Speaker 1: We created a new segment in the industry. What we're
doing is data science for cyber security.
Speaker 2: Welcome listeners to the Industrial Security Podcast. My name is
Nate Nelson. I'm here with Andrew Ginter, the vice president
of Industrial Security at Waterfall Security Solutions, who's going to
introduce the subject and guest of today's show. Andrew, how
are you.
Speaker 3: I'm very well, Thank you, Nate. Our guest today is
Karmit Yadin. She is the CEO of Device Total and
Device Total is doing ot security data science in the
area of vulnerability management and I had no idea what
that was, so I was keen to find out.
Speaker 2: Then, without further ado, here's your interview with Krmeat.
Speaker 3: Hell, car, meet and welcome to the podcast. Before we
get started, can I ask you to please you say
a few words about your background for our listeners, and
you know a bit about the good work you're doing
at Device Total.
Speaker 1: Thank you for the opportunity. Highly appreciated. So a little
bit about my background. I started my journey in the
cyber security space when I joined the Israeli Army was
trained for network and security. I worked as a CISOM
in several NESTBAC companies. I worked with governments around the world,
mostly with the US government, on gathering intelligence from connected devices,
and with time, I realized that the biggest challenge the
cyber security industry have is in the fact that as humans,
we connect ourselves with so many devices and the number
of connected devices is increasing dramatically, and the problem is
that security teams and humans don't have visibility to the
security posture of each device and their organization. They also
don't have visibility on how each device impacts the entire organization.
So I decided to take that as a personal mission
for me to solve. I did my doctoral studies exactly
about this subject, and I funded the device total to
solve this unique problem and significant one.
Speaker 3: Our topic today is vulnerabilities and there's a lot of
information available about vulnerabilities on the Internet. Can you talk
about vulnerabilities? Which part of that spaces are you looking at?
Speaker 1: So the first important thing is for us to understand
what does it means vulnerabilities for the IoT and the
OT space. And the biggest challenge organizations have today is
to know what vulnerability is related to any of their
devices in their organization. Now, in order to understand that,
we need to understand how the vendors that manufactures those
devices match vulnerabilities. And what's important to understand it is
that vendor publish their vulnerabilities by two main parameters. One
is the hardware of the device and the second one
is the software which is the filmware version. Now, there
are different sources from where we can gather this information.
So the most reliable source is the vendor security advisory.
The vendor responsibility by regulation by the way they have
to publish and to disclose the vulnerabilities they are aware
of to the industry and to their customers. Most of
the vulnerability management today focusing on IoT and OT will
gather the information from MVD. Now, the problem with MVD
is that MVD provide a non accurate and non complete
visibility on the vulnerability on those devices. Therefore, customers and
organization in order to in order to identify the accurate
data vulnerabilities data for their devices will need to do
lots of manual activities. They will need to go to
the security advisory and to try to understand what vulnerability
is related to these devices. This task takes, like forever,
a lot of time and it's and it's a very
difficult task to do, a lot of manual work, different websites,
definitely unscalable. So this is how the industry looks today.
There is no one universal repository providing all the data
for any device.
Speaker 3: So that that does sound like a lot of work
for you know, someone like me. You know, if I'm
operating an industrial site, I've got a lot of equipment,
I've got a lot of software to try and go
out and find this information manually. You're saying, is well,
it's a lot of hard work.
Speaker 1: Yes, that's true, it's a lot of hard work. The
problem is that security advisories today they are non structure data.
The data inside there is a non structure and for
those vendors that try to structure that didn't structure the
entire data. So we are dealing with a lot of
data that machines cannot consume and a humans that are
capable to rate that doesn't have the scalability that machine have.
So that's the problem. The data is there, but we
cannot consume that, and this is one problem. The second
problem would be, now that I understand what problems do
I have, how am I going to solve that? So
you're one hundred percent right.
Speaker 3: In previous episodes of the podcast, we have had people
talking about new standards that are out there for publishing
vulnerability information in a machine readable format. You know, I
had imagined that those standards would solve this problem. Are
are they not solving it?
