Welcome to St. Schoops Podcast Series on IT Security and Government, underwritten this week by Verizon. I'm your host, Wyatt Cash, and in today's episode we're talking about how state and local governments can fill their talent gaps in IT security in a way that makes more economic sense. And we'll explore how managed and professional services providers are helping agencies to address today's expanding security threats.
Joining us to talk about that today is Chris Novak, Global Director for the Verizon Threat Research Advisory Center. Verizon is a leader in security services, and Chris's teams lead hundreds of cybersecurity investigations annually, ranging from financial fraud, cyber espionage, ransomware, industrial control systems, cyber terrorism, among other cyber threats. Chris, welcome to the program. Thanks.
Glad to be here. And also speaking with us is Gary Bonacorsi, Chief Technology Officer for US State and Local Government and Education at Tanium, which works with Verizon through a strategic partnership to provide unified endpoint management and security services. Gary has held a number of senior technology leadership positions over the past two decades, including as CTO and CIO at the States of Nevada and Texas, as well as companies including Dell EMC, Oracle and Merck MedCo. Gary, thank you for joining us and welcome to the program.
Thanks, Wyatt. Glad to be here. Well, state and local governments routinely struggle to find and retain the IT talent they need. Those challenges have certainly grown more difficult this year.
As state agencies contend with the impact of the pandemic, the sudden shift to a remote workforce has widened the security risks for agencies and states are anticipating significant budget pressures in the face of unanticipated expenses. Technology is supposed to make things easier for state and local agencies to accomplish their missions, but Gary, let me start with you. Why has it become so much harder for IT departments to find and retain the skills they need? And where are you seeing stopgap solutions to help them?
I think that's really twofold problem. I think the retirements are taking a lot of institutional knowledge and taking it out the door. And then you have the competitive landscape, especially when you come into, what I would say, modern tool sets around security and infrastructure. It's really hard to find those people and attract them in the public sector workspace.
But I think from a stopgap solution to help them, you're seeing all moved to this managed services environment. And our partnership with Verizon, we use our team as a service. And the reason that kind of helps with the skills gap perspective is our platform as a service uses no infrastructure. And it uses one small agent.
So it takes all that skills that you need to manage and maintain that infrastructure you currently do today with a lot of different tools and solutions. We eliminate that. So it takes the pressure off the IT department and they can redirect other resources. And Chris, from your perspective, what would be your answer to those same two questions?
Yeah, I actually agree with everything that Gary said. And I would actually add a little bit to that and say also I think there's a bit of a supply and demand problem in the workforce as well, not just on the retirement of skills potentially leaving the workforce, but also I think it is a fast, maybe fast doesn't even put it correctly rapidly growing desire for security as everything becomes cyber enabled. And there's just not enough of those resources to go around. And so that obviously makes the landscape even more competitive, which at the same time then also makes it challenging for entities and agencies to actually be able to retain the talent because they're getting pulled and pushed and tugged on from a lot of different directions.
And so when I look at the partnership that we have with TENium, that really allows users to benefit from the fast and efficient scalability of that apparatus, the ability to deploy endpoint agents in mass across an organization or an institution, do it quickly and then get that visibility where maybe that gives you a better people to technology ratio. And then also I look at it from the staff and skills augmentation perspective. I kind of have described this as the analogy of a car. You can buy a car, maintain the car and drive the car, but then depending on what your needs are, what your resources are and what it is that you want to focus on, you may opt to have someone else maintain the car or if you have the resources, you may pay someone else to actually drive you in the car.
And so finding the right sweet spot of where your resources and what it is you want to spend your time, focus on kind of help drive that conversation. And so we do something similar with the Verizon resources and TENium technology and really being able to bring those resources from a lot of different experiences and skill sets helps quite a bit in terms of augmenting and entities capabilities. Well, state and local IT departments have always had to balance the economics of relying on in-house staff versus considering outside vendors to support their IT operations a bit like your analogy, Chris. What is the return on investment for leaders to use managed and professional services to improve security in particular and why are the economics changing?
You know, especially when we talk about security, it really is a must do. Agencies just can't risk opening themselves up to vulnerabilities. And you couple that with the discussion we just had about the challenges of staffing. It's kind of pushing people into a managed service environment to get the benefit.
But there's a couple of things from a cost perspective or maybe it's even opportunity cost and hard cost. But for the opportunity cost, it's really the ability to scale on demand. So oftentimes when you find in government organizations, they build out these large organizations and then they're only waiting for a certain event as opposed to a managed service. You can basically buy what you need at the time that there's any bit.
You can scale up services to do that. So it gives you the flexibility to scale on demand. But the other part of it is just really the financing side, specifically around the budget impact since we've ended with COVID and it's normal that we're living in. The budget impacts are going to make capital expenditure budget requests much more difficult to obtain.
I think you're going to see a pressure on headcount as well. So I think it's organizations are going to have to look to manage service providers like Verizon and Tanium to help provide that bridge to get them through this process. And Chris, your thoughts? Yeah, again, I agree with what Gary said and a little bit to that in the sense that we see a lot of organizations where security is not the thing that they do, right?
