Episode 01 – Sec Ops Efficiency 

Podcast Guest Introductions

Host
Welcome to our latest podcast episode. I’m your host, Charlotte, and I’m here today with Peter and Andy. Welcome.

Before we get started, obviously, we’re here to talk about SecOps today. But before we do, why don’t you guys just take a minute to introduce yourselves?

Peter Jones
Great. Thank you very much. Pleasure to be here. So my name is Peter Jones. I’m a cybersecurity specialist. I’ve been in the industry for longer than I care to remember.

Mainly focused on public sector.

Host
Yep. Excellent. Andy?

Andy Le Grice
Hi Charlotte. My name is Andy Legrise. I’m the security practice lead. I work with Peter and our wider, teams to, ensure we deliver the services that, our our clients expect us to deliver.

Host
Excellent. Well, it’s really nice to have you both here. I’m actually quite looking forward to this, conversation because security, cybersecurity is obviously a big issue at the moment. Everybody’s talking about it.

And, specifically, we’re here today to talk about it with regards to the public unique challenges that they have.

Evolving Public Sector Threat Landscape

Host
Might be good to start on how has this how has the landscape around this changed for the public sector over the last few years?

Peter Jones
Oh, I can probably pick up on that.

Yeah. It’s it’s changed massively, and I think the, most daunting thing is that those changes are only accelerating going forward.

So, you know, if we take a look back a few years, you know, we can go pre pandemic when everyone was typically working within their their network.

Obviously, pandemic hit, everybody started to work from home, and no one really came back. So now pretty much everybody is able to work in a hybrid environment, couple of days in the office, couple of days at home. That has clearly expanded the tax office massively.

So we have that remote work issue, which is obviously a bit of a challenge.

But we also then, if you look back over the last few years, cloud first was, you know, a massive topic for everybody.

That’s pulled back a little bit now. Everyone went all into the cloud.

Then they realized potentially how much it can cost Mhmm. And they’ve pulled it back. So now again, most people are in this sort of hybrid environment where they have plenty of applications within their on prem data center, but they’re also then using some applications either in an IaaS environment or in a SaaS environment.

And I think probably the third main challenge is the the threats and how they’ve evolved over time.

Obviously with the expanded attack surface, we’ve got more to cover. We’ve got more to think about which is a challenge in itself.

But with AI, of course, coming down the the the road, this has now increased the speed of attacks that we’re seeing dramatically. From that point of identifying a vulnerability to the point that that vulnerability is breached has reduced dramatically.

So I think from my point of view, that’s probably the, the key areas.

Cybersecurity Skills and Resource Shortages

Andy Le Grice
Totally agree. I mean, there’s there’s one key point as well that, that has become pretty obvious over recent years and that is the fact that there’s real competition for the for the skills Mhmm. People skills, the capability, that form a key part of an organ organization’s defense and ability to to cope with the the demands on an organization to provide effective cyber defenses. So as well as all of the the the technical advances and therefore the advances in the the threats that every organization faces, which is when they have to evolve their defenses from a a technical perspective, there’s also the the the the people skills, those, security specialists to to consider. And that’s where we see a lot of the challenges, isn’t it, around the, around the sector. Yeah. It really is.

Host
Mhmm. You know, it’s interesting, is it? Especially what you say about speed of response because I’m guessing a lot of the way things are currently set up is to detect thing or to detect things over time, maybe in weeks, but now it’s shrunk down to hours as to when things can drastically change.

Peter Jones
Mhmm. That’s right.

Host
So, you touched on, skills shortages there. So what what’s the the biggest impact of those skills shortages on the public sector? And what what can they do about it? Because, obviously, one of the challenges for the public sector is a lack of resources, not just people, but money, financial financial resources, and and often they struggle to compete with the private sector. So what are some of the impacts of that that you see?

Peter Jones
Yeah. It’s it’s it’s massive, and it’s a major challenge for everybody.

In fact, there’s a common theme actually that that works through most of the conversations that we have.

Obviously, every organization has their own unique challenges. But in almost every conversation, it’s that lack of resource. It’s like, you know, no one’s ever told me they’ve got more than enough money and how can I spend it? So not had that conversation yet, still waiting for it. Yeah.