Speaker 1: The problems start with the fact that specifically in IoT
and OT devices, there are so many vendors that manufactures
different type of devices to the industry, and there is
no alignment and there is no standardization on how vendor
A publish their security data versus Vendor B, So there
is no alignment between them, and our job is to
create that alignment because it doesn't exist elsewhere. Another thing
about standards is that there are lots of standards and
regulation for the organizations that are using iotis and OUTI devices.
They must validate what vulnerabilities they have, they must use
their latest version of the devices. They must control the
risk of the devices in different end gills. So the
majority of the regulation and the standards is on the
organizations that are using the devices versus on how the
manufacture should publish. They have to publish, but the way
they publish is their own way, and each vendor doing
that differently today.
Speaker 3: Listening to what you're saying here, you know, it sounds
like what the world needs is a search engine for
vulnerabilities that can tell me, you know, what's broken, can
tell me what fixes are available, you know, with reliable,
up to date data. Is that what the world needs?
Speaker 1: Know Andrew, I think that what the world needs is.
Speaker 3: To know.
Speaker 1: What vulnerabilities exist on their devices. They don't want to
go and search our organization don't want to go and
use a search engine to search all the vulnerabilities on
all their devices. They want someone to tell them, hey,
these are the problems you have. These are the solutions
that you need to implement. And that's the priority on how,
on how and when you should do that. And that's
a solution that organizations like Armies, Nozomi and Clarity provide
to day to their customers. The companies that needs that
search engine and capabilities are those companies they need that
to have, They need to have device that we are
behind their scenes.
Speaker 3: You have product in the space. What do you have? What?
What what you know? How do you work with with
with these vendors?
Speaker 1: Okay, so what we're doing we are on a daily
basing collecting and normalizing all the data exist on any
security advisories in the industry today. So we're collecting the
data from the security advisories from the vendor website. We
normally the data, we structure the data, and for the
very first time in the industry, we managed to create
one universal repository that includes all the security data, including
the vulnerabilities and the mitigation and remediation for any device
exists in the industry today. And what those vendor can
do together with us, they can consume our data based
on the devices they identified in the customer network. They
can query our database and we will reply back with
the vulnerabilities matched to the devices they identified, mitigation, remediation,
software update, end of life data, en so on. And
we are updating the data daily.
Speaker 2: So Andrew, I, while I was listening to her, just
now decided to pull up any given CVE on mvd's website.
We have a description of the problem, we have a
score associated with just how severe the vulnerability is. We
have hyperlinks to mitigation instructions and then various other information.
So I guess what I'm wondering is what exactly the
platform she's describing does so much more or better than
what seems to me like a pretty comprehensive list of
what I need to know about this vulnerability.
Speaker 3: What Device Total has done is a make the NBD
machine readable because you know, to her point, if I
have a refinery with I don't know how many CPUs
in it. Let's say you know six thousand devices with
CPUs in them, everything from PLCs to flow meters to
you name it. And you know my question is not
where's my search engine? I want to go to each
one of my six thousand devices once a month and
look up the device in the search engine. That's not
what I want. What I want is to pay someone
like Armists or Clarity or Dregos or Nazomi to tell
me what devices I have, to tell me which of
those devices are out of date, to tell me what
mitigations are available for these out of date devices. I
want someone to solve this problem for me. And so
what we need under the hood of Nazomi and Dregos
and whatnot is that machine readable database of vulnerabilities, because
these platforms are the ones that are active in my refinery,
scanning what devices I have, keeping track of what devices
I have and where they are, and what their purpose is,
and they need access to a constantly updated database of
vulnerabilities so they can produce those reports about how much
troublining for the devices I have? Does that make sense?
Speaker 2: I see. So it's less that NVD doesn't provide the
specific kinds of information we need. It's much more about
making this information accessible and machine readable.
