EPAM Cybersecurity Podcast

People are, belatedly, getting smarter about privacy—and there are all kinds of business and social ramifications here. This is what Jesse Redniss, Founder & CEO of Qonsent and Co-Founder of BRAVE Ventures, and Sam Rehman, our Chief Information Security Officer and SVP, are talking about in the latest #CybersecurityByDesign episode of *Silo Busting.* Pointing to some very recent research, Redniss says: “Nearly 90% of people actually don’t want to have their data shared with external third parties off of their applications.” How can organizations and brands  do better? “It comes down to value exchange,” says Redniss. We’re 100% certain that if you listen to this useful and informed conversation, you’ll learn much about Apple’s iOS 14.5, the new AppTrackingTransparency framework, the future of personally identifiable information (PII), and the challenges of privacy education. Just one click and you can jump on the platform of trust and transparency that is their dialogue. Welcome!

Host: Alison Kotin
Engineer: Kyp Pilalas
Producer Ken Gordon

Silo Busting 25: The Future of Privacy with Jesse Redniss and Sam Rehman

The cloud may have made business more flexible, but it has made security *complicated.* 

According to Jay Parikh, CEO at Lacework and our guest on this #CybersecurityByDesign conversation, the cloud model “introduces a whole new set of risks that I think the industry, we all, are really trying to put our arms around.”

Parikh and Sam Rehman, EPAM’s Chief Information Security Officer and SVP his conversational companion, try to figure out how to stretch the arms of cybersecurity to provide an adequate defensive posture.

Part of the answer is starting early. “Ideally you understand risks in your environment before they show up in production and before they impact the business,” says Parikh. “But if there are risks that do creep through into production that you're able to find and remediate them as soon as possible.”

Parikh says it’s important to rethink the way security is done “so that it's part of this move fast, this builder kind of mentality that is there in the cloud.” You need people who can build security naturally into the development process. 

Talent is an issue—a big one—here.

“We need more builders in security,” says Rehman. “Constantly just throwing people at it is just not gonna solve it.” Parikh agrees, adding that security “has to be something that is there and it's part of the build process. It's not an after-the-build process.”

Which means, of course,  that you need the kind of people with the skills about capabilities for being a builder. 

“Finding builders, finding security expertise, is very hard these days,” says Parikh. “The demand just continues to far outstrip the supply of the talent out there.”

And you do manage to bring them on board, you need to provide them with engaging work. “You don't want them to be doing repetitive, mundane things because they're not gonna be happy. Then you have a retention problem.”

Listen to this episode. It’s so relevant and timely and thoughtful that retention won’t be a problem.

Host: Alison Kotin
Engineer: Kyp Pilalas
Producer: Ken Gordon

Silo Busting 51: Jay Parikh and Sam Rehman on Bringing More Builders into Cybersecurity

On the latest #CybersecurityByDesign conversation, we’ve got our minds set on… hacking. Bruce Schneier, author of the recently published *A Hacker’s Mind: How the Powerful Bend Society’s Rules and How to Bend Them Back Again,* chats with Sam Rehman, EPAM’s Chief Information Security Officer and SVP, about the hacking mindset and what it means for security in the age of generative AI. 

Schneier gets the conversation rolling by defining a hacker as “Someone who finds a bug or vulnerability, a loophole in a set of rules, and exploits it to their advantage.”

He talks about hacking not just computers but tax systems, hockey, tax codes, and Formula 1 racing. Rehman mentions that he appreciated a couple of Schneider’s examples and Schneier replies: “There are a couple? There are dozens of examples! Examples are what makes the book fun!” (Reader: The book is fun indeed.)

Schneier notes that “hacking isn't necessarily good nor bad,” which might surprise some who live outside the perimeter of the cybersecurity world. “Hacking is how systems evolve. If I figure a clever way to use a system, to subvert a system that no one thought of before, there are benefits as well as costs.”

The guys then get into the inevitable topic of 2023: The costs and benefits of hacking in the context of AI.

“I think it's gonna be a big arms race in AI and security,” says Schneier, adding that in the near term, AI will benefit the defender. “The attacker is already attacking at computer speeds. Being able to defend at computer speeds will be an enormous benefit.”

While he’s generally optimistic that AI will be good for the good guys, Schneier says “The transition period will be very chaotic.”

This chaos will come from the idea of AI has a hacker. He points to the idea of accountants—human ones—poring through tax code looking for loopholes to exploit: “That feels like something that you can train an AI to do,” he says. “And what happens when AI finds vulnerabilities in tax codes or financial regulations or other sets of laws? How will that work? How fast will they be? How clever will they be? Will they find things that are just so complicated that humans would never have found them?”

Schneier says that AI will increase the speed, scale, sophistication, and scope of hacking and wonders if these differences in degree will make a difference in kind. Then he answers: “The advances in AI in the past six months have been enormous. The next six months will be even bigger. Conversations we have today aren't going to be true in six months.”

What won’t change, however, is the hacker’s essential mind, which Reman admits has always been part of him: “I have always looked at everything as: ‘What else can I do with this?’”

“That’s totally the hacker mindset,” replies Schneier. “I don't think you can train that. I think that is something you either are or are not.”

Host: Macy Donaway
Engineer: Kyp Pilalas
Producer: Ken Gordon

Silo Busting 59: Bruce Schneier and Sam Rehman on Hacking in the Era of Generative AI

The cloud creates “cloud cowboys,” says Yinon Costica, VP of Product and Co-Founder of Wiz. 

