1 00:00:00,000 --> 00:00:03,329 W. Curtis Preston (2): This week on the backup wrap-up we cover the world 2 00:00:03,329 --> 00:00:05,820 of security monitoring and response. 3 00:00:06,119 --> 00:00:11,430 We talk about SIM soar and XDR tools, what they are, how each plays 4 00:00:11,430 --> 00:00:13,500 a role in your security posture. 5 00:00:13,799 --> 00:00:17,369 We also talk about a scalable SIM solution called sea monster. 6 00:00:17,670 --> 00:00:19,019 That does all three. 7 00:00:19,500 --> 00:00:23,970 It was built by a red team to help blue teams, our guests and expert this 8 00:00:24,000 --> 00:00:26,100 week is desert rock of sea monster. 9 00:00:26,400 --> 00:00:28,949 And she has some definite opinions on this market that I 10 00:00:28,949 --> 00:00:30,299 think you'll find very useful. 11 00:00:30,750 --> 00:00:34,589 I know, we usually talk about backup and recovery here, but this popular episode 12 00:00:34,589 --> 00:00:39,126 from last year will definitely help you to begin that conversation that you've been 13 00:00:39,126 --> 00:00:40,896 wanting to have with the security team. 14 00:00:41,310 --> 00:00:42,630 If you're not familiar with me. 15 00:00:42,630 --> 00:00:45,150 I'm w Curtis Preston, AKA Mr. 16 00:00:45,150 --> 00:00:45,660 Backup. 17 00:00:45,960 --> 00:00:49,200 And I've been passionate about backup recovery, Dr. 18 00:00:49,410 --> 00:00:54,960 For over 30 years ever since I lost data and I had no backups of it, I had to tell 19 00:00:54,960 --> 00:00:57,450 my boss, we couldn't restore the database. 20 00:00:57,840 --> 00:00:59,640 I don't want that to happen to you. 21 00:00:59,640 --> 00:01:02,520 And that's why I do this on this podcast. 22 00:01:02,520 --> 00:01:06,360 We turn unappreciated backup admins into cyber recovery heroes. 23 00:01:06,630 --> 00:01:08,670 This is the backup wrap-up. 24 00:01:22,263 --> 00:01:23,253 Welcome to the show. 25 00:01:23,762 --> 00:01:26,427 I'm your host, w Curtis Preston, AKA Mr. 26 00:01:26,427 --> 00:01:26,867 Backup. 27 00:01:27,119 --> 00:01:31,989 And I have with me my senior H D M I consultant, Prasanna Malaiyandi. 28 00:01:32,159 --> 00:01:32,729 W. Curtis Preston: How's it going? 29 00:01:32,729 --> 00:01:33,409 Prasanna. 30 00:01:33,794 --> 00:01:34,574 Prasanna Malaiyandi: I'm good. 31 00:01:34,574 --> 00:01:35,114 Curtis. 32 00:01:35,114 --> 00:01:39,074 I'm I, by the way, my bill is in the mail, so, or invoice 33 00:01:39,164 --> 00:01:39,794 W. Curtis Preston: Alright, I'll, 34 00:01:41,864 --> 00:01:47,054 because once again, once again, you ended up having a fountain of 35 00:01:47,054 --> 00:01:53,834 knowledge about a random technical topic that ended up being very useful. 36 00:01:53,894 --> 00:01:57,704 I mean, the fact that you just were like, oh no, I think that's the, the H 37 00:01:57,704 --> 00:02:02,684 G M I 1.7 spec that came out in 2009 or. 38 00:02:03,734 --> 00:02:10,934 Um, and they're like, and then when I, so, so basically, yeah, so I have 39 00:02:10,994 --> 00:02:17,294 a new Apple TV and meaning the, the little box, and I was trying to connect 40 00:02:17,294 --> 00:02:20,384 it to my 2009 plasma television. 41 00:02:21,074 --> 00:02:27,694 And, uh, it uses, uh, HDMI-CC. 42 00:02:27,854 --> 00:02:28,214 Prasanna Malaiyandi: Yep. 43 00:02:28,979 --> 00:02:31,439 W. Curtis Preston: Yeah, to control the power off and power 44 00:02:31,439 --> 00:02:33,959 on and it wasn't working for me. 45 00:02:34,619 --> 00:02:39,119 And uh, I was just talking to Prasanna about that. 46 00:02:40,679 --> 00:02:43,259 And then once again, you were like, oh, well if you checked the 47 00:02:43,259 --> 00:02:45,839 setting and such, watch a macall it. 48 00:02:47,579 --> 00:02:49,049 And you, you solved my problem. 49 00:02:49,424 --> 00:02:52,424 Prasanna Malaiyandi: Yeah, and I solved your problem that Apple 50 00:02:52,424 --> 00:02:53,894 support couldn't even solve for you. 51 00:02:55,229 --> 00:02:57,689 W. Curtis Preston: Yeah, yeah, apple support was worthless. 52 00:02:57,799 --> 00:03:02,089 Uh, and this is all just a process of getting towards my new big giant 53 00:03:02,089 --> 00:03:04,099 TV that will at some point arrive. 54 00:03:04,729 --> 00:03:10,744 Um, I'm just, I'm just waiting for that moment to buy the big, the big giant tv. 55 00:03:11,134 --> 00:03:15,124 But, um, I bought the soundbar first, so I have this old 56 00:03:15,559 --> 00:03:17,179 Prasanna Malaiyandi: And was your wife happy 57 00:03:18,074 --> 00:03:19,874 W. Curtis Preston: My wife was so happy that she could turn 58 00:03:19,879 --> 00:03:21,074 the television off, you know? 59 00:03:21,314 --> 00:03:24,734 I mean, it was so, it was such a burden for her to have to get 60 00:03:24,764 --> 00:03:28,094 up and turn on the TV when she first starts watching television. 61 00:03:28,784 --> 00:03:29,414 Uh, and 62 00:03:29,549 --> 00:03:31,919 Prasanna Malaiyandi: well, and I think, I think just to clarify, I think 63 00:03:31,924 --> 00:03:33,929 off work, turning off the TV work, 64 00:03:33,944 --> 00:03:34,244 W. Curtis Preston: off. 65 00:03:34,349 --> 00:03:34,949 Prasanna Malaiyandi: turning on. 66 00:03:35,444 --> 00:03:39,344 W. Curtis Preston: Which is what made it so confusing off worked, but on did not. 67 00:03:39,974 --> 00:03:43,994 And, um, but now they both work and my wife can watch 68 00:03:43,994 --> 00:03:45,794 television without, you know, 69 00:03:46,949 --> 00:03:47,729 Prasanna Malaiyandi: Cursing your name 70 00:03:49,364 --> 00:03:50,054 W. Curtis Preston: Exactly. 71 00:03:50,099 --> 00:03:51,179 Prasanna Malaiyandi: being like Curtis, why do 72 00:03:51,254 --> 00:03:53,774 W. Curtis Preston: and now, now, once again, she will, she 73 00:03:53,774 --> 00:03:55,214 will give you credit for it. 74 00:03:55,304 --> 00:03:55,934 Uh, and I 75 00:03:55,934 --> 00:03:58,799 will get no credit, but, Such is life. 76 00:03:59,219 --> 00:04:02,459 So, um, let's move on to our guest. 77 00:04:02,459 --> 00:04:05,759 I found her her background, fascinating. 78 00:04:06,029 --> 00:04:10,499 She has degrees in both business and law and she finished her M B a 79 00:04:10,499 --> 00:04:14,399 while actually running the company that we're talking about today, which 80 00:04:14,399 --> 00:04:17,489 is, uh, SIEMonster, that's s i e. 81 00:04:18,299 --> 00:04:23,109 Monster, an affordable security monitoring software solution. 82 00:04:23,399 --> 00:04:28,119 She's now their c e o and you can find her on Twitter as @deztraction 83 00:04:28,139 --> 00:04:30,479 so that's d e z traction. 84 00:04:30,779 --> 00:04:33,719 Uh, welcome to the Pod Dez Rock. 85 00:04:33,949 --> 00:04:34,629 Dez Rock: Thank you. 86 00:04:34,629 --> 00:04:35,149 Thank you for 87 00:04:35,149 --> 00:04:35,549 having me 88 00:04:35,549 --> 00:04:35,789 guys. 89 00:04:35,869 --> 00:04:38,449 W. Curtis Preston: So, uh, you, so you've been, you've been all over 90 00:04:38,449 --> 00:04:40,909 the globe and you are now currently. 91 00:04:41,989 --> 00:04:43,819 I think just a few miles where I lived 92 00:04:43,819 --> 00:04:44,089 for a 93 00:04:44,089 --> 00:04:44,539 while. 94 00:04:44,599 --> 00:04:45,769 Where, where, where exactly? 95 00:04:45,769 --> 00:04:46,789 You're in Delaware 96 00:04:47,443 --> 00:04:49,533 Dez Rock: I am, I just gimme a minute. 97 00:04:49,533 --> 00:04:51,453 I want 'em to announce it like the locals. 98 00:04:52,423 --> 00:04:52,773 No. 99 00:04:52,903 --> 00:04:53,253 Uh, 100 00:04:55,343 --> 00:04:56,573 W. Curtis Preston: Are you in Newark? 101 00:04:58,103 --> 00:05:00,553 Dez Rock: No, no, exactly where 102 00:05:00,693 --> 00:05:01,053 I'm, 103 00:05:01,283 --> 00:05:01,613 W. Curtis Preston: yeah. 104 00:05:01,613 --> 00:05:04,133 So that's actually where I got my start. 105 00:05:04,798 --> 00:05:09,983 In backups back in 1993, I was fresh out of the Navy. 106 00:05:09,983 --> 00:05:14,813 I was, I had, the Navy had sent me to Philadelphia, so my ship was in 107 00:05:14,818 --> 00:05:16,523 dry dock up there in Philadelphia. 108 00:05:17,153 --> 00:05:25,523 And um, so I got out and immediately went into, uh, backups, uh, because it was like 109 00:05:25,523 --> 00:05:27,353 many people, it was the job I could get. 110 00:05:27,353 --> 00:05:31,373 No one, no one wakes up, you know, no one dreams of being a, a backup 111 00:05:31,523 --> 00:05:33,803 Prasanna Malaiyandi: Hey, don't shatter people's hopes. 112 00:05:33,803 --> 00:05:35,963 You know, I'm just saying, Curtis, maybe there 113 00:05:35,978 --> 00:05:38,498 W. Curtis Preston: you wanna be a backup person, there is demand. 114 00:05:38,528 --> 00:05:39,278 Trust me. 115 00:05:39,638 --> 00:05:41,498 Uh, there's just not a line. 116 00:05:41,741 --> 00:05:45,371 and, but yeah, I got my start there on Christiana Road. 117 00:05:45,911 --> 00:05:49,511 The, that was where, uh, bank of America was. 118 00:05:49,581 --> 00:05:53,561 Uh, I have a, I have a daughter who's now 28, who was born on Christiana 119 00:05:53,561 --> 00:05:54,911 Road at Christiana Hospital. 120 00:05:55,481 --> 00:05:59,261 So I'm feeling very close to you right now, even though you're all the way 121 00:05:59,261 --> 00:06:00,341 on the other side of the country. 122 00:06:00,491 --> 00:06:01,421 Dez Rock: That's lovely to hear. 123 00:06:01,421 --> 00:06:02,171 Cause I know you're in 124 00:06:02,171 --> 00:06:02,771 California, 125 00:06:03,041 --> 00:06:03,636 W. Curtis Preston: absolutely. 