Day in the Life: Josh Morris, SVP of Global Sales

Josh Morris, our Senior Vice President of Global Sales, joined Torq earlier this year in February. Josh has worked for several industry-leading cybersecurity organizations throughout his career, and most recently served as Group Vice President at Splunk. From hyperautomation to home life, Josh shares how he finds balance in his day. 

What’s your morning routine? 

My alarm goes off bright and early at 5am ET. Ideally, my day starts with weightlifting at the gym. After that, I head home to prepare for calls with our headquarters in Tel Aviv. Even though each day is different, my mornings always consist of meetings. In addition to customer and partner meetings, I have 1-on-1s with my team early in the week. It’s important to me to meet with my team weekly to make sure everyone is excelling professionally. Not to mention, it gives us time to get in our virtual “water cooler talk” as well. 

What happens once you finish your morning meetings? 

A- I usually skip breakfast, so after my first round of meetings I grab a bite to eat. Then, I lock in for another block of meetings. There are a lot of exciting new initiatives in the pipeline. It’s been all hands on deck with our BDR team, our new channel team, and our go-to-market team to bring new innovations to life. 

It’s lunch time! What’s your go-to? 

BBQ is hands-down my favorite meal. A little-known fact about our employees at Torq is that a lot of us are passionate about BBQ. In fact, our Co-Founder and CTO, Leonid Belkind made a Slack channel called “Smoking and Grilling Meats.” If I have leftovers from the night before, I’ll throw them in my Sous Vide at approximately 95 degrees to prevent overcooking. 

What are things you do to give yourself a competitive edge?  

A non-negotiable for me during the week is to block time on my calendar to be what I call a “student of the game.” This time is dedicated to learning and personal development. It could be about learning more about our competition, or bettering myself on leadership, learning, and positive thinking. I also block out time to ensure I’m reaching out or following up with our customers, prospects, and partners to stay connected.

How do you find balance in your life?  

Achieving balance in my life has come with being disciplined with time management. I’m very disciplined with my calendar and efficient with my day, so that I can be present with my family in the evening.

Do you have any productivity hacks or favorite apps for work

Two things that help me with my productivity are note taking and writing to-do lists. I find it very satisfying to cross stuff off on paper, as opposed to keeping a digital checklist. My favorite app is Grammarly. It’ll highlight your mistakes as you go, which I find very helpful.

What are some things you enjoy as a family? 

As a family of six, we’re always on the go. Just like work, every day is different for my family. Last night my daughter had a lacrosse game at 9:40pm, so we were there late supporting her. As a family, we love spending time outdoors together,  we enjoy going boating or fishing. We went fishing before the 4th of July and caught a bunch of porgies. We caught them, fileted them, and threw them on the BBQ. My idea of the perfect meal. 

SEE TORQ IN ACTION

Ready to automate everything?

“Torq takes the vision that’s in your head and actually puts it on paper and into practice.”

Corey Kaemming, Senior Director of InfoSec

“Torq HyperSOC offers unprecedented protection and drives extraordinary efficiency for RSM and our customers.”

Todd Willoughby, Director

Compuquip logo in white

“Torq saves hundreds of hours a month on analysis. Alert fatigue is a thing of the past.”

Phillip Tarrant, SOC Technical Manager

Fiverr logo in black

“The only limit Torq has is people’s imaginations.”

Gai Hanochi, VP Business Technologies

Carvana logo in black

“Torq Agentic AI now handles 100% of Carvana’s Tier-1 security alerts.”

Dina Mathers, CISO

Riskified logo in white

“Torq has transformed efficiency for all five of my security teams and enabled them to focus on much more high-value strategic work.”

