Cisco security GM discusses plan for infosec domination

Cisco believes CISOs are overwhelmed by too many security products and vendors, and the company introduced a new platform, ominously code-named Thanos, to help enterprises.

But despite being named after the Marvel Comics megavillain, Cisco's SecureX platform isn't necessarily designed to wipe out half of all existing security products within enterprise environments. Instead, Cisco is taking a different approach by opening up the platform, which was unveiled last month, and integrating with third parties.

Gee Rittenhouse, senior vice president and general manager of Cisco's Security Business Group (SBG), said the aim of SecureX is to tie not only Cisco products together, but other vendor offerings as well. "We've been working really hard on taking the security problem and reducing it to its simplest form," he told SearchSecurity at RSA Conference 2020 last month.

That isn't to say that all security products are effective; many "are supposed to have a bigger impact than they actually do," Rittenhouse said. Nevertheless, the SBG strategy for SecureX is to establish partnerships with third parties and invite them to integrate with the platform, he said, rather than Cisco trying to be everything to everyone. In this interview, Rittenhouse discusses the evolution of SecureX, how Cisco's security strategy has shifted over the last decade and the company's plan to change the infosec industry.

Editor's note: This interview was edited for clarity and length.

How did the idea for SecureX come about?

Gee Rittenhouse

Gee Rittenhouse: We thought initially if we had a solution for every one of the major threats vectors -- email, endpoint, firewalls, cloud, etc. -- for one vendor, Cisco, then that would be enough. You buy Cisco networking and you buy Cisco security and that transactional model will simplify the industry. And we realized very quickly that didn't do anything except put a name on a box. Then the second thing we thought was this: What happens if we take all these different things and integrate the back end together so that when I see a threat on email, I can block on my endpoint? We stitch all this together [via the SecureX framework] on behalf of the customer, and not only does the blocking happen automatically but you also get better protection and higher efficacy. We'd tell people we had an integrated architecture. And the customers would look at us and say 'Really? I don't feel that. You've got a portal over here, and a portal over there' and so on. And we'd say, 'Look, we've worked for three years integrating this together and we have the highest efficacy.' And they'd say, 'Well, everybody has their numbers ...'

About a couple of years ago, we said we've simplified the buying model and simplified the back end. Let's try to simplify the user experience. But you have to be very careful with that. The classic approach is to build a platform, and everyone jumps on the platform and if you only have Cisco stuff, life is great. But, of course, there are other platforms and other products. We wanted to be precise about how we do this, so we picked a particular use case around investigations. It's an important use case. We built this very simple investigation tool [Cisco Threat Response] that you can think about as the Google search of security. Within five seconds, you can find out that you don't have [a specific threat] in your environment, or yes, you do and here's how to block it and respond. The tool had the fastest rate of adoption of any of our products in Cisco's history. It's massively successful. More than 8,000 customers use it every day as their investigation tool.

Were you expecting that kind of adoption for Cisco Threat Response?

Rittenhouse: No. We were not. There were two things we weren't expecting. We weren't expecting the response in terms in usage. We thought there'd be a few customers using it. The other thing that we didn't expect was a whole use community came together to, for example, integrate vendor X into the tool and publish the connectors on GitHub. A whole user community has evolved around that platform and extended the capability of it. In both cases, we were quite surprised.

When we saw how that worked, saw the business model, and we understood how people consumed it, we attached it to everything and then said 'Let's take the next step' with analytics and security postures. We asked what a day in the life for security professional was. They're flooded with noise and threats and alerts. They have to be able to decipher all of that -- can the platform do that automatically on their behalf? That's what we're doing with SecureX, and the feedback has been super positive

What kind of feedback did you get from customers prior to Cisco Threat Response and SecureX? Did they have an idea of what they wanted?

There is only a handful of true, successful platform businesses in the world; it's very hard to attract that community and achieve that scale.

Rittenhouse: There was a lot of feedback from customers who asked us to make the front end of our portfolio simpler. But what does that actually mean? It was very generic feedback. And in fact, we struggled with the 'single pane of glass' approach. What typically happens with that approach is you try to do everything through it, and all of the sudden that portal becomes the slowest part of the portfolio. This actually took a lot of time and a lot of conversations with customers on how they actually work. We engaged a lot of them with design thinking, and Cisco Threat Response was the first thing to come out of those discussions, and then SecureX.

And I want to make the distinction between a platform and a single pane of glass or a portal. And we very much think of SecureX as a platform. And when you think about a platform, it's usually something that other people can build stuff on top of, so the value to the community is other people's contributions to it, and you get a multiplier effect. There is only a handful of true, successful platform businesses in the world; it's very hard to attract that community and achieve that scale.

Like other recent studies, Cisco's [2020] CISO Benchmark Report showed that many CISOs feel they have too many security products and are actively trying to reduce the number of vendors they have. Other vendors have talked about this trend and are trying to capitalize on it by becoming a one-stop security shop and pushing out other products. But with SecureX, it sounds like you're taking a different approach by welcoming third-party vendors to the platform and being more open.

Rittenhouse: We would encourage the industry as a whole to be more open. In fact, the industry is not very open at all. One of the benefits to being open is the ability to integrate. In today's industry, for example, let's say you're a security vendor and your technology says a piece of malware is a threat level 5, and I say it's a level 2. And you're integrated into our platform, and you're freaking out because it's a level 5. I ask you, 'Rob, why do you think this? What's the context around this? Share more.' And until you have that open interface and integration, I just sit there and say, 'For some reason, this vendor over here claims it's big, but we don't see it'"

So yes, we're open. And I would anticipate the user experience with Cisco security products integrated together will be very different than what you would get with third parties integrated until they start to share more. And this is one of the issues you see in the SIEM and SOAR markets; they become data repositories for investigations after you get attacked. What actually happened? Let's go back into the records and figure it out. Because of the data fidelity and the real-time nature [of SecureX] this is something you interact with immediately. It can automatically trace threats and set up workflows and bring in other team members to collaborate because you have that integrated back end.

Cisco has said it's the biggest security vendor in the world by revenue, but most businesses probably still associate the company with networking. Now that SecureX has been introduced, what's the strategy moving forward?

Rittenhouse: We've spent a lot of time on the messaging. I think more and more people recognize we're the biggest enterprise security company. In many ways, our mission is to democratize security like [Duo Security's] Wendy Nather said, so we want to make it invisible. We don't want to be sending the message that you have to get this other stuff to be secure. We want it to be built into everything we do.

There's been a lot of mergers and acquisitions, especially by companies looking to increase their infosec presence. But Wendy talked during her keynote about simplifying security instead adding product upon product. But it doesn't sound like you're feeling the pressure to do that.

Rittenhouse: No. We are not a private equity firm. We buy things for a purpose. And when we buy something, we'll be happy to tell you why.