Gerald Bushelt (16:07)

Foreign.

Dave Bittner (16:12)

Do you know the status of your compliance controls right now? Like right now, we know that real time visibility is critical for security, but when it comes to our GRC programs, we rely on point in time checks. But get this, more than 8,000 companies like Atlassian and Quora have continuous visibility into their controls with Vanta. Here's the gist. Vanta brings automation to evidence collection across 30 frameworks like SoC2 and ISO 27001. They also centralize key workflows like policies, access reviews and reporting, and helps you get security questionnaires done five times faster with AI. Now that's a new way to GRC. Get $1,000 off Vanta when you go to vanta.com cyber that's vanta.com cyber for $1,000 off. Gerald Buchellt is Chief Information Security Officer at Acronis, and in today's sponsored Industry Voices segment we discuss how threat research and intelligence matter to MSPs.

Gerald Bushelt (17:34)

The Managed Service provider industry has really been at the forefront of rolling out technology for small and medium businesses and making it scalable and usable for those kind of businesses. If we think back like 20 or 30 years, it was typical that each company had their own small IT department, which typically consisted of a few administrators perhaps. And we're trying to really keep things together with the increasingly complex IT environment that we are seeing today. Whether it's laptop management, endpoint management or SaaS services, it's like public cloud usage, et cetera, et cetera. It's like these kinds of challenges become harder and harder and it becomes Prohibitively expensive for a small or even a medium sized business to operate those kind of technologies completely on their own. Which is why the managed service provider really came into play. It's like where it, the IT department as a service, if you want, started to really take shape over those last, I would say 25 years, give or take, and has been overall quite successful because it allows businesses to focus on their actually core mission objectives instead of having to invest fairly heavily into personnel and resources around technology enablement. And I think this trend is going to continue and actually going to accelerate over the next years and, and decades because at the end of the day it's like we are in a labor sharing environment. And I think these kind of technologies really make sense to be managed by professionals that focus on that instead of having everyone try to do their own thing. The scope of the managed service provider really started out obviously as in a fairly limited IT management fashion around basic corporate IT enablement, but has gone now really much deeper into all aspects of the corporate environment, including running back office systems, but also in an increasing way focusing on security. We have even specialized managed service providers, managed security service providers, which are focusing specifically on the security needs, compliance needs for companies. They're sometimes standalone entities, sometimes they're part of managed service providers and they're really. It's like looking at defining the overall requirements for companies security posture and then ultimately risk exposure to the world.

Dave Bittner (20:18)

Well, let's dig into threat research and threat intelligence specifically. I mean why do these matter to MSPs?

Gerald Bushelt (20:25)

It's, I mean at the end of the day it's like in order to set up any kind of sensible security program, you need to understand what you're actually dealing with. If you just do security based on compliance checklists or quote unquote by the numbers or what the book says, then you end up creating environments that are not necessarily addressing the actual threats that your customers are facing. You end up potentially overspending on certain types of controls that are really not necessary or can be dealt with in different ways. And you potentially underspend on absolutely critical controls that are not on your radar screen. So it's like understanding threat intelligence is really important at multiple levels. At the highest level it really is needed in order to be able to fully understand the risk and exposure of your customers, of your own business actually as well. And for that you really need to know your customers. But it's like understand that well in order to define the right kind of controls that you want to put in place. And then at a Lower level. It's like you want to rely on vendors such as Acronis to really leverage telemetry and advanced threat information that we can collect from our many workloads in order to be able to create an environment that is proactively locking down things and proactively preventing issues.

Dave Bittner (21:53)

One of the things that strikes me, and correct me if I'm mistaken here, is that things like antivirus and anti spam, you can deploy those in a very automated kind of way. But threat intelligence and threat research require more human intervention and more thoughtfulness and I suppose to that end, more effort. Is that an accurate perception?

Gerald Bushelt (22:19)

Yeah, I would say you can definitely see it this way. If you have a simple antivirus or anti malware agent on your laptop, you're obviously attempting to proactively prevent certain issues to happen. And you can do all kinds of fun things, signature based detection, you can do heuristics, you can integrate this with the overall network stack to see what type of systems your laptop is communicating with and based on that, perform certain automated action. But I think the true magic comes into play when you start to take this information and collect it at a central point in order to better understand what is actually going on in your environment and then potentially have even better and more comprehensive controls in place that do not necessarily only act on a single laptop, but on your entire environment. And that's where we really get into the EDR and ultimately XDR environment, where you can integrate the kind of telemetry that comes from your respective laptops into centralized environment, just like alert and monitor based on that, do research through a pretty much interactive kind of capability that allows you to execute certain types of tasks through the agent that you have on those endpoints and ultimately get a much better sense in terms of what's going on. And as such, like I said, it's like beyond much more proactive about locking down certain aspects of your infrastructure.

Dave Bittner (23:49)

It seems to me also that working with a third party provider such as you and your team, you get the benefit of all the other organizations that you all are looking at. Beyond my own moat around my organization, you all have view into things that I otherwise wouldn't have any window into very much.