Definitely a lack of people. So, again, as the security architecture has evolved over the years, most organizations are dealing with maybe twenty or thirty different security tools. And when you’ve only got maybe one or two people that are responsible for managing those tools, it becomes incredibly challenging.

So certainly, it’s the lack of budget, it’s the lack of people, but it’s also the lack of skills or specialism to be able to utilize the tools that are in place effectively, which I think really is, is an issue.

Technical Deployment and Human Behavior

Andy Le Grice
And and what what we often see is, sadly, as we’re, aware, many IT projects fail to deliver, the promises, that they that they claim to deliver upfront. And cybersecurity is is no different. So when, technical solutions are rushed into place or partially deployed, that typically creates a lot of friction for end users, and, sadly, increases the admin overhead, for the the security analysts and the the operations teams.

We were talking to an NHS trust recently, around the use of Microsoft conditional access, and their deployment was not quite as considered as it may have been. So what they’ve been doing is is simply turning it off when users need to access services. But they’re they’re doing that, in a in a rather crude way. So the the user is impacted.

The security of the organization is certainly impacted. And, of course, the workload for the for the team, the security operations team, increases. So the the lack of skills that may well exist in many organizations at the point of deploying technical controls leads to a rather, significant knock on effect.

Host
Interesting. Interesting.

Peter Jones
I I I can probably extend that, actually. The the the the number of times I’ve walked into an account and, you know, they’ve talked through the security controls they have in place and, it typically, it gets to the IPS, the intrusion prevention system.

Host
Mhmm.

Peter Jones
And, you know, they spend a lot of money on this thing. They’re they’re expensive tools.

And the number of times I’ve heard, yeah, well, it it was producing an awful lot of alerts. It was it was flashing all of the time and we just decided to turn it down until it stopped flashing. And, yeah, okay. That’s not exactly the point. But alright.

Host
See, people never never allow for human behavior, do they, in human adaptation to stress points when they’re just designing these processes.

Securing Asset Visibility and IoT

Host
So one of the points you mentioned at the beginning was around, visibility across the estate. You mentioned that right at the beginning. So what, I guess, what are the risks there?

Is it just about spottering vulnerabilities? And what do what do many people miss? And and to your point that you just said where you don’t accommodate for human behavior, what what are the things that they often miss or don’t consider?

Peter Jones
Yeah. This this is another really common theme across all of our accounts.

You can when when we qualify accounts, we we obviously need to talk through the estate and and, how they’re managing the various components within the estate.

One of the questions I ask is, how confident are you that you understand exactly what’s connecting to your network?

And the response is generally, yeah.

Host
Yeah. Ish. Ish.

Peter Jones
Sort of. Yeah. You know, I think I’ve got a good idea. And, you know, honestly, that’s that’s simply not good enough in today’s world. You could almost get away with it in yesterday’s world, but but right now with the speed of attacks and how they’re happening, it really is absolutely critical to understand exactly what’s connecting to your network, how it’s connecting to the network, and obviously, what you need to do to protect it.

Host
If you

Peter Jones
can’t see it, then you can’t protect it.

So visibility is absolutely key. And, typically, it’s it’s generally okay for the IT estate.

You know, most people know who which users are connecting in. But as soon as you look at IoT devices, cameras, quality sensors, anything like that, that’s typically the estate’s problem. It’s somebody else’s issue. Yeah.

Or we’ve put it into a zone where we don’t need to worry about it. And the bottom line is you do. You know, that’s the low hanging fruit for most hackers to come into an organization, target the stuff that is not being updated or patched regularly. And then once you’re in, you’ve got that opportunity for lateral movement.

Yeah.

Andy Le Grice
And and and of course, when you’ve established that visibility, to some extent, the problem moves on, doesn’t it? You you then have the visibility, and you suddenly realize how many vulnerabilities you do have in your estate. And then and then you have to carefully consider how you go about prioritizing those, those vulnerabilities.

How you go about remediating the the the risk associated

Peter Jones
Mhmm.

