How A-Core Concrete Sets a Solid Foundation for Preemptive Security

of 10
How A-Core Concrete Sets a Solid
Foundation for Preemptive Security
Transcript of a discussion on how to best balance resilient security requirements with efficient use of
human capital and resources in a highly dispersed organization.
Listen to the podcast. Find it on iTunes. Download the transcript. Sponsor: Bitdefender.
Dana Gardner: Welcome to the next edition of the BriefingsDirect podcast series. I’m Dana
Gardner, Principal Analyst at Interarbor Solutions, your host and moderator.
A special breed of company -- even though it has a relatively small number of employees --
does very big jobs with those lean and often distributed workforces. A perfect example of such a
concentrated and efficient business is A-Core Concrete Specialists, which builds large and
complex structures across the Western United States.
When it comes to managing IT, the lean-and-mean mantra also holds true. The jack-of-all-
trades requirements means that the IT leadership of it is often the head of security. As a prime
example, that’s another way that A-Core Concrete shines.
Today’s BriefingsDirect security innovations discussion examines how A-Core Concrete has
created a security culture that relies on centralized administration, proactive insights, and rapid
remediation to successfully assure that the whole company operates at peak performance.
Here to share the story of how to best balance resilient security with the efficient use of human
capital and resources is Andy Black, Chief Information Officer (CIO) at A-Core Concrete
Specialists Inc., in Salt Lake City. Welcome, Andy.
Andy Black: Hello. Thank you.
Gardner: How does your management and IT approach allow
A-Core Concrete to best meet its security objectives?
Black: A-Core Concrete operates in seven different states
within the Western United States. We have 13 offices
throughout the Western U.S., and our main corporate
headquarters is in Salt Lake City, Utah.
From there, we run the majority of the businesses. Each
division operates independently. There are some that operate
branch sites in various states and others where we don’t
actually have offices. So, we need to provide a lot of remote
capabilities and access to IT at all of these various locations.
When I came aboard several years ago, I determined the best answer was not to have a central
data center where all of our servers and applications were housed. That just made it more
complex for every one of those locations to gain access to the main facility. Because we also
Black

of 10
were growing rapidly, I needed the ability to expand the business quickly and plug in a new
location really fast.
If I had to establish a direct virtual private network (VPN) connection back to our main data
center at the main corporate headquarters, it probably wasn’t going to work well. So, instead we
decided to migrate all of our servers and the environment to the Microsoft Azure cloud and set
up each office location with VPN connections up to that Azure cloud environment.
That’s enabled us to operate lean and more
securely. Each office has a secure connection to
our primary applications via remote access. And
all of our people operating remotely on mobile
devices and laptops are also able to gain access
to our cloud-based environment.
That’s basically how we’ve configured our IT environment so every physical location -- as well
as all of our remote workers – can have secure access into all of our cloud-based resources.
Gardner: Andy, we hear so much these days about remote work and whether that’s the right fit
for the long-term. Seems to me what’s most important is gaining the flexibility and the agility to
be location-independent. You can always get the work done regardless of where the people are.
What were some of the challenges you faced to maintain your security requirements, even with
13 offices – and more remote locations -- spread around the country?
Keep the cloud safe across the Western U.S.
Black: Well, a great example that comes to mind is we are currently working on one of the
largest renovation projects in the country, the Church of Jesus Christ of Latter-day Saints
temple renovation project in downtown Salt Lake City. That project involves a lot of very intense
and technical work. We’re lifting the entire temple off of the ground to install earthquake
prevention materials. Within the facility, we’re drilling holes down the sides of the temple. Of
course, this is an historic landmark, so we have to retain and protect the facility.
But we’re working on that job site in conjunction with other companies. We are a subcontractor
in partnership with the main host organization that is doing a lot of the construction. And so, we
have our managers and our administrators working in the other companies’ offices and trailers.
And so, we rely on those other companies’ internet connections for the majority of their work
and yet our people still need to have access to our main company IT resources.
For them, for example, we have set up a VPN client that they load onto their individual
computers, so they can simply rely on that internet connection and still tap into our Microsoft
Azure cloud.
Now, for all of our other main office locations, we have firewalls in place, and each firewall is
configured with that VPN client. But the way we’ve configured and built this out -- so that
everything is cloud-based, while we can secure it with a VPN connection -- puts this in a tight
spot because people are located all over the place. They might be using a cellphone as a
All of our people who operate
remotely on mobile devices and
laptops are also able to gain access
to our cloud-based environment.

