A Better Way to Pentest for the Cloud

00:05 Welcome. This is a better way to pentest for the cloud. Today I'm joined by Synack's field CISO, Wade Lance, and Freshfields' global CISO, Mark Walmsley. If there are any questions, enter them into the Q&A. We have someone behind the scenes to answer questions. Over to you, Wade. Thanks, Justine. And really looking forward to today's session. Mark, thanks again for your time. It was certainly fun getting ready for the session and talking through the topics. How's your day?

00:35 It's very nice to see you again, too. And thanks for the invite. Good day so far. Towards the end of my day, I should say. But it's very nice to see you all and to be here at this particular event. Awesome. So let's jump right into the topic at hand, which is certainly interesting, and we want to talk about cloud strategy and some of the issues around it. And so talk to us a little bit about some of the business and the technical drivers, but primarily the business drivers around Freshfields' decision to adopt

01:06 a cloud-first strategy. What were, you know, some of the generic stuff, but then also some of the specifics too? Sure. So a bit of introduction to Freshfields for those of you who don't know the organisation. We're a global law firm. We're a premium law firm. So we've got an international business and we service the biggest and best clients out there in the world. And part of that is making sure that not just our legal advice is the best, but the infrastructure and therefore the security behind it meets that client service.

01:36 And as we all know, cloud is a scalable service that allows you to develop and deliver products quickly to the market. And so we started three years ago with a cloud-first strategy, meaning all new big applications would go into the cloud so that it was scalable. We reduced the effort to manage the hardware, but actually we're now a cloud-only business. Every new application, every change of an application goes into the cloud-first for that particular... So

02:06 how was that first transition to saying, "Okay, all new stuff is going to be cloud platform, cloud-centric, but yet you've got existing applications and processes that are not that way." And then people want to iterate on that. Did you manage some of that cultural, you know, process? You're talking as if I've got through that process. We're still going on that journey, unfortunately, so it is difficult because people are familiar with the current applications.

02:36 Obviously, moving it to the cloud means that your more generic, vanilla applications are in that space, and there are some challenges convincing people it's the way and it's a long journey, quite frankly. Lots of the applications we've got are bespoke-built and customized and therefore are naturally scalable into the cloud. But that's part of the journey. We're talking about future-proofing the organisation, but it is a constant challenge and those who are watching this particular session will understand that themselves.

03:07 Pushing to the cloud requires a bit of governance. Yeah, any early wins in that process? I know in talking with other security leaders, they focus, I think you mentioned it, on some of the more low-hanging fruit type applications where transition was easy. And so you kind of demonstrate some value. Were there any of those early wins that you were able to use to kind of promote the strategy early on? We actually did it in the reverse,

03:37 so we didn't do the low-hanging fruit, we did the big and ugly to start with. So we did our document management system, our people system, our CRM system and obviously Office 365 are all now cloud-based. They're the biggest platforms we've got and that's in part by design, because if you can do the big things well and securely, you give people confidence that the lower hanging fruit will be naturally easier. So we actually went the reverse way. Interesting.

04:07 It was painful, but we're in a good space now. So we built the trust early on by the volume and size of the migration to the cloud. Right. Any other processes that you can share with us? Any other pieces of that process that were particularly helpful in managing expectations or helping them look, nontechnical folks have this idea that, "Oh, we're going to do it in the cloud."

04:37 And people like you wave a magic wand and, boom, we're there. And any other parts of that that were really substantive and helpful in communicating to the board, communicating to other business leaders that were keys to your strategy? It's all about resiliency and it's all about economies of scale. And you get those to a degree in the cloud, but it's about resourcing. So yes, it's a scalable technology platform.

05:07 It's not... It's cost-neutral, and we might come to that later on about some of the misconceptions about cloud, but the most important thing is we're able to use our resources in a better way. So IT and security resources are scarce, they're also quite expensive and if you've got them doing the right type of work, a) they feel more valued and therefore you retain them, but the business sees them as being visible aspects of the organisation and they are valued through that. It's about realigning workloads and getting top work for top dollar.

