SlideShare a Scribd company logo
1 of 10
Download to read offline
Page 1 of 10
How A-Core Concrete Sets a Solid
Foundation for Preemptive Security
Transcript of a discussion on how to best balance resilient security requirements with efficient use of
human capital and resources in a highly dispersed organization.
Listen to the podcast. Find it on iTunes. Download the transcript. Sponsor: Bitdefender.
Dana Gardner: Welcome to the next edition of the BriefingsDirect podcast series. I’m Dana
Gardner, Principal Analyst at Interarbor Solutions, your host and moderator.
A special breed of company -- even though it has a relatively small number of employees --
does very big jobs with those lean and often distributed workforces. A perfect example of such a
concentrated and efficient business is A-Core Concrete Specialists, which builds large and
complex structures across the Western United States.
When it comes to managing IT, the lean-and-mean mantra also holds true. The jack-of-all-
trades requirements means that the IT leadership of it is often the head of security. As a prime
example, that’s another way that A-Core Concrete shines.
Today’s BriefingsDirect security innovations discussion examines how A-Core Concrete has
created a security culture that relies on centralized administration, proactive insights, and rapid
remediation to successfully assure that the whole company operates at peak performance.
Here to share the story of how to best balance resilient security with the efficient use of human
capital and resources is Andy Black, Chief Information Officer (CIO) at A-Core Concrete
Specialists Inc., in Salt Lake City. Welcome, Andy.
Andy Black: Hello. Thank you.
Gardner: How does your management and IT approach allow
A-Core Concrete to best meet its security objectives?
Black: A-Core Concrete operates in seven different states
within the Western United States. We have 13 offices
throughout the Western U.S., and our main corporate
headquarters is in Salt Lake City, Utah.
From there, we run the majority of the businesses. Each
division operates independently. There are some that operate
branch sites in various states and others where we don’t
actually have offices. So, we need to provide a lot of remote
capabilities and access to IT at all of these various locations.
When I came aboard several years ago, I determined the best answer was not to have a central
data center where all of our servers and applications were housed. That just made it more
complex for every one of those locations to gain access to the main facility. Because we also
Black
Page 2 of 10
were growing rapidly, I needed the ability to expand the business quickly and plug in a new
location really fast.
If I had to establish a direct virtual private network (VPN) connection back to our main data
center at the main corporate headquarters, it probably wasn’t going to work well. So, instead we
decided to migrate all of our servers and the environment to the Microsoft Azure cloud and set
up each office location with VPN connections up to that Azure cloud environment.
That’s enabled us to operate lean and more
securely. Each office has a secure connection to
our primary applications via remote access. And
all of our people operating remotely on mobile
devices and laptops are also able to gain access
to our cloud-based environment.
That’s basically how we’ve configured our IT environment so every physical location -- as well
as all of our remote workers – can have secure access into all of our cloud-based resources.
Gardner: Andy, we hear so much these days about remote work and whether that’s the right fit
for the long-term. Seems to me what’s most important is gaining the flexibility and the agility to
be location-independent. You can always get the work done regardless of where the people are.
What were some of the challenges you faced to maintain your security requirements, even with
13 offices – and more remote locations -- spread around the country?
Keep the cloud safe across the Western U.S.
Black: Well, a great example that comes to mind is we are currently working on one of the
largest renovation projects in the country, the Church of Jesus Christ of Latter-day Saints
temple renovation project in downtown Salt Lake City. That project involves a lot of very intense
and technical work. We’re lifting the entire temple off of the ground to install earthquake
prevention materials. Within the facility, we’re drilling holes down the sides of the temple. Of
course, this is an historic landmark, so we have to retain and protect the facility.
But we’re working on that job site in conjunction with other companies. We are a subcontractor
in partnership with the main host organization that is doing a lot of the construction. And so, we
have our managers and our administrators working in the other companies’ offices and trailers.
And so, we rely on those other companies’ internet connections for the majority of their work
and yet our people still need to have access to our main company IT resources.
For them, for example, we have set up a VPN client that they load onto their individual
computers, so they can simply rely on that internet connection and still tap into our Microsoft
Azure cloud.
Now, for all of our other main office locations, we have firewalls in place, and each firewall is
configured with that VPN client. But the way we’ve configured and built this out -- so that
everything is cloud-based, while we can secure it with a VPN connection -- puts this in a tight
spot because people are located all over the place. They might be using a cellphone as a
All of our people who operate
remotely on mobile devices and
laptops are also able to gain access
to our cloud-based environment.
Page 3 of 10
mobile hotspot or an airport Wi-Fi network. And so, while they have that VPN connection to me,
that still does not protect them 100 percent.
We’re aware that there are a number of hacks and other issues out there where they take
advantage of VPN and even Remote Desktop Services (RDS)-types of connections into those
remote access servers and cloud environments. And so, we have to be able to protect and
secure those as well.
As a result, I rely on a lot of the services and support I get from Bitdefender for securing our
computers and connections. They can be remote, in these other offices and shared with other
companies, and we can still have secure access to all of our resources.
Gardner: The days of creating a fortress and moat perimeter that you can protect and beef up
from time to time -- those days are gone. There is no perimeter. The perimeter is everywhere.
Given that, what are the top requirements for the endpoints to take advantage of your cloud use
and remain secure and under control?
Protect all platforms, everywhere
Black: One of the main reasons I moved to Bitdefender in the first place was its high quality
and reputation when it comes to ransomware protection. That was one of my primary goals as a
result of an instance where we had an attack several years ago. The security solution we had at
the time helped prevent the vast majority of attacks, yet we still had a couple of machines that
were hit. I needed to find a good, solid solution.
At the time I did my research, Bitdefender came out on top of the list. By installing Bitdefender,
we not only gained an endpoint protection solution that provided ransomware protection, it also
gave us antivirus, anti-malware, and other resources to securely protect those local devices.
Then, at the same time, because we still see so many attacks through email, we tapped into the
Bitdefender email filtering solution as well.
We rely very heavily on that solution to handle the local desktops, the laptops, and all those
devices -- as well as all of our communication through email -- to make sure that we protect
ourselves as much as we possibly can.
We still have to train the users. The weakest point
in any security system is still the users. They still
click on things, and they can still open things. But
by having the endpoint protection solution and the
email filtering solution in place, we feel that gives
us a really good perimeter, if you will, to try to
protect us and keep us much more secure when it comes to managing all of these devices that
are all over the place.
Gardner: As your security and other IT partners have also adopted cloud architectures, how
has that impacted your ability to manage and secure all of those far-flung endpoints?
We still have to train the users.
The weakest point in any security
system is still the users.
Page 4 of 10
See, secure, and share the cloud
Black: That’s a really great question. Not only do we have our own primary servers in the cloud
that we use for specific systems in our environment, but we also outsource many other vendor-
related hosted services, including software as a service (SaaS), for many other applications.
Most of those are also hosted on Amazon Web Services (AWS) or Azure, so they’re all cloud-
hosted. We may have one type of connection on one location, but on that same computer we’re
doing 10 other things and 10 other resources are going to other cloud-hosted services.
I have, through Bitdefender, a great console that we use for two purposes. The first purpose is
so that on my main view I can see all of the connected devices, and I can see which devices
have had things blocked -- whether it’s been blocked, quarantined, or deleted. In a snapshot, I
can open it up and determine if I have any devices out there that are jumping out and saying,
“Hey, something just happened. We need to look at this right now.”
I also receive notifications if somebody’s
machine has clicked on a wrong link. It gives
me a notification, saying, “Hey, you need to go
look at this particular computer.” That primary
console has been great. Through that console,
there are also links whereby I can pull up each
individual computer, and it makes the
recommendations for how to better secure that
specific device. I can then click on some of those and it will automatically make the adjustment
for me and make that fix. Then in others, it actually relates more to group policy kinds of
changes that we can make on our network so each device within the entire company can be
adjusted based on those particular recommendations. That’s all in the primary endpoint
protection console that I use.
