A transcript of a discussion on how comprehensive cloud security solutions need to go beyond on-premises threat detection and remediation to significantly strengthen extended digital business workflows.

1. Page 1 of 11
How to Gain Advanced Cyber
Resilience and Recovery
Across Digital Business Workflows
A transcript of a discussion on how comprehensive cloud security solutions need to go beyond
on-premises threat detection and remediation to significantly strengthen extended digital business
workflows.
Listen to the podcast. Find it on iTunes. Download the transcript. Sponsor: Unisys and
ServiceNow.
Dana Gardner: Hi, this is Dana Gardner, Principal Analyst at Interarbor Solutions and
you’re listening to BriefingsDirect.
Cyber attacks are on the rise, harming brands and supply chains while fomenting
consumer and employee distrust -- as well as leading to costly interruptions and service
blackouts.
At the same time, more remote workers and extended-enterprise processes due to the
pandemic demand higher levels of security across all kinds of business workflows.
Stay with us now as we explore why comprehensive cloud security solutions need to go
beyond on-premises threat detection and remediation to significantly strengthen
extended digital business workflows.
To learn more about ways to shrink the attack surface and
dynamically isolate process security breaches, please join
me now in welcoming Karl Klaessig, Director of Product
Marketing for Security Operations, at ServiceNow.
Welcome, Karl.
Karl Klaessig: Thank you so much.
Gardner: We’re also here with E.G. Pearson, Security
Architect at Unisys. Welcome, E.G.
E.G. Pearson: Thank you. I’m happy to be here.
Gardner: Karl, why are digital workflows so essential now for modern enterprises, and
why are better security solutions needed to strengthen digital businesses?
Klaessig: Dana, you touched on cyber attacks being on the rise. It’s a really scary time
if you think about MGM Resorts and some of the really big attacks in 2020 that took us
Klaessig

2. Page 2 of 11
all by surprise. And 23 percent of consumers have had their email or social media
accounts hacked, taken over, or used. These are all huge threats to our everyday life as
businesses and consumers.
And when we look at so many of us now working from home, this huge new attack
surface space is going to continue. In a recent Gartner chief financial officer (CFO)
survey, 74 percent of companies have the intent to shift employees to work from home
(WFH) permanently.
These are huge numbers indicating a mad dash to build and scale remote worker
infrastructures. At the end of the day, the teams that E.G. and I represent, as vendors,
we strive hard to support these businesses as they seek to scale and address an
explosive impact for cyber resilience and cyber operations in their enterprises.
Gardner: E.G., we have these new, rapidly evolving adoption patterns around extended
digital businesses and workflows. Do the IT and security personnel, who perhaps cut
their teeth in legacy security requirements, need to think differently? Do they have
different security requirements now?
IT requirements rise with increased cyber attacks
Pearson: As someone who did cut their teeth in the
legacy parts, I say, “Yes,” because things are new.
Things are different.
The legacy IT world was all about protecting what they
know about, and it’s hard to change. The new world is
all about automation, right? It impacts everything we
want to do and everything that we can do. Why wouldn’t
we try to make our jobs as simple and easy as
possible?
When I first got into IT, one of my friends told me that
the easiest thing you can do is script everything that
you possibly can, just to make your life simpler.
Nowadays, with the way digital workflows are going, it’s not just automating the simple
things -- now we’re able to easily to automate the complex ones, too. We’re making it so
anybody can jump in and get this automation going as quickly as possible.
Gardner: Karl, now that we’re dealing with extended digital workflows and expanded
workplaces, how has the security challenge changed? What are we up against?
Klaessig: The security challenge has changed dramatically. What’s the impact of
Internet of things (IoT) and edge computing? We’ve essentially created a much larger
attack surface area, right?
Pearson

