Aviatrix Makes Breach Containment Free Until May

Hey everyone, welcome here to Techstrong TV. I'm really happy to welcome back to our show my friend Doug Merritt, CEO of Aviatrix. Doug, thanks for joining us.

I kind of pulled you out early on a weekend here to cover this exciting announcement coming up on Monday. Doug, well, I'm going to let you tell the story. What's the big news?

First of all, thank you for having me on, and no problem at all on a weekend date. Security never sleeps, as we all know. It's a 24/7 sport.

We have been working for quite some time on a product that we are launching this week called Clearance, which is a set of capabilities that allow outbound containment as well as lateral containment and intrusion prevention and detection. So the combination of what security professionals, threat professionals would call egress management, that's outbound containment, macro and micro segmentation, which is the lateral piece, and then making sure that you get insight into that traffic on intrusion prevention and detection. And with all the events that are happening over really the past year, and certainly this past week on, and what I think you all are calling Black October now, we have decided to up the ante, if you will, with Clearance.

But we can talk about that through the interview. Absolutely. And let me just explain.

The irony of October being Cybersecurity Awareness Month, and at the same time having just all of the cybersecurity issues come to the forefront this month, probably the biggest one being the PHP to Shell, but there's been several others. On top of that, we've seen record, just like ridiculous amounts of patches coming out from a record month from Microsoft on Patch Tuesday. Adobe had crazy amounts of patches.

Google, everyone is putting out patches, and then this is all post-Methos type of vulnerability disclosures and findings. And I think, the security industry, and not just the security industry, the IT industry, because it's not security people who do the patching. The IT industry is again being reminded painfully that we can't patch our way out of this.

You just can't patch fast enough at that level of tsunami, so to speak. And so Clearance represents, I think both a stopgap until you can patch, as well as perhaps more of just an operating model going forward, where you're not always hair on fire. So I think both of those are really accurate.

I agree with you. Let's step back for one second. So what is patching all about?

Vulnerabilities exist in software code. Attackers with the right insights can take advantage of those vulnerabilities as one mechanism to try and get into systems to cause some type of damage. And patching is a way to fix those vulnerabilities.

There's a limit on the rate of patching within any organization because our systems are these very complex webs of technologies, and a patch is a change, and when you change one aspect of this broad interconnected web, it can take a system down. And at the end of the day, taking these systems down is very bad. They're our revenue systems, they're manufacturing systems, they're HR systems.

We don't want them to go down unnecessarily. And with the LLMs and agentic AI harnesses, the ability to find flaws that people have never envisioned before or thought of, this PHP2Shell actually was seen years ago, we just didn't think it was exploitable, is increasing the rate of potential penetration. And one of the fixes to stop that is patch like crazy, but you need time to do that.

And network security controls, egress management, lateral movement, are one way to buy time. And we can walk through that in a second. But if we put that aside, CrowdStrike last year saw that 82% of all successful breaches rode valid credentials.

That has nothing to do with this type of penetration that people are panicked about with something like PHP2Shell. That is someone getting Alan's credentials, and Alan already has access to all these different systems, usually way too much because we do not have hygiene the way we should, which is why we're patching like crazy because hygiene's difficult, and then riding those credentials to do really, really negative things. Network security, what comes into a workload, what goes out of a workload, and what workloads are talking to other workloads, is a foundational control that doesn't stop these activities from happening.

It won't typically stop me from using a credential. It may stop the leak of a credential. It won't stop an attacker from getting into...

It can. If you block the attacker, it could stop the penetration that is happening with PHP2Shell. But more importantly, if you assume that you can't stop all valid credentials and you're not going to be able to find all vulnerabilities before attackers do, then the network is a foundational disconnected control from so much of the other cyber activity that bounds the breach, bounds the bad things that happen down to a very definable aspect of the landscape, and you can quantify the cost of something bad happening to that landscape, and you can also rehearse and get better at how do I bring that portion of the landscape back up if it goes down.

It's a reliability strategy. It's a survivability strategy. It's a responsibility strategy for cyber teams.

