AiThority Interview Series with Mike Weber, VP, Coalfire Labs at Coalfire

Tell us about your technological interaction with IoT and other intelligent technologies that you work with?

Coalfire Labs provides technical testing services of all IT environments and solutions, including IoT technologies. Our work with IoT focuses on the end-to-end implementation from the hardware device, the remote connectivity architecture, the data stores, and the instrumentation and operational interfaces of the solution. We test its security, emulating what an attacker could do to subvert it, and what impact may be experienced by the consumer or the provider’s business. We work to gain access to technology deployed in the field, degrade the integrity of the data collected by field devices, compromise data stores or operational management systems to expose sensitive data, or demonstrate how these may be altered to provide inaccurate information, ultimately impacting business decisions. We do this before an attacker does so the company can learn how to protect against it.

How does Coalfire solve the challenges of capital-intensive industries with IoT?

Our work spans the range of technologies and environments including Industrial Control Systems. Companies building IoT components in ICS/SCADA environments can be challenged to gain acceptance of their products given how IoT “breaks” the historical physical boundaries that have been part of securing industrial and operational technology. Our testing of Industrial IoT solutions in the water/wastewater, electrical, and automotive industries provides assurance that they can withstand the efforts of concerted attackers. Many companies producing products in these industries find that demonstrating this diligence in their engineering efforts can differentiate them versus their competitors.

Predictive maintenance/analytics is one of the biggest boons of IoT. However, to get concrete results is time-consuming. How are companies like Coalfire trying to solve this problem?

By testing IoT solutions and uncovering vulnerabilities in the architecture or platforms. Coalfire helps companies identify appropriate strategies to protect solutions with actionable recommendations, ultimately accelerating the adoption and deployment of IoT technologies.

What today is the biggest threat to Enterprise Data?

Historically speaking, the human has been the biggest threat to the enterprise. Beyond that, the cost to ensure strong, multi-factor and layered security can come at a significant cost to provide for both external and internal data access. Managing these solutions and maintaining a full suite of end-to-end security solutions is not a simple operational task. Cloud Service Providers (CSPs) are an attractive solution to organizations facing these challenges for these reasons. However, CSPs aren’t a panacea – in today’s world of multi-cloud and hybrid environments, misconfigured authentication settings are sometimes all it takes to expose all your data to those that know to look for it.

Read More: AiThority Interview Series with Mark Qiu, Co-Founder and COO, RoboSense

What can industries leverage from Coalfire’s Cyber Security solution?

Coalfire doesn’t provide products – this is really an advantage from our viewpoint. We advise on security gaps and how to become more secure, and by not offering a product, customers know that we aren’t giving a biased spin on issues to push proprietary products.

The Cloud has substantially eased data management for enterprises. However, what do you think are the biggest challenges in Cloud deployments?

Cloud services are attractive to organizations looking to find solutions to data management and security challenges. However, cloud services have their own challenges – with the complexity of multi- and hybrid cloud environments, enterprises have more to learn than ever within the increasingly complex shared responsibility models and proprietary best practices. Companies still have to have in-depth cloud security strategies.

How important is it for you to keep in touch with the technological evolution of your company’s offerings?

As a security testing and assessment service company, it’s of paramount importance to stay on top of the latest technologies that are entering the market. Our reputation is based on knowing what the heck we’re talking about and being able to provide recommendations to our customers that are meaningful – if we were to provide useless or inaccurate information or not be able to speak authoritatively on matters of technology security, we’d quickly find ourselves “exploring other career options”!  And it’s not easy trying to build and maintain a level of knowledge that our customers can benefit from. We have structured training programs and career development plans that align with the direction of the industry and the strategic direction of our company.

Tell us about the paradigm of your Compliance services?

Compliance keeps getting more costly and complex for organizations—compliance frameworks coupled with privacy regulations, some by country, now by individual U.S. state, are proliferating. Our paradigm is to find ways that companies can align compliance cycles and prepare to leverage automation, so that they can begin to do repeatable tasks that span compliance frameworks once and use many, rather than eating manhours and costs doing everything separately. Overall, though, compliance alone doesn’t equal security, so all this aligned compliance work should still be focused on an overall defense-in-depth model.

Read More: AiThority Interview Series with Dean Abbott, Co-Founder And Chief Data Scientist at SmarterHQ

What is your take on weaponization of AI?

This is an interesting question. There are security products in the market that are being promoted as Machine Learning architectures – or in some instances, AI – that dynamically adjust for anomaly detection and security protection. While I can’t say all these claims are legitimate ML or AI, I will say that many of these intelligent platforms have been developed in the wake of dynamic polymorphic malware, which had stumped traditional “signature-based” detection platforms. I’m unsure if AI in its truest sense will see a packageable deployment in a malware context, but it’s possible that attacking platforms can leverage some kind of self-managing code to evade detection and response solutions akin to how they do now. However, it’s a bit of an arms race once again, with security solutions trying to stay ahead of the attacker. Ultimately that arms race would boil down to who has the better AI – if indeed this is even a weaponizable construct as we currently know it.

Where do you see AI/Machine learning and other smart technologies heading beyond 2025?

The field we know as AI/ML is somewhat nebulous right now but has already been transformative to many industries. Machine Learning itself is really a subset of AI – and contains its own subsets of approaches as well. I think that ML is the only real answer to sorting out the meaning of massive amounts of data that are being collected as we build out an ever-increasingly connected world. I would also surmise that we’ll see incredible advancements in computing power as manufacturers innovate to keep up with the demands of increasing AI solutions and capabilities.

Thank you, Mike! That was fun and hope to see you back on AiThority soon.

Read More: AiThority Interview Series with Jurgen ter Hoeve, CEO at We.Stream