Cyber Resilience Panel

Jessica Eisenberg:

Hey guys, we are back here at N2W for a very special post-panel commentary with Krista Case. So for those of you who missed it, we recently had a great panel discussion on the new face of cyber resiliency. So we'll put the link in the show notes, but we had various cloud influencer folks come from anywhere from the ransomware space. We had CISOs, we had ex-CISOs, we had defense experts. We had the guys on the resiliency side of things. So they all came together to understand why cybersecurity messaging has essentially rerouted to cyber resiliency and really what that means. So I am very happy to unpack all that. Krista, you might be the perfect person to weigh in on what we talked about. Krista leads the Cyber Resilience and Security Practice at theCUBE Research. It's part of SiliconANGLE. She works on research, she advises, she does industry analyses. She essentially helps business and tech leaders make sense of what's going on in a very rapidly evolving cyber world and, with all the evolving threats, how they can secure their systems. So, Krista, really, really great to have you.

Krista Case:

Jessica, thank you so much for having me. I'm thrilled to be sitting down with you today. And I have to say, I really loved the panel discussion. So looking forward to unpacking further some of these themes.

Jessica Eisenberg:

It was great. And what came out of it is this: the purpose is not to cause any panic, despite the fact that some of these threats are quite scary. But let's sort of get into the threat landscape because I think the idea is that we can do something about it no matter how dangerous these threats are. So let's say the elephant in the room, AI. So there's tons of AI-driven attacks. There's AI agents that are becoming insider threats. There's huge ransomware attacks targeting industries. There's hacktivism, very sophisticated social engineering. So, Krista, I'm very curious, what's your take? What would you say the biggest threat to enterprise systems is?

Krista Case:

There's a lot to be scared of, for sure. So, we recently conducted a number of in-depth interviews, and we found that companies are concerned about the adversarial point of view, so adversaries using AI to accelerate their speed and to kind of scale their attack techniques. But beyond that, organizations are actually mostly concerned with the pace at which their own organizations are adopting AI and the new risks that that creates. So, I think the biggest threat is actually complexity combined with privilege. And so what I mean by that is that we have these interconnected identities. We now have these AI agent identities in the mix alongside the humans and more traditional machines or NHIs. We have these very heterogeneous infrastructure environments of cloud and even SaaS applications. We have APIs and sensitive data. And so whether it be an external malicious actor or whether it be an internal AI agent that has gone rogue, even without being overtly malicious, they only have to find one path through that environment. And so that's what I would say really the biggest risk is today from my point of view.

Jessica Eisenberg:

The fact that you touched on the complexity aspect, because it's not just the fact that these agents can kind of self-evolve and figure out what's going on, but there's so much complexity with our systems right now. And security teams, they just simply can't get a handle on the governance aspect of everything. So kind of a follow-up question to that: there's all these changes going on, like you talked about these agents and these internal risks, and should we be doing something about it, about this AI sophistication? Is there something special we need to be doing, or is it more like this is another reason why we have to go back to the basics and we have to make sure that we're going to have to assume a breach at some point and work on that mitigation aspect?

Krista Case:

I'll give you a typical analyst answer, which is that I think it's a bit of both. I think certainly metaphorically eating our vegetables. Right. It is very important. So things like, okay, making sure that all of our patches are up to date, making sure that we do have the appropriate detection tools in place, for example, all remains important because if we stop a threat, it's just one less that we have to then remediate. But from where I sit, the conversation has shifted. The saying now is that it's not a matter of if, it's a matter of when. And so I do think that organizations have realized that even mature security programs are going to fail, especially in this AI era. You mentioned at the start of this conversation, we already had things like ransomware, these supply chain attacks that were breaching these mature security programs. So now it becomes a conversation of, especially as we have these adversarial AI attacks and we have these AI agents, when something inevitably does become compromised, do we have the ability to do things like control how far it can travel, control what it can change in sort of its blast radius? And then even most importantly, especially since we're sitting down to talk about resilience: how do I keep my critical business services up and running while I am investigating and remediating that incident? And that's really why we're covering resilience together with security here at theCUBE Research. And we hear even from practitioners that resilience has actually become a core item that's falling under security's wheelhouse these days because it has become this board-level mandate.

Jessica Eisenberg:

So that's sort of what I want to get into with you. First of all, let's kind of take a step back and say, what is cyber resiliency? What does that mean to you? What are the success factors there? And would you say it was a gradual switch from this idea of prevention to the core cyber resiliency tactics, or was it sort of a very recent phenomenon?