of 10
mobile hotspot or an airport Wi-Fi network. And so, while they have that VPN connection to me,
that still does not protect them 100 percent.
We’re aware that there are a number of hacks and other issues out there where they take
advantage of VPN and even Remote Desktop Services (RDS)-types of connections into those
remote access servers and cloud environments. And so, we have to be able to protect and
secure those as well.
As a result, I rely on a lot of the services and support I get from Bitdefender for securing our
computers and connections. They can be remote, in these other offices and shared with other
companies, and we can still have secure access to all of our resources.
Gardner: The days of creating a fortress and moat perimeter that you can protect and beef up
from time to time -- those days are gone. There is no perimeter. The perimeter is everywhere.
Given that, what are the top requirements for the endpoints to take advantage of your cloud use
and remain secure and under control?
Protect all platforms, everywhere
Black: One of the main reasons I moved to Bitdefender in the first place was its high quality
and reputation when it comes to ransomware protection. That was one of my primary goals as a
result of an instance where we had an attack several years ago. The security solution we had at
the time helped prevent the vast majority of attacks, yet we still had a couple of machines that
were hit. I needed to find a good, solid solution.
At the time I did my research, Bitdefender came out on top of the list. By installing Bitdefender,
we not only gained an endpoint protection solution that provided ransomware protection, it also
gave us antivirus, anti-malware, and other resources to securely protect those local devices.
Then, at the same time, because we still see so many attacks through email, we tapped into the
Bitdefender email filtering solution as well.
We rely very heavily on that solution to handle the local desktops, the laptops, and all those
devices -- as well as all of our communication through email -- to make sure that we protect
ourselves as much as we possibly can.
We still have to train the users. The weakest point
in any security system is still the users. They still
click on things, and they can still open things. But
by having the endpoint protection solution and the
email filtering solution in place, we feel that gives
us a really good perimeter, if you will, to try to
protect us and keep us much more secure when it comes to managing all of these devices that
are all over the place.
Gardner: As your security and other IT partners have also adopted cloud architectures, how
has that impacted your ability to manage and secure all of those far-flung endpoints?
We still have to train the users.
The weakest point in any security
system is still the users.

of 10
See, secure, and share the cloud
Black: That’s a really great question. Not only do we have our own primary servers in the cloud
that we use for specific systems in our environment, but we also outsource many other vendor-
related hosted services, including software as a service (SaaS), for many other applications.
Most of those are also hosted on Amazon Web Services (AWS) or Azure, so they’re all cloud-
hosted. We may have one type of connection on one location, but on that same computer we’re
doing 10 other things and 10 other resources are going to other cloud-hosted services.
I have, through Bitdefender, a great console that we use for two purposes. The first purpose is
so that on my main view I can see all of the connected devices, and I can see which devices
have had things blocked -- whether it’s been blocked, quarantined, or deleted. In a snapshot, I
can open it up and determine if I have any devices out there that are jumping out and saying,
“Hey, something just happened. We need to look at this right now.”
I also receive notifications if somebody’s
machine has clicked on a wrong link. It gives
me a notification, saying, “Hey, you need to go
look at this particular computer.” That primary
console has been great. Through that console,
there are also links whereby I can pull up each
individual computer, and it makes the
recommendations for how to better secure that
specific device. I can then click on some of those and it will automatically make the adjustment
for me and make that fix. Then in others, it actually relates more to group policy kinds of
changes that we can make on our network so each device within the entire company can be
adjusted based on those particular recommendations. That’s all in the primary endpoint
protection console that I use.
Then secondary to that is the email filtering console. And I dive into that on a regular basis, and
I’m learning, “Okay, what’s getting blocked? What’s getting filtered? Should this really be going
through? Should this not be going through? Is it virus-related? Is it malware? Is it simply a
phishing scam? Is it marketing?”
I look at that on a regular basis to make sure that if something does get blocked, it really should.
I can still, if needed, release it and get it right to our end users very quickly. These particular
tools have been very, very helpful for me in trying to manage the endpoint protection and
manage our communications through our email service.
Gardner: Andy, you’re the CIO, not the chief information security officer (CISO), so you’re
juggling a lot of different priorities. One of the things that is hard for people to balance is getting
too much – or too little – email information. Can you, through the management console and
interface, tune it so that you don’t get overwhelmed, but can find the right balance?
Fine-tune filtering your email
Black: When we first implemented the Bitdefender email filtering solution a while ago, we
weren’t really entirely certain how best to make it work. And so, we put specific settings in place,
Through that console, there are also
links whereby I can pull up each
individual computer, and it makes
the recommendations for how to
better secure that specific device.

