How to Build an Actionable Approach to Cybersecurity

Edited for readability to remove filler words, false starts, and unnecessary repetitions. Timestamps refer to the original recording.

[01:48] Hello, everybody. Hopefully you can hear me. We're waiting for Paul from CPP to join. There you are, Paul. We have a bunch of folks on who were able to join. Glad you were able to make it.

[02:20] Welcome, everybody. I'll hand it to Paul first.

[02:24] Thank you, everybody, for joining. We're covering a critical topic today. Between Fab and myself, we have a lot of experience in this sector, and we look forward to explaining what we have to talk about.

[02:56] Before we dive into the presentation, I want to take a couple of minutes to review CPP at a high level. Some of you know me and CPP, and a handful of people don't, so this will be beneficial. CPP has been around for about 20 years. CRN Magazine is the industry standard for resellers and consultants, and we've been fortunate enough to be part of the Tech Elite 250 for four years in a row. There are over 40,000 companies like CPP in the industry. To be in the top 250, we feel honored and privileged.

[03:56] The four areas of focus that CPP has are cloud, AI and analytics—which we call intelligent automation—modern infrastructure, and cybersecurity, which includes defense and the ability to recover. At a high level, that's what CPP does. We have a variety of service offerings to implement those solutions. I'm not going to go through every word on this slide, but I want to focus on a couple of things. We try to be introspective as a company and ask our clients, "Why do you work with CPP?" This slide tells a lot of stories, and I'm happy to expand on it in a different forum.

[04:50] One thing customers like about us is our ability to eliminate red tape. If you have an issue or need something, we jump in and help. Our clients appreciate that. You'll also see implementing security and governance procedures without impeding operations. That's the point of this discussion when I hand the baton to Fab. The last point I'll touch on is knowledge transfer. I've seen service providers leave with all the know-how when they walk away from a project. Our goal is to make sure you have all the knowledge we have. If you want to continue working with us afterward, we have service arrangements we can provide, but that's always your choice.

[05:52] You work with us because you want to, not because you have to. That's different from many competitors in the industry. At a high level, our services include helpdesk support. I'm sitting in Clinton, New Jersey, today, and our NOC is here. We're East Coast based, so the first call with our helpdesk or any of our service offerings is handled here on the East Coast. We answer the phone in your time zone. Most of you on the call are East Coast based, and that's important. I believe A players are always trying to get to the day shift. Being able to talk with people in your time zone and region is important from a customer service perspective.

[06:44] We provide a variety of services, from engineer as a service to preventive maintenance and projects. We deliver services around the solutions we provide. Security is the reason we're here today. Centripetal is our lead solution, and you'll see why shortly. We do everything from endpoint protection to data recovery solutions like Zerto and next-generation VPN solutions like Zscaler. We have a full suite of services, but Centripetal is at the top for a reason. Fab will explain that effectively.

[07:39] I'll cover the last couple of slides and then hand it to Fab, who's better at talking about his solution than I am. A picture tells a thousand words. I watched a YouTube video from Centripetal, and this analogy struck a chord with me. In the Middle Ages, the castle on the hill was an amazing defense strategy. Then the cannonball came, and that strategy started to buckle.

[08:21] Now there are missiles. Picture missiles and cannonballs as next-generation ransomware attacks, and picture the castle and moat as current-generation firewalls and endpoint protection. You need them, but they're not enough. What we're here to discuss is how to put a shield around your castle and protect your organization. Centripetal has a different way of doing things. The castle and moat—firewall and endpoint protection—don't cut it anymore. Fab will tell you that almost every modern ransomware attack had a corporate firewall in place.

[09:20] I think 90% of those attacked also had endpoint protection in place, so you need more than that. We're here to help and answer any questions along the way. Text me or use the chat. I'm proud to be part of this solution set. It's unique and innovative. Fab, the show's yours.

[09:48] Thanks, Paul. We're proud to be working with CPP. You have great relationships in the industry, and we've already closed significant business together. Paul did a nice introduction explaining what we're doing at Centripetal. This is a different approach from anything you'll see in the market. We're basically the only company taking this approach. It's important because we're in a cyber war. The cost of cybercrime continues to rise. Eight trillion dollars last year, with an estimate of $10.5 trillion by 2025. That includes remediation costs, liability, training, and retooling. It's a mess out there.