126 00:06:03,756 --> 00:06:06,006 The, the, the complete opposite corner of the country. 127 00:06:06,606 --> 00:06:12,456 Um, now clearly based on how I'm hearing you speak, uh, you were 128 00:06:12,456 --> 00:06:14,286 raised in, in a different part. 129 00:06:14,346 --> 00:06:16,586 Uh, probably a, probably a different hemisphere, I'm guessing. 130 00:06:16,755 --> 00:06:16,995 Dez Rock: Do you 131 00:06:17,175 --> 00:06:17,335 wanna 132 00:06:17,335 --> 00:06:17,545 W. Curtis Preston: Oh, 133 00:06:17,605 --> 00:06:19,075 Prasanna Malaiyandi: This is Curtis's favorite thing. 134 00:06:19,245 --> 00:06:19,735 Yeah. 135 00:06:19,860 --> 00:06:22,530 W. Curtis Preston: It's, it's not fair because I, I looked at your LinkedIn page 136 00:06:22,530 --> 00:06:24,030 and I knew that you went to Victoria. 137 00:06:24,890 --> 00:06:29,115 Uh, so, uh, that's not fair, but I, I would've gotten it either way. 138 00:06:29,115 --> 00:06:33,645 I, I definitely, uh, my favorite is trying to, trying to, 139 00:06:34,005 --> 00:06:36,045 within a few phrases, trying to 140 00:06:36,045 --> 00:06:40,305 distinguish whether or not I'm talking to a Kiwi or a, or an Aussie. 141 00:06:40,395 --> 00:06:40,995 Um, 142 00:06:41,345 --> 00:06:45,545 Dez Rock: And Aussie, so my accent is not the one that the Americans are used to. 143 00:06:45,575 --> 00:06:49,835 And I, and I can drop it down to what you guys would most people think I'm from 144 00:06:49,835 --> 00:06:51,995 England and when I come to the us right? 145 00:06:52,925 --> 00:06:55,115 Unless, unless I start talking a bit like this. 146 00:06:55,595 --> 00:06:58,605 And then, then they'll, they'll really know then it's 147 00:06:58,650 --> 00:06:59,460 W. Curtis Preston: Exactly. 148 00:06:59,855 --> 00:07:04,175 Dez Rock: And so what's really, what's really hard to fathom, most Americans 149 00:07:04,775 --> 00:07:08,675 I've, that accents can differ in a country. 150 00:07:09,095 --> 00:07:10,385 It's remarkably 151 00:07:10,595 --> 00:07:12,420 W. Curtis Preston: they should, it shouldn't, uh, 152 00:07:12,950 --> 00:07:13,260 surprise them. 153 00:07:13,260 --> 00:07:15,960 I mean, we have like 20 in this country. 154 00:07:16,191 --> 00:07:16,681 Yeah. 155 00:07:16,746 --> 00:07:16,926 Dez Rock: know. 156 00:07:17,496 --> 00:07:17,886 I know. 157 00:07:18,336 --> 00:07:18,906 I know. 158 00:07:19,411 --> 00:07:19,771 W. Curtis Preston: Yeah. 159 00:07:19,851 --> 00:07:26,101 And, and what's more amazing to me is how much accents can vary in England, right? 160 00:07:26,281 --> 00:07:27,091 Prasanna Malaiyandi: I was just gonna bring 161 00:07:27,211 --> 00:07:28,171 W. Curtis Preston: little country. 162 00:07:28,591 --> 00:07:33,361 And, you know, you have a different accent between north and South London, right? 163 00:07:33,441 --> 00:07:36,241 I I, and it's just, and, and then you have accents, accents 164 00:07:36,241 --> 00:07:38,371 vary based on class, right? 165 00:07:38,611 --> 00:07:40,081 On education and, and 166 00:07:40,081 --> 00:07:40,681 all of that, 167 00:07:40,681 --> 00:07:41,041 right? 168 00:07:41,401 --> 00:07:42,931 Um, so yeah. 169 00:07:43,626 --> 00:07:43,866 Dez Rock: That's 170 00:07:43,891 --> 00:07:44,101 W. Curtis Preston: yeah, 171 00:07:44,101 --> 00:07:45,481 I, I, I enjoy. 172 00:07:46,086 --> 00:07:48,816 Dez Rock: But the same can be said in New York, New York, right? 173 00:07:48,876 --> 00:07:51,756 I mean, a New York accent depends on how they, you could tell literally 174 00:07:51,756 --> 00:07:54,786 where, whereabouts they're from because of that, and that's just one 175 00:07:55,096 --> 00:07:55,816 W. Curtis Preston: That is true. 176 00:07:55,836 --> 00:08:01,206 Dez Rock: So it is just the inability to apply the exact same rule to other 177 00:08:01,206 --> 00:08:01,746 countries. 178 00:08:02,056 --> 00:08:05,791 W. Curtis Preston: We, we, um, Yeah, we, I don't know. 179 00:08:05,851 --> 00:08:06,601 I don't know what to say. 180 00:08:06,691 --> 00:08:07,321 America. 181 00:08:07,501 --> 00:08:14,571 Um, so, so, but you're, you're here now, so, uh, you're, 182 00:08:14,571 --> 00:08:15,661 you actually live in Dallas. 183 00:08:15,666 --> 00:08:17,941 The company is headquartered in Delaware. 184 00:08:17,941 --> 00:08:18,631 I'm seeing 185 00:08:18,631 --> 00:08:19,891 New York also. 186 00:08:19,981 --> 00:08:22,021 Where, what is, how does New York figure into it? 187 00:08:22,179 --> 00:08:24,999 Dez Rock: so we were in New York Post, uh, pre pandemic with the 188 00:08:24,999 --> 00:08:28,089 headquarters, and I used to be, I, I've transferred from New York. 189 00:08:28,149 --> 00:08:31,629 I, I used to live in New York as well, and uh, New York is where we went 190 00:08:31,629 --> 00:08:33,939 through Techstars in 2018 as well. 191 00:08:33,939 --> 00:08:38,439 So that's why, uh, that's why we have a presence or had a presence in New York. 192 00:08:38,439 --> 00:08:39,609 I'm about to pull out of New York. 193 00:08:40,479 --> 00:08:42,339 Um, stick to, um, 194 00:08:42,909 --> 00:08:43,449 Dallas. 195 00:08:43,744 --> 00:08:44,344 W. Curtis Preston: Nice. 196 00:08:44,494 --> 00:08:45,064 All right. 197 00:08:45,124 --> 00:08:46,624 Well, I've been in all those places. 198 00:08:46,624 --> 00:08:47,824 I love all those places. 199 00:08:48,484 --> 00:08:52,714 Let's, let's talk about, um, by the way, Dallas, uh, clearly 200 00:08:52,714 --> 00:08:57,894 wins, uh, from a barbecue perspective, um, unless you're, 201 00:08:58,119 --> 00:08:58,719 Dez Rock: Right? 202 00:08:58,809 --> 00:08:59,349 Yes. 203 00:08:59,769 --> 00:09:00,939 Well, you don't, 204 00:09:02,469 --> 00:09:02,769 they'll let 205 00:09:02,979 --> 00:09:03,059 you. 206 00:09:03,244 --> 00:09:03,734 W. Curtis Preston: Yeah. 207 00:09:03,734 --> 00:09:04,014 Yeah. 208 00:09:04,373 --> 00:09:04,703 yeah. 209 00:09:04,703 --> 00:09:07,433 Although of the, of the three cities they win. 210 00:09:07,833 --> 00:09:11,123 Although if I'm in, if I, if I get to choose my Texas cities based on 211 00:09:11,553 --> 00:09:13,253 barbecue, Dallas wouldn't be it. 212 00:09:13,253 --> 00:09:14,333 Sorry folks. 213 00:09:14,333 --> 00:09:14,633 Sorry. 214 00:09:14,633 --> 00:09:15,623 Dallas folks. 215 00:09:16,013 --> 00:09:19,193 I'm a bit of a Austin Barbecue fan, but 216 00:09:19,198 --> 00:09:22,343 anyway, I've had great, but I've had great barbecue in, in, 217 00:09:22,493 --> 00:09:23,483 in Dallas. 218 00:09:23,573 --> 00:09:25,733 Uh, my favorite was at Terry Blacks. 219 00:09:25,845 --> 00:09:26,675 but anyway, we. 220 00:09:26,795 --> 00:09:28,145 Dez Rock: Yeah, that's exactly what I've 221 00:09:28,145 --> 00:09:28,535 heard as 222 00:09:28,590 --> 00:09:31,320 W. Curtis Preston: we could easily have an entire podcast about 223 00:09:31,725 --> 00:09:32,265 Prasanna Malaiyandi: But we're not. 224 00:09:33,195 --> 00:09:33,495 Yes, 225 00:09:33,495 --> 00:09:33,645 but 226 00:09:33,690 --> 00:09:34,080 W. Curtis Preston: not. 227 00:09:34,110 --> 00:09:35,490 That's not why we're here to talk. 228 00:09:35,495 --> 00:09:42,541 So, did you see the way he's reining me in Des so let, let's go back to 2016. 229 00:09:42,901 --> 00:09:50,371 When you, you got this idea to, to, you know, start this new company, 230 00:09:50,671 --> 00:09:53,101 what problem did you see that you were trying to. 231 00:09:53,626 --> 00:09:57,616 Dez Rock: Well, at the time we were Kustodian with a K and we were 232 00:09:57,616 --> 00:10:01,186 professional hackers, so we were pen testers, um, working all over the 233 00:10:01,186 --> 00:10:06,886 world, a small elite bespoke group, um, with clients all over the world. 234 00:10:07,366 --> 00:10:11,951 One of our Australian clients, um, BlueScope Steel, fourth largest steel 235 00:10:11,951 --> 00:10:17,111 manufacturing in the world, uh, had some issues with some ransomware. 236 00:10:17,441 --> 00:10:18,611 I know that's a topic that. 237 00:10:19,571 --> 00:10:20,921 You guys were Yeah. 238 00:10:20,921 --> 00:10:21,551 Wanna touch on. 239 00:10:21,551 --> 00:10:26,171 But, um, had some issues with that and, um, instead of, uh, that, 240 00:10:26,281 --> 00:10:29,141 that we would be testing them every year for their compliance, 241 00:10:29,141 --> 00:10:30,341 you know, for penetration testing. 242 00:10:30,701 --> 00:10:34,541 So they actually asked us, well, are there no tools for this? 243 00:10:34,631 --> 00:10:37,901 Uh, is there no way that we can support or, you know, protect our data? 244 00:10:38,471 --> 00:10:40,061 And we are red team, right? 245 00:10:40,391 --> 00:10:40,721 So we. 246 00:10:41,666 --> 00:10:42,187 I don't know. 247 00:10:42,192 --> 00:10:42,746 Let have a look. 248 00:10:43,041 --> 00:10:44,571 W. Curtis Preston: You're like, we don't do that. 249 00:10:44,571 --> 00:10:45,561 We don't do protect. 250 00:10:45,741 --> 00:10:46,011 We do 251 00:10:46,226 --> 00:10:48,086 Dez Rock: we, we don't do that. 252 00:10:48,086 --> 00:10:49,766 We, we know, we know how to get 253 00:10:49,766 --> 00:10:55,106 in and we we get in real, like we know that we know how to penetrate very well. 254 00:10:55,111 --> 00:10:55,526 Right. 