Name: Gartner’s 2023 CNAPP Market Guide | Live Discussion
Start: 2023-03-27T21:43:00Z
End: 2023-03-27T22:13:13.000Z
Location: BrightTALK
Rating: 0

Secure cloud, containers, and endpoints with one unified solution. Find and remove critical risks in your modern attack surface—from laptops to containers—all from a single UI and data model.

Cybersecurity is a requirement for every company in the world regardless of size or industry. And that’s a fact! 

But… if you’re looking to get your own business off the group, where do you start with cybersecurity? 

This week on Cybersecurity Standup we’re talking to Chris Castaldo, CISO at Crossbeam and author of “Start-Up Secure: Baking Cybersecurity into Your Company from Founding to Exit.” 

Chris has written a book that covers “everything a founder, entrepreneur and venture capitalist should know when building a secure company.” Whether you’re brainstorming, in your first round of funding, or looking to level up your whole company–we’ll show you how baking in a strong security posture can transform your startup and drive the value proposition for your target market. 

Stay tuned for more… because there’s something very special about this episode of Cybersecurity Standup!

Cybersecurity for Startups

Ever feel like it’s a constant crisis in cybersecurity? 

Or like the work is never done, and burnout is always on the horizon? 

Cybersecurity is a field full of breaches, threats, and high-stakes situations. That feeling of constant crisis can seep into our everyday lives and impact our mental health in a deep and ongoing way.

Talking about the issue is step one, but help is also available! 

This week, we’re speaking with two experts. Catherine Moore, the founder and CEO of RISE Directory, is a licensed clinical social worker with valuable insights on pursuing career development without burning out. Katrice Gerald is the Head of People at Uptycs and has brilliant perspectives into company culture and authenticity.

Breaches and Burnout: How Cybersecurity Pros Can Prioritize Mental Health

Whew–the superbowl of the cybersecurity world is behind us! Let’s recap, shall we? 

Whether you’re recovering from RSA or still reeling from the FOMO, join us for a lively discussion about key takeaways from RSA Conference 2023 from marketing initiatives to major announcements.

We’ll cover generative AI and speculate on what the industry can expect to see in this area in the near future. We’ll also talk about compliance and the impact of regulations on the industry. And has anyone else been noticing the juxtaposed demand for talent, coupled with the ongoing pattern of layoffs? Let’s discuss what’s happening there, too.

RSA Key Takeaways

How do you manage your mental health as a cybersecurity professional? 

Cybersecurity can be high-stakes and high-stress. Avoiding burnout is an ongoing practice for many cybersecurity professionals, even when we love and care about the work. There are unique mental health risks faced by those in the field, and we might all benefit from talking about these challenges, and sharing our experiences. 

Join Amanda Berlin, CEO of Mental Health Hackers, and the Uptycs team members Mark Bliss, Crystal Poenish, and Bronwen Hudson to learn from their expertise. 

How do you take care of yourself during stressful times? 

May is Mental Health Awareness month so we’re taking this opportunity to do our part to reduce stigma. 

* Please note that this episode of Cybersecurity Standup is not guided by a certified mental health professional. 

#MentalHealth #Cybersecurity #CISO #Burnout #MentalHealthAwareness

Mental Health in Cybersecurity

How do security teams determine that the right users have access to the right resources and permissions? Join experts Sudarsan Kannan, Director of Product Management at Uptycs, and Siban Mishra, Senior Product Manager at Uptycs,  to learn how role based access control (RBAC) is effectively implemented in container and Kubernetes deployments.   

Together, we will evaluate RBAC policies, breaking down the different tactics security teams use to monitor production users, catching potentially dangerous roles, and building confidence around simplifying the management of your RBAC. 

Visibility into real-time RBAC is a challenge for most teams, with the sprawl of users, services and devices creating an ever-expanding mesh of roles. Provisioning users and services can be overly-reliant on manual processes, leading to gaps in runtime around who has access to what. Learn how to shift up and enable your team with the clear visibility needed to address RBAC policies.

