Protecting Individuals By Protecting Companies

Startups get the party. Startups get the party started. Startups get the party. Startups get the party started. You want tech and tacos, tacos and tech you know we got tacos and tech is on smash border green guacamole keeper countins counting beans Contador Quentan frijoles found us trying to raise some queso la vida San Diego school of rappy rapping fire tortillas round jalapenos in these modern times a crappy beer and coffee my coding yoga posse fold the body origami we be surfing coronado eating tacos El gordo, the taco stand in pesto lucha libre and sombrero Got a shout out to cost angels by the ocean watch the sunset la Hoya shores Entrepreneurs trying to get funded when San Diego Startup Week is popping in the summer Oceanside, the Tijuana esti be full of hustlers from couch surfing to penthouses right on the beach Tech leaders who who believe stars are within reach we interview and founders who be shooting for the Moon SDTechOS with your host Neil Bloom. Startups get the party, startups get the.

Welcome to the Tacos and Tech podcast where we discover cutting edge San Diego technologies and the builders making it happen. I'm your host Neil Bloom, San Diego's tech ambassador and together you're going to put a face to the name of today's tech leaders with our own blend of local lifestyle. This segment is brought to you by Cox Edge. Our longtime partnership with Cox Business has helped their engineering teams develop new tech products for small businesses and startups. Cox is investing in Edge capabilities and working with developers and engineers across the ecosystem to deliver ultra low latency compute solutions, helping customers to improve application performance and to reduce cloud transport and on premise infrastructure costs. Interested in hearing more about Cox Edge? Please visit coxedge.com and mention Neil Bloom or freshbroodtech.com for our partner discount. And welcome back to the Tacos and Tech Podcast. I'm your host and today I am joined with two fabulous guests. I've got Jeremy Ventura of mimecast and Chris Pier Dominici of Rapidscale. Guys, thanks for joining the pod.

Thanks for having me.

Thanks for having us.

Yeah. So business emails, we're going to dive into deep into emails today, but specifically emails. They're a front door to a wide range of attacks. Especially we're seeing some pretty broad cybersecurity attacks happen over the last year with the pandemic, but also just sophistication in this And a recent Mimecast study showed that 64% increase in cyber threats just from 2019 to 2020. Can't even imagine what 2021 looks like. And this big looming unknown of what does back to work look like, is it really ever going to be back full? Could these attacks increase and you know, are we going to continue to pretty much, you know, use this all digital means of communication? How do we protect it all? So we're going to have a conversation about that. We brought two experts in their field. We've got Mimecast and RapidScale who have partnered with Cox Business to bring together a strong toolkit of defenses against these threats that could endanger our communities and companies. So it's pretty serious and we're going to talk about through some serious scenarios, but also some tips and things that the customer is asking for in this day. So Jeremy and Chris, welcome. Want to get to know a little bit about each of you in your own regard. So Jeremy, you want to give us a background of your history in this space and as well as an overview of mimecast.

Perfect. Absolutely. And once again, thanks for having us. Neil. As mentioned, my name is Jeremy Ventura. I've been with mimecast just for about two years now. I hold the role of a senior security strategist. So I wear a couple different hats. The first one of them being, I like to call it my day job, my night job. My day job really focuses on protecting prospects and customers, listening to their needs, understanding their security ecosystems, helping them evaluate their email security postures and their total security environments. The other hat that I wear is also being a thought leader, both internally with other mimecasters. So listening to what our customers say, what they say about the products, what they say about the industry, and taking that back to our product teams and educating internal employees, but also being the external face for mimecast as well. So doing things like this, from podcasts to articles, blogs and other forms of media. But before mimecast, I spent some time with a couple different security companies from tenable, relyQuest and IBM where I held different roles from sales engineering to consulting, all the way to incident response. So been around the field for a little while and have seen a lot of different aspects of cybersecurity.

Awesome. We are looking forward to your viewpoint here. Thanks for that. And Chris, how about you? Your background and a little bit of RapidScale's tech overview.

