The velocity of innovation necessitates an agile approach to infrastructure management, which often leads to complexity and, consequently, vulnerabilities. Organizations are in a relentless race to identify and prioritize security gaps, but how can we effectively manage and mitigate these risks?

In this episode, Jay Mar-Tang, field CISO at Pentera, discusses how Pentara blends the efficiency of automation with insightful human judgment to addresses the gaps in traditional security processes while enhancing effectiveness and response times. Jay is joined by our panelists, Keith McCartney, vp, security and IT, DNAnexus, and Nick Espinosa, host of the nationally syndicated Deep Dive Radio Show.

Got feedback? Join the conversation on LinkedIn.

Huge thanks to our sponsor, Pentera

Full Transcript

[Voiceover] Connecting security solutions with security leaders. Security You Should Know starts now.

[Rich Stroffolino] Welcome to Security You Should Know. Today, we’re going to be talking about Pentera and what they’re doing in continuous security validation. The problem they’re addressing, it’s a classic one, is how do you prioritize security gaps? And helping us get answers to these questions are Keith McCartney, VP Security and IT at DNAnexus, and Nick Espinosa, host of the nationally syndicated Deep Dive Radio Show.

So, Keith, I’m going to start with you. Why are we still having problems prioritizing these security gaps?

[Keith McCartney] Well, with the pace of innovation that we’ve got, velocity is critical, and that means that you’re going to have a more agile approach to how we manage our infrastructure, and it’s going to result in complexity and, you guessed it, vulnerabilities.

[Rich Stroffolino] All right, and Nick, I’m going to throw the same thing to you. Why is this still a problem?

[Nick Espinosa] Because nobody knows their risk. I mean, think about it. It’s a key point, right? We have huge surface areas for attacks. How many people know every DNS record that is out there for them? Our IP addresses are scanned multiple times a day, dozens of times a day, some for research, a lot for threat.

We don’t understand our risk footprint out there, and if we can’t quantify our risk, how can we understand the likelihood or the impact of what it is? And therefore, we need to constantly be vigilant.

[Rich Stroffolino] All right, well, getting some answers to these challenges, we’re going to be talking with Jay Mar-Tang from Pentera, and we’re going to start out with three questions. So, Jay, get ready here. To start out, how can I explain the value of Pentera’s solution to my CEO? What does your solution do and maybe what does it not do?

And what’s the pricing model? So, Jay, can you give us these preliminaries?

[Jay Mar-Tang] Pentera is the answer to the question of, are we ready for an attack like ransomware in our environment? Which could be extremely damaging to businesses, as we know, or at worst, cost lives. The Pentera platform enhances and augments adversary emulation testing traditionally done by external penetration testers and manual internal red teams through the use of automation.

And this automation will enable businesses to better identify and mitigate risk by focusing on exploitable pathways, as well as augment, scale, and increase the efficiency of existing security teams without the need of hiring more people. The platform’s main focus is understanding lateral movement, privilege escalation, and objectives such as ransomware susceptibility.

Pentera is not a static application security testing or dynamic application security testing solution focused on the application lifecycle. Pricing is straightforward. All we need to do is know the amount of internal target you have, the size of your external attack surface, as well as your cloud workloads.

[Rich Stroffolino] Okay, CISOs, you’ve gotten a taste for the solution. I’m sure though, you have a ton of questions. So, Nick, I’m going to start out with you. What other questions do you have about Pentera?

[Nick Espinosa] Yeah, yeah. I’d be generally curious to know, especially when we’re talking about automated testing, AI, all that kind of stuff, how do you, Pentera, balance the benefits of automated testing with the need for things like human intuition, ethical judgment, especially when you’re deciding what scenarios to simulate inside or outside of an environment?

[Jay Mar-Tang] Yeah, it’s a great question. So, there naturally has to be some guardrails to a solution. You don’t want it to just run rampant. And you could think of that as just determining the scope. So, if you want to hit 500 assets over here and your critical assets in this network, you just define that scope, and Pentera will keep that within the lens and boundaries of what you’re testing.

The other thing is that you need to make sure that when you’re running automation and you’re exploiting, that exploits are built safe. And what that means is that you’re not grabbing things from Malware Bazaar or random POC exploits. We have a research team whose primary job is to build those exploits, reverse engineer, and re-engineer them.

So, when you have those guardrails, you’re in control, and things like identity checking can be automated, but you are in control ultimately if you want to test certain exploits or not test certain exploits.

[Rich Stroffolino] All right, Keith, I’m going to throw to you. What questions do you have for Pentera?

[Keith McCartney] I really wanted to dig into vulnerability prioritization. How do you understand our environments to be able to make that work effectively and give us valuable information?

[Jay Mar-Tang] Yeah, it goes back to the previous question, actually. So, there needs to be naturally some understanding of business and business context, which we do when we work with you as partners, and you can also incorporate things like critical assets inside the tool. So, that helps with prioritization.

