Nathan Rollings, Elevate Health | Qualys QSC22

This is texturong TV. Hey everyone. We're back here.

We're gonna wrap up our day one coverage of quality QSC. It's been a great day. We've probably done.

I don't know. It doesn't maybe more interviews. Hope to give you a flavor of what goes on here.

I just want to remind you all again, you know. Koalas puts these on It's open to anyone who wants to register probably too late to come on down to Vegas for this right now. But if you want to catch the next one, it's a great security conference because you it's not just Wallace and the quality people.

It's the the people you meet here you get a chance to interact with. Gives me a good lead into our next guest. His name's Nathan Rawlings.

Nathan is with elevent elevance health elevant health. He's actually speaking tomorrow tomorrow and Before we get into what he's speaking about Nathan first of all, say hello. Hello.

So can people a little background on you? Yeah, so I'm Nate Rawlings with elevance health formerly Anthem Whole Health company with plans across Medicare Medicaid and Commercial. We have 14 Anthem Blue Cross state plan.

So but we do a lot more as well. We do Pharmacy behavioral specialty Health digital platforms, right? And so we've really I don't want to say reinvented ourselves, but are working to take Health Care all the way to the communities in which we live.

So my job super important there because I'm the senior director of vulnerability management secure configuration and Cloud security posture management. Yep. And so I take that very seriously because we're protecting the systems and data series job, right that protect the folks in those communities.

So glad to be here and looking forward to talking about. Thanks. Thanks for that Nate.

You know, I'll tell you something. It's Kind of information you have I mean, obviously there's hip person people's personal health information, but there's also this there's trade information, right? There's I mean such sensitive kind of data.

No one wants to be tomorrow's headline. That's right. Right.

And so there's something is it. This is a job, right? Yes, absolutely.

You know, I I've been in security 25-30 years myself man. Right and I started security companies have been in the industry. I mean 30, you're 30 years old, right?

Yeah, something like that. But you know, it's been a long strange trip as they say but one of the Kind of mythical beings unicorns and security was trying to show Roi. Yeah.

Absolutely man. I remember doing an Roi calculator for a company. I started back in the early 2000s, you know of why vulnerability management, you know would provide Roi I can't tell you how many people laughed at us.

Absolutely. Yeah for sure. You're talking about Roi security tomorrow.

Why shouldn't we laugh at? You? Not just because I like unicorns I guess but because I think Roi and when we look at it in just the security lens it is difficult to quantify and explain articulate.

But when you look at it through the lens of your partner, right, we know that there's a finite number of hours in the day and there's even less hours in the day that our friends and it in the business are are working and and even smaller amount of time in which they're working to maintain those applications and systems or mediate vulnerabilities on those systems patch rehydrate images in the cloud. So if we can maximize the risk reduction for the hours that they spend on those activities, then we are improving the return on investment for the time they're investing in doing those things. So I like that.

Yeah, so that's what we're focused on and you know as part of the product Advisory Board and with the partnership and what we have with flawless, that's a lot of our messaging. It's like Wallace is my tool and and terms and I say my that's the Royal mind because I've got a great team behind me, but it gives me the security insights that I need. To understand the risk of the environment but I have to think about the folks that are actually doing the work doing the remedial activities doing the corrective action.

Their time is money, man. It is exactly that right. And so if if I'm not thinking about that, then I'm not going to be able to reduce the amount of risk because at the end of the day and you talked about sensitive data things like HIPAA PCI, and there was folks talking about it today.

I don't get to mandate what my service level Agreements are right, but I do get to prioritize and the vulnerabilities and the actions and the security exposures that need to be fixed first so that we can reduce the amount of risk and I do get a provide the information in a way that they can consume so they can be action oriented in the way that they address them. So we built that and not not through just that action right but it's the willingness to understand their perspective and drive that so and I want to tell you why we came to that Allen. I came in to the vulnerability management role at alabance couple years ago, right?

It'll be two years in December and I looked across the landscape and I was like, we got it, you know 18 subsidiaries and every cloud environment out or CSP out there and 7,000 applications on my boy. This is gonna be a big job. How are we going to do it?

Right? And so, you know when I talk tomorrow, I'm contrary to the to the pleasing points of the koalas folks. I'm not going to talk about how qualis can solve all your problems, but I will tell them how we've used qualis to solve some of our problems.

