Jeffrey Engle, Conquest Cyber: “transfer some risk where you can but know that you own your outcome”

Today’s business landscape is plagued with uncertainties about the level of cybersecurity needed to protect the organization’s most precious assets.

As enterprises are trying to protect their workforce and information from cybercriminals, many turn to think about encrypting their online traffic and making password sharing protected. The good news is that cybersecurity software companies, such as Conquest Cyber, are continuously assessing these vulnerabilities and deploying solutions that enable you to take a proactive approach to safeguarding sensitive data.

We’ve reached out to Jeffrey Engle, Chairman and President of Conquest Cyber, to discuss the current state of cybersecurity, new emerging threats, and essential digital hygiene practices.

Let’s go back to the early days of Conquest. How did the idea of this project come about, and what has your journey been like since?

I was running the federal business unit for our then-parent company and working closely with one of the major public cloud providers. In my discussions and engagements, I kept coming across the same issue: decision-makers did not have the data or context to be able to make informed decisions about the selection, implementation, management, and monitoring of their systems, networks, and data. Essentially, they were flying blind and having to take people's word for fact. Unfortunately, those resources were overwhelmed and disconnected from their peers while simultaneously working in an era where technology innovation works faster than they can keep up. The dots need to be connected and the context provided so cyber resiliency could be possible.

It has been an interesting ride. We have been finding pockets of leaders, operators, and industry partners that get the need to bi-directionally connect risk and operations. When we uncover them, it is exciting and motivating for the whole team – we go all into partnering with them in our innovations. There have also been pockets of people and organizations that have a fixed mindset around their approach and don’t want to connect auditors, CIOs, operational practitioners, blue teamers, etc., towards a common and transparent outcome. My sense is that we will be coming across more of the former and less of the latter as adaptive security, integrated cyber resiliency management, and cyber risk management in general start to mature in their understanding.

Can you tell us a little bit about what you do? Which industries do you mainly work with?

We are an integrated cyber resiliency platform company. We enable business outcomes, ensure they have the appropriate security technologies in place, and then integrate our platforms ARMED™ and SCyOps™ to drive continuous Compliance, Maturity, and Effectiveness in our client’s technology ecosystem by connecting risk and operations. Our market is US critical infrastructure organizations and government. Essentially, any organization that performs a National Critical Function needs cyber resiliency, or our way of life will suffer, so that is what we exist to protect.

You mention that nowadays, cyberattacks are often carried out by state-sponsored threat actors rather than amateur hackers. Could you briefly explain what these government-backed attacks look like?

Government-sponsored attacks come with an agenda. They are focused and sophisticated. We have seen China shut down the power grid in India and Russia perform complex attacks on Ukrainian infrastructure. These are overt. For our customer base, however, I am more concerned about the cicada approach. Gaining access for long durations with the ability at any time to take action to advance a geopolitical agenda or to link it with other damaging efforts to our way of life. We have discovered some of those efforts in the past year with SolarWinds and Microsoft Exchange Server, but the extent of compromise likely extends much further than what was discovered and the effort to gain access hasn’t slowed down.

Did you notice any new threats arise during the pandemic? Were there any new features added to Conquest as a result?

Perhaps, newly discovered threats and new ways for those threats to exploit their targets due to the change in the way people work. We had major developments in the attack surface management and extended detection and response capabilities within our products to enable adaptation to those changes so we can maintain a competitive edge with our customers and partners.

Which threats are we going to see more of in 2022?

I guess that depends on the vantage point. We will likely see more APT attacks, but the public will undoubtedly hear about more and more ransomware events. I am seeing a trend toward more effort in sharing data between government and industry, as well as more embracing of industry data by the government.

With more companies adopting work from home policies, what issues can arise if the organizational security system is faulty or not in place at all?

The compromise of personal systems is high. Gaming and other personal activities expose individual users and their systems to a broad threat landscape. The basic concepts of cyber resiliency are what is on your network, who is on your network, what is happening on your network, and where your sensitive data becomes impossible to meet. Imagine a minefield that is the technology ecosystem. With an effective cyber resiliency program, you take a system to probe and mark that minefield so your users can move through it at the speed of business. In WFH, without an effective program, it’s like sending your users running through that minefield without a guide. Sure, some or all may make it but not likely for long.

The number of organizations affected by cyberattacks grows exponentially. And yet, certain organizations act only after an incident occurs. Why do you think people turn a blind eye when it comes to online security?

I don’t think most organizations know where to start. Even the best practitioners need a team, reinforcement, and support. Some know where they want to be. Some know where they are. Very few know how to get there. The cyber industry doesn’t help with everything sounding the same, and very few technologies are well understood by all the key players in a cyber program, e.g., board, C-Suite, CIO, CISO, help desk.

In your opinion, which cybersecurity practices are a must these days, especially for personal use?

It’s easy to say MFA, strong passwords, updated AV, hover over links, be hesitant to click, etc. Unfortunately, none of those are going to save you forever. If you want to be personally cyber resilient, then you need to track the best practices of the day and thoughtfully implement them in your everyday life. Transfer some risk where you can but know that you own your outcome.

Would you like to share what’s next for Conquest Cyber?

There are a lot of exciting things coming. We have been talking about adaptive risk management and cyber resiliency for years, and we are starting to see it become part of the dialogue across our market sectors. As a special operations-led organization, we will continue to innovate, force multiply, and work diligently to build cyber resiliency across more of the critical infrastructure sectors and protect the national critical functions they perform.