Speaker 3: That's right, machine readable for the other vendors that need
the data. Another thing that you know I was talking
to commit after the fact I didn't capture in the
recording is you know she pointed out, and it's it's
public knowledge. If you google the MVD program and you
know falling behind, you'll see an announcement from earlier this
year saying, you know, we are fall behind. There's too
many vulnerabilities. The program had had to not process all
the vulnerabilities that were being disclosed to them. They prioritized
what they thought were the most important vulnerabilities, but the
database was falling behind. So that's another argument for a
private vendor coming in here doing this, having someone pay them,
rather than have the government do it and you know,
be subject to the vagaries of I've only got so
much budget, there's only so much I can do with
that budget. You know, this is this is an opportunity
for private industry to come in and do the job
sort of thoroughly completely because they have the money to
do it. So reflecting on this, Nate, what strikes me is,
you know, I, in hindsight it makes perfect sense. But
you know, until I realized what Device Total was about,
I had no idea that such a company existed. If
you think about it, you know, what's the value that's
delivered by companies like Armis and Dragos, And that's sort
of class of call it asset inventory and asset management solution.
They scan your network, they figure out what assets you have,
and they come back and tell you how vulnerable they are.
And so they need their own Every one of these
vendors needs a machine readable database of devices and vulnerabilities
and ideally things like workarounds and compensating measures and fixes
if they're available and where the fix is available. They
need all of this so that they can present this
in reports, they can present it in whatever to their customers.
And before Device Total existed, I would have imagined that
every one of these vendors would have to do this
research on their own. And once they produce that database
for their own internal use. My own guess is that
they'd be reluctant to sell that database to somebody else.
You know, why would they give their competitors a leg up.
And so that, you know, in hindsight, produced the opportunity
for someone like Device Total to come in there, do
the job once, and sell the result. You know, if
they can do the job in a sense better than
any one vendor could do individually, there's huge incentive for
these vendors to say, you know, instead of me doing
this painfully manual process and producing an infraior result, just
buy the data from Device Total. So makes sense in hindsight.
But you know, before I talk to Carmite, I had
no idea that this sort of niche and the ecosystem existed. Okay,
so it's starting to become clear to me. You're saying
that the kinds of vendors like Drego's Nasomi Clarity, that
kind of vendor is your customer.
Speaker 1: So that kind of vendors, Yes, so we work with
any platform that has asset management and asset discovery solution,
and those kind of customers using a data is a
layer of intelligence on top of their asset discovery and
asset management capabilities so they can give better visibility and
data that they don't have today, like the mitigation, remediation,
end of life data for any IoT and OT devices
exists in their customers network. On top of that, our
customers will also be large scale organization service providers, stock companies.
Their problem is that they are using different asset management discovery,
different tool and some of them that are doing even manually.
Our capability is in the fact that we are capable
do digest any asset inventory list from any source, whether
if it's manually or from the asset discovery, and we
provide the layer of intelligence on top of that data,
and we will provide on a daily basis the accurate vulnerabilities,
accurate mitigation action, what softwares we need to do software
update to, under what priority work are the workarounds available
from the vendor. And with all those data, we will
also provide the prioritization based on the risk and the
criticality for the end customer.
Speaker 3: So it's something subtle in there that that I'm not
sure everyone caught. You know, It's it's clear that the
asset management vendors are potential customers of this, you know,
database of vulnerabilities. But Carmite also mentioned service p you know,
think I don't know a big oil company with one
hundred and fifty sites, each of which is you know,
a multi billion dollar asset. These big organizations tend to
have central security operation centers. They tend to insource, they
do that themselves. And you know, these centers tend to
have automation. They've got you know, they buy you know,
one or six of each kind of tool, and they
generally have their own automation, their own code that they've
they've invented to pull it all together, and you know,
automate the job of managing vulnerabilities, managing incidents, managing everything.
The second sort of customer she she mentioned very fast
was service providers. You know, security as a service is
a thing, even in the OT world. A lot of people, don't,
you know, People smaller than the biggest companies need a
security operation center, but don't want to staff their own.