255 00:10:55,886 --> 00:11:00,296 Um, there isn't a area, and that's one of the, like, there isn't a 256 00:11:00,926 --> 00:11:04,076 customer, a location, a challenge that we have not risen to by the way. 257 00:11:04,226 --> 00:11:04,506 Right. 258 00:11:04,556 --> 00:11:06,866 So, Badge of honor that we wear. 259 00:11:07,376 --> 00:11:12,176 Um, so these clients are, so they asked for software to be Blue team, right? 260 00:11:12,206 --> 00:11:16,286 Like protect, and um, to which we said, let's have a look. 261 00:11:16,976 --> 00:11:20,326 And the one name at that time that came up was Splunk. 262 00:11:20,674 --> 00:11:23,854 They can handle really big data and they can do this. 263 00:11:23,854 --> 00:11:28,054 And so we said you wouldn't believe this cuz that Splunk is now, we said, let's 264 00:11:28,054 --> 00:11:29,464 just let you know we're happy to bro. 265 00:11:29,494 --> 00:11:31,104 Like let's introduce you to Splunk. 266 00:11:31,104 --> 00:11:31,504 Right? 267 00:11:32,584 --> 00:11:36,964 So we did and, and Splunk gave them a quote. 268 00:11:39,604 --> 00:11:45,214 And it was at that point, to cut a story short, it was at that point that BlueScope 269 00:11:45,334 --> 00:11:50,914 said to us, is there no way that we could perhaps solve this any other way? 270 00:11:50,919 --> 00:11:51,784 And we said, you know what? 271 00:11:51,784 --> 00:11:53,764 Let's have a look at some open source tools, right? 272 00:11:54,214 --> 00:11:57,739 And so, the need was affordable security for big data. 273 00:11:58,429 --> 00:12:01,999 Um, and that was the, uh, field in which we went into. 274 00:12:01,999 --> 00:12:05,479 And at the time we went with open source tools, right. 275 00:12:05,779 --> 00:12:08,659 And we patched them to, you know, like we basically stitched them up. 276 00:12:08,659 --> 00:12:10,879 We made, you know, like put a cover on it, made it easier to 277 00:12:10,879 --> 00:12:12,229 use, made it easier to roll out. 278 00:12:12,589 --> 00:12:14,099 And that's how SIEMonster started. 279 00:12:14,479 --> 00:12:18,759 And SIEMonster was always, we thought at the time, an annex to what we already. 280 00:12:19,444 --> 00:12:21,344 I mean, we were pen testers, we're hackers. 281 00:12:21,944 --> 00:12:24,974 We thought this is just this cute little project that was happening on the side. 282 00:12:25,064 --> 00:12:25,514 One off. 283 00:12:25,574 --> 00:12:31,304 Well, our, what started like a very small snowball got bigger and bigger. 284 00:12:31,364 --> 00:12:34,784 Uh, the Australian government, including us, Aus Cyber backed us. 285 00:12:35,459 --> 00:12:39,439 Um, to come to San Francisco to rsa, which we were now nominated product 286 00:12:39,439 --> 00:12:40,639 of the year back then as well. 287 00:12:40,849 --> 00:12:42,739 So we started to track momentum. 288 00:12:43,129 --> 00:12:45,859 Uh, we saw that then that's where we saw further needs. 289 00:12:46,069 --> 00:12:47,599 Okay, so this wasn't just a one off. 290 00:12:47,599 --> 00:12:52,459 There really is a need for big data to be secured down at 291 00:12:52,519 --> 00:12:54,259 a far more affordable price. 292 00:12:54,259 --> 00:12:54,679 Right? 293 00:12:55,039 --> 00:12:58,669 Um, because we vehemently believe that, uh, security 294 00:12:58,669 --> 00:13:00,409 should not be gate kept by price. 295 00:13:00,649 --> 00:13:00,869 Right. 296 00:13:01,259 --> 00:13:06,634 So, uh, that's a fundamental that that's, by the way, that's harks back to the 297 00:13:06,634 --> 00:13:10,684 days of when we were hackers as well, because we, uh, participated in the 298 00:13:10,684 --> 00:13:13,234 DEFCON culture way back when as well. 299 00:13:13,264 --> 00:13:15,724 So we were always giving back to community and feeling this way. 300 00:13:15,724 --> 00:13:16,714 So that hasn't changed. 301 00:13:17,104 --> 00:13:20,134 So that is the, uh, origin story 302 00:13:20,404 --> 00:13:20,924 of SIEMonster. 303 00:13:20,939 --> 00:13:22,439 Prasanna Malaiyandi: So just a quick question. 304 00:13:22,439 --> 00:13:24,689 I know you mentioned a couple times big data. 305 00:13:24,689 --> 00:13:28,979 So did you feel that in the big data space there weren't any 306 00:13:29,519 --> 00:13:31,369 tools available that were simple? 307 00:13:31,389 --> 00:13:32,969 There weren't tools available that were 308 00:13:32,969 --> 00:13:34,199 affordable or all the above? 309 00:13:34,328 --> 00:13:37,328 Dez Rock: If we go back to the origin story, the original, uh, thing 310 00:13:37,328 --> 00:13:39,188 was it wasn't affordable, right? 311 00:13:39,408 --> 00:13:43,068 By the way, the SIEM space was not as crowded as what it's now. 312 00:13:43,128 --> 00:13:43,488 Right. 313 00:13:43,908 --> 00:13:45,678 Um, so it's quite different now. 314 00:13:45,683 --> 00:13:48,348 And I know a lot of people are doing a lot of things and that's, that's 315 00:13:48,348 --> 00:13:51,438 really great to see that we're all that, that give, people are giving 316 00:13:51,438 --> 00:13:52,578 Splunk a run for their money. 317 00:13:53,058 --> 00:13:55,218 Um, but I dunno how many people. 318 00:13:55,938 --> 00:13:58,128 Attacking the big data spaces. 319 00:13:58,128 --> 00:14:00,318 You know, there's a lot that will go small, medium. 320 00:14:00,858 --> 00:14:05,418 And the other thing that a lot of, um, people are doing, if you know 321 00:14:05,418 --> 00:14:09,138 this space really well, is they will charge by node or by, you know, 322 00:14:09,138 --> 00:14:10,458 they, they'll charge by endpoint. 323 00:14:10,458 --> 00:14:13,968 And when you do that, you are asking your security operators to pick 324 00:14:13,973 --> 00:14:15,948 and choose what they wanna cover. 325 00:14:16,248 --> 00:14:17,698 Now that's vehemently against. 326 00:14:18,443 --> 00:14:22,433 Belief system too, because if you do not put locks on all your doors, 327 00:14:22,433 --> 00:14:23,753 then your house is not secured. 328 00:14:23,753 --> 00:14:24,203 It's a zen. 329 00:14:24,263 --> 00:14:25,703 It's as simple as that, right? 330 00:14:26,093 --> 00:14:29,373 So, uh, we thought, well, that's a design flaw. 331 00:14:29,483 --> 00:14:31,943 Again, this is red team thinking about blue, right? 332 00:14:31,973 --> 00:14:33,143 Because we know how to get in. 333 00:14:33,533 --> 00:14:36,503 So if you leave a door open, we already know that we're gonna, 334 00:14:36,563 --> 00:14:37,853 like, that's the best way to get in. 335 00:14:38,093 --> 00:14:41,423 So if you're not covering all your end points, then your system is not secure. 336 00:14:41,483 --> 00:14:41,933 Period. 337 00:14:41,933 --> 00:14:43,313 End of story right there. 338 00:14:43,883 --> 00:14:46,223 That's why we decided big data is. 339 00:14:47,388 --> 00:14:48,708 Where we need to aim for. 340 00:14:48,738 --> 00:14:49,068 Right. 341 00:14:49,128 --> 00:14:51,708 And it doesn't mean big data, big organizations. 342 00:14:51,708 --> 00:14:55,548 It just means any data, all data, all encompassing. 343 00:14:56,418 --> 00:14:56,688 Hmm. 344 00:14:57,828 --> 00:14:58,108 W. Curtis Preston: interesting. 345 00:14:58,113 --> 00:15:02,703 So I heard, I heard you say two things that to me sound like they 346 00:15:02,703 --> 00:15:04,263 conflict and they probably don't. 347 00:15:04,263 --> 00:15:05,853 So I just need you to help me understand. 348 00:15:06,153 --> 00:15:09,143 One was you said that you, you, you agree with. 349 00:15:09,603 --> 00:15:12,573 Me that you know, you know, you need to protect everything, right? 350 00:15:12,573 --> 00:15:13,863 If you're not protecting everything. 351 00:15:14,313 --> 00:15:16,623 And then it sounds like you have a solution that's aimed 352 00:15:16,623 --> 00:15:18,063 specifically at Big Data. 353 00:15:18,363 --> 00:15:21,723 So does that mean there's other parts of the organization that 354 00:15:21,723 --> 00:15:22,623 you're not protecting? 355 00:15:22,673 --> 00:15:29,543 Dez Rock: No, what I'm trying to say is that our solution is, uh, is scalable. 356 00:15:30,383 --> 00:15:30,803 Right. 357 00:15:30,983 --> 00:15:32,813 And that's part of the story of our success. 358 00:15:32,813 --> 00:15:33,533 We're scalable. 359 00:15:33,533 --> 00:15:36,893 So it doesn't matter what you throw at us, we will put a circle 360 00:15:36,893 --> 00:15:38,813 around your entire organization. 361 00:15:39,083 --> 00:15:41,783 And if you, if you grow, we grow with you. 362 00:15:41,783 --> 00:15:42,593 It's as simple as that. 363 00:15:42,953 --> 00:15:47,783 Um, and without hesitation, and no one can do the EPS that we do, like the 364 00:15:47,783 --> 00:15:52,193 events per second, the challenges that that requires, like we excel at that. 365 00:15:52,463 --> 00:15:55,673 So when we started, like what started off. 366 00:15:56,098 --> 00:15:56,938 Helping one client. 367 00:15:56,998 --> 00:15:57,568 Let's face it. 368 00:15:57,568 --> 00:16:01,528 Like helping one client then started to become like, how do we, 369 00:16:01,948 --> 00:16:06,898 and it was always with the red, uh, red team, uh, vision, right? 370 00:16:07,408 --> 00:16:10,138 We need to protect everything clearly, right? 371 00:16:10,138 --> 00:16:12,208 We all agree in that if you're not protecting everything, you're not 372 00:16:12,208 --> 00:16:13,828 protecting the entire organization. 