Yossi Yeshua, CISO

CircleCI Breach: How to Rotate All Stored Secrets ASAP

The Incident

Yesterday, CircleCI, a Continuous Integration/Continuous Delivery (CI/CD) service, notified the world it had been breached via a critical advisory from its CTO. As a major software delivery pipeline service, CircleCI users store myriad credentials for various services in CircleCI’s “Secrets Store” infrastructure. A clear recommendation from their advisory is to “Immediately rotate any and all secrets stored in CircleCI.”

“Rotating a secret” refers to disabling and resetting it in the original system, then deleting it from CircleCI, and then allocating a new one with the same permissions, and putting it in CircleCI again. The latter element is critical to ensure pipelines keep working. However, doing this at scale is challenging. 

Torq has a highly-effective and straightforward solution to the issue, and will provide any organization that isn’t currently a customer a free account, and architect advice, to automate rotating secrets ASAP, with no further commitment.

How Torq Can Help

1. Immediately Rotate Any and All Secrets Stored in CircleCI

Torq can assist in immediately rotating all secrets rapidly and efficiently by accessing the secrets stored in CircleCI in project environment variables or in contexts. With Torq, organizations that use CircleCI can immediately retrieve all existing secrets, classify them, identify their owners, and ensure tight and fast follow-up on rotating each of them.

Torq has built and tested a highly-effective workflow that connects to the organizational CircleCI environment, retrieves all relevant secrets, together with their creation/usage dates, and continues following up by:

  • Finding the owners and notifying them via email, Slack, and/or Microsoft Teams
  • Rotating all keys
  • Creating reports and updating status via desired communication methods

2. Review Internal Logs for Unauthorized Access

CircleCI recommends customers review internal logs for their systems for any unauthorized access starting from December 21, 2022, through to January 4, 2023, or upon completion of their secrets rotation.

Torq can help break down the difficult task of identifying any unauthorized access into actionable and automated steps to save tremendous security analyst time, reduce mean time to response time (MTTR), and reduce any potential exposure due to unauthorized key usage.

Reviewing access logs is a procedure that is highly dependent on the type of infrastructure hosting the deliverables of CircleCI pipelines. Torq’s flexible out-of-the-box integrations can allow rapid building of automations that access logs on any infrastructure, such as (but not limited to):

  • Amazon Web Services
  • Google Cloud Platform
  • Microsoft Azure
  • Kubernetes clusters
  • Github/Gitlab/Atlassian Bitbucket accounts
  • “Artifactory” services
  • Platform-as-a-Service solutions (such as Heroku)
  • Infrastructure-as-Code services such as HashiCorp Terraform Cloud

As a concrete example, Torq automation can be used to ensure a full match between the artifacts repository and the software pipeline. Here is how an automation like that would work:

  1. Torq can pull a list of container images from your Artifactory
  2. For every image, Torq verifies via GitHub or another repository, the existence of a matching (time/content) commit, and flags all the gaps to orchestrate specific follow-up

Torq is Architected with a Zero Trust Approach

Torq, as a security automation and integration platform, can also carry a significant amount of credentials for various corporate systems. To mitigate risks like this incident, Torq has proactively deployed these critical architectural elements:

  • Torq’s secrets store is implemented using a cloud-based Hardware Security Module (Cloud HSM), to reduce the risk of a mass breach
  • Torq provides a full API allowing its users to rotate secrets as part of a regular routine, all included in the core product
  • Torq integrates with all major customer-hosted secret stores, such as HashiCorp Vault, Britive, Akeyless, AWS KMS, Google Cloud Key Management, Azure Key Vault, and many more
  • Torq enables using roles and workload identities to authenticate operations instead of using credentials where possible.

Begin Rotating Your CircleCI Keys Today 

CircleCI integration, as well as associated workflow templates, are available to Torq users, today. Find them in the workflow designer and template libraries, respectively. Users can also contact their customer service manager for a demo and walkthrough.

Not using Torq yet? Get in touch to handle this issue at no cost, and see how Torq security automation accelerates security operations to deliver unparalleled protection. 