05:40 Nice. Well, listen, you brought up the idea of some of the misconceptions around cloud-first strategy. Let's talk about some of the misconceptions. At the end of it, I'll ask you about some of the ideas that do pan out, some of those like the tribal knowledge people expect to get out of the cloud that you actually do. But let's talk about the misconceptions. What are some of the lines that when people talk about cloud-first,

06:10 "Here's what you're gonna get," you cringe up and go, "Oh, that's not, that's not gonna..." I mean, the biggest one everyone knows is that cloud is not cheaper if you do it in the right way. It's cost-neutral, but it's not cheaper. So your CFO will often come and say, "This sounds like a great idea, Mark. How much will we save?" And the net response is, "We won't. We'll have a greater capability, but we won't be saving any money on it," and that's quite a difficult concept to swallow because everyone for the last

06:42 ten years that's gone to cloud has reported it's cheaper and scalable and can turn services on and off, but we know if you do it right, don't forget, cloud is accessible not just to your staff, but to all of the threat actors out there. You need to have your eyes and ears on that environment 24/7. It does become more expensive and comparable. So the first one is, quite clearly, it's cost-neutral. If you think there's going to be a big cost saving, then you're probably going down the wrong path. So that's the first one.

07:12 And I'm assuming that was a fair amount of work. Were you able to reset expectations of the board and the rest of leadership to kind of neutralize that idea early on to tell them, hey, listen, this is like, you're not cutting my budget through this process. We're not going to save any money in this process. We're going to be quicker, more adaptable, more agile, but were you able to head that off at the pass, or was it kind of an ongoing process just based on the predominance of that message, "Cloud's cheaper"?

07:42 Well, you reverse the conversation, you say I can get you more for the amount of money that you currently spend. So rather than being cost saving, it's about value and scalability and speed to market. So efficiency in a different way. We try and avoid cost conversations to the extent it's all about deriving the best service. So we flipped it on its head and said, "I can give you something better for the current spend," as opposed to the by the way I'll need a reduction or get a reduction in the budget as a result of this so we avoided that conversation.

08:13 What about the skills side of the house? How did that go? Because it's, you know, there's different tech, different people, processes. How did that work out in Freshfields? Well, we've got excellent people. I mean, generally, we've got some of the most fantastic people out there. And I wouldn't say it if it wasn't true, but there is a skill shortage generally in security, as we all know. There is a particular skill shortage within cloud because of the way that it develops both the platforms and obviously the evergreening approach.

08:43 You need to make sure that you've got dedicated resources. The generic resources that you had to support platforms don't really cut it in the cloud and there's not that many people with the right level of experience and qualifications to deal with it. Much of this is about making sure that you've got those resources inbuilt into the teams before you make that transition across. And it's important to recognise that the responsibility for cloud security and maintenance is shared.

09:13 There's this whole myth that if you go to Office 365, Microsoft, they do it all for you. You buy your E5 licence, everything's baked in, but very clearly it's not and you understand there is a demarcation between where Microsoft are and where the client responsibility starts and you have to understand that at a granular level and make sure that you've got appropriate resources in otherwise you get caught out quite quickly and that's why we've seen some of the big breaches out there because that bit's not been understood by the clients.

09:46 Yeah, one of the things I've heard from some of your peers in the space is that there's kind of this generic security division of responsibility around security, right? Where does the provider's security responsibility end and where does yours start? There are generically some rules. But in fact, it's different for different kinds of platforms and different providers and whatnot. So you mentioned the granularity in getting real specific on a process-by-process level about

10:17 where the lines are. How did that tie in for you? Because you mentioned earlier the need for specific skills. Is that an area where you were able to make some magic or I'm assuming it was? It's difficult for everyone. There's no magic in there, unfortunately, but it is a case of understanding what the art of the possible looks like. We're very lucky as a law firm that our client base is some of the best out there.

10:47 So some of the controls are mandated through our client base. It's super helpful to understand the minimum requirements. We've got great relationships with intelligence services, so we understand what the latest threats look like, the latest models look like, so we're able to invest in those proactively, which provides that extra level of controls and security into the products. But it is really important that we understand because it doesn't matter who you go with, you can turn all the security off if that's your choice and

11:18 we know that there are businesses out there that do exactly that because they don't understand. Microsoft don't mandate a minimum standard. They say this is what you've got, you choose what you want, and it's up to you to implement that. And so understanding and having specialists is really important. Yeah, I know in the security space, so there's that whole specificity of architecture, right? How do we make it work? How do we develop provisioning, deprovisioning processes, and all that?