This creates, as you might imagine, security issues. 

“Cloud allows people to really own their stuff end-to-end. They can basically create whatever they want,” says Costica. But he says that security professionals need to ensure that the cowboys can “govern their environments in a way that is secured while they continue to build.”

These issues set the theme for this #CyberesecurityByDesign conversation between Costica, Sam Rehman, EPAM’s Chief Information Security Officer and SVP, and Aviv Srour, our Head of Cyber Innovation.

Rehman notes that the frequency of change in cloud is “great for software engineering,” but adds: “It also makes it very, very difficult for you to actually find your baseline, your footing,” regarding security.

One of the most useful things we learn in this episode is how cloud might help spread the responsibility for security. In the past, security was solely the problem of the security team but with cloud and its self-serve nature, Costica says: “Security now should be democratized to those who are actually managing the environments, running the resources, have the right context.”

As a group, the guys talk about the differences between on-prem and cloud security, the role of visibility plays in cloud, the pragmatism cloud brings to security, and more.

Understanding the manifold nature of cloud is critical, and it will require a lot more education than many organizations realize. Says Rehman: “If you don't have a good understanding of what your cloud looks like, which is majority of people out there, then you still have a huge problem.”

Be part of the solution: Listen.


Host: Kenji Ross
Engineer: Kyp Pilalas
Producer: Ken Gordon

Silo Busting 61: A Clear View of Cloud Security with Yinon Costica, Sam Rehman, and Aviv Srour

“There’s been an incident,” is a sentence no one wants to hear… except perhaps people like Ron Konigsberg, Co-Founder and CTO of Gem and our guest on *Silo Busting,* whose business is cloud incident response (IR).

We know what you’re thinking: What makes cloud IR different from all other forms of IR? 

Let’s let Konigsberg explain: “The challenge is that the cloud is technically simply different.” If you’re using legacy tools, “you're going to protect probably 20% of the cloud.”

Konigsberg is joined in conversation by Sam Rehman, EPAM’s Chief Information Security Officer and SVP, and the pair are pelted with questions by Aviv Srour, our Head of Cyber Innovation.

Konigsberg says that incident responders need to “adapt from network and agents to services and APIs, and constantly learn about new services and stay up to date and up to speed” with what the bad guys are picking up.

Oh, those bad guys! Regarding attackers, Konigsberg says: “They adopt innovation faster than defenders.” They can do so because they have fewer dependencies “and they care less [than defenders do] about breaking things.”

To illustrate, he asks us to think about migrating to the cloud: Imagine you’re an attacker and you simply never worry about any legacy systems from your previous environments. “They have much more liberty and they move faster.”

“They adopt techniques about new services that each cloud provider is releasing *tomorrow,*” says Konigsberg. 

So it is, in some ways, about playing catch-up. CISOs have had to adopt a new mindset and posture. “You can only block so many punches until you have to figure out [that] you need to move around, you need to counter, and so on,” says Rehman.

Rehman adds that CISOs have finally understood the “shared responsibility between you and the cloud provider.” But that’s not the only issue with the cloud. “It's much flatter than what you’re used to on prem,” he says. “Which means a lateral attack is a lot quicker, moving things around a lot easier, and the *simplicity* of people actually moving things around and infecting a large area is substantially higher.”

So how can an organization properly respond to, and learn to prioritize within, the cloud conundrum? One answer, says Rehman, is culture. 

“We have to adopt a learning culture in security,” he says. “They’re always gonna be one step ahead of us, but at least we're one step behind, not ten.” Pick up the pace of your learning and listen to the experts speak. Hit play!  

Host: Lisa Kocian
Editor: Kyp Pilalas
Producer: Ken Gordon

Silo Busting 68: Cloud IR Readiness with Ron Konigsberg, Sam Rehman & Aviv Srour

Apps don’t just bring us our favorite music and allow us to engage in mobile banking; they present great opportunities for cybercrime. More than 80% of cyberattacks enter through the application layer. That’s why this #CybersecurityByDesign episode of Silo Busting is focused on application security, or AppSec, as the experts call it. One of them, Eugene Dzihanau, EPAM’s Head of Defensive Security Services, joins Sam Rehman, our Chief Information Security Officer and SVP, and Producer Ken Gordon to think out loud about what AppSec means right now. Dzihanau says that, in our cloud-driven present, “Applications became much more than applications” and that in this world “everything starts to become an application.” Rehman agrees and says that it’s a dangerous time because cybercriminals are looking vigorously for vulnerabilities. “Whenever there is change, there is chance for an exploit,” says Rehman. How to make applications more secure? Start at the start. Dzihanau says: “Thinking about security from an architecture perspective from the beginning will save you a lot of headaches.” Of course, it’s not simple to make this happen, and Dzihanau counsels us to approach this carefully and intentionally: “Don’t set the bar too high. Address the change in behavior of your developers and architects and make sure that the security steps are done throughout your SDLC, from the beginning to the end, from design to deployment.”

Host: Alison Kotin
Engineer: Kyp Pilalas
Producer: Ken Gordon

Silo Busting 14: Sam Rehman and Eugene Dzihanau on AppSec

EPAM Continuum's award-winning podcasts feature interviews with people practicing innovation in various forms, digging into their ability to deliver results. Repeatedly.

Silo Busting 51: Jay Parikh and Sam Rehman on Bringing More Builders into Cybersecurity

The EPAM Continuum Podcast Network