Sure. Thanks for having me on Neil. I really appreciate it. So I am the product marketing lead for RapidScale. We are basically a managed cloud service provider and we are essentially like the cloud services arm for Cox Business. We provide a range of solutions from Microsoft 365 to security and a range of other aspects designed to help companies expand their footprint in the IT space and leverage the cloud effectively as a means for reducing what they spend in their infrastructure and their services, help expand their IT teams, be a resource for them from a knowledge perspective and things of that nature. I've been with RapidScale now for two years, but my experience in the technology sector and particularly as it relates to security type elements goes back almost as long as I've been in product marketing, which is coming up on a quarter century now. You know, I've worked in with hardware related technology security aspects going back to my early days with like IBM and Juniper Networks. More recently over the last say 20 years probably has been around software as a service type functions. And my role with RapidScale is basically to be kind of the bridge between our product folks and the greater marketplace. So it's everything from go to market perspective, content and collateral creation, evangelization of what we do and things of that nature.

Awesome. Well, thank you guys both for being here again and early in Covid we saw a lot of cybercriminals taking advantage of new devices being online and IT departments were overwhelmed under management, especially with new devices. Maybe Chris, take a crack to this first. Like what did we learn from those earlier periods of COVID into most of 2020 and are we improving? We're getting better. Have people picked up the pace?

It's interesting. I think you can see from the early days of COVID to now that a lot of organizations are getting better with their devices and trying to secure them. I think a lot of organizations were probably caught somewhere in the range of not well prepared to being wholly unprepared for the demand of what the remote working situation put upon them from a number of perspectives, not just from the security standpoint, but even just the basic connectivity standpoint of having all of these workers all of a sudden be working remotely and what that meant to them from a network perspective, but also making sure that they were securing those devices. Particularly when you throw into the mix that many organizations had to rely upon some form of bring your own device type of a scenario to support their people working remotely almost at the drop of a hat. A lot of companies have gotten better with it, no small measure because they realized they had to use the cloud to do that effectively, that some of the older style approach to that remote networking connectivity didn't really cut Mustard, you know, the older style methodologies of VPN and things of that nature.

So a lot of things we hear about vulnerabilities come from end users, you know, kind of employees clicking on suspicious things, whether it's links, emails, ads, like all those things. There's only so much you can do to educate your audience, your customer. I'm curious, maybe Chris, start on that one as well and then we'll move it over to Jeremy as well too. Like are we doing better on educating kind of at the edge to stop the vulnerabilities coming from just the random clicks?

I think some organizations probably are doing a better job of that. I think that they realize very quickly with all the people working remotely and not having that internal network oversight aspect of things that they might have had in the past with people working on premises, that they had to be proactive with their users to say, these are the security measures we have in place. These are the things you need to do to make sure that we're staying secure. And these are the things that as it relates to your devices, your email, you can't be doing sort of thing. Some organizations probably weren't as good at that as others, but some were really good at that. And that's where solutions like mimecast come in because they can be a great resource for the IT team to more proactively be educating their end users on best practices, you know, in a fun way sort of thing.

Yeah, Jeremy, any kind of color there? Because I know you highlighted a lot of that in the kind of year in review report that education really needs to happen. What have you seen in terms of how education is actually infiltrating and actually having a positive impact?

Yeah, absolutely. I definitely think we are doing better as an industry, as Chris mentioned, but we still have a long way to go in that email security or state of email security report, Neil, that you mentioned, which I know we'll talk about coming up here. You know, we found that one in five organizations didn't actually have a regular security training program in place. That was kind of shocking, you know, to see that. Didn't hear that from different CIOs, CISOs directors across the globe. And because of this, users were three times more likely to actually click on suspicious links. And we know the remote workforce really isn't going to change anytime soon, if ever. Right. We're always going to have people remote and organizations will. And I think it's on organizations to be more responsible, to take more accountability to training and educating their employees and really engraving that Each individual, each employee, from the janitor to the CFO is responsible for security of the organization that they work for. Of course, it's human nature. Right. We will always have users that are going to be clicking on malicious links or opening up attachments, no matter what technology is in place. But providing that regular security awareness training, the accountability and responsibility, and also making sure that the training is frequent, fun, interactive, maybe adding some gamification and things like that can really help reduce and mitigate the risk to an organization. So I think we're definitely improving as an industry, but we still have a long way to go.