Krista Case:

They're great questions, Jessica. So when I think about cyber resiliency, to me it comes down to a handful of things. So one is understanding what that known good business state looks like, understanding what the critical business services are, and having a defined and proven plan to keep those critical operations up and running during an incident. So it goes beyond strictly backup and recovery, it goes beyond strictly recovering infrastructure, and really it has to do with understanding the full application context and again, really what the state of the business is. So again, that's primarily falling on, if you think about it as sort of a spectrum, it really falls on what I view as kind of the side of the spectrum of, again, recovery. Now that being said, you can make a case that there are certain resilience capabilities. So things like identifying malicious behavior in the environment to stop it more quickly certainly can factor in there as well. And then, in terms of the second part of the question about success factors. So historically we think about things like RPO, RTO, backup and recovery times. And again, I do think that those remain important, but I think the biggest critical success factor is really understanding the overall downtime of business services in the event that a breach happens. And I think that's the most critical success factor of a resilient strategy because that's what executives and the boards are concerned about at the end of the day.

Jessica Eisenberg:

It's interesting. You talk a lot about the leadership and the boardroom, and the panel also talked about this a lot. And this idea that there's this sort of overconfidence was the consensus. They think they know what the RTO is, but when you actually ask them, they actually don't know what it is. And they have this sort of old-school mentality that they'll go back to the IT team and they'll take care of it during a disaster. So, I guess my question for you is, what's the status? Do you think leadership is fully on board with how this messaging is changing? Do you think they're prepared, or do you think there's a lot of work to be done?

Krista Case:

Jessica, our research has also found that there is a degree of overconfidence, especially when it comes to building resilience against these agentic AI issues that we've been talking about. So I do think that there is a recognition amongst the board that there are some new issues here and some new challenges to address. But I do think that there is a feeling amongst the board that security and IT sort of have it covered to a degree. If I were in the role of a security or an IT practitioner, the conversation that I would be having with my board would be around risk. So for example, if we are going to roll out these particular AI initiatives into production based on our current environment, here are the new points of risk that we're introducing, and here is how we recommend remediating them. So because there is that degree of overconfidence, I think grounding things in some of these trade-offs and acceptable levels of risk is the appropriate way to have that conversation.

Jessica Eisenberg:

And I think the aspect of taking inventory too, because, like you said, you keep mentioning complexity and I think it just comes back to that. People don't even know what they need to protect, and the cloud being so elastic, it's perpetuating that problem. What's the reason behind sort of enterprises not going through the drills and being prepared and getting those siloed teams together, and what's behind that?

Krista Case:

I think there are some legacy mindsets here that are causing some of these issues, that need to really evolve and adapt. So when we think about the airline industry, I think aviation, my perception is that they treat failure as though it is inevitable and though it needs to be rehearsed. But when it comes to enterprise IT and security, I mean, a failure in the past could mean their job, right? Especially if it's something fairly catastrophic, right? So there is an inclination there to treat failure as exceptional, to not want to admit that it has happened or that it could happen. So I think probably the biggest thing here is really embracing this idea that it is unfortunately inevitable that there will be some point of failure, but that's okay. And really, if we plan for it and if we rehearse it, then we are prepared for it and we are better suited to operate through it. Certainly when you have a failure or a breach, that's the last time that you want to be trying to scramble and identify that there is something that you didn't rehearse or to identify that there is a breakdown in your technology stack. So I think really drilling this and including the executive leadership would be my biggest recommendations in addition to adapting that mindset.

Jessica Eisenberg:

And I think just in the past year, I think we saw so many unexpected events happen and we saw drone attacks and we saw regional outages and we saw a bad misconfiguration and we saw, you name it, every industry was hit with ransomware. And from your standpoint, would you say it's maybe the past year, two years that really leadership is understanding that?

Krista Case:

I do think it's a relatively recent shift. So just reflecting on conversations I've had, as well as key industry events and moments like the Black Hat conference or the RSAC conference, I think to your point, the ransomware breaches, for example, had made headlines. So even well before enterprises adopted AI, executives and boards were starting to pay attention and they were starting to ask their IT and security teams, okay, are we prepared for this? We cannot afford to be the next headline. Show me that we could withstand this, right? So there already was that mind shift starting to happen. But I think that these conversations are greatly accelerating even just over the last several months. For example, we saw the Hugging Face incident, where an OpenAI agent went rogue during testing and breached their systems, right? So as these things are making headlines, they're adding urgency to that conversation. And so I think the pace is accelerating, and I think it only will continue to do so moving forward, because AI is here to stay and these agents are given a job and they're going to find any way to get that job done. And so there's a recognition that we need to make sure that we have appropriate security controls, appropriate guardrails in place, as well as, as we were talking about a few minutes ago, Jessica, the resilience to be able to trace back what happened, to roll back as needed and recover in the event that something does go wrong.