3. Page 3 of 11
What’s changed in a very positive way is that this expanded surface has driven
automation and the capability to not only secure workflows but to collaborate on those
workflows.
We have to have the capability to quickly detect, respond, and remediate. Let’s be
honest, we need automated security for all of the remote solutions now being utilized –
virtually overnight – by hundreds of thousands of people. Automation is going to be the
driver. It’s what’s really rises to the top to help in this.
Gardner: E.G., one of the good things with the modern IT landscape is that we can do
remote access for security in ways that we couldn’t before. So, for IoT, as Karl
mentioned, we’re talking about branch offices -- not just sensors or machines.
We increasingly have a very distributed environment, and we can get in there with our
security teams in a virtual sense. We have automation, but we also have the virtual
capability to reach just about everywhere.
Pearson: Nowadays, IoT is huge. Operational
technology (OT) is huge. Data is huge. Take your
pick, it’s all massive in scope nowadays. Branch
offices? Nowadays, all of us are our own branch
office sitting at our homes.
Now, everybody is a field employee. The world changed overnight. And the biggest
concern is how do we protect every branch office and every individual who’s out there? It
used to be simpler, you used to create a site-to-site virtual private network (VPN) or you
had communications that could be easily taken care of.
Now the communication is open to everybody because your kids want to watch Disney
in the living room while you’re trying to work in your office while your wife is doing work
for her job three rooms down. The world is different.
The networks that we have to work through are different. Now, instead of trying to
protect an all-encompassing environment, it’s about moving to more individual or
granular levels of security, of protecting individual endpoints or systems.
I now have smart thermostats and a smart doorbell. I don’t want anybody attaching to
those. I don’t need somebody talking to my kids through those things. In the same vein, I
don’t need somebody attaching to my company’s OT environment and doing something
silly inside of there. So, in my opinion, it’s less about the overarching IT environment,
and more about how to protect the individuals.
Gardner: To protect all of those vulnerable individuals then, what are the new solutions?
How are the Unisys Stealth and ServiceNow Platform coming together to help solve
these issues?
Branch offices? Nowadays,
all of us are our own branch
office sitting at our homes.

4. Page 4 of 11
Collaborate to protect the individual, right away
Klaessig: Well, there are a couple of areas I’ll touch on. One is that Unisys has an
uncanny capability to do isolation and initially contain a breach or threat. That is
absolutely paramount for our customers. We need to get a very quick handle on how to
investigate and respond. Our teams are all struggling to scale faster and faster with
higher volume. So, every minute bought is a huge minute gained. Right out of the gate,
between Unisys and ServiceNow, that buys us time -- and every second counts. It’s
invaluable.
Another thing that's driving our solutions are the better ties between IT and security;
there’s much more collaboration. For a long time they tended to be in separate towers,
so to speak. But the codependences and collaborative drivers between Unisys and
ServiceNow mean that those groups are so much more effective. The IT and security
teams collaborate thanks to the things we do in the workloads and the automation
between both of our solutions. It becomes extremely efficient and effective.
Gardner: E.G., why is your technology, Unisys Stealth for Dynamic Isolation a good fit
with ServiceNow? Why is that a powerful part of this automation drive?
Pearson: The nice part about dynamic isolation is it’s just a piece of what we can do as
a whole with Unisys Stealth. Our Stealth core product is doing identity-based
microsegmentation. And, by nature, it flows into software-defined networking, and it's
based on a zero trust model.
The reason that's important is, in software-
defined networking, we're gathering tons of
information about what's happening across
your network. So, in addition to what’s
happening at the perimeter with firewalls, you
are able to get really good, granular information about what's happening inside of your
environment, too.
We're able to gather that and send all of that fantastic information over the ServiceNow
Platform to your source, whatever it may be. ServiceNow is a fantastic jumping point for
us to be able to get all that information into what would have been separate systems.
Now they can all talk together through the ServiceNow Platform.
Klaessig: To add to that, this partnership solves the issues around security data volume
so you can prioritize accurately because you’re not inundated. E.G. just described the
perfect scenario, which is that the right data gets into the right solution to enable
effective assessment and understanding to make prioritizations on threat responses and
threat actions based on business impact.
That huge but managed amount of data that comes in is invaluable. It’s what drives
everything to get to prioritizing the right incidents.
In software-defined networking,
we’re gathering tons of
information about what’s
happening across your network.