Yeah. And it's interesting that you mentioned kind of those stats, a few other stats that came from that survey, which by the way was a great kind of heads up because these numbers were big in terms of what I mean, some of the things that you just said, 1 in 5 but 67% of companies actually plan to spend more on cybersecurity this year. I'm curious to know maybe from both these points of view, especially Chris, potentially, because you're kind of right there with the customer. What are they spending this on? Are they spending it on upfront, like short term investments or long term outlooks? Right. Saying we need to make this a lifelong investment, that people are our front line of defense. And so kind of in front of that, like both of you just like playing a game with me here, if you had a semi infinite budget on defense or tools or even education, what would you spend it on and how would you split it between the two? So I know there's a few questions there. Chris, do you want to take a first crack?

Sure. It's interesting, I think that Covid was kind of a wake up call for organizations in many ways. Whether you're talking about a small business, you're talking about the biggest enterprise, that too many organizations for too long have probably been very reactive to their security postures and oftentimes implementing measures that were progressively becoming less and less effective over the recent years, Covid kind of forced them to become one more awake to what they needed to be doing, but also to be more proactive moving forward with those security measures. And I think in some respects that's even more true for the smaller side of the IT space. So the small and medium sized companies, where they don't have the resources of the large companies in the larger end of the mid spectrum when it comes to IT teams, security resources, particularly security experts in their own environment, so they look to organizations to help them out. The small, the companies they tend to be. And oftentimes those organizations are the least sophisticated. So they got kind of a rude awakening with what Covid brought to the table in terms of the risks, but also just how the attack vectors seen to be almost magnifying at quantum leaps every single year that they have to contend with. So that now organizations are waking up to. I have to be proactive and I have to look at my security posture across the board. Everything from your endpoints with your end users to your network and your infrastructure levels. And looking at what I have in place, what do I need to put into place and how I can cost effectively do that. So, you know, they're more and more organizations are relying upon people that have that expertise that can come in and help them assess that quickly and implement not just the measures for now, but the measures for the future, you know, and pivot away from that reactive security posture to a proactive one where you're implementing methodologies like a mimecast that are proactively helping you, you know, secure your landscape to other things, you know, even beyond things like managed detection and response solutions to what's the future for my security posture of how I could be proactively preventing threats, containing threats, when they do break through the security posture, which they will, and preventing that from spreading outwards. So they recognize that they have to start putting serious money towards that. But as I think everybody here has probably seen, you know, the small and medium sized companies, they have the most constrain budgets for that. So how can they effectively put the limited budgets that they have, and perhaps even the limited resources they have, from an IT team perspective, to face those threats and prevent those malware attacks and things of that nature.

Yeah, I completely agree with Chris right there. I think to start kind of deciphering between the small to medium sized to large companies, the way I also kind of look at that is also the maturity levels of a lot of these organizations. And maturity, sometimes that word can always get a little scrutinized. But really looking at three things, the people, the process and technology, and how do they all play together? Do we have the right staff? Is our staff focused on the highest priority alerts and incidents that the organization's facing? When we look at processes, do we have flexible and adaptive policies and procedures, but also incident response plans in case something like a ransomware attack happens? Have we gone through those steps? Have we tested it? And to Chris's point about technology, you know, there's definitely to the question, there's definitely short term investments and short term Things that organizations can do today, you know, looking at VPNs, looking at multifactor authentication, different things that kind of takes that human time spent in trying to automate a little bit more. And then we start focusing about the long term things. You know, Chris mentioned the Manage xdr, but also Soar zero Trust networks, CASB networks, SIEM technologies. Right. Things that can really help automate and orchestrate what's happening within organizations to really give time back to the humans, the IT and security teams that are responding to this. I think an important thing is it's not a one size fits all model for companies. And I think as organizations move through this digital transformation phase and the buzzword that we hear at the time, but really as organizations move to the cloud, right. As we saw that back in the pandemic, where all of a sudden everyone's on zoom, everyone's on teams, everyone's on slack, everyone's on OneDrive and Google. How do you secure that? Were organizations even prepared to even secure that? Do they know how to do that? I think it kind of goes back to the original question where I think security teams weren't necessarily prepared and it was all not necessarily because they didn't have remote workforce, but it was the speed and the scale at which we had to do that transformation and make sure we're securing our employees. So, yeah, I agree with Chris and that's kind of adding my two cents in there. But I will answer that last question though. If I was a CISO or CIO and you had infinite budget, the concept here is once again not one size fits all, but depending on the organization, you need to look at the word risk and how does risk apply to the business? And I think that's important. We talk a lot about roi, return on investment, but really to look at the roi, you need to look at what is the business impact and how do we gain a better sense of the technology and people that are leveraging that. So for example, if your organization has iot, which every organization does, or you have industrial control systems and OT technology, right. How do we secure that? What would happen if an attack happened? And all of a sudden my manufacturing plant is shut down and I can't supply the goods and services to organizations or the consumers worldwide. So I think there's a big component of that as well, applying the risk to the business impact. But of course, right. It goes back to everything we learned from the pandemic was it starts with security fundamentals. When we see and listen to all the largest breaches happening in 2020, 2021. A lot of the stuff it's coming in through things that organizations didn't do properly, the right way to begin. And that all starts with the security fundamentals.

