With the growing move towards a hybrid and remote work environment, more and more people are relying on their smart devices to get work done. Keeping track of all of these devices, and ensuring that they are being used in a very secure manner, can be a challenging proposition. A recent survey finds organizations unprepared and overwhelmed with managing thousands or hundreds of thousands of these endpoint devices. Mike McNeill, CEO, Fleet Device Management, sheds light on some of these critical security issues and addresses questions such as: How does an organization manage its devices? Do they know if their devices are compliant and secure? Do they have ways to query them to learn more about their status in real-time? Mike also offers recommendations on how to prepare for the future of device management.

Time Stamps

01:28 -- Share with the listeners some highlights of your professional journey.

02:11 -- Let's talk about the motivation for the study.

03:54 -- The study is fairly recent; it was started on February 25, 2022. It was conducted online via Pollfish using organic sampling. And when I look at the industry is represented. It's pretty comprehensive. You all didn't leave out any sector. Am I correct?

04:52 -- Were you surprised by the survey findings relating to the state of device management?

06:48 -- Talking about managing the devices and keeping track of the devices, I read here that only a quarter of the sample population said that their devices are fully enrolled and upgraded. You know, that's worrisome. Why do you think organizations would allow that to happen?

07:54 -- So, if I'm understanding you correctly, the use of multiple operating systems and multiple platforms is part of the problem when it comes to tracking the devices, right?

08:33 -- Another finding that got my attention is that one of the best practices is to have a good Bring-Your-Own-Device (BYOD) policy. And to be more specific, 32% said, having a documented BYOD policy is a crucial best practice for their MDM (mobile device management) strategy. Can you expand on this?

09:57 -- BYOD, Bring Your Own devices, as an approach has its pros and cons. It was interesting to read that 32% of the respondents felt that having a documented BYOD policy is a crucial best practice for their MDM strategy. What are your thoughts?

11:49-- Another best practice documented here is measuring point-in-time compliance across all devices. Share with the listeners what you mean by point-in-time compliance or real-time compliance across devices.

13:56 -- How feasible is it to try and automate the patching process and thereby remove the responsibility (of patching) from the users?

17:51 -- Another finding that I find interesting is that multi-factor authentication becoming a top priority for 2022. The reason I find it interesting is I would assume that by now, multi-factor authentication would be a standard. I wonder why the delay in the adoption of a security mechanism that is universally accepted to be a very robust protective measure. What are your thoughts?

19:35 -- What were some unanticipated or unexpected findings?

20:59 -- I think the extent to which security and IT teams can work together and appreciate the significance of each other's work would make the development and implementation process more effective and efficient. What do you think?

23:12 -- What would you say to organizations interested in improving device management? How should they prepare themselves?

25:46 -- Going back to the report, where you're talking about preparing for the future of device management, you have several recommendations, one of which is to start managing containers. Can you expand on that?

28:21 -- Another recommendation in this report is to protect remote workers with zero trust, TLS, and multi-factor authentication. I'd like you to expand on this TLS when you suggest " move away from VPNs to granular proxies with TLS." Can you explain this?

30:38 -- Share some final thoughts with the listeners.

Memorable Mike McNeill Quotes

For endpoint security and risk management overall, you are starting to see more security engineers and security operations roles live in the IT department, and you're starting to see more IT engineering roles effectively taking on security challenges. And I think there's an argument to be made that in a couple of years, we're gonna see blended IT and security departments. So they will not be all that distinct anymore, other than the risk management aspect and crunching the numbers.

I think your success then comes down to, can we take inventory of what we have, and look at this from first principles, like, what are we trying to achieve here? We have a security posture we want to get to, we need to have an accurate inventory, and we need to make sure that we're collecting the right data that we can empower our security team with to like go run and build what they need themselves without having to go ask IT for more and more data every time.

If you are pocketed in and are part of a big organization, look for ways to find portable formats and solutions that don't lock you into a particular future, and that can work for other people in your company, even if they do have to use a different set of tools.

Connect with Host Dr. Dave Chatterjee and Subscribe to the Podcast

Please subscribe to the podcast, so you don't miss any new episodes! And please leave the show a rating if you like what you hear. New episodes release every two weeks.

