Artwork for podcast The Cybersecurity Readiness Podcast Series
Preparing for the Future of Device Management
Episode 313rd August 2022 • The Cybersecurity Readiness Podcast Series • Dr. Dave Chatterjee
00:00:00 00:32:50

Share Episode

Shownotes

With the growing move towards a hybrid and remote work environment, more and more people are relying on their smart devices to get work done. Keeping track of all of these devices, and ensuring that they are being used in a very secure manner, can be a challenging proposition. A recent survey finds organizations unprepared and overwhelmed with managing thousands or hundreds of thousands of these endpoint devices. Mike McNeill, CEO, Fleet Device Management, sheds light on some of these critical security issues and addresses questions such as: How does an organization manage its devices? Do they know if their devices are compliant and secure? Do they have ways to query them to learn more about their status in real-time? Mike also offers recommendations on how to prepare for the future of device management.


Time Stamps

01:28 -- Share with the listeners some highlights of your professional journey.

02:11 -- Let's talk about the motivation for the study.

03:54 -- The study is fairly recent; it was started on February 25, 2022. It was conducted online via Pollfish using organic sampling. And when I look at the industry is represented. It's pretty comprehensive. You all didn't leave out any sector. Am I correct?

04:52 -- Were you surprised by the survey findings relating to the state of device management?

06:48 -- Talking about managing the devices and keeping track of the devices, I read here that only a quarter of the sample population said that their devices are fully enrolled and upgraded. You know, that's worrisome. Why do you think organizations would allow that to happen?

07:54 -- So, if I'm understanding you correctly, the use of multiple operating systems and multiple platforms is part of the problem when it comes to tracking the devices, right?

08:33 -- Another finding that got my attention is that one of the best practices is to have a good Bring-Your-Own-Device (BYOD) policy. And to be more specific, 32% said, having a documented BYOD policy is a crucial best practice for their MDM (mobile device management) strategy. Can you expand on this?

09:57 -- BYOD, Bring Your Own devices, as an approach has its pros and cons. It was interesting to read that 32% of the respondents felt that having a documented BYOD policy is a crucial best practice for their MDM strategy. What are your thoughts?

11:49-- Another best practice documented here is measuring point-in-time compliance across all devices. Share with the listeners what you mean by point-in-time compliance or real-time compliance across devices.

13:56 -- How feasible is it to try and automate the patching process and thereby remove the responsibility (of patching) from the users?

17:51 -- Another finding that I find interesting is that multi-factor authentication becoming a top priority for 2022. The reason I find it interesting is I would assume that by now, multi-factor authentication would be a standard. I wonder why the delay in the adoption of a security mechanism that is universally accepted to be a very robust protective measure. What are your thoughts?

19:35 -- What were some unanticipated or unexpected findings?

20:59 -- I think the extent to which security and IT teams can work together and appreciate the significance of each other's work would make the development and implementation process more effective and efficient. What do you think?

23:12 -- What would you say to organizations interested in improving device management? How should they prepare themselves?

25:46 -- Going back to the report, where you're talking about preparing for the future of device management, you have several recommendations, one of which is to start managing containers. Can you expand on that?

28:21 -- Another recommendation in this report is to protect remote workers with zero trust, TLS, and multi-factor authentication. I'd like you to expand on this TLS when you suggest " move away from VPNs to granular proxies with TLS." Can you explain this?

30:38 -- Share some final thoughts with the listeners.


Memorable Mike McNeill Quotes

For endpoint security and risk management overall, you are starting to see more security engineers and security operations roles live in the IT department, and you're starting to see more IT engineering roles effectively taking on security challenges. And I think there's an argument to be made that in a couple of years, we're gonna see blended IT and security departments. So they will not be all that distinct anymore, other than the risk management aspect and crunching the numbers.

I think your success then comes down to, can we take inventory of what we have, and look at this from first principles, like, what are we trying to achieve here? We have a security posture we want to get to, we need to have an accurate inventory, and we need to make sure that we're collecting the right data that we can empower our security team with to like go run and build what they need themselves without having to go ask IT for more and more data every time.

If you are pocketed in and are part of a big organization, look for ways to find portable formats and solutions that don't lock you into a particular future, and that can work for other people in your company, even if they do have to use a different set of tools.


Connect with Host Dr. Dave Chatterjee and Subscribe to the Podcast

Please subscribe to the podcast, so you don't miss any new episodes! And please leave the show a rating if you like what you hear. New episodes release every two weeks.

Connect with Dr. Chatterjee on these platforms:

LinkedIn: https://www.linkedin.com/in/dchatte/

Website: https://dchatte.com/

Cybersecurity Readiness Book: https://www.amazon.com/Cybersecurity-Readiness-Holistic-High-Performance-Approach/dp/1071837338

Transcripts

Introducer:

Welcome to the Cybersecurity Readiness Podcast

Introducer:

Series with Dr. Dave Chatterjee. Dr. Chatterjee is the author of

Introducer:

the book Cybersecurity Readiness: A Holistic and

Introducer:

High-Performance Approach, a SAGE publication. He has been

Introducer:

studying cybersecurity for over a decade, authored and edited

Introducer:

scholarly papers, delivered talks, conducted webinars and

Introducer:

workshops, consulted with companies and served on a

Introducer:

cybersecurity SWAT team with Chief Information Security

Introducer:

Officers. Dr. Chatterjee is Associate Professor of

Introducer:

Management Information Systems at the Terry College of

Introducer:

Business, the University of Georgia. As a Duke University

Introducer:

Visiting Scholar, Dr. Chatterjee has taught in the Master of

Introducer:

Engineering in Cybersecurity program at the Pratt School of

Introducer:

Engineering.