CircleCI Demo Templates

If you’re already ready to go, we’ve prepared two workflow templates that utilize and demonstrate the power of Parallel Loop. Torq users can begin deploying them right away. 

SEE TORQ IN ACTION

Ready to automate everything?

“Torq takes the vision that’s in your head and actually puts it on paper and into practice.”

Corey Kaemming, Senior Director of InfoSec

“Torq HyperSOC offers unprecedented protection and drives extraordinary efficiency for RSM and our customers.”

Todd Willoughby, Director

Compuquip logo in white

“Torq saves hundreds of hours a month on analysis. Alert fatigue is a thing of the past.”

Phillip Tarrant, SOC Technical Manager

Fiverr logo in black

“The only limit Torq has is people’s imaginations.”

Gai Hanochi, VP Business Technologies

Carvana logo in black

“Torq Agentic AI now handles 100% of Carvana’s Tier-1 security alerts.”

Dina Mathers, CISO

Riskified logo in white

“Torq has transformed efficiency for all five of my security teams and enabled them to focus on much more high-value strategic work.”

Yossi Yeshua, CISO

Jason Chan on How Torq Overcomes Cybersecurity’s Biggest Challenges

Jason Chan is one of the world’s foremost cybersecurity authorities and we’re extremely proud to have him as a member of the Torq Advisory Board. He’s a pivotal figure in driving adoption of security automation best practices at many companies, including Netflix, where he led the information security organization.

In our third and final Chan video series, he discusses one of the most important challenges in cybersecurity: making cyberthreat identification, management, and remediation as simple as possible for professionals of all backgrounds and technical abilities.

Chan advocates for getting more people involved in cybersecurity and promoting the concept of interoperability across the security stack. He discusses how Torq reduces the barriers for entry into the world of security automation, and why as a result, it’s a force multiplier for practitioners to deliver the strongest security posture possible and move faster than ever to deliver maximum impact.

Watch the video below and learn more about Chan’s perspectives on Torq:

Take Action Today
Learn how to get started with security automation by reaching out to the professionals at Torq. You’ll learn more about the Torq platform and how we’ve helped myriad organizations achieve and exceed their security goals.

SEE TORQ IN ACTION

Ready to automate everything?

“Torq takes the vision that’s in your head and actually puts it on paper and into practice.”

Corey Kaemming, Senior Director of InfoSec

“Torq HyperSOC offers unprecedented protection and drives extraordinary efficiency for RSM and our customers.”

Todd Willoughby, Director

Compuquip logo in white

“Torq saves hundreds of hours a month on analysis. Alert fatigue is a thing of the past.”

Phillip Tarrant, SOC Technical Manager

Fiverr logo in black

“The only limit Torq has is people’s imaginations.”

Gai Hanochi, VP Business Technologies

Carvana logo in black

“Torq Agentic AI now handles 100% of Carvana’s Tier-1 security alerts.”

Dina Mathers, CISO

Riskified logo in white

“Torq has transformed efficiency for all five of my security teams and enabled them to focus on much more high-value strategic work.”

Yossi Yeshua, CISO

Torq Users Hit 1,000,000+ Daily Security Automations

Security automation is an increasingly critical element in optimizing enterprise cybersecurity postures. Today, Torq announced its users are executing more than 1,000,000 daily security automations using our security automation platform – a major milestone that underlines the traction and importance of unifying today’s complex security stacks. The exponentially-expanding usage of Torq also reflects the current macroeconomic climate, in which security leaders are being asked to maximize the value of their existing security infrastructure, as well as ensure staff are focused on higher-level management and critical incident response.

Torq’s modern security automation approach is helping security teams address these priorities, allowing teams of any size to quickly create, deploy, and iterate on automated responses to otherwise-unpredictable events.

Introducing Torq Insights

A key element of the Torq platform is our latest innovation: Torq Insights. It’s a comprehensive reporting and analytics overlay that provides the operational data needed to consistently manage, monitor, and iteratively evolve the security automation stack, to ensure it’s providing maximum protection while driving optimal efficiency.

