Name: Friday Flows Episode 23: Retrieve and respond to Azure guest accounts with Wiz
Start: 2024-03-25T09:38:00Z
End: 2024-03-25T09:38:06.000Z
Location: BrightTALK
Rating: 3.5

Smart, secure workflows for your whole team. The world's best companies
— from startups to the Fortune 10 – trust Tines to powerfully manage their
mission critical workflows, automatically responding to and remediating
alerts in real time.

In this week’s episode of The Future of Security Operations podcast, Thomas is joined by George Griesler. George has been working in cybersecurity since 1997, when he assumed the role of Senior Network administrator at the United States Golf Association (USGA), eventually advancing to Director of Information Security. He currently serves as the Senior Director of Cybersecurity at the National Football League (NFL), where he works to secure events like the Super Bowl, which in 2024 was the most-watched telecast ever.

George and Thomas discuss:

- What security operations looked like in 1997
- Protecting the secrets of regulation golf equipment at the USGA
- The shift in security and privacy needs at live sports events
- Securing scents, flavors, and other chemical formulations at IFF
- Preparing for Super Bowl LXXVIII in the wake of the MGM Resorts cyber attack
- The Super Bowl threat profile, from scoreboard hacking to stadium credentials
- Collaborating with cybersecurity experts from CISA, the FBI, Caesars Palace, and the MGM Grand.
- Aligning security operations with physical security
- The reality of working on high-pressure events
- The benefits of knowledge sharing with other teams working on live sports events
- The importance of relationship building across internal security teams:
- The potential of automation, orchestration, and AI in incident response

The NFL's George Griesler on securing the Super Bowl and reducing risk

Don't have a technical background, but want to create automations that can help your daily work?

Check out Tines University: https://lnkd.in/eVuaVKbd

Andrew Lee, a Business Development Rep here at Tines, recently completed the certification & learned how to create Tines stories. In this Friday Flows, he walks through an API Pagination story to grab Star Wars characters.

No matter your skill set, it's easy to get started. In a matter of weeks, you'll be prepared to build powerful workflows and start reducing mundane, repetitive tasks.

Friday Flows Episode 25: API Pagination with Andrew Lee

Intercom moved from taking 2 months to build a workflow to taking 2 hours using Tines.

Join us as we explore how Intercom’s IT team used Tines to boost efficiency by overhauling their workflows.

As well as using Tines for themselves, the IT team provides the guardrails by which they can share Tines with other teams in their business and allow these teams to automate their own workflows without worrying about compliance, sensitive data etc.

What to expect from the webinar:

A summary of how Intercom used to build and manage workflows compared to what they are doing now with Tines.
How Tines can help your IT infrastructure/IT support/ Cloud Security/ Customer solutions teams.
Q&A session with Tines and Intercom to answer your questions

Intercom's Journey to an IT Automation Center of Excellence

In this week’s episode of The Future of Security Operations podcast, Thomas is joined by Adam Khan. Adam is a cybersecurity and technology leader with over 25 years of experience working at Fortune 500 companies. He has a proven track record of building and managing global security teams, leading engineering, infrastructure, application, and product, and is currently VP of Global Security Operations at Barracuda.

Adam and Thomas discuss:
- Building discipline and resilience by working on SRE teams
- How a well-known DDoS attack changed his career path
- Using automation to reduce alert fatigue
- Strategies for plugging the security skills gap
- The potential of AI-driven XDR
- How cyber attacks are evolving in the age of AI
- Lessons learned from researching the history of cybersecurity
- Empowering teams to do their best work
- Creating a culture of continuous learning

Barracuda's Adam Khan on AI-driven XDR and plugging the security skills gap

93% of security practitioners believe that more automation would improve the work they produce.

Join us as we explore how Mars used Tines & Wiz to identify and remediate security risks within their cloud infrastructure with automated workflows. Along with insights on how to leverage Tines and Wiz, webinar attendees will hear directly from Mars about the impact these platforms have had on their business resilience and security culture.