of 10
and it seemed like we were still blocking more than we really wanted to block. But we had the
capability to very easily open the console and shift something here, do changes there, make an
adjustment -- and then see how that all worked.
Ultimately, I got to a point where I reached out for help. I needed to get more assistance from
Bitdefender specifically and I was assigned to an individual who then put me in contact with the
more technical backend resources so that they could help me more specifically adjust and
configure and change our parameters for the email filtering solution so that we could better get
the things that needed to come through and block the things that didn’t need to come through.
One specific piece to that was the marketing component. People get all of the spam emails, all
the time. There is in the email filter solution, three specific selections. You have a marketing low
reputation, a medium reputation, and a high reputation.
Because we were getting so much spam, I decided that I wanted to block that medium
reputation email as well and have that filtered out. And so, while it greatly reduced the amount
of spam email that everybody got, we discovered about a month later that it was also blocking
bid requests.
We have a number of our managers throughout the company in every state where we are who
are subscribed to various resources that would automatically send these managers’ current job
bid requests. They have a job that’s going on in such-and-such location. We need to know
about this so we can provide a bid on that particular job.
Well, we discovered that many of those were also getting blocked because they were being
treated as a marketing medium -- and that wasn’t the right answer. I made more adjustments
and I talked to the managers and said, “Okay, well, if I adjust this so that we don’t miss these
bids, you will continue to get all of these other marketing emails.” And they replied, “No, that’s
fine. We’d rather get the marketing emails together with these bid requests than miss the bid
requests and then miss out on a potential job that that we could get into.”
So, this is very customizable. There are a
lot of adjustments we can make.
Sometimes it’s just a tweak here and a
tweak there. But what I found was very,
very helpful was that I had the capability to
tap into Bitdefender’s backend, and to talk
to the right people, have them sit down, see
my screen, and we could work through it
together -- and they could teach me.
As you said, I’m not necessarily the security expert. I need to manage all of these environments
and all the data and information that’s coming through. Having Bitdefender as a resource was
also very helpful to configure and tune our system to make it work best for our needs.
Gardner: Sure, you want proactivity, you want the machine to do the work for you, anticipate
some of the things, and offer analytics. When it comes to that proactive approach, is there
something about the way that the interface and the data and the analytics come together that
gives you a heightened sense of the security behind your security?
This is very customizable. There are a lot
of adjustments we can make. Sometimes
it’s just a tweak here and a tweak there.
… I had the capability to tap into
Bitdefender’s backend, and to talk to the
right people … work through it together.