373 00:16:14,098 --> 00:16:15,838 So if that's the case, then how do we do that? 374 00:16:15,838 --> 00:16:18,058 But do it really fast as well, because you do not wanna slow 375 00:16:18,058 --> 00:16:19,048 the network down as well. 376 00:16:19,078 --> 00:16:22,948 You see how they all, it's all hand in hand and it all comes down to, again, 377 00:16:23,128 --> 00:16:25,488 the way we do things cause of who we are. 378 00:16:26,008 --> 00:16:31,043 Right, and so that's why big data and all encompassing 379 00:16:31,313 --> 00:16:33,593 Prasanna Malaiyandi: So just pushing back on what Curtis had said, right. 380 00:16:33,593 --> 00:16:37,133 I think probably Curtis, what you were confused about was 381 00:16:37,513 --> 00:16:39,863 probably the big data word, right. 382 00:16:39,863 --> 00:16:40,643 And phrase, right. 383 00:16:40,643 --> 00:16:43,793 I think it's really like Des, like you had said, right? 384 00:16:43,793 --> 00:16:46,793 You scaled depending on if you are a small shop and growing 385 00:16:46,793 --> 00:16:48,293 or if you're a big shop, right? 386 00:16:48,293 --> 00:16:50,273 It's a single solution that you could use. 387 00:16:50,718 --> 00:16:54,918 That scales as you grow versus a lot, I'm guessing in this space there's 388 00:16:54,918 --> 00:16:57,948 a lot of people where it's like, Hey, if you have a small solution, 389 00:16:57,953 --> 00:16:58,818 you're probably not gonna use 390 00:16:59,293 --> 00:16:59,413 Dez Rock: They 391 00:16:59,748 --> 00:17:02,358 Prasanna Malaiyandi: They won't use the exact same implementation because 392 00:17:02,808 --> 00:17:06,318 either it's too expensive to deploy like your enterprise wide, and we see 393 00:17:06,323 --> 00:17:08,418 this in other software stacks as well. 394 00:17:08,418 --> 00:17:08,658 Right? 395 00:17:08,658 --> 00:17:11,688 You have an enterprise-wide solution, which is more complex and has all 396 00:17:11,688 --> 00:17:16,458 the bells and whistles, but, uh, sort of a small medium company, it's too 397 00:17:16,458 --> 00:17:19,868 complex because they may not have the dedicated IT resources to use. 398 00:17:20,608 --> 00:17:23,428 And then you have the opposite problem, where if you have a solution 399 00:17:23,428 --> 00:17:26,038 for small, medium businesses, when you get to enterprise, it 400 00:17:26,038 --> 00:17:29,128 doesn't quite meet the scale and the security requirements and other 401 00:17:29,233 --> 00:17:31,433 Dez Rock: You have hit the nail right on the head there. 402 00:17:31,663 --> 00:17:34,483 So we are a solution that can be used by small, medium businesses 403 00:17:34,483 --> 00:17:37,913 and can scale all the way up to enterprise without a blink of an eye. 404 00:17:38,368 --> 00:17:39,958 Immediately, you don't have to do anything. 405 00:17:39,958 --> 00:17:40,618 It just does it. 406 00:17:40,618 --> 00:17:42,748 So that's part of the technology that we've built in. 407 00:17:42,814 --> 00:17:45,644 and by the way, if you're small, medium, you actually get the 408 00:17:45,644 --> 00:17:48,704 benefit of enterprise grade security. 409 00:17:48,764 --> 00:17:49,544 So there's that too. 410 00:17:50,064 --> 00:17:55,129 W. Curtis Preston: Our audience is primarily data protection focused folks 411 00:17:55,429 --> 00:17:58,699 who might not actually know what a SIEM solution is. 412 00:17:59,209 --> 00:18:02,359 So, uh, and by the way, is, is that, by the way, is 413 00:18:02,359 --> 00:18:04,339 that how it's generally pronounced? 414 00:18:04,339 --> 00:18:06,349 Cuz I've always said SIEM solution. 415 00:18:06,689 --> 00:18:09,329 Dez Rock: I think, um, I think it's pronounced different 416 00:18:09,329 --> 00:18:10,169 in different countries. 417 00:18:10,169 --> 00:18:13,809 And when we saw it, we, in Australia, we saw it as SIEM. 418 00:18:13,859 --> 00:18:14,219 Right. 419 00:18:14,429 --> 00:18:15,929 In fact, we didn't even know what a SIEM was. 420 00:18:15,929 --> 00:18:17,659 We were like something held your pants up. 421 00:18:17,659 --> 00:18:18,299 No idea. 422 00:18:18,419 --> 00:18:19,289 That's where we started. 423 00:18:19,619 --> 00:18:19,799 Right. 424 00:18:20,459 --> 00:18:22,329 Um, uh, it was only later. 425 00:18:22,884 --> 00:18:25,644 Once we named the company SIEM Monster, right? 426 00:18:25,734 --> 00:18:28,354 The way we named it, then we realized that a lot of people call it SIEM. 427 00:18:28,984 --> 00:18:32,994 So, uh, and then we were stubborn about it and we started calling it, right? 428 00:18:33,414 --> 00:18:35,184 Um, that's that too. 429 00:18:35,284 --> 00:18:37,934 SIEM stands for s, it's s i e M, right? 430 00:18:38,444 --> 00:18:41,474 Uh, security info Information event management. 431 00:18:42,784 --> 00:18:45,304 It's another way of saying monitoring software that SOCs 432 00:18:45,454 --> 00:18:46,834 will use, for example, right? 433 00:18:46,834 --> 00:18:48,424 Or any security analyst will use. 434 00:18:48,814 --> 00:18:53,914 Uh, so it's to give you a God view of your entire organization and 435 00:18:53,919 --> 00:18:55,834 the events that happen in there. 436 00:18:55,984 --> 00:18:59,404 Now there is a lot of things, and the definition of SIEM is a 437 00:18:59,404 --> 00:19:01,354 really good one because there's a lot of confusion out there. 438 00:19:01,354 --> 00:19:04,564 People think that are such a searchable database is a SIEM, it's not. 439 00:19:04,984 --> 00:19:06,724 So you need to add some context around. 440 00:19:07,484 --> 00:19:08,684 Prasannas laughing. 441 00:19:08,684 --> 00:19:09,644 Cause I think, you know, it's Right. 442 00:19:10,154 --> 00:19:11,834 So, right. 443 00:19:12,104 --> 00:19:15,824 Um, so you, a SIEM ought to have some enrichment into as well. 444 00:19:15,874 --> 00:19:18,544 And that happens when, um, with recognition that 445 00:19:18,544 --> 00:19:19,714 this needs to be an event. 446 00:19:19,714 --> 00:19:23,344 And then of course we have certain factors like SOAR capabilities 447 00:19:23,349 --> 00:19:28,534 and XDR capabilities, which is the newest version of SOAR, let's say. 448 00:19:28,534 --> 00:19:33,564 And so SOAR, and I'm gonna give a very basic, uh, analogy here, is when we. 449 00:19:34,509 --> 00:19:37,839 Have a rule set apply to events that always happen. 450 00:19:37,839 --> 00:19:41,139 And I like to use the logging, you know, like putting in the wrong 451 00:19:41,559 --> 00:19:42,489 password over and over again. 452 00:19:43,359 --> 00:19:48,339 So when that happens, or someone logs in, like you guys are a Delaware based 453 00:19:48,339 --> 00:19:52,089 company and you're all in Delaware and yet somebody in a different 454 00:19:52,169 --> 00:19:56,549 country is starting to log in, it's flagged from, you know, the location. 455 00:19:56,549 --> 00:19:56,729 Right? 456 00:19:56,729 --> 00:20:00,805 So things like that that you would say these as a ruleset, This is 457 00:20:00,810 --> 00:20:01,984 something that I need to know about. 458 00:20:01,984 --> 00:20:04,474 So it needs to turn into an event to alert me for, right? 459 00:20:04,804 --> 00:20:06,484 So you can write rules about that. 460 00:20:06,484 --> 00:20:07,954 And that's called SOAR, right? 461 00:20:07,954 --> 00:20:09,364 That's S O A R. 462 00:20:09,814 --> 00:20:14,404 So then the next iteration of that in the industry is called xdr. 463 00:20:14,434 --> 00:20:17,314 And what XDR does is a lot of automation of that. 464 00:20:17,314 --> 00:20:21,574 So then it not only picks out the events, it tells you what's happening. 465 00:20:21,754 --> 00:20:24,244 It actually tells you that this is something that you need to do and 466 00:20:24,244 --> 00:20:25,834 sometimes can shut it down as well. 467 00:20:25,834 --> 00:20:26,134 And I. 468 00:20:26,599 --> 00:20:28,069 I do have a story about that. 469 00:20:28,489 --> 00:20:34,099 Uh, when a ransomware tried to get into one of our clients, a large hospital 470 00:20:34,489 --> 00:20:37,819 and the XDR component literally shut it down before anyone could do anything. 471 00:20:37,909 --> 00:20:41,659 Oh, it before it was infiltrated and saved that company. 472 00:20:41,779 --> 00:20:42,109 Yeah. 473 00:20:42,229 --> 00:20:44,509 W. Curtis Preston: So you threw out a couple of, uh, acronyms 474 00:20:44,509 --> 00:20:48,859 there, and we always ask our guests to, to spell out the acronyms, 475 00:20:48,919 --> 00:20:50,179 uh, that, that they use. 476 00:20:50,179 --> 00:20:51,979 So what SOAR and xdr. 477 00:20:55,209 --> 00:20:56,679 Dez Rock: Certainly SOAR is security 478 00:20:56,684 --> 00:20:58,779 orchestrated automation and response. 479 00:20:59,199 --> 00:21:03,009 So as I mentioned, it automates and responds, so it'll give you, you know, 480 00:21:03,129 --> 00:21:07,749 it'll actually run a script and then give you a response as an alert on your 481 00:21:07,749 --> 00:21:09,879 Slack email, however you like to have it. 482 00:21:09,884 --> 00:21:12,849 So something has been done and alerted, certainly helps your. 483 00:21:13,899 --> 00:21:18,219 SOC team or your an analyst have a better idea, you know, so they're not 484 00:21:18,459 --> 00:21:22,899 literally, because what usually happens with any SIEM is that events come in. 485 00:21:22,959 --> 00:21:27,369 You need a way to prioritize them to say what is urgent, what is not. 486 00:21:27,839 --> 00:21:33,249 SOAR will actually handle a lot of the very similar uh, 487 00:21:33,249 --> 00:21:35,489 events that need to be action. 