Connect with Dr. Chatterjee on these platforms:

LinkedIn: https://www.linkedin.com/in/dchatte/

Website: https://dchatte.com/

Cybersecurity Readiness Book: https://www.amazon.com/Cybersecurity-Readiness-Holistic-High-Performance-Approach/dp/1071837338

Welcome to the Cybersecurity Readiness Podcast

Series with Dr. Dave Chatterjee. Dr. Chatterjee is the author of

the book Cybersecurity Readiness: A Holistic and

High-Performance Approach, a SAGE publication. He has been

studying cybersecurity for over a decade, authored and edited

scholarly papers, delivered talks, conducted webinars and

workshops, consulted with companies and served on a

cybersecurity SWAT team with Chief Information Security

Officers. Dr. Chatterjee is Associate Professor of

Management Information Systems at the Terry College of

Business, the University of Georgia. As a Duke University

Visiting Scholar, Dr. Chatterjee has taught in the Master of

Engineering in Cybersecurity program at the Pratt School of

Engineering.

Hello, everyone, I'm delighted to

welcome you to this episode of the Cybersecurity Readiness

Podcast series. Our discussion today will revolve around the

current state and future of endpoint security management.

I'm thrilled to have Mike McNeil, CEO and cofounder, Fleet

Device Management, as my guest today. And Mike will share his

thoughts and perspectives, and also some very interesting

findings from a study that his organization has conducted. So

Mike, welcome.

Thanks for having me, Dave.

Hey, before we get into the details of the

discussion, the study, let's talk about yourself a little bit

share with the listeners some highlights of your professional

journey.

Oh, yeah, so I got into Open Source, in 2011-2012

or so, did a bunch of different packages over the course of of

my time in Open Source, but I built a framework called

Sails.js for the Node.js community. And then more

recently, I've teamed up with Zack Wasserman from the Osquery

project on his app called Fleet, which is a open source platform

for collecting data from the devices and servers that you

manage.

Okay, fantastic. So as I was reading

the report on the state of device management, I found some

of the findings to be quite concerning. But I'm not

surprised. With the growing move towards a hybrid and remote work

environment, you expect that more and more people will rely

on their smart devices to get work done. Keeping track of all

of these devices, and ensuring that they are being used in a

very secure manner, can be a challenging proposition. So

there are a lot of challenges that we're going to be talking

about today. But let's first talk about the motivation for

the study.

Yeah, so we in the in the Fleet, the company,

right, because we're a company that built built around an open

source project and community, we wanted to understand how is the

problem of device management shaping up, right, because it's

getting more and more complicated. You got all these

different cloud accounts with your AWS servers and your GCP

servers, which is Google Cloud Platform, and Azure, from

Microsoft, and many other providers. Plus, you might even

have some stuff on-prem (on-premise), you've got mobile

devices, right, and maybe they are corporate issued or company

issued, maybe they're your own personal device. And the same

thing can be happening with with laptops. And so in the

transition that was going on, a big problem that we saw was

people would end up with like a lot of different device

management platforms. And we wanted to understand like, what

is the actual underlying goals here? And how effective are

people in this increasingly complicated environment at

achieving this device management goals?

Excellent. And you all spoke, or you all

sampled 205 members of professional security teams who

are directly responsible for device management. The study is

fairly recent, it was started on February 25 2022. It was

conducted online via Pollfish using organic sampling. And when

I look at the industries represented, it's pretty

comprehensive. Y'all didn't leave out any sector. Am I

correct?

That's right. Yeah, we tried to go as broad as

we could, so that we could get, there's a lot of fish farms,

right? Have IoT devices like there's it's a much more

complicated regulatory environment. But there's also a

lot of medical devices out there. And we were mostly

focused on kind of the the corporate devices and the

production devices like servers, or virtual servers or

containers. But we did we did factor in some of the IoT stuff

as well.

Good to know. Good to know. So let's get

to some of the insights from the study. Let's begin at a high

level by discussing the overall state of device management. Your

survey finds that organizations are struggling to manage a large

number of endpoints. A quarter of the respondents report having

to manage 250,000 devices or more. And another quarter of

respondents are in organizations with over 10,000 workstations.

The respondents also said that devices in their organizations

are at various stages of enrollment, and upgrade. While

some organizations report having enrolled nearly all devices in

their MDM with the latest operating system, there are

others, where not even a quarter of the devices are enrolled and

upgraded. This means many organizations don't know which

devices are at risk. And that is very concerning. Does this

finding surprise you?