From Automated Processes to Automation Programs

First-generation SOARs were introduced to the market as a way to add repeatability and predictability to security operations. While powerful, these platforms are difficult to deploy and generally designed only for a few threat response use cases. The need for more effective security automation remained.

Recognizing the gap between SOAR platforms and the need for more universal security automation, solution providers have begun to offer limited automation functionality within their platforms. The result is still piecemeal automation, only exacerbated by disparate approaches and processes. 

While there may be more automation than ever, Torq believes quality and efficiency has suffered. To truly realize the benefits of security automation, Torq closes these gaps by consolidating automation efforts, lowering the technical barriers to automated workflows, and now providing the analytical feedback necessary to truly optimize security automation. As a result, our users are benefiting from:

  • Increased predictability of security responses
  • Maximum benefits from the tools they’ve already invested in
  • A clear set of data that helps teams improve overall security efficiency
  • A solution powerful enough for the most complex threat responses, yet easy enough to deploy that it can be used for the smallest of repetitive security tasks

“Torq Insights shows me how actively my team is using the platform to improve our overall security posture and makes everyone’s lives easier and more productive,” said Phillip Tarrant, SOC Technical Manager, Compuquip. “It allows me to see my teammates’ progress with Torq by showing the value they’re getting out of it. The ‘total runs’ analytics capability is huge. It’s amazing to see that Torq is handling 80.8K runs a week for Compuquip without a single hiccup.”

A New Standard for Automation Management

Torq Insights is available to all Torq users. Current users can now simply click on “Insights” above the Workflows page in the app. With Torq Insights, users can instantly find data like total time saved by automated workflows, how many workflows are in production at a given time, and the most active workflows, among other information.

 

Security automation analytics with Torq Insights

Users will soon be able to assess their automation programs against common security frameworks, compare performance and effectiveness of internal use cases, and align to industry best practices, all while integrating with wider business intelligence reporting.

Get Access to Advanced Automation Insights Today

Existing Torq users can use the new dashboard right away. 

If you haven’t had a chance to see the platform in action, get in touch for a free trial account and put Torq to work for your team.

SEE TORQ IN ACTION

Ready to automate everything?

“Torq takes the vision that’s in your head and actually puts it on paper and into practice.”

Corey Kaemming, Senior Director of InfoSec

“Torq HyperSOC offers unprecedented protection and drives extraordinary efficiency for RSM and our customers.”

Todd Willoughby, Director

Compuquip logo in white

“Torq saves hundreds of hours a month on analysis. Alert fatigue is a thing of the past.”

Phillip Tarrant, SOC Technical Manager

Fiverr logo in black

“The only limit Torq has is people’s imaginations.”

Gai Hanochi, VP Business Technologies

Carvana logo in black

“Torq Agentic AI now handles 100% of Carvana’s Tier-1 security alerts.”

Dina Mathers, CISO

Riskified logo in white

“Torq has transformed efficiency for all five of my security teams and enabled them to focus on much more high-value strategic work.”

Yossi Yeshua, CISO

Torq’s No-Code Security Automation Solution Now Available in AWS Marketplace

Torq is proud to announce the immediate general availability of its no-code security solution in AWS Marketplace, the curated digital catalog with thousands of software listings from independent software vendors that make it easy to find, test, buy, and deploy software that runs on Amazon Web Services (AWS).

Torq’s presence on AWS Marketplace streamlines and shortens the procurement process to handle the exponentially-increasing demand for our solution serving Fortune 500 enterprises to fast-growing medium-sized companies and small innovative businesses across every industry vertical.

Our availability on the AWS Marketplace, as well as private offers, provide Torq the flexibility to customize our offering for AWS-based cloud-native customers, while ensuring the smoothest purchase and deployment processes possible. This reduces overhead and complexity for Torq and its customers alike.

