In a recent podcast interview with Zack Hack, Host of Cybercrime Magazine, Robert E. Johnson III, Cimcor CEO/President, discusses having a proactive vs. reactive mindset in terms of cybersecurity, change management, change control, and system integrity assurance.
The podcast can be listened to in its entirety below.
Zack Hack, here. Welcome to The Data Security Podcast sponsored by Cimcor. Cimcor develops innovative, next-generation file integrity monitoring software. The CimTrak Integrity Suite monitors and protects a wide range of physical, network, cloud, and virtual IT assets in real-time while providing detailed forensic information about all changes. Securing your infrastructure with CimTrak helps you get compliant and stay that way. You can find out more about Cimcor and CimTrak on the web at cimcor.com/cimtrak.
Q: Joining us today is President and CEO, Robert E. Johnson, III. Robert has been a pioneer in the development of next-gen system integrity, monitoring, self-healing systems, and cyber security software. Robert, welcome back. Great to be chatting with you again. How've you been?
A: I've been great, Zack. I hope you've been great as well. I'm certainly happy to be back on your show and discuss some of these interesting security issues.
Q: And we're happy to have you here. Today, we're going to talk about the importance of proactive vs. reactive mindset in cybersecurity. Now, we hear a lot about the push for becoming more proactive with change management and IT. Will it solve many of the problems in cybersecurity? Do you think this is true?
A: Well, yes, to an extent. Change management, change control, this isn't new. It's been around forever. The problem in the industry has always been: "How do you implement change management at scale?" And to take it one step further, the other issue is: "How do you perform change management and monitor those changes at scale?"
However, if you are able to overcome those two issues, if that was achieved, that would have a material impact on operations, because that would improve up-time, it would improve availability, and it would improve reliability. And best of all, a strong change management process would not only benefit operations but would also benefit organizations from a security perspective.
Q: How can we get organizations to move to a more proactive mindset vs the reactive?
A: Well, honestly, Zack, you really need to be ready and must have both. You need to have that proactive mindset but you also need to be ready to react because there will always be a need for this reactive component of your cybersecurity strategy. However, there are ways that you can move and be more proactive in your approach. A couple of ideas are, one:
Implementing system hardening throughout your enterprise by leveraging CIS Benchmarks and DISA STIGs. In the end, this reduces your overall attack surface and that makes it much more difficult for threat actors to achieve their objectives. Another idea is:
Ensure that you have a trusted baseline for all of your systems in your organization. And then another thought is:
Implement a change control process and workflow throughout your organization. Make it the standard. Make it how you do things.
And finally, if you're going to implement those types of actions, you need to monitor. You need to understand what's happening. You need to have the insight into new and unexpected changes to your systems in comparison to that trusted baseline that I recommended you establish.
So, at Cimcor, we collectively call all of those steps that I just mentioned: System Integrity Assurance and Compliance.
Q: Continuous monitoring with what you call System Integrity Assurance and Compliance... Why is this uber-important?
A: It's important because, despite the industry's best efforts, things in our IT environment are going to change. Some change is bad, but guess what, often the change is good. Change management at scale has traditionally been a problem because it was difficult to differentiate between the good changes and the bad changes. The result was just a lot of noise.
However, imagine if you could get rid of all the good changes and just focus on the bad changes. And imagine, if you can do all of that at scale. That will be a game changer because you could focus your cybersecurity team to work on the issues that actually matter.
Even though that may sound incredible, that's exactly what we've built at Cimcor. Our product, the CimTrak Integrity Suite, can help you easily monitor even the largest infrastructures, identifying all of those unexpected changes, while simultaneously suppressing any noise related to the good changes.
This is a big win for the cybersecurity industry because it finally allows us to implement true and strong change management practices at scale. And if you think about it, almost every breach and hack starts with some change, and with CimTrak, you will always know about it.
Q: How long has Cimcor been in business? How long have you been around?
A: Cimcor's been in business since 1997, but this product is about twelve or thirteen years old. It's been evolving over the years, and now we think we have this product that can really change how we approach security in enterprises.
Q: If our listeners wanted to know a little bit about it, they maybe want to get a demo or go online and check it out. How do they go about contacting you?
A: It's very easy to learn more about us. You simply go to our website at www.cimcor.com and that's C as in cat, I. M, C, O, R . com and we would love the opportunity to provide your listeners with a trial so they can try it in their own environment, they can do their own proof of concept, or we can even provide a demonstration. We could do it online with Zoom and kind of walk your listeners through exactly what our product can do and the value proposition for their organization
Q: Great information, really great information. Thank you so much for sharing it with us and our listeners. Robert, thank you so much. Always a pleasure talking with you. We'll chat again soon.
A: Sounds great. I look forward to speaking with you again, Zack, I appreciate it.
.png?width=50&height=50&name=Robert%20(1).png)