Yes and no, right? Because qualitatively, we've

been hearing for a long time, just from the contributors to

the project that we have so many different tools on the security

side. And on the IT side, we have maybe a platform that

manages our Macs and a different platform that manages our

windows, we knew there were some complications there. But it was

it was pretty surprising just how much how varied the the

issues were. It's not like people were the only thing wrong

is, Hey, I can't collect my security data, right, from my

devices. It's like, people are having issues across the board

in effectively managing their computers. And that's true in

every industry.

Interesting, talking about managing the

devices, keeping track of the devices, I read here that only a

quarter of the sample population said that their devices are

fully enrolled and upgraded. You know, that's worrisome, why do

you think organizations would allow that to happen?

So the organization's wake up, You know, it's not like they

wake up in the morning, and it's, they look around, and

they, they have this problem? And and they got here overnight,

right? It's, it's, I think that you have, you always have even

at a small company, maybe a few devices that are on, you know,

Linux, Ubuntu laptops, or maybe you're mostly a Mac shop, and

you have a couple of Windows PCs, maybe you have most of your

infrastructure in AWS, but there's just one or two Google

Cloud accounts. And I think what does happen is they start making

exceptions, and then they look 12 months later, and it's sort

of ballooned out of control, the problem. And then they started

having to say, alright, we're gonna have to really invest some

serious time and resources to figure out how to catch back up

for our compliance purposes, or our security posture.

So if I'm understanding you correctly, the use of multiple

operating systems, multiple platforms, that's part of the

problem, right, when it comes to tracking the devices?

Absolutely, that and then shadow IT. So on this

on the server side of the world, like you, maybe you have a large

organization, and you want to have an enterprise agreement

that says like, all of our cloud usage from Acme Inc, is gonna go

to Microsoft, for example. But then there's some teams that end

up just kind of creating individual Google Cloud accounts

or individual AWS accounts, and those start to add up. And then

before you know it, you've got a bunch of mystery servers that

aren't tracked as part of your big strategy.

Interesting, you know, another finding that

got my attention, where the report states states, one of the

best practices is to have a good Bring Your Own Device Policy.

And to be more specific, 32% said, having a documented BYOD

policy is a crucial best practice for their MDM strategy.

And again, MDM stands for mobile device management. Can you

expand on this?

Yeah, I mean, so if you're familiar with with

Aristotle's concept of like, the golden mean, right, there's one

reality where you just say, hey, nobody can use their own device.

Or if you do, you're gonna have to, like enroll it, and all of

your text messages are gonna belong to us. And like, all of

your, all of your web browsing activity is going to belong to

us, et cetera, that makes it really hard. It's a hard pill

for employees to swallow. And then on the other side of the

coin, you have what happens at a lot of companies where they

started off and everybody kind of has their own laptop and

before you know it, you're 100 people, before you know it,

you're like 500 people, or maybe you know, this happened recently

with the supply chain issues. The Apple store in the US or in

other countries where you're going through resellers, can't

get you a laptop quickly enough. And so you're just having to

say, you know what, it's been five weeks like just just go get

one, Mike go anywhere you can. And then maybe that person

encrypts their hard disk using their personal iCloud password

and before you know it, you don't have access to the hard

Good to know BYOD. Bring Your Own

disk.

Devices as an approach has its pros and cons. It was

interesting to read that 32% of the respondents felt that having

a documented BYOD policy is a crucial best practice for their

MDM strategy. What are your thoughts?

So I think, especially when it comes to I'll

work, I'll work back from BYOD. With BYOD think there is it's

kind of like time off policies, right? You can tell everyone at

your company, here's the process, you go through to take

some time off, maybe you let your manager No, you put it in a

calendar of some kind, and, and then you're good, right. But

sometimes you get sick and or an emergency happens. And you have

to go around the process. And I think it's I think organizations

are realizing that they have to have a way to support that, and

then catch back up, while also still kind of having their best

practice standard process for getting devices enrolled. And I

think that's kind of true across the board with shadow it as

well. Folks are folks are realizing that people are going

to have cloud accounts. Sometimes when you need to get

something done, people just go get it done, right. And they

sign up for the account without going through procurement, or

they they go and go by their own. Maybe they go by their own

laptop, right outside of maybe the marketing team uses their

budget instead of using the it team's budget. I think it's kind

of having a dual strategy for like, what do we do in the

standard case? And then what do we do when there's an exception.

