Risky Business #729 -- Why patching faster won't save us
Dec 5, 2023
auto_awesome
Ryan Kalember, Proofpoint’s EVP of Cybersecurity Strategy, discusses the Iran-linked attacks on US water infrastructure, the ownCloud bug, and the D-Link 0day controversy. The podcast also covers the importance of Okta, ransomware attacks on hospitals and credit unions, and the need for innovative network security approaches
Prompting user alerts for security has been effective in detecting unusual activities and improving data protection.
AI-driven interfaces can deepen user interactions for better incident responses and security measures.
Tessian acquisition highlights the importance of addressing misdirected emails for enhanced data security and product validation.
Deep dives
Using User Prompts for Security Alerts
Prompting users for security alerts has been effective, especially for detecting unusual activities like sharing large amounts of data or changing permissions. It can help prevent data exposure incidents and improve security posture.
Specific Use Cases
User prompts have been successful for scenarios like detecting unusual cloud file sharing activities, identifying public permissions on data, and flagging suspicious logins or remote management tools installation. These prompts can engage users in security actions and reduce the burden on analysts.
Effectiveness and Challenges
Prompting users with specific questions can provide valuable insights and actionable responses. This approach is effective for certain initial compromise scenarios but may face challenges in cases like legitimate remote management tool usage.
Integration of AI and LLMs
Leveraging large language models for interacting with users can enhance the depth of responses beyond binary options. These AI-driven interfaces can facilitate a more nuanced dialogue with users for improved security incident responses.
Tessian Acquisition and Misdirected Email Solution
The acquisition of Tessian highlights the importance of addressing misdirected emails, a critical data security concern. While Proofpoint had a version of the solution, acquiring Tessian accelerates implementation at scale and validates the product's effectiveness through extensive testing.