Andy Le Grice
With those, those vulnerabilities. Yeah.

Peter Jones
Most most organizations are absolutely overwhelmed by the number of vulnerabilities they have.

Andy Le Grice
Absolutely. And and some of them may be on, associated with services or devices that just aren’t used or just don’t offer any significant value to the organization. So once you’ve established that visibility, you then have to prioritize how you’re going to mitigate the risks associated with those those vulnerabilities.

Optimizing Integrated Security Architectures

Host
Yeah. And that’s that’s quite a minefield to unpick, isn’t it, given some of the other things you’ve been talking about? So they haven’t got bottomless resources financially or people Yep. To solve the problem. And if you’ve got different teams responsible for, managing those, like you say, you’ve got facilities management who might be responsible for cameras. You’ve got utilities that might be responsible for other types of equipment.

Where do you even start, and how do you even prioritize that? And and I guess that must feel quite overwhelming for these for these organizations.

Peter Jones
It it really is. And again, you know, these things have built up over many, many years. And typically, it’s responding to the latest threat that’s come into that market at that particular time. So you do end up with this whole, you know, Frankenstein of a a sort of security architecture built up of many, many different security controls.

So I’d I’d suggest, you know, for the organizations that are limited on resource and really thinking about how they can optimize their their capabilities, think about the security architecture as a whole. Mhmm. So, you know, maybe take a step back and think about all of the security controls that exist within the architecture. Now that could be everything of course from your endpoint security, but it goes through email security, your identity access management, your web proxies, your firewalls, your IPS, your IDS, behavioral analytics, it goes into the cloud and all of those controls as well.

Take a look at that list of controls that you have and ask yourself just, you know, are they serving you? Are they integrated?

Are they sharing threat intelligence?

And are you able to monitor those controls in a way that will allow you to have an effective response in the event of a breach?

I’ve got to say, for for a lot of our accounts, the answer to that question right now is no.

Host
Mhmm.

Peter Jones
And if that is the answer, then it really is time to either do your own review, your own gap analysis, and and see really how you can improve those integrations, Or talk to a a trusted third party and bring those specialists in to do that security maturity assessment.

Host
Mhmm.

Peter Jones
Understand where those gaps are, and then talk about how we can build up on those integrations to be able to present the data in a way that can make your teams as effective as they can possibly be

Host
Yeah.

Peter Jones
Given the limitations that you have.

Andy Le Grice
And that that’s exactly where we spend a lot of our time. So effectively making best use of what our customer organizations already have. Yeah. So so typically, there’s a lot of capability that’s left untouched from, let’s say, for example, from a Microsoft perspective where there might be, an enterprise agreement, that offers a lot of services and and capability, particularly from a security perspective.

But coming back to the skills, shortages that many organizations face and the fast moving pace of of change, the demands on the IT team as a whole, often capabilities are left sitting on the shelf as people say, which could be put to good use. And not only put to good use, but deployed in an effective, efficient way that helps the administrators, from the reduce their workload, reduces friction from an end user perspective. So we we do spend a lot of time working with our clients, on exactly that area.

Leveraging Existing Software Licensing

Peter Jones
Yeah. And and this is where the public sector actually generally have a real advantage because whether you’re talking sort of education or whether you’re talking health, there’s an opportunity there to have, licensing at a relatively low cost. So for instance, in the university sector, most of the universities we find have a Microsoft a five license.

Host
Mhmm.

Peter Jones
That’s a very very powerful license giving you a whole range of security controls. Yeah. But honestly, most of the time are not actually optimized completely.

But the same is true from the networking world. If you’re sort of a networking led organization, there are security controls, within, you know, Cisco identity services engine, for instance, that can really give you some advantages to segment the network effectively, and and really improve the security profile of your organization.

So looking at the existing licenses that you have today Mhmm. And how you can optimize them, I think is is absolutely key.

Host
And that probably helps from a cost perspective as well, doesn’t it? In terms of optimizing on the licenses and maybe understanding what they do and don’t need.

Peter Jones
Mhmm.

Host
Which can help then fund other sort of security initiatives.

