Cloud Services and Risk Management with JC Najera at QSC24

This is Textron tv. Hey everyone. We're back here in San Diego, sunny San Diego.

I might add, uh, covering the Qualys QSC America's Conference. Really happy to be here. Um, our next guest, well, he, it's not his first time.

He actually was with us in Las Vegas. I think that was at the Bellagio. It was the Bellagio in 2022.

Um, I remember it was kind of qua, uh, not Quais. Covid was sort of coming to, uh, it Was, yeah, it was a Venetian Actually, I Just remember actually it was the fir the year. The one before was Boll and then it went to Venetian.

Anyway, help me with your name. Jose. Jose Nara.

He does it really good. Say it one more time. Jose Nara Nara.

I could do the Jose part. The rolling R gives me a hard time. So, Jose Nara Jose is with Syntax.

Syntax. That's correct. And if you're not familiar with syntax, give 'em the website.

com. com. Perfect.

And just, I'm not going to make you go into a five minute kind of pitch, but what's the 32nd pitch on Synt? Right. So, so Synt has a large ERP and cloud, uh, managed service provider.

So we work with Azure, AWS, Oracle, Google Cloud, and we work with, uh, SAP and Oracle to produce, you know, valuable product, uh, services and products on the cloud and ERP basically. Love it. Good stuff.

And then Jose, what's your role at Syntax? So I am a SOC manager, uh, at a global level. Um, I work, uh, on vulnerability management, uh, threat intelligence, uh, and detection engineering.

So that's the, the proactive part of the soc. Uh, and my job is to, uh, you know, view the risks and then fix them before, you know, the boom is, uh, Sumit and Juliet said Before, right? Actually, we just had Juliet in here.

Oh, nice. Uh, it was, it was an, yeah, that runway's getting shorter and shorter. Oh, yeah.

But anyway, when we interviewed you back in 2022, you were, uh, you had adopted the total cloud Yes. Yeah. Solution.

Yeah. The, the, so we talked about VMDR, and then I do remember, uh, that that year was the year that quals released Total Cloud. Right.

And this is gonna be part of my, my talk actually, where, um, uh, you, we were discussing the fact that it was a new product. You asked me how, how do I feel about that? And I told you, well, that's an interesting thing.

I would like to test that FinTech sounded good. Yeah. Sounded really good.

Um, and then two years after I'm here, I am, you know, I'm gonna be talking about Toll Cloud. 'cause I think it's a great product in Texas seeing a lot of value in it. Uh, we are able to see a lot of, uh, new things or discover new things that we've never seen before.

Uh, and then our risk management is, you know, getting better because of that. So what, you know, there's sort of classical risk management and then there's risk management we talk about at a cyber level. Mm-Hmm.

Right. And, and I'm sensing when you are talking about risk management, it's very at that SOC level where, hey, these are the vulnerabilities that we're finding. These are the, you know, potential, uh, ways in.

Mm. And we've got to prioritize which are the most, uh, potentially harmful, and then fix them as quickly as we can. Exactly.

And, and in a very, you know what, at a very simple level, that's risk management. Mm-Hmm. Right.

There are others, you know, at the CFO levels and these levels where they, they have a very different definition and formula for determining risk and risk management. But you know what, Jose, you represent like a lot of people who are watching this, people who roll up their sleeves and get their fingernails dirty in security. And that's what risk management is finding where my exposures are.

And pro I, I probably can't fix all of 'em in time, but which one should I fix first, second, third, and getting into it. Right. And, and that's exactly the kind of task that Total Cloud was meant to, to, uh, to work with.

And it sounds like thumbs up from you on it. Absolutely. Yeah.

I, I think we, we need to be prepared always. We need to assume that risk is there and then be able to prioritize it. 'cause you said it, right?

I mean, there's a lot of risks. There's, there's a lot of vulnerabilities. Millions and millions.

And then you need to choose which ones are the, the most important ones. Uh, you need to figure out who owns what. And then Syntax, for example, we, we help a thousand customers.

So we need to figure out, you know, what is important for each one of those customers. They are on their multi-cloud, their, uh, hybrid environments, public, private. So we need to figure out all of those things.

Um, so, so we can tell them what to do and we can do, you know, what is best, best for them as well. Sure, Sure. And you know, as a managed services provider, you know, you, you bear a, a greater risk, right.