488 00:21:35,934 --> 00:21:37,784 For you, that's what a SOAR is. 489 00:21:38,094 --> 00:21:41,244 XDR or E D R is a extended detection and response. 490 00:21:41,424 --> 00:21:42,894 So it basically builds on that. 491 00:21:43,104 --> 00:21:48,354 And what that is, is, um, uh, the newer, um, technology, 492 00:21:48,354 --> 00:21:50,604 which again involves automation. 493 00:21:51,659 --> 00:21:52,229 As well. 494 00:21:52,499 --> 00:21:59,009 So that will not only tell you that something has actually 495 00:22:08,769 --> 00:22:11,919 W. Curtis Preston: Okay, so, so if I were to summarize these threes 496 00:22:11,924 --> 00:22:15,969 tools, the SIEM tool is the thing that notices that something bad happened. 497 00:22:16,269 --> 00:22:21,579 A SOAR tool will tell you that something bad happened and an XDR e d r tool 498 00:22:21,579 --> 00:22:24,339 will actually respond, uh, that like 499 00:22:24,399 --> 00:22:27,819 it can actually do things to stop the thing from happening. 500 00:22:27,879 --> 00:22:28,569 Does that sound about. 501 00:22:29,814 --> 00:22:34,044 Dez Rock: So a SOAR will tell you true, but a SOAR will actually respond as well 502 00:22:34,044 --> 00:22:37,884 because running on script, you can build custom made scripts as well, right? 503 00:22:38,124 --> 00:22:41,694 So in your organization, you only, you know your organization the way 504 00:22:41,804 --> 00:22:45,474 you, you know, it's, it's, everyone's quite unique in that fashion. 505 00:22:45,774 --> 00:22:46,244 So what. 506 00:22:46,919 --> 00:22:48,539 You can't have out of the box rules. 507 00:22:48,719 --> 00:22:52,109 You definitely need your own set of rules to match your organization. 508 00:22:52,109 --> 00:22:53,099 That's what a SOAR will do. 509 00:22:53,429 --> 00:22:58,829 The XDR or E D R will actually action to take down commonly. 510 00:22:59,009 --> 00:23:04,079 For example, if it's a known attack vector coming in, right, it will actually shut 511 00:23:04,079 --> 00:23:05,759 down that IP and say no more from here. 512 00:23:05,969 --> 00:23:08,789 So that is not just saying, Hey, if this happens, let me know. 513 00:23:09,449 --> 00:23:11,579 This is like, if this happens, let me know and also shut it 514 00:23:11,579 --> 00:23:12,599 down before I even get there. 515 00:23:13,139 --> 00:23:13,529 So it's an. 516 00:23:14,904 --> 00:23:20,484 It's, it's not, before that, it was the ANA analysis or analyst doing the action. 517 00:23:20,934 --> 00:23:23,794 This is now the program actioning, 518 00:23:23,914 --> 00:23:27,214 W. Curtis Preston: But it sounded like you said Soar can do some actions as well. 519 00:23:27,214 --> 00:23:33,079 That's why I was, um, So, and it's, I'm just, again, help me 520 00:23:33,079 --> 00:23:37,999 understand, like with the, with the SOAR tool, the, the main action 521 00:23:37,999 --> 00:23:40,429 that I think it's doing is, is letting you know, right? 522 00:23:40,429 --> 00:23:44,299 It's sending you messages, whatever it is that you want do. 523 00:23:44,829 --> 00:23:45,219 Dez Rock: That's the 524 00:23:45,529 --> 00:23:45,859 W. Curtis Preston: That's, 525 00:23:46,059 --> 00:23:48,429 Dez Rock: So just to clarify, that's the action it's 526 00:23:48,429 --> 00:23:48,729 doing. 527 00:23:48,909 --> 00:23:49,629 Exactly. 528 00:23:50,029 --> 00:23:52,849 W. Curtis Preston: to actually shut down something or block 529 00:23:52,849 --> 00:23:57,199 ports or whatever, that's where a, an XDR e D R tool. 530 00:23:59,064 --> 00:23:59,544 Dez Rock: Correct. 531 00:23:59,604 --> 00:24:03,354 That's when you start to get into that automation side of things where 532 00:24:03,534 --> 00:24:05,184 it's starting to think for you. 533 00:24:05,274 --> 00:24:08,574 It's starting to, and that's where the ai, the exciting part of, you know, the AI can 534 00:24:08,574 --> 00:24:09,774 come into, it's starting to think for you. 535 00:24:09,774 --> 00:24:11,244 It's starting to get to know patterns. 536 00:24:11,544 --> 00:24:14,334 That's where, by the way, there'll be another iteration of this. 537 00:24:14,619 --> 00:24:18,699 So we have, if we can imagine, SIEM would be the core, right? 538 00:24:18,969 --> 00:24:21,549 The core that is protecting all of your data. 539 00:24:21,809 --> 00:24:26,469 SOAR would sit around that, but SOAR is kinda like version one, let's say. 540 00:24:26,469 --> 00:24:30,579 And then you've got xdr, which encompasses all of SOAR Does that make? 541 00:24:30,639 --> 00:24:33,939 So it does everything that SOAR does, but a little bit more. 542 00:24:34,149 --> 00:24:37,389 And I can imagine that as the future goes on, we'll have another 543 00:24:37,389 --> 00:24:38,649 version of that, which will then 544 00:24:38,649 --> 00:24:39,039 include. 545 00:24:39,304 --> 00:24:41,974 W. Curtis Preston: So are these three separate tools then, 546 00:24:41,974 --> 00:24:45,784 or there are tools that encompass all three aspects. 547 00:24:46,185 --> 00:24:48,315 Dez Rock: I'm certain that there are companies saying that 548 00:24:48,315 --> 00:24:51,285 they are three separate tools, but that's not what we think. 549 00:24:52,890 --> 00:24:53,610 Should happen. 550 00:24:53,610 --> 00:24:58,530 We think security should have be able to do all of that. 551 00:24:58,530 --> 00:25:03,860 So even though, you know, we are titled a SIEM uh company, we actually 552 00:25:03,865 --> 00:25:08,220 have SOAR and XDR capabilities and quite quietly working on the next, 553 00:25:09,090 --> 00:25:09,480 uh, 554 00:25:09,480 --> 00:25:09,600 the 555 00:25:09,805 --> 00:25:13,255 W. Curtis Preston: So the answer, uh, and at some point, Prasanna, I'll let 556 00:25:13,255 --> 00:25:17,005 you speak, but I, this is, you're the first person I've had that's really been 557 00:25:17,005 --> 00:25:20,255 able to sort of lay all this out for me. 558 00:25:20,665 --> 00:25:26,630 Uh, So there probably are SIEM tools, SOAR tools, XDR tools, 559 00:25:26,780 --> 00:25:29,150 individual products that I can buy. 560 00:25:29,660 --> 00:25:34,790 Uh, there are probably hundreds of them, uh, but there are maybe a smaller set of 561 00:25:34,795 --> 00:25:38,480 companies that like yours that can do all three 562 00:25:38,565 --> 00:25:39,795 Dez Rock: We'll do all of them. 563 00:25:40,340 --> 00:25:40,490 W. Curtis Preston: Okay. 564 00:25:40,965 --> 00:25:41,325 Dez Rock: Correct. 565 00:25:41,325 --> 00:25:44,635 And even smaller that can handle the data volume that we 566 00:25:44,635 --> 00:25:44,835 can. 567 00:25:45,380 --> 00:25:45,650 W. Curtis Preston: Okay. 568 00:25:46,160 --> 00:25:46,610 All right. 569 00:25:46,615 --> 00:25:47,035 Prasanna Malaiyandi: Yep. 570 00:25:47,515 --> 00:25:49,515 W. Curtis Preston: You, you may now speak for Prasanna. 571 00:25:49,660 --> 00:25:50,740 Prasanna Malaiyandi: Thank you Curtis. 572 00:25:50,830 --> 00:25:56,140 Uh, so Des, when you were talking earlier about sort of, okay, you need 573 00:25:56,140 --> 00:25:57,970 this automation with Soar, right? 574 00:25:57,970 --> 00:26:00,730 To be able to figure out and alert you properly, right? 575 00:26:01,090 --> 00:26:06,640 Um, I think a lot of our listeners may not necessarily realize sort of 576 00:26:06,700 --> 00:26:09,370 the volume of events that may come in. 577 00:26:09,850 --> 00:26:10,090 Right. 578 00:26:10,090 --> 00:26:14,080 Could you talk a little bit about sort of like what you see in some maybe 579 00:26:14,085 --> 00:26:16,210 like small, medium businesses, right? 580 00:26:16,210 --> 00:26:18,510 Where they might be like, Hey, I just have an IT guy. 581 00:26:18,510 --> 00:26:20,260 They can just mi manually monitor, 582 00:26:20,265 --> 00:26:20,560 right? 583 00:26:20,800 --> 00:26:23,500 All these events and why some of these things may not 584 00:26:23,500 --> 00:26:24,070 work yet. 585 00:26:24,291 --> 00:26:25,461 Dez Rock: Well, first of all, let's start 586 00:26:25,461 --> 00:26:26,091 with what. 587 00:26:26,736 --> 00:26:27,766 Like, what is a SIEM? 588 00:26:27,786 --> 00:26:30,126 Remember I said there are some people thinking that a searchable 589 00:26:30,506 --> 00:26:33,516 database is a SIEM because it we're collecting everything. 590 00:26:33,726 --> 00:26:41,256 But that's just, for starters, that sounds like a nightmare because now it security 591 00:26:41,256 --> 00:26:44,466 guy literally has look for, that's, 592 00:26:44,656 --> 00:26:45,076 Prasanna Malaiyandi: Yep. 593 00:26:45,726 --> 00:26:48,276 Dez Rock: that's not telling, giving any ranking. 594 00:26:48,546 --> 00:26:50,386 That's, that's a searchable database. 595 00:26:50,391 --> 00:26:50,916 That's not a SIEM. 596 00:26:51,306 --> 00:26:54,556 So, um, So with a SIEM. 597 00:26:54,556 --> 00:26:58,086 With just a SIEM, the amount, and remember everything is an incident. 598 00:26:58,206 --> 00:27:00,426 It doesn't know if it's a good incident or a bad incident. 599 00:27:00,456 --> 00:27:01,656 It's just an incident. 600 00:27:01,836 --> 00:27:02,226 Okay? 601 00:27:02,526 --> 00:27:06,036 Everything is creating, everything is, uh, giving you a trigger. 602 00:27:06,516 --> 00:27:08,006 So we need to then assess. 603 00:27:08,276 --> 00:27:10,796 If it's a good thing or a bad thing, is it an event? 604 00:27:10,886 --> 00:27:11,216 Right? 605 00:27:11,276 --> 00:27:13,346 So, by the way, if it's an event, is it a good event? 606 00:27:13,346 --> 00:27:13,976 Is it a bad event? 