened and frankly rapid response. That's kind of the premise of the threat aware network. Knowing where the potential issues lie as well as where there's clear bad activities and moving rapidly to address those weaknesses is the goal.

Nice. So are there any new challenges for the enterprise you think? While you really need to have a threat aware network in place, I think I've read somewhere there's like malware as a service now you mentioned cloud a few times. I'm sure that exposes people to certain security risks that they may not be aware of. So I guess at a high level, any new challenges for the enterprise that you see that is really bubbling up to you?

Yeah, I think it's a great question. I could certainly sit here and offer some relative to the additional or the accelerating consumption of as a service emotions because you don't always know what apps and applets and potential API exposures are in there. That's a space that I think as an industry we're getting better at API weaknesses and vulners themselves. But tomorrow there'll be more. I think it comes back to recognizing that you must have robust process in place to constantly investigate and be diligent about identification of these opportunities to better secure volumes or even frankly apps, because volumes are known. It's the unknown things that are frankly more challenging because that's where true zero days lie and where in essence threat actors are always going to be looking. Now, good news, largely that remains the realm of incredibly well funded actors with technical adepts and capabilities that are generally far beyond the quote unquote average cybercriminal. But suffice to say there's enough of the other we'll call them incredibly well organized actor. I'm not going to attribute the nations or whatnot, but rather those with enough discipline to consistently take apart code and look for weaknesses and vulnerabilities to then exploit from that. And no organization's immune to this of any scale. And largely that's where you need to know what code you have what assets you depend on, where those apps reside, where the data is and how it's to be used so that you can build the right policies and tolerances around these, these connections so that you can take action when something odd or anomalous happens.

So, yeah, like I said, I am a beginner. I don't know, I think I heard before someone said if someone wants to hack you, you're going to get hacked. I know that's pretty fatal kind of a view of it, but is that a true statement or how much can you actually prevent? I keep reading about ransomware lately, like Garmin, I think, paid out ransomware. How preventable is that? Is it like you can only do the best you can and eventually you're going to get hacked anyway?

So I'm not fatalistic, you know, like. But indeed there is some truth to that statement that if you are indeed targeted by some elements, that there's not a whole host of things you can do to prevent the infection. Now, that said, having an effective process in place and knowing how to respond quickly and ably in order to address that before that initial cut becomes an open wound, becomes something potentially far more dire. I think that's where an organization needs to ensure that they have response plan that's in place, they can effectively execute and they do drills on this. You need to practice these things. Like in the disaster context, there's no difference. For an epic breach level event, knowing how to handle the whole procedural piece in the event something like this does occur is part of it. Now that said, let's step back a moment because oftentimes people need make that statement about if somebody wants to hack you, they will. So they did that based on predominantly the amount of breaches or just the prevalence in the news of security issues, and the bulk of them are preventable. So while if there's somebody focused on you, there's probably not a lot they can do if they're well funded. But most people are in fact more often hit by commodity malware or vulnerabilities that have frankly been in place for years. We've had protections in place for a long time. So that speaks to something else, which is effectively understanding what's running in the environment, identifying infections when they are, before they grow into something much more severe. In the case of one media infection, and I'm not going to name the individual organization, but the infected client was infected for 16 months prior to the actual incident occurring. And in that scenario it was actually a system that was sold on the secondhand market for like $2,500 in the dark web to a very organized actor that then did something far, far more significant. After that the system was sold, but the initial malware was just sitting there late for quite some time. So the write processes, inspection, virus controls and network software likely saw what was in place and just did not take action. So visibility is part of this throughout the environment. And that's our premise, is that again, the combined security and network visibility in one, when you leverage that information and make it intelligent, that's where you can take decisive actions and really help to protect the environment and the users.

So how would that have worked? Say someone used Juniper and they had threat aware network. How would it bubble up that malware? Does it scan all the machines and then it bubbles up a report and like does a percentage of a high probability of being an issue?

How does that work now in regards to that specific incident? Right. You know, there was communications that had been occurring from that client out to basically keep alive. That ensured that that was still there, that it was still an active infection. But it was done so subtly. But the fact of the matter was that the server that it was connecting to was known, right, to be, you know, a CNC or a secondary actor. There was an adversarial asset. It wasn't like connecting to some popular major site. That sequence that connection was visible. That would have flagged at least an investigation event, if not a direct flock. And so from that alone, SOC would have at least had visibility. Now, at that point, it would have been dependent on the processes and the people to take action and to investigate. But the network itself could have informed the security teams that, hey, this is strange, right? Why is it connecting, communicating with this node, that there's no business services that our organization depends on that are there. And it is also a known host for a number of bad actions. So that alone the reputational pieces could have condemned that client connection.