5. Page 5 of 11
Gardner: The way you're describing how the solutions work together, it sounds like the
IT people can get better awareness about security priorities. And the security people can
perhaps get insights into making sure that the business-wide processes remain safe.
Critical care for large communities, step by step
Klaessig: You’re absolutely right because the continuous threat prioritization and
breach protection means that the protective measures have to go through both IT and
security. That collaboration and automation enables not just the operational resilience
that IT is driving for, but also the cyber resilience that the security teams want. It is a
handshake.
That shared data and workloads are part of security but they reflect actual IT processes,
and vice versa. It makes both more effective.
Gardner: E.G., anything more to offer on this idea of roles, automation, and how your
products come together?
Pearson: I wholeheartedly agree with Karl. IT and security can’t be siloed anymore.
They can't be separate organizations.
IT relies on what security operations puts in
play, and security operations can't do anything
unless IT mitigates what security finds. So
they can’t act individually anymore. Otherwise,
it’s like telling a football player to lace up their
ice skates and go score a couple of goals.
Gardner: As we use microsegmentation and zero trust to attend to individual devices
and users, can we provide a safer environment for sets of users or applications?
Pearson: Yes, we have to do this in smaller and smaller groups. It’s about being able to
understand what those communities need and how to dynamically protect them.
As we adjust to the pandemic and the humungous security breaches like we found at the
end of 2020, protecting large communities can't be done as easily. It’s so much easier to
break those down into smaller chunks that can be best protected.
Klaessig: It’s also around protecting best based on the applications. I think that has a
big impact because you can say, “Hey, these are the applications critical for our
customers and our organization.” Therefore, anyone who has access to those, we
monitor that much more closely, or they are automatically prioritized at the top of the
queue if there's an incident.
[IT and security] can’t act
individually anymore. Otherwise,
it’s like telling a football player to
lace up their ice skates and go
score a couple of goals.

6. Page 6 of 11
We can group things out based on use and the impact to the business. And again, this
all contributes to the prioritization and the response when we coordinate between the
two solutions, Unisys and ServiceNow.
Gardner: So it’s an identity-driven model but on steroids. It's not just individual people.
It's critical groups.
Klaessig: Well said.
Pearson: Yes.
Gardner: How can people consume this, whether you’re in IT, security personnel, or
even an end user? If you're trying to protect yourself, how do you avail yourself of what
ServiceNow and Unisys have put together?
Speed impedes bad-to-worse scenario
Klaessig: The key is we target enterprises. That's where we work together and that's
where ServiceNow workflows go. But to your point, nowadays I'm essentially a lone, solo
office person, right? With that in mind, we need to remember those new best practices.
The appropriate workflows and processes within our collective solutions must reflect the
actual individual users and processes. It goes back to our comments a couple of minutes
ago, which is what do you use most? How often do you use it? When do you use it, and
how critical is it? Also, who else is involved?
That’s something we haven’t touched on up until now -- who else will be impacted? At
the end of the day, what is the impact? In other words, if someone just had a credential
stolen, I need the quick isolation from Unisys based on the areas of IT impacted. I can
do that in ServiceNow, and then the appropriate response puts a workflow out and it’s
automated into IT and security. That’s critical. And that’s the starting point for the other
processes and workflows.
Gardner: We now need to consider what happens when you inevitably face some
security issues. How does the ServiceNow Security Incident Response Platform and
Unisys Stealth come together to help isolate, reduce, and stifle a threat rapidly?
Pearson: The reason such speed is important is
that many of you all have already been impacted
by ransomware. How many of you all have
actually seen what ransomware will do if left
unchecked for even just 30 minutes inside of a
network? It’s horrible. That to me, that is your
biggest need.
Speed is important [because
of] … what ransomware will do
if left unchecked for even just
30 minutes inside of a network.
It’s horrible.

7. Page 7 of 11
Whether it is just a regular end-user or if it’s a full-scale, enterprise-level-type workflow,
speed is a huge reason that we need a solution to work and to work well. You have to be
fast to keep bad things from going really, really wrong.
One of the biggest reasons we have come together with Stealth doing
microsegmentation and building small communities and protecting them is to watch the
flow of what happens with whom across ports and protocols because it is identity based.
Who’s trying to access certain systems? We’re able to watch those things.
As we’re seeing that information, we’re able to say if something bad is happening on a
specific system. We’re able to show that weird or bad traffic flow is occurring, send that
to ServiceNow and allow the automated operations to protect an end point or a server.
Because the process is automated, it brings the response down to less than 10 seconds,
using automated workflows within ServiceNow. With dynamic isolation, we’re able to
isolate that specific system and cut if off from doing anything else bad within a larger
network.
That’s huge. That gives us the capability to take on something fast that could bring down
an entire system. I have seen ransomware go 30 minutes unchecked, and it will
completely ravage an entire file server, which brings down an entire company for three
days until everything can be brought back up from the backups. Nobody has time for
that. Nobody has time for the 30 minutes it took to do something silly to cost you three
days of extra work, not to mention what else may come from that.
With our combined capabilities, Unisys
Stealth provides the information we’re
able send to the ServiceNow platform to
have protection put in place to isolate and
start to remediate within 10 seconds.
That’s best for everybody because 10
seconds worth of damage is a whole lot
easier to mitigate than 30 minutes’ worth.
Klaessig: Really well-said, E.G.
Gardner: I can see why 2+2=6 when it comes to putting your solutions together.
ServiceNow gets the information from Stealth that something is wrong, but then you
could put the best of what you do together to work.
Resolve to scale teams, skills, with automation
Klaessig: We do. And this leads us to do even more automation. How can you get to
that discovery point faster, and what does that mean to resolve the problem?
With our combined capabilities,
Unisys Stealth provides the
information we’re able to send to the
ServiceNow platform to have
protection in place to isolate and start
to remediate within 10 seconds.