Dr. Dave Chatterjee:

Hello, everyone, I'm delighted to

Dr. Dave Chatterjee:

welcome you to this episode of the Cybersecurity Readiness

Dr. Dave Chatterjee:

Podcast series. Our discussion today will revolve around the

Dr. Dave Chatterjee:

current state and future of endpoint security management.

Dr. Dave Chatterjee:

I'm thrilled to have Mike McNeil, CEO and cofounder, Fleet

Dr. Dave Chatterjee:

Device Management, as my guest today. And Mike will share his

Dr. Dave Chatterjee:

thoughts and perspectives, and also some very interesting

Dr. Dave Chatterjee:

findings from a study that his organization has conducted. So

Dr. Dave Chatterjee:

Mike, welcome.

Mike McNeill:

Thanks for having me, Dave.

Dr. Dave Chatterjee:

Hey, before we get into the details of the

Dr. Dave Chatterjee:

discussion, the study, let's talk about yourself a little bit

Dr. Dave Chatterjee:

share with the listeners some highlights of your professional

Dr. Dave Chatterjee:

journey.

Mike McNeill:

Oh, yeah, so I got into Open Source, in 2011-2012

Mike McNeill:

or so, did a bunch of different packages over the course of of

Mike McNeill:

my time in Open Source, but I built a framework called

Mike McNeill:

Sails.js for the Node.js community. And then more

Mike McNeill:

recently, I've teamed up with Zack Wasserman from the Osquery

Mike McNeill:

project on his app called Fleet, which is a open source platform

Mike McNeill:

for collecting data from the devices and servers that you

Mike McNeill:

manage.

Dr. Dave Chatterjee:

Okay, fantastic. So as I was reading

Dr. Dave Chatterjee:

the report on the state of device management, I found some

Dr. Dave Chatterjee:

of the findings to be quite concerning. But I'm not

Dr. Dave Chatterjee:

surprised. With the growing move towards a hybrid and remote work

Dr. Dave Chatterjee:

environment, you expect that more and more people will rely

Dr. Dave Chatterjee:

on their smart devices to get work done. Keeping track of all

Dr. Dave Chatterjee:

of these devices, and ensuring that they are being used in a

Dr. Dave Chatterjee:

very secure manner, can be a challenging proposition. So

Dr. Dave Chatterjee:

there are a lot of challenges that we're going to be talking

Dr. Dave Chatterjee:

about today. But let's first talk about the motivation for

Dr. Dave Chatterjee:

the study.

Mike McNeill:

Yeah, so we in the in the Fleet, the company,

Mike McNeill:

right, because we're a company that built built around an open

Mike McNeill:

source project and community, we wanted to understand how is the

Mike McNeill:

problem of device management shaping up, right, because it's

Mike McNeill:

getting more and more complicated. You got all these

Mike McNeill:

different cloud accounts with your AWS servers and your GCP

Mike McNeill:

servers, which is Google Cloud Platform, and Azure, from

Mike McNeill:

Microsoft, and many other providers. Plus, you might even

Mike McNeill:

have some stuff on-prem (on-premise), you've got mobile

Mike McNeill:

devices, right, and maybe they are corporate issued or company

Mike McNeill:

issued, maybe they're your own personal device. And the same

Mike McNeill:

thing can be happening with with laptops. And so in the

Mike McNeill:

transition that was going on, a big problem that we saw was

Mike McNeill:

people would end up with like a lot of different device

Mike McNeill:

management platforms. And we wanted to understand like, what

Mike McNeill:

is the actual underlying goals here? And how effective are

Mike McNeill:

people in this increasingly complicated environment at

Mike McNeill:

achieving this device management goals?

Dr. Dave Chatterjee:

Excellent. And you all spoke, or you all

Dr. Dave Chatterjee:

sampled 205 members of professional security teams who

Dr. Dave Chatterjee:

are directly responsible for device management. The study is

Dr. Dave Chatterjee:

fairly recent, it was started on February 25 2022. It was

Dr. Dave Chatterjee:

conducted online via Pollfish using organic sampling. And when

Dr. Dave Chatterjee:

I look at the industries represented, it's pretty

Dr. Dave Chatterjee:

comprehensive. Y'all didn't leave out any sector. Am I

Dr. Dave Chatterjee:

correct?

Mike McNeill:

That's right. Yeah, we tried to go as broad as

Mike McNeill:

we could, so that we could get, there's a lot of fish farms,

Mike McNeill:

right? Have IoT devices like there's it's a much more

Mike McNeill:

complicated regulatory environment. But there's also a

Mike McNeill:

lot of medical devices out there. And we were mostly

Mike McNeill:

focused on kind of the the corporate devices and the

Mike McNeill:

production devices like servers, or virtual servers or

Mike McNeill:

containers. But we did we did factor in some of the IoT stuff

Mike McNeill:

as well.

Dr. Dave Chatterjee:

Good to know. Good to know. So let's get

Dr. Dave Chatterjee:

to some of the insights from the study. Let's begin at a high

Dr. Dave Chatterjee:

level by discussing the overall state of device management. Your

Dr. Dave Chatterjee:

survey finds that organizations are struggling to manage a large

Dr. Dave Chatterjee:

number of endpoints. A quarter of the respondents report having

Dr. Dave Chatterjee:

to manage 250,000 devices or more. And another quarter of

Dr. Dave Chatterjee:

respondents are in organizations with over 10,000 workstations.

Dr. Dave Chatterjee:

The respondents also said that devices in their organizations

Dr. Dave Chatterjee:

are at various stages of enrollment, and upgrade. While

Dr. Dave Chatterjee:

some organizations report having enrolled nearly all devices in

Dr. Dave Chatterjee:

their MDM with the latest operating system, there are

Dr. Dave Chatterjee:

others, where not even a quarter of the devices are enrolled and

Dr. Dave Chatterjee:

upgraded. This means many organizations don't know which

Dr. Dave Chatterjee:

devices are at risk. And that is very concerning. Does this

Dr. Dave Chatterjee:

finding surprise you?