11:49 Then there's a whole security side where we're pretty mature now. Most organizations, I know Freshfields is, as far as your monitoring and response capabilities for on-premises platforms and systems: well developed, very mature. But then now you're bringing on these cloud systems when in fact there are different monitoring controls, different processes in some cases. It's funny you say, "How did that go?" How is that going, right, for you? I was about to correct you. You're absolutely right.

12:20 It's a constant. It's a constant challenge and investment. The simplest way to put it is not all cloud providers get it. We spend a lot of time educating cloud providers in modern practices and modern threats. Quite a few of the Freshfields security team here are on the advisory boards of big technology companies across the world to help them develop and deliver better products in a secure way. And actually, it's an educational two-way path, so we'll often be helping those organisations to understand

12:52 what good looks like or might look like in the future so that we're able to become customers of them. So we're influencing, I wouldn't say that we influence everyone, but we're certainly available to help people who are interested. Yeah, you're influencing smart people who are willing to learn off of the pain of somebody else's work, right? Well, that's very true, yeah. Yeah. So within the security space, talk to me about security testing in this space.

13:23 So we talk about these outcomes, secure outcomes, solid posture monitoring and whatnot. But validating and testing and understanding that, of course, is a critical piece of the process. What were some of the eye-openers along the way in security testing in your cloud-first strategy? Well, let's talk about cloud as a technology. There are two things that are really important for me. The first one is that it's accessible to everyone.

13:54 So the threat vector is higher. That's a fact. It's a given fact that if you get it wrong, you're going to get caught very, very quickly. The second point is all cloud providers are moving to an evergreening model. Now that evergreening might be quarterly updates as opposed to annual updates to many like Microsoft and other organisations. That evergreening is weekly so you've got new capability being turned on. New capability can have poor code vulnerabilities and it can be misconfigured.

14:25 So if you believe both of those things are true, and quite clearly I do, then you have the whole debate about how do we secure that environment? Because traditional one-off pentesting, point in time, tomorrow, completely different world, it doesn't stand up to anything. And this is a case of ticking a box for your ISO cert or your client audit. It doesn't actually provide proper security and confidence longer term. So there's still a space for traditional pentesters. We get that, but we've been working with Synack and other people for

14:58 some time now on continuous testing. Looking at the platforms on a 365-day basis to look at every configuration and any new piece of capability to make sure that it is appropriate and secured and that gives our clients a lot of confidence. It gives our cyber insurer some extra confidence too and it allows us to move to this world where we're ever evolving which is where modern businesses are now. If you can't evolve quickly and readily,

15:29 you get left behind and that's one of the capabilities that we have. The second point is traditional pentesting again it's got a real place in history, but it doesn't operate in the way that you would do with a proper aggressive focused threat actor, someone who's got all sorts of tools and capabilities that they can utilise to get into technologies and that's really where our worry vector is at the moment.

15:59 So we're deploying the best of what we can on a permanent basis. Yeah, that's a long answer to your question. Sorry. No, it's a great topic. I've had a couple of conversations with people where I point out, you know, there's no such thing as "cloud testing." There's Azure, there's AWS, there's GCP. I mean, there's different platforms and they have different structures. And so you need specialists, people who are able to look at your application stack and the

16:30 base infrastructure stack and then do testing that is appropriate given that environment, right? So being very specific about the kind of testing has been a critical part of success. I want to go back to something you said about the continuous testing model as opposed to a point-in-time testing model. I'm going to spring this one on you because I've been thinking about it over the last couple of weeks. There's this idea, and you mentioned it, around governance, risk and compliance and satisfying

17:04 regulators with your testing regimen. But it feels to me like the risk part in that standard formula is really around the risk of not satisfying the regulators as opposed to in an evergreening environment where, hey, providers and application people are changing things monthly to weekly, probably, right? As opposed to taking a business-risk-centric

17:34 approach to the testing regimen. And how are you working through that process of kind of defining, hey, these environments, these applications, they can get point-in-time tests at this process. These environments really need a continuous testing process in order to apply appropriate testing the same way you would apply appropriate monitoring. How are you working through that process with your teams? So it's a fairly straightforward equation, actually.