A new Forrester Total Economic Impact™ study found that by using AWS Marketplace, organizations experience three key benefits:

  • An improved vendor onboarding process, resulting in a 75% reduction in onboarding efforts for new vendors
  • Reduced time processing invoices, leading to a 66% reduction in time spent due to procurement efficiencies
  • Increased licensing flexibility, leading to a 10% reduction in licensing costs

With Torq in AWS Marketplace, it has never been easier for customers to rapidly access and implement our industry-leading solution to ensure the strongest security posture possible against all cyberthreats.

Learn more and purchase Torq in AWS Marketplace

Visit AWS Marketplace

SEE TORQ IN ACTION

Ready to automate everything?

“Torq takes the vision that’s in your head and actually puts it on paper and into practice.”

Corey Kaemming, Senior Director of InfoSec

“Torq HyperSOC offers unprecedented protection and drives extraordinary efficiency for RSM and our customers.”

Todd Willoughby, Director

Compuquip logo in white

“Torq saves hundreds of hours a month on analysis. Alert fatigue is a thing of the past.”

Phillip Tarrant, SOC Technical Manager

Fiverr logo in black

“The only limit Torq has is people’s imaginations.”

Gai Hanochi, VP Business Technologies

Carvana logo in black

“Torq Agentic AI now handles 100% of Carvana’s Tier-1 security alerts.”

Dina Mathers, CISO

Riskified logo in white

“Torq has transformed efficiency for all five of my security teams and enabled them to focus on much more high-value strategic work.”

Yossi Yeshua, CISO

Torq Announces Advisory Board Featuring Global Cybersecurity Visionaries

Torq is extremely proud to announce the formation of the Torq Advisory Board, a group of some of the world’s most respected cybersecurity professionals, including several industry-leading CISOs and heads of information security. All of our advisors have made major impacts in cybersecurity for their companies, and for the industry at large. They have strongly advocated leveraging cutting edge technologies to drive greater effectiveness and productivity across organizational cybersecurity ecosystems, positively impacting systems, processes, and people.

Our Advisory Board is helping guide Torq as we further expand our Security Automation offerings and capabilities, serve more and more global enterprises, and continue to integrate the majority of cybersecurity systems into our platform.

Members of the Torq Advisory Board include:

Jason Chan, Former VP of Information Security, Netflix

Jason has more than 20 years of experience working in cybersecurity, including adopting security automation, cloud security, and enhancing security in modern software development practices. Jason’s most recent career experience was leading the information security organization at the video streaming behemoth Netflix for more than a decade. His Netflix team set the bar extraordinarily high, focusing on sophisticated risk assessment and management, and compliance management strategies and approaches. 

Talha Tariq, CISO, HashiCorp

In his role at HashiCorp, Talha is responsible for protecting the security of his company, customers, and partners as it provisions, secures, connects, and runs cloud infrastructure for their most important applications. He has 15 years of experience building and scaling security programs from startups to Fortune 100 organizations. Prior to HashiCorp, Talha served as CISO at Anki where he was responsible for corporate information security, product and application security, privacy engineering, security operations, and incident response. Talha also served as Director of Security Consulting at PwC, advising clients across a range of industries on matters related to data breaches, hacking events, security program development, and threat assessments.

Yaron Slutzky, CISO, Agoda

Yaron is responsible for security at Agoda, one of the world’s fastest growing-online travel booking platforms. From its beginnings as an e-commerce start-up based in Singapore in 2005, Agoda has grown to offer a global network of two million properties in more than 200 countries and territories worldwide. It provides travelers with easy access to a wide choice of luxury and budget hotels, apartments, homes, and villas. Headquartered in Singapore, Agoda is part of Booking Holdings and employs more than 4,000 staff in more than 30 countries. Prior to Agoda, Yaron was CISO at Cellcom, and Information Technology Director at Numark Innovations. 