Agreed. Doug, that was one of the most eloquent definitions of containment I've heard. So thank you for that.

But I think you nailed it right on the head. That is the strategy of containment, of, as I think in Aviatrix terms I've heard you say it, limiting the blast radius of these types of attacks. I think we've all been around the block long enough to know we're not going to stop or find the next vulnerability before the bad guy does.

It's just that's the nature of the game, the cards we're dealt. The name of the game then has to be containment. I don't know another way.

And so we just go to what was the reaction of many people around PHP2Shell? " I know that's definitely an option in the remediation universe. I've got to figure out where all my PHP lives, and I'll just take it down, and then I'll figure out which ones I can patch and which ones I can't.

There's much older versions, et cetera. First of all, you had appropriate ingress and egress management. You'd be very clear on what you have to take down.

Certain aspects are not reachable, and they have no network past them at all. So don't worry about those portions, those segments, those areas of your application. And then as you do your scan and understand what your state is, you could be very selective on which segments of your entire offering you take down and how long you take them down so you can correct everything.

That's way better than the entire government of XYZ is offline, or the entire airline complex of XYZ is offline, which is what we saw happening, which is why I've been preaching for a year now that containment is really the only workable reliable network-level containment, which is the only workable reliability strategy I can think of. Because these are, as you said, these are going to keep happening. It was a really wacky, bad week, but I think this is a low bar of what we're going to see over the next three, five, seven months.

No, it's the new normal. It's the new normal. Doug, I want to focus strictly, tightly into Clearance now.

Obviously, it uses the containment type of technology and limiting that blast radius type of thing that you're talking about. But let's get into the how, when, how much kind of piece of this. How does Clearance help, let's say with PHP2Shell or any of the other garden variety kind of- Bad things happening lately.

Yes. Great question. So, with Clearance, which goes with overall containment, there are three macro areas of capability.

The first is outbound containment, which is the industry will call egress. Egress, a lot of these terms don't make as much sense in cloud and with modern workloads as they once did- Mm-hmm. Yeah ...

because of their architecture. But it stops out-- It manages outbound containment. What is allowed to communicate to a website, and is it an appropriate website or not?

So that is usually one of the most important first steps of an attacker approach. You've got to find a way to a workload and establish command and control. I own that workload.

To do that, you typically have to call home to the bad guy's site. Like for command and control, it's got to go somewhere that it shouldn't. And most workloads, a database, an e-commerce server, a payroll system, have very determined paths.

And for some of these breaches, with simple hygiene on outbound containment, there's no way it would've ever happened, and we can walk through Light LM as a good example. But that's the first piece. The second piece is if you stop command and control, that's awesome, but there's still other ways that bad things can happen.

So let's segment this environment. Instead of having one big environment, so if I get in, I can do anything I want, let's chop it up into 100 or 500 or 1,000 different logical application or capability segments. And that's lateral containment, the second piece of Clearance.

And then the third is all about active defense. These concepts around containment and segmentation, network containment and segmentation, are not new. They've been around for 50 plus years.

There are many different companies that have advocated for this and tried to help customers with this problem and this opportunity. And one of the big issues has been operational concern. If you're doing anything at the network layer has potential, because all of our lives are networked, and all of our applications are networked, of causing a systems interruption.

Which goes back to, obviously, with a crisis, like last week, people are willing to take their entire system offline. But generally, don't want to do that. You don't want a tool that you've used to cause a systems outage.

So the third component, the intrusion prevention, intrusion detection, and then what we're calling active defense, is the capability to... Is the orientation of lowering that operational risk. Evaluating the landscape on a 24 by seven basis with help of AI capability to help the users, the security population, IT population, have a better understanding of what needs to be monitored on an egress basis and what segmentation should exist, and how do you keep those segmentations up in a effective way.

So the bundle of that is Clearance and the Clearance capability. And then underneath the Clearance offering, there's a bunch of stuff that Aviatrix has learned from many past attempts. Our team has worked at a lot of these past generation companies on how to ensure that all this is safe.