What you will learn: 
- Understand RBAC best practices, common pitfalls to avoid, and how to review RBAC policies regularly to keep your clusters safe
- Monitor RBAC for k8s effectively to prevent unauthorized access to clusters and reduce security risk around exec privileges and visibility into stored secrets
- Break through the noise to locate high priority power users, risky roles, and service accounts with privileged access

RBAC Security for Kubernetes: How to Keep Your Clusters Safe

How does digital forensics and investigations differ from traditional XDR to cloud? What techniques can we translate into DFIR for AWS and Kubernetes incident response? Join experts Amanda Berlin, Lead Incident Detection Engineer at Blumira, and Josh Lemon, Director of Uptycs’ global managed detection and response team, to learn how to manage your detection alerts and unify investigation efforts. 

Together, we will break down the patterns around common cloud-based attacks like Cryptominer and Credential Abuse and share techniques to prioritize alerts for faster response times. 

While investigating security incidents, challenges arise when dealing with siloed tooling and disparate data sources across your environment. Learn how Amanda and Josh have worked to break down those silos and shift up to end-to-end investigations across XDR and cloud environments.

You Will Learn How To:
- Prioritize alerts and unify response efforts across traditional and cloud-based assets.
- Understand easy wins around cloud detections and break down the core challenges around incident response in the cloud.
- Differentiate DFIR, mean time to detection, and mean time to remediation with and without using a sensor to collect data.

Shifting Up DFIR from XDR to the Cloud

As the cloud-native landscape expands, we’re relying more and more heavily on containers to build, deploy, and run workloads–and security teams need solutions that enable, rather than hinder, these full lifecycles.

Enter Kubernetes!

This week on Cybersecurity Standup, just before we head to Amsterdam for KubeCon, join us for a Live discussion on the future of containers and Kubernetes security.

We’ll discuss what Kubernetes (k8s) is, what it means to be cloud-native, and what predictions we have for the upcoming year when it comes to containers. We’ll also dip a toe into the impact of legislation, and talk about how to deploy zero-trust at scale (even for hundreds of thousands of endpoints).

No matter your sub-field, this discussion will be useful–so don’t stress if you don’t know what eBPF is yet.

The Future of Containers and Kubernetes Security

What Cybersecurity Professionals Should Know About Mergers & Acquisitions

 How do leaders make risk decisions about Mergers and Acquisitions?

What does cyber due diligence actually encompass?

This week on #CybersecurityStandup, we’re talking business! 

When it comes to #cybersecurity, there are a lot of factors to consider when companies are merging or being acquired. With all of the innovation and new GTM strategies… come all the security flaws.

Decision makers need to be able to make informed choices about the risk they’re taking on, without just relying on ratings companies (at least, solely)... but building out a qualitative risk analysis can take a lot of time. This week, we have a star-studded panel of guests, and we’ll discuss how to save time without cutting corners, and how to increase value to your company.

What Cybersecurity Pros Should Know About Mergers & Acquisitions

What’s the advantage of anomaly detections? Join us this month as in-house expert Craig Chamberlain walks through examples of things anomaly detections can catch that rules-based detections are blind to. He’ll share how he engineers detections for scaling cloud environments and ways to hone them so it’s not just another false-positive alert cannon.

There are a variety of use cases where anomaly detections outperform traditional methods of threat detection, with examples in this discussion focusing around supply chain and third-party access security. Walk away knowing why anomaly detections are the vital parallel function for traditional threat modeling and how to build trust within your team around the science behind statistical analysis. 

What you will learn: 
- Uncover alerts found using anomaly detections that were missed by traditional detection methods.
- Use anomaly frameworks to secure supply chain and third party access use cases.
- Understand the advantages, drawbacks, and differences between machine learning, artificial intelligence, and statistical modeling in familiar security use cases.

Anomaly Detection and What You Can’t See

CDR? Another acronym? We know - it’s pretty soupy out here. But CDR–Cloud Detection and Response–is one CISOs and their teams should know, and be familiar with… even if there are a lot of differences in opinion about what CDR actually encompasses.

This week on Cybersecurity Standup, we’re answering your burning questions about CDR:
-  Does CDR include XDR, or vice versa?
- Is CDR just XDR, with a cloud twist?
- What can CDR tools accommodate that other tools can’t?

And… how can CDR capabilities address the unique challenges and risks associated with cloud environments and ensure a robust security posture for organizations leveraging cloud services?

