Cyberwire Network Host (0:02)

You're listening to the Cyberwire Network, powered by N2K.

ThreatLocker Advertiser (0:11)

Most environments trust far more than they should, and attackers know it. ThreatLocker solves that by enforcing default deny at the point of execution. With ThreatLocker allow listing, you stop unknown executables cold. With ring fencing, you control how trusted applications behave. And with ThreatLocker DAC defense against configurations, you get real assurance that your environment is free of misconfigurations and clear visibility into whether you meet compliance standards. ThreatLocker is the simplest way to enforce zero trust principles without the operational pain. It's powerful protection that gives CISOs real visibility, real control, and real peace of mind. ThreatLocker makes zero trust attainable even for small security teams. See why thousands of organizations choose ThreatLocker to minimize alert fatigue, stop ransomware at the source, and regain control over their environments. Schedule your demo@threatlocker.com N2K today.

Deepen Desai (1:20)

Hello, my name is deepin desai and I am the global ciso at zscaler. So growing up, I mean, I come from a family full of doctors. They're all in the field of medicine. So that, that was an area that intrigued me. But at the same time, I was very fascinated by computers and, you know, developing newer programs, software development. That, that was the, the area of interest for me when I was growing up. It was really interesting the way I ended up of cybersecurity. This is more than 20 years ago. I was introduced to an online game where there were folks literally cheating, right? Terms such as hacking, aimbots, a lot of the features that some of the gamers were using to take advantage, to gain advantage over the competition. And more than the game, the part that really intrigued me was how those cheating applications were working. What were they doing in the back end, right? So that's when I got exposed to Microsoft Windows APIs, things like DLL injection. How was the behavior of a legitimate process being modified to gain advantage? So that was my first exposure in that area. And then as I started getting more deeper into the field of software security, OS security, it's a thing that continues to evolve and there is never a dull day in the field of security, as most cybersecur experts would agree, Right at the master stage, all my coursework was focused on software fundamentals, OS fundamentals, and then with inclination towards cybersecurity. So I created a client that is able to detect any kind of DLL injection, any kind of attempt to modify that legitimate application behavior. So that was the first thing. Then I was able to get an internship At a startup that was building UTM appliances back in the day. And then the next opportunity from there onwards I got to build detection technologies. That was at Dell Sonicwall where I influenced some of the detection technologies on the cloud side, some on the next generation firewall that was introduced. And that really was very, very satisfying because now you're doing something that you love doing and it's having an influence in protecting thousands of organizations around the globe. The most recent stint, and this is eight years old, 2014 is when I joined Zscaler and the concept was very, very disruptive. I mean it was already a fire. We came up with this security cloud platform where the organizations around the world that were struggling to manage those appliances and point products, now we're offering that as a service. The entire security stack is in the cloud and that provided me and my team ability to perform some of the next generation detection technology changes. Honestly, it's a disruption in the field of cybersecurity where we're able to scale, where we are able to protect organizations globally. Even in the in the situation where pandemic hit, most organizations that were using the older technologies were struggling. Whereas if the organizations that were using what we have built, they were excelling and we continue to see more and more adoption as well. When I'm in the group of doctors, which is on the family side, I always call myself, hey, I am also a doctor. But in the field of treating digital viruses, just like you guys treat physical viruses targeting human body, we are the Internet doctors trying to make sure it's a safe place and protecting the organization. There are two important components when you're trying to groom a new security expert. So number one is you need to provide time to train and research. Especially in the field of security research, the way you need to structure their daily routine is 70% of their time may go towards what is needed for the business. Whether it's tracking certain malware family, tracking certain exploits, or developing those detections. 30 to 35% at least, that's the minimum you need to provide time to those folks to develop their skills, do research, learn about new techniques and continue to improve their ability to analyze those new evolving threats. So that's how I always have made sure my team was built and structured in a way that they are enabled to do that research activity and then that in a way also helps them contribute towards that 60 to 70% of the goal where they're trying to protect the customers. For the folks that are aspiring to get into the field of CyberSecurity, my number one recommendation is to have strong fundamentals on software development side as well. Understanding the technologies, whether it's operating system fundamentals or some of the programming languages. Those are some of the things that really helped me as I plunged into this completely different field. Because unless you know the fundamentals, you will struggle as you try to learn about how the threat actors are trying to abuse the existing technology. I'm really proud of two things and that's honestly the areas where I would love to be remembered as well. So number one is, you know there is a significant skill shortage when it comes to the field of cyber security. So every time when I hire someone the team that I build it brings me immense pleasure as I see them progress through their career, them developing newer skills, them picking up newer responsibilities. I still remember my first team that I built 15 years ago. Most of those guys are leading key technologies at many of the major security vendors and some of them are still with me. So that's one area where I would like to be remembered as a mentor that helped get them into the field and learn and allow them to pick up some of the newer stuff. The second piece is the detection technologies especially aimed towards the Zero Trust, the cloud based security where I had some exposure at my previous job. But at Zscaler I spin to the next level. So getting remembered for solving the problem of legacy security architecture and helping thousands of organizations, especially during the time of pandemic, to keep their users secure.