And as far as the platforms, I think we're seeing a lot more

convergence, people are spending a lot of time building custom

scripts trying to extract data from their MDM platform. And

then they're having to go redo that same work for their other

platforms, right or for their for the way they deploy things

to their servers. And it's just, it takes too much time.

Wow! Complicated. Moving on to

another best practice documented here, which talks about

measuring point-in-time compliance, across all devices.

Share with the listeners, what do you all mean by point-in-time

compliance, or real -time compliance across devices.

So the, I'll use an example from, let's say,

let's say you start a company, right, and you and you're like,

I'm going to go sell to, you know, I don't know Bloomberg,

right. And they look at your, your awesome product that you

have, it probably has a website where they log in and add some

servers that are powering that product. Well, one of the things

they're gonna want you to do, if you're hosting the product for

them is go through in the US, usually a SOC2 compliance. And

Europe, it's more easily ISO 27001 compliance. And that can

vary for different organizations and use cases. But those are the

most common. So a lot of companies find themselves

dealing with that first, really just to be able to sell

effectively. So that usually is a one time thing. And then

you're kind of good for you good for a while, right and good for

a year or two, there's a lot of different flavors that get you

different levels of compliance. But at a certain point, when you

get big enough, and these days, it's actually trickling down to

smaller and smaller organizations, you start to

actually have a need to make sure that your security posture

is kind of next level, right? Like you're getting, you're

getting real phishing attempts, like every single day, you're

actually getting compromises happening across your fleet. And

then that's where the point-in-time compliance becomes

bigger than just, you know, not only can I prove to the auditors

that on this particular day, I was either compliant or I

wasn't, which oftentimes, you know, the reality is that people

aren't right in the middle between these audits, there's

gaps, because there's always going to be exceptions. But

point-in-time compliance is also like a lot more valuable for the

fact that it doesn't have to be a compliance standard that's

general across the industry, it could just be that, hey, we

decided that nobody should have their one recovery kits sitting

on their desktop, you can enforce that, right? So why not

turn on an alert that goes off and lets that person know, so

they can like remediate the problem? Or get IT involved to

help them out.

Yep. In fact, vulnerability management

is the number one focus area. As I talk to subject matter experts

on this show, one particular expert emphasized that if he had

to select one area where a lot of attention needs to be paid,

and that is vulnerability management, making sure your

devices are all patched up. And so when I'm thinking about

enforcing that across the board, given the different types of

devices, the different operating systems, and then people using

their own devices, from a technical standpoint, Mike, how

feasible is it to try to automate the process and take

the action, the the action of updating, you know, patches away

from the user, and I will admit that I'm one of those people,

when I see an update, update alert, I don't right away, do

it. I'm lazy about it, but that is not a good practice. And so

how do you ensure that people like me,don't engage in that, if

I may.

Well, pretty, so it's, uh, I'd say there's two,

there's actually two pieces to this. There's the operating

system patching. Yeah, yeah, a lot more invasive, it's a total

takedown of your system, right. And that's where I think that's

where actually where companies want to start a lot of times,

because that's where you it's very easy to report on

generally. I mean, again, you might be pulling from multiple

different tools, if you don't have a cross-platform device

management solution. But you are being it's just one data point,

right? You can say like, what how many people are up to the

latest operating system for Mac, for Windows, and that there's

actually there's a tool called Nudge that his I'm actually

sometimes Dave can end up being just like you. One thing that's

consistently gotten me to update my OS, in a timely fashion is

Nudge popping up its window, it's open source, it's free,

it's by this guy, Eric Gomez, it pops up a window that you can't

close. And you'd have to explicitly tell it, do I want to

defer this later, for like, three hours or so or tomorrow,

and it only lets you do that, I think a handful of times,

whatever Apple has built in, you know, it talks about only

letting me do it a certain number of times, but for

whatever reason, it didn't work, but Nudge Nudge was how we

solved that problem at Fleet even just for our small team,

you know, 30 to 40 folks. On the other side, though, for for

patching software packages, way more complicated problem space.