Then secondary to that is the email filtering console. And I dive into that on a regular basis, and
I’m learning, “Okay, what’s getting blocked? What’s getting filtered? Should this really be going
through? Should this not be going through? Is it virus-related? Is it malware? Is it simply a
phishing scam? Is it marketing?”
I look at that on a regular basis to make sure that if something does get blocked, it really should.
I can still, if needed, release it and get it right to our end users very quickly. These particular
tools have been very, very helpful for me in trying to manage the endpoint protection and
manage our communications through our email service.
Gardner: Andy, you’re the CIO, not the chief information security officer (CISO), so you’re
juggling a lot of different priorities. One of the things that is hard for people to balance is getting
too much – or too little – email information. Can you, through the management console and
interface, tune it so that you don’t get overwhelmed, but can find the right balance?
Fine-tune filtering your email
Black: When we first implemented the Bitdefender email filtering solution a while ago, we
weren’t really entirely certain how best to make it work. And so, we put specific settings in place,
Through that console, there are also
links whereby I can pull up each
individual computer, and it makes
the recommendations for how to
better secure that specific device.
Page 5 of 10
and it seemed like we were still blocking more than we really wanted to block. But we had the
capability to very easily open the console and shift something here, do changes there, make an
adjustment -- and then see how that all worked.
Ultimately, I got to a point where I reached out for help. I needed to get more assistance from
Bitdefender specifically and I was assigned to an individual who then put me in contact with the
more technical backend resources so that they could help me more specifically adjust and
configure and change our parameters for the email filtering solution so that we could better get
the things that needed to come through and block the things that didn’t need to come through.
One specific piece to that was the marketing component. People get all of the spam emails, all
the time. There is in the email filter solution, three specific selections. You have a marketing low
reputation, a medium reputation, and a high reputation.
Because we were getting so much spam, I decided that I wanted to block that medium
reputation email as well and have that filtered out. And so, while it greatly reduced the amount
of spam email that everybody got, we discovered about a month later that it was also blocking
bid requests.
We have a number of our managers throughout the company in every state where we are who
are subscribed to various resources that would automatically send these managers’ current job
bid requests. They have a job that’s going on in such-and-such location. We need to know
about this so we can provide a bid on that particular job.
Well, we discovered that many of those were also getting blocked because they were being
treated as a marketing medium -- and that wasn’t the right answer. I made more adjustments
and I talked to the managers and said, “Okay, well, if I adjust this so that we don’t miss these
bids, you will continue to get all of these other marketing emails.” And they replied, “No, that’s
fine. We’d rather get the marketing emails together with these bid requests than miss the bid
requests and then miss out on a potential job that that we could get into.”
So, this is very customizable. There are a
lot of adjustments we can make.
Sometimes it’s just a tweak here and a
tweak there. But what I found was very,
very helpful was that I had the capability to
tap into Bitdefender’s backend, and to talk
to the right people, have them sit down, see
my screen, and we could work through it
together -- and they could teach me.
As you said, I’m not necessarily the security expert. I need to manage all of these environments
and all the data and information that’s coming through. Having Bitdefender as a resource was
also very helpful to configure and tune our system to make it work best for our needs.
Gardner: Sure, you want proactivity, you want the machine to do the work for you, anticipate
some of the things, and offer analytics. When it comes to that proactive approach, is there
something about the way that the interface and the data and the analytics come together that
gives you a heightened sense of the security behind your security?
This is very customizable. There are a lot
of adjustments we can make. Sometimes
it’s just a tweak here and a tweak there.
… I had the capability to tap into
Bitdefender’s backend, and to talk to the
right people … work through it together.
Page 6 of 10
Get the whole picture to manage threats
Black: The display in the interface for the endpoint protection is very, very useful. In fact, in
working with the same Bitdefender consultants, they helped me put the right quadrants in the
right spots, to select which reporting features would be the most useful and would show me all
the correct data.
We’re all visual people. A picture’s worth a thousand words. And so, rather than just looking at
tables or lists of things that appear, it’s much easier to see it visually. One interesting thing
about the dashboard is that I can click on a specific link or a specific dashboard icon and then it
will take me to more information in greater depth and greater detail.
At a glance, that executive dashboard is very
helpful first to see exactly where we are and
what number of threats are coming through. I
can quickly determine, “Are we seeing an
uptick in an attack perimeter at the moment or
not? What’s being hit?” If I want greater detail, I
click on it, I pull it up and I can get more
information that way.
That particular resource has been very helpful. Again, once it’s set up and I know it’s there, and
I trust it, it is no longer something I have to go into every single day. I’m not tapping into this
every day. That’s not really my role overall, but when I need to, or if there’s something that’s
happening, I can tap into it very quickly, pull it right up, see what’s happening, talk to my team
and say, “Let’s go attack these particular systems. This one’s questionable. We’re not sure
what’s going on here, so jump on that one.” It’s just a great management tool from that
perspective.
Gardner: It sure sounds as though it’s a fit-for-purpose management approach, which is so
important when you’re in a lean-and-mean environment.
You mentioned earlier, Andy, that your end users and their behavior are such an important part
of security. Is there something about the way that you’re getting information about what’s going
on at your endpoints and in your network that you can take back to the users and reinforce the
right kinds of behaviors? Is there a way that you can instill a security culture based on the
information you have for your consoles and analytics and take that back to train, in a sense,
your workers to be more diligent about their best practices?
Train your teams to spot spam
Black: A couple of years ago, we determined as the leadership team it will be very beneficial
and helpful for us to meet on a weekly basis across the company and do training. I’ve trained on
all sorts of different things within the organization, but one of the key things that I continue to
bring up regularly is security. I will say, “Here are the most recent things that we’re dealing with.
Here are the most recent attacks.”
At first glance, that executive
dashboard is very helpful to see
exactly where we are and what
number of threats are coming through.
Page 7 of 10
Then every once in a while, something may come through our e-mail, because no solution is
100 percent perfect, and so I still have to rely on my users to know and be aware and look at
what’s coming through to make sure that it’s still good or bad. And so, we have a phishing report
link option. If something comes through and it looks fishy, they click the link, and it automatically
sends it to my team. We see this e-mail and we can double check and verify whether or not it’s
good or bad.
If it’s bad, we can obviously let the user know and thank them and congratulate them for being
proactive and determining, “Yep, sure enough, that’s not the right thing.” And then depending on
what’s coming through, sometimes I will take screenshots of that, and I will send out a
communication across the company, saying, “Hey, everybody. These are certain things that are
happening right now. This is bad, this is bad, this is bad,” so you don’t want to open these.
Then, during these trainings that I have with the company, I can discuss with people, “What are
you seeing? How do we look at and break down one of these messages in these e-mails to
determine, is this really a valid e-mail, and if not, how do we recognize that? How do we
determine it?”
By helping and working with all of the
people throughout the company on a
regular basis, having these
conversations, showing them the
examples, taking these screenshots
and so on, it’s helped to create a
greater security culture within the
organization. A lot of the smarter user
base can be more proactive on their
own end and say, “Yeah, yeah. This is bad or I’m not really sure about this particular one, Andy.
Let me send this to you and have you double check it for me just to be sure.”
The vast majority of the time, it’s worked very well. Now, people can still make a mistake. I had
a user literally a week ago click on a link that said they needed to redo their e-mail password. I
can’t remember what it was and sure enough, it took them to a spoofed site. They didn’t think
fast enough. They entered their credentials and immediately thought, “Okay, that was probably
bad. So, Andy help me.” The next thing you know, we helped them reset the password right
away so that whatever just got compromised is no longer there.
But at least people are more aware. They’re thinking. Even if they clicked the button and
afterward, they’re like, “Yeah, that probably was not the right answer. Let’s jump on. Let’s talk to
Andy’s team and let’s see if we can get it fixed.”
Helping to create that security-aware culture makes a big difference. Because the people in IT
can put all of the infrastructure in place. We can have the firewalls and the VPNs and the
