There's a need for MSSPs to move beyond simply watering down alerts and providing a report. it's time to do more detection, provide more value, and make sure that cloud and cloud services are not left out. This is a high-level keynote touching on threats, risk, and ways to think about providing more value.

1. Ben Johnson, Co-Founder & CTO
Managed Security Service Conference 2019 | Denver, CO
Delivering “Detection + 1” in the Cloud Age
bjohnson@obsidiansecurity.com

2. BACKGROUND CHECK // BEN JOHNSON
Co-Founder and CTO, Obsidian Security
Co-founder and former CTO of Carbon Black, built the first EDR product;
Previously, NSA CNO and AI Lab
2000 20172010
Employment
Board Seats
1st Technical Advisor (Amicus Curiae) to US FISA
Court

3. @chicagoben | @obsidiansec
Today’s Goal?
To Force Reflection
(and hopefully offer a tip or two)

4. @chicagoben | @obsidiansec
State of Cyber

5. @chicagoben | @obsidiansec
Recent Headlines

6. @chicagoben | @obsidiansec
Data Breaches
2015
2016
2017
2014
2015
2016
2017
2014
2013
2012
2011
2010
2009
2008

7. @chicagoben | @obsidiansec
Leaky Clouds
Booz Allen
OneLogin
The RNC
Verizon
Accenture
Dow Jones
Viacom
Deloitte
Sweden
California

8. @chicagoben | @obsidiansec
Skills Gap +
Deploy-and-Decay +
= LACK OF CYBER SELF-ESTEEM
Huge Data (more than big)
Attacker Successes +
Many Challenges

9. @chicagoben | @obsidiansec
Adversaries & Motivations
Cybercriminals
• Broad-based and
targeted
• Financially
motivated
• Getting more
sophisticated
Hactivists
• Targeted and
destructive
• Unpredictable
motivations
• Generally less
sophisticated
Nation-States
• Targeted and
multi-stage
• Motivated by data
collection
• Highly sophisticated
with endless
resources
Insiders
• Targeted and
destructive
• Unpredictable
motivations
• Sophistication varies

10. @chicagoben | @obsidiansec
MSPs NOT IMMUNE

11. @chicagoben | @obsidiansec
“Cloud Age”

12. @chicagoben | @obsidiansec
Race to the Cloud
Lots of benefits of cloud adoption … we aren’t really here for that.

13. Enterprise Architectures are Complex
Sales
Force
SlackO365
AWS
Surface area is more dynamic with more entropy
HQ
Business
Applications
Databases
Active
Directory
Even with SaaS, YOU are responsible for Identity and Access Management (IAM).

14. @chicagoben | @obsidiansec
Information Security and the Cloud (Reality)
“IT is going from 0 to 100 in the cloud and leaving us in the dust”
- Fmr. CISO, Lending Club
“We’re blind to all these new SaaS accounts”
- Director, Cyber Intelligence, Top Athletics Brand
“We have 300 AWS accounts and no governance”
- Public Tech Company
“Hackers don’t break in, they login.”
- CISO, Cisco

15. @chicagoben | @obsidiansec
AWS Responsibilities?
Hackers want this!

16. @chicagoben | @obsidiansec
Azure Responsibilities?
Hackers want this!

17. @chicagoben | @obsidiansec
SaaS: “OF” versus “IN”
The SaaS provider handles all aspects
except for identity and access
management, client device controls,
and data accountability.
The customer, therefore, must
understand users, devices & all data
related to that service.

18. @chicagoben | @obsidiansec
?
Microsoft handles the underlying
infrastructure, including patching and
updating, and the accessibility of the
service.
You are responsible for what is emailed,
who accesses the email, and how they
access the email.

19. @chicagoben | @obsidiansec
SAAS Integrations
https://developer.salesforce.com/
https://developers.google.com/gsuite/
https://developer.microsoft.com/en-us/office
https://api.slack.com/
https://aws.amazon.com/documentation/
Some are really easy to build Apps and Ingest data.

20. @chicagoben | @obsidiansec
“Detection + 1”

21. @chicagoben | @obsidiansec
Beyond Traditional Detection
RISKS & THREATS
SUCCESS FOR MSSPs &
CUSTOMERS

22. @chicagoben | @obsidiansec
Risk

23. @chicagoben | @obsidiansec
Reduce Entropy, Reduce Risk

24. @chicagoben | @obsidiansec
Identity Creep
DORMANT ACCOUNTS
ORPHANED ACCOUNTS
MISMATCHED PERMISSIONS
238 days
181 days
87 days
79 days
22 days
17 days
9 days
8 days
…
20758 lines

25. @chicagoben | @obsidiansec
Right-Size Surface Area?
Visualize the surface area you could use
against the surface area you are using.

26. @chicagoben | @obsidiansec
Dormant Accounts?
Even if you cannot get
buy-in to reduce risk, cost
savings are huge!
At left, a relatively small
company (600 employees)
could save over $300k /
year by right-sizing 3
services!

27. @chicagoben | @obsidiansec
Is the Environment Healthy?
The absence of disease does not mean health.

28. @chicagoben | @obsidiansec
Customer Enablement

29. @chicagoben | @obsidiansec
Journey vs. Destination
Security teams put their energy where they have autonomy.
They get comfortable in a never-ending journey instead of
driving toward new destinations.

30. @chicagoben | @obsidiansec
Journey vs. Destination

31. @chicagoben | @obsidiansec
Visibility Drives Defenses
Focus human attention on
high risk, high value assets
No sense preparing for
fires that don’t exist or
protecting low value
assets.

32. @chicagoben | @obsidiansec
Tech Stack Empowers Both Sides
CUSTOMERS SERVICE PROVIDERS
Like the shade a tree
gives, a good tech stack
affords powerful general
protection to all
constituencies.

33. @chicagoben | @obsidiansec
Wrapping Up

34. @chicagoben | @obsidiansec
AWS Responsibilities?
Hackers want this!

35. @chicagoben | @obsidiansec
Cloud: Massive Opportunity for Unifying IT & Security
IT Security
Enablement Enablement
Provides Appropriate Tech Provides Appropriate Risk
CONNECTED?

36. @chicagoben | @obsidiansec
Tools provide logs. Can you centralize visibility & context?
Visibility Drives Defenses

37. @chicagoben | @obsidiansec
Countering Creep: Quick Provision Process
Then Now
Give me access
to Salesforce
Work ticket generated
IT staff reviews ticket
Manager sign-off
Needs info from
accounting
Weeks later, access granted
Manager
unavailable
Give me access
to Salesforce
Automated assessment,
manager alerted
Minutes later, access granted
Team

38. @chicagoben | @obsidiansec
Different Groups, Different Perspectives

39. @chicagoben | @obsidiansec
CliffsNotes
•Include cloud! (Office, Salesforce, AWS, etc)
•Fight risk! Shrink surface area.
•Drive a better baseline (raise the bar).
•Every detection is a teachable moment.
•Enable customers to utilize the tech they pay for.
•There’s a lot of value in tying together best-of-breed.

40. @chicagoben | @obsidiansec
Continuous Improvement

41. @chicagoben | @obsidiansec
Ask Yourself: “Am I…”
1. …providing recommended actions of how to cleanup, remediate, and improve?
2. …moving the fight upstream (hygiene, prevention, reducing risk, etc)?
3. …enabling my customers to utilize the tech?
4. …defending enough surface area?

42. Ben Johnson, CTO
ben@obsidiansecurity.com
@chicagoben | @obsidiansec
THANK YOU!