They don't exist to do security. They exist to do something else. And security is have to have in order to make their other operations remain operative. And so leaning on managed security or professional services helps augment and allow them to say those limited CapEx or OpEx dollars that they have, they can focus into the areas that are really core and fundamental to their mission.
And they can lean on managed security or professional services to be kind of more outcome or deliverable based and say, this is what we expect and we can pay a third party to plug in and bring us those expectations. And then it also relieves them of the burden of things like hiring people, training people and retaining people. And then if you lose people going out and starting that cycle over again. And then also it gives you kind of almost an interesting element of like cloud based people, if you will.
And what I mean by that is many organizations don't need every skill set 100% all the time. They need this skill set this week and then maybe they don't need it for another couple of weeks. And generally for most organizations, it's not practical for them to have on staff every conceivable skill set they need full time. So leaning on managed or professional services allows you to scale up and scale down based on those needs and keep the budget really focused on the fundamentals.
Well, Gary and Chris, you both get to see a global view of cybersecurity threats and certainly state local agencies, CIOs and CIOs are familiar with most of the people. What are you seeing right now in the way of trends that state officials really need to be confronting? And why does the Verizon Tanium partnership perhaps better prepare them to address some of those particular security threats? I'll take a first stab at it.
I always start with the building block. And to me, the biggest building block when you have a security practice starts with visibility. And we find that most organizations that we go into have a very limited visibility into their environment. In fact, there's sometimes up to 20% of their environment is not known to them.
So without having visibility of your entire enterprise and know everything that's connected to your network, you just don't have security. It's really impossible. So this new normal that we live in today with distributed workforce and distributed learning environments where you have people no longer physically in the same location that you can control from a security perspective. That's really opened up the threat landscape as many of these devices now, whether you're doing devices that were provided by the organization themselves or their net new bare metal or there even sometimes BYOD devices that people bring and use their own devices at home is really just opened up this threat landscape in ways we've never experienced before.
Then you couple that with an inability to make sure that someone's connected to your network all the time so that you can monitor that. So when you have distributed workforce, they drop a VPN connection on the internet that ability to manage those devices using traditional tools today, it doesn't happen. So I think Taniums platform helps agencies gain that visibility across their network because our architecture does not rely on conventional connectivity. In fact, we can use general internet traffic as opposed to VPN traffic to manage those distributed endpoints no matter where they're on a VPN connection or off of a connection.
That's how we get that true visibility of what's out there in your environment. I think having that as a platform gives you the foundation to have a security profile. And Chris, what are you and your team seeing out there relative to what's important to state and local officials and again, how do you see the Verizon and Tanium partnership being helpful to them? Yeah, I think holistic visibility is key.
My team goes out as you mentioned and we do hundreds of not thousands of breach investigations every year. And one of the first things that we do when we start any investigation for any entity is check to see what tools they have and what instrumentation of visibility they have in place. Because the key to that kind of battle, if you will, with the adversary is you want to have visibility into what it is that's actually happening where it's happening, how it's playing out. Because without that information and knowledge, you can't figure out your defensive or your offensive plans on how you're going to tackle that problem.
And so that piece is absolutely key. And when we look at what we're doing from a managed services perspective, one of the critical factors there is how do we get the best and broadest possible visibility of the organization so that we can correlate as many data points together to figure out whether or not something is just anomalous and unusual behavior, because again, we're in this kind of new evolving state of normal. So things are changing and we need to be able to have enough information to determine whether or not this changes because of something malicious, or is this change just because Jane or Bob are now working from home or working from another remote location and things about their working habits are just changing as a result, but there's nothing maybe malicious there. So bringing all of that into the fold from a managed perspective is key and is a strength that Verizon brings to bear in that Tanium partnership relationship, you know, using those natural language queries of the endpoints, being able to do it in rapid time is obviously extraordinarily critical.
And interestingly, that kind of dovetails with some of what we're seeing from our annual data breach investigations report, for example, one of the things that we noted this last year was that there was an actual trend in improved discovery and detection time of breaches, something we hadn't seen in years. And when we dug into the data, coincidentally, one of the things that we actually found that was contributing in a major way to the improved discovery and detection was the visibility across the endpoints and the fact that those organizations were using managed security service providers, which were able to alert and detect on these apparatus and these incidents even faster than before. Well, that sounds encouraging, actually. Getting more specific, though, can either of you share some examples of how the Verizon Tanium partnership and managed and professional services in general are actually helping drive stronger security capabilities at state or local agencies?
Yeah, I'll jump on that one, why I think the biggest thing that I would highlight is the ability to do nearly everything remotely, because nothing is like it used to be. Nothing is happening, quote, according to plan. If organizations and agencies even had the plans they need for something like this in place. And so I think having the ability to rely on a trusted advisor or trusted third party to help set that up, roll that out, help with operating or implementing best practices, I think is critical.