607 00:27:13,976 --> 00:27:15,596 So we start ranking, right? 608 00:27:15,806 --> 00:27:21,266 So we start to say, ok, so when people are trying to break in bad, super bad, right? 609 00:27:21,506 --> 00:27:22,586 Someone turning on the printer. 610 00:27:23,426 --> 00:27:24,086 It's an event. 611 00:27:25,046 --> 00:27:26,186 We don't need to do anything. 612 00:27:26,216 --> 00:27:27,176 There's no alert there. 613 00:27:27,236 --> 00:27:29,246 But it's still, you see, you're still being, it's an event. 614 00:27:29,246 --> 00:27:30,056 You're still recording. 615 00:27:30,966 --> 00:27:32,706 But it's not something that needs to be actioned. 616 00:27:32,916 --> 00:27:36,516 These are very basic examples, but I, I like working with really basic 617 00:27:36,521 --> 00:27:38,166 analogies and then building out, right? 618 00:27:38,586 --> 00:27:41,766 So, um, in that case, Their volume. 619 00:27:41,766 --> 00:27:42,846 You're talking about volume. 620 00:27:43,116 --> 00:27:47,406 Even the bad ones could, like you could have pages and pages, how like that 621 00:27:47,406 --> 00:27:51,366 makes it very difficult and like small to medium businesses usually have one guy, 622 00:27:51,996 --> 00:27:53,526 like you are the security guy, go do it. 623 00:27:53,526 --> 00:27:53,796 Right? 624 00:27:54,336 --> 00:27:56,166 So that's a lot of pressure for one guy. 625 00:27:56,166 --> 00:27:58,086 So you need to make it easier for them. 626 00:27:58,296 --> 00:27:59,256 So that's why. 627 00:27:59,486 --> 00:28:04,016 You know, alerts to, uh, slack channels, alerts to phones, or, because they can't 628 00:28:04,016 --> 00:28:08,366 be sitting there staring at a screen like this is not, uh, wall Street ticker. 629 00:28:08,516 --> 00:28:08,966 Do you know what I mean? 630 00:28:09,026 --> 00:28:12,716 You cannot have that, that you just, you cannot be doing that. 631 00:28:12,716 --> 00:28:17,216 So you need ways to put some, uh, framework around, well, 632 00:28:17,216 --> 00:28:19,976 human flaws like blinking, right? 633 00:28:20,276 --> 00:28:25,706 So we need, uh, a system in which we can, first of all, rank. 634 00:28:26,811 --> 00:28:30,471 And then like I said, a SIEM was probably not enough because it depends 635 00:28:30,471 --> 00:28:31,941 on the volume of data coming in. 636 00:28:32,241 --> 00:28:32,631 Not enough. 637 00:28:32,631 --> 00:28:36,711 So you'd probably want some actionable items to say this usually happens 638 00:28:36,711 --> 00:28:39,681 and when this usually happens, I want if that, then this, right? 639 00:28:40,011 --> 00:28:42,381 Then that's basically what SOAR is, right? 640 00:28:42,381 --> 00:28:45,531 So, um, then I want these things to be done. 641 00:28:46,101 --> 00:28:50,121 Makes your IT security guys life so much easier and 642 00:28:50,301 --> 00:28:52,756 Prasanna Malaiyandi: would you say that that transition from just 643 00:28:52,756 --> 00:28:58,696 a normal SIEM to soar, does that happen at a certain employee count, 644 00:28:58,696 --> 00:29:00,856 at a certain data set size count? 645 00:29:00,856 --> 00:29:05,236 Like what do you, or is it basically everyone should be thinking about 646 00:29:05,436 --> 00:29:08,056 Dez Rock: Everyone think, look, the way it's going is everyone should be 647 00:29:08,056 --> 00:29:10,036 thinking about XDR way at the beginning. 648 00:29:10,396 --> 00:29:13,096 Everyone should, because I think that you right now, you do 649 00:29:13,101 --> 00:29:14,956 not need to run a SIEM, right? 650 00:29:14,956 --> 00:29:15,476 To run a SOC. 651 00:29:15,501 --> 00:29:18,736 You need highly specialized people, and that's a cost point. 652 00:29:19,096 --> 00:29:21,766 Like small to medium organizations cannot be doing that. 653 00:29:22,006 --> 00:29:28,456 So what they need is tools that will make a job easy for an IT person to say, this 654 00:29:28,456 --> 00:29:29,836 is something that needs to be actioned. 655 00:29:30,756 --> 00:29:34,806 The, the benefit of something, and I hate to, I hate shilling, but 656 00:29:34,806 --> 00:29:37,866 the benefit of our product is, is that you don't make that decision. 657 00:29:38,466 --> 00:29:39,066 It's there. 658 00:29:39,456 --> 00:29:40,146 It doesn't matter. 659 00:29:40,146 --> 00:29:43,116 Like if you're small, if you're large from the start, it's there. 660 00:29:44,046 --> 00:29:44,436 Yeah. 661 00:29:44,576 --> 00:29:44,786 W. Curtis Preston: it. 662 00:29:45,906 --> 00:29:46,596 Dez Rock: It's not a choice 663 00:29:46,646 --> 00:29:48,566 W. Curtis Preston: Yeah, and I think the. 664 00:29:49,866 --> 00:29:50,576 The worry. 665 00:29:50,606 --> 00:29:51,086 Right. 666 00:29:51,086 --> 00:29:55,076 Come, you know, there's a lot of us that have been in it for a minute, right? 667 00:29:55,656 --> 00:30:03,986 That's, that's the kids say and um, The worry historically with automated things 668 00:30:04,076 --> 00:30:10,556 that are going to actually do things in my environment to help protect me is that 669 00:30:10,646 --> 00:30:14,036 they're going to trigger too often, right? 670 00:30:14,041 --> 00:30:18,206 That they're gonna, it's obviously, it's the false question, and you, you 671 00:30:18,206 --> 00:30:22,346 know, you've decided that we're under attack and so we shut down the network 672 00:30:22,676 --> 00:30:25,886 or, or whatever it is that, that we've decided that we're gonna do that. 673 00:30:26,126 --> 00:30:26,606 How? 674 00:30:26,636 --> 00:30:27,116 How do. 675 00:30:27,796 --> 00:30:29,626 Get to that level of comfort. 676 00:30:29,718 --> 00:30:32,898 Dez Rock: So well, we have professional services for that, where we actually 677 00:30:32,903 --> 00:30:37,398 rule out, and that's the rule sets that we write to literally customize 678 00:30:37,398 --> 00:30:39,318 that stuff for your organization. 679 00:30:39,323 --> 00:30:41,688 So you've removed the false positives, right? 680 00:30:41,718 --> 00:30:44,178 Because we, you can't imagine that people are going to be able to 681 00:30:44,178 --> 00:30:45,438 know how to do that off the bat. 682 00:30:46,413 --> 00:30:48,813 It's probably one to be left to the professionals, 683 00:30:48,813 --> 00:30:50,043 right, to set it up for you. 684 00:30:50,043 --> 00:30:56,973 Kinda like anything, almost like buying a new, um, apple TV and 685 00:30:56,978 --> 00:31:01,143 connecting it to your TV and needing a professional to come in and help you 686 00:31:03,093 --> 00:31:03,333 set. 687 00:31:03,478 --> 00:31:06,268 W. Curtis Preston: a, as a technical person, the fact that I needed 688 00:31:06,268 --> 00:31:11,758 professional assistance to set up my Apple TV is a, was a bit insulting. 689 00:31:12,028 --> 00:31:14,248 Okay, here's another really important question. 690 00:31:14,298 --> 00:31:19,008 I'm assuming that these tools and, and your tool of course, 691 00:31:19,538 --> 00:31:22,838 They manifest themselves in a couple of different ways, right? 692 00:31:22,878 --> 00:31:25,268 How do people buy these products, put them in? 693 00:31:25,268 --> 00:31:27,518 And then how does your, how does your product work? 694 00:31:27,723 --> 00:31:30,843 Dez Rock: Okay, so this is a very pertinent question right now because 695 00:31:30,843 --> 00:31:34,593 we're about to release version five and we're the only SIEM product out there 696 00:31:34,593 --> 00:31:39,033 that'll be available on AWS marketplace where you, if you're technical enough, 697 00:31:39,363 --> 00:31:42,363 you can actually do it yourself with the support portal and go for it. 698 00:31:42,363 --> 00:31:43,203 You don't need any help. 699 00:31:43,203 --> 00:31:46,213 As done implementations, you'll have it up and running within minutes. 700 00:31:46,953 --> 00:31:49,623 Again, unheard of if you know about any of this, right? 701 00:31:49,893 --> 00:31:50,853 Unheard of. 702 00:31:51,423 --> 00:31:54,603 But we're here to break the, again, we're here to make sure that, uh, 703 00:31:54,633 --> 00:31:56,373 security is not gate kept right? 704 00:31:56,643 --> 00:31:57,483 And that's part of it. 705 00:31:58,113 --> 00:32:02,883 Um, now if that is outside of your technical scope, then we 706 00:32:02,888 --> 00:32:05,973 are here to help implement and, and put that in for you as well. 707 00:32:06,273 --> 00:32:08,073 Um, so you have two 708 00:32:08,073 --> 00:32:08,553 options 709 00:32:08,668 --> 00:32:10,288 Prasanna Malaiyandi: When you do talk about that second case 710 00:32:10,288 --> 00:32:11,458 or even the first case, right? 711 00:32:11,458 --> 00:32:16,618 Is it customer or you are deploying it in their infrastructure? 712 00:32:16,618 --> 00:32:18,508 In their environment on servers? 713 00:32:18,513 --> 00:32:22,858 Is it offered as like a SaaS service that they log into? 714 00:32:22,858 --> 00:32:24,688 Especially if you have multiple sites, so it's 715 00:32:24,688 --> 00:32:25,828 all managed centrally. 716 00:32:25,833 --> 00:32:26,848 Like what does that 717 00:32:26,848 --> 00:32:27,838 deployment model look like? 718 00:32:28,293 --> 00:32:28,653 Dez Rock: Correct. 719 00:32:29,553 --> 00:32:33,543 So the, the unique part of our, um, product is, is that 720 00:32:33,543 --> 00:32:35,223 they all can hold tenants. 721 00:32:35,463 --> 00:32:41,553 So again, if say for example, you are, uh, a small business, you're growing and 722 00:32:41,553 --> 00:32:43,503 now you have different, uh, locations. 