IT Briefcase Exclusive Interview: Fighting the Online Security Battle with Audian Paxson, Critical Watch

Effectively securing a business is not a simple task. More often than not, many skills and technologies are involved.

In the below interview, Audian Paxson from Critical Watch outlines security threats that businesses are facing today, as well as measures that can be taken to help organizations efficiently fight the online security battle.

•  Q. What are you seeing as the biggest security threats to businesses today?

There are many that I would put on the top of the list. BYOD (bring your own device) is just at the infancy of creating security problems we haven’t even dreamed of. Corporate participation in Social Media is further enabling targeted cyber threats on executives and corporate assets. And best practices and security technologies can’t begin to catch up to the adoption rate of Cloud Computing. Those are probably the three leading technologies that just about any size business is embracing or about to embrace right now. As always, any new technology has an associated threat that is just one step behind and security technologies to address those threats are usually 3-4 steps behind.

None of this represents a new paradigm. You can replace mobile, social media or cloud computing with yesterday’s new business technologies like virtual machines, VOIP, Wifi or SaaS. The same pattern remains: New technology => New threat => New security

The biggest threat is the aggregate of all of this – simply “just trying to keep up.” Keeping up with the technologies and the required security tools requires increasingly more man hours and more advanced skills and training – and it appears to be a losing battle. Recent reports claim the industry will need to add nearly 2 million jobs during the next three years to keep up.

Click here if you’d like to view the article

•  Q. Can you please explain a little about the benefits of Active Countermeasure Intelligence and its three components?

Most vulnerability management or risk management solutions provide a narrow view of just one or two aspects of the networking and computing environment in the typical enterprise. Active Countermeasure Intelligence (ACI) makes it possible to view risk data from all the different layers within these environments in a consolidated and comprehensive view while presenting a contextual recommendation and ranking of how to mitigate that risk with the optimum countermeasure(s). Or said more simply… ACI helps you see all the stuff that can do bad things and gives you detailed recommendations to help keep those bad things from happening.

Active Countermeasure Intelligence is a combination of three components:

1. ACI Platform is the foundation, architected to integrate with a variety of vendors that provide risk inputs, countermeasures and analytics and reporting consoles all via multiple APIs (application protocol interfaces) as well as industry standards.
2. ACI Recommendation Engine uses the data from all these different vendors to provide detailed mitigation strategies using one or more countermeasures. An example solution would use actual risk input data from a customer’s environment to generate a detailed site survey; detailing a ranking of what security technologies the customer should invest in along with detailed configuration settings tailored to the customer’s environment.
3. Basecamp Labs is a research team at Critical Watch that analyzes security data from a variety of sources and then formulates the countermeasure taxonomy and expressions used by the ACI Platform.

• Q. In order to properly secure a business, there are frequently many skills and technologies involved. Can you please tell us what measures Critical Watch is taking to help organizations efficiently fight the battle against security threats today?

One of the benefits of working with partners and customers during the past 12 years is learning from their real world environments. They share their challenges and allow us to work with them to develop new solutions. We learned that very few point solutions are optimally configured, usually because they are complex and require advanced training to optimize their settings. We developed a solution using the ACI Recommendation Engine to help administrators automatically optimize a mitigation strategy using one or more security technologies that they usually already have in place.

• Q. How can tools such as FusionVM from Critical Watch provide vulnerability management that can be customized to manage vulnerabilities throughout the enterprise?

FusionVM makes it easy to set up a sustainable, repeatable and automated process to monitor and notify enterprises of vulnerability issues. This approach saves valuable time and money compared to simple vulnerability scanning tools that generate big huge flat reports without any customized context. The general process should be easy and repeatable from discovery to scanning, to reporting to remediation.

• Q. What other solutions can Critical Watch offer to help businesses improve their current level of Security?

We offer PCI Compliance services for companies that handle credit card payments. PCI compliance standards aim to protect personal information during processing of credit card payments.

Audian Paxson is director of product management at Critical Watch, responsible for product direction and product marketing for FusionVM and the ACI Platform. In this role he identifies new opportunities for Critical Watch solutions based on industry research and customer feedback. Before Critical Watch Audian was responsible for product strategy at Iconix, Inc. where he was instrumental in launching anti-phishing solutions designed for partners PayPal, eBay and Trend Micro. Audian also held positions at Intel Corporation where he was responsible for the development and marketing of Intel Netmerge and Intel Converged Communications Platform.