It's interesting you mentioned maturity but also risk your survey findings. I think people were pretty real, pretty honest with how vulnerable they felt. Companies said their 80% were already hurt by a lack of cyber preparedness with three times the amount of malicious links clicking and emails. And 70% of companies expect themselves to be targets of email born attacks, yet they're still kind of still not making the investment yet. Potentially. Any special anecdotes that kind of came from this data that you heard individually while you were compiling it?

Yeah, I'll start first because this is fresh in my mind. I was actually just telling another group of individuals this story and it all had to do once again with does the organization, does the security IT team have visibility into not just their employees but the assets that they're using, those company owned devices, as Chris mentioned, that BYOD device policy and do you have control over it? One of the stories that kind of came out of that was actually around a CFO of a major organization and this individual was working from home during the pandemic and they were leveraging their laptop and they have a family with a couple kids and they let the children, every night after work was done, go on their laptop and watch YouTube videos or surf the Internet and not really protect it that well. So the individual, the cfo, their child had a Gmail account. There was an email inside of that Gmail account and the child didn't know. Child's under 10 years old, clicks, the email opens up. I think it's like, hey, you know, here's an extra thousand coins to play to the next round of XY game. And that child opened the email and of course there was a malicious payload that was downloaded on that machine and the rest is history. As you can imagine, it goes back to do organizations know where their assets are? Do we have the right security controls in place? Of course, there's a human aspect to this as well, right? The employee. You know, there's got to be a responsibility ness to make sure that employees aren't leveraging also their machines for personal information or for personal needs. So anyway, that was just one of those stories that kind of popped at the top of my mind when looking at the statistics. And we heard that in real life.

Any stories jump out at you, Chris?

Yeah, it's interesting. I mean we've had some customers where they've had breaches because they had not adequately been doing those fundamentals that Jeremy talked about in his, in securing their, their posture. You know, we had a large client, I won't say who they are, what industry they are because they probably give it away. But they had that very challenge where you know, they hadn't secured their email environment very well. And lo and behold, someone opened something inappropriate and it completely opened up their network to a malware attack. You know, it doesn't take, it doesn't take much anymore. The sophistication of those efforts, you know, if you're just talking about even email is some of these bad actors are very, very sophisticated with what they send. You know, in terms of the email looking like it comes from a legitimate source, it has legitimate header information in it and has legitimate looking information in the body that someone says, oh this looks like this is something I should open. And they open it up and they click on a link. Doesn't take long for that to cause to wreak massive havoc.

For sure. Yeah. And you know, it's interesting, even the findings in the survey, like people admit to that, that they're like I'm vulnerable, right. Like 88% of Office 365 users said that they need more email security, yet they're still open those emails and clicking those links sometimes, which is kind of interesting. 13% of companies still don't even have email security whatsoever. And only one in five companies offer ongoing cyber training. So there's a lot of room for improvement. Jeremy, maybe for you, what are some quick low hanging fruit? You gave some good ones before about multi factor authentication, that kind of stuff. Any other low hanging fruit we can do to just kind of get some, for companies to get some easy wins, quick protections. Maybe for thinking about SMB, small, medium sized businesses too.