723 00:32:43,503 --> 00:32:46,413 So you have different op, you can literally sit different tenants 724 00:32:46,413 --> 00:32:50,643 and have one panel of view, uh, and your system will grow with you. 725 00:32:50,643 --> 00:32:55,833 That this is what I mean about highly customizable and uh, very, Incredibly 726 00:32:55,838 --> 00:32:59,553 scalable, so you could sit different tenants inside right now, off the bat, 727 00:32:59,733 --> 00:33:01,353 through AWS and it's in the cloud. 728 00:33:01,353 --> 00:33:08,253 By way performance, we utilizes technology in order to make this happen as well. 729 00:33:08,263 --> 00:33:09,943 W. Curtis Preston: So you're, you're, you're a service 730 00:33:09,943 --> 00:33:11,383 and I like that very much. 731 00:33:11,443 --> 00:33:15,613 Uh, I do think that that's clearly the way it is going and, and it 732 00:33:15,613 --> 00:33:18,943 makes it so much simpler for a lot of people, especially SMBs. 733 00:33:20,068 --> 00:33:22,333 Um, but I don't understand. 734 00:33:22,333 --> 00:33:27,613 So you're up in the cloud, but you need to, uh, see things, right? 735 00:33:27,613 --> 00:33:33,043 These events that you described, uh, you use that term events per second, right? 736 00:33:33,043 --> 00:33:33,763 E p s. 737 00:33:34,123 --> 00:33:36,523 So how are you able to see these things 738 00:33:36,523 --> 00:33:38,203 that are going on inside my environment? 739 00:33:38,203 --> 00:33:39,303 How do we make that connection? 740 00:33:39,550 --> 00:33:43,600 Dez Rock: So during the implementation stage, you'll be asked to input all of 741 00:33:43,605 --> 00:33:46,660 your data traffic into that to, to us. 742 00:33:46,720 --> 00:33:50,680 You'll actually be told to, or you could actually even have a local agent. 743 00:33:50,970 --> 00:33:54,330 So a virtual local agent within, and then what happens is that 744 00:33:54,330 --> 00:33:56,130 acts as a, um, repository. 745 00:33:56,130 --> 00:33:59,490 So everything goes to that agent, and then it becomes one funnel up 746 00:33:59,490 --> 00:34:04,050 to the cloud that allows for, um, your, your guys are in backup, right? 747 00:34:04,080 --> 00:34:05,580 That allows for two things as well. 748 00:34:05,580 --> 00:34:09,570 That means that if there's a disconnection anywhere, you've actually got local 749 00:34:09,570 --> 00:34:13,260 storage of events, which is really good for forensic and anything else. 750 00:34:13,260 --> 00:34:15,090 It's just due due diligence, right? 751 00:34:15,570 --> 00:34:18,870 And so when the connection is reestablished, it will. 752 00:34:19,930 --> 00:34:22,880 Uh, take all of that, um, events back up to 753 00:34:22,880 --> 00:34:23,240 the cloud. 754 00:34:23,490 --> 00:34:25,170 W. Curtis Preston: That makes a lot of sense. 755 00:34:25,200 --> 00:34:25,950 And then of course I will 756 00:34:25,950 --> 00:34:29,550 need someone to monitor that, the service. 757 00:34:29,580 --> 00:34:30,000 Right. 758 00:34:30,030 --> 00:34:32,010 Um, or I can hire somebody to do that. 759 00:34:32,110 --> 00:34:35,350 Dez Rock: Correct it, it does depend on the, uh, on the skillset of 760 00:34:35,350 --> 00:34:38,470 your staff and your organization, what type of organization it is. 761 00:34:38,470 --> 00:34:41,080 If you're looking for just compliance and just let me know 762 00:34:41,080 --> 00:34:42,730 if someone is trying to hack in. 763 00:34:43,240 --> 00:34:44,110 I think you're good. 764 00:34:44,200 --> 00:34:45,430 Like I, I I think you're good. 765 00:34:45,430 --> 00:34:46,480 Your It can do it. 766 00:34:46,700 --> 00:34:51,280 If your data is incredibly sensitive and you need 24 7 monitoring, then 767 00:34:51,280 --> 00:34:52,600 you would probably outsource that. 768 00:34:53,800 --> 00:34:57,315 And I suppose it comes back to the actual value of having red 769 00:34:57,315 --> 00:34:59,565 team create blue team security. 770 00:34:59,745 --> 00:35:03,435 We think of every, every design element, we don't put just 771 00:35:03,435 --> 00:35:05,655 funnels straight up because what happens if there's a disconnect? 772 00:35:05,955 --> 00:35:07,185 What happens if there's a power failure? 773 00:35:07,185 --> 00:35:09,285 What happens if that, like even that needs a. 774 00:35:10,545 --> 00:35:11,655 That's all been thought through. 775 00:35:11,715 --> 00:35:12,075 Right. 776 00:35:12,435 --> 00:35:15,225 Um, so the redundancy isn't intended to be kept there. 777 00:35:15,705 --> 00:35:18,375 It's, it's intended to just in case there is a disconnection, 778 00:35:18,765 --> 00:35:20,085 a power internet, whatever. 779 00:35:20,325 --> 00:35:20,625 Right. 780 00:35:20,715 --> 00:35:23,505 Um, and these are all the things that have been thought through. 781 00:35:24,105 --> 00:35:25,665 Uh, so the system is secure. 782 00:35:25,785 --> 00:35:26,955 It's not just protecting you. 783 00:35:26,955 --> 00:35:27,855 The entire system is 784 00:35:27,855 --> 00:35:28,305 secure at 785 00:35:28,310 --> 00:35:28,800 Prasanna Malaiyandi: Okay. 786 00:35:28,845 --> 00:35:29,115 Dez Rock: Yeah. 787 00:35:29,140 --> 00:35:30,340 W. Curtis Preston: it's like, it's like, 788 00:35:30,340 --> 00:35:32,200 bank robbers that built a bank. 789 00:35:35,340 --> 00:35:36,120 Dez Rock: Exactly right. 790 00:35:36,120 --> 00:35:39,180 It's just, you know, the other thing, the o the only thing, the 791 00:35:39,390 --> 00:35:43,890 other thing is, is like, it's like, it's like having a motorcycle gang 792 00:35:44,220 --> 00:35:45,810 as personal protection, right. 793 00:35:45,930 --> 00:35:49,380 It's probably, you know, the outlaws that's the trying image I'm trying to get. 794 00:35:49,560 --> 00:35:51,720 It's like having outlaws and going, I'm, these are gonna be 795 00:35:51,725 --> 00:35:53,490 my security guards and you know, 796 00:35:54,030 --> 00:35:56,700 you've got the best damn security guards on you could ever get. 797 00:35:56,700 --> 00:35:57,090 Right. 798 00:35:57,270 --> 00:35:58,350 Because ain't nobody's gonna mess 799 00:35:58,350 --> 00:35:58,620 with you. 800 00:35:59,400 --> 00:36:02,760 Because the p that's exactly the, exactly. 801 00:36:02,820 --> 00:36:03,900 Um, the 802 00:36:04,375 --> 00:36:06,385 W. Curtis Preston: So do you, do you still do the red team 803 00:36:06,385 --> 00:36:09,425 stuff or, or is it, this is going so well that you're not. 804 00:36:09,895 --> 00:36:10,705 You're not doing that. 805 00:36:12,630 --> 00:36:13,320 Dez Rock: Yeah. 806 00:36:13,410 --> 00:36:16,380 So we always keep a foot into the red team world. 807 00:36:16,385 --> 00:36:21,030 We still attend Defcon, um, in Las Las Vegas every year. 808 00:36:21,360 --> 00:36:22,890 Um, and. 809 00:36:23,865 --> 00:36:29,685 We, but unfortunately, um, the, this has overtaken everything and 810 00:36:29,685 --> 00:36:33,555 this has grown from what was a kind of side act to the main event. 811 00:36:33,645 --> 00:36:34,035 Yes. 812 00:36:34,735 --> 00:36:37,225 W. Curtis Preston: I like that, that, I mean, that, that's, you know, you're, 813 00:36:37,225 --> 00:36:40,255 you're clearly meeting a need, uh, and. 814 00:36:40,705 --> 00:36:44,815 If you're helping SMBs to have better security, I am. 815 00:36:44,815 --> 00:36:45,865 I am all for it. 816 00:36:46,445 --> 00:36:48,665 Prasanna Malaiyandi: Des, at the beginning you had alluded to a 817 00:36:48,665 --> 00:36:52,445 ransomware story that you think we might be interested in hearing about. 818 00:36:52,895 --> 00:36:55,595 Um, maybe you want to talk about what happened. 819 00:36:56,102 --> 00:36:56,612 Dez Rock: Oh, okay. 820 00:36:56,612 --> 00:37:01,068 So that, that's one of our clients who's a large hospital. 821 00:37:02,358 --> 00:37:02,778 Most of our 822 00:37:02,778 --> 00:37:03,078 clients 823 00:37:03,083 --> 00:37:03,258 don't 824 00:37:03,268 --> 00:37:04,048 Prasanna Malaiyandi: We're totally fine. 825 00:37:04,228 --> 00:37:04,558 yeah. 826 00:37:04,938 --> 00:37:06,048 Dez Rock: So just bear with me here. 827 00:37:06,218 --> 00:37:08,868 And, and I, and I'm in the, I'm in the Secret Keeper 828 00:37:08,868 --> 00:37:09,678 business, okay? 829 00:37:09,948 --> 00:37:11,028 So a large 830 00:37:11,028 --> 00:37:11,538 Hospital. 831 00:37:13,468 --> 00:37:18,148 Uh, was infiltrated, um, by an incident that was basically going 832 00:37:18,148 --> 00:37:20,478 to be an attempted, uh, ransomware. 833 00:37:20,483 --> 00:37:20,728 Right. 834 00:37:20,808 --> 00:37:27,058 malware was attempt to lock down their system and it was our, um, including the 835 00:37:27,148 --> 00:37:31,733 SOAR and the XDR capabilities, and he, and the project was called Project Skynet. 836 00:37:31,793 --> 00:37:34,088 It was, it's just, Phenomenal. 837 00:37:34,093 --> 00:37:36,858 Once you hear this guy's story about it, I've literally got 838 00:37:36,858 --> 00:37:39,648 a, um, I was so interested. 839 00:37:39,978 --> 00:37:41,298 I had him interviewed right? 840 00:37:41,628 --> 00:37:44,118 And wanted to get what his story out there. 841 00:37:44,118 --> 00:37:47,778 It's a brilliant, brilliant story of exactly this. 842 00:37:47,778 --> 00:37:52,518 It's exactly how, uh, attempt was made and the SIEM did its job. 843 00:37:53,028 --> 00:37:54,258 It literally did its job. 844 00:37:54,258 --> 00:37:55,648 It's kind of like, are you. 845 00:37:56,798 --> 00:38:00,728 Fans of Harry Potter by any chance, you know, the last movie when all of the, 846 00:38:00,728 --> 00:38:05,408 uh, statues come to life and finally start protecting the, uh, castle, right? 