Why a breaker switched to become a maker at Devicie

Author: Glyn Geoghegan, Security and Compliance, Devicie (Breaker of stuff. Now maker of things. Not a CISO)

From one hacker to another, Devicie is striding towards flipping end users from weakest link to strongest defence.

Hacker is oft abused as a dirty word, so for context here I’m talking about offensive security, red team, or penetration testing.

What we’re confronting is that making things is hard, but breaking things is easy (at least for folk like me). Until Devicie, I hadn’t seen a technology in the fix-it (or defensive) space that I could really believe in.

Devicie woke me out of my break-it funk, and showed me an environment in which I felt I could have a positive impact.

Cut to the chase

Why does my opinion matter? Well, to many people it might not.

But I’ve been hacking stuff for quite a while; breaking systems for over 20 years, and am humbled to have worked with some really amazing hackers. I’ve seen many ways of building and defending applications, networks, and systems. Despite the talent and effort, they have all (at least in part) failed to solve the overall problem. A quick scan of some reputable commentators and the mainstream media shows that attackers are currently doubled down on ransomware and phishing. There’s apparently a ransomware victim about every 10 seconds, and phishing attacks account for more than 80% of reported security incidents. The material impact is escalating quickly too, with predictions that cyberattacks will cost the world up to US$10.5 trillion annually by 2025.

Nothing will solve everything

There is no single point solution that will save all the things. One size rarely fits all, and this is especially true with regards to the ubiquitous and complex digital systems we are now reliant upon.

People are frequently, and perhaps unfairly, considered the weakest link; or at least the last remaining soft target once everything else has been secured. Education, awareness, and securing their endpoints have all been flagged as important elements of solving these cybersecurity weaknesses. These initiatives, tools, best efforts, and technologies are rolled out, and then eventually into the ‘too hard’ basket they go.

This approach has been partly or wholly unsuccessful for years. Testament to this is that you’d be hard pushed to find a real Red Team exercise that failed to infiltrate an organisation, and typically the fleshware (i.e. the person using the device that made a mistake) is the vector for those intrusions. I’ve seen many projects try to secure the endpoint to save the users from themselves, but these projects always seem to fail, or result in a compromised or incomplete solution.

Here’s the rub. Why should end users need to become security experts, or even IT experts, to do their jobs safely? The responsibility is being placed on the wrong folk, and it is sure to fail. Likewise, can we expect an under-resourced IT team, or any highly skilled experts, to get it right 100% of the time? No, we’re only human (arguably).

Reinventing end user security (the pitch!)

Devicie has reinvented device security and management, and I think it really can make end users as secure as possible in today’s environment.

By automating the deployment of standards, processes, and controls, Devicie helps mitigate critical security risks (and automatically reapplies and self-heals when anomalies are detected). Devicie also automates the process of ensuring applications are up to date and patches applied in a smarter way. Through automating and managing these steps, Devicie also removes the potential for human error that inevitably comes with a manual process.

My initial reaction to Devicie might have been a raised eyebrow and “sounds too good to be true” muttered under my breath (or to those that know me perhaps even fewer words). Except I’ve known these folks for a very long time. They are a smart bunch who have spent many decades understanding the complexities of building, managing, and securing the widest range of SOEs and employee devices.

By automating their combined expertise, leveraging Intune for native deployment, and productising the process of enabling, managing and securing devices, they are walking the talk in a way that elevates end-user security quickly and effectively. It’s clear from talking with the team that automation has been the key to this. By automating, Devicie has been able to repeatably secure the endpoint for users in a way that doesn’t restrict them, while allowing the organisation to have the control and visibility it needs over every device. Further, by protecting the users from typical attacks, and deploying the tech to mitigate threats from the endpoint, even when bad stuff inevitably happens, it won’t be catastrophic. The fleshy end of the equation moves from being a guaranteed way to compromise, to one with a very limited potential and value to the attacker.

Mission Possible?

In my professional journey, I’d almost given up on thinking anyone could be fully secure. No matter how much work we’ve done to help organisations build secure applications and infrastructures, it was always still a Fail. Ultimately, once the red team had a crack at the lowly end users, the Crown Jewels still ended up in the hands of the bad guys. It felt like all that investment was basically worthless.

But now, I’ve drunk the cool-aid and seen Devicie in action, I’ve moved from being part of an impossible mission, to feeling like I’ve joined Mission Possible (or at least Mission Plausible). Devicie really does put the tools in the hands of our clients to provide a safe play pen for their users to access systems. Suddenly the previous weakest link is no longer the final attack vector. Instead, it can become an integral part of a secure and productive environment.

Oh, and I’m still breaking stuff too, don’t worry.

Related resources

Why securing end-user devices is a key part of the Zero Trust journey

Moving to the future state for device security can quickly uplift organisations towards Zero Trust while also facilitating a positive end-user experience. 

Read more
devicie essential eight capabilities statement

Devicie Essential Eight: Capabilities statement

This document outlines how Devicie helps organisations to quickly implement key ASD Essential Eight controls on end-user devices.

Read more
How Devicie automates Essential Eight on end-user devices

How Devicie automates Essential Eight controls on end-user devices

Devicie automates Essential Eight controls on end-user devices, so organisations can ensure security and productivity.

Read more