of 10
Get the whole picture to manage threats
Black: The display in the interface for the endpoint protection is very, very useful. In fact, in
working with the same Bitdefender consultants, they helped me put the right quadrants in the
right spots, to select which reporting features would be the most useful and would show me all
the correct data.
We’re all visual people. A picture’s worth a thousand words. And so, rather than just looking at
tables or lists of things that appear, it’s much easier to see it visually. One interesting thing
about the dashboard is that I can click on a specific link or a specific dashboard icon and then it
will take me to more information in greater depth and greater detail.
At a glance, that executive dashboard is very
helpful first to see exactly where we are and
what number of threats are coming through. I
can quickly determine, “Are we seeing an
uptick in an attack perimeter at the moment or
not? What’s being hit?” If I want greater detail, I
click on it, I pull it up and I can get more
information that way.
That particular resource has been very helpful. Again, once it’s set up and I know it’s there, and
I trust it, it is no longer something I have to go into every single day. I’m not tapping into this
every day. That’s not really my role overall, but when I need to, or if there’s something that’s
happening, I can tap into it very quickly, pull it right up, see what’s happening, talk to my team
and say, “Let’s go attack these particular systems. This one’s questionable. We’re not sure
what’s going on here, so jump on that one.” It’s just a great management tool from that
perspective.
Gardner: It sure sounds as though it’s a fit-for-purpose management approach, which is so
important when you’re in a lean-and-mean environment.
You mentioned earlier, Andy, that your end users and their behavior are such an important part
of security. Is there something about the way that you’re getting information about what’s going
on at your endpoints and in your network that you can take back to the users and reinforce the
right kinds of behaviors? Is there a way that you can instill a security culture based on the
information you have for your consoles and analytics and take that back to train, in a sense,
your workers to be more diligent about their best practices?
Train your teams to spot spam
Black: A couple of years ago, we determined as the leadership team it will be very beneficial
and helpful for us to meet on a weekly basis across the company and do training. I’ve trained on
all sorts of different things within the organization, but one of the key things that I continue to
bring up regularly is security. I will say, “Here are the most recent things that we’re dealing with.
Here are the most recent attacks.”
At first glance, that executive
dashboard is very helpful to see
exactly where we are and what
number of threats are coming through.

of 10
Then every once in a while, something may come through our e-mail, because no solution is
100 percent perfect, and so I still have to rely on my users to know and be aware and look at
what’s coming through to make sure that it’s still good or bad. And so, we have a phishing report
link option. If something comes through and it looks fishy, they click the link, and it automatically
sends it to my team. We see this e-mail and we can double check and verify whether or not it’s
good or bad.
If it’s bad, we can obviously let the user know and thank them and congratulate them for being
proactive and determining, “Yep, sure enough, that’s not the right thing.” And then depending on
what’s coming through, sometimes I will take screenshots of that, and I will send out a
communication across the company, saying, “Hey, everybody. These are certain things that are
happening right now. This is bad, this is bad, this is bad,” so you don’t want to open these.
Then, during these trainings that I have with the company, I can discuss with people, “What are
you seeing? How do we look at and break down one of these messages in these e-mails to
determine, is this really a valid e-mail, and if not, how do we recognize that? How do we
determine it?”
By helping and working with all of the
people throughout the company on a
regular basis, having these
conversations, showing them the
examples, taking these screenshots
and so on, it’s helped to create a
greater security culture within the
organization. A lot of the smarter user
base can be more proactive on their
own end and say, “Yeah, yeah. This is bad or I’m not really sure about this particular one, Andy.
Let me send this to you and have you double check it for me just to be sure.”
The vast majority of the time, it’s worked very well. Now, people can still make a mistake. I had
a user literally a week ago click on a link that said they needed to redo their e-mail password. I
can’t remember what it was and sure enough, it took them to a spoofed site. They didn’t think
fast enough. They entered their credentials and immediately thought, “Okay, that was probably
bad. So, Andy help me.” The next thing you know, we helped them reset the password right
away so that whatever just got compromised is no longer there.
But at least people are more aware. They’re thinking. Even if they clicked the button and
afterward, they’re like, “Yeah, that probably was not the right answer. Let’s jump on. Let’s talk to
Andy’s team and let’s see if we can get it fixed.”
Helping to create that security-aware culture makes a big difference. Because the people in IT
can put all of the infrastructure in place. We can have the firewalls and the VPNs and the
endpoint protection, the antivirus, and the anti-malware, all of that -- but at the end of the day, it
still is up to the end user. They are the last point of protection, so they need to be aware. They
need to be cognizant of what they’re dealing with. The more we can work with them, the better.
Gardner: That root-cause analysis and learning what’s been behind problems is one part of the
solution, as you point out, and relating that to behavioral adjustments is another. But what about
the ability to react as a security professional when something does go wrong?
By helping and working with all of the people
throughout the company on a regular basis,
having these conversations, showing them
the examples, taking these screenshots and
so on, it’s helped to create a greater security
culture within the organization.