847 00:38:05,528 --> 00:38:07,258 So it's a phenomenal SIEM, right? 848 00:38:07,258 --> 00:38:10,898 It's like finally they sit there and, but they find that's exactly what happened. 849 00:38:10,903 --> 00:38:13,928 The SIEM came to life and, and killed the ransomware. 850 00:38:14,198 --> 00:38:17,348 Identified it, knew what it was, shut it down before we could. 851 00:38:18,383 --> 00:38:22,373 This was then passed along to management to say, this is because it's one thing to 852 00:38:22,373 --> 00:38:23,993 say, damn it, we've been hacked or dam it. 853 00:38:23,993 --> 00:38:25,433 We've got ransomware to deal with. 854 00:38:25,583 --> 00:38:25,943 Right? 855 00:38:26,333 --> 00:38:27,443 That's panic mode. 856 00:38:27,683 --> 00:38:29,843 But to hear, listen, they tried it. 857 00:38:30,818 --> 00:38:33,308 But they didn't get anywhere because this was, we stopped. 858 00:38:33,578 --> 00:38:34,418 This was stopped. 859 00:38:34,568 --> 00:38:35,288 It's you. 860 00:38:35,738 --> 00:38:37,388 That's a different emotional journey. 861 00:38:37,838 --> 00:38:39,248 You're not sure if it's like, did it happen? 862 00:38:39,248 --> 00:38:40,028 Did it not happen? 863 00:38:40,033 --> 00:38:40,478 What happened? 864 00:38:40,478 --> 00:38:42,388 You know, like, like, you know. 865 00:38:42,788 --> 00:38:46,088 Um, and so great story for that. 866 00:38:46,088 --> 00:38:50,588 So that's exactly a story that's happened that because ransomware, and 867 00:38:50,618 --> 00:38:51,758 here's the other thing I gotta tell you. 868 00:38:52,058 --> 00:38:52,478 Alright. 869 00:38:52,748 --> 00:38:54,168 Just lean in boys. 870 00:38:54,758 --> 00:39:00,338 Every company that's been hacked, Every company that's had ransomware 871 00:39:00,368 --> 00:39:03,848 attacks, all of these guys have got security software too, 872 00:39:04,388 --> 00:39:04,808 right? 873 00:39:05,283 --> 00:39:05,673 W. Curtis Preston: Yep. 874 00:39:06,458 --> 00:39:07,028 Dez Rock: Just think about 875 00:39:07,083 --> 00:39:07,473 W. Curtis Preston: Yep. 876 00:39:07,713 --> 00:39:11,043 And, and every one of them that were unable to restore 877 00:39:11,043 --> 00:39:13,053 their data had backup software. 878 00:39:13,603 --> 00:39:14,163 Right. 879 00:39:14,313 --> 00:39:16,773 Um, and yet, and yet sit. 880 00:39:17,138 --> 00:39:18,758 Dez Rock: because you know what they say. 881 00:39:18,933 --> 00:39:19,433 W. Curtis Preston: What do they say? 882 00:39:20,363 --> 00:39:21,293 Dez Rock: You know what they say 883 00:39:21,293 --> 00:39:26,723 Nobody gets fired from, from buying a Gartner Quadrant product, right. 884 00:39:27,803 --> 00:39:32,123 Exactly well known, which means security people, and I'm guessing backup people 885 00:39:32,123 --> 00:39:36,113 or two are not doing their research on the technology and the advancements. 886 00:39:36,113 --> 00:39:37,793 They're just doing what everyone else is doing. 887 00:39:37,853 --> 00:39:41,333 They go to Google what is the best thing, what is the best backup pro, whatever, and 888 00:39:41,333 --> 00:39:43,223 going with that, not necessarily the best. 889 00:39:43,463 --> 00:39:46,763 So the companies out there that are being hacked, that are getting ran 890 00:39:46,793 --> 00:39:50,303 ransomware softwares, I guarantee you they've got really, really 891 00:39:50,303 --> 00:39:52,853 well known security software in. 892 00:39:53,753 --> 00:39:55,913 And they're doing a phenomenal job, aren't they? 893 00:39:56,403 --> 00:39:56,763 Phenomenal. 894 00:39:56,768 --> 00:39:57,713 Absolutely brilliant. 895 00:39:58,438 --> 00:40:01,968 W. Curtis Preston: I, I sent, I sense a tad bit of sarcasm there. 896 00:40:06,963 --> 00:40:10,773 Well, Des, you've been, you've been fascinating, you've been entertaining, 897 00:40:10,803 --> 00:40:13,563 uh, and, and very educational. 898 00:40:13,593 --> 00:40:17,463 Uh, I do not know as much about this space as, as I should. 899 00:40:17,793 --> 00:40:22,383 And, and I, I think, I think I'm, you know, I'm, I'm not alone in that. 900 00:40:22,388 --> 00:40:27,633 So, you know, you really helped us understand what that market does. 901 00:40:27,693 --> 00:40:31,768 I, I love this idea of a product that is, You know, I mean, the fact 902 00:40:31,768 --> 00:40:35,668 that your product sort of starts with affordable as, as your leading thing. 903 00:40:36,328 --> 00:40:40,228 Uh, I, you know, I love that the idea that you said that, you know, your, your 904 00:40:40,288 --> 00:40:43,888 the customer that started this, they said they, they wanted Splunk and then 905 00:40:43,888 --> 00:40:45,928 they got a quote and they're like, ha. 906 00:40:45,988 --> 00:40:46,348 Right. 907 00:40:46,348 --> 00:40:47,878 They had, uh, sticker shock. 908 00:40:48,538 --> 00:40:51,088 And, and I do think that that. 909 00:40:52,728 --> 00:40:54,648 Problem cost, right. 910 00:40:54,648 --> 00:40:59,058 Is a barrier for a lot of areas of technology, and I really agree with you 911 00:40:59,058 --> 00:41:05,358 that it should not, you shouldn't have to be rich, uh, to, to have decent security. 912 00:41:05,598 --> 00:41:06,048 Right? 913 00:41:06,108 --> 00:41:09,408 Um, and so I, I'm, I'm glad your company's there. 914 00:41:09,408 --> 00:41:10,668 I'm glad you're doing well. 915 00:41:11,058 --> 00:41:16,548 Uh, I wish upon you that you will have no time left for Red Team Business. 916 00:41:17,058 --> 00:41:17,688 Um, 917 00:41:20,433 --> 00:41:23,103 And, uh, so tha thanks a lot for coming on the pod 918 00:41:23,383 --> 00:41:24,343 Dez Rock: Oh, thanks for having me. 919 00:41:24,343 --> 00:41:24,463 It's 920 00:41:24,463 --> 00:41:24,613 been a 921 00:41:24,613 --> 00:41:25,123 pleasure. 922 00:41:25,193 --> 00:41:25,403 W. Curtis Preston: And 923 00:41:25,498 --> 00:41:27,388 Prasanna Malaiyandi: Des, just, uh, one question. 924 00:41:27,393 --> 00:41:31,828 If, uh, our listeners wanted to find out more information about 925 00:41:31,828 --> 00:41:33,418 SIEMonster, where can they go? 926 00:41:33,418 --> 00:41:33,598 Can 927 00:41:33,598 --> 00:41:35,908 they, like, is there a website they could hit? 928 00:41:35,908 --> 00:41:36,538 Like what should they 929 00:41:36,538 --> 00:41:36,748 do? 930 00:41:37,155 --> 00:41:42,175 Dez Rock: SIEMonster spelled SIEMonster com. 931 00:41:42,595 --> 00:41:43,925 Um, that's our home. 932 00:41:43,930 --> 00:41:48,115 And um, yeah, that's where you can find out more about the product and um, get 933 00:41:48,830 --> 00:41:49,400 W. Curtis Preston: I like it. 934 00:41:49,400 --> 00:41:54,500 I, I wonder if, because of the way we pronounce it in the US I wonder 935 00:41:54,500 --> 00:41:59,330 if people call your company SIEM Monster and they don't understand 936 00:42:00,865 --> 00:42:01,705 Dez Rock: all the time. 937 00:42:02,345 --> 00:42:06,955 They don't understand the J the joke, because remember when we first started we 938 00:42:06,955 --> 00:42:09,350 were like, We, we heard it as SIEMonster. 939 00:42:09,580 --> 00:42:10,330 We were like, haha, 940 00:42:10,480 --> 00:42:10,840 the 941 00:42:11,255 --> 00:42:11,615 W. Curtis Preston: Aren't we 942 00:42:11,615 --> 00:42:12,095 clever? 943 00:42:12,195 --> 00:42:12,400 Dez Rock: Lago. 944 00:42:12,400 --> 00:42:16,360 You know, like, you know, so that's, aren't we clever tongue? 945 00:42:16,450 --> 00:42:16,900 Right. 946 00:42:17,260 --> 00:42:22,030 Um, and we even had, our servers had different names, we had different code 947 00:42:22,030 --> 00:42:24,040 names, we had all had monster names. 948 00:42:24,070 --> 00:42:31,030 Uh, we had Kraken, we had, we had had, we had so much fun coming up with all of 949 00:42:31,030 --> 00:42:35,740 that at the start, you know, when we were just re really start, you know, starting. 950 00:42:37,000 --> 00:42:39,190 So the SIEMonster stuck, had to get rid of, uh, 951 00:42:41,500 --> 00:42:44,080 but we still have them on Slack and they're be private and they're. 952 00:42:46,055 --> 00:42:48,365 W. Curtis Preston: Uh, don't keep that character. 953 00:42:48,515 --> 00:42:49,505 Um, yeah. 954 00:42:49,505 --> 00:42:51,275 So, uh, Prasanna, thanks. 955 00:42:51,275 --> 00:42:52,055 Uh, thanks. 956 00:42:52,175 --> 00:42:53,525 You know, great conversation. 957 00:42:54,305 --> 00:42:55,895 Prasanna Malaiyandi: as always then thank you. 958 00:42:57,515 --> 00:42:58,025 W. Curtis Preston: All right. 959 00:42:58,025 --> 00:43:00,425 And, uh, thank again to our listeners. 960 00:43:03,495 --> 00:43:08,205 The backup wrap up is written, recorded and produced by me w Curtis Preston. 961 00:43:08,775 --> 00:43:10,245 If you need backup or Dr. 962 00:43:10,245 --> 00:43:13,875 Consulting content generation or expert witness work, 963 00:43:14,175 --> 00:43:16,125 check out backup central.com. 964 00:43:16,875 --> 00:43:19,995 You can also find links from my O'Reilly Books on the same website. 965 00:43:20,655 --> 00:43:24,735 Remember, this is an independent podcast and any opinions that you 966 00:43:24,735 --> 00:43:26,655 hear are those of the speaker. 967 00:43:26,720 --> 00:43:28,580 And not necessarily an employer. 968 00:43:29,480 --> 00:43:30,200 Thanks for listening.