8. Page 8 of 11
And there’s another angle to this. Our listeners and readers are probably saying, “I know
we need to respond quickly, and, yes, you’re enabling me to do so. And, yes, you’re
enabling me to isolate and do some orchestration that ties things up to buy me time. But
how do I scale the teams that are already buried beyond belief today to go ahead and
address that?”
That’s a bit overwhelming. And here’s another added wrinkle. E.G. mentioned
ransomware, and the scary part is in 2020 ransomware was paid 50 percent of the time
versus one-third of the time in 2019. Even putting aside the pandemic and natural
disasters, this is what our teams our facing.
It again goes back to what you heard E.G. and I touch on, which is automation of
security and IT is what’s critical here. Not only can you respond consistently quicker, but
you’ll be able to scale your teams and skills -- and that’s where the automation further
kicks in.
In other words, businesses can take on
this type of volume around security
management with the teams they have in
place today. That’s why automation is so
critical. Comprehensive tooling increases
detection on the Unisys side, and that
gives them not only more time to respond
but allows them to be more effective as well. As attacks escalate, they can’t just go
ahead and add more people in time, right? This is where they need that automation to
be able to scale with what they have.
It really pays off. We’ve seen customers benefit from a dollars and cents prospective,
where they saw a 74 percent improvement in time-to-identify. And now 46 percent of
their incidents are handled by automation, saving more than 8,700 hours annually for
their teams. Just wrap your head around that. I mean, that’s just a huge advantage from
putting these pieces together and automating and orchestration like E.G. has been
talking about.
Gardner: Is it too soon, Karl, to talk about bots and more automation where the
automation is a bit more proactive? What’s going to happen when the data and the
speed get even more useful, but more compressed when it comes to the response time?
How smart are these systems going to get?
AI, ML, get the right people to do the right thing
Klaessig: The reality is, we’re already going there. When you think of machine learning
(ML) and artificial intelligence (AI), we’re already doing a certain amount of that in the
products.
As attacks escalate, [businesses]
can’t just go ahead and add more
people in time, right? This is where
they need that automation to be able
to scale with what they have.

9. Page 9 of 11
As we leverage more of the great data from Unisys, it drives who can resolve those
vulnerabilities because they have a predetermined history of dealing with those types of
vulnerabilities. That’s just an example of being able to use ML to align the right people to
the right resolution. Because, at the end of the day, it still comes down to certain people
doing certain things and it always will. But we can use that ML and AI to put those
together very quickly, very accurately, and very efficiently. So, again, it takes that time to
respond down to seconds, as E.G. mentioned.
Gardner: Are we going to get to a point where we simply say, “J.A.R.V.I.S., clean up the
network”?
Pearson: I hope so! Going back to my old days of being an admin, I was an extremely
lazy admin. If I could have just said, “J.A.R.V.I.S., remediate my servers,” I would have
been all over it.
I don’t think there’s any way we can’t move toward more automation and ML. I don’t
necessarily want us to get to the point where Skynet is not going to delete the virus,
saying, “I am the virus.” We don’t need that.
But being able to automate helps overcome the mundane, such as resetting somebody’s
password and being able to pull a system offline that’s experiencing some sort of weird
whatever it may be. Automating those types of things helps everybody go faster through
their day because if you’re working a helpdesk, you’ve already gotten 19 people with
their hair on fire begging for your attention.
If you could cut off five of those people by automating and very easily allowing some AI
to do the work for you, why wouldn’t you? I think their time is more valuable than the few
dollars it’s going to cost to automate those processes.
Klaessig: That's going to be the secret to success
in 2021 and going forward. You can scale, and the
way you're going to scale is to take out those
mundane tasks and automate all of those different
things that can be automated.
As I mentioned, 46 percent of the security incidents became automated for our
customer. That's a huge advantage. And at the end of the day, putting J.A.R.V.I.S.
aside, the more ML we can get into it, the better and more repeatable the processes and
the workflows will be -- and that much faster. That's ultimately what we're driving toward
as well.
Gardner: Now that we understand the context of the problem, the challenges
organizations face, and how these solutions come together, I'm curious at how this
actually gets embedded into organizations? Is this something that security people do,
that the IT people do, that the helpdesk people do? Is it all of the above?
You can scale, and the way
you’re going to scale is to
take out those mundane
tasks and automate.

