Citi

Jason is an Information Security Executive specializing in constructing information security programs and leading teams within heavily regulated sectors such as finance, healthcare, and insurance. He possesses extensive expertise in identifying risks and threats, as well as implementing robust risk mitigation strategies to bolster security and meet policy and regulatory mandates effectively.

Please tell us about the journey that you've had so far and your roles and responsibilities.

I have been working in the industry for over 20 years, with a primary focus on security for approximately 18 of those years. Throughout my career, I've observed a common trajectory where individuals typically start in specialized security roles that were less prevalent when I began. My own journey has encompassed various positions including administration, architecture, penetration testing, and progressing into larger design and program management roles. I've also engaged extensively in consulting, splitting my time fairly evenly between consulting and full-time employment. My experience also spans financial services, as well as stints at a cloud service provider. In addition, I've worked in other regulated industries and government sectors, both within and outside the United States. This diverse background has afforded me insights into different markets and regulatory environments.

What are some of the challenges in securing cloud architecture that current services are unable to provide an optimal solution for?

CSPs claim their services are secure by default, but it’s incumbent upon customers to assess their suitability for specific needs before implementation. It takes a lot of effort to configure a cloud service to build a high-security and/or regulated level of implementation and depends on many adjacent processes and tooling to exist in concert to achieve a secure cloud. It involves dynamic processes and tools such as IAM with MFA, Federation, and Policy design, diverse deployment methods (pipelines, console, SDK), drift detection tools for change tracking, activity monitoring through logging and guardrails, encryption with key management, image scanning for containers, and threat modeling to identify necessary controls.

Are there emerging technologies in Cloud Security that you believe can significantly enhance our ability to protect sensitive data and meet our organization's business requirements more effectively?

I believe in the primacy of strong processes to underpin effective programs and enforce controls. While tooling automates and orchestrates processes, the core lies in well-established procedures for protecting sensitive data. Exciting products now integrate security patterns early in the development cycle. These tools integrate with developers' IDEs, allowing them to incorporate predefined security patterns, controls, and code examples during ideation. This "shift-left" approach empowers developers to proceed swiftly without being hindered by security and compliance checkpoints. However, these tools are best suited for high-maturity organizations that have established patterns, policies, standards, and threat models. Major advancements in cloud tooling for data protection remain scarce, with most relying on established methods like IAM, ACL, encryption, and monitoring. The innovators are leveraging cloud-native services to enforce desired behaviors, employing highly opinionated cloud management and configuration so that they can have preventative/detective/responsive controls in place so that tenants cannot make the errors that lead to information disclosure or prevent bad actors from exploiting misconfigurations.

“Incorporating information from various sources is not enough; it's crucial to make all data discoverable and query able. Enabling this capability allows for enriching other security processes and maximizing the value of collected information.”

What technology trend in cyber threat detection and response for the cloud captures your interest the most, and why?

In my recent roles across various clients, a common task has been to develop a program that identifies controls through threat modeling, focusing on Directive, Preventative, Detective, and Responsive measures. Providing businesses with this contextual framework is crucial for addressing the challenges of cloud security effectively. Over time, the industry has introduced numerous tools aimed at tackling this issue. My approach involves building the core content of our security measures, which changes how I evaluate tooling. Rather than solely relying on vendors for guidance, I seek tools that augment my process and increase control effectiveness. While this approach offers significant benefits, I understand that not all companies have the resources to invest in extensive development. So I’ll say to them to consider that even the best tools are extremely limited by at least a few perspectives so you then have to decide what you are willing to give up if your investment is put into tooling vs. process.

Could you provide specific project details where you dealt with a security issue or threat?

I once worked with an energy company in the south of England that had been acquired by a French company. My role as a cloud consultant was to provide guidance, training, and design support. During a training session in the console, I received a notification about leaked credentials in one of the Bitbucket repositories. This unexpected event interrupted the training, prompting me to explain its significance to the attendees, who appeared unaware. Despite their initial confusion, I took the opportunity to guide them through an incident response exercise. It became evident that the team lacked clear ownership over credential management, as the responsible individuals had recently been let go. Instead of solely focusing on the scheduled training, I led the group in identifying the leaked credentials, disabling them, and assessing their usage. I emphasized the importance of taking proactive steps beyond merely deactivating IM temporary credentials, such as terminating any active sessions associated with them. I led a significant project at a well-known East Coast bank, focusing on transitioning to cloud infrastructure and improving alignment within development teams. The initial challenge was inconsistent adoption and concerns about system security. The primary goal was to boost the team's confidence, ensuring they met security standards and also understood the specific requirements and risk tolerance. Therefore, we developed a strategy around creating behavioral tests to go beyond basic control implementation. Instead of just encrypting data with a switch, we emphasized demonstrating actual data protection. For instance, encrypting data was insufficient if it could be accessed and decrypted by anyone with storage access. We constructed test cases to showcase specific behaviors like accessing encrypted data with different keys. This included scenarios where object access was possible but reading it required an additional layer of access control through a third key. The core idea was to move beyond compliance checkboxes and instead focus on defining and demonstrating capabilities aligned with the true intent of security rules. Many companies are yet to mature in this aspect, realizing that compliance should extend beyond the surface to genuinely showcase the effectiveness and intent of security measures.

What advice would you give to professionals in the security industry on staying updated with the rapidly evolving threat landscape?

In the realm of security, it's crucial to navigate through the vast array of resources and focus on high-quality, widely recognized sources. I get excited to read posts from people who discover new threats and demonstrate them via their Github repo. While vendor whitepapers may appear impressive, they often turn out to be basic permission management exploitation or neglect network controls. I recommend considering your vendors as supplementary sources alongside primary collections such as MITRE, OWASP, and NIST projects. For targeted threat intelligence, both vendor and open-source platforms offer valuable insights. However, it's essential not only to set up means to consume information from these sources but also to take action. Ensure that all your data is discoverable and queryable so that it can enrich your other security processes. For instance, receiving a feed from AWS about updates to API actions or threats for services is informative, but it's even better if that feed triggers a new Jira ticket in your work queue. This allows for rapid threat modeling of new issues, enabling a swift response to known threats or features.