Bill McKinley, CISO, SigFig and former Head of Information Security at The New York Times

Bill serves as CISO for SigFig, an enterprise financial technology firm that develops next-generation products for financial institutions, advisors, and their customers. Through its partnerships with financial institutions including Wells Fargo, UBS, and Citizens Financial, SigFig’s wealth management tool is available to over 70 million consumers. Prior to SigFig, Bill was Head of Information Security at The New York Times, Vice-President of Infrastructure Engineering at AllianceBernstein, and Senior Infrastructure Engineer Team Lead at JP Morgan.

We are also very fortunate to have Stephen Ward, Managing Director at Insight Partners, as part of our board of directors.

At Insight Partners, Stephen focuses on investments in cybersecurity. Prior to joining Insight, Stephen was CISO at The Home Depot, where he provided progressive direction over cybersecurity and technology risk. He is also a Board Member at Mimecast and served on the board of Cloudknox, which was recently sold to Microsoft. His innovative approach has led to malware-related patented technology and he has received award recognition from his industry peers in cybersecurity. Stephen has over 20 years of experience in cybersecurity, physical security, fraud and technology risk acquired throughout his career in both the public sector (U.S. Secret Service) and the private sector (JPMorgan Chase and TIAA).

It’s a real honor and privilege to be working with these cybersecurity luminaries and to have them advise Torq as we further deliver on our incredible potential to customers, partners, and investors. We’re looking forward to further collaboration with them all in the years ahead as we take Torq to even greater heights of success.

SEE TORQ IN ACTION

Ready to automate everything?

“Torq takes the vision that’s in your head and actually puts it on paper and into practice.”

Corey Kaemming, Senior Director of InfoSec

“Torq HyperSOC offers unprecedented protection and drives extraordinary efficiency for RSM and our customers.”

Todd Willoughby, Director

Compuquip logo in white

“Torq saves hundreds of hours a month on analysis. Alert fatigue is a thing of the past.”

Phillip Tarrant, SOC Technical Manager

Fiverr logo in black

“The only limit Torq has is people’s imaginations.”

Gai Hanochi, VP Business Technologies

Carvana logo in black

“Torq Agentic AI now handles 100% of Carvana’s Tier-1 security alerts.”

Dina Mathers, CISO

Riskified logo in white

“Torq has transformed efficiency for all five of my security teams and enabled them to focus on much more high-value strategic work.”

Yossi Yeshua, CISO

Torq Joins the Cloud Security Alliance

We’re extremely happy to announce that Torq has joined the Cloud Security Alliance (CSA), the world’s leading organization dedicated to defining and raising awareness of best practices to help ensure a secure cloud computing environment.

The CSA has more than 80,000 members worldwide and has been endorsed by the American Presidential Administration, which selected the CSA Summit as the venue for announcing the federal government’s cloud computing strategy. It also collaborates with global policy makers to support and evolve key cloud security initiatives, such as the National Institute of Standards and Technology (NIST) and the European Commission.

Torq is proud to collaborate with the CSA going forward, and work with its large-scale community of  industry practitioners, associations, governments, and corporate and individual members as it evolves the no-code security automation space, and introduces critical innovations in the coming months and years. Torq will also benefit from the CSA’s cloud security-specific research, education, training, certification, and events.

We are proud to be part of the CSA’s mission to create and maintain a global, trusted cloud ecosystem with positive, forward-looking outcomes for its members, customers, and the world at large alike.

With visibility and transparency top of mind, we display the CSA logo in our Trust Center alongside our other key compliance certifications, which include ISO 27001 and SOC 2.

To learn more about the CSA, please visit: cloudsecurityalliance.org

SEE TORQ IN ACTION

Ready to automate everything?

“Torq takes the vision that’s in your head and actually puts it on paper and into practice.”

Corey Kaemming, Senior Director of InfoSec

“Torq HyperSOC offers unprecedented protection and drives extraordinary efficiency for RSM and our customers.”