But when we talk about general vulnerabilities, whether they’re point vulnerabilities or what I like to call environmental vulnerabilities, misconfigurations, the prioritization takes into consideration the true exploitable pathway, as I mentioned before, and what that means is the intrusion kill chain, right, the steps of the attack, and what’s the first step in the attack.

And if you can prioritize it as such, you can cut the head off the snake, so to speak, and stop things earlier in the kill chain, therefore prioritizing and focusing your efforts.

[Nick Espinosa] Yeah, so that kind of actually just leads me to a question here because, I mean, obviously, there are plenty of companies out there that have a lot of sensitive and private data, and now we’re dropping in, obviously, a third-party tool, Pentera, to get to work to find those vulnerabilities.

But how are you as an organization balancing the need for in-depth testing with things like transparent communication about how data is accessed, stored, protected, to basically ensure that your clients can trust you as your systems are going through cataloging all these kinds of things? How are you ensuring their privacy?

[Jay Mar-Tang] It’s a great question. And for this reason, we actually have built the software to be on-prem. So, in that case, right, the data doesn’t leave your premises, it stays with you. Now, this can be either through software that you virtualize, it could exist, for example, in your own private cloud, so you can deploy it up in Azure or AWS, but that information doesn’t go back anywhere.

There’s no remote access or anything like that, unless, of course, you give it to us, and you want to work with us as partners.

[Keith McCartney] One of the things I noticed is that you have a lot of feedback loops into security teams, whether that’s into the SOC or whether that’s some type of penetration testing. What’s your strategy with that? How do you see your tool and technology making security teams and the individuals on those teams better?

[Jay Mar-Tang] Yeah, it’s all about scale and augmenting. So, if we’re running 5 tests today, for example, we want to be running 10 with the automation, both from the offensive security team as well as the defensive security team. And that purple teaming meld of red and blue teams together is where we want to enable all of our customers to be.

And a lot of customers today still are struggling to get that program off the ground, either due to not having the expertise, or if they have the expertise, it’s just too much for their security testers, the ones actually running adversary emulation, to do on their own. So, by using the automation as a power tool in the tool belt, you can get much more done.

Think about before you had tools, how long would it take you to build a house? Now with the amount of tools that we have, construction is much more streamlined. It’s the same thing. And I truly believe we’re going to be going in that direction when we talk about purple teaming and proactive security in the mindset of exposure management moving forward into the next few years.

[Nick Espinosa] Well, and in that vein, I took a look at your website, and one of the things that you talk about there is security validation. So, how are you, Pentera, basically defining and measuring security in a more holistic sense? Like beyond just the technical defenses and compliance requirements, as a holistic approach to security, how are you augmenting that?

How are you completing that? What is your stance on that?

[Jay Mar-Tang] Yeah, our stance is that security can and should be measurable, not based on, “Oh, we haven’t been breached; therefore, we’re doing a good job.” What we want to do is understand what that layered approach is, and every organization has a different approach to that. But there’s some standards that are built around identity, network segmentation, data security and encryption, things like that.

And what we do is, by understanding and working with our customers, when we try and get to crown jewels, for example, and we know that there are four layers of defense, five layers of defense or whichever, if we can’t get through those, or we can’t get through the first layer, great, checkbox. We know that tool’s working or that control’s working effectively.

Then we can peel that back and get to layer two. Can Pentera get through that? Yes or no? Peel that back. So, we essentially have the layers of the onion, and we just peel them back with our testing, and this is where continuous security validation becomes a program. It’s not something you do once or twice a year.

This is something that can and should be ongoing for that very reason.

[Keith McCartney] Do you think there’s any prerequisites that an organization needs to have in place before they leverage this continuous validation approach?

[Jay Mar-Tang] That’s a good question. I think the prerequisites, we need to have an understanding of exactly what is critical to the business. And I say that because I’ve worked with enough organizations in the duration of my career that had somewhat of an idea, but didn’t maybe consider the critical path or the critical chain, meaning the web of infrastructure that touches these critical assets that’s critical to the business.

Or for example, not taking into consideration the risk that is introduced by third parties, or other systems that interact with our business, should also be considered as part of criticality. And I think that, if I were to work with any organization, I would say we really need to have a good understanding and challenge them to say, “But is this truly it?

Is this truly everything?” And if so, then we can start the program.

[Nick Espinosa] Well, and speaking of programs, I mean, I think that opens up a question of essentially cybersecurity culture, right? So, in your view, how does the widespread adoption of automated security validation tools like Pentera shape cybersecurity culture just at large? What are the potential unintended consequences for how organizations approach risk management if it’s automated purely?

I mean, what is your position on that?

[Jay Mar-Tang] So, you’re asking about specific negatives that may come from the automation?

[Nick Espinosa] Yeah, so unintended consequences of having everything automated could be, let’s say, a lack of visibility by a cybersecurity team, or a cybersecurity culture could be that which we are training our employees on, but is now being handled in an automated manner. Now, obviously, your platform is not necessarily training employees on things, but it would dovetail with, let’s say, awareness training in the sense that, well, we have all of these tools and mechanisms in place to ensure your safety such as Pentera, etc.