Jessica Eisenberg:

So those are some great actionable items that IT teams can implement. But what would you say if you were to meet up with a team of backup and DR guys? Those are the firefighters. Those are the ones that are going to get the phone call at 3:00 AM. What would you say that they should be prioritizing now in terms of resilience?

Krista Case:

It's a great question, Jessica. And I actually would like to start my list by advising them to actually work with shared accountability here. So I think honestly, step one is to collaborate with the business to identify what are maybe three or five critical processes and have that direction be set by the business. And then from an IT perspective, they can do things like map the systems, the identities, the data, and other dependencies that are required to execute these business processes. So that would be kind of, I guess, step two. And then we can do things like establish the RPO, the RTO to make sure that that maps to the SLAs that the business requires, verify that they have things like immutable and clean recovery points. And then I do think that testing is a big piece of this. Time the testing, run a tabletop exercise around a particular scenario that they're especially concerned about and really try to throw some wrenches in that mix. You mentioned the cloud environment, so maybe assume that a cloud region has gone out. And I think following those steps, we can not only continue to move the ball down the field, metaphorically speaking, in terms of nurturing these conversations with the business, but also have that proven ability to recover these critical business services in the event that something does happen.

Jessica Eisenberg:

For sure. Here at N2W, we stress on a daily basis to our customers the importance of those drills. And I can honestly say that we have that feature in place and there's so many teams that are still not utilizing it. And it's a real shame because drills are something that you really have to lock into your muscle memory. A lot of people have different ideas of what a drill is. A drill is not just getting your data back. A drill is getting your permissions back. A drill is getting your network configurations back. But I think it was Ashu from AWS, he said your data without permissions is basically a pile of bricks. It's not a house. So, there's all these components of restore, and if you don't go through that process over and over and over again, what are you going to do in a disaster if you're not doing it in peacetime? So, the drills are a big part of what we do, and we can't really emphasize that enough. So, this is great advice, Krista, really. And I guess my final question for you is really, is there anything that we haven't covered that you think we should be covering, that we should really emphasize for both leadership and siloed teams?

Krista Case:

I think we've touched on a lot of critical items here. I guess if I were to take a step back, I would say certainly, as you're mentioning, the backup and recovery of data and systems remains incredibly fundamental. I would also advise practitioners to start thinking ahead in terms of recovering the application state, recovering especially the reasoning behind an AI agent or application, kind of why it took a certain action or why it made a decision that it did. So like we've been talking about, that does require bringing together the good basics of data and infrastructure recovery with things like having logging around things like actions and authorization, which certainly is going to factor in here. And then like we were just talking about, testing the recovery is going to be especially critical. This is a very volatile space, and I think we're only just beginning to see how enterprises are going to be using AI. So really being a partner to the business and being able to understand how the business is moving forward with AI and the actions that need to be taken to have resilience there, I think is going to be very critical.

Jessica Eisenberg:

For sure. And I just want to add, just as an asterisk, that it doesn't have to be expensive, because I know a lot of teams are also concerned about that. They don't want to restore every week all of their resources. This does get extremely expensive. There are replication tools that are extremely expensive. It doesn't have to be, and there are simulations you can do. Definitely, we help customers on a daily basis doing that. So, I just wanted to touch on that because that is a big concern as well. Okay, awesome. I think that's basically it. Krista, where can people find you? Where can they ask you questions?

Krista Case:

Sure. Thanks, Jessica. So you can find me, I'm active on LinkedIn. You can find me at a whole bunch of trade shows. As you mentioned, I handle the research and analysis through theCUBE Research. I'm also an active theCUBE host, so I'm around a whole bunch of trade shows. So you can certainly find me both in person and online at LinkedIn.

Jessica Eisenberg:

We'll put that in the show notes and definitely contact us. We're happy to chat about any cyber resiliency gaps that you have and how we can help. So once again, thank you, Krista. Always just a pleasure to talk to you, really. Thank you so much for coming on.

Krista Case:

It was my pleasure, Jessica. Thank you so much.