Join to find out.

Cloud Detection and Response (CDR) Explained

Why aren't there more women working in cybersecurity?

March is Women’s History Month so we’re taking this opportunity to chat about the challenges that women face in the cybersecurity industry, and celebrate the journeys some of us have taken to get here.

With Black History month just in the rear view mirror, it’s crucial to address these issues from an intersectional perspective. When it comes to cybersecurity–an industry desperate for experts and for talent–it’s even more important to empower those who face challenges when entering or rising in the industry. Fostering diversity in cybersecurity allows us to encounter new ideas, reach new markets, and make better decisions.

References:
https://cybersecurityventures.com/women-in-cybersecurity-report-2022/
https://blackcybersecurityassociation.org/

Women in Cybersecurity: Challenges, Successes, & Future Plans

Recently, the White House released a cybersecurity strategy document for the National Cybersecurity Initiative, and it’s making the rounds within the industry. 

Some are welcoming it as a ‘good starting point’ but others point out that few aspects of the document are actionable. 

So, let’s talk about it! 

Who is the target audience for this document? Should CISO’s be taking note? What impact will this have, if any, on software providers? And how, exactly, might the government go about ‘rebalancing the responsibility to defend cyberspace’? 

When we talk about “taking the burden off end users and shifting the responsibility to the “owners and operators of the systems that hold our data and make our society function”... who are we talking about? 

Join us Live on Thursday March 9, 2023, 9:30amPST/12:30pm EST, to dive into this document and what impact it might have. 

Got questions? Let us know your thoughts and concerns in the comments.

What Up White House? 3 Takeaways for Cybersecurity Pros

Uptycs's unveiled an agentless workload scanning solution, arming teams with 100% friction-free coverage of their cloud workloads. Agentless workload scanning gives you a fast, point-in-time snapshot of the security posture of all workloads in your environment. You can measure risk (vulnerabilities and misconfigurations), detect malware, and understand the compliance posture of workloads.

This session features Jack Roehrig, a seasoned security veteran and CISO, who joins us to break down the benefits of an agentless model and why the Uptycs unified approach of both agentless and agent-based cloud workload security provides the best of both worlds.

When to use Agent-Based and Agentless Workload Security

Advanced Techniques and Common Pitfalls in Scaling Cloud Security

The specific challenges of securing an expansive multi-cloud or hybrid environment go far beyond the cloud-provider baselines and compliance best practices. Decision makers are moving beyond the legacy tool portfolio standards to address the need for a new approach to people, process, and technology strategy.

In this fireside chat, we’ll outline and then dive into the most salient and unique challenges for mature cloud sec teams, including a lack of visibility, the ephemeral nature of the cloud, and inflexible processes. Then we’ll discuss a few new approaches to address these challenges in your strategy immediately. Key elements of securing cloud environments (IaaS/PaaS and SaaS) across the major public cloud providers (AWS, GCP, Azure) and share critical insights on how modern defenders should be approaching the most salient challenges of cloud security, including:

 - Why cloud threats look different and how to model them
 - Addressing and eliminating the dreaded data silo
 - Operationalizing a “visibility first” strategy for security decision making

The ephemeral nature of misconfigurations and vulnerabilities in the cloud and how to manage them
Join Uptycs’ Director of Cloud Security and former AWS Head of ATO, Andre Rall with Director of Product Management and former Former RSA Product Executive and Security Expert Sudarsan Kannan for an in-depth chat. This will be a useful session for anyone building a cloud-native security program to support and enhance their organization’s growth and innovation.

Oops! Your Developer’s Laptop Is Connected to Your Cloud… What Now?

The specific challenges of securing an expansive multi-cloud or hybrid environment go far beyond the cloud-provider baselines and compliance best practices. Decision makers are moving beyond the legacy tool portfolio standards to address the need for a new approach to people, process, and technology strategy.