So, from a holistic picture in terms of how we foster the cybersecurity culture, where basically do you fit in? Would there be something that could be potentially negative or positive in that vein as well?

[Jay Mar-Tang] I think it’s mainly positive in the fact that, once again, we’re helping to scale out and be more comprehensive when it comes to the program because we’re adding capacity. However, to answer your question around negatives as you were describing this, I said, well, where there could be a pitfall would be complacency.

And I think that is the pitfall of any security program where we say, “This is good enough.” Hey, we started automating. We’re way better than we were before, so I think we’re okay. We can take our foot off the gas, or we can not be as vigilant. And that’s where I think as security professionals, we always get tripped up because as soon as we start to get complacent or we start to not be as diligent, that’s where a gap is misguided or not seen.

And just because we can be comprehensive and scale out, we still have to aim the tool, for example, right? The tool will go, but we still need to have an understanding of the business, which is precisely why automation will never replace people. Business decisions need to come from people, and those conversations always need to be had.

[Keith McCartney] Does Pentera bring any humans, any staff members into the solution, or is it entirely machine and automation driven?

[Jay Mar-Tang] It’s machine and automation driven, but like I mentioned, those business contacts, understanding like, I don’t know, I can put in different IP addresses or different scopes of the network, but the humans need to understand this area is more critical than that area and here’s why. And that type of interaction is where when you partner with us, you start working with our ex-red teamers to build out these strategies.

So, it’s almost like I can have a self-driving car, but I still want to tell it where to go. Right? I can’t just get in and just expect it to read my mind. I need to say, yeah, I need to go to the grocery store. I need to go to the gym in my case, [Laughter] right? Because that’s where my priorities lie, eating and training.

[Laughter]

[Nick Espinosa] I hear you. I want to talk, and I know I’ve been getting a little philosophical on you, but you’ve got some really good answers here. So, I’m just genuinely curious. I think one of the things that we could all agree on is that what we are living in right now society-wide is a low trust environment in the sense that we, meaning the general public, see data breaches left and right.

This company’s getting hacked, a million records stolen, a billion records stolen, what’s the dark web, etc., etc. And so, by virtue of that, Pentera in and of itself as a forward-thinking company, you are essentially dropping in AI-automated tools and different platforms to safeguard essentially the digital existence of a company, of organizations, of humans by virtue of that, by ensuring that everything is essentially up to code.

And so, as a company, are you looking at this as like a guardian of societal trust situation in terms of your AI? Or is this more of a disruption, if you will, of just like malicious events? Looking at it philosophically, what do you see in the future in terms of ensuring that trust for humanity?

[Jay Mar-Tang] Yeah, I think you’re completely right. We’re bombarded with breach after breach after breach after breach. Is our data secure? And I think as a society, we’re getting a little numb to that. And we were founded on the premise that all organizations can benefit from looking at their network through the lens of the attacker.

And they can, and they should. And that’s why we champion, and we fly the flag wherever we can go, not only of automation, but why thinking like the attacker is very valuable. Because these breaches continue to happen. We need to take a different approach. The only way to stop something is to identify before it happens, and I think if you ask anybody working here, that is what drives our passion is to enable our customers to do it before it happens.

Because it affects you and me, right? I can’t check into a hotel, or my health records are there now and exposed. Nobody wants that. Nobody benefits from that. But if we can stop it ahead of time, my gosh, I mean, I think it would just solve so many problems in a perfect world, right?

[Rich Stroffolino] Yeah. Hi, Jay, I got to jump in here. What’s one thing that we didn’t ask about that we need to know about Pentera?

[Jay Mar-Tang] I think the thing that we all need to realize is that this is actually easier than you expect to roll out and even to try. And most of our customers are surprised at the value that they see or even the things that they find, both from a risk exposure perspective, as well as a control validation perspective, in a short amount of time and in a short exercise.

And that’s how we like to show our customers exactly what we can do. We come in, we work with you, and coming out of that engagement, you have a great understanding of where the organization stands for better or for worse, and it’s the first step in a long step. So, I challenge everybody to think about what this means for them and bring us in.

We’d love to show you what we can do.

[Rich Stroffolino] That’s it for this episode of Security You Should Know. To learn more, head on over to Pentera.io. Thanks to Janet Heins and Nick Espinosa for helping us learn more about this solution with their fantastic questions, and thanks to Jay Mar-Tang and Pentera for their time and being game to answer them.

Thank you for listening to Security You Should Know.

[Voiceover] That wraps up another episode of Security You Should Know. If you like this program, please subscribe, tell your friends, and leave us a review. All companies showcased on this program are sponsors of CISO Series. If your company would like to be spotlighted and interviewed by our security leaders, go to our contact page on CISOseries.com or just email us at info@ciso-dev.davidspark.dcgws.com.

Thank you for listening to Security You Should Know, connecting security solutions with security leaders.