Mike McNeill:

Yes and no, right? Because qualitatively, we've

Mike McNeill:

been hearing for a long time, just from the contributors to

Mike McNeill:

the project that we have so many different tools on the security

Mike McNeill:

side. And on the IT side, we have maybe a platform that

Mike McNeill:

manages our Macs and a different platform that manages our

Mike McNeill:

windows, we knew there were some complications there. But it was

Mike McNeill:

it was pretty surprising just how much how varied the the

Mike McNeill:

issues were. It's not like people were the only thing wrong

Mike McNeill:

is, Hey, I can't collect my security data, right, from my

Mike McNeill:

devices. It's like, people are having issues across the board

Mike McNeill:

in effectively managing their computers. And that's true in

Mike McNeill:

every industry.

Dr. Dave Chatterjee:

Interesting, talking about managing the

Dr. Dave Chatterjee:

devices, keeping track of the devices, I read here that only a

Dr. Dave Chatterjee:

quarter of the sample population said that their devices are

Dr. Dave Chatterjee:

fully enrolled and upgraded. You know, that's worrisome, why do

Dr. Dave Chatterjee:

you think organizations would allow that to happen?

Dr. Dave Chatterjee:

So the organization's wake up, You know, it's not like they

Dr. Dave Chatterjee:

wake up in the morning, and it's, they look around, and

Dr. Dave Chatterjee:

they, they have this problem? And and they got here overnight,

Dr. Dave Chatterjee:

right? It's, it's, I think that you have, you always have even

Dr. Dave Chatterjee:

at a small company, maybe a few devices that are on, you know,

Dr. Dave Chatterjee:

Linux, Ubuntu laptops, or maybe you're mostly a Mac shop, and

Dr. Dave Chatterjee:

you have a couple of Windows PCs, maybe you have most of your

Dr. Dave Chatterjee:

infrastructure in AWS, but there's just one or two Google

Dr. Dave Chatterjee:

Cloud accounts. And I think what does happen is they start making

Dr. Dave Chatterjee:

exceptions, and then they look 12 months later, and it's sort

Dr. Dave Chatterjee:

of ballooned out of control, the problem. And then they started

Dr. Dave Chatterjee:

having to say, alright, we're gonna have to really invest some

Dr. Dave Chatterjee:

serious time and resources to figure out how to catch back up

Dr. Dave Chatterjee:

for our compliance purposes, or our security posture.

Dr. Dave Chatterjee:

So if I'm understanding you correctly, the use of multiple

Dr. Dave Chatterjee:

operating systems, multiple platforms, that's part of the

Dr. Dave Chatterjee:

problem, right, when it comes to tracking the devices?

Mike McNeill:

Absolutely, that and then shadow IT. So on this

Mike McNeill:

on the server side of the world, like you, maybe you have a large

Mike McNeill:

organization, and you want to have an enterprise agreement

Mike McNeill:

that says like, all of our cloud usage from Acme Inc, is gonna go

Mike McNeill:

to Microsoft, for example. But then there's some teams that end

Mike McNeill:

up just kind of creating individual Google Cloud accounts

Mike McNeill:

or individual AWS accounts, and those start to add up. And then

Mike McNeill:

before you know it, you've got a bunch of mystery servers that

Mike McNeill:

aren't tracked as part of your big strategy.

Dr. Dave Chatterjee:

Interesting, you know, another finding that

Dr. Dave Chatterjee:

got my attention, where the report states states, one of the

Dr. Dave Chatterjee:

best practices is to have a good Bring Your Own Device Policy.

Dr. Dave Chatterjee:

And to be more specific, 32% said, having a documented BYOD

Dr. Dave Chatterjee:

policy is a crucial best practice for their MDM strategy.

Dr. Dave Chatterjee:

And again, MDM stands for mobile device management. Can you

Dr. Dave Chatterjee:

expand on this?

Mike McNeill:

Yeah, I mean, so if you're familiar with with

Mike McNeill:

Aristotle's concept of like, the golden mean, right, there's one

Mike McNeill:

reality where you just say, hey, nobody can use their own device.

Mike McNeill:

Or if you do, you're gonna have to, like enroll it, and all of

Mike McNeill:

your text messages are gonna belong to us. And like, all of

Mike McNeill:

your, all of your web browsing activity is going to belong to

Mike McNeill:

us, et cetera, that makes it really hard. It's a hard pill

Mike McNeill:

for employees to swallow. And then on the other side of the

Mike McNeill:

coin, you have what happens at a lot of companies where they

Mike McNeill:

started off and everybody kind of has their own laptop and

Mike McNeill:

before you know it, you're 100 people, before you know it,

Mike McNeill:

you're like 500 people, or maybe you know, this happened recently

Mike McNeill:

with the supply chain issues. The Apple store in the US or in

Mike McNeill:

other countries where you're going through resellers, can't

Mike McNeill:

get you a laptop quickly enough. And so you're just having to

Mike McNeill:

say, you know what, it's been five weeks like just just go get

Mike McNeill:

one, Mike go anywhere you can. And then maybe that person

Mike McNeill:

encrypts their hard disk using their personal iCloud password

Mike McNeill:

and before you know it, you don't have access to the hard

Dr. Dave Chatterjee:

Good to know BYOD. Bring Your Own

Dr. Dave Chatterjee:

disk.

Dr. Dave Chatterjee:

Devices as an approach has its pros and cons. It was

Dr. Dave Chatterjee:

interesting to read that 32% of the respondents felt that having

Dr. Dave Chatterjee:

a documented BYOD policy is a crucial best practice for their

Dr. Dave Chatterjee:

MDM strategy. What are your thoughts?