They might not be quite big enough to staff their own.
Even if they are a little bit big enough, you know,
this may not be what they want to focus on.
And so there's a fair number of service providers out
there that will uh say, we will manage we will
look at your alerts, We will you know, manage your
security for you and raise the alarm if if you
need to do anything, and you know, send your reports
about your assets and do all of the things that
asock does. And again, these service providers one, you know,
they compete based on the knowledge the domain of their
their security analysts, their experts, their people. But they also
compete to a degree with technology. Yeah, they buy a
bunch of you know, off the shelf technology to gather
data and manage alerts. But again they tend to have
some of their own technology that sort of is their
special sauce adds their their their special flavor to the
the security as a service offering. And that class of
vendor service provider might also benefit from access to a
vulnerability database from from time to time to you know,
to produce their own automation and make their own people
more effective in the space. So that, you know, that
was something that went by fast and struck me as interesting.
Sounds like you are competing with the MVD, the National
Vulnerability Database. Do you have a search engine where people
like me could search your database?
Speaker 1: Yes, we do have that capability. Our customers can log
into the portal and they look manually for devices. One
of our main capability and a very unique one, is
that we enable customer to identify the security posture of
devices even before for they purchasing the device. So we
give our customers to get visibility and impact on any
device existing the industry, even before purchasing that. Now, comparing
us to an MVD, we just don't do what MVD
does MVD. The goal of mvds is match vulnerabilities and
provide data on vulnerabilities. MVD doesn't look at the risk
from a device perspective. MVD doesn't consider the relationship between
different devices in the network and that impact. MVD doesn't
have the mitigation, doesn't provide remediation, doesn't provide workarounds, end
of life data. MVD doesn't have the data that or
organization nowadays need.
Speaker 3: Can you talk about your reception? You know, how what
what's the experience of your customers? Like what you know?
How did how did they receive the you know, the
knowledge that that you existed.
Speaker 1: I can share with you that when we just started,
we went to one of the largest organizations Fortune five
hundred organization in the US and he said, listen, we
work with all the vulnerability management tools exist in the
industry today, show us what you have. But it was
like very suspicious. He wanted to see another option, but
was very suspicious. And when we actually show him the data,
he was he was she really liked that. He really
liked that because so we managed to solve him so
many problems that he needed to do manually that he
needed to check the vendor, to go online and to
validate the data for critical devices. He was very surprised
that he can add devices manually, not from assets management,
and still can get the data. He was amazed because
understanding the impact of new devices before purchasing them doesn't
even cross his mind that it's an option and not
not just that. The one of the unique things that
we bring is also the mitigation and the remediation. So
for the very first time, he doesn't need to pay
for very expensive tools to give them the problem. Now
he can also know what's the solution for all the
vulnerabilities that war identified on this network and under what
priority to sell to to mitigate that. So it's a
it's a it's a really game changer for the end customers.
Themselves and obviously for companies that has the assets management
capabilities that wants to give higher value to their customers.
Speaker 3: You've been doing this for a while, Can I ask you,
you know, where are you at? What's coming next?
Speaker 1: Today? We're focusing and I'm primarily focusing on the IoT
and the OT industry because of everything that we talked
about today. This is where an organization have a very
significant problem. But as device, our goal is to cover
any device exists in the industry and any device exists
any a network, and our next stage is to add
all the IT devices and software into our platforms as well.
That's what we are working on.
Speaker 3: So that's a little bit surprising. I mean, in my experience,
a lot of the cybersecurity technology that's in the OT
space starts in the IT space and then expands to
include the weirdness of the OTA space. You're doing it
the other way around.
Speaker 1: Apparently we're not most people. What we're doing is very different.
We didn't change only that approach, we also change the
other approach. So we created a new segment in the industry.