And also because historically, you know, we were all in the

world of IT, people were hooked up to physical desktop computers

on a network, or companies that would send people off into the

wild would would have VPNs. And a lot of companies still do a

VPN. So a lot of the infrastructure was really built

around this idea of network scanners, where it sits on your

network, and it kind of sniffs out all the devices and whether

they have any vulnerabilities. But that's a lot less detailed

information you can get if you actually have an agent installed

on the computer, whether that's a server or a laptop. So that's

actually something we've we've dug into a lot with the fleet

project, is trying to understand what what can we add, we already

have an agent on the system, because we're with OSquery,

right? Monitoring, telemetry about the the actions, the usage

of the device, anything that might be suspicious. So if we

can use that to grab the software inventory, what we

learned, well, you know, could we automate this, right? And we

learned that a lot of companies are already consuming

vulnerability feeds. So they'll get the CVEs (Common

Vulnerabilities and Exposures), which are represent like a

vulnerability in a piece of software, come in, and they'll

have analysts that either with scripts or by hand, match up

those CVEs to actual software that's installed, whether that's

like a Chrome extension, or a package running on a server, or

an app like Figma. And that can definitely be automated. And

that's actually something we built into Fleet. It's one of

the free features of the product.

Okay, you know, another finding that I

find interesting is multifactor authentication becoming a top

priority for 2022. The reason I find it interesting is I would

assume that by now, multifactor authentication would be a

standard. So I get a sense that several of the folks who were

sampled in their organization, they were still moving in that

direction, they we're not quite there yet. And that's when

again, I wonder why the delay in adoption of a security mechanism

that is universally accepted to be a very robust protective

measure. What are your thoughts?

If you've ever played racquetball and you've

gone into the gym, and you look at the courts, and you see how

many of these people are wearing goggles, right? I'm not I'm not

wearing the goggles, right? I mean, and there's a I think a

lot of people just anytime when you ask them to do something

that isn't in their immediate right now interest, it can be

really hard to motivate people to do that, because we just

don't think that way as humans. So that's, I think the

psychology is a big factor. But on the other side vendors,

right, they've had to learn to love MFA. I think it's really

easy to deprioritize security features like this, especially

ones that involve extra UI, and you know, your product managers,

like ah customers are going to get have bad experiences getting

into the product. Like we don't want to do that. Right. And so

it is I think it was a hard thing to prioritize for a lot of

companies until they realize that it helps prevent account

sharing. And so I think, I think we've seen a lot more MFA take

off from the vendor side, as companies realize, hey, this is

a way we can actually make more money because we can get people

to prove that they are who they say they are, and therefore, you

know, it's not two people sharing the same account.

Okay, that's a good point. So what

were some of the things that you found in the report that got

your attention? I mean, I would like to call it say,

unanticipated or unexpected findings. What would that be?

Well, one thing we saw we actually did a report or

we did a separate we asked the same question right, but to IT

respondents, and it was interesting to see how the IT

and security respondents answered differently. Right? To

see on the security side, folks were far more interested in

like, enforcing that the configuration of the operating

system is secure and appropriate, versus on the IT

side, like a lot of the challenge, like, Yeah, that's

great. My security teams asking me to do that. But the

challenges were a lot more diverse. The IT side was a lot

more aware of how long it took to roll out an MDM. I think they

actually said it took three months longer on average than

the security respondents did, probably because the security

folks saw it three months in and in the process, and I think the

IT folks were more exposed to the actual nitty gritty of the

migration. And then the other thing was just how much more

aware that the IT side of the house was about the challenges

of enrollment and trying to hit your enrollment goals. And and

some of the pushback that the that the employees gave when

they're when they don't necessarily want their devices

to have to be under management or monitored.

You bring up this, this apparent

disconnect between the security team and the IT team, and a lot

has been written about it, and a lot will be. A fundamental

question that does always come to my mind is why don't

organizations get these people, these teams to work in tandem,

work together, so that can facilitate implementations? Like

when I'm reading this report, I see one of the challenges is

effective implementation of MDM tools and platforms. And though

this was not explicitly mentioned, as a potential

success factor, I'm going to put it out there that I think the

extent to which security and IT teams can work together and

appreciate the significance of what is being done that, would

speed up matters. What do you think?