Peter Jones
And where there’s overlap Yeah. As well. It’s like, where can you maybe get rid of some of these controls because it’s handled in a in a different way elsewhere?

Host
Yeah. And I I guess as well, it’s interesting.

I know I’m digressing very slightly. So, but looking at things holistically to your point must be very necessary because I guess it’s like any complex environment, changing something over here could inadvertently impact something negatively elsewhere or more than one thing. So are there times when you’ve seen that you’ve seen that and sort of how how can they sort of make sure that doesn’t happen?

Maintaining Security Through Cultural Change

Andy Le Grice
Well, absolutely.

And and sometimes, what we do see is planned change leading to enforced unplanned

Peter Jones
change

Andy Le Grice
from a from a security Yeah.

Perspective. So where we have, diverse organizations in terms of siloed teams within that within that organization.

A key feature is to ensure that the the culture around security is in place so that security is always considered along with any, as a fundamental element of any IT project. Now I think things have improved from where things were many years ago, but we still see security teams struggling to respond to to changes that are taking place either planned or unplanned, within within the organization.

Peter Jones
I think just to to add to that, it it it’s also a really good practice to go back to basics. It’s, again, just talking about that visibility.

Ask yourself, do we know exactly where our critical assets are? Mhmm.

Especially now as we’re moving into cloud and, you know, these applications and the data stores are now moving around in in in various

Host
They’re not in little black boxes in the corner.

Peter Jones
They’re not in that little box. Exactly. Yeah. So understand, where the data is held. Yeah.

Do you know who owns that data? Who is the line of business manager that is actually responsible for that that piece of data? And is that line of business manager, applying the security policies that are relevant for that data.

Host
Mhmm.

Peter Jones
Again, you know, it’s it’s worth having a check and a review of that because you do lose track over time

Host
Mhmm. Of

Peter Jones
where this data is held and who’s got actually responsibility for applying the the security policy that is relevant for that data.

Host
Yeah. Yeah. And documenting who that is and sort of managing when people exit the organization. Is that is that knowledge retained?

Peter Jones
Yeah. Yeah. Absolutely. Yes.

Incident Response and Breach Planning

Host
We’ve talked a lot about prevention, detection, and visibility.

But in in your opinion, I think I know what the answer might be.

Do organizations spend enough time preparing organization that knows there’s been a breach. Often it’s a third party that’s been impacted that lets them know. So do do organizations spend enough time on that?

Andy Le Grice
So I I think some do, but, unfortunately, they are the minority.

Peter Jones
Mhmm.

Andy Le Grice
And I I think we’ve covered a a number of reasons as to why this is the case. There’s a lot of the time, that the teams are understandably effectively trying to keep the lights on, keep things running from a from a day to day perspective.

And often where there are proactive planning sessions put in place around disaster recovery or instant response planning etcetera, they tend to fall by the wayside at that point in time. But they are obviously very very important.

So a lot of this is about processes. It’s it’s not really about the technology. Yeah. So, the technology, the the controls from a security perspective help prevent that incident, that breach in the in the first place, and they also help tell us when that incident has occurred. So sooner rather than later is obviously good, And there is a slight shift towards detection, rather than prevention because many organizations accept that they will sadly ultimately be breached at at some point.

Host
Yeah.

Andy Le Grice
But planning is absolutely key.

So ensuring that all of the stakeholders, across the organization are aware of what to do, what their role is

Host
Yeah.

Andy Le Grice
When an incident occurs, depending on what type of incident it is, will dictate exactly what that response is going to be.

So putting out, putting aside some time to run through different scenarios will help the organization determine what their course of action should be, what the implications are, what they need to ready themselves for in the event of that, becoming a reality. But also, they may determine that they will need some outside help.

So if there’s a catastrophic incident, they may need to call on some specialists, to assist them, to, for a speedy, a meaningful, effective recovery. So really, it’s all about planning, isn’t it?

Peter Jones
Yeah. It’s that preemptive action isn’t it?

It’s

Host
Which human beings are so good at.

Peter Jones
Well exactly. Yes. That’s that’s right.