[10:56] People don't realize we're up against a full market economy. Cyber threat actors exchange information and specialize. Some just scan to see if they can get into your network. They hand that list to someone who figures out how to build a weapon to get in, and someone else does the installation. We hear about ransomware, but that's the final point in the chain. The people executing ransomware use that money to pay other actors who helped them get in. This is an economy we're up against, not just someone in a hoodie in a basement hacking your network. There are some of those too, but it's a real challenge.

[11:49] In many cases, these bad actors are direct competitors to your business. We think about our competition, but hackers and hacking organizations can end up competing directly with your business. This breakdown is from the IBM Cost of a Data Breach report, which came out in June 2023. IBM takes over 500 breaches globally and crunches the numbers.

[12:28] Some of this data is scary. The dark blue is 2023, and the light blue is 2022. You can see which industries are seeing rising breach costs. Healthcare tops the list at almost $11 million: the average cost of a breach for a hospital or healthcare organization. Different verticals have different levels of success in reducing liability. The public sector has the lowest average cost per breach: $2.07 million in 2022, rising to $2.6 million in 2023. Although it's the lowest average cost, it's the fastest-growing sector, with 25% growth. In K–12 and the SLED markets—state, local, and education—there has been a lot of activity.

[13:45] The federal government has stepped in to shore up defenses by providing money for additional technology because schools are getting eaten alive by ransomware. This is probably the last slide about financials. We talked about $10.5 trillion by 2025. Spending on security and risk management was $188 billion last year. We're spending a lot to mitigate this, but the average time to identify and contain a breach hasn't improved much. As an industry, we're failing to keep up. That's why we and the companies partnering with us believe a new approach is needed.

[14:55] These slides show the world's biggest breaches and hacks. The amount of data exfiltrated is increasing year over year, and ransomware has exploded. Looking at the growth pattern, we need to stop this. As Paul pointed out, 95% of these threats could have been prevented, and we'll explain why.

[15:39] There hasn't been technology until now that allows for that mitigation. Imagine if this slide were reduced by 95%, with most of these bubbles gone. That's what we're trying to bring to market. Let's look at what organizations do today. There are technology and talent challenges in what we call the threat cycle. To mitigate threats, we traditionally load rules into firewalls and EDRs and wait for activity.

[16:31] I'm not a fan of waiting for a breach. It can seem like we're sitting around waiting for something to blow up. That's not really the case: people actively look at logs, reports, and alerts to identify risk. When they identify something risky, they investigate what was breached or what malware was installed. Then they remediate, update rules, and communicate the breach, including training users not to click phishing links. On the front end, there are technology challenges: most equipment in our security stack isn't designed to address the number of threats out there today.

[17:30] We're in a cyber war, and once you look at what's happening on the wire, you can't unsee it. The amount of daily reconnaissance is staggering. On the back end, we have talent challenges. Globally, we're three and a half million cybersecurity professionals short.

[18:09] We don't have enough people, and those we have are overwhelmed with other work: keeping infrastructure running, laptops patched, and device firmware upgraded. There are significant challenges in the current threat cycle. Some surveys from the last year show that 63% of cybersecurity professionals say they don't have the necessary staffing or skills in-house.

[18:51] That ties directly into the shortfall of three and a half million professionals. The most telling statistic is that 95% of all breaches had available threat intelligence and could have been prevented. This isn't a number Centripetal or CPP made up. These numbers come from Gartner Group, Webroot, and cyber threat intelligence providers. They're aware of the infrastructure being used to hack enterprises. The challenge is that the data is spread across tens or hundreds of providers, without sufficient information sharing. When I said 95% of those breaches could have been prevented, that's what I meant: the intelligence was available.

[20:04] We knew an IP address belonged to bad actors. What was it doing on the network? Most people didn't know it was a bad IP address; it was just another piece of incoming traffic. The same applies to URLs. That information needs to be aggregated and consolidated. Current threat intelligence programs miss the mark. I come from a background mostly on the mobile operator side.

[20:49] I knew a little about threat intelligence before I got here. I was blown away by the amount of information available to identify bad actors. Most organizations only have access to a fraction of it. That's the first challenge: limited intelligence feeds. Even if you have a firewall from a vendor Paul and his team provide, with a threat feed going into it, you're capturing about 1% of known threats, plus or minus.