18:04 The most critical cloud-based platforms with the highest volume of sensitive and personal data get our premium 24/7 testing because those are the assets. That's where our clients are concerned. That's where our regulators will go crazy if we have an issue. That's where we will get fines or in Germany it could be criminal sanctions. Those are the crown jewels, so they get crown-jewel service. Applications that are hosted in our data centres, they're not cloud facing, they might be cloud facing,

18:35 but they're not connected directly to our network and they contain lower value. It's difficult to justify continuous testing on those applications. They get point-in-time reviews, they'll get configuration reviews separately. So it's a fairly straightforward equation and also I'm given a defined budget each year so at some point that runs out, doesn't it? And so you have to make that judgment call. Yeah, I think you make a great point. Just approaching your application stack and your

19:07 infrastructure stack from a risk-first posture, where it's business-critical, and apply the appropriate testing. And what I found is organizations that do that, they find that totally satisfies the regulators. But if you start off with, "What do the regulators want?" and then try and tack onto it, in most cases, it doesn't work out. Well, I presented at a different session a number of years ago where I was with Justine and we were talking about how the market is changing, there were some regulated businesses in that particular presentation.

19:39 And ultimately, I explained that their jobs were going to change because the point-in-time, you've ticked the box, the computer says yes, it's actually not about protecting the world. It's about showing that you can follow some predefined steps and in my opinion, the world was going to go back to its own way of working, which is what do I really need to protect and why do I need to protect it and that's where I put my investment and my people and my strategy knowing that the other assets could be weaker, but actually very limited in terms of damage rather than ticking the box across the board because we are

20:11 constrained by cash and people and time and that didn't go down so well, but it is now reality that people are now saying... I've just got off a call, as I explained before, with a US company, a big finance company and they've got that mindset which is we totally understand where you're coming from that you're protecting the crown jewels and that you have to prioritise as opposed to tick all the boxes. So we'll see, in my opinion, we'll see more of that.

20:41 Where do we put our money and not just across the board in even piles but stacking it on your critical assets. Yeah and the last comment I guess in this section would be that the continuous testing is a great ideal, right? But there's this concept of familiarity blindness, right? And it talks about we know for a fact that the same tester like you may have fantastic security testers in a given

21:12 set of technology stack, right? But the same testers applied to the same environment at some point begin to get familiarity blindness, and they're missing things just because they've been looking at the same thing for weeks on end. Our research suggests it's somewhere in the three to five week range where that begins to happen. Which is why at Synack we built our continuous model around cycled cadres. You get 20, 30, 40 people whatever it is they'll look at it for about a

21:42 month and then they get shifted out and we bring in a whole new batch of people. And so it's always fun to me to talk about continuous testing and just to kind of pop the balloon on that model that it's easy to do continuous testing. Just take your people and have them look at this environment all the time. It's like, that kind of doesn't work, right? Have you seen that in your processes at all? So we haven't seen that from a testing perspective,

22:15 but we use you for our continuous testing. We know that you cycle staff, but it's absolutely true in every part of technology and security is that repetitive tasks often end up being undermined by the people running them because they start to, exactly to your point, miss pieces of information, and once you've missed it, it becomes common and therefore you think it's acceptable. So cycling is really important. We cycle through our security team. We'll always do a two-eyes approach,

22:45 meaning that someone will look at it first and then the next few weeks' time someone else will look at it, and then you'll get the four eyes together to say, what did we find? What did you find? What did I find? And how can we help each other? But we know that's the process at Synack anyway. So we know that you cycle through your testers so that you don't get that testing fatigue. Yeah, but also your testers, I feel like I'm selling your product here, your testers use different tools. So once you cycle through the people, it's not just the skills that you're getting, you're getting a brand new set of tools as well that are

23:16 coming about to look at those applications. So it's two changes to the environment, which means that it is ultimately for us better. Yeah, and that's been a bedrock for us here at Synack. We get the best testers we can get. We have them access your environment strictly through our platform. So it's very controlled and monitored. But we do let them use whatever tools they want to use. There's a bunch of scanning and whatnot built into the platform.