Certainly when you’re planning for a breach, because you should, you know, you should absolutely expect that a breach is going to happen, at at any point.

The best thing is, of course, to be prepared. So we’re gonna talk about bringing in third parties.

It’s almost a little bit too late if the breach has already happened to bring in that third party. Obviously, if if you’re in that situation, bring in the specialists as quickly as you can. But the, the best way to do it, if if possible, is engage with that third party in advance. As you say, do the tabletop exercises. Do the work the walk throughs.

Prepare for the breach, and then practice, practice, practice. Yeah. So, you know, run through those exercises as long as you can and, ensure that everything that you prepare for is maintained and kept up to date, not just put in a drawer and forgotten about till next year.

Andy Le Grice
Yeah. And, of course, ensuring those plans, are going to be available if the worst does happen rather than, sitting in a cloud service that you can no longer access.

Peter Jones
Yeah. That’s right. Very good. Yes. That’s true.

Host
No. That’s it’s a good point. I know someone who works in, contingency and and business recovery, and and they insist everyone has a hard copy in a locked area in the office because if the cloud goes down, then where do you go?

Andy Le Grice
Absolutely. It it sounds almost comical, it’s true and often the first point of failure.

Host
Yeah. Definitely.

Peter Jones
Yeah. In fact, I mean, if you are really short of resources and if, you don’t have a great budget, you don’t have a lot of people, probably one of the most powerful things that you can have is a piece of paper with a list on it. Yeah. It’s a list of if anything goes wrong, who do I call?

Mhmm. If they’re not available, who else can I call? Yeah. Who’s responsible for which action, and are they aware that they’re responsible for that action?

And in which order should I go through this list in order to respond effectively?

If you have that one piece of paper, you’re generally ahead it, it, it

Host
I love that.

I love how simple that is because it because it’s all in people’s heads, isn’t it? And people know information. So, yeah, I like that.

Andy Le Grice
There’s there’s some good guidance on the NCSC website, actually, about planning, for for for instance, obviously, how to prevent them. There’s a lot of, a lot of time, dedicated to that, but how to respond in the event of an incident. So the a lot of it, as we’ve already covered, is common sense, and the NCSC have done a good job of, guiding people in the right direction. So it’s well worth a look on their website.

Host
Yeah. Good. Alright. We’ll we’ll put a link link to that on the screen.

So just just sort of ahead of wrapping up, just got a couple more questions. And, actually, one of them sort of leads on nicely from that simple paper list. I really like that idea.

Budget Optimization and Attack Surface Reduction

Host
But what what are some other sort of offset options for public sector organizations that are really pushed for budget and resource, resource who want to do all of those things. You know, I guess, what are the top things they should be doing, and and how can they offset smaller budgets?

Andy Le Grice
Yeah. So so Peter’s talked about getting the getting the basics right, which is is often easier said than than done. But it it is true. So if we if we really do go back to basics, what we are looking at is ensuring that we are minimizing our attack surface. Surface.

So what that really means is turning off any services, any devices that we’re not using to reduce that opportunity, for the for the threat actors.

We need to be on top of our patching, and we’ve talked about backups. So ensuring that, that that our backups are in place. All of these things are known good. I only said best practice but they’re good fundamental practices that we should be following, from both a disaster recovery and a cyber security perspective.

And then we can build out processes on on top of them. And we’re not talking about complex processes.

And one of the most effective ways that we have found, pushes modest sized organizations to maintain such standards is by gaining and then retaining cyber essentials.

Because the NCSC’s cyber essentials program is all about getting the basics right. Yeah. And being able to demonstrate that you have a sound grasp of the requirements of good cybersecurity hires.

Host
They do that, they’re in a pretty strong strong position.

So how would they weave in, so obviously endpoint devices and you touched or you I think you both spoke about hybrid working earlier.

Transitioning From VPN to Zero Trust

Host
How what what’s a good basic way for them to get control of that part of it? Because that’s the hardest bit to control, isn’t it?

Peter Jones
Well, it’s yeah. It’s a challenging bit to control, and it’s it’s changed very recently, of course, with the pandemic, with people moving, to to a remote work situation.