What to expect from the webinar: A panel discussion covering:
- How Tines and Wiz can improve cloud security and reduce friction in current processes
- Insights from Mars on their investment in enhanced detection and response
- How companies can use these insights to operationalize cloud detection and response across their - teams and make security a team sport
- How to set security goals that are visible across the C-Suite
- Q&A session with Mars, Tines and Wiz

Remediating Mars’ Cloud Security Risks with Wiz and Tines

In this week’s episode of The Future of Security Operations podcast, Thomas is joined by Matt Johansen. Matt is a security veteran who has helped defend startups, the biggest financial companies in the world, and everything in between. Alongside his day job as Head of Software Security at Reddit, he teaches companies how to protect against cyber attacks, and coaches entrepreneurs and CISOs that need help with infrastructure, application, cloud, and security policies. He also writes Vulnerable U, a weekly newsletter that talks about embracing the power of vulnerability for growth.

Thomas and Matt discuss:

- Moving from a large security team at Bank of America to a small one at Reddit
- Embracing scrappiness and doing more with less
- Overcoming sunk-cost fallacy
- Why the 2014 Sony hack was a pivotal time for AppSec
- Running the threat research centre at White Hat
- What he looks for when hiring in AppSec, the SOC and beyond
- His decision to start creating content about mental health in security
- Moving past imposter syndrome
- Renouncing superhero culture
- Paved paths and guardrails, and what comes next after "shift left"
- Lessons learned from Reddit's 2023 security incident
- The power of automating incident response

The Future of Security Operations is brought to you by Tines, the smart, secure workflow builder that powers some of the world’s most important workflows. https://www.tines.com/solutions/security

Reddit’s Matt Johansen on renouncing superhero culture

Great Friday Flows today with Conor Dunne. He built this story to send notifications when a new device is enrolled in Jamf, check CrowdStrike to see if the device is also located there, and respond to a Slack thread with the findings.

They have impressively:

Reduced workflow build time by 95%, compared to Python
Have 4x more team members automating
Saved 150 hours in the first month of using Tines

Friday Flows Episode 24: Verify Crowdstrike is present on new devices in Jamf

This week on The Future of Security Operations podcast, Thomas is joined by Prima Virani. Prima is a security engineer who worked across industries as varied as oil and gas and Fintech before becoming Principal Security Engineer at Twilio. With over a decade of experience spanning infrastructure security engineering, incident detection and response, and forensics, she's also shared insights at countless security conferences around the world, including SecTOR Canada and Agile India.

In this episode, Prima and Thomas discuss:

- The unique challenges of working in forensics
- Her transition to detection and response and cloud security
- Building a security detection framework at Segment
- Reducing mean time to resolve through automation
- Using data to prioritize which processes should be automated
- Merging teams and technologies when Segment was acquired by Twilio
- Joining the securing platform engineering team at Twilio
- Designing a challenging and varied career in security
- The influence of mentorship on career growth
- Democratizing security through knowledge sharing
- How security will change in the next five years

Twilio's Prima Virani on tackling burnout through automation

On this episode of The Future of Security Operations podcast, Thomas is joined by Andrew Santell. Andrew is an experienced security leader who worked for the U.S. Navy for over a decade before moving into the private sector. In 2021, he founded the Security Operations program at Netflix, and recently, he joined edge cloud platform Fastly, where he is the Director of Security Operations and Cyber Defense.

In this episode, Andrew and Thomas discuss:
- Navigating the unique challenges of the Navy, from log management to prioritization
- Making the leap from the Navy to tech
- Building a security operations team and program from scratch at Netflix
- Red teaming phishing response playbooks at Netflix to test their effectiveness
- Recognizing the value of good processes
- Why teams should design processes first, automate later
- Creating a feedback loop between teams at Fastly
- How “shifting left” has helped Andrew’s team reduce vulnerabilities
- Using automation for risk assessment at Fastly
- Andrew’s approach to incidents like the Log4J vulnerabilities 
- Why growth in the vendor market is a good thing for practitioners 
- Why automation should be a requirement, not just a best practice
- What advancements in AI mean for threat detection
- The importance of risk-based decision-making
- The potential of self-remediation 
- Why good security leadership starts with taking care of your people

Fastly’s Andrew Santell on going from the Navy to Netflix

A fundamental pillar of cybersecurity continues to be employee education & awareness.

