Automation and AI in Cybersecurity: Enhancing Response Capabilities with Billy Gouveia

Podcast: Play in new window | Download (Duration: 14:05 — 19.4MB)

Subscribe: RSS

Summary

In this episode of #ChattinnCyber, Billy Gouveia, the CEO of Surefire, a prominent cybersecurity firm stops by to chat. Billy chats about quantifying the costs associated with data breaches. He shares what it was like growing up in Boston and becoming the CEO of a renowned cybersecurity company.

Billy acknowledges the significance of #cybersecurity in today’s world, stating that the work being done in the field will have a lasting impact on future generations. He highlights the exponential growth of the tech industry, which is enabled by cybersecurity, and emphasizes the importance of addressing issues such as IP theft and the normalization of cybercrime.

Billy explains that he recognized structural disincentives for current market participants to embrace technology in a different way. He wanted to reframe the role of incident response experts and leverage technology to provide better outcomes for clients. By automating workflows and utilizing technology effectively, Surefire aims to provide faster outcomes, reduce costs, and make clients’ lives better during cyber events. The conversation then delves into the role of automation and #artificialintelligence (AI) in incident response. Billy clarifies that while AI has a role to play in automation, the current focus is more on automation itself. He discusses the advancements in technology and tools for detection, containment, forensic investigations, and restoration.

Billy emphasizes the importance of talent in the field and how automation can streamline processes, allowing experts to focus on guiding clients through business decisions. Billy tells our listeners about cybersecurity controls that provide the best return on investment (ROI). He suggests starting with endpoint detection and response capability, along with multi-factor authentication (MFA) and backups. He explains that the prioritization of controls may vary depending on the nature of the business, such as protecting intellectual property or ensuring uptime.

The discussion then shifts to the challenges of MFA bypass techniques, where threat actors find ways to bypass or degrade MFA controls. Billy explains examples such as MFA fatigue and token theft, highlighting the need for multiple controls and a thoughtful approach to cybersecurity.

In conclusion, Billy reflects on the dynamic and challenging nature of the cybersecurity domain. He emphasizes the importance of seeking guidance from experts like Marsh McLennan Agency #MMA to navigate the complexities of cybersecurity.

Key Takeaways

1. The Significance of Cybersecurity: Billy Gouveia emphasizes that cybersecurity is among the defining issues of our time, with the work being done in the field expected to impact future generations. The tech industry, enabled by cybersecurity, is a trillion-dollar industry, but it also faces challenges such as IP theft and the normalization of cybercrime.
2. Reframing the Role of Incident Response: Surefire aims to reframe the role of incident response experts by leveraging technology and automation to provide better outcomes for clients. By automating workflows and utilizing tools effectively, they can provide faster responses, reduce costs, and improve clients’ experiences during cyber events.
3. Automation vs. Artificial Intelligence: While artificial intelligence (AI) has a role to play in automation, the current focus in incident response is more on automation itself. Automation can streamline processes and allow experts to focus on guiding clients through business decisions. AI’s role in incident response is expected to grow over time.
4. Prioritizing Cybersecurity Controls: When it comes to cybersecurity controls, Billy suggests starting with endpoint detection and response capability, multi-factor authentication (MFA), and backups. The prioritization of controls may vary depending on the nature of the business, such as protecting intellectual property or ensuring uptime.
5. Evolving Cybersecurity Challenges: Threat actors are constantly finding ways to bypass or degrade cybersecurity controls. MFA bypass techniques, such as MFA fatigue and token theft, pose challenges. It is crucial to have multiple controls in place and to stay vigilant in adapting to evolving cybersecurity threats.

Key Quotes

1. “In many ways, cyber is among the defining issues of our time… The stuff we work on now will affect our kids and our grandkids.”
2. “…if we have automation putting the puzzle together, then what our team can do is focus more on helping the client orient to the picture the puzzle creates, and then guiding our clients through a set of business decisions.”
3. “I’m hopeful AI can make the offense-defense matchup a lot more symmetric… Maybe AI can close that.”
4. “Having a response take three days in duration versus three weeks makes their lives better, reduces business interruption.”
5. “Four or five years of a hard insurance market has done more to improve security controls than 20 years of security professionals howling at black hat or RSA or any of the security conferences.”

About Our Guest