endpoint protection, the antivirus, and the anti-malware, all of that -- but at the end of the day, it
still is up to the end user. They are the last point of protection, so they need to be aware. They
need to be cognizant of what they’re dealing with. The more we can work with them, the better.
Gardner: That root-cause analysis and learning what’s been behind problems is one part of the
solution, as you point out, and relating that to behavioral adjustments is another. But what about
the ability to react as a security professional when something does go wrong?
By helping and working with all of the people
throughout the company on a regular basis,
having these conversations, showing them
the examples, taking these screenshots and
so on, it’s helped to create a greater security
culture within the organization.
Page 8 of 10
Is there something about the way your security apparatus is designed that helps you so that
when things do go wrong, to nip it in the bud?
Plan ahead for best problem-solving practices
Black: Using the console within Bitdefender, I can see the machines that have recently
blocked something, or had a virus come through and then quarantined it, or whatever. I can
then have my team go out and look at that specific computer and see if something got through.
But I will tell you that if Bitdefender says they blocked it, they blocked it, and it hasn’t really been
an issue. But it also tells me who those users are, so I know if there’s a specific individual that
we need to work with. We can say, “Okay, now it looks like six times in the last week you clicked
on things. Let’s talk about this. What is going on? Let’s make sure you have figured that out.”
Now, again, looking at it from the leadership perspective, I can put all of the infrastructure in
place, but I need to have the capability to recover should somebody do something that they
shouldn’t have. I can focus on having all of my backups in place, my replications in place,
whether it’s cloud-based or otherwise; having my resources, my applications, my files stored in
different locations so it’s not all in one bucket, so that if something does happen to get through,
it’s that one piece that might be affected, not the entire organization.
It becomes more of a mindset of how I built out the infrastructure to support my company,
specifically to meet our needs so that if one particular site has an issue or one particular
application has an issue, it can be isolated to that specific component. We have the backups,
the replications, all of the disaster recovery in place so that if the worst happens, we’re not going
to be completely out of business.
Now, one last piece to that, it’s very important to
have the communication ahead of time with the
business leadership, the ownership, so that
should something such as ransomware come
through, it’s not just locking the computer. We
can restore a computer, we can restore from
backup, that’s fine. You might lose a day. It’s not
going to kill us.
But, one of the biggest things with ransomware that’s happening today is not just an encryption
of a computer but where the bad people will get in, pull data out first and hang onto your
information and then they want to charge you a ransom because they’re going to threaten to
release your information. They want you to pay the ransom to not release the data and then pay
the ransom to also decrypt your devices and your systems.
And so, the issue is more with the information that they gather. If you can have a conversation
and have that decision made ahead of time with the organization, you can let your leadership
know, how you created your backups. Here’s how you got your encryption. Here’s how your
data is being protected. And if somebody comes in and says, “We have your data, we will
release it unless you pay a ransom.” Well, then you at least have a game plan and a decision
process made ahead of time so that it’s not a response or knee-jerk reaction to just immediately
pay the ransom.
Should something such as
ransomware come through, it’s not
just locking the computer. We can
restore a computer, we can restore
from backup, that’s fine. You might
lose a day. It’s not going to kill us.
Page 9 of 10
Have those conversations in advance, have that plan in place already, so you’re ready to go if
and when that occurs.
Gardner: Now you’re talking about operational resiliency -- to have those plans in place with the
right steps to take when you need it. When you have the data at your disposal, you can act.
That’s a huge part of a good, solid security culture. I commend you for that.
Before we sign off, let’s talk a little bit about the future. Where do things go next? Are you
concerned about the number of different endpoints that you might be involved with? Do you feel
as though you’re going to have to expand your horizon across more endpoints?
Meet and manage mobile-device risks
Black: The two fronts that don’t really keep me up at night per se, but they are in the back of
my mind, are the mobile devices because we do have a lot of our applications accessible on cell
phones, on tablets; iPads, for example. It’s more than just the desktop computer anymore, it’s
not just a Windows or an Apple-based machine. It’s definitely those mobile devices.
More than two-thirds of our company, of our workforce, are field operators. They are the guys
out in the field actually cutting the concrete, doing the freeway work, and so on. They rely
entirely on a mobile device -- their cell phone, their tablet. I have to build and secure those
devices as well. And the number of those devices is only going to grow. As our business
continues to grow and as we expand, and we go to other locations, I’m going to have more
people who are going to have those mobile devices. And so, that’s a huge front for me that I
really need to make sure that I have protection services in place.
Now secondary to that is the impact of artificial
intelligence (AI) and machine learning (ML).
People can create millions of bots, and with
those bots they can find new ways to hack in.
The more intelligent AI and ML becomes, the
stronger your own defenses need to be. And so
the more we can incorporate our own AI and ML
into our defense environments -- on the
computers, on the mobile devices and in our
endpoint protection -- the better we can prevent the bad guys who are also using those same
tools to come at us. Right now, to me, those are my two biggest fronts going forward that I’m the
most concerned about.
Gardner: Andy, any advice to organizations that like you are distributed, are lean, and have big
jobs but a relatively small workforce -- and perhaps also a fairly lean-and-mean IT department?
Any thoughts that you would impart to them as they try to improve their security posture?
Black: A lot of the smaller and mid-sized businesses, they all realize that computers and
technology are required to keep them in business and to press forward. But they’re still not
really willing to spend the money that it might take to bring in that level of protection. They try to
play the risk game, saying, “How long can we go until we get hit? We’re not going to get hit. We
are too small of a company. We’re not a target.”
The more we can incorporate our
own AI and ML into our defense
environments – on the computers,
on the mobile devices and in our
endpoint protection – the better we
can prevent the bad guys who are
also using those same tools.
Page 10 of 10
Well, what we’re finding is that the biggest target is the small- to medium-sized businesses
(SMBs) because they tend to not have invested into their security to protect themselves. And
so, that’s where those weaknesses come in.
Again, those same organizations -- while they do the bare minimum, they might have an end-
point protection solution on their computers -- they’re not necessarily securing their mobile
devices. They’re not necessarily creating and working with their people to create that culture of
security.
And so, it doesn’t take a lot. It’s not a huge investment in most cases. But if you will make that
more of a priority it does make a world of difference to protect your business because it’s going
to cost a lot more to recover than it would be to prevent in many of those issues.
Gardner: That’s great advice. I’m afraid we’ll have to leave it there. You’ve been listening to a
sponsored BriefingsDirect discussion on how concentrated and efficient businesses like A-Core
Concrete build security cultures that rely on centralized administration, proactive insights, and
rapid remediation to move safely at the preferred and optimized speed of business. A big thank
you to our guest, Andy Black, CIO at A-Core Concrete Specialists. Thank you so much.
Black: Thank you.
Gardner: I’m Dana Gardner, Principal Analyst at Interarbor Solutions, your host and moderator
for this ongoing series of BriefingsDirect discussions. And a big thank you to our sponsor
Bitdefender, as well, for supporting these presentations.
Our last big thank you goes out to our audience, that’s you, for joining us. Please pass this
along to your community and do come back next time.
Listen to the podcast. Find it on iTunes. Download the transcript. Sponsor: Bitdefender.
Transcript of a discussion on how to best balance resilient security requirements with efficient use of
human capital and resources in a highly dispersed organization. Copyright Interarbor Solutions, LLC,
2005-2023. All rights reserved.
You may also be interested in:
• How an MSP brings comprehensive security services to diverse clients
• Better IT security comes with ease in overhead for rural Virginia county government
• SambaSafety’s mission to reduce risk begins in its own datacenter security partnerships
• How MSP StoredTech brings comprehensive security services to diverse clients using
Bitdefender
• For a UK borough, solving security issues leads to operational improvements and cost-
savings across its IT infrastructure
• How an Architectural Firm Retains Long-Term Security Confidence Across a Fully Virtualized
and Distributed Desktop Environment
• Regional dental firm Great Expressions protects distributed data with lower complexity thanks
to amalgam of Nutanix HCI and Bitdefender security
• How MSPs Leverage Bitdefender’s Layered Approach to Security for Comprehensive Client
Protection
• Kansas Development Finance Authority gains peace of mind, end-points virtual shield using
Hypervisor-level security