[21:37] On one day, you might capture 2%; on another, half a percent. The feeds are limited because there isn't sufficient sharing and aggregation. The second challenge is that detect and respond doesn't prevent attacks. Bad actors have figured out how to get around EDR systems that have been popular over the last seven years. An EDR that was good four or five years ago is running out of gas. It's not necessarily that the intelligence isn't good; the problem is alert fatigue. This applies to MDR as well. An endpoint detection and response system generates alerts, but how many can you chase down? It's like walking into a store and repeatedly ringing the bell when there are only one or two people to serve you. It becomes a distraction.

[22:40] Detect and respond isn't working as well as it was. Existing tools aren't designed to process a high volume of indicators of compromise. When we talk about threat intelligence, we're talking about indicators of compromise, or IOCs. These include IP addresses from known bad actors, URLs that are phishing links, and IDS rules or signatures that we match to identify someone trying to introduce ransomware or a virus.

[23:31] That's the challenge we're up against. We have good intelligence and know where 95% of these people are, but there hasn't been a way to enforce it until now.

[23:45] At Centripetal, we've partnered with CPP on technology called Clean Internet. It combines four aspects of technology and human expertise to address those challenges. First, it provides advanced threat detection with preventative shielding. Most detection and response systems look at incoming traffic and then try to identify whether it's bad. What if we knew upfront and stopped that traffic from coming in at all? That's what we deliver with Clean Internet: advanced threat detection with preventative shielding.

[24:46] The second aspect is aggregating threat feeds. You have to pay for threat intelligence. If you buy it from your firewall vendor, there's a license fee. Third-party providers include Proofpoint, Recorded Future, GrayNoise, and IBM X-Force.

[25:33] These providers have databases of known threats. They capture threat activity through infrastructure and telemetry on the internet. They might set up a fake Exchange server or Windows laptops to gather information and identify bad actors at work. They don't share information. At Centripetal, with Clean Internet, we aggregate it. We pay for millions of dollars' worth of threat intelligence and aggregate it into what is essentially the largest database of threat intelligence on the planet.

[26:24] That's 10 billion indicators of compromise, updated every 15 minutes. The third aspect is mitigating the skills gap. We talked about the shortfall of three and a half million cybersecurity professionals. We have a top-notch security operations team, with many people coming directly from the military. We don't just sell a tool; we sell a service. We deploy the technology, but it isn't another dashboard for you to watch. We sell you the race car and provide the driver as part of the service.

[27:08] This is a white-glove service. An analyst is assigned to your enterprise to watch incoming threats and adjust policy as needed. The fourth aspect is incorporating the fastest packet filtering technology on the planet. Centripetal has over 104 patents. This technology came out of the Department of Homeland Security and was developed over roughly 14 years. We can build a packet filter that shields 95% of incoming threats at wire speed. Once we identify bad actors, we drop them at the network edge. That's where the Centripetal logo comes from. It's a collection of Cs, but centripetal force is the force you see when water goes down a drain. We flush bad actors at the network edge before they touch your firewall.

[28:20] That's why we call it Clean Internet: we take bad actors off the wire before they get in. We're finding this to be probably the most effective cybersecurity approach in the market right now. This technology is used by the Department of Homeland Security. We've deployed it in hospitals, K–12 schools, state and local governments, and banks. It's gaining rapid adoption.

[28:56] To summarize the service, you don't have to run the tool. You can—we give you full access to see the data and bad actors coming into your network—but you have an analyst building policy and filtering on the fly. Our operations analysts deliver this white-glove service. It's cost-effective, with zero capital outlay. It's bundled as OpEx rather than another box sending alerts at you.

[29:47] Here's an example: a large hospital in the Northeast was struggling with about 3 million firewall events per hour. It had a top-of-the-line firewall with a threat feed, but still saw 3 million events. This was incoming traffic they couldn't identify. It wasn't from a known good actor, wasn't mission traffic, and wasn't identified in threat intelligence.

[30:28] Like most organizations with a security information and event management system—a SIEM—they gathered and correlated security information. I think of a SIEM as a next-generation syslogger, although SIEM vendors might disagree. Unknown events go into the SIEM to determine a risk score. In this case, the hospital was seeing 5.7 gigabytes of SIEM logs per hour.

[31:03] Those 63 million events per day generated 5.7 gigabytes of SIEM logs per hour. I don't know anyone who can look at that much data every hour and determine its risk profile. You could use automation to get ahead of it, but it's essentially an impossible task. We put the Clean Internet solution's advanced threat detection technology, the RuleGate, in front of the firewall. The RuleGate is fascinating because it functions at layer one.