Absolutely. For those quick and kind of low hanging fruits and you know, something that can be implemented within a matter of hours, if not minutes. I'll give you one. Well, the month of October is coming up Cybersecurity Awareness Month. So it kind of goes back to that original point that I made around training employees, testing employees, running phishing simulations. Now the one big thing too is I think as employees sometimes we are scared. We see those emails and if I click the wrong thing and I open this or you know, was this email safe or not? And I say yes, it's safe and it really wasn't. We almost feel that we're going to be yelled at. Right. By our managers or organizations. And I think that's once again goes back to the security and IT teams and even the management to say it's all about education. No one's going to be perfect. And so if we can continuously educate our employees, the better we all are. I mentioned earlier about making things fun, maybe adding gamification. I know one organization almost did. You know if you complete your cyber training in the next 24 hours, X, Y and Z, you get a company sweatshirt or something like that, right? Try to make this fun, try to get users educated on that, try to get them interested in it as well. Of course other low hanging fruits, right? The training thing, having users of course highlight over URLs and seeing is that really the domain or looking at emails. But once again it's humans. We're moving at light speeds, we're on our cell phones at 7am at Starbucks and going right back to our computer at home. And so we've got to make sure that the technology is in place. But once again I think the low hanging fruit, especially as the month of October coming up is try to think creatively, try to get users interested, entertain into and buy in to the security policies and security in general.

You mentioned the technologies being used, right? So we've talked Agnosium now about like it's got to be up to the user, you know, they're the endpoint. But there is some tech being built to try to help this, right? Either using artificial intelligence or machine learning. Do you have any examples of some of these technologies that are being built?

Yeah, actually so mimecast ourselves have one that leverages machine learning. It's actually called Cyber Graph. Talking about once again the end user, not necessarily looking at the emails or they're not trained properly to look at the different domains. And is this someone that I normally communicate with? This is exactly what we do. What we do is we learn users behaviors and their pattern recognition. What we're doing in the background is creating a database, an identity graph database is what it's called and it's really there to leverage in pickle anomalies. So for example if Chris emails me today and he's never emailed anyone at mimecast before, we will get a banner that pops up in the email, color coded banner that says nobody has ever responded to Chris before or Chris has never sent an email to this organization before. And it goes even beyond that because it's learning the patterns, it's learning behaviors of your end users. The nice thing about that is of course from probably almost every organization, now that I talk to everyone's got kind of the external up in the subject and once again it's human nature. Every email that comes internal to the network it says external, external, external. What about adding something different? Humans are visual learners. A lot of us are adding different color coded banners up there that may be red or yellow or blue or black depending on the severity of that. So that's what actually mimecast produces when it comes specifically for email security. Of course there are a lot of different organizations out there and I know Chris also partners with a lot of different other companies that leverage AI and machine learning but specifically for email security and kind of the topic today, that's actually something that mimecast is pretty proud of as far as our acquisition and we typically see that widely used with our customers.

Chris, maybe you can speak to that but also speak to maybe related to what's that partnership like using those suite of tools with Cox business as well as maybe how Cox customers can get ahead with some of the smart tech and resources through this relationship.

Well, I think no matter what the size of the organization is, IT teams are always managing a lot of different demands. But that's particularly true the challenge that I think becomes more strenuous as you go down the size of the organization where the IT teams for a small company or even a mid sized company are much, much smaller and they're wearing more hats. So they need resources that make their job easier for them to do. And that's where you know, as a managed cloud service provider that's what we keep in mind is we're bringing solutions to market the resources that are going to make everybody's lives easier to do but are also very powerful. And that's, you know, like a mimecast is great for that where it's constantly evolving, there's more automation being built into it that makes it easier for small companies and the medium sized companies that are resource constrained to do more steps of their job more quickly and more easily. But that's where machine learning and AI represent a huge lift for lack of a better way to describe it to alleviate those challenges, particularly in the cloud perspective because of the ease of deploying that and what that represents for organizations like from a security perspective where the machine learning is so much more powerful than what a human can do actively and adapting to what's occurring from a security standpoint that helps reduce your threat vectors enormously because it's learning all of the latest challenges that are coming along that threaten an IT environment. That's something that IT teams couldn't possibly do on their own, whether they're large or they're small. So the more of that you can automate, the better that's going to be. Particularly when it's a critical resource like your security that mitigates your threat posture and reduces that footprint of where you may be compromised and how deep that compromise could potentially become.