Mike McNeill:

So I think, especially when it comes to I'll

Mike McNeill:

work, I'll work back from BYOD. With BYOD think there is it's

Mike McNeill:

kind of like time off policies, right? You can tell everyone at

Mike McNeill:

your company, here's the process, you go through to take

Mike McNeill:

some time off, maybe you let your manager No, you put it in a

Mike McNeill:

calendar of some kind, and, and then you're good, right. But

Mike McNeill:

sometimes you get sick and or an emergency happens. And you have

Mike McNeill:

to go around the process. And I think it's I think organizations

Mike McNeill:

are realizing that they have to have a way to support that, and

Mike McNeill:

then catch back up, while also still kind of having their best

Mike McNeill:

practice standard process for getting devices enrolled. And I

Mike McNeill:

think that's kind of true across the board with shadow it as

Mike McNeill:

well. Folks are folks are realizing that people are going

Mike McNeill:

to have cloud accounts. Sometimes when you need to get

Mike McNeill:

something done, people just go get it done, right. And they

Mike McNeill:

sign up for the account without going through procurement, or

Mike McNeill:

they they go and go by their own. Maybe they go by their own

Mike McNeill:

laptop, right outside of maybe the marketing team uses their

Mike McNeill:

budget instead of using the it team's budget. I think it's kind

Mike McNeill:

of having a dual strategy for like, what do we do in the

Mike McNeill:

standard case? And then what do we do when there's an exception.

Mike McNeill:

And as far as the platforms, I think we're seeing a lot more

Mike McNeill:

convergence, people are spending a lot of time building custom

Mike McNeill:

scripts trying to extract data from their MDM platform. And

Mike McNeill:

then they're having to go redo that same work for their other

Mike McNeill:

platforms, right or for their for the way they deploy things

Mike McNeill:

to their servers. And it's just, it takes too much time.

Dr. Dave Chatterjee:

Wow! Complicated. Moving on to

Dr. Dave Chatterjee:

another best practice documented here, which talks about

Dr. Dave Chatterjee:

measuring point-in-time compliance, across all devices.

Dr. Dave Chatterjee:

Share with the listeners, what do you all mean by point-in-time

Dr. Dave Chatterjee:

compliance, or real -time compliance across devices.

Mike McNeill:

So the, I'll use an example from, let's say,

Mike McNeill:

let's say you start a company, right, and you and you're like,

Mike McNeill:

I'm going to go sell to, you know, I don't know Bloomberg,

Mike McNeill:

right. And they look at your, your awesome product that you

Mike McNeill:

have, it probably has a website where they log in and add some

Mike McNeill:

servers that are powering that product. Well, one of the things

Mike McNeill:

they're gonna want you to do, if you're hosting the product for

Mike McNeill:

them is go through in the US, usually a SOC2 compliance. And

Mike McNeill:

Europe, it's more easily ISO 27001 compliance. And that can

Mike McNeill:

vary for different organizations and use cases. But those are the

Mike McNeill:

most common. So a lot of companies find themselves

Mike McNeill:

dealing with that first, really just to be able to sell

Mike McNeill:

effectively. So that usually is a one time thing. And then

Mike McNeill:

you're kind of good for you good for a while, right and good for

Mike McNeill:

a year or two, there's a lot of different flavors that get you

Mike McNeill:

different levels of compliance. But at a certain point, when you

Mike McNeill:

get big enough, and these days, it's actually trickling down to

Mike McNeill:

smaller and smaller organizations, you start to

Mike McNeill:

actually have a need to make sure that your security posture

Mike McNeill:

is kind of next level, right? Like you're getting, you're

Mike McNeill:

getting real phishing attempts, like every single day, you're

Mike McNeill:

actually getting compromises happening across your fleet. And

Mike McNeill:

then that's where the point-in-time compliance becomes

Mike McNeill:

bigger than just, you know, not only can I prove to the auditors

Mike McNeill:

that on this particular day, I was either compliant or I

Mike McNeill:

wasn't, which oftentimes, you know, the reality is that people

Mike McNeill:

aren't right in the middle between these audits, there's

Mike McNeill:

gaps, because there's always going to be exceptions. But

Mike McNeill:

point-in-time compliance is also like a lot more valuable for the

Mike McNeill:

fact that it doesn't have to be a compliance standard that's

Mike McNeill:

general across the industry, it could just be that, hey, we

Mike McNeill:

decided that nobody should have their one recovery kits sitting

Mike McNeill:

on their desktop, you can enforce that, right? So why not

Mike McNeill:

turn on an alert that goes off and lets that person know, so

Mike McNeill:

they can like remediate the problem? Or get IT involved to

Mike McNeill:

help them out.

Dr. Dave Chatterjee:

Yep. In fact, vulnerability management

Dr. Dave Chatterjee:

is the number one focus area. As I talk to subject matter experts

Dr. Dave Chatterjee:

on this show, one particular expert emphasized that if he had

Dr. Dave Chatterjee:

to select one area where a lot of attention needs to be paid,

Dr. Dave Chatterjee:

and that is vulnerability management, making sure your

Dr. Dave Chatterjee:

devices are all patched up. And so when I'm thinking about

Dr. Dave Chatterjee:

enforcing that across the board, given the different types of

Dr. Dave Chatterjee:

devices, the different operating systems, and then people using

Dr. Dave Chatterjee:

their own devices, from a technical standpoint, Mike, how

Dr. Dave Chatterjee:

feasible is it to try to automate the process and take

Dr. Dave Chatterjee:

the action, the the action of updating, you know, patches away

Dr. Dave Chatterjee:

from the user, and I will admit that I'm one of those people,

Dr. Dave Chatterjee:

when I see an update, update alert, I don't right away, do

Dr. Dave Chatterjee:

it. I'm lazy about it, but that is not a good practice. And so

Dr. Dave Chatterjee:

how do you ensure that people like me,don't engage in that, if

Dr. Dave Chatterjee:

I may.

