10 Minute Take

Why Security Tools Fall Short and Leave Significant Configuration Risks

Transcript

00:06

Hi everybody. My name is Tal Kollender.

00:08

I'm one of the founders and the CEO of

00:11

Remedio of the things that made me realize.

00:15

Creating Remedio from the beginning is the

00:18

ability to think like an attacker. So

00:21

when you want to hack into something,

00:23

you really want to think what can

00:26

be breakable. And every computer, let's

00:28

say that you have an organizational

00:31

computer, then it comes with an

00:33

antivirus. It comes with maybe more.

00:37

Defense or more tools that

00:40

will help protect your device

00:43

from potential breach. So

00:46

maybe you have it on the e-mail, maybe

00:49

you have it on the devices as an

00:51

antivirus and firewalls, etc. But when I

00:54

do have the entire tool set and I

00:57

think I'm protected, organizations are

00:59

still get breached every day. You can

01:01

read it on the news. What

01:04

is the problem?When I

01:07

investigated why I pay so much money

01:10

on 3rd party tools but I still

01:12

get rich even though I'm properly.

01:15

Secured. I mean a parent allegedly, um.

01:19

When I just saw it, I just

01:22

realized that, well, hackers are maybe

01:24

they do care at the beginning of

01:27

how how to get into your end

01:30

endpoints, but at the end of the

01:33

day they just move laterally.

01:36

Within the devices abusing something that

01:39

is called misconfigurations and we are

01:41

talking about device misconfigurations,

01:43

what is it actually like the

01:46

the term of misconfiguration?So

01:49

apparently it can be many things, it

01:51

can be human errors. Everybody knows

01:53

that, everybody makes mistakes. Then the

01:56

second thing of that would be default

01:58

settings. So when you get your first

02:01

computer, even when you have.

02:04

The security tools, even if it is

02:06

hardened, one of the things that you

02:08

should know is that even when you have

02:11

it, the security settings will always be

02:13

there. The creativity settings and

02:16

default settings, sorry of them, of every

02:18

single beat and byte that you have on

02:21

your device can lead to a massive, I

02:24

would say like massive breaches as we, as

02:26

we read on the news.

02:30

And then another important part on

02:32

top of that would be, what

02:35

if I told you that you

02:38

have?Untouchable

02:40

vulnerabilities that are still there out

02:43

there on your device. One of

02:46

the things that you will say

02:49

no way. I have every possible

02:52

tool that protects and prevents

02:54

everything, but not Edr's and DLP's

02:57

and anti e-mail malware, whatever.

03:00

That you have. They cannot stop

03:02

something. That is called

03:04

misconfiguration. Misconfigurations in

03:05

general are handled mainly manually and

03:07

it means that you need to go

03:10

either device by device or write some

03:13

scripts or to double check yourself

03:16

against it. But what we created is

03:19

a new approach of safe remediation.

03:21

And let me give you an example of what I

03:24

mean. A great example is maybe I'm

03:27

not sure if you are aware of WannaCry

03:30

is something that maybe 20 year old you

03:33

know in terms of the vulnerability of

03:36

SMBv one. But it is still out there,

03:38

people are still get hacked because of

03:41

this SMBv 1. So for those of you

03:44

who don't know SMBv 1 is an obsolete

03:46

protocol. Obsolete protocol that

03:49

exists on your Windows, on

03:52

the your Linux, on the

03:54

Macs, and even switches, routers

03:57

and everywhere. The problem is

04:00

that SMBv 1. Is almost on.

04:03

Each and every operating system is still

04:05

there. It's still enabled. Now you can

04:08

run vulnerability checks against it or

04:10

pentest and they will all tell you SMBv

04:13

1 is enabled. Now you need to disable

04:16

it. How can you disable

04:18

it without, you know knowing what what

04:21

the impact can be?How are you going

04:23

to disable it?Without even knowing

04:26

how to script against Windows, different

04:29

versions, Linux different versions, Max

04:32

different versions. And then what

04:34

happened if there is an impact and then

04:36

you need to revert. Now we

04:39

made we just found the perfect way

04:42

to stop. And make

04:44

a safer mediation. And finally,

04:47

save you time. And, of

04:50

course, money. Let me jump into

04:52

the demo so I can definitely show you

04:55

this example and even one more example

04:57

that is related to SMBv 1. So what

05:00

you can see on the screen here with

05:03

my multiple tabs open is this is our

05:06

UI. And if I will take the example

05:08

of SMBv one which you can see also

05:11

here, but I really want you to see

05:14

it from, I would say like a better,

05:17

a better way. And.