How are you rolling this out with Cox business customers? Like how can they get in on kind of this special partnership, for lack.

Of a better way to describe it, pretty easily, you know, it's not just that we offer that solution but also the expertise to help them implement that solution in their environment. And when you're talking about those small and medium sized companies where implementing a new solution can be pretty daunting for them in a general sense, but particularly when you're talking about security related aspects where they may not necessarily have a deep expertise in their IT teams because their people are more generalist and being able to leverage not just our cloud services arm but for improving their security, but the other more traditional network related infrastructure aspects that they can deploy. You know, it's kind of gives them a broad quiver of arrows to pick from to put down those security threats and have a valuable partner at their, their side. Not just in rapid scale and Cox, but also in mimecast that you, you know, you have those resources so you're not, you don't have to worry about the solution being untested and the expertise not being there in rapid scale. One of the things that sets us apart from a lot of our competitors is not just the expertise but also the support for the IT teams and the end users. So with a lot of our solutions we can be that extra IT person to help support a resource constrained team where they may be having an issue that we can help remediate either before they even know about IT or with that end user that has challenges.

Yeah, and the only thing I'll add on there is from the mimecast team. We love working with Chris and the rest of the RapidScale team as well. They are actually our largest global MSSP entire company wide. So we've done already over. I believe it's already Chris, correct me If I'm already 500 different installs protecting over almost 100,000 users and continue to grow as well. So everything Chris said, from the implementation to the support services to even integration services and just the expertise in consulting. We love partnering with rapid scale and we've seen a lot of success and a lot of happy customers which makes everybody happy and more Secure.

Love hearing that. Especially with how daunting the world it seems like the cyber world can be to know that there's teams partnering on this, helping the small medium sized business, that entrepreneur who really just wants to serve their customer, they got a stack behind them that can help them protect them. So appreciate that, guys. Thank you. You mentioned we're getting Starbucks in the morning. Usually in the night we're getting tacos. It is Tacos Tuesday. We got to know from each of you. You guys got a favorite taco spot? Chris?

I do, yeah. Actually, it's interesting. Living up here in New Hampshire, you wouldn't think you can get decent tacos, but there's one where I live, it's a small little regional chain called La Coretta's that makes fantastic authentic tacos that you normally don't find in a lot of areas. And they make it. They have a really mean house margarita to boot.

Love that, Jeremy.

I was just going to say a good taco is only as good as the tequila as well. So I would go with Wild Taco, which is actually out of Newport Beach, California. They're actually owned by a company called Bear Flag, which is pretty popular here in Orange county where everybody knows them for their fresh fish and seafood. But they created a taco joint not too long ago. Now they're actually kind of expanding. That one opened up in Laguna beach, but as Chris mentioned, it's all about the street tacos. So it's all about the pairings, what's on the taco. And then of course, got to have a good margarita to go with it.

I love it. Cheers to that. Well, thanks guys. Really appreciate your insight, expertise, the education and knowledge you're sharing with so many other companies. So thanks for being on the podcast.

My pleasure. Thanks for having us.

Thank you, Neil.

Thanks for joining us on the Tacos and Tech podcast with Neil Bloom. Thanks again to Cox Business for helping make this possible by expanding the reach of the San Diego tech ecosystem. Big shout out to School of Rap for our rad intro music. And this podcast is edited and mixed by Patrick Norton at citizenrecording.com youm can find Neil Bloom on Twitter eelbloom and on LinkedIn as well as well as fresh brewed tech and tacos in tech Pod on Twitter too.

Startups get the party. Startups get the party started. You want tech and tacos, Tacos in tech, you know we got it.

Hey, Sa.