Gotcha. So we did touch a little bit on AI. I think a lot of people have unrealistic expectations about it, but I think with machine learning, if you have like a really threat aware network, you're probably collecting a lot of data, a lot of log files, a lot of different things. I would think machine learning would be a perfect user case for this. So have you seen an increase in machine learning and is that part of the solution that you have for being able to really detect these things?

Absolutely. So yeah, ML, AI, right? These are all names for the intelligence to make sense out of large volumes of information or data, right? It's just information until you infer from it something actionable, something particularly important and that that becomes intelligence at that point. And so we've, you know, certainly had a number of machine learning and AI capabilities within our ATP technologies, as well as embedded in the firewall and the management framework itself that help various components of our complete solution to indeed infer and to draw out of that information and data insights actionable threat guidance for customers to then take decisive measures in order to intercept or to intercede a potential activity of breach or whatever infection growing worse.

So in the description of the power of threat network that you did for Black Hat, it says how did the war botnet traffic blocking the traffic at the edge of a non traditional security device with Juniper connected security. So that sentence is a mouthful. Could you break that down as for a newbie, what that means? And is that a common type of attack that you've been seeing recently?

It is. And so let me make it simple, right? I think that is quite a statement. So in that particular scenario, what I walked through during the session was the example of botnets are host of drones or devices that have software installed on them that can be in concert controlled and basically commanded to do certain things, right? Some denial of service activities or other things. So that's this piece now recognizing that you have a device that is a part of a botnet, an identified source is part of the intelligence that I've mentioned before in the thread aware network, recognizing that. But the other piece is being able to intercept and to block those communications before it even bothers the security appliance. And so you can drop that traffic, that activity, those command actions at the wan edge of the environment so that you don't even pollute the interior of your infrastructure and your organization once you know definitively that that is a botnet connection. And so we can do so either on Juniper routers or on competitor routers, right. We're keen on ensuring customers can use the capabilities that our connected security strategy offers throughout infrastructure they have today. Because while we believe it absolutely does work a little bit more effectively or efficiently to deploy on a Juniper infrastructure, the reality is that we can't expect an organization to adopt our solution. And then, and frankly there's some cases where it may not be the ideal solution, but being able to support our premise and the connected security strategy by being able to drop bad connections in their existing wireless, their routers, et cetera, that's fundamentally what we're supporting our clients, our customers today doing around the world. And so in the talk I walked through being able to drop a specific client at the routed edge before it ever traversed the DMZ into the interior environment, so didn't even have to cross the firewall. In that case we can drop that connection right there at the WAN port.

So it sounds like in a network architecture router may be your first line of defense. And is that an area you've seen people kind of avoiding or maybe not having enough emphasis on?

Well, I don't think that folks realize that it can be a capable ally or element in a security intercept beyond your typical stateful rules. Right. So routers have always been able to, you know, manage and direct based on IPs and ports, which is what they do. However, by using the security intelligence and instrumenting a command that this specific ip, that this specific port is malicious and that that client shouldn't be talking to that server, that's where you could turn a router into, into more that is the fundamental pinning of the threat aware network is that we can turn typical infrastructure non security devices into able security technologies to empower the entire environment.

So like you mentioned, router's been around forever. What I've been hearing more about and I think it's a buzzword because it's been years Internet of Things. So have you seen as more and more things connect to the network, non traditional devices like Internet of Things, that it expands the attack surface for people that may not be aware of what they need to do in order to make sure that those aren't compromised?

IoT is indeed a significant challenge. And we've seen only a fraction of the devices that we're likely to over the next five to ten years attaching already and with 5G imminent, the performance of those connections is going to increase exponentially. Multi gig connections on a per device basis. That opens up a whole host of potential challenges if you do not have a network or an infrastructure and security model in place that can monitor and provide visualization or visibility to all of those communication actions and all that data transference. So indeed we're only seeing the beginning stages of what kind of potential risk it opens for organizations who perhaps haven't thought through it because for years we raced to connect based on convenience and admittedly there was good logic to doing so right, water meters and so forth. But we didn't think that people would be, we didn't think there was any risk and or you know, taking advantage of that. And so we have devices and technology out there, these little simple sensors and monitoring nodes that don't even have the memory or CPU capabilities to have a security instrumented on it. So where can you protect those elements? The only place you can do so is at the network or upstream from that device and doing so at the connection. That's really the core of our strategy and why security and Juniper's network heritage are combined to provide our customers that stack. So IoT it's going to be a handful and I think we're up for the challenge, but it's going to be a journey for the industry to get their hands around it.