of 10
Is there something about the way your security apparatus is designed that helps you so that
when things do go wrong, to nip it in the bud?
Plan ahead for best problem-solving practices
Black: Using the console within Bitdefender, I can see the machines that have recently
blocked something, or had a virus come through and then quarantined it, or whatever. I can
then have my team go out and look at that specific computer and see if something got through.
But I will tell you that if Bitdefender says they blocked it, they blocked it, and it hasn’t really been
an issue. But it also tells me who those users are, so I know if there’s a specific individual that
we need to work with. We can say, “Okay, now it looks like six times in the last week you clicked
on things. Let’s talk about this. What is going on? Let’s make sure you have figured that out.”
Now, again, looking at it from the leadership perspective, I can put all of the infrastructure in
place, but I need to have the capability to recover should somebody do something that they
shouldn’t have. I can focus on having all of my backups in place, my replications in place,
whether it’s cloud-based or otherwise; having my resources, my applications, my files stored in
different locations so it’s not all in one bucket, so that if something does happen to get through,
it’s that one piece that might be affected, not the entire organization.
It becomes more of a mindset of how I built out the infrastructure to support my company,
specifically to meet our needs so that if one particular site has an issue or one particular
application has an issue, it can be isolated to that specific component. We have the backups,
the replications, all of the disaster recovery in place so that if the worst happens, we’re not going
to be completely out of business.
Now, one last piece to that, it’s very important to
have the communication ahead of time with the
business leadership, the ownership, so that
should something such as ransomware come
through, it’s not just locking the computer. We
can restore a computer, we can restore from
backup, that’s fine. You might lose a day. It’s not
going to kill us.
But, one of the biggest things with ransomware that’s happening today is not just an encryption
of a computer but where the bad people will get in, pull data out first and hang onto your
information and then they want to charge you a ransom because they’re going to threaten to
release your information. They want you to pay the ransom to not release the data and then pay
the ransom to also decrypt your devices and your systems.
And so, the issue is more with the information that they gather. If you can have a conversation
and have that decision made ahead of time with the organization, you can let your leadership
know, how you created your backups. Here’s how you got your encryption. Here’s how your
data is being protected. And if somebody comes in and says, “We have your data, we will
release it unless you pay a ransom.” Well, then you at least have a game plan and a decision
process made ahead of time so that it’s not a response or knee-jerk reaction to just immediately
pay the ransom.
Should something such as
ransomware come through, it’s not
just locking the computer. We can
restore a computer, we can restore
from backup, that’s fine. You might
lose a day. It’s not going to kill us.

of 10
Have those conversations in advance, have that plan in place already, so you’re ready to go if
and when that occurs.
Gardner: Now you’re talking about operational resiliency -- to have those plans in place with the
right steps to take when you need it. When you have the data at your disposal, you can act.
That’s a huge part of a good, solid security culture. I commend you for that.
Before we sign off, let’s talk a little bit about the future. Where do things go next? Are you
concerned about the number of different endpoints that you might be involved with? Do you feel
as though you’re going to have to expand your horizon across more endpoints?
Meet and manage mobile-device risks
Black: The two fronts that don’t really keep me up at night per se, but they are in the back of
my mind, are the mobile devices because we do have a lot of our applications accessible on cell
phones, on tablets; iPads, for example. It’s more than just the desktop computer anymore, it’s
not just a Windows or an Apple-based machine. It’s definitely those mobile devices.
More than two-thirds of our company, of our workforce, are field operators. They are the guys
out in the field actually cutting the concrete, doing the freeway work, and so on. They rely
entirely on a mobile device -- their cell phone, their tablet. I have to build and secure those
devices as well. And the number of those devices is only going to grow. As our business
continues to grow and as we expand, and we go to other locations, I’m going to have more
people who are going to have those mobile devices. And so, that’s a huge front for me that I
really need to make sure that I have protection services in place.
Now secondary to that is the impact of artificial
intelligence (AI) and machine learning (ML).
People can create millions of bots, and with
those bots they can find new ways to hack in.
The more intelligent AI and ML becomes, the
stronger your own defenses need to be. And so
the more we can incorporate our own AI and ML
into our defense environments -- on the
computers, on the mobile devices and in our
endpoint protection -- the better we can prevent the bad guys who are also using those same
tools to come at us. Right now, to me, those are my two biggest fronts going forward that I’m the
most concerned about.
Gardner: Andy, any advice to organizations that like you are distributed, are lean, and have big
jobs but a relatively small workforce -- and perhaps also a fairly lean-and-mean IT department?
Any thoughts that you would impart to them as they try to improve their security posture?
Black: A lot of the smaller and mid-sized businesses, they all realize that computers and
technology are required to keep them in business and to press forward. But they’re still not
really willing to spend the money that it might take to bring in that level of protection. They try to
play the risk game, saying, “How long can we go until we get hit? We’re not going to get hit. We
are too small of a company. We’re not a target.”
The more we can incorporate our
own AI and ML into our defense
environments – on the computers,
on the mobile devices and in our
endpoint protection – the better we
can prevent the bad guys who are
also using those same tools.