Mike McNeill:

Well, pretty, so it's, uh, I'd say there's two,

Mike McNeill:

there's actually two pieces to this. There's the operating

Mike McNeill:

system patching. Yeah, yeah, a lot more invasive, it's a total

Mike McNeill:

takedown of your system, right. And that's where I think that's

Mike McNeill:

where actually where companies want to start a lot of times,

Mike McNeill:

because that's where you it's very easy to report on

Mike McNeill:

generally. I mean, again, you might be pulling from multiple

Mike McNeill:

different tools, if you don't have a cross-platform device

Mike McNeill:

management solution. But you are being it's just one data point,

Mike McNeill:

right? You can say like, what how many people are up to the

Mike McNeill:

latest operating system for Mac, for Windows, and that there's

Mike McNeill:

actually there's a tool called Nudge that his I'm actually

Mike McNeill:

sometimes Dave can end up being just like you. One thing that's

Mike McNeill:

consistently gotten me to update my OS, in a timely fashion is

Mike McNeill:

Nudge popping up its window, it's open source, it's free,

Mike McNeill:

it's by this guy, Eric Gomez, it pops up a window that you can't

Mike McNeill:

close. And you'd have to explicitly tell it, do I want to

Mike McNeill:

defer this later, for like, three hours or so or tomorrow,

Mike McNeill:

and it only lets you do that, I think a handful of times,

Mike McNeill:

whatever Apple has built in, you know, it talks about only

Mike McNeill:

letting me do it a certain number of times, but for

Mike McNeill:

whatever reason, it didn't work, but Nudge Nudge was how we

Mike McNeill:

solved that problem at Fleet even just for our small team,

Mike McNeill:

you know, 30 to 40 folks. On the other side, though, for for

Mike McNeill:

patching software packages, way more complicated problem space.

Mike McNeill:

And also because historically, you know, we were all in the

Mike McNeill:

world of IT, people were hooked up to physical desktop computers

Mike McNeill:

on a network, or companies that would send people off into the

Mike McNeill:

wild would would have VPNs. And a lot of companies still do a

Mike McNeill:

VPN. So a lot of the infrastructure was really built

Mike McNeill:

around this idea of network scanners, where it sits on your

Mike McNeill:

network, and it kind of sniffs out all the devices and whether

Mike McNeill:

they have any vulnerabilities. But that's a lot less detailed

Mike McNeill:

information you can get if you actually have an agent installed

Mike McNeill:

on the computer, whether that's a server or a laptop. So that's

Mike McNeill:

actually something we've we've dug into a lot with the fleet

Mike McNeill:

project, is trying to understand what what can we add, we already

Mike McNeill:

have an agent on the system, because we're with OSquery,

Mike McNeill:

right? Monitoring, telemetry about the the actions, the usage

Mike McNeill:

of the device, anything that might be suspicious. So if we

Mike McNeill:

can use that to grab the software inventory, what we

Mike McNeill:

learned, well, you know, could we automate this, right? And we

Mike McNeill:

learned that a lot of companies are already consuming

Mike McNeill:

vulnerability feeds. So they'll get the CVEs (Common

Mike McNeill:

Vulnerabilities and Exposures), which are represent like a

Mike McNeill:

vulnerability in a piece of software, come in, and they'll

Mike McNeill:

have analysts that either with scripts or by hand, match up

Mike McNeill:

those CVEs to actual software that's installed, whether that's

Mike McNeill:

like a Chrome extension, or a package running on a server, or

Mike McNeill:

an app like Figma. And that can definitely be automated. And

Mike McNeill:

that's actually something we built into Fleet. It's one of

Mike McNeill:

the free features of the product.

Dr. Dave Chatterjee:

Okay, you know, another finding that I

Dr. Dave Chatterjee:

find interesting is multifactor authentication becoming a top

Dr. Dave Chatterjee:

priority for 2022. The reason I find it interesting is I would

Dr. Dave Chatterjee:

assume that by now, multifactor authentication would be a

Dr. Dave Chatterjee:

standard. So I get a sense that several of the folks who were

Dr. Dave Chatterjee:

sampled in their organization, they were still moving in that

Dr. Dave Chatterjee:

direction, they we're not quite there yet. And that's when

Dr. Dave Chatterjee:

again, I wonder why the delay in adoption of a security mechanism

Dr. Dave Chatterjee:

that is universally accepted to be a very robust protective

Dr. Dave Chatterjee:

measure. What are your thoughts?

Mike McNeill:

If you've ever played racquetball and you've

Mike McNeill:

gone into the gym, and you look at the courts, and you see how

Mike McNeill:

many of these people are wearing goggles, right? I'm not I'm not

Mike McNeill:

wearing the goggles, right? I mean, and there's a I think a

Mike McNeill:

lot of people just anytime when you ask them to do something

Mike McNeill:

that isn't in their immediate right now interest, it can be

Mike McNeill:

really hard to motivate people to do that, because we just

Mike McNeill:

don't think that way as humans. So that's, I think the

Mike McNeill:

psychology is a big factor. But on the other side vendors,

Mike McNeill:

right, they've had to learn to love MFA. I think it's really

Mike McNeill:

easy to deprioritize security features like this, especially

Mike McNeill:

ones that involve extra UI, and you know, your product managers,

Mike McNeill:

like ah customers are going to get have bad experiences getting

Mike McNeill:

into the product. Like we don't want to do that. Right. And so

Mike McNeill:

it is I think it was a hard thing to prioritize for a lot of

Mike McNeill:

companies until they realize that it helps prevent account

Mike McNeill:

sharing. And so I think, I think we've seen a lot more MFA take

Mike McNeill:

off from the vendor side, as companies realize, hey, this is

Mike McNeill:

a way we can actually make more money because we can get people

Mike McNeill:

to prove that they are who they say they are, and therefore, you

Mike McNeill:

know, it's not two people sharing the same account.