More Related Content

Similar to How A-Core Concrete Sets a Solid Foundation for Preemptive Security

How the Switch to a Predominantly Remote Workforce Accelerated IT and Securit...
How the Switch to a Predominantly Remote Workforce Accelerated IT and Securit...How the Switch to a Predominantly Remote Workforce Accelerated IT and Securit...
How the Switch to a Predominantly Remote Workforce Accelerated IT and Securit...Dana Gardner
 
IoT Design Principles
IoT Design PrinciplesIoT Design Principles
IoT Design Principlesardexateam
 
Why Today’s Hybrid IT Complexity Makes 'as a Service' Security Essential
Why Today’s Hybrid IT Complexity Makes 'as a Service' Security EssentialWhy Today’s Hybrid IT Complexity Makes 'as a Service' Security Essential
Why Today’s Hybrid IT Complexity Makes 'as a Service' Security EssentialDana Gardner
 
How Unisys and Microsoft Team Up To Ease Complex Cloud Adoption For Governmen...
How Unisys and Microsoft Team Up To Ease Complex Cloud Adoption For Governmen...How Unisys and Microsoft Team Up To Ease Complex Cloud Adoption For Governmen...
How Unisys and Microsoft Team Up To Ease Complex Cloud Adoption For Governmen...Dana Gardner
 
Read the Discussions below and give a good replyDiscussion 1..docx
Read the Discussions below and give a good replyDiscussion 1..docxRead the Discussions below and give a good replyDiscussion 1..docx
Read the Discussions below and give a good replyDiscussion 1..docxmakdul
 
Headquartered at home community publication nx n pakistan
Headquartered at home   community publication nx n pakistanHeadquartered at home   community publication nx n pakistan
Headquartered at home community publication nx n pakistanTariq Mustafa
 
How a Minnesota Law Firm Brings Mission Critical Security To Myriad Mobile De...
How a Minnesota Law Firm Brings Mission Critical Security To Myriad Mobile De...How a Minnesota Law Firm Brings Mission Critical Security To Myriad Mobile De...
How a Minnesota Law Firm Brings Mission Critical Security To Myriad Mobile De...Dana Gardner
 
Introduction to Cloud computing
Introduction to Cloud computingIntroduction to Cloud computing
Introduction to Cloud computingKumayl Rajani
 
10-ways-the-dissolving-perimeter-kills-IT
10-ways-the-dissolving-perimeter-kills-IT10-ways-the-dissolving-perimeter-kills-IT
10-ways-the-dissolving-perimeter-kills-ITIdan Hershkovich
 
Cloud computing notes unit I as per RGPV syllabus
Cloud computing notes unit I as per RGPV syllabusCloud computing notes unit I as per RGPV syllabus
Cloud computing notes unit I as per RGPV syllabusNANDINI SHARMA
 
SECURE DATA TRANSFER BASED ON CLOUD COMPUTING
SECURE DATA TRANSFER BASED ON CLOUD COMPUTINGSECURE DATA TRANSFER BASED ON CLOUD COMPUTING
SECURE DATA TRANSFER BASED ON CLOUD COMPUTINGIRJET Journal
 
Cloud computing
Cloud computingCloud computing
Cloud computingHira Zahan
 
How Consistent Data Services Deliver Simplicity, Compatibility, And Lower Cost
How Consistent Data Services Deliver Simplicity, Compatibility, And Lower CostHow Consistent Data Services Deliver Simplicity, Compatibility, And Lower Cost
How Consistent Data Services Deliver Simplicity, Compatibility, And Lower CostDana Gardner
 
Cloud Computing - An Introduction to Cloud Computing Services
Cloud Computing - An Introduction to Cloud Computing ServicesCloud Computing - An Introduction to Cloud Computing Services
Cloud Computing - An Introduction to Cloud Computing ServicesStreym IT Solutions
 
The why of a cloud ppt
The why of a cloud pptThe why of a cloud ppt
The why of a cloud pptSana Nasar
 
AWS Security Challenges
AWS Security ChallengesAWS Security Challenges
AWS Security ChallengesSTO STRATEGY
 
Introduction to cloud computing
Introduction to cloud computingIntroduction to cloud computing
Introduction to cloud computingDigital Shende
 

Similar to How A-Core Concrete Sets a Solid Foundation for Preemptive Security (20)

How the Switch to a Predominantly Remote Workforce Accelerated IT and Securit...
How the Switch to a Predominantly Remote Workforce Accelerated IT and Securit...How the Switch to a Predominantly Remote Workforce Accelerated IT and Securit...
How the Switch to a Predominantly Remote Workforce Accelerated IT and Securit...
 
Facing the Future - Is the cloud right for you?
Facing the Future - Is the cloud right for you?Facing the Future - Is the cloud right for you?
Facing the Future - Is the cloud right for you?
 
IoT Design Principles
IoT Design PrinciplesIoT Design Principles
IoT Design Principles
 
Why Today’s Hybrid IT Complexity Makes 'as a Service' Security Essential
Why Today’s Hybrid IT Complexity Makes 'as a Service' Security EssentialWhy Today’s Hybrid IT Complexity Makes 'as a Service' Security Essential
Why Today’s Hybrid IT Complexity Makes 'as a Service' Security Essential
 
How Unisys and Microsoft Team Up To Ease Complex Cloud Adoption For Governmen...
How Unisys and Microsoft Team Up To Ease Complex Cloud Adoption For Governmen...How Unisys and Microsoft Team Up To Ease Complex Cloud Adoption For Governmen...
How Unisys and Microsoft Team Up To Ease Complex Cloud Adoption For Governmen...
 
Read the Discussions below and give a good replyDiscussion 1..docx
Read the Discussions below and give a good replyDiscussion 1..docxRead the Discussions below and give a good replyDiscussion 1..docx
Read the Discussions below and give a good replyDiscussion 1..docx
 
Headquartered at home community publication nx n pakistan
Headquartered at home   community publication nx n pakistanHeadquartered at home   community publication nx n pakistan
Headquartered at home community publication nx n pakistan
 
How a Minnesota Law Firm Brings Mission Critical Security To Myriad Mobile De...
How a Minnesota Law Firm Brings Mission Critical Security To Myriad Mobile De...How a Minnesota Law Firm Brings Mission Critical Security To Myriad Mobile De...
How a Minnesota Law Firm Brings Mission Critical Security To Myriad Mobile De...
 
Introduction to Cloud computing
Introduction to Cloud computingIntroduction to Cloud computing
Introduction to Cloud computing
 
10-ways-the-dissolving-perimeter-kills-IT
10-ways-the-dissolving-perimeter-kills-IT10-ways-the-dissolving-perimeter-kills-IT
10-ways-the-dissolving-perimeter-kills-IT
 
Cloud computing notes unit I as per RGPV syllabus
Cloud computing notes unit I as per RGPV syllabusCloud computing notes unit I as per RGPV syllabus
Cloud computing notes unit I as per RGPV syllabus
 
SECURE DATA TRANSFER BASED ON CLOUD COMPUTING
SECURE DATA TRANSFER BASED ON CLOUD COMPUTINGSECURE DATA TRANSFER BASED ON CLOUD COMPUTING
SECURE DATA TRANSFER BASED ON CLOUD COMPUTING
 
Cloud computing
Cloud computingCloud computing
Cloud computing
 
How Consistent Data Services Deliver Simplicity, Compatibility, And Lower Cost
How Consistent Data Services Deliver Simplicity, Compatibility, And Lower CostHow Consistent Data Services Deliver Simplicity, Compatibility, And Lower Cost
How Consistent Data Services Deliver Simplicity, Compatibility, And Lower Cost
 
M2 Computing SBT
M2 Computing SBTM2 Computing SBT
M2 Computing SBT
 
B1802041217
B1802041217B1802041217
B1802041217
 
Cloud Computing - An Introduction to Cloud Computing Services
Cloud Computing - An Introduction to Cloud Computing ServicesCloud Computing - An Introduction to Cloud Computing Services
Cloud Computing - An Introduction to Cloud Computing Services
 
The why of a cloud ppt
The why of a cloud pptThe why of a cloud ppt
The why of a cloud ppt
 
AWS Security Challenges
AWS Security ChallengesAWS Security Challenges
AWS Security Challenges
 
Introduction to cloud computing
Introduction to cloud computingIntroduction to cloud computing
Introduction to cloud computing
 

Recently uploaded

H2O.ai CEO/Founder: Sri Ambati Keynote at Wells Fargo Day
H2O.ai CEO/Founder: Sri Ambati Keynote at Wells Fargo DayH2O.ai CEO/Founder: Sri Ambati Keynote at Wells Fargo Day
H2O.ai CEO/Founder: Sri Ambati Keynote at Wells Fargo DaySri Ambati
 
