Thought Leaders in Cyber Security: Ray Rothrock, CEO of RedSeal (Part 4)

Sramana Mitra: Not at all. How long does it take to map a sizeable network like the kinds of numbers that you’re rolling out here?

Ray Rothrock: If you’re a skilled engineer, it could take a couple of weeks to a couple of months. Cisco took a couple of weeks.

Sramana Mitra: Is it a scan running continuously, or is it a scan running at certain times?

Ray Rothrock: It depends on the complexity and lots of other attributes of the network. Most people run it overnight because it usually takes a couple of hours.

Sramana Mitra: So the scan doesn’t take more than a couple of hours.

Ray Rothrock: Right. We modified our software to do continuous runs. Let’s say you’re in the military, and you’re running a wireless network in the field. You only have 25 to 50 devices. You can monitor that on a continuous basis.

Sramana Mitra: Switching gears a bit, I’m going to ask you to take more of an industry observer viewpoint. Obviously, cyber security is very much a cutting-edge issue. It’s very much a contemporary issue. It’s very much an issue of the future. It’s going to get worse and worse, and more and more complex. On the other side, the troublemakers figure out how to make trouble. It’s going to become more problematic. What do you see?

Ray Rothrock: You said it all right there. I see exactly that. If you break the last 30 years into roughly decades, then in the beginning, cybersecurity industry mimicked the physical world. We had locks on the doors. We had windows. We had all this physical world concepts that were applied. Firewall is a physical thing. It wasn’t invented by the cyber security industry. The idea was, if I can just protect the perimeter, everything inside will be fine. That was an important thing. That’s what created Check Point, Fortinet, Palo Alto. This is a huge industry.

That was cool until Web 2.0 happened. I’m an HR person and I’m going to work on some stuff at home. I’d send the file from my local corporate network out to my Yahoo! email account. Now, I’ve shifted proprietary documents outside my network through the wall to a public place. That’s the problem. Data leaks happen. Then, intrusion detection came. After intrusion detection, encrypting the host to make it hard for people to steal things and understand what they’ve stolen.

There was this whole wave of point product after point product dealing with very specific threats. Then people said, “This is crazy. I can’t have an infinite number of these things. Let’s set a policy.” For example, if you’re going to take credit cards on the Internet, I must protect that personal information. For PCI, it’s been out there for 20 years. It’s evolved very nicely. Then along came HIPAA. Then along comes NERC. Different policies have come out of different government regulatory bodies. Those have affected how networks are built. There are lots of companies even today still. Illumio is a classic example. How do you enforce a policy on a network?

This segment is part 4 in the series : Thought Leaders in Cyber Security: Ray Rothrock, CEO of RedSeal
1 2 3 4 5