Dr. Dave Chatterjee:

Okay, that's a good point. So what

Dr. Dave Chatterjee:

were some of the things that you found in the report that got

Dr. Dave Chatterjee:

your attention? I mean, I would like to call it say,

Dr. Dave Chatterjee:

unanticipated or unexpected findings. What would that be?

Mike McNeill:

Well, one thing we saw we actually did a report or

Mike McNeill:

we did a separate we asked the same question right, but to IT

Mike McNeill:

respondents, and it was interesting to see how the IT

Mike McNeill:

and security respondents answered differently. Right? To

Mike McNeill:

see on the security side, folks were far more interested in

Mike McNeill:

like, enforcing that the configuration of the operating

Mike McNeill:

system is secure and appropriate, versus on the IT

Mike McNeill:

side, like a lot of the challenge, like, Yeah, that's

Mike McNeill:

great. My security teams asking me to do that. But the

Mike McNeill:

challenges were a lot more diverse. The IT side was a lot

Mike McNeill:

more aware of how long it took to roll out an MDM. I think they

Mike McNeill:

actually said it took three months longer on average than

Mike McNeill:

the security respondents did, probably because the security

Mike McNeill:

folks saw it three months in and in the process, and I think the

Mike McNeill:

IT folks were more exposed to the actual nitty gritty of the

Mike McNeill:

migration. And then the other thing was just how much more

Mike McNeill:

aware that the IT side of the house was about the challenges

Mike McNeill:

of enrollment and trying to hit your enrollment goals. And and

Mike McNeill:

some of the pushback that the that the employees gave when

Mike McNeill:

they're when they don't necessarily want their devices

Mike McNeill:

to have to be under management or monitored.

Dr. Dave Chatterjee:

You bring up this, this apparent

Dr. Dave Chatterjee:

disconnect between the security team and the IT team, and a lot

Dr. Dave Chatterjee:

has been written about it, and a lot will be. A fundamental

Dr. Dave Chatterjee:

question that does always come to my mind is why don't

Dr. Dave Chatterjee:

organizations get these people, these teams to work in tandem,

Dr. Dave Chatterjee:

work together, so that can facilitate implementations? Like

Dr. Dave Chatterjee:

when I'm reading this report, I see one of the challenges is

Dr. Dave Chatterjee:

effective implementation of MDM tools and platforms. And though

Dr. Dave Chatterjee:

this was not explicitly mentioned, as a potential

Dr. Dave Chatterjee:

success factor, I'm going to put it out there that I think the

Dr. Dave Chatterjee:

extent to which security and IT teams can work together and

Dr. Dave Chatterjee:

appreciate the significance of what is being done that, would

Dr. Dave Chatterjee:

speed up matters. What do you think?

Mike McNeill:

I think anytime when you have different

Mike McNeill:

organizations, departments, teams that have to have an

Mike McNeill:

interface point, and this is true in software, too, right? If

Mike McNeill:

you've ever worked with microservices, you know, what it

Mike McNeill:

can be like. There starts to have to be a lot more things you

Mike McNeill:

layer on right to be able to make sure that that interface

Mike McNeill:

point is successful, maybe you have like an intake process so

Mike McNeill:

that the IT team can take requests from security, because

Mike McNeill:

they're getting asked things from a lot of different

Mike McNeill:

stakeholders. And so I think it can be successful with a lot of

Mike McNeill:

work. But it also is seeming like more and more that

Mike McNeill:

security, you know, on the Appsec side, application

Mike McNeill:

security, there's a shift left idea where security is actually

Mike McNeill:

infiltrating into the actual software engineering

Mike McNeill:

organization and making sure that it's like it's like a

Mike McNeill:

DevOps stage, right? It's, and you could actually make the same

Mike McNeill:

argument about design, right, and how as becoming a DevOps

Mike McNeill:

stage for user interfaces, but for the other part is security

Mike McNeill:

for kind of endpoint security and risk management overall,

Mike McNeill:

it's starting to you start to see more security engineers and

Mike McNeill:

security operations roles, live in the IT department, and you're

Mike McNeill:

starting to see more IT engineering roles, effectively

Mike McNeill:

taking on security challenges. And I think that there's an

Mike McNeill:

argument to be made that in a couple of years, we're gonna see

Mike McNeill:

blended IT in security departments. So they're not

Mike McNeill:

going to be all that distinct anymore, other than the risk

Mike McNeill:

management aspect and actually crunching the numbers.

Dr. Dave Chatterjee:

That is very encouraging. I think that's

Dr. Dave Chatterjee:

the first thing I've heard that makes me very optimistic. It

Dr. Dave Chatterjee:

should have happened a long time back that, but now that you're

Dr. Dave Chatterjee:

mentioning that, that things are moving in that direction about a

Dr. Dave Chatterjee:

blended IT and security department, that sounds awesome.

