STEPHEN ROSE: I am so excited today to have a very good friend of mine join us to talk about security and all that is important in security. Paula, calling in from Warsaw, no less. Thank you so much for joining us today. How are you?


PAULA JANUSZKIEWICZ: Well, thank you so much for the invitation. Everything is good. And how are you doing?


STEPHEN ROSE: I'm doing great. So, I've known you for about 12 years, but even then, you were doing security. So, tell us a little bit about yourself and the work that you do and how you have gotten to this point in being one of the top security experts . . . you know, speakers in the world.


PAULA JANUSZKIEWICZ: Well, thank you for this. Yeah we know each other for so many years, right? But well, I've been in the industry for the past 15 years actually, and the company that I have established called CQURE is right now 12 years old. And also to show how cybersecurity has grown for so many years, at the very beginning, I was the only one, and right now we've got 42 team members.


STEPHEN ROSE: That's crazy. That really shows how important it has become back since the Windows 7 days and NT. Well, you were doing like Windows 2000 security, and then sort of moved up from that as I continued to know you and work with you over the years. So, our show today is on security, and I thought it would be great to ask you, what are the three or four questions that you consistently get that you say, "I wish I didn't have to answer these four because either so many other great things to dig into." So what are three or four things that every person who's looking at security should really think about or should really know?


PAULA JANUSZKIEWICZ: Oh, well. Some of them are quite generic that I'm getting.


STEPHEN ROSE: Which is fine, yeah.


PAULA JANUSZKIEWICZ: OK. So, this is the first funny one I'm getting if, for example, during the pen test, as well, or after the speech at the conferences and so on, and that question is simple and it sounds, How to hack Windows? [Both laughing]


STEPHEN ROSE: OK.


PAULA JANUSZKIEWICZ: That really makes me laugh because there are so many things, right? that are dependent on like while you were getting into the infrastructure things can be misconfigured, and there's a platform security in Windows, which is great, so there's plenty of things that that the answer isn't very short, yeah? But on the other hand I don't want to fall into the typical consultant and answer it, which will be, "Well, it depends." [Paula laughing]


STEPHEN ROSE: Yeah, but it is. I mean, there it's not that Windows is not a secure platform on its own, it's how people configure it or misconfigure it or don't finish things is where those areas lie. So absolutely, I think it depends on the person, how they're looking at things. So what advice, if somebody is saying, "I want to secure Windows," what are one or two things you say are the absolute must-dos? Where does somebody kind of start?


PAULA JANUSCZKIEWICZ: So when we, for example, look from the enterprise perspective, one of the top things to consider right now would be the whole platform that is related with preventing running the software, in general, the code that we don't know. So simply speaking, whitelisting implemented through AppLocker, Device Guard, application control, and also the attack surface reduction rules, which are related to Exploit Guard that are, for example, preventing us from running micros from the documents while also taking into consideration phishing right now. That is a really nice thing to have because phishing has grown within the pandemic time in a massive way.


STEPHEN ROSE: Yeah. It's crazy how much it has gone up and how many "your Netflix account didn't go through" and things like that that are hitting. How about MFA? How important is it for folks to put in MFA or some sort of two-factor authentication?


PAULA JANUSCZKIEWICZ: Yeah, it's good that you mentioned it because not a really long time ago, I was actually doing a pen test for an oil and gas company and there were approximately 6,000 accounts that I was supposed to test, and that was one of the first stages of the penetration test. And I started with the simplest possible thing that is out there, which is a password spraying [and these guys did not have MFA], and 29 accounts out of that 6,000, approximately, they actually had the user name, of course, as the name within the company but the password was "companyname2020." So, like it's just statistics, right?


STEPHEN ROSE: Right. That's exactly it. Yeah, what is another thing that people tend to overlook? One of the interesting things is during the pandemic, so many people rush to move things that were on prem to the cloud to be able to support people externally. One of the things that we've continually said is, It's really important to go back now and take a look at your security because you changed a lot of things to allow people to work from any device anywhere and to be able to do it securely. Templates are really important to go back and to go take a look at and to put those in. To run Secure Score and things like that. What is one of the big things that you've seen as people have rushed to roll out things in weeks that they had planned to do in months that you found as a gap?


PAULA JANUSCZKIEWICZ: Well, first of all, I think allowing private, like, personal devices to connect to the infrastructure without clearly defined strategy where they can connect is one of the biggest mistakes that they make. And the reason why I think so is because, well, I understand that, in a sense, because they have to provide the access, but they rushed as you mentioned for it. So, there was no clear action on the security side taken, for example, that is filtering the traffic that is happening from the personal device. And what I mean by this is that that device gets infected. You've got attacks, for example, like VPN pivoting that are allowing to use the personal workstation to hop through the infrastructure's items. And then you've got the concept of somethings that we call "shadow IT." And in general, these are all solutions items that are within the organizational infrastructure that are put out of the compliance. So that could significantly increase the risk of getting access somewhere and especially because the hacker is not really directly connecting to network. It's connecting through the workstation that is under attack. So, the hacker could be also sitting on that workstation, yes? So, there are plenty of options here. And I think that this is currently the biggest risk because we are allowing devices that we have no control on to connect to the infrastructure.


STEPHEN ROSE: Yeah. So probably one of the best things that accompany can do is maybe bring in a security expert to go ahead to take a look at their networks, to see what they've done. It's certainly money well spent considering the billions and billions of dollars that companies have lost in data being lost, in names getting out as personally identifiable information. So, how do they get a a hold of someone like you and set up to get a security consultation?


PAULA JANUSCZKIEWICZ: Someone needs to find a security consulting company and discuss the scope. Basically, the first question would be how to secure remote work. And one of the things would be to analyze our external cybersecurity posture to verify what kind of services are in general published. So, something similar pretty much to the external pen test but also defining how these devices are configured; what are the images, like you mentioned; and how people are actually connecting. So, is it also VPN with multifactor authentication because that is also a really nice concept here. So, that will be pretty much the first step to take.


STEPHEN ROSE: Yeah, and we're seeing a lot of split tunneling because of Teams and things like that, so it's super important. Great. Where do people go to learn more about you and your company and can reach out to you if they have questions?


PAULA JANUSCZKIEWICZ: Well, thank you. So, within in our team, we've got first thing simply a website, which is CQUREAcademy.com, which is our educational part of the team. We spend 70 percent of our time on the projects and approximately 30 percent of our time performing some research, delivering trainings, presentations. And in this website, there is a huge amount of videos that we recorded and articles about cybersecurity. And that is also a really nice step to reach us because that could be through getting knowledge simply. And we are sitting behind it, yes? So, there is . . . well, my email is very simple: It's Paula@Cqure.pl, and I'm also on Twitter @PaulaCqure--also very easy. Also easy to find me on Facebook or LinkedIn. So, in the current time, especially when we have to work remotely, you have to stay connected. So, it is actually very easy to find us. [Paula laughing]


STEPHEN ROSE: Awesome. It is so great to see you. I'm sorry we weren't able to connect this year at ignite because I'm missing you and Gregors and everybody else, but it is wonderful. I really appreciate you joining us. I know how busy you are. I know that you, because you can be virtual, can do two or even three conferences at the same time, and you are. So, thanks again for joining us. Stay well. And everybody, check out Paula's information. It's absolutely tremendous. And thank you again for being on the show today.


PAULA JANUSCZKIEWICZ: Thank you so much.