23:46 They get to use whatever. It's always interesting, the results of that. As you point out, there's huge value in cycling, not just the people and their experience, but the tools as well. So I know we're running out of time. And I definitely want to get at the wins from Freshfields' experience and from your experience in this space. And I'll just let you go on about a couple of them. The part I'm most interested in is the surprise wins. Talk to us about the wins that you expected to get and you sure enough did.

24:20 But were there any surprise wins at the end of the process? You're like, oh, that's actually better for Freshfields or for your security organization. Maybe try to cram it into those structures if you can. No problem. The biggest win for us personally is that our clients are watching what Freshfields do. They're looking for advice. We've got a big cyber practice at Freshfields. So they're looking at us.

24:50 We often get calls about how we can provide support and advice. So for me, the biggest upside is, a), the business trusts that cloud is secure and we can do it right and there's a need to invest in it because I don't get the conversations about you've got to drop your budget, it's that we're doing this, what do you need to do? It's a very mature conversation. So, surprised about that. Great that we can connect it to our clients and our clients are asking for advice because we're now on a journey together and that's really important that IT and security are bonding to

25:22 clients not just through the legal services provider. And then it's the agility part and agility comes with governance and you've got to be careful that you don't just buy and deploy, but it has meant that it is multitudes quicker than it was before because you're taking the whole infrastructure conversation out of the window and you can scale up and down. The last one will not be a surprise to anyone, but when you've worked in traditional data centres, Freshfields is 279 years old.

25:52 We've been a physical data centre client for years and years and years. Going to the cloud and allowing us agility has been lightning for us in terms of how we can now move as a business and particularly through the pandemic. We're able to scale through the pandemic, no drop in service whatsoever. There are plenty of upsides and benefits through that and no doubt we will continue our journey. One of the things that's always interesting to me

26:22 is how you talk about your customers and your relationships, the Freshfields relationships with your customer base, which they rely on you for legal advice, critical legal advice and direction and support and some really important processes. And what's always amazing to me is that you realize that they're not just judging you on that legal advice. They're judging you on your prowess as an organization, which includes your agility,

26:53 security, your ability to leverage new technologies. It all works together. To me, that's always been the surprise that there are still organizations that think they can be weak in technical prowess and adaptability and moving to the cloud and whatnot and still be respected in their particular field, whether it's accounting or legal or whatever it is. The world is changing. Wade, the world is completely changing. So you look at all of the pitches that come through, and

27:25 legal pitches are no different to any other pitch. What's the quality of the service? Who are your people? What's the value proposition going forward? Every pitch now has two things. What do you do for security? What's your innovation strategy? And they want to know because that's value for them. That's something that they can hang off to say Freshfields is better than another law firm because we're a premium brand, so we come at value. We're not the cheapest. We provide the best legal advice.

27:55 What are the other things that we can talk about our business that give that client the, "Yes, we should do business with Freshfields"? They've got the very best lawyers in the world there. Guess what? They've got a strategy that's scalable, we can learn from it and by the way, the data is secure as well. They're positive tick boxes, and they are the differentiators between the major players now very clearly. Yeah, well, Mark, great session. Thank you so much for your time. Always a pleasure.

28:26 A lot of respect for what you and your team have been doing and it's been a great relationship for Synack, I know over the years. And so we continue to admire your work, and we're glad to be a partner with you guys. So thanks for taking the time. I really appreciate it. Very nice to speak to you, Wade. Absolutely. So Justine, that's all for us. We'll pass it back over to you. Thank you, Wade and Mark, for your time today and a great discussion. For those on the line, if you're interested in seeing a demo of our cloud security offering in the Synack platform, check out our demo series Cut to the Chase,

28:57 where field CISO Jeremiah Roe talks about top exploitable vulnerabilities in the cloud and how to navigate them. These resources are also available in the documents section of the Goldcast platform. With that, I thank you for your time and hope you all have a great day.

No lines match that search.