Dr. Dave Chatterjee:

Moving along those lines in terms of facilitating

Dr. Dave Chatterjee:

compliance, facilitating implementation, based on your

Dr. Dave Chatterjee:

experience, what makes a company better prepared in device

Dr. Dave Chatterjee:

management? What are some factors, technical, managerial

Dr. Dave Chatterjee:

that because you will appreciate or agree that there can be a lot

Dr. Dave Chatterjee:

of tools out there, and let's say Tool A is highly popular,

Dr. Dave Chatterjee:

highly effective, but it may not be effective for an organization

Dr. Dave Chatterjee:

that's not ready for that tool, because there is that

Dr. Dave Chatterjee:

people-process-technology alignment, that is very

Dr. Dave Chatterjee:

important to make sure that you realize you get the most out of

Dr. Dave Chatterjee:

these platforms and tools. So what what what would you say to

Dr. Dave Chatterjee:

organizations who are interested to get better at device

Mike McNeill:

Well, I'll say it depends, but I'll give you I'll

Mike McNeill:

give you a better answer than that. But I would say the first

Mike McNeill:

thing I would do is ask myself, how big are we right? How do we

Mike McNeill:

currently do IT? Is it still part of the engineering

Mike McNeill:

organization? Because if so, then then you know, you're going

Mike McNeill:

to have this tendency if you bring on any security focus is

Mike McNeill:

now going to be split between applications security and making

Mike McNeill:

sure your code is safe, and actually looking at your own

Mike McNeill:

internal needs. So I think I would look towards where your IT

Mike McNeill:

is now. Like, how do your laptops get ordered? How do you

Mike McNeill:

keep track of you know, if you're doing anything for like,

Mike McNeill:

warranty expiration, or how do we recycle laptops, what's our

Mike McNeill:

offboarding process look like? And whether that's, you know, a

Mike McNeill:

wiki page somewhere or like a checklist and an issue or

Mike McNeill:

something, I think jumping off from those human processes, and

Mike McNeill:

management? How should they prepare themselves?

Mike McNeill:

then saying, okay, who's going to own this? And what kind of

Mike McNeill:

framework are they going to use to solve the entire problem? You

Mike McNeill:

know, if you have a team of 30 people already in your security

Mike McNeill:

department, well, it's going to be a lot more complicated for

Mike McNeill:

you, because you've probably already bought a lot of

Mike McNeill:

different tools. So I think your success really then comes down

Mike McNeill:

to, can we take inventory of what we have, and really look at

Mike McNeill:

this from first principles? Like, what are we really trying

Mike McNeill:

to achieve? Here, we have a security posture we want to get

Mike McNeill:

to, we need to have an accurate inventory. And we need to make

Mike McNeill:

sure that we're collecting the right data that we can empower

Mike McNeill:

our security team with to like go run and build what they need

Mike McNeill:

themselves without having to go ask IT for more and more data

Dr. Dave Chatterjee:

You know, you're spot on. And that's part

Dr. Dave Chatterjee:

every time,

Dr. Dave Chatterjee:

of, you know, comprehensive planning. Unless you know, what

Dr. Dave Chatterjee:

you what you have that needs to be secured, you really can't

Dr. Dave Chatterjee:

make progress. But then as we were discussing, the the way

Dr. Dave Chatterjee:

companies are today, highly distributed with a lot of remote

Dr. Dave Chatterjee:

operations, that can be a huge challenge is just to keep track

Dr. Dave Chatterjee:

of who's using what and whether it's their personal device, or

Dr. Dave Chatterjee:

it's an organizational device. So once again, going back to the

Dr. Dave Chatterjee:

report, where you all talk about preparing for the future of

Dr. Dave Chatterjee:

device management, and you have several recommendations, one of

Dr. Dave Chatterjee:

which is "start managing containers." Can you expand on

Mike McNeill:

Yeah, so today, you know, more and more

Mike McNeill:

that?

Mike McNeill:

companies are moving from, let's say, look, 20 years back, right,

Mike McNeill:

like you would have a server in a closet somewhere, right, or in

Mike McNeill:

a data center, then we moved to the cloud, and you have a

Mike McNeill:

virtual pretend server that's living in in AWS, like somewhere

Mike McNeill:

in their in their data centers. And then with containers, you

Mike McNeill:

know, we're able to basically let anybody run their own cloud,

Mike McNeill:

effectively, on a container host, whether it's Kubernetes

Mike McNeill:

and using Docker, whatever it is, and I think a lot of people

Mike McNeill:

assume that because my container image is secure, and because the

Mike McNeill:

life of my container is short, the risk is relatively low. And

Mike McNeill:

it is right compared to something that's running for

Mike McNeill:

weeks and weeks, you know, what's the worst that's gonna

Mike McNeill:

happen, somebody can compromise it for a few minutes. But there

Mike McNeill:

are some sticky issues that can still come out of that. And as

Mike McNeill:

the reality of what's possible changes, you know, attackers are

Mike McNeill:

going to learn to make the most of what they got right to get,

Mike McNeill:

get what they want. Exactly. And so if that means your script has

Mike McNeill:

to run faster to do an attack than it will. So I think a lot

Mike McNeill:

of companies are looking at moving to can we monitor each

Mike McNeill:

container, maybe maybe we we don't install Osquery on every

Mike McNeill:

container, although you can. And we've seen that maybe I install

Mike McNeill:

it on the host, or maybe I'm using like cube query on the

Mike McNeill:

container host to get more information about Kubernetes as

Mike McNeill:

a whole, I think people are realizing the need to have that

Mike McNeill:

telemetry. And just even just to see what's going on. The other

Mike McNeill:

part of this is with, you know, we talked about shadow it

Mike McNeill:

before, if you have 100 Google Cloud accounts, and you're a big

Mike McNeill:

company, that is a nightmare to keep up with and figure out the

Mike McNeill:

billing and just where they're all at. So the other nice side

Mike McNeill:

effect of device management is not just security like, and

Mike McNeill:

especially if we're defining a device as a container, as

Mike McNeill:

abstract as that might be. We're giving you a way to see from

Mike McNeill:

like a legal and billing and privacy perspective, like

Mike McNeill:

where's our data flowing to? And what else do we have, and in

Mike McNeill:

what accounts?