[31:49] It's essentially invisible and uses bypass NIC card technology. It sits in front of your firewall, and no one knows it's there. There's a small amount of latency—50 microseconds—but we capture and identify traffic before it reaches the firewall. We have a layer-three connection behind the firewall, but in front, it's layer one, so it can't be hacked into. It captures every packet and matches it against 10 billion indicators of compromise.

[32:30] We installed the RuleGate, and security analysts watched the activity. After a week, we built the advanced packet filter to shield known bad actors coming into the hospital's network. They went from 63 million events per day to 213,000 entering the SIEM. That's a 99.8% reduction. SIEM logs went from 5.7 gigabytes per hour to less than 11 megabytes per hour: a 99% reduction. When we talk about threat activity that was known somewhere but wasn't addressed, we're applying that intelligence. Once we apply it, the network cleans up.

[33:30] You get out of the posture of chasing alerts all day and asking who's in your network or who clicked a link. That activity quiets down. Clean Internet brings a quiet security stack. You don't have to believe me or Paul: try it for 30 days at no cost. You can't unsee what we show you. No one has the visibility we deliver because no one else has 10 billion indicators of compromise. We match every incoming and outgoing packet against that database. We can identify a device or laptop that clicked a phishing link.

[34:40] We can tell you a camera is talking to a command-and-control server in a far-off country. The detail is staggering. Deployment takes less than an hour. You unplug the firewall and connect it to the RuleGate, then connect the ISP router to the other side. It functions at layer one. If the RuleGate goes offline or someone trips over a power cord, traffic continues flowing because of the bypass card.

[35:18] It fails open, so traffic continues to flow. Deployment is easy, and results are immediate. We see bad actors coming in right away. An assigned analyst looks specifically at your network. At the end of the first week, we've identified bad actors and classified activity as high, medium, or low risk. We make policy recommendations, and you approve them. We don't simply block traffic. You may be working with a particular country and not want to block all traffic from there.

[36:02] That's fine; it doesn't go into the policy. Once your custom policy is applied, the filtering technology goes into effect and cleans up your network. One of the biggest things we do is stop reconnaissance. I'd say 97% to 98% of the traffic RuleGate stops is reconnaissance. We take port scanners looking for a way in off the wire. It's probably the easiest thing for us to do.

[36:44] That means you're no longer on the list. If bad actors can't see you or your open ports, they can't include you in the lists they sell. We can demonstrate this by looking at port scanner platforms such as Shodan.io and Censys.

[37:20] You can type your IP address into those platforms to see available or open ports. We take that reconnaissance off the wire, and eventually you'll age out of Shodan and Censys because we're blocking it. You become invisible. Paul's illustration of a shield over the castle is exactly what Clean Internet does. I hope some of you will try the system. The more customers we have, the better intelligence we can identify across multiple verticals.

[38:17] Thanks, Fab. We have a couple of questions. Brian asks, "How frequently does the threat list get updated?" It depends on the provider, but usually every 15 minutes. We spend around $3 million a year on threat intelligence. That changes because we can identify which intelligence is valuable. With such a large volume of intelligence across our customers, we can assess its value quickly.

[39:01] I haven't discussed the AI aspects, which are outside the scope of this presentation. We curate the data coming in from multiple feeds and providers. Curation matters because bad intelligence can cause legitimate sites to be blocked. We curate it to avoid false positives. Thanks, Fab. If anyone is interested, we can explain more about how this works in a follow-up meeting.

[39:39] Michael Sauls asks, "Do you provide any guarantees?" I'm not sure what kind of guarantee you mean—indemnification, for example? Mike, please clarify in the chat, and we'll follow up. The clarification is: "If you don't catch something, do you cover costs?" I don't know how to answer that.

[40:17] There may be a business arrangement involving cybersecurity insurance, but we'll follow up with you on that, Mike. Daryl asks, "You keep saying layer one, but you have to read at layer two. How do you decode SSL traffic?" Stateful firewalls typically decrypt SSL or TLS traffic.

[40:51] We don't decrypt unless there's a need. If we see a session from a bad actor with a full TCP connection established, we see all the TCP exchanges. If that traffic is encrypted in TLS 1.2 or 1.3, your analyst will ask, "We saw this TLS session from country X. We'd like to decrypt it. Are you okay with that?" If you agree, we have technology called Probable Cause TLS Proxy to capture and decrypt the packets, if they're decryptable—for example, TLS 1.2 and, in some cases, 1.3. Those packets are stored on the RuleGate.