Because you have a thousand organizations depending on you. Right. Because they're hiring, not you, well, they are hiring you, but they're hiring syntax to say, Hey, managing that risk, keeping us safe is part of the reason that we're using you versus doing it ourselves.

'cause we think you could do a better job at it. Yeah. Um, by the same token, you turn around and say, Hey, Qualys is a tool that's gonna help us achieve that.

We've looked at other tools and, and this is what we think is the best for our purposes. Right? Yeah.

It, it, it made sense. I mean, we, we were using VMDR, we were using PCI compliance before and SEA security, you know, configuration assessments. So it, it all made sense when we figure out that we could actually do the, uh, cloud security, posture management through Toll Cloud, using the same process as the same look and feel, even the same team, which is pretty cool.

I mean, we didn't need to hire a bunch of new People. Right. And that, that made it kind of an easy, easy on ramp.

It was, It was very, very easy. Yeah. Now, of course though, since 2022, the world's changed a little bit, this AI thing.

Mm. Everybody's crazy with ai, as you mentioned in the opening team note, uh, sum and Julia thought talked about, you know, the boom. But they also talked about how that runway to the boom is much shorter.

Mm-Hmm. How we go. Things are just moving faster.

And, and AI is both helping, is is, can be both friend and foe there. How, how are you seeing this affect you and your, in your role and, and what you're doing at Syntax? Yeah, I mean, you need to adapt.

You need to be able to use it on your, you know, uh, Just for, for for your own goods, right? I mean, Mm-Hmm. us for example, in the soc, we do developed several tools that are, that have AI to figure out, uh, or enhancements.

We'd figure out new stuff, new threat intelligence to get, we can actually actually, um, you know, attack those attackers or, well, not attack, but defend or the attackers. Mm-Hmm. Um, so our, our SOC level one is based on ai.

So we, we can actually send, uh, alerts to customers using ai, which is, you know, uh, private property basically. Um, and we are intellectual property from Syntax and we send those alerts to customers using AI so then they can figure out what's happening. They have this very human readable, non technical, engineering plain Language.

Yeah. So it, it's very useful. And, and customers feel like they're getting more and more every time.

So that's a very good use of AI for sure. Sure. And what about in terms of, uh, AI and, and other new technologies making their way into Total Cloud and some of the other Qualys, uh, some of the other qua solutions that you guys use?

Have that helped? Or like, I mean, certainly Qualis hasn't stood still since 2022. Either.

They've constantly improved the products. Yeah. They, they're constantly doing that.

And I, I think, you know, I'm pretty sure they're gonna show a lot of things, new things right now, Qualys, uh, security conference. Mm-Hmm. And I think they're gonna surprise us a lot with AI stuff, with new capabilities.

And I'm very, very happy that I'm here 'cause I can, you know, hear it for firsthand, figure out how can we use it now, uh, on syntax with our customers and everything. So that's, that's very, very exciting. But you're also here as a speaker, which is a pretty cool thing.

Is this your first time presenting? This is gonna be my second time. So I was speaker at Las Vegas Ah-Huh?

In 22. Yeah. 22.

And then, uh, this is my second time here, uh, now in San Diego. Very cool. Very cool.

One last thing. Sure. So one of the big announcements has been this, uh, it's called True Risk Management, enterprise True Risk Management.

And it's, it's, they're introducing this concept of a rock. So you work at the right Rock Risk Operation Center that kind of pulls in risk information across all of the different tools. And not just Qualys tools, but third party tools and information sources.

You probably have it, you're probably just finding out about it here. Mm-Hmm. But is that something you guys, you could see maybe becoming part of your SOC operations team?

Yeah, absolutely. I think it's, or is that a separate silo in the company? I, I think it should be part of it.

I mean, it, again, it makes sense. Uh, we are having information here and there, so, you know, putting all together, uh, making sure that everything matches, everything correlates as Sumit mentioned before. Mm-Hmm.

Uh, will help us calculate risk and then communicate that risk to the, to the board, which is the most, the most important thing. Right. Absolutely.

Jose, thank you so much for coming here and it's good to see you. Hopefully it won't be two or three years until I see you again. I hope so.

But stay in touch and, and best of luck with what you're doing. You're on the front lines, man. Thank you very much.

Doing good work. Alright. We're live here in San Diego.

We'll be back with another guest in just a short moment. We've got some other infor uh, information and, uh, content for you to watch right now. This is Hummel at San Diego for Qualis.

QSC.