I think anytime when you have different

organizations, departments, teams that have to have an

interface point, and this is true in software, too, right? If

you've ever worked with microservices, you know, what it

can be like. There starts to have to be a lot more things you

layer on right to be able to make sure that that interface

point is successful, maybe you have like an intake process so

that the IT team can take requests from security, because

they're getting asked things from a lot of different

stakeholders. And so I think it can be successful with a lot of

work. But it also is seeming like more and more that

security, you know, on the Appsec side, application

security, there's a shift left idea where security is actually

infiltrating into the actual software engineering

organization and making sure that it's like it's like a

DevOps stage, right? It's, and you could actually make the same

argument about design, right, and how as becoming a DevOps

stage for user interfaces, but for the other part is security

for kind of endpoint security and risk management overall,

it's starting to you start to see more security engineers and

security operations roles, live in the IT department, and you're

starting to see more IT engineering roles, effectively

taking on security challenges. And I think that there's an

argument to be made that in a couple of years, we're gonna see

blended IT in security departments. So they're not

going to be all that distinct anymore, other than the risk

management aspect and actually crunching the numbers.

That is very encouraging. I think that's

the first thing I've heard that makes me very optimistic. It

should have happened a long time back that, but now that you're

mentioning that, that things are moving in that direction about a

blended IT and security department, that sounds awesome.

Moving along those lines in terms of facilitating

compliance, facilitating implementation, based on your

experience, what makes a company better prepared in device

management? What are some factors, technical, managerial

that because you will appreciate or agree that there can be a lot

of tools out there, and let's say Tool A is highly popular,

highly effective, but it may not be effective for an organization

that's not ready for that tool, because there is that

people-process-technology alignment, that is very

important to make sure that you realize you get the most out of

these platforms and tools. So what what what would you say to

organizations who are interested to get better at device

Well, I'll say it depends, but I'll give you I'll

give you a better answer than that. But I would say the first

thing I would do is ask myself, how big are we right? How do we

currently do IT? Is it still part of the engineering

organization? Because if so, then then you know, you're going

to have this tendency if you bring on any security focus is

now going to be split between applications security and making

sure your code is safe, and actually looking at your own

internal needs. So I think I would look towards where your IT

is now. Like, how do your laptops get ordered? How do you

keep track of you know, if you're doing anything for like,

warranty expiration, or how do we recycle laptops, what's our

offboarding process look like? And whether that's, you know, a

wiki page somewhere or like a checklist and an issue or

something, I think jumping off from those human processes, and

management? How should they prepare themselves?

then saying, okay, who's going to own this? And what kind of

framework are they going to use to solve the entire problem? You

know, if you have a team of 30 people already in your security

department, well, it's going to be a lot more complicated for

you, because you've probably already bought a lot of

different tools. So I think your success really then comes down

to, can we take inventory of what we have, and really look at

this from first principles? Like, what are we really trying

to achieve? Here, we have a security posture we want to get

to, we need to have an accurate inventory. And we need to make

sure that we're collecting the right data that we can empower

our security team with to like go run and build what they need

themselves without having to go ask IT for more and more data

You know, you're spot on. And that's part

every time,

of, you know, comprehensive planning. Unless you know, what

you what you have that needs to be secured, you really can't

make progress. But then as we were discussing, the the way

companies are today, highly distributed with a lot of remote

operations, that can be a huge challenge is just to keep track

of who's using what and whether it's their personal device, or

it's an organizational device. So once again, going back to the

report, where you all talk about preparing for the future of

device management, and you have several recommendations, one of

which is "start managing containers." Can you expand on

Yeah, so today, you know, more and more

that?

companies are moving from, let's say, look, 20 years back, right,

like you would have a server in a closet somewhere, right, or in

a data center, then we moved to the cloud, and you have a

virtual pretend server that's living in in AWS, like somewhere

in their in their data centers. And then with containers, you

know, we're able to basically let anybody run their own cloud,

effectively, on a container host, whether it's Kubernetes

and using Docker, whatever it is, and I think a lot of people

assume that because my container image is secure, and because the

life of my container is short, the risk is relatively low. And

it is right compared to something that's running for

weeks and weeks, you know, what's the worst that's gonna

happen, somebody can compromise it for a few minutes. But there

are some sticky issues that can still come out of that. And as

the reality of what's possible changes, you know, attackers are

going to learn to make the most of what they got right to get,

get what they want. Exactly. And so if that means your script has

to run faster to do an attack than it will. So I think a lot

of companies are looking at moving to can we monitor each

container, maybe maybe we we don't install Osquery on every

container, although you can. And we've seen that maybe I install

it on the host, or maybe I'm using like cube query on the

container host to get more information about Kubernetes as

a whole, I think people are realizing the need to have that

telemetry. And just even just to see what's going on. The other

part of this is with, you know, we talked about shadow it

before, if you have 100 Google Cloud accounts, and you're a big

company, that is a nightmare to keep up with and figure out the

billing and just where they're all at. So the other nice side

effect of device management is not just security like, and

especially if we're defining a device as a container, as

abstract as that might be. We're giving you a way to see from

like a legal and billing and privacy perspective, like

where's our data flowing to? And what else do we have, and in

what accounts?

