Bio

CHARLES HERRING

WitFoo Chief Technology Officer

By the end of 2015 it was clear to me that the craft of cybersecurity was broken. My mind continuously compared SECOPS with other mature crafts that I had observed and executed, and it bothered me to the point of stealing peace and sleep. I decided I was going to start a revolution to “Build the tools and data needed to enable the craft of cybersecurity operations to mature.” This focus formed the mission of WitFoo and the battle cry for the revolution. Most revolutions fail because there is a myriad of devious factors stacked against them. Most Davids are murdered by Goliath. It is very rare for bold, underdog revolutions to succeed. We knew that even before we filed Articles of Incorporation. We knew to deliver sustainable, healthy change into a toxic market, we were going to have to have a set of plans resilient to the dangers and evils that existed.

Rock On

For the last 4-5 years of running with the WitFoo revolution, I have constantly had to defend our small team. In the early days, potential investors would remark, “You can’t get all this done with such a small team.” Now that we have accomplished building the product, the go-to-market strategy, have many happy customers we are still told, “I don’t see how you can get so much done with such a small team.” I want to respond with “that seems to be a problem with your ability to see since we’ve already done it and you are looking at it,” but I realize that is not going to help the situation.

In dealing with customers, analysts, partners and investors I am regularly faced with having to decide whether I should acquiesce and deliver what they want or try to teach them why they should change their minds and accept what I believe they need.

WitFoo’s Global Indicator of Compromise feed is a secure and reliable way for the WitFoo community to share intelligence about emerging threat sources.

The feed is updated in near-real time as attacks occur across the WitFoo Community. It consists of the IP address and hostname of the attacking source, the tools and methods that the community is using to detect the threat and how many incidents the source has been a part of across the community.

Hits in the feed are automatically shared across the entire community and big data stacks of each deployment are retrospectively analyzed to find hits that may have been missed. All records including firewall, proxy, EDR and NetFlow records are checked for communications with the known bad indicators.

Abstract

Developing software that changes the world, exceeds customer expectations, provides turn-key functionality in diverse scenarios while meeting security and compliance requirements is the holy grail of Security Development Operations (SECDEVOPS). There are thousands of variables that need to be constantly addressed to find the balance that delivers sustainable and secure success. In this session, WitFoo’s chief engineers will outline an innovative approach to secure devops called Metric Driven Development. It will cover the following topics:

tldr; – Just Download the Spreadsheet

I put together an Excel spreadsheet that does all the calculations I am going to explain below. If you don’t need to know how the sausage is made, feel free to download it and plug in your numbers.Download here: ROI Calculator.xlsx

When I was learning how to troubleshoot and repair electronics in the Navy, I would sometimes challenge one of the instructors on how something worked. If I delved into a complicated subject I was often told it worked on “FM” which meant f***ing magic. That rarely stopped me however, and I often found the concepts were not overly complicated, just not directly relevant to my training.

There is some FM in information security that I’d like to demystify as we examine how tools can enable and not hinder the craft. We’ll examine algorithms and machine learning in this installment.

Learning Wit

Fail fast.  It’s one of the Agile buzz phrases that gets thrown around a lot in software product organizations these days.  Particularly, organizations trying to embrace the Lean/Agile approach to production.  The term ‘fail fast’ is grounded in the Lean concept of continuous learning.  Lean theory contends that learning is not a singular event, but rather a continuous process of trial and error.  The Lean approach advocates that the smaller the ‘set’ of learning and the faster it takes place, the better.  Thus, fail fast should really be ‘learn fast’ or ‘learn something small fast,’ but that’s not nearly as catchy.  This is all grounded in the heavily researched area of human learning.  Humans learn by trial and error.  Lean simply says so should the organizations.

When I was leading the Network Security Group at the US Naval Postgraduate School, I was overwhelmed with the degree of failure we experienced. The amount of events, complexity of investigations and immature security infrastructure created an environment of perpetual failure. After gathering the basic business metrics I discussed in Metering Incident Response 101 I decided it was time to push the problem up the chain of command.

A core tenet to success in any endeavor is defining, collecting and analyzing core metrics. Incident Response teams can only develop plans that lead to success when it can be defined and metered. Understanding and collecting two key metrics can aid in defining, metering and reporting on success.