Obsidian Security's Ben Johnson - From the NSA to Emerging Cybersecurity Startups

I've worked at rapid growth companies and emerging technologies are always on the milestone. In the Cybersecurity space, tools in security operations and analytics such as EDR, NTA, UBA, SOAR, and recently, XDR have evolved into household terms.  So what's next? 

CDR - Cloud Detection and Response

When I heard about cloud security, I researched and came across an online interview - "Frictionless SaaS Security" -  with Ben Johnson, one of the Co-Founders of ​Obsidian Security,​ a three-year-old startup based in Newport Beach. "Frictionless" evokes visions of seamless, smooth, and easy deployment and use. Is it really possible to deploy an uncomplicated cloud security solution that will address a very complex problem?  This frictionless solution is the next emerging tool called Cloud Detection and Response. 

I found the interview very insightful as it dove into Ben’s backstory from working for the NSA (National Security Agency) to launching Obsidian, a cloud detection and response platform. Johnson’s first exposure to security began when he saw the thriller, “Enemy of the State”. Soon after fiction turned into fact. The Computer Science major was so fascinated with the NSA that he applied for a job and was hired at the agency.  He says it was such a valuable training ground in cybersecurity and software development that he would have worked unpaid.  Hmmm, I wonder if he would have taken another path if he had not seen the movie.  Note to self - ask him if I ever see him at RSA or a tech conference. 

Seven years later, he transitioned to Finance and Trading but missed working in security and product development which led to him Co-Found Carbon Black. In 2017, he left Carbon Black, to form Obsidian with fellow partners Glenn Chishold (former CTO at Cylance) and Matt Wolff (former Chief Data Scientist at Cylance).

From Endpoint to the Cloud:

But why pivot to the cloud? The founders found their answer after surveying 300 customers and enterprises on what their challenges are around the cloud. The answers weren’t too surprising. CISO’s didn’t know what was going on such in their GSuite, or Salesforce. NGAV (Next Generation Anti Virus)  and EDR (Endpoint Detection and Response) tools "was always their focus but SaaS is a new world... the major concern of what’s going on in their SaaS accounts”, Johnson said. 

“Endpoint focused binary and malware processes but SaaS comes down to accounts and maps to the employee... each user may have about 20 accounts but what is each user doing? And what kind of access do they have?", Johnson further explained. 

Challenges:

Disparate tools - You access Box by logging into Okta but you’re mapped to a particular area, or have certain privileges.

User behavior - You need to understand who’s logging in, who has the account, how are they downloading content, and if they share a lot and to whom?

Tracking all this data is very time consuming and overwhelming for IT, who’s primary focus is to onboard or terminate user accounts behind the firewall. But now when you’re outside the firewall and everything is accelerating so fast, how do you detect and respond?

“We’re creating the same problems in 10 days in the cloud that took us 10 years to create on-prem”, said Johnson. “If you have a staff of 18, that equates to 80 SaaS apps.” This is a major pain for IT teams when trying to determine control, access, and privilege.

Answer to SaaS Security:

Obsidian looks for external adversaries and keeps them out while looking at insider activity whether it is malicious or accidental. Obsidian is like a SaaS EDR (Endpoint Detection and Response).  It's my understanding that their deep integrations can hook to customer's platforms and thread the users, roles, and behaviors - into a single view of different systems. It answers all the questions such as who the user is, what is their role, and where are they located (IP address and data center). Detection, response, and investigation will map the data across the applications.

Deployment:

Sounds like a complex process, but Johnson says onboarding is fast and will reduce dramatically alert fatigue. Analysts will no longer bounce between four different consoles (such as Zoom or Salesforce). According to Johnson, just click for a few minutes and it will start grabbing data. Obsidian is fast to install and has a quick time to value by providing insights in a single view with no impact on productivity. It’s just that simple.

If Obsidian's frictionless SaaS security tool is able to help security operations teams dramatically reduce the time to detect and respond to cloud threats with behavior analytics -  they could be the next cybersecurity startup spearheading the new CDR space. 

If you really want to see how it works, Obsidian’s offers a free 14 day trial of the full functionalities of the platform.

Click here to test it out