Transcript: New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024
Transcript: New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024Transcript: New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024
Transcript: New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024BookNet Canada
 
What is DBT - The Ultimate Data Build Tool.pdf
What is DBT - The Ultimate Data Build Tool.pdfWhat is DBT - The Ultimate Data Build Tool.pdf
What is DBT - The Ultimate Data Build Tool.pdfMounikaPolabathina
 
Ensuring Technical Readiness For Copilot in Microsoft 365
Ensuring Technical Readiness For Copilot in Microsoft 365Ensuring Technical Readiness For Copilot in Microsoft 365
Ensuring Technical Readiness For Copilot in Microsoft 3652toLead Limited
 
TeamStation AI System Report LATAM IT Salaries 2024
TeamStation AI System Report LATAM IT Salaries 2024TeamStation AI System Report LATAM IT Salaries 2024
TeamStation AI System Report LATAM IT Salaries 2024Lonnie McRorey
 
Passkey Providers and Enabling Portability: FIDO Paris Seminar.pptx
Passkey Providers and Enabling Portability: FIDO Paris Seminar.pptxPasskey Providers and Enabling Portability: FIDO Paris Seminar.pptx
Passkey Providers and Enabling Portability: FIDO Paris Seminar.pptxLoriGlavin3
 
Fact vs. Fiction: Autodetecting Hallucinations in LLMs
Fact vs. Fiction: Autodetecting Hallucinations in LLMsFact vs. Fiction: Autodetecting Hallucinations in LLMs
Fact vs. Fiction: Autodetecting Hallucinations in LLMsZilliz
 
(How to Program) Paul Deitel, Harvey Deitel-Java How to Program, Early Object...
(How to Program) Paul Deitel, Harvey Deitel-Java How to Program, Early Object...(How to Program) Paul Deitel, Harvey Deitel-Java How to Program, Early Object...
(How to Program) Paul Deitel, Harvey Deitel-Java How to Program, Early Object...AliaaTarek5
 
From Family Reminiscence to Scholarly Archive .
From Family Reminiscence to Scholarly Archive .From Family Reminiscence to Scholarly Archive .
From Family Reminiscence to Scholarly Archive .Alan Dix
 
How AI, OpenAI, and ChatGPT impact business and software.
How AI, OpenAI, and ChatGPT impact business and software.How AI, OpenAI, and ChatGPT impact business and software.
How AI, OpenAI, and ChatGPT impact business and software.Curtis Poe
 
New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024
New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024
New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024BookNet Canada
 
Modern Roaming for Notes and Nomad – Cheaper Faster Better Stronger
Modern Roaming for Notes and Nomad – Cheaper Faster Better StrongerModern Roaming for Notes and Nomad – Cheaper Faster Better Stronger
Modern Roaming for Notes and Nomad – Cheaper Faster Better Strongerpanagenda
 
Testing tools and AI - ideas what to try with some tool examples
Testing tools and AI - ideas what to try with some tool examplesTesting tools and AI - ideas what to try with some tool examples
Testing tools and AI - ideas what to try with some tool examplesKari Kakkonen
 
Scale your database traffic with Read & Write split using MySQL Router
Scale your database traffic with Read & Write split using MySQL RouterScale your database traffic with Read & Write split using MySQL Router
Scale your database traffic with Read & Write split using MySQL RouterMydbops
 
Take control of your SAP testing with UiPath Test Suite
Take control of your SAP testing with UiPath Test SuiteTake control of your SAP testing with UiPath Test Suite
Take control of your SAP testing with UiPath Test SuiteDianaGray10
 
UiPath Community: Communication Mining from Zero to Hero
UiPath Community: Communication Mining from Zero to HeroUiPath Community: Communication Mining from Zero to Hero
UiPath Community: Communication Mining from Zero to HeroUiPathCommunity
 
A Journey Into the Emotions of Software Developers
A Journey Into the Emotions of Software DevelopersA Journey Into the Emotions of Software Developers
A Journey Into the Emotions of Software DevelopersNicole Novielli
 
Time Series Foundation Models - current state and future directions
Time Series Foundation Models - current state and future directionsTime Series Foundation Models - current state and future directions
Time Series Foundation Models - current state and future directionsNathaniel Shimoni
 
TrustArc Webinar - How to Build Consumer Trust Through Data Privacy
TrustArc Webinar - How to Build Consumer Trust Through Data PrivacyTrustArc Webinar - How to Build Consumer Trust Through Data Privacy
TrustArc Webinar - How to Build Consumer Trust Through Data PrivacyTrustArc
 
Digital Identity is Under Attack: FIDO Paris Seminar.pptx
Digital Identity is Under Attack: FIDO Paris Seminar.pptxDigital Identity is Under Attack: FIDO Paris Seminar.pptx
Digital Identity is Under Attack: FIDO Paris Seminar.pptxLoriGlavin3
 

Recently uploaded (20)

H2O.ai CEO/Founder: Sri Ambati Keynote at Wells Fargo Day
H2O.ai CEO/Founder: Sri Ambati Keynote at Wells Fargo DayH2O.ai CEO/Founder: Sri Ambati Keynote at Wells Fargo Day
H2O.ai CEO/Founder: Sri Ambati Keynote at Wells Fargo Day
 
Transcript: New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024
Transcript: New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024Transcript: New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024
Transcript: New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024
 
What is DBT - The Ultimate Data Build Tool.pdf
What is DBT - The Ultimate Data Build Tool.pdfWhat is DBT - The Ultimate Data Build Tool.pdf
What is DBT - The Ultimate Data Build Tool.pdf
 
Ensuring Technical Readiness For Copilot in Microsoft 365
Ensuring Technical Readiness For Copilot in Microsoft 365Ensuring Technical Readiness For Copilot in Microsoft 365
Ensuring Technical Readiness For Copilot in Microsoft 365
 
TeamStation AI System Report LATAM IT Salaries 2024
TeamStation AI System Report LATAM IT Salaries 2024TeamStation AI System Report LATAM IT Salaries 2024
TeamStation AI System Report LATAM IT Salaries 2024
 
Passkey Providers and Enabling Portability: FIDO Paris Seminar.pptx
Passkey Providers and Enabling Portability: FIDO Paris Seminar.pptxPasskey Providers and Enabling Portability: FIDO Paris Seminar.pptx
Passkey Providers and Enabling Portability: FIDO Paris Seminar.pptx
 
Fact vs. Fiction: Autodetecting Hallucinations in LLMs
Fact vs. Fiction: Autodetecting Hallucinations in LLMsFact vs. Fiction: Autodetecting Hallucinations in LLMs
Fact vs. Fiction: Autodetecting Hallucinations in LLMs
 
(How to Program) Paul Deitel, Harvey Deitel-Java How to Program, Early Object...
(How to Program) Paul Deitel, Harvey Deitel-Java How to Program, Early Object...(How to Program) Paul Deitel, Harvey Deitel-Java How to Program, Early Object...
(How to Program) Paul Deitel, Harvey Deitel-Java How to Program, Early Object...
 
From Family Reminiscence to Scholarly Archive .
From Family Reminiscence to Scholarly Archive .From Family Reminiscence to Scholarly Archive .
From Family Reminiscence to Scholarly Archive .
 
How AI, OpenAI, and ChatGPT impact business and software.
How AI, OpenAI, and ChatGPT impact business and software.How AI, OpenAI, and ChatGPT impact business and software.
How AI, OpenAI, and ChatGPT impact business and software.
 