What we're doing is data science for cyber security. Okay,
we are a data science company for cyber security in
a very specific approach for devices. We decided to start
from the IoT and the OT industry just because there
is no alternative to that right And the reason for
that is that organizations today cannot install client or agent
on IoT and OT devices and that's why it's a
significant problem. And we, as a startup company, need to
start where we see the biggest potential. So we started
there and now we are expanding for the IT industry.
Speaker 3: It sounds like you have more data than the MVD.
I'm curious, are you Are you working with the MVD?
Are they going to use your data in the future.
Speaker 1: So our business model is to sell data. We're the
only company in the industry to the that have this data,
and we're the only organizations today that are doing that.
We are normalizing, fixing, and constantly updating the data for
any device exists in the industry and the only ones
that are doing so. So I m v D should
use and benefit a lot from using our data as
well as any other organization. I see NVD as a
great potential customer for us.
Speaker 3: Cool. So you know I learned something this episode I
had before I talked to you, folks. I had no
idea that anyone was doing this. So you know, thank
you for doing this good work. Thank you for joining
us on the podcast. Before I let you go, can
you sum up what is sort of the key lessons
to take away from our interview here.
Speaker 1: So the key less lessons for us today is that
managing vulnerabilities on IoT and OTI devices can be easy,
can be done, and can be easy. Our capability is
to provide all the vulnerabilities on any device. Actually we
give a commitment that we cover any IoT and OUTI device,
provide vulnerability, the mitigation, remediation, end of life data, and
we manage to create data that doesn't exist in the
industry today and no one is doing that today. And
welcome everyone to use to go to our website at
deviced dot com you and sign up for a free demo,
Connect me on lin Gidin as well, and feel free
to reach out. Thank you and thank you for inviting
me today. Highly appreciate it.
Speaker 2: Andrew. That concludes your interview with Karmitia Dein to take
us out here, I'm wondering she seemed to suggest that
this platform, this service was broadly applicable to all industrial
IoT sorts of devices. But is there any particular industry
that might need this more than others because for one
reason or another they were having trouble with this kind
of thing before.
Speaker 3: That's a good question, and you know, on many previous
episodes we've had discussions of how difficult it is to
patch certain kinds of industrial systems. But what I find
in my own customer base is that pretty much everybody
needs the knowledge. So heavy industry where there's safety critical
functions and there's an extreme reluctance to patch, still wants
to know how much trouble are in so that they can,
you know, when new information is available, they can reevaluate
the effectiveness of their compensating measures because they can't patch,
but they need to know how much trouble are in
so that they can figure out have I got enough
and the right kind of compensating measures in place? Sort
of less consequential, Let's say, you know, manufacturing that is
less safety critical tends to patch more aggressively, and so
they need to know what patches are available and which
are more important than others so that they can get
those patches applied. So, in my experience, sort of everybody
wants this knowledge and they're going to use it for
different purposes. What struck me about the episode was sort
of lifting the lid on how all that asset management
stuff works. I really did know that there was you know,
I did not know there was this, this opportunity in
the ecosystem for a data science a service provider providing
a lot of data and you know, now I know
that you know these people exist. It's it's a sort
of a look behind the scenes. I found interesting. I
was also happy, for the first time in my life
to have a concrete example of data science. I heard
the phrase before and always scratch my head, going, what's
that you know, new fangled language. Well, here is a
very large amount of data that needs to be managed,
needs to be made available to lots of different kinds
of consumers, from people to you know, machines that do
asset management, to machines that that you know, draw conclusions
about Well, if you have these vulnerabilities and those vulnerabilities
in the same network, you might be subject to this
sort of your problem. That kind of of analytics you know,
might even be AI based. These are all services you
can provide conclusions you can draw once you have machine
machine access to the data, so you know, data science
for for OT security. It's nice to have an example.
Speaker 2: Well, thank you to car Meete for speaking with you, Andrew.
And Andrew is always thank you for speaking with me.
Speaker 3: It's always a pleasure. Thank you, Nate.
Speaker 2: This has been the Industrial Security Podcast from Waterfall. Thanks
to everyone out there listening.