Today's Friday Flows features an easy way to test your employees & teach them to keep an eye out for suspicious emails.

This Tines story created by Conor Dunne grabs a list of employees from your HR system and sends them a simulated phishing email. A Tines Case will be created to track if a link in the email is clicked.

Friday Flows Episode 22: Run a Simulated Phishing Attack on your employees

To kick off season 5 of the Future of Security Operations podcast, Thomas is joined by Mandy Andress. Mandy is the Chief Information Security Officer at Elastic, a leading platform for search-powered solutions, and has more than 25 years of experience in information risk management and security. Before Elastic, Mandy led the information security function at MassMutual and established and built information security programs at TiVo, Evant, and Privada. She also founded an information security consulting company with clients ranging from startups to Fortune 100 companies.

In this episode, Mandy and Thomas discuss:

- Her move from accounting to security 
- Why she was drawn to Elastic's employee-centric culture
- How her role at TiVo in the early '00s shaped her view of privacy
- Switching from a technology-first to people-first approach to security
- Recognizing the human factor in incident response 
- Embracing asynchronous operations on dispersed teams
- The importance of bringing your authentic self to work 
- Staying technical as you move into leadership
- How she puts her law degree to use as a CISO
- Balancing compliance and overall security posture
- Collaboration and knowledge sharing within the CISO community
- Elastic's approach of knowledge sharing by default
- How prioritizing analyst time will be critical in the future of SecOps
- Adopting an infrastructure-as-code approach
- Balancing between proactive security measures and reactive responses
- Building a culture of security across the organization
- Tips for surviving in security operations in tech

The Future of Security Operations is brought to you by Tines, the platform that powers some of the world’s most important security workflows. https://www.tines.com/solutions/security

Elastic's Mandy Andress on switching to people-first approach to security

Learn more about one of our most popular workflow templates: Onboard Employees & Grant Access to Specific Tools where Conor Dunne shows how easy it is.

Friday Flows Episode 21: Onboard Employees & Grant Access to Specific Tools

In the third instalment of "Tines, securing your cloud infrastructure" we look at two stories designed to save money and resources and close potential security gaps in your Azure environment.

Firstly, we'll address the task of Updating groups assigned to a user in Azure Active Directory which allows admins to update a user's group membership in Azure Active Directory. This is essential for adding extra security to accounts flagged for suspicious activity and protecting the team & company as a whole. Secondly, we'll delve into the imperative process of deallocating and deleting unnecessary virtual machines in Azure while raising corresponding tickets. Efficient resource management in the cloud environment not only optimizes costs but also mitigates vulnerabilities. The story showcases how Tines' automation streamlines this process, ensuring unnecessary virtual machines are promptly addressed, enhancing your cloud infrastructure's resilience.

Throughout this webinar, we'll discuss the technical intricacies, best practices, and the seamless orchestration between Tines and Azure. Our aim is to equip you with actionable insights to enhance your cloud security strategy, leveraging the prowess of Tines' automation capabilities within the Azure framework.

Securing your cloud infrastructure with Tines & Azure

Launching an AWS EC2 instance can be done in seconds, but are they being set up securely for success?

In today's Friday Flows, Michael Tolan helps us celebrate the 700th Tines Story Library addition with a look at a customer submitted workflow to audit and remediate default security groups for virtual machines in AWS.

Friday Flows Episode 20: Regularly Update Insecure AWS EC2 Security Groups

Analyst’s often take in IOCs from many different sources and manually copy & paste them into security tools to search for them across environments or add them to blocklists. This can be time-consuming & repetitive.