10. Page 10 of 11
Everybody has a role in order to reap benefits
Pearson: The way we usually get this going is there needs to be buy-in from everybody
because it's going to touch a lot of folks. I'm willing to bet Karl's going to say similar
things. It's nice to have everybody involved and to have everybody's buy-in on this.
It usually starts for us at Unisys with what we're doing with microsegmentation and with a
networking and security group. They need to talk to be able to get this rolled out. We
also need the general IT folks because they're going to have to install and get this rolled
out to endpoints. And we need the server admins involved as well.
When it comes down to it, everybody's going to have to be involved a little bit. But it
generally starts with the security folks and the networking folks, saying, “How can I
protect my environment just a little bit more than I was before?” And then it rolls from
there.
Klaessig: I agree. At the end of the day,
this goes back being a collaborative
opportunity. In other words, when we look
at this, this is the opportunity for IT and
security to join together. These solutions
really benefit both teams. And oftentimes, it actually can piggyback on investments
they've already made elsewhere.
And that's a big advantage as well. Going forward, I strongly believe in -- and I've seen
the results of this -- being a driver toward greater collaboration. It is that type of
deployment and should be done in that manner. And then quite frankly, both
organizations reap the benefits.
Pearson: Wholeheartedly.
Gardner: I'm afraid we'll have to leave it there. You've been listening to a sponsored
BriefingsDirect discussion on how comprehensive cloud security solutions need to go
beyond on-premises threat detection to significantly strengthen critical digital business
services.
And we've learned how a joint-solution between Unisys and ServiceNow shrinks the
attack surface, dynamically and rapidly isolating today's extended enterprise security
threats.
Please join me in thanking our guests, Karl Klaessig, Director of Product Marketing for
Security Operations, at ServiceNow. Thanks so much, Karl.
Klaessig: Thank you, it was a pleasure.
This is the opportunity for IT and
security to join together. These
solutions really benefit both teams.

11. Page 11 of 11
Gardner: And we've also been here with E.G. Pearson, Security Architect at Unisys.
Thanks so much, E.G.
Pearson: Thanks, Dana.
Gardner: And a big thank you as well to our audience for joining this BriefingsDirect
cybersecurity innovation discussion. I'm Dana Gardner, Principal Analyst at Interarbor
Solutions, your host throughout this series of Unisys- and ServiceNow-sponsored
BriefingsDirect discussions.
Thanks again for listening. Please pass this along to your IT community, and do come
back next time.
Listen to the podcast. Find it on iTunes. Download the transcript. Sponsor: Unisys and
ServiceNow.
A transcript of a discussion on how comprehensive cloud security solutions need to go beyond
on-premises threat detection and remediation to significantly strengthen extended digital business
workflows. Copyright Interarbor Solutions, LLC, 2005-2021. All rights reserved.
You may also be interested in:
• The future of work is happening now thanks to Digital Workplace Services
• How Unisys ClearPath mainframe apps now seamlessly transition to Azure Cloud without
code changes
• How security designed with cloud migrations in mind improves an enterprise’s risk
posture top to bottom
• How Unisys and Microsoft team up to ease complex cloud adoption for governments and
enterprises
• How Unisys and Dell EMC head off backup storage cyber security vulnerabilities
• How Agile Enterprise Architecture Builds Agile Business Advantage
• How an agile focus for Enterprise Architects builds competitive advantage for digital
transformation
• The Open Group digital practitioner effort eases the people path to digital business
transformation