Gerald Bushelt (24:10)

So yeah, it's like that's, I mean that is the strength that comes from working with an organization such as ours that does not only push out a product, but it's like really also invests back into leveraging the information that we're getting. And again, it's like, I think there's good kind of like approaches to do this on multiple levels. It's like both on improving the product itself, it's like improving the detection capability capabilities, improving our signatures beyond what is generally available through things like total virus or so, and then really go out with augmented and much more targeted things. We see a lot of what's happening in the MSP space because we do have a lot of customers and partners in that range. So it's like it allows us to really leverage those things better. And that's all at the tactical level, at the tactical implementation level. The kind of reports and the kind of like updates that we provide outside of that are really also very helpful for our MSP partners and the community at large to understand what's actually happening in that space. From a more conceptual perspective, what are.

Dave Bittner (25:26)

Your recommendations for an organization that wants to implement this, wants to make threat research and threat intelligence more a factor in their day to day operations. How would you recommend they proceed?

Gerald Bushelt (25:38)

So at the simplest levels it would be really just picking a vendor, that trusted vendor that implements this in their own products and has a proven track record of hopefully many years to really include advanced threat information from their own systems as well as from others and using that for protecting customers endpoints. But at the same time I would also always say it's like you do want to have a function in your security team that looks at this from a from a more 20,000 foot level perspective and really tries to understand it's like what the company is doing, what the customers of the company are doing, how this maps back to what's going on in the overall digital underground. Does this attract specific cybercriminals? Does this attract only script kiddies? Or do you perhaps even attract certain types of nation state adversaries? Which is is not super typical, but it does happen quite a bit as well. Based on that information, you really then want to review what it is that you're doing and as such then optimize your resources. If you're not dealing with nation state adversaries, then there are certain things that you may be able to get away with not doing with quite so much death versus if you are exposed to those kind of threats.

Dave Bittner (27:06)

That's Gerald Bushell, CISO at Acronis. Hey everybody, Dave here. Have you ever wondered where your personal information is lurking online? Like many of you, I was concerned about my data being sold by data brokers. So I decided to try DeleteMe. I have to say delete me is a game changer. Within days of signing up, they started removing my personal information from hundreds of data brokers. I finally have peace of mind knowing my data privacy is protected. Deleteme's team does all the work for you with detailed reports so you know exactly what's been done. Take control of your data and keep your private life private it by signing up for Delete Me now at a special discount for our listeners today. Get 20% off your delete me plan when you go to JoinDeleteMe.com N2K and use promo code N2K at checkout. The only way to get 20 off is to go to JoinDeleteMe.comN2K and enter code N2K at checkout. That's JoinDeleteMe.com N2k code N2K and finally, this year's Cyber First Girls competition in the UK has not only crowned its winners, but also inspired the next generation of cybersecurity professionals. In a record breaking year year, 14,500 girls across 4159 teams took on the challenge, showcasing brilliant problem solving, teamwork and determination at a ceremony at Jodrell Bank. Hillcrest School in Birmingham was named top scoring state newcomer while Henrietta Barnett School in North London took top scoring team with regional champions and special award winners also honored. The event coincided perfectly with International Women's Day, highlighting the industry's need for more female representation. Chris Ensor of the NCSC expressed gratitude to teachers, sponsors and participants emphasizing the importance of encouraging young women into cyber careers. With just 17% of cybersecurity roles filled by women, competitions like Cyber first are critical in closing the industry's skills gap and shaping a more diverse future. And that's the CyberWire. For links to all of today's stories, check out our daily briefing@thecyberwire.com we'd love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing world of cybersecurity. If you like our show, please share a rating and review in your favorite podcast app. Please also fill out the survey in the show notes or send an email to cyberwire2k.com N2K's senior producer is Alice Carruth. Our Cyberwire producer is Liz Stokes. We're mixed by Trey Hester with original music and so sound design by Elliot Peltzman. Our Executive producer is Jennifer Ivan. Peter Kilby is our publisher and I'm Dave Bittner. Thanks for listening. We'll see you back here tomorrow. And now a message from our sponsor Zscaler, the leader in Cloud Security enterprises have spent billions of dollars on firewalls and VPNs, yet breaches continue to rise by an 18% year over year increase in ransomware attacks and a $75 million record payout in 2024. These traditional security tools expand your attack surface with public facing IPs that are exploited by bad actors more easily than ever with AI tools, it's time to rethink your security Zscaler Zero Trust plus AI stops attackers by hiding your attack surface making apps and IPs invisible eliminating lateral movement Connecting users only to specific apps, not the entire network Continuously verifying every request based on identity and context Simplifying security management with AI powered automation and detecting threats using AI to analyze over 500 billion daily transactions. Hackers can't attack what they can't see. Protect your organization with Zscaler Zero Trust and AI. Learn more@Zscaler.com Security.