Right? And I think that's the key right. I just had a conversation with dillip who you know platform.

He runs he built the quality platform. Absolutely. I think that's the key to this whole thing.

Can't expect quality or any other company to come by and say, you know poof your your security problems are gone. You're right abilities are done. At the end of the day the tools absolutely tools are only is, you know, as less than I learned growing up.

The the tool makes the man but they're only as good as the man or person woman person using that absolutely and and so just because you have quality or quality like thing doesn't magically mean your stuff went away. Now now you got your work that's at least you know, what work it is. It's absolutely right.

So we were with the qualis agent deploying that vmdr. So we were a longtime quality shop traditional Network appliances scanning and frequencies in downtime. We deployed to agents in 95% of our systems over 400,000 systems that could accept my agent.

We now reduced vulnerability detection time by 4200% 42 times. So we're finding vulnerabilities every four hours on 95% of a fortune 20 companies systems. We increased the time to communicate of vulnerability by seven times.

So on average we're finding vulnerabilities in communicating them within service now and our other workflows within a day crazy. It's crazy. It's crazy.

I am I think back to my days on the other side of this camera. You know where the average meantime to remediate was 90 plus days. It's great.

That way crazy right was crazy. What is it what it's supposed to be? That's right.

And so we're still working on driving down that meantime to remediation but really the whole concept of Roi came to me like, you know, my guys are frustrated. We've deployed the agents for finding them fast. We've got a risk-based methodology.

That's Best in Class in the industry. We're communicating through service now and working with service now and improve their platform. But we had to start now.

We have to start looking at those other things that can drive down that meantime to remediation if we look at it as a stack bar meantime to detect mean time to communicate and then meantime to remediate if I told you we're communicating our vulnerabilities in today and SLA 30 days. And you miss that SLA. What were you doing for?

29 days? That's what you got that you got it. So that brings up my pet peeve.

Look, we've had companies touting automated remediation automated patching automated configuration automated remediation where I'm I'm changing Network paths to you know, isolate certain kinds of traffic that could be, you know, exploited and so forth. We've had this available in the industry. Long time 15 plus years.

Absolutely. There's a tremendous reluctance. To move towards automation.

Yeah. It's like and you ask people why why and they're like, well, I don't want to break anything. That's exactly okay better to be insecure better to have this gaping hole over.

Right and someone's gonna drive a truck through you know, and I think that's about creating cyber awareness and I yeah, it's you know, what's funny and if you you do a little Socratic method with the folks and you say okay, you don't want to play that patch because that system's critical and you need it. Right? Well, it's taking down.

It's exactly right. It's a logical exactly. What's the larger risk and you know with the different means of deploying patches and you know folks being able to to do so in production quickly roll back.

We've got to bring again our partners in and show them that that automated remediation is going to further increase the ROI for the time that they're spending and that's and that's the key piece of it, but in my mind so that That's not a technology. The Technology's there. I think Wallace has a great absolutely for it.

Absolutely. I think that's more of a mindset. I agree to get changed.

I agree sometimes changing mindsets is a lot harder than just building code. I agree. I agree and you know, it's we live in the we all live in the Missouri State, you know the show me exactly right?

So I think we have to be able to demonstrate that and Take a step back from the security practitioner lens and and have a seat in their chair for a second say let me show you how our tools can help you and we've talked a lot over the last couple days. We get a lot of value out of the qualified cybersecurity Asset Management capability and guess who else gets a lot of value out of it and it our Enterprise architecture groups. A lot of the folks that are looking for those same asset details and things like that.

So let's bring them in and just like I'm asking qualis and the other technology providers to work with each other integrate your tools to make better security posture for our entire environment. We need to be doing those same things within our organizationally and and that's where the ROI kick really kicks. That's right better.

We're better together. You got it, man. Hey Nate, I don't think it's gonna be a great session.

I hope so looking forward to it for more importantly then keep fighting the good fight. It sounds like you're on your game. We're trying to we're trying to elephants in a good place with it.

I appreciate it. All right. com.

Excellent. All right. Hey, that's gonna wrap up day one here at Las Vegas.

We will be back tomorrow. I think around 10:30 Pacific time check the live stream until then. Hey stay safe.

Enjoy. We're out. Bye-bye.