This Friday Flows features a workflow that utilizes APIs to easily manage IOC’s in CrowdStrike & collaborate with peers in Slack.

Friday Flows Episode 19: Manage CrowdStrike IOCs in Slack

Learn how Intercom is automating use cases like:

Employee lifecycle management
Hardware issue reporting
Access request management
Security alert notifications

"For a long time, we’ve had this goal to empower other people in our company to automate their own processes, without having to wait on engineers to have bandwidth."

With an interface that teams in IT infrastructure, cloud security, IT support, and customer solutions can easily use, Tines is helping Intercom create that all-important culture of secure automation faster.

Friday Flows Episode 18: How Intercom's IT team boosts efficiency with Tines

Tines & Teams... has a nice ring to it!

Rosie Halpin, our newest Product Manager, walks through the new & improved ways to quickly get connected, start sending messages, and build powerful automations that send relevant information to users in Teams.

Aaron Sandow said it's now so simple & easy to use he could teach his grandparents to connect Tines to Teams!

Friday Flows Episode 17: How to authenticate Microsoft Teams for use with Tines

Friday Flows Episode 16: Monitor Intercom with Nightfall

Friday Flows Episode 15: Automating with Database Integrations

Friday Flows Episode 14: Analyze phishing email senders, URLs, and attachments

Friday Flows Episode 12: Building in Python vs Tines with No Code

Friday Flows Episode 11: Respond to & configure Terraform Cloud run task

Friday Flows Episode 10: Lock Down Devices with JAMF & Duo Security

Friday Flows Episode 9: Grant Temporary Application Access with Pages

Friday Flows Episode 8: Manage Elasticsearch and GKE clusters via Slack

Friday Flows Episode 7: Elastic Alert Response with Cases & Slack

Friday Flows Episode 6: Normalize Alerts with ChatGPT

Friday Flows Episode 5: Analyze CrowdStrike Detections

Friday Flows Episode 4: Run a Crowdstrike Realtime Response Command

Friday Flows Episode 3: Employee Onboarding & Offboarding

Friday Flow Episode 2: Threat Intelligence Enrichment

Friday Flows Episode 1: Tines Overview

Friday Flows

"This is a great example of the power of Tines. You can automate something simple, but also very manual & time-consuming."

Michael Tolan continues our cloud security series & walks us through a workflow to easily identify and manage Azure Entra ID guest accounts detected by Wiz. In seconds, take action by disabling or deleting any undesired guest accounts via a Tines page.

Friday Flows Episode 23: Retrieve and respond to Azure guest accounts with Wiz

Azure

Security Automation

Cloud Security

IT Security

SaaS

Security as a Service

Cyber Security

Threat Detection

Security Operations

The IT security community on BrightTALK is composed of more than 200,000 IT security professionals trading relevant information on software assurance, network security and mobile security. Join the conversation by watching on-demand and live information security webinars and asking questions of experts and industry leaders.

Increasing expectations for good governance, effective risk management and complex demands for corporate compliance are presenting a growing challenge for organizations of all sizes. Join industry thought leaders as they provide you with practical advice on how to implement successful risk and compliance management strategies across your organization. Browse risk management resources in the form of interactive webinars and videos and ask questions of expert GRC professionals.

IT Governance, Risk and Compliance

Enterprise applications have become a crucial piece of infrastructure for many businesses. The enterprise applications community on BrightTALK features the latest insights in enterprise application integration, enterprise application architecture and EAS software. Join the community to gain access to thousands of videos and webinars presented by recognized enterprise information systems experts and arm yourself with the knowledge you need to succeed.

Enterprise Applications

As an IT professional, many of the problems you face are multifaceted, complex and don’t lend themselves to simple solutions. The information technology community features useful and free information technology resources. Join to browse thousands of videos and webinars on ITIL best practices, IT security strategy and more presented by leading CTOs, CIOs and other technology experts.

Friday Flows Episode 23: Retrieve and respond to Azure guest accounts with Wiz

Presented by

About this talk

More from this channel