S3 E3: This Unstoppable Security Mind is Transforming Silicon Valley Through the End-Point

In this episode, I interview Rahul Kashyap, Chief Security Architect and Head of Security Research at Bromium, a company that focuses on stopping cyber-attacks where users are most vulnerable—the endpoint—through virtualization isolation. One of Silicon Valley’s 40 Under 40, Rahul has built a career around developing cyber defense technologies that focus on exploit prevention. At Bromium, Rahul manages R&D and product security, while simultaneously conducting robust industry outreach, speaking at leading security conferences including BlackHat, BlueHat, Hack-In-The-Box, RSA, DerbyCon, BSides, ISSA International, OWASP, InfoSec UK and others. 

Sponsored By:

CIO Security Scoreboard – Go to VisualCIO.com to learn more about how to communicate the status of your IT Security program visually and in minutes.

Time Stamped Show Notes:

02:00 – Rahul joins to the show 02:41 – Talking about the 40 Under 40 03:30 – The importance of being “unstoppable”—no one believes in you at the front-end—you need to be relentless in your confidence and determination 04:47 – The genesis of being “unstoppable” 06:05 – The importance of taking on big challenges versus small challenges—Rahul’s Gandhi example 06:43 – We are a function of the problems we choose 07:25 – Even when you don’t hit the target when you take on a “big challenge” when you fall, you’ll fall somewhere along the path and that’s a great place to be 07:55 – The problems Bromium tackles 08:34 – Attackers have found a soft-spot—the end users—and all it takes is one bad click 09:12 – Attackers have nothing to lose, and end-users will continue to make mistakes 09:44 – No one can build the perfect security engine—it’s impossible 10:15 – The key is not worrying about users making mistakes, or attackers attacking—the key is isolating the attack at the end-point and confining it there 13:25 – Bromium focuses primarily on desktops, laptops, and tablets 14:00 – Micro-virtualization is at the executable side 14:46 – Rahul defines Bromium Labs 16:09 – Defensive security versus offensive security 16:52 – Every security company should invest in offensive security because it most accurately resembles how hackers think 18:23 – Offensive security gives you the Why 18:44 – Defensive security gives you the How 20:04 – Anti-Virus is approximately 5% effective 20:30 – It has lost its efficacy because the technology—in principle—hasn’t evolved 22:45 – Bromium Labs’ first focus is to keep your network from getting infected in the first place 25:35 – Does Bromium need to be run in isolation or can it bundled into the software stack at the end-point? 26:49 – The security architecture behind managing disparate end-points 28:02 – Bromium’s pre-deployment analysis tool is under development but will launch soon 28:28 – Bromium’s partnership with Microsoft for Windows 10 30:33 – The frequency of patching has become SUCH a burden for small business, which is why Bromium developed a unique position towards patching 32:15 – Patching is often human error related 33:48 – It’s a new way of doing security—isolation versus prevention 34:16 – Sandboxing, Hardware enforced isolation, micro virtualization 35:18 – Most of your browsers already have a sandbox 36:55 – Companies are tired of investing in so many security products…the industry is too fragmented—Bromium is looking to change that 38:08 – It’s vital to understand the architectural limitations of each technology 38:55 – Rahul’s favorite new technology?—Hive which is exploring the intersection between big data and security 40:48 – Rahul shares his thoughts on machine learning and A.I. 42:33 – Rahul has taken up kayaking to manage stress and stay focused…and Call of Duty on X-Box One

4 Key Points:

We are a function of the problems we choose—an important concept to live by. The true soft-spot in today’s cyber-security market is the end-user—end-users always have, and always will make mistakes that result in compromised systems and networks. It is impossible to engineer a perfect security system—the threats change to rapidly—instead of trying to focus on prevention, let’s focus on technologies that accept attacks as the inevitability they are…technologies that let an attack happen, but isolate it immediately at the end-point. The cyber-security business (like most businesses) can be extremely taxing—find an outlet for healthy stress management.

Key Resources:

Rahul Kashyap – Today’s guest—Chief Security Architect and Head of Security Research at Bromium Sandboxing – Default security mechanism that operates through isolation of threats, now available on most browsers Bromium Labs – Dedicated to advancing the “state of the art” of information security by performing advanced research into current and future security threats. The Hive – An incubator that uses deep learning (a new discipline in AI) and neural network models to automate the learning of data representations and features. Micro Virtualization – A proprietary technology that abstracts applications and sub-processes from hardware and runs them in isolated environments.

Credits:

Show Notes provided by Mallard Creatives