05:20

I really want to go and click here on the

05:23

SMB V1. You can obviously see like plenty

05:25

of other examples, but Matt, let me take

05:27

you to the specific thing that we all

05:29

know that is still louder.

05:32

On the SMB V1 example, what you can

05:35

see is not only that SMB V1 is

05:38

enabled again. So far easy what we can

05:41

show you if SMB was or wasn't used

05:44

in the past 90 days. And then

05:47

what we can show you is that not only

05:50

if it was or wasn't used, you can click,

05:53

you can see the entire device list, you

05:55

can see every single detail within the

05:58

device. You can go and filter by device

06:00

if you would like and see what is the SMB

06:03

status there. But then remember

06:05

our approach, we want to show

06:08

you that right now what you

06:11

can do is you can select

06:14

and go for the entire 4.1

06:17

K alert on 4.5 K devices

06:20

and click on remediate.

06:22

What you are going to see now is

06:25

our remediation screen that will explain

06:27

to you that you can disable SMBv 1.

06:30

On the devices that you chose that

06:33

the SMB V1 actually wasn't used in

06:36

the past 90 days. We

06:39

can even tell you how we do it.

06:41

Not only that, we can even of

06:44

course like being more than transparent,

06:47

we can make sure that it will

06:49

be automatically reapplied. When we say

06:52

automatically reapply, it means that any

06:54

future device and current devices within

06:57

Remedio with the same behavior of SMBv,

06:59

one that wasn't used in the past

07:02

90 days but still enabled, will be

07:05

automatically disabled. This is

07:08

the power of Remedio, but more

07:11

importantly, we added our autonomous.

07:14

Autonomous recommendations.

07:16

One thing that we do here is

07:19

that we find correlated topics or related

07:22

topics that we know that if you

07:25

are going to close one of them,

07:28

the others are. I mean,

07:30

you need to close them, no doubt about

07:32

it. And This is why when you

07:35

click here on the disable the web client

07:38

service, this is a dependency. Of

07:40

the SMBv one that we can just assure

07:43

you. How easy it is just

07:46

to do everything in a single click?

07:50

Now if you have any kind of you know

07:53

you want to do it after a certain time

07:55

day, you have some kind of a service now

07:58

or a JIRA that you want to do ticketing

08:01

for the approval. Everything is doable

08:03

here. But what happened after

08:05

you remediated? And let's say that you

08:08

remediated something. And then you

08:11

regret. We can

08:13

assure you that after remediating, no

08:15

matter what you want to do and to

08:18

revert an undo, we can take it and

08:21

we can revert it. You can choose a

08:24

single device, you can choose multiple

08:27

devices. You can select all of the

08:29

devices. But then you

08:32

can definitely take the entire

08:35

action or some specific assets

08:38

and revert them.

08:41

This is our power. In short, making

08:44

safer mediation, but also making sure

08:46

that even if you want, let's take

08:49

it even seven years after the first

08:51

remediation, you can always bring it back

08:54

to the misconfigured states. And then you

08:57

can mute it if you want and

08:59

ignore and what we call accept the

09:02

risk. And then you can

09:05

just see the entire journey of yours,

09:08

how much risk reduction you saved.

09:10

Listen, with 0 disruption, 0 downtime,

09:12

that's the power of pRemedio. You

09:15

can also see the money that you

09:18

save. It's also always good to see

09:20

how much money you saved. But more

09:23

importantly, again, how easy things

09:25

become when you have a safe remediation

09:28

tool. Are causing the

09:30

entire environment, entire devices.

09:33

Whether you have like a single

09:35

environment, Whether you do Mnas?And

09:38

whether if you want just to validate your

09:41

Vdis, everything is possible with Prima

09:43

deal. I hope you enjoyed the demo. And

09:46

if you would like to learn more, please

09:49

visit us. And if you like to sign

09:52

in for a free trial, please scan the

09:55

QR code. Thank you so much.