Dr. Dave Chatterjee:

And then you know, another recommendation

Dr. Dave Chatterjee:

that that is made in this report that "protect remote workers

Dr. Dave Chatterjee:

with zero trust, TLS and multifactor authentication." I'd

Dr. Dave Chatterjee:

like you to expand on this TLS, when when you all suggest that

Dr. Dave Chatterjee:

move away from VPNs to granular proxies with TLS. Can you

Dr. Dave Chatterjee:

explain this?

Mike McNeill:

Yeah, I'll give you the real short version, as I

Mike McNeill:

understand it, but I'll point you towards this guy, Richard

Mike McNeill:

Steinan has a good book. Can't remember the name of it now. But

Mike McNeill:

if you look him up on on LinkedIn, I'm sure his book is

Mike McNeill:

there, where he goes, and he just interviews a bunch of IT

Mike McNeill:

security leaders about like, Hey, how are you dealing with

Mike McNeill:

this specific problem. And if I had to sum it up, it really

Mike McNeill:

comes back to it's used to be in the office, or you used to be on

Mike McNeill:

a network. And we have all this infrastructure we built up as a

Mike McNeill:

community to support that use case, like if you the idea is if

Mike McNeill:

you locked down that perimeter, you're just good. And then it

Mike McNeill:

kind of lets us not worry as much about this is similar. If

Mike McNeill:

you have a code repository, and you check in some secrets to it,

Mike McNeill:

if you expect that the codes never going to be public. It's

Mike McNeill:

like, well, worst thing is insider risk. Somebody takes the

Mike McNeill:

token causes some trouble, whatever. It's not that big of a

Mike McNeill:

risk. But I think a lot of people are reevaluating that

Mike McNeill:

whole idea in general, and especially once remote work

Mike McNeill:

became the unavoidable reality that we all lived with, you

Mike McNeill:

know, in the last few years. It's, it's 2022. Right now for

Mike McNeill:

context on 2020 everything changed and remote work had

Mike McNeill:

already been a long time coming. So how this all ties together

Mike McNeill:

with TLS is if I'm sitting in a Starbucks, right and I'm, I'm on

Mike McNeill:

my computer and I log into an HTTP website, even if it's just

Mike McNeill:

some little internal thing that no one thought would matter,

Mike McNeill:

maybe they didn't want to deal with let's encrypt, and I type

Mike McNeill:

in anything in plain text and send that in at a request over

Mike McNeill:

the network. Anybody who's sitting there just by nature of

Mike McNeill:

how Wi Fi or any of the link layer protocols work, like I can

Mike McNeill:

see those bytes flowing through the air. And I can grab those

Mike McNeill:

and I can borrow your plaintext password or your session ID for

Mike McNeill:

as long as I want. But TLS prevents that, right? It gives

Mike McNeill:

you a secure tube between your laptop and the place where

Mike McNeill:

you're headed, that no one can intercept except maybe the

Mike McNeill:

certificate authority.

Dr. Dave Chatterjee:

Interesting. What does TLS stands for?

Mike McNeill:

Its Transport Layer Security.

Dr. Dave Chatterjee:

Okay, there you go. Transport Layer

Dr. Dave Chatterjee:

Security. Fantastic. Let's start wrapping things up. It's been a

Dr. Dave Chatterjee:

great conversation. Great insights. I'd like to give you

Dr. Dave Chatterjee:

the opportunity to summarize things, share anything you'd

Dr. Dave Chatterjee:

like with the listeners, before we call it today.

Mike McNeill:

Yeah, I think I would just for anyone that's

Mike McNeill:

that's struggling with device management out there, I think I

Mike McNeill:

would encourage you to really look at what you're doing right

Mike McNeill:

now from first principles. If you are pocketed and and part of

Mike McNeill:

a big organization, look for ways to find portable formats

Mike McNeill:

and solutions that don't lock you in, to a particular future,

Mike McNeill:

and that can work for other people in your company, even if

Mike McNeill:

they do have to use a different set of tools. And then lastly,

Mike McNeill:

I'd say whether or not you're you know anything about device

Mike McNeill:

management, or you're facing these problems, if you're

Mike McNeill:

someone who is interested in contributing to open source,

Mike McNeill:

Fleet is open source. And so is Osquery. We would love to

Mike McNeill:

anything you'd like to add, if you read our docs, it's all

Mike McNeill:

online on fleetdm.com. And you can hop on to GitHub and

Mike McNeill:

contribute to everything from go back in source code to our React

Mike McNeill:

frontend to Osquery, which is written in C++, even all the way

Mike McNeill:

over to our company handbook, which is public and edits are

Mike McNeill:

welcome.

Dr. Dave Chatterjee:

Fantastic! Well, Mike, thanks again, for

Dr. Dave Chatterjee:

your time and insights. It's been a pleasure.

Mike McNeill:

Thanks Dave, it was fun!

Dr. Dave Chatterjee:

A special thanks to Mike McNeil for his

Dr. Dave Chatterjee:

time and insights. If you liked what you heard, please leave the

Dr. Dave Chatterjee:

podcast a rating and share it with your network. Also,

Dr. Dave Chatterjee:

subscribe to the show, so you don't miss any new episodes.

Dr. Dave Chatterjee:

Thank you for listening, and I'll see you in the next

Dr. Dave Chatterjee:

episode.

Introducer:

The information contained in this podcast is for

Introducer:

general guidance only. The discussants assume no

Introducer:

responsibility or liability for any errors or omissions in the

Introducer:

content of this podcast. The information contained in this

Introducer:

podcast is provided on an as-is basis with no guarantee of

Introducer:

completeness, accuracy, usefulness, or timeliness. The

Introducer:

opinions and recommendations expressed in this podcast are

Introducer:

those of the discussants and not of any organization.

Chapters

Video

More from YouTube