In this fireside chat, we’ll outline and then dive into the most salient and unique challenges for mature cloud sec teams, including a lack of visibility, the ephemeral nature of the cloud, and inflexible processes. Then we’ll discuss a few new approaches to address these challenges in your strategy immediately. Key elements of securing cloud environments (IaaS/PaaS and SaaS) across the major public cloud providers (AWS, GCP, Azure) and share critical insights on how modern defenders should be approaching the most salient challenges of cloud security, including:

Why cloud threats look different and how to model them
Addressing and eliminating the dreaded data silo
Operationalizing a “visibility first” strategy for security decision making
The ephemeral nature of misconfigurations and vulnerabilities in the cloud and how to manage them
Join Uptycs’ Director of Cloud Security and former AWS Head of ATO, Andre Rall with Director of Product Management and former Former RSA Product Executive and Security Expert Sudarsan Kannan for an in-depth chat. This will be a useful session for anyone building a cloud-native security program to support and enhance their organization’s growth and innovation.

Scaling Up Your Cloud Security Program: Advanced Techniques and Common Pitfalls

How to Make Linux More Secure (with less work)

Let's have a candid conversation about getting back to basics.

Linux’s power is its versatility. It can host hundreds of containers across a complex network or run a single desktop. It can power everything from smart TVs, Android phones and most Internet of Things (IoT) devices.

But when it comes to locking down Linux, its adaptability can also be it’s Achilles’ heel.

Here’s the truth: There are myriad solutions promising to help secure your Linux environment but none of them are worth a damn if you don’t have the basics down.

We have a candid conversation about the importance of laying a firm foundation for an effective security program for your Linux environment and explore what we consider the 4 Golden Rules of Linux Security:

 - Reduce attack surface area with Secure Shell (SSH) best practices
 - Scan for odd user activity
 - Streamline routine Linux security tasks
 - Improve your threat detection

Security professionals of all stripes will come away with actionable recommendations to prioritize and execute on these four foundational tenets and get their most pressing Linux security questions answered by an expert.

4 Golden Rules of Linux Security

Data becomes information only when you know the right questions to ask.

The Uptycs Security Analytics Platform empowers security teams to ask questions across their attack surface and uncover actionable answers to improve enterprise-wide security.

Uptycs offers complete security observability for your cloud workloads, collecting and analyzing real-time workload activity in detail—for hosts, VMs, containers, microVMs, and serverless functions—alongside the cloud infrastructure and orchestrator telemetry that acts as the control plane for these cloud-native applications.

Join us to learn:

How we’re addressing unique cloud-native security challenges with security observability across the attack surface
An “under the hood” walkthrough of the Uptycs Security Analytics Platform
How to reduce noise and quickly visualize the attack chain with an integrated MITRE ATT&CK dashboard, composite threat scores, and process graphs

Defending The Modern Attack Surface: Cloud-Native Security Observability

Gartner just released the first Market Guide for Cloud Native Application Protection Platforms (CNAPP). This means that CNAPP is here to stay, and its rapid evolution over the past few years will likely continue, especially as tools are unified and siloes are eliminated.

In case you’re just joining the conversation, the establishment of a CNAPP market guide is a milestone for cloud security, signaling an end to niche cloud security tools meant to solve specific problems (CWPP, CSPM, CIEM, etc). As the market matures, these functions are being unified into a single platform: CNAPP.

Gartner’s 2023 CNAPP Market Guide | Live Discussion

Cyber Security

Gartner

Security Management

Security Strategy

Emerging Technologies

Emerging Markets

Information Security

Cloud Security

IT Security

Application Security

Cloud computing has exploded over the past few years, delivering a previously unimagined level of workplace mobility and flexibility. The cloud computing community on BrightTALK is made up of thousands of engaged professionals learning from the latest cloud computing research and resources. Join the community to expand your cloud computing knowledge and have your questions answered in live sessions with industry experts and vendor representatives.

Cloud Computing

The IT security community on BrightTALK is composed of more than 200,000 IT security professionals trading relevant information on software assurance, network security and mobile security. Join the conversation by watching on-demand and live information security webinars and asking questions of experts and industry leaders.

As an IT professional, many of the problems you face are multifaceted, complex and don’t lend themselves to simple solutions. The information technology community features useful and free information technology resources. Join to browse thousands of videos and webinars on ITIL best practices, IT security strategy and more presented by leading CTOs, CIOs and other technology experts.

Gartner’s 2023 CNAPP Market Guide | Live Discussion

Presented by

About this talk

More from this channel