And again, being able to do all of that remotely because we get a lot of calls from organizations that say, hey, we believe we have some kind of incident. We'd like to dig a little deeper. And obviously, if that's an organization that we may have already been collaborating with Tanium to deploy the endpoint agents, the ability for us to plug right in and begin doing that analysis or investigation, that makes things so much faster. Typically, we're moving towards containment and eradication in a matter of hours instead of maybe traditionally what would have been days or weeks.
And then obviously, there's the whole health and hygiene aspect of it. You know, I can't preach enough how important that is. You need to know what you have. In the early days of our research around the DBIR, we reported on something we call the unknown unknowns.
And I'm not going to go into a long discussion on what that was, but ultimately what it highlighted was there was so much about organizations that the organizational owners and operators didn't even really know existed or didn't know how it existed or where or why it existed. And if you don't know those fundamental questions or the answers to them, how are you actually going to be able to go about securing them? So this really helps us wrap a lot more known around the environment. Okay, I know that your responsibilities take you to customers across the United States.
What examples can you point to about how Tanium Everizant made a difference at one or more agencies? One of the most interesting things I've seen is the ability for customers to stand up Tanium as a service so quickly and drive immediate value. Since we do not need infrastructure for either unified endpoint management or unified endpoint security, we only have a single agent. We can literally stand up Tanium as a service in less than an hour and start driving business value immediately.
And then the other thing that we're seeing is really the cost reduction that we're showing our customers because once you start getting that visibility we've been talking about, in addition to the security aspects of it, there's really some availability to really drive down cost. You can start doing tools consolidation reclaiming all that infrastructure, reclaiming that headcount and basically redeploying number other place, but also the licensing cost. And then you couple that with software and we take that for granted. Most IT organizations buy software today.
They really don't know the utilization of that software. They don't know where that software is really deployed. So since we have this granular high fidelity visibility, we've oftentimes go into organization. We identify in a matter of a week or two, sometimes millions of dollars of software that they can reclaim and then reinvest that back into their IT operations and security operations.
I know we just did a large county that required Tanium as a service. They're fully deployed across enterprise and driving value in just a matter of a week or so. Well, finally, gentlemen, what recommendations would you offer IT leaders at agencies as to consider and choosing and adopting managed services as a way to address security threats as technology and security. So I'll jump on that one.
There's a couple of things I always recommend to everybody. First, get references and talk to them. A lot of what comes our way in terms of new customer relationships, honestly, comes through referrals or recommendations from other customers of ours. There's also an organization that is kind of a separate subsidiary of Verizon called ICSA Labs that anyone who's going out there looking at a variety of different security products.
They do a lot of independent testing of those products. And so they also typically put together some pretty good research on what's out there in the market. And then I also recommend, you know, if you're going to try something new, whether it's managed or product, do proof of concept, get a demo, see what's actually happening, see whether it works well for your environment. You know, I know that when we went out and looked to see who we were going to partner with on the endpoint side of things, we did a bake off of probably a dozen plus vendors at the time to try to figure out what was going to work well for Verizon and what was going to work well for our customers.
And obviously, Tanium came out on top with that review. And obviously, that is something that we've leaned on very heavily, both in the form of the way we work from a managed perspective as well as from a professional services perspective. And then I think it's also good when you're looking at implementation of tools or managed services, how can you do any kind of consolidation? We go out and we see a lot of customers and we get a lot of feedback.
And some of the common things we hear from people is they have, you know, agent fatigue, you know, every vendor they talk to has an agent to install. Well, then my response back is then you need to look at ways that you can consolidate that when you're engaging with a technology is there a way for that technology to potentially take the place of several other agents that you might deploy the endpoints. You're going to recognize efficiency at the endpoint level as well as you'll be able to consolidate some of the subject matter expertise. And then the last thing I would say, speak to the analyst community.
There's a lot of analysts out there that do reviews and ratings of managed security services providers Verizon participates in most of those analysts reviews and you'll see that we rate very strongly as a leader in every one of those. And so I think that that's another good way to get some third party commentary and opinion on what the managed security landscape looks like. Some great points. Gary, your last thoughts or recommendations?
Yeah, a couple thoughts. I agree with Chris on the reference component. So when you look at a reference, I think you need to look at what's been their past performance, when there is issues that come up. Do they hold true to their SLAs and is it performance what their promises are?
And I think the last thing I would suggest when you look at organizations is I find a lot of folks get involved with different types of providers and they don't really have a strategy going in or more importantly have a strategy if they have to get out. So I think it's important to look at the quality of the provider and number two. How do you engage with them going in and out? Terrific.
I'm afraid we're going to have to leave it there for today though. Chris, no back end. Gary Bonacorsy. Thanks so much for joining us to talk about using managed services to address today's IT talent gaps, particularly in security.
Thanks for opportunity to be here. My pleasure. And thanks to Verizon for underwriting today's episode. Look for more of our coverage on IT security in government on statescoop.com and our state school radio channels on Apple Podcast, Spotify, Google Play, Stitcher and TuneIn.
This is why I cast your host. Thanks for tuning in.