You can start with monitor mode, so you're just evaluating your environment. You can stage policies with real-time feedback on, "If I had blocked these workloads in these ways, would it have caused a systems outage? " And then you can put those policies into production one at a time, one workload at a time.

Workload, again, being a virtual private cloud or a VCF, so it's just a small portion of your landscape. If you don't like it, you can back out with a single button push. There's a lot of stuff that we've done to make sure that outbound containment and lateral containment can finally be done safely as well as quickly and easily, which have been one of the banes of existence around network containment.

Absolutely. I love it. Doug, I want to talk about kind of the Halloween trick-or-treat, let's call it, right, that you guys are offering here.

It's a treat. We could allow this for... Well, Clearance is going to be available, I think, as of November 1, technically, right?

Yes, yeah. But as of November 1 through May of next year, anybody can check this out, try it out for themselves. Is that the situation?

Yes. And so the big news, and it is a lot of debate with the past few days across the team, is we're offering Clearance free for any enterprise across every workload across your entire estate through May 1st. And it really goes back to a lot of conversations that you and I have had in the past and I've had with so many other people in the security industry.

This is a really, really unique time for all companies, all humans, honestly, because we're so dependent on the online world for our effective existence. And we had been working with Clearance to price it really effectively, really affordably, so we could meet that need. But on a workload-by-workload basis, well under the existing workload-by-workload charges that you see from lots of other vendors out there.

And it's our confidence in the product and then also our realization that we've got to get this to everybody. We've got to make it affordable because this is a problem that my friends that live down the street, literally live down the street, that have a small company with a website, they've got to manage it as well as the largest financial institutions, the biggest governmental agencies. And with the events of last week, in many, many back and forth conversations, it's like, what if we just give it away for free until May 1st?

We think it's the right hygiene for people, period, no matter what. But with what we're seeing with vulnerability exploitation, vulnerability discovery and exploitation, people need time. They need time to discover their network.

They need time to patch and quarantine different areas. Especially because we're going into the holiday seasons, which tend to create really big difficulties in patching for most of these companies. They've locked down their systems because they can't have systems interruptions.

So the network becomes an even more important control. If you can just gate things, if something is not available, that's what I tell all my family and friends all the time. How do you manage security?

Well, you start by not making it available. If you've got a set of spotlights from your house, and it's advertising, "Come here, I've got lots of money," that's not a good security strategy. You want to make your house as hard to find as possible, and by pulling it off the internet, pulling a workload off the internet, it's very difficult to even find or begin penetration.

And then you can begin this segmentation work that we're doing so that your house is almost impossible to find. If someone does happen to get in, you've got locks everywhere. If they do get inside, you've got barriers and cameras through the house so that it's not easy for an attacker to achieve their objective.

And that's all we're advocating here. But it really helps with patching hygiene because I can analyze... Having a calm head in these environments is so important for folks.

And our belief is that effective network containment and Clearance as a solution for that allows people to calmly study their environment and try and make the right decisions for both the revenue side and customer service side of the business, as well as the security business. Excellent. com website, I assume, and there'll be something on the front page?

Yeah. com- Yes ... they both wind up at the same spot.

You'll see a bunch of assets starting this week. The initial idea was to launch this towards the end of the week. With everything that's happening, we've kind of accelerated that launch, and then we included the free for any of you all until May 1st assistance.

It's our Clearance incident response orientation to the environment that we're all facing. So please come and visit. Please come and visit and check it out.

Love it. Hey, Doug, this is great work, and this is kind of stuff we expect from Aviatrix and your team. Looking forward to see how the audience takes advantage of this, because I think we're all looking for answers here.

We're all looking to buy some time. We're all looking to figure out how we operate at this new normal. Congratulations, and we'll speak to you soon.

Thank you very much, Alan. I really appreciate you taking time on the weekend as well. Not a problem.

Doug Merritt, CEO of Aviatrix, here on Techstrong TV. We're going to take a break. We'll be back with more.