Source: www.lastwatchdog.com – Author: bacohido
KINGSTON, Wash. — U.S. Secretary of State Antony Blinken opened RSA Conference 2024 last week issuing a clarion call for the cybersecurity community to defend national security, nurture economic prosperity and reinforce democratic values.
Related: The power of everyman conversing with AI
Blinken
That’s a tall order. My big takeaway from RSAC 2024 is this: the advanced technology and best practices know-how needed to accomplish the high ideals Secretary Blinken laid out are readily at hand.
I was among some 40,000 conference attendees who trekked to in San Francisco’s Moscone Center to get a close look at a dazzling array of cybersecurity solutions representing the latest iterations of the hundreds of billions of dollars companies expended on cybersecurity technology over the past 20 years.
And now, over the next five years, hundreds of billions more will be poured into shedding the last vestiges of on-premises, reactive defenses and completing the journey to edge-focused, tightly integrated and highly adaptable cyber defenses directed at the cloud edge.
This paradigm shift is both daunting and essential; it must fully play out in order to adequately protect data and systemsin a post Covid 19, early GenAI and imminent quantum computing operating environment.
Simultaneous paradigm shifts
In his keynote address, Secretary Blinken alluded to several tectonic shifts happening simultaneously. Post Covid 19, work forces and supply chains have become highly distributed. This has resulted in the intensifying of companies’ reliance on cloud services delivered at via smartphones, web browsers and IoT devices. Innovation has blossomed, though, conversely, the network attack surface has expanded exponentially.
Add to this the wild card of GenAI/LLM. The democratization of machine learning and artificial intelligence – putting the ability to extract value from data into the hands of ordinary humans – has just started to revolutionize user experiences. And, of course, this has created new tiers of criminal hacking opportunities.
“Today’s revolutions in technology are at the heart of our competition with geopolitical rivals,” Blinken said. “They pose a real test to our security, and they also represent an engine of historic possibility for our economies, for our democracies, for our people, for our planet. Put another way security, stability, prosperity — they are no longer solely analog matters.”
Singh
Flying home from the conference, I reflected on an observation made by Cota Capital managing partner Aditya Singh who said this: “Rules-based security is over, context-based security is taking over.” Singh said this as he moderated a panel discussion featuring the founders of Simbian, Seraphic Security and Amplifier Security, three promising start-ups that are all about contextual defense.
See, categorize, control
It struck me that each of the security vendors I spoke with were caught up in the trend of prioritizing contextual security, as well. Each sought to dial-in the optimum dose of protection without sacrificing an iota of innovation. In a hyper-interconnected operating environment this can only be achieve by accounting for context.
I then wrote down two column headings – contextual data protection and contextual security services — and proceeded to place each of the security vendors I spoke with in one or the other column.
Adduri
If data is the new gold, then seeing, categorizing and controlling access to every speck of gold makes perfect sense. I had a wide-ranging discussion with Pranava Adduri, co-founder and CEO of Bedrock Security, about why quite the opposite has happened: many organizations have been amassing information indiscriminately, simply because they can. Bedrock is applying graph database know-how to helping companies get a handle on all of their data and make strategic decisions about governance and security policies.
At the end of the day, I’d classify all the innovation occurring in application security (AppSec) as being about this sort of contextual data management. This includes innovators in the DevSecOps tools space, like Qwiet.ai and NightVision and I’d also put into this group leading API security innovators, like Traceable, Data Thereom and Salt Security.
I spoke, as well, with Isaac Roybal, CMO of Seclore, supplier of an advanced of iteration of Enterprise Digital Rights Management (EDRM), which focuses on granular control of data access.
Chan
I’d even place hardware security innovators into the category of contextual data security tools. I had a great conversation with Camellia Chan, co-founder and CEO of Flexxon, which introduced its security-infused X-PHY server module at the conference; X-PHY protects data at the memory level, the last line of data defense.
Big security services role
The second grouping of vendors I met with at RSAC 2024 were more about a security services component. AT&T Cybersecurity made a splash announcing a recasting of its M4SP business under the name LevelBlue in partnership with WillJam Ventures. I also spoke with Open Systems and Ontinue, both offering their iterations of a managed security service tuned for the current operating environment.
Sinha
I visited with DigiCert CEO Amit Sinha and we spoke about DigiCert’s expanding portfolio of services which revolves around helping companies contextually manage their widening sprawl of PKI keys and digital certificates.
Benishti
My conversation with Ironscales co-founder and CEO Eyal Benishti followed a similar arch as he described how his company is delving into leveraging GenAI/LLM to help detect and deter email phishing attacks much more granularly. Meanwhile, Ahmed Abdelhalim, senior director of security solutions, A10 Networks, explained the latest advances in DDoS defenses.
Wilson
I also sat down with senior execs from Lacework to find out about their cloud-security platform and with Exabeam, supplier of a security operations platform. Be sure to give a listen to LW’s RSAC Fireside Chat podcast with Exabeam CPO Steve Wilson to hear the fascinating origination tale of the OWASP Top Ten for Large Language Model Applications. And one of the coolest conversations I had was with Rajiv Pimplaskar, CEO at Dispersive.io, about adapting WWII fuzzing tactics to mitigate deep fakes.
Fortuna
I also met with vendors in the vanguard of an all-new type of security service – enterprise browsers; advanced browser security features are now available imbedded in company issued browsers based the open-source Chromium browser operating systems, i.e. Google Chrome and Microsoft Edge. Innovators like Island.io, SquareX and Seraphic Security are taking different angles to solutions in the fast emerging space. And I really got into the weeds about the browser arising as a focal point of edge-defenses with Pedro Fortuna, co-founder and CTO of Jscrambler, one of the pioneers of JavaScript security, which is making at the heart of browser security.
Finally, I spoke to four niche security service providers: Hyas, which combines advanced threat intelligence and DNS security services; Anetac, a start-up offering technology to help companies more effectively lock down their service accounts (the accounts used behind the scenes that grant access to things like customer data bases, cloud storage lockers and shopping carts;) Simbian, which supplies contextual workflows for security tasks ranging from complex investigations to compliance measures; Amplified Security, which helps human employees take “self-healing” security actions; and VISO Trust, which is adding richer context to supply chain audits.
Kluzak
Every conversation I had at RSAC 2024 was fascinating and instructive; each vendor was immersed in developing advanced protections companies now need to stay viable in an environment of rapid change. Black and white rules are out. Flexible, nuanced security policies that can be automatically implemented, at scale, are in. This is even more so true as the GenAI/LLM revolution plays out; I had an awesome brain storming session with David Kluzak, CRO, of LogRhythm, about the scenarios likely to play out as companies scramble to internally leverage LLM — to drive up revenue — in the weeks and months ahead. We chatted over ice cream sundaes at the Thoma Bravo mixer at the SF MOMA.
You’ll hear more details about the vendors I’ve mentioned above as our popular Last Watchdog RSAC Fireside Chat podcast series, which commenced last week, continues. A few new episodes will go live each week, now through mid-June.
The pace of change is breathtaking. I’ll keep watch and keep reporting.
Acohido
Pulitzer Prize-winning business journalist Byron V. Acohido is dedicated to fostering public awareness about how to make the Internet as private and secure as it ought to be.
Original Post URL: https://www.lastwatchdog.com/my-take-rsac-2024s-big-takeaway-rules-based-security-is-out-contextual-security-is-taking-over/
Category & Tags: My Take,RSAC,Top Stories – My Take,RSAC,Top Stories
Views: 0