of 10
Well, what we’re finding is that the biggest target is the small- to medium-sized businesses
(SMBs) because they tend to not have invested into their security to protect themselves. And
so, that’s where those weaknesses come in.
Again, those same organizations -- while they do the bare minimum, they might have an end-
point protection solution on their computers -- they’re not necessarily securing their mobile
devices. They’re not necessarily creating and working with their people to create that culture of
security.
And so, it doesn’t take a lot. It’s not a huge investment in most cases. But if you will make that
more of a priority it does make a world of difference to protect your business because it’s going
to cost a lot more to recover than it would be to prevent in many of those issues.
Gardner: That’s great advice. I’m afraid we’ll have to leave it there. You’ve been listening to a
sponsored BriefingsDirect discussion on how concentrated and efficient businesses like A-Core
Concrete build security cultures that rely on centralized administration, proactive insights, and
rapid remediation to move safely at the preferred and optimized speed of business. A big thank
you to our guest, Andy Black, CIO at A-Core Concrete Specialists. Thank you so much.
Black: Thank you.
Gardner: I’m Dana Gardner, Principal Analyst at Interarbor Solutions, your host and moderator
for this ongoing series of BriefingsDirect discussions. And a big thank you to our sponsor
Bitdefender, as well, for supporting these presentations.
Our last big thank you goes out to our audience, that’s you, for joining us. Please pass this
along to your community and do come back next time.
Listen to the podcast. Find it on iTunes. Download the transcript. Sponsor: Bitdefender.
Transcript of a discussion on how to best balance resilient security requirements with efficient use of
human capital and resources in a highly dispersed organization. Copyright Interarbor Solutions, LLC,
2005-2023. All rights reserved.
You may also be interested in:
• How an MSP brings comprehensive security services to diverse clients
• Better IT security comes with ease in overhead for rural Virginia county government
• SambaSafety’s mission to reduce risk begins in its own datacenter security partnerships
• How MSP StoredTech brings comprehensive security services to diverse clients using
Bitdefender
• For a UK borough, solving security issues leads to operational improvements and cost-
savings across its IT infrastructure
• How an Architectural Firm Retains Long-Term Security Confidence Across a Fully Virtualized
and Distributed Desktop Environment
• Regional dental firm Great Expressions protects distributed data with lower complexity thanks
to amalgam of Nutanix HCI and Bitdefender security
• How MSPs Leverage Bitdefender’s Layered Approach to Security for Comprehensive Client
Protection
• Kansas Development Finance Authority gains peace of mind, end-points virtual shield using
Hypervisor-level security

How A-Core Concrete Sets a Solid Foundation for Preemptive Security

More Related Content

Similar to How A-Core Concrete Sets a Solid Foundation for Preemptive Security

Recently uploaded

How A-Core Concrete Sets a Solid Foundation for Preemptive Security