[41:45] We can't access the RuleGate or SSH into it. There's no reverse SSH, so you control your data. You log in through the web interface and download those packets. You can send them to us to review together, but you maintain chain of custody. Your traffic payload isn't our business. We can use IDS and analyze the payload inside the box, but no payload data comes out. Only events go to our SIEM. We use Splunk to report risky traffic. We're looking at metadata rather than payload.

[42:44] We'll report, "This traffic came from country X. It was encrypted, we decrypted it, and here's what we identified. What would you like to do?" Daryl asks a follow-up: "Do you have to use a man-in-the-middle mode to get the certificates, or do you get them from the customer?" With Probable Cause TLS Proxy, we can be a man in the middle. We're not replacing the firewall. We're decrypting traffic from known bad actors.

[43:26] The first step is identifying where the traffic comes from. We're not interested in decrypting traffic from legitimate sites. We're looking at traffic identified in threat intelligence. We also block zero-days. We've seen Log4j and MOVEit attacks before they were announced. When we looked back after the zero-day announcement, we saw we'd already blocked that activity.

[44:04] That's because a bad actor was trying to execute the zero-day. If we shield against that actor, they can't get in to execute it. We can follow up with Daryl and Mike in more detail. Another question is, "How do you protect and support cloud infrastructure?" We have a RuleGate in the cloud. It functions at layer three rather than layer one because you can't use bypass NIC cards in AWS or Azure. We use gateway load balancers, a well-understood technology.

[44:50] You enable gateway load balancing and route traffic through our RuleGates. The next question is about installation: how long does it take, and how involved is it? We do a scoping call. The actual outage is a couple of seconds: the time to unplug your firewall and plug it into the RuleGate, then connect the cable from the ISP router. You also assign an IP address on the inside of the network.

[45:31] Typically, we ask for a port mirror on the internal network so we can decode private IPs. If someone clicks a phishing link, we want to identify the Windows machine—for example, 10.11.29.5—that clicked it. That lets us match the outgoing packet to the private IP address. There's also a question about how Probable Cause TLS Proxy gets in the middle. One thing we need to determine is your WAN IP.

[46:16] If we have your WAN IP, we can insert ourselves into the TLS session. We can discuss that on a separate call. Michael Sauls asks, "How do you scan incoming email if you're only at layer two, assuming the email comes from a legitimate site?" We don't scan emails. We're not an email protection system. We come into action when someone clicks a phishing link.

[46:49] We don't scan emails for malicious URLs. This technology came out of the government, is used by DHS, and has been used in top-secret networks. Control and chain of custody of the payload are important in those environments, so you maintain custody of your data. There's also a comment about Mimecast. I think we've covered the questions, but there was one about another company.

[47:34] Henry asks about PacketViper and whether this is similar. There are other systems out there. We call this a threat intelligence gateway. Clean Internet is essentially a threat intelligence gateway as a service. We're different from other offerings, but I don't want to disparage companies; everyone's trying to address cybersecurity challenges. The difference with Centripetal is that we can ingest more threat intelligence and pay for more than anyone else. Most threat intelligence gateways provide a feed or a few feeds, or let you bring your own. They don't bring $3 million worth of intelligence, curate it, and enforce it at the edge using our packet filtering technology.

[48:41] We also have the AI analyst looking at events. If you'd like more detail, arrange a meeting with Paul. We're happy to explain the technology further, and I appreciate the questions. For those who know me, we've been involved in a handful of proofs of concept. In every one, what Fab said is true: you can't unsee what you see. These organizations already have all the tools you can imagine. Every once in a while, an invention comes along that's better, and I think we're at that point. It doesn't mean what you're doing today is wrong; it's the best you can do with what's available. This is an invention worth looking at.

[49:36] Thanks, Paul. We've converged several technologies: AI curation, AI analysts to help address the shortfall in people, packet filtering to match traffic at wire speed, and updating threat intelligence as it emerges. These are the big game changers.

[50:23] Other organizations don't have a dedicated system to do this. It's highly specialized, but we find it effective. Our customers don't get hacked, and that's good news. Thank you for joining us today. We'll follow up and hope to explore this technology in more detail with each of you. Fab, thank you for your support, and thank you to Centripetal. Thanks, Paul, for having us. We look forward to follow-up meetings with your clients to explain the technology further.

[51:16] Thanks, everybody, and thank you for the great questions. Take care.