And then you know, another recommendation

that that is made in this report that "protect remote workers

with zero trust, TLS and multifactor authentication." I'd

like you to expand on this TLS, when when you all suggest that

move away from VPNs to granular proxies with TLS. Can you

explain this?

Yeah, I'll give you the real short version, as I

understand it, but I'll point you towards this guy, Richard

Steinan has a good book. Can't remember the name of it now. But

if you look him up on on LinkedIn, I'm sure his book is

there, where he goes, and he just interviews a bunch of IT

security leaders about like, Hey, how are you dealing with

this specific problem. And if I had to sum it up, it really

comes back to it's used to be in the office, or you used to be on

a network. And we have all this infrastructure we built up as a

community to support that use case, like if you the idea is if

you locked down that perimeter, you're just good. And then it

kind of lets us not worry as much about this is similar. If

you have a code repository, and you check in some secrets to it,

if you expect that the codes never going to be public. It's

like, well, worst thing is insider risk. Somebody takes the

token causes some trouble, whatever. It's not that big of a

risk. But I think a lot of people are reevaluating that

whole idea in general, and especially once remote work

became the unavoidable reality that we all lived with, you

know, in the last few years. It's, it's 2022. Right now for

context on 2020 everything changed and remote work had

already been a long time coming. So how this all ties together

with TLS is if I'm sitting in a Starbucks, right and I'm, I'm on

my computer and I log into an HTTP website, even if it's just

some little internal thing that no one thought would matter,

maybe they didn't want to deal with let's encrypt, and I type

in anything in plain text and send that in at a request over

the network. Anybody who's sitting there just by nature of

how Wi Fi or any of the link layer protocols work, like I can

see those bytes flowing through the air. And I can grab those

and I can borrow your plaintext password or your session ID for

as long as I want. But TLS prevents that, right? It gives

you a secure tube between your laptop and the place where

you're headed, that no one can intercept except maybe the

certificate authority.

Interesting. What does TLS stands for?

Its Transport Layer Security.

Okay, there you go. Transport Layer

Security. Fantastic. Let's start wrapping things up. It's been a

great conversation. Great insights. I'd like to give you

the opportunity to summarize things, share anything you'd

like with the listeners, before we call it today.

Yeah, I think I would just for anyone that's

that's struggling with device management out there, I think I

would encourage you to really look at what you're doing right

now from first principles. If you are pocketed and and part of

a big organization, look for ways to find portable formats

and solutions that don't lock you in, to a particular future,

and that can work for other people in your company, even if

they do have to use a different set of tools. And then lastly,

I'd say whether or not you're you know anything about device

management, or you're facing these problems, if you're

someone who is interested in contributing to open source,

Fleet is open source. And so is Osquery. We would love to

anything you'd like to add, if you read our docs, it's all

online on fleetdm.com. And you can hop on to GitHub and

contribute to everything from go back in source code to our React

frontend to Osquery, which is written in C++, even all the way

over to our company handbook, which is public and edits are

welcome.

Fantastic! Well, Mike, thanks again, for

your time and insights. It's been a pleasure.

Thanks Dave, it was fun!

A special thanks to Mike McNeil for his

time and insights. If you liked what you heard, please leave the

podcast a rating and share it with your network. Also,

subscribe to the show, so you don't miss any new episodes.

Thank you for listening, and I'll see you in the next

episode.

The information contained in this podcast is for

general guidance only. The discussants assume no

responsibility or liability for any errors or omissions in the

content of this podcast. The information contained in this

podcast is provided on an as-is basis with no guarantee of

completeness, accuracy, usefulness, or timeliness. The

opinions and recommendations expressed in this podcast are

those of the discussants and not of any organization.