Nice. And I keep mentioning I am a newbie to security, but every time I look up security, Juniper always comes up. So I guess for the folks that are like me, what is Juniper? What are your solutions? How does it help folks? Why do I keep seeing it every time I look for security related items?

It's a good question, Joe. We do come up often, so we've been in security for a very long time. Juniper was in fact one of the first network security leaders in the industry since 2003 when an acquisition was made at the time the market leading firewall technology vendor, Netscreen. For folks who've been around a while, it's a logo that perhaps as we mentioned in some time, but Juniper has been very much one of the fundamental vendors driving in a leadership position the network security architecture for the last almost two decades. And so our solutions entail both next generation firewalls as well as a host of adjacent and complementary technologies that support that agile and flexible visibility that is demanded by organizations of all sizes and, and by all sizes, you know, referring to all the way up to the absolute largest environments on the planet depend on and rely on Juniper security and network technologies to power their communications every day. In fact, we're very likely communicating across two or more infrastructures that are on Juniper right now. Given the presence on 99% of all providers and hosting locations in the world.

That must be kind of stressful too, I guess because say if Juniper had a security hack somewhere, then that'd be an exploit that'd be open to a lot of folks, I guess.

Yeah. So I mean we definitely need to remain diligent. I mean we've got a lot of software, right? So any organization is potentially vulnerable, depending. And so we've a team that looks very closely at and constantly monitors for it. There's no one immune to it, no matter how diligent you are. But it's also how fast you respond to it and how well you, you know, enable your users, your customers to handle those Things.

Awesome. So, Mike, those are all the questions I have. I have one last question I ask everyone, but is there anything you definitely want me to ask or anything you.

Think I should have covered the piece that I'll offer. And I think, you know, the one that I hear most often is, so how do I get to a place of a truly secure infrastructure? Is there a perfect network security environment? And I'm a pragmatist, right? You know, having seen an awful lot of things, some rather experimental, some prove it out over time that there is no single perfect. And I think that it largely comes down to picking a technology provider that, you know, is passionate about delivering the best possible technology products and capabilities, listening to you actively and hearing from customers what they need, what is legitimately, you know, the real challenges that they face. That's the best, you know, possible in a direction I can provide. You know, I spent a decade, like I said, consulting prior to this, helping guide organizations pick the best technologies for them. I personally feel that Juniper's got an awful lot to offer practically any organization. But I won't sit here and say that it's perfect for everyone. And so it really comes down to ensuring you can trust the technology vendor that you've chosen because you are partnering with them and you need to feel that they're on your side to provide the best possible solution that can be. And at that point I'll offer. Folks, I'm spanbauer@juniper.net, if you have questions for me, I'd be happy to take them personally, as I do indeed want to hear from organizations around the world who either use us today in everyday life and your needs as well as where you feel that there's something else, some opportunity and more. So we're here for you and that's what I'll leave with.

Okay, Mike, before we go, is there one piece of actual advice you can give to someone to help them with their security testing efforts and what's the best way to find or contact you?

I think as far as the best security testing advice, you can never make an assumption that the device is behaving exactly as you expect it. You must do your own proof. And that doesn't just include the purchase motion, but also instrumented controls and policy. Right. Make certain that it is in fact behaving as you expect it to before you roll out into production code keys and to validate that it is doing what you anticipate. There's no substitute for that. Hands on validation. It's what NSS does and it remains very much in a core to my being that will help an organization arrive at that confidence level. And then as far as contacting me, my email address is mspanbaueriniper.net or of course you can find me on LinkedIn. Also as Mike Spambauer with Juniper Networks so I'd love for folks to reach out and be happy to chat.

Thank you Mike for your security testing awesomeness. For links to everything of value we covered in this episode, head on over to testguild.com S34. And while you're there, make sure to click on the Try Today link under the Exclusive Sponsor section to learn all about Micro Focus Fortify, which is the recognized market leader in application security. And if you haven't already, I highly recommend you head on over to secureguild.com and register for the 2020 event. Our goal is you learn a tip, tool, technique or best practice that will help accelerate a new or existing security testing effort that you need to work on. This event is awesome for beginners, so if you really want to help your career in 2020 and beyond, don't miss the 2020 event. Check out our awesome speakers@secureguild.com so that's it for this episode of the Test Guild Security Podcast. I'm Joe. My mission is to help you succeed with creating end to end full stat security testing awesomeness. As always, test everything and keep the good. Cheers.

Thanks for listening to the Test Guild Security Podcast. Head on over to testguild.com for full show notes, amazing blog articles and online testing conferences. Don't forget to subscribe to the Guild to continue your testing journey.