And it was interesting to watch, actually, to go through this process because when the pandemic first hit, there was a knee jerk reaction to enable people to work from home. And therefore, we saw this massive uptake of VPN capability, you know, upgrading the the VPN concentrators to be able to bring in more and more connections. And that was great and it worked very well and our people managed to overcome that hurdle very very effectively.

Now we’re a little bit more mature. We recognize this is gonna be very much for the long term.

And VPN, you know, does have its challenges.

It it was a technology that was very much evolved to enable users to connect through and connect onto the network and then of course connect through to the data center. But now as those users are connecting directly to cloud based SaaS applications or maybe going to IS applications, the need to backhaul all of that data into, the, the the the core network and go through that central security stack is now reduced and it doesn’t actually help the user experience as well. It delays that process.

Host
It slows it right down. Yeah.

Peter Jones
Isn’t it? So, VPN is is fine. However, if you have an opportunity to think about zero trust access and establishing that per user per device session based access to the application Mhmm.

Where you can actually not only improve the security for that particular individual at home, but you can also improve the user experience as well. It’s a sort of win win all around. Mhmm. Then that’s a very positive, thing to build up your capability for remote work.

Andy Le Grice
And you’re typically reducing costs at your central or hub sites by, reducing the bandwidth that’s required. Of course. Tromboning the, the traffic into the network and straight back out again. And typically, these connections are terminated on firewalls, so they’re having to work less hard. The firewall spec could arguably come down. So, I think if we were to start from scratch we would not really design, today’s, or yesterday’s VPN services to allow connectivity to services that are largely cloud driven, cloud hosting.

Peter Jones
That that’s right.

And again, at at that point, you have the opportunity to use a completely unified security policy across all of your users

Host
Nice.

Peter Jones
Which actually makes it easier for the sec ops team as well to to manage and control.

It also then gives them visibility of exactly what’s going on and how these connections are being established. Mhmm. Kind of visibility of all of the workflows, both client server and also server to server workflows as well. And if you have that level of visibility, then you’re actually putting yourself in a great position to be able to respond effectively if you are breached.

Host
Which circles back very nicely to the beginning of what we were talking about with our holistic view. So just just to finish up on, because I think and I know this is a question you guys get a lot is, and and maybe if you can squeeze it into three points, then do.

But how can they leverage their their infrastructure? You touched on tools earlier, sort of making sure they’re getting the most out of their those. But how can they do it with what they already have? What are some of the things they should consider?

Peter Jones
Well, I think from, from my point of view, it will be, really understand your existing licensing. It’s think about, what you have in place right now, what capabilities. You know, do you have an a five license from Microsoft? Do you have any, maybe, capabilities within your networking estates that you can perhaps leverage.

Look at that and see whether you can enable your security architecture to start working for you rather than against you.

Host
Mhmm.

Peter Jones
So thinking about those integrations, thinking about how those security controls are presenting themselves to enable you to understand the full extent of a breach, and then, again, it’s leading back to that ability to be able to respond effectively if you do notice those, those things happening.

Andy Le Grice
Yeah. Associated with that, because many or most, arguably, security services are delivered via the cloud.

Features are being added all the time. Features, capabilities.

So many organizations don’t know that they have much increased improved capability sitting there waiting to be used. So it’s not as though they haven’t necessarily enabled the use of a of a licence or a service, but that service itself has evolved.

So so, again, we spend a reasonable amount of time working with our our clients to ensure that they understand and they know what is available to them. So it’s it’s a similar point, but it it’s slightly different.

Host
Yeah. No. It’s it’s a very very good point. And, yeah. So thank you both for your time today. You know, I’ve found it genuinely very interesting, and I what’s nice to hear is that while there’s a lot that you can do and there’s a lot that you have to consider, there were some great points that came across that I think will make it quite practical for public sector organizations to make a start and at least see that they that they’ve got the even with limited resources, they they can make a start and do effective things to get to that, like you say, that good practice stuff.

So

Andy Le Grice
Absolutely true.

Host
Thanks both very much. Great. Thank you, Charlotte.

Peter Jones
Thank you very much. Thank you.