New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024
New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024
New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024
 
Modern Roaming for Notes and Nomad – Cheaper Faster Better Stronger
Modern Roaming for Notes and Nomad – Cheaper Faster Better StrongerModern Roaming for Notes and Nomad – Cheaper Faster Better Stronger
Modern Roaming for Notes and Nomad – Cheaper Faster Better Stronger
 
Testing tools and AI - ideas what to try with some tool examples
Testing tools and AI - ideas what to try with some tool examplesTesting tools and AI - ideas what to try with some tool examples
Testing tools and AI - ideas what to try with some tool examples
 
Scale your database traffic with Read & Write split using MySQL Router
Scale your database traffic with Read & Write split using MySQL RouterScale your database traffic with Read & Write split using MySQL Router
Scale your database traffic with Read & Write split using MySQL Router
 
Take control of your SAP testing with UiPath Test Suite
Take control of your SAP testing with UiPath Test SuiteTake control of your SAP testing with UiPath Test Suite
Take control of your SAP testing with UiPath Test Suite
 
UiPath Community: Communication Mining from Zero to Hero
UiPath Community: Communication Mining from Zero to HeroUiPath Community: Communication Mining from Zero to Hero
UiPath Community: Communication Mining from Zero to Hero
 
A Journey Into the Emotions of Software Developers
A Journey Into the Emotions of Software DevelopersA Journey Into the Emotions of Software Developers
A Journey Into the Emotions of Software Developers
 
Time Series Foundation Models - current state and future directions
Time Series Foundation Models - current state and future directionsTime Series Foundation Models - current state and future directions
Time Series Foundation Models - current state and future directions
 
TrustArc Webinar - How to Build Consumer Trust Through Data Privacy
TrustArc Webinar - How to Build Consumer Trust Through Data PrivacyTrustArc Webinar - How to Build Consumer Trust Through Data Privacy
TrustArc Webinar - How to Build Consumer Trust Through Data Privacy
 
Digital Identity is Under Attack: FIDO Paris Seminar.pptx
Digital Identity is Under Attack: FIDO Paris Seminar.pptxDigital Identity is Under Attack: FIDO Paris Seminar.pptx
Digital Identity is Under Attack: FIDO Paris Seminar.pptx
 

