{"id":22881,"date":"2022-12-12T22:35:00","date_gmt":"2022-12-12T22:35:00","guid":{"rendered":"https:\/\/mailinvest.blog\/index.php\/2022\/12\/12\/jupiterone-pinpoints-cures-to-cybersecurity-ailments\/"},"modified":"2022-12-12T22:35:00","modified_gmt":"2022-12-12T22:35:00","slug":"jupiterone-pinpoints-cures-to-cybersecurity-ailments","status":"publish","type":"post","link":"https:\/\/mailinvest.blog\/index.php\/2022\/12\/12\/jupiterone-pinpoints-cures-to-cybersecurity-ailments\/","title":{"rendered":"JupiterOne pinpoints cures to cybersecurity ailments"},"content":{"rendered":"

<\/a>\n
<\/p>\n

\n

One of the big topics of discussion at AWS re:Invent 2022<\/a> was cybersecurity<\/a>, and with good reason: Bad actors are getting more sophisticated. Cloud security needs to respond in kind.<\/p>\n

JupiterOne Inc., a \u201ccyber asset attack surface management\u201d company, believes the trend hasn\u2019t been good in the cybersecurity industry \u2014 perhaps one issue gets resolved, but a hundred follow in its wake.<\/p>\n

\u201cI do think that we\u2019re at a point where we have enough painkillers and Band-Aids,\u201d said Erkang Zheng<\/a> (pictured), founder and chief executive officer of JupiterOne. \u201cWe need to start looking at how we can do better, fundamentally, with the basics and do the basics well. Because a lot of times, it\u2019s the basics that get you into trouble.\u201d<\/p>\n

That might seem like a simple solution, but it\u2019s not always the case in practice. It\u2019s easy to think that users should have multi-factor authentication, or MFA, enabled or endpoint protection on devices.<\/p>\n

\u201cBut the question being, how do you know it is working 100% of the time? How do you know that?\u201d Zheng asked.<\/p>\n

Zheng discussed that issue, and JupiterOne\u2019s potential solutions, during a conversation with theCUBE industry analyst John Walls<\/a> at AWS re:Invent<\/a>, during an exclusive broadcast on theCUBE, SiliconANGLE Media\u2019s livestreaming studio. (* Disclosure below.)<\/em><\/p>\n

Boiling it down to five questions<\/h3>\n

JupiterOne believes security is a data problem that needs an engineering approach and a platform for consolidation. It raised $70M on a $1 billion valuation to boost its market capabilities<\/a> earlier this year.<\/p>\n

For Zheng, it\u2019s essential not to find out MFA or endpoint protection is not functioning after the fact, when it\u2019s too late.\u00a0To prevent that, organizations need to ask themselves five basic questions: What do I have? What\u2019s important out of all the things I have? Out of those things, do I have a problem? If so, who can fix it? And, finally, over time, am I getting better?<\/p>\n

\u201cYou just keep asking these questions in different areas, in different domains, with a different lens,\u201d Zheng said. \u201cMaybe that\u2019s endpoints. Maybe that\u2019s cloud. Maybe that\u2019s users. Maybe that\u2019s product and applications. But it really boils down to these five questions. That\u2019s the foundation for any good security program.\u201d<\/p>\n

Approaching it that way \u2014 thinking about it as diagnosing a problem and applying medicine to it \u2014 forms the essence of JupiterOne\u2019s approach.<\/p>\n

\u201cWe spend a lot of time doing attacker research from the outside, but we don\u2019t fundamentally understand, in a complete way, what\u2019s the complexity within our own environment in terms of digital assets,\u201d Zheng said. \u201cAnd that\u2019s almost like the DNA of your own work.\u201d<\/p>\n

On trying to find experts in everything<\/h3>\n

For years, there\u2019s been a constraint refrain<\/a> in the cybersecurity space: There is a lingering skills shortage, making it difficult for organizations to find and retain skilled staff<\/a>.<\/p>\n

Why is there a skills shortage when many talented people are out there? It has to do with the \u201cmind-boggling\u201d number of tasks requested of security people, according to Zheng.\u00a0For example, suppose one asks a security analyst how to protect something or deal with an incident. What one is asking that individual to do is not only understand the security concept and be a domain expert in security, but also to understand AWS, other clouds, endpoints, code, and applications to do an analysis and a response properly.<\/p>\n

\u201cIt\u2019s impossible. You have to have a person who\u2019s then an expert in everything,\u201d Zheng stated. \u201cThat\u2019s one thing we have to resolve; it\u2019s how we use technology like JupiterOne to provide an abstraction so that there\u2019s automation in place to help the security teams be better at their jobs without having to be an expert in deep technology.\u201d<\/p>\n

JupiterOne models the data and provides the analysis and visualization out of the box so organizations can just focus on security practices. Then, the company seeks to change mindsets \u2014 for example, regarding vulnerability management<\/a>.<\/p>\n

\u201cThe mindset for vulnerability management has been, how do I manage findings? Now we have to change it to the concept of more proactive, how to manage assets,\u201d he said.<\/p>\n

If mindsets aren\u2019t fundamentally changed, that poses a problem, Zheng added.<\/p>\n

\u201cI have to look at things, not from a reactive, findings perspective, but really starting from an asset-centric, day-one perspective, to look at that and have this foundation \u2014 have this map built,\u201d he said. \u201cIf I need direction, I go to Google Maps. But the reason that it works is because somebody has done the work of creating the map.\u201d<\/p>\n

Here\u2019s the complete video interview, part of SiliconANGLE\u2019s and theCUBE\u2019s coverage of the AWS re:Invent 2022 Global Startup Program<\/a>:<\/p>\n