How A-Core Concrete Sets a Solid Foundation for Preemptive Security

  • 1. Page 1 of 10 How A-Core Concrete Sets a Solid Foundation for Preemptive Security Transcript of a discussion on how to best balance resilient security requirements with efficient use of human capital and resources in a highly dispersed organization. Listen to the podcast. Find it on iTunes. Download the transcript. Sponsor: Bitdefender. Dana Gardner: Welcome to the next edition of the BriefingsDirect podcast series. I’m Dana Gardner, Principal Analyst at Interarbor Solutions, your host and moderator. A special breed of company -- even though it has a relatively small number of employees -- does very big jobs with those lean and often distributed workforces. A perfect example of such a concentrated and efficient business is A-Core Concrete Specialists, which builds large and complex structures across the Western United States. When it comes to managing IT, the lean-and-mean mantra also holds true. The jack-of-all- trades requirements means that the IT leadership of it is often the head of security. As a prime example, that’s another way that A-Core Concrete shines. Today’s BriefingsDirect security innovations discussion examines how A-Core Concrete has created a security culture that relies on centralized administration, proactive insights, and rapid remediation to successfully assure that the whole company operates at peak performance. Here to share the story of how to best balance resilient security with the efficient use of human capital and resources is Andy Black, Chief Information Officer (CIO) at A-Core Concrete Specialists Inc., in Salt Lake City. Welcome, Andy. Andy Black: Hello. Thank you. Gardner: How does your management and IT approach allow A-Core Concrete to best meet its security objectives? Black: A-Core Concrete operates in seven different states within the Western United States. We have 13 offices throughout the Western U.S., and our main corporate headquarters is in Salt Lake City, Utah. From there, we run the majority of the businesses. Each division operates independently. There are some that operate branch sites in various states and others where we don’t actually have offices. So, we need to provide a lot of remote capabilities and access to IT at all of these various locations. When I came aboard several years ago, I determined the best answer was not to have a central data center where all of our servers and applications were housed. That just made it more complex for every one of those locations to gain access to the main facility. Because we also Black
  • 2. Page 2 of 10 were growing rapidly, I needed the ability to expand the business quickly and plug in a new location really fast. If I had to establish a direct virtual private network (VPN) connection back to our main data center at the main corporate headquarters, it probably wasn’t going to work well. So, instead we decided to migrate all of our servers and the environment to the Microsoft Azure cloud and set up each office location with VPN connections up to that Azure cloud environment. That’s enabled us to operate lean and more securely. Each office has a secure connection to our primary applications via remote access. And all of our people operating remotely on mobile devices and laptops are also able to gain access to our cloud-based environment. That’s basically how we’ve configured our IT environment so every physical location -- as well as all of our remote workers – can have secure access into all of our cloud-based resources. Gardner: Andy, we hear so much these days about remote work and whether that’s the right fit for the long-term. Seems to me what’s most important is gaining the flexibility and the agility to be location-independent. You can always get the work done regardless of where the people are. What were some of the challenges you faced to maintain your security requirements, even with 13 offices – and more remote locations -- spread around the country? Keep the cloud safe across the Western U.S. Black: Well, a great example that comes to mind is we are currently working on one of the largest renovation projects in the country, the Church of Jesus Christ of Latter-day Saints temple renovation project in downtown Salt Lake City. That project involves a lot of very intense and technical work. We’re lifting the entire temple off of the ground to install earthquake prevention materials. Within the facility, we’re drilling holes down the sides of the temple. Of course, this is an historic landmark, so we have to retain and protect the facility. But we’re working on that job site in conjunction with other companies. We are a subcontractor in partnership with the main host organization that is doing a lot of the construction. And so, we have our managers and our administrators working in the other companies’ offices and trailers. And so, we rely on those other companies’ internet connections for the majority of their work and yet our people still need to have access to our main company IT resources. For them, for example, we have set up a VPN client that they load onto their individual computers, so they can simply rely on that internet connection and still tap into our Microsoft Azure cloud. Now, for all of our other main office locations, we have firewalls in place, and each firewall is configured with that VPN client. But the way we’ve configured and built this out -- so that everything is cloud-based, while we can secure it with a VPN connection -- puts this in a tight spot because people are located all over the place. They might be using a cellphone as a All of our people who operate remotely on mobile devices and laptops are also able to gain access to our cloud-based environment.
  • 3. Page 3 of 10 mobile hotspot or an airport Wi-Fi network. And so, while they have that VPN connection to me, that still does not protect them 100 percent. We’re aware that there are a number of hacks and other issues out there where they take advantage of VPN and even Remote Desktop Services (RDS)-types of connections into those remote access servers and cloud environments. And so, we have to be able to protect and secure those as well. As a result, I rely on a lot of the services and support I get from Bitdefender for securing our computers and connections. They can be remote, in these other offices and shared with other companies, and we can still have secure access to all of our resources. Gardner: The days of creating a fortress and moat perimeter that you can protect and beef up from time to time -- those days are gone. There is no perimeter. The perimeter is everywhere. Given that, what are the top requirements for the endpoints to take advantage of your cloud use and remain secure and under control? Protect all platforms, everywhere Black: One of the main reasons I moved to Bitdefender in the first place was its high quality and reputation when it comes to ransomware protection. That was one of my primary goals as a result of an instance where we had an attack several years ago. The security solution we had at the time helped prevent the vast majority of attacks, yet we still had a couple of machines that were hit. I needed to find a good, solid solution. At the time I did my research, Bitdefender came out on top of the list. By installing Bitdefender, we not only gained an endpoint protection solution that provided ransomware protection, it also gave us antivirus, anti-malware, and other resources to securely protect those local devices. Then, at the same time, because we still see so many attacks through email, we tapped into the Bitdefender email filtering solution as well. We rely very heavily on that solution to handle the local desktops, the laptops, and all those devices -- as well as all of our communication through email -- to make sure that we protect ourselves as much as we possibly can. We still have to train the users. The weakest point in any security system is still the users. They still click on things, and they can still open things. But by having the endpoint protection solution and the email filtering solution in place, we feel that gives us a really good perimeter, if you will, to try to protect us and keep us much more secure when it comes to managing all of these devices that are all over the place. Gardner: As your security and other IT partners have also adopted cloud architectures, how has that impacted your ability to manage and secure all of those far-flung endpoints? We still have to train the users. The weakest point in any security system is still the users.
  • 4. Page 4 of 10 See, secure, and share the cloud Black: That’s a really great question. Not only do we have our own primary servers in the cloud that we use for specific systems in our environment, but we also outsource many other vendor- related hosted services, including software as a service (SaaS), for many other applications. Most of those are also hosted on Amazon Web Services (AWS) or Azure, so they’re all cloud- hosted. We may have one type of connection on one location, but on that same computer we’re doing 10 other things and 10 other resources are going to other cloud-hosted services. I have, through Bitdefender, a great console that we use for two purposes. The first purpose is so that on my main view I can see all of the connected devices, and I can see which devices have had things blocked -- whether it’s been blocked, quarantined, or deleted. In a snapshot, I can open it up and determine if I have any devices out there that are jumping out and saying, “Hey, something just happened. We need to look at this right now.” I also receive notifications if somebody’s machine has clicked on a wrong link. It gives me a notification, saying, “Hey, you need to go look at this particular computer.” That primary console has been great. Through that console, there are also links whereby I can pull up each individual computer, and it makes the recommendations for how to better secure that specific device. I can then click on some of those and it will automatically make the adjustment for me and make that fix. Then in others, it actually relates more to group policy kinds of changes that we can make on our network so each device within the entire company can be adjusted based on those particular recommendations. That’s all in the primary endpoint protection console that I use. Then secondary to that is the email filtering console. And I dive into that on a regular basis, and I’m learning, “Okay, what’s getting blocked? What’s getting filtered? Should this really be going through? Should this not be going through? Is it virus-related? Is it malware? Is it simply a phishing scam? Is it marketing?” I look at that on a regular basis to make sure that if something does get blocked, it really should. I can still, if needed, release it and get it right to our end users very quickly. These particular tools have been very, very helpful for me in trying to manage the endpoint protection and manage our communications through our email service. Gardner: Andy, you’re the CIO, not the chief information security officer (CISO), so you’re juggling a lot of different priorities. One of the things that is hard for people to balance is getting too much – or too little – email information. Can you, through the management console and interface, tune it so that you don’t get overwhelmed, but can find the right balance? Fine-tune filtering your email Black: When we first implemented the Bitdefender email filtering solution a while ago, we weren’t really entirely certain how best to make it work. And so, we put specific settings in place, Through that console, there are also links whereby I can pull up each individual computer, and it makes the recommendations for how to better secure that specific device.
  • 5. Page 5 of 10 and it seemed like we were still blocking more than we really wanted to block. But we had the capability to very easily open the console and shift something here, do changes there, make an adjustment -- and then see how that all worked. Ultimately, I got to a point where I reached out for help. I needed to get more assistance from Bitdefender specifically and I was assigned to an individual who then put me in contact with the more technical backend resources so that they could help me more specifically adjust and configure and change our parameters for the email filtering solution so that we could better get the things that needed to come through and block the things that didn’t need to come through. One specific piece to that was the marketing component. People get all of the spam emails, all the time. There is in the email filter solution, three specific selections. You have a marketing low reputation, a medium reputation, and a high reputation. Because we were getting so much spam, I decided that I wanted to block that medium reputation email as well and have that filtered out. And so, while it greatly reduced the amount of spam email that everybody got, we discovered about a month later that it was also blocking bid requests. We have a number of our managers throughout the company in every state where we are who are subscribed to various resources that would automatically send these managers’ current job bid requests. They have a job that’s going on in such-and-such location. We need to know about this so we can provide a bid on that particular job. Well, we discovered that many of those were also getting blocked because they were being treated as a marketing medium -- and that wasn’t the right answer. I made more adjustments and I talked to the managers and said, “Okay, well, if I adjust this so that we don’t miss these bids, you will continue to get all of these other marketing emails.” And they replied, “No, that’s fine. We’d rather get the marketing emails together with these bid requests than miss the bid requests and then miss out on a potential job that that we could get into.” So, this is very customizable. There are a lot of adjustments we can make. Sometimes it’s just a tweak here and a tweak there. But what I found was very, very helpful was that I had the capability to tap into Bitdefender’s backend, and to talk to the right people, have them sit down, see my screen, and we could work through it together -- and they could teach me. As you said, I’m not necessarily the security expert. I need to manage all of these environments and all the data and information that’s coming through. Having Bitdefender as a resource was also very helpful to configure and tune our system to make it work best for our needs. Gardner: Sure, you want proactivity, you want the machine to do the work for you, anticipate some of the things, and offer analytics. When it comes to that proactive approach, is there something about the way that the interface and the data and the analytics come together that gives you a heightened sense of the security behind your security? This is very customizable. There are a lot of adjustments we can make. Sometimes it’s just a tweak here and a tweak there. … I had the capability to tap into Bitdefender’s backend, and to talk to the right people … work through it together.
  • 6. Page 6 of 10 Get the whole picture to manage threats Black: The display in the interface for the endpoint protection is very, very useful. In fact, in working with the same Bitdefender consultants, they helped me put the right quadrants in the right spots, to select which reporting features would be the most useful and would show me all the correct data. We’re all visual people. A picture’s worth a thousand words. And so, rather than just looking at tables or lists of things that appear, it’s much easier to see it visually. One interesting thing about the dashboard is that I can click on a specific link or a specific dashboard icon and then it will take me to more information in greater depth and greater detail. At a glance, that executive dashboard is very helpful first to see exactly where we are and what number of threats are coming through. I can quickly determine, “Are we seeing an uptick in an attack perimeter at the moment or not? What’s being hit?” If I want greater detail, I click on it, I pull it up and I can get more information that way. That particular resource has been very helpful. Again, once it’s set up and I know it’s there, and I trust it, it is no longer something I have to go into every single day. I’m not tapping into this every day. That’s not really my role overall, but when I need to, or if there’s something that’s happening, I can tap into it very quickly, pull it right up, see what’s happening, talk to my team and say, “Let’s go attack these particular systems. This one’s questionable. We’re not sure what’s going on here, so jump on that one.” It’s just a great management tool from that perspective. Gardner: It sure sounds as though it’s a fit-for-purpose management approach, which is so important when you’re in a lean-and-mean environment. You mentioned earlier, Andy, that your end users and their behavior are such an important part of security. Is there something about the way that you’re getting information about what’s going on at your endpoints and in your network that you can take back to the users and reinforce the right kinds of behaviors? Is there a way that you can instill a security culture based on the information you have for your consoles and analytics and take that back to train, in a sense, your workers to be more diligent about their best practices? Train your teams to spot spam Black: A couple of years ago, we determined as the leadership team it will be very beneficial and helpful for us to meet on a weekly basis across the company and do training. I’ve trained on all sorts of different things within the organization, but one of the key things that I continue to bring up regularly is security. I will say, “Here are the most recent things that we’re dealing with. Here are the most recent attacks.” At first glance, that executive dashboard is very helpful to see exactly where we are and what number of threats are coming through.
  • 7. Page 7 of 10 Then every once in a while, something may come through our e-mail, because no solution is 100 percent perfect, and so I still have to rely on my users to know and be aware and look at what’s coming through to make sure that it’s still good or bad. And so, we have a phishing report link option. If something comes through and it looks fishy, they click the link, and it automatically sends it to my team. We see this e-mail and we can double check and verify whether or not it’s good or bad. If it’s bad, we can obviously let the user know and thank them and congratulate them for being proactive and determining, “Yep, sure enough, that’s not the right thing.” And then depending on what’s coming through, sometimes I will take screenshots of that, and I will send out a communication across the company, saying, “Hey, everybody. These are certain things that are happening right now. This is bad, this is bad, this is bad,” so you don’t want to open these. Then, during these trainings that I have with the company, I can discuss with people, “What are you seeing? How do we look at and break down one of these messages in these e-mails to determine, is this really a valid e-mail, and if not, how do we recognize that? How do we determine it?” By helping and working with all of the people throughout the company on a regular basis, having these conversations, showing them the examples, taking these screenshots and so on, it’s helped to create a greater security culture within the organization. A lot of the smarter user base can be more proactive on their own end and say, “Yeah, yeah. This is bad or I’m not really sure about this particular one, Andy. Let me send this to you and have you double check it for me just to be sure.” The vast majority of the time, it’s worked very well. Now, people can still make a mistake. I had a user literally a week ago click on a link that said they needed to redo their e-mail password. I can’t remember what it was and sure enough, it took them to a spoofed site. They didn’t think fast enough. They entered their credentials and immediately thought, “Okay, that was probably bad. So, Andy help me.” The next thing you know, we helped them reset the password right away so that whatever just got compromised is no longer there. But at least people are more aware. They’re thinking. Even if they clicked the button and afterward, they’re like, “Yeah, that probably was not the right answer. Let’s jump on. Let’s talk to Andy’s team and let’s see if we can get it fixed.” Helping to create that security-aware culture makes a big difference. Because the people in IT can put all of the infrastructure in place. We can have the firewalls and the VPNs and the endpoint protection, the antivirus, and the anti-malware, all of that -- but at the end of the day, it still is up to the end user. They are the last point of protection, so they need to be aware. They need to be cognizant of what they’re dealing with. The more we can work with them, the better. Gardner: That root-cause analysis and learning what’s been behind problems is one part of the solution, as you point out, and relating that to behavioral adjustments is another. But what about the ability to react as a security professional when something does go wrong? By helping and working with all of the people throughout the company on a regular basis, having these conversations, showing them the examples, taking these screenshots and so on, it’s helped to create a greater security culture within the organization.
  • 8. Page 8 of 10 Is there something about the way your security apparatus is designed that helps you so that when things do go wrong, to nip it in the bud? Plan ahead for best problem-solving practices Black: Using the console within Bitdefender, I can see the machines that have recently blocked something, or had a virus come through and then quarantined it, or whatever. I can then have my team go out and look at that specific computer and see if something got through. But I will tell you that if Bitdefender says they blocked it, they blocked it, and it hasn’t really been an issue. But it also tells me who those users are, so I know if there’s a specific individual that we need to work with. We can say, “Okay, now it looks like six times in the last week you clicked on things. Let’s talk about this. What is going on? Let’s make sure you have figured that out.” Now, again, looking at it from the leadership perspective, I can put all of the infrastructure in place, but I need to have the capability to recover should somebody do something that they shouldn’t have. I can focus on having all of my backups in place, my replications in place, whether it’s cloud-based or otherwise; having my resources, my applications, my files stored in different locations so it’s not all in one bucket, so that if something does happen to get through, it’s that one piece that might be affected, not the entire organization. It becomes more of a mindset of how I built out the infrastructure to support my company, specifically to meet our needs so that if one particular site has an issue or one particular application has an issue, it can be isolated to that specific component. We have the backups, the replications, all of the disaster recovery in place so that if the worst happens, we’re not going to be completely out of business. Now, one last piece to that, it’s very important to have the communication ahead of time with the business leadership, the ownership, so that should something such as ransomware come through, it’s not just locking the computer. We can restore a computer, we can restore from backup, that’s fine. You might lose a day. It’s not going to kill us. But, one of the biggest things with ransomware that’s happening today is not just an encryption of a computer but where the bad people will get in, pull data out first and hang onto your information and then they want to charge you a ransom because they’re going to threaten to release your information. They want you to pay the ransom to not release the data and then pay the ransom to also decrypt your devices and your systems. And so, the issue is more with the information that they gather. If you can have a conversation and have that decision made ahead of time with the organization, you can let your leadership know, how you created your backups. Here’s how you got your encryption. Here’s how your data is being protected. And if somebody comes in and says, “We have your data, we will release it unless you pay a ransom.” Well, then you at least have a game plan and a decision process made ahead of time so that it’s not a response or knee-jerk reaction to just immediately pay the ransom. Should something such as ransomware come through, it’s not just locking the computer. We can restore a computer, we can restore from backup, that’s fine. You might lose a day. It’s not going to kill us.
  • 9. Page 9 of 10 Have those conversations in advance, have that plan in place already, so you’re ready to go if and when that occurs. Gardner: Now you’re talking about operational resiliency -- to have those plans in place with the right steps to take when you need it. When you have the data at your disposal, you can act. That’s a huge part of a good, solid security culture. I commend you for that. Before we sign off, let’s talk a little bit about the future. Where do things go next? Are you concerned about the number of different endpoints that you might be involved with? Do you feel as though you’re going to have to expand your horizon across more endpoints? Meet and manage mobile-device risks Black: The two fronts that don’t really keep me up at night per se, but they are in the back of my mind, are the mobile devices because we do have a lot of our applications accessible on cell phones, on tablets; iPads, for example. It’s more than just the desktop computer anymore, it’s not just a Windows or an Apple-based machine. It’s definitely those mobile devices. More than two-thirds of our company, of our workforce, are field operators. They are the guys out in the field actually cutting the concrete, doing the freeway work, and so on. They rely entirely on a mobile device -- their cell phone, their tablet. I have to build and secure those devices as well. And the number of those devices is only going to grow. As our business continues to grow and as we expand, and we go to other locations, I’m going to have more people who are going to have those mobile devices. And so, that’s a huge front for me that I really need to make sure that I have protection services in place. Now secondary to that is the impact of artificial intelligence (AI) and machine learning (ML). People can create millions of bots, and with those bots they can find new ways to hack in. The more intelligent AI and ML becomes, the stronger your own defenses need to be. And so the more we can incorporate our own AI and ML into our defense environments -- on the computers, on the mobile devices and in our endpoint protection -- the better we can prevent the bad guys who are also using those same tools to come at us. Right now, to me, those are my two biggest fronts going forward that I’m the most concerned about. Gardner: Andy, any advice to organizations that like you are distributed, are lean, and have big jobs but a relatively small workforce -- and perhaps also a fairly lean-and-mean IT department? Any thoughts that you would impart to them as they try to improve their security posture? Black: A lot of the smaller and mid-sized businesses, they all realize that computers and technology are required to keep them in business and to press forward. But they’re still not really willing to spend the money that it might take to bring in that level of protection. They try to play the risk game, saying, “How long can we go until we get hit? We’re not going to get hit. We are too small of a company. We’re not a target.” The more we can incorporate our own AI and ML into our defense environments – on the computers, on the mobile devices and in our endpoint protection – the better we can prevent the bad guys who are also using those same tools.
  • 10. Page 10 of 10 Well, what we’re finding is that the biggest target is the small- to medium-sized businesses (SMBs) because they tend to not have invested into their security to protect themselves. And so, that’s where those weaknesses come in. Again, those same organizations -- while they do the bare minimum, they might have an end- point protection solution on their computers -- they’re not necessarily securing their mobile devices. They’re not necessarily creating and working with their people to create that culture of security. And so, it doesn’t take a lot. It’s not a huge investment in most cases. But if you will make that more of a priority it does make a world of difference to protect your business because it’s going to cost a lot more to recover than it would be to prevent in many of those issues. Gardner: That’s great advice. I’m afraid we’ll have to leave it there. You’ve been listening to a sponsored BriefingsDirect discussion on how concentrated and efficient businesses like A-Core Concrete build security cultures that rely on centralized administration, proactive insights, and rapid remediation to move safely at the preferred and optimized speed of business. A big thank you to our guest, Andy Black, CIO at A-Core Concrete Specialists. Thank you so much. Black: Thank you. Gardner: I’m Dana Gardner, Principal Analyst at Interarbor Solutions, your host and moderator for this ongoing series of BriefingsDirect discussions. And a big thank you to our sponsor Bitdefender, as well, for supporting these presentations. Our last big thank you goes out to our audience, that’s you, for joining us. Please pass this along to your community and do come back next time. Listen to the podcast. Find it on iTunes. Download the transcript. Sponsor: Bitdefender. Transcript of a discussion on how to best balance resilient security requirements with efficient use of human capital and resources in a highly dispersed organization. Copyright Interarbor Solutions, LLC, 2005-2023. All rights reserved. You may also be interested in: • How an MSP brings comprehensive security services to diverse clients • Better IT security comes with ease in overhead for rural Virginia county government • SambaSafety’s mission to reduce risk begins in its own datacenter security partnerships • How MSP StoredTech brings comprehensive security services to diverse clients using Bitdefender • For a UK borough, solving security issues leads to operational improvements and cost- savings across its IT infrastructure • How an Architectural Firm Retains Long-Term Security Confidence Across a Fully Virtualized and Distributed Desktop Environment • Regional dental firm Great Expressions protects distributed data with lower complexity thanks to amalgam of Nutanix HCI and Bitdefender security • How MSPs Leverage Bitdefender’s Layered Approach to Security for Comprehensive Client Protection • Kansas Development Finance Authority gains peace of mind, end-points virtual shield using Hypervisor-level security