Todd Willoughby, Director

Compuquip logo in white

“Torq saves hundreds of hours a month on analysis. Alert fatigue is a thing of the past.”

Phillip Tarrant, SOC Technical Manager

Fiverr logo in black

“The only limit Torq has is people’s imaginations.”

Gai Hanochi, VP Business Technologies

Carvana logo in black

“Torq Agentic AI now handles 100% of Carvana’s Tier-1 security alerts.”

Dina Mathers, CISO

Riskified logo in white

“Torq has transformed efficiency for all five of my security teams and enabled them to focus on much more high-value strategic work.”

Yossi Yeshua, CISO

Jason Chan on Harnessing Security Automation to Manage Cyberthreat Complexity

Torq is extremely proud to have Jason Chan on our advisory board. Jason has more than 20 years of experience working in cybersecurity. He’s one of the world’s leading experts in adopting security automation, cloud security, and enhancing security in modern software development practices.

Jason’s most recent career experience was leading the information security organization at Netflix for more than a decade. His Netflix team set the bar extraordinarily high, focusing on cutting edge risk assessment and management, and compliance management strategies and approaches. 

I had the privilege of being able to have a discussion with Jason, exploring the positive impacts security automation is having on organizations of all sizes, worldwide. In the first part of our conversation, “Harnessing Security Automation to Manage the Complexity of Today’s Threat Landscape,” Jason discusses the fact that while cyberthreats are increasing exponentially, it’s becoming increasingly difficult to hire people to address this escalation. As Jason puts it, “The question is how do we get the most out of the resources we have and prioritize the issues we need to address most critically?”

Watch the first part of our conversation in video below and learn all about Jason’s perspective on how security automation addresses these challenges by maximizing the impact of the security systems, processes, and people organizations already have in place, and breaking down security silos:

 

Take Action Today
Learn how to get started with security automation by reaching out to the professionals at Torq. You’ll learn more about the Torq platform and how we’ve helped myriad organizations achieve and exceed their security goals.

Get Started

SEE TORQ IN ACTION

Ready to automate everything?

“Torq takes the vision that’s in your head and actually puts it on paper and into practice.”

Corey Kaemming, Senior Director of InfoSec

“Torq HyperSOC offers unprecedented protection and drives extraordinary efficiency for RSM and our customers.”

Todd Willoughby, Director

Compuquip logo in white

“Torq saves hundreds of hours a month on analysis. Alert fatigue is a thing of the past.”

Phillip Tarrant, SOC Technical Manager

Fiverr logo in black

“The only limit Torq has is people’s imaginations.”

Gai Hanochi, VP Business Technologies

Carvana logo in black

“Torq Agentic AI now handles 100% of Carvana’s Tier-1 security alerts.”

Dina Mathers, CISO

Riskified logo in white

“Torq has transformed efficiency for all five of my security teams and enabled them to focus on much more high-value strategic work.”

Yossi Yeshua, CISO

When to Automate and When Not to Automate

Everyone loves automation, and it can be easy to assume that the more you automate, the better. Indeed, falling short of achieving fully autonomous processes can feel like a defeat. If you don’t automate completely, you’re the one falling behind, right?

Well, not exactly. Although automation is, in general, a good thing, there is such a thing as too much automation. And blindly striving to automate everything under the sun is not necessarily the best strategy.

Instead, you should be strategic about what you do and don’t automate. Even if you have the tools and resources to automate certain parts of a process, you may not actually want to automate them.

The Benefits of Automation

To understand the argument for being selective about the processes you automate, let’s go over the key benefits that teams are usually trying to achieve when they automate something. Typically, those benefits include:

  • Faster results.
  • Less time spent by engineers on manual processes.
  • Greater consistency and a lower rate of errors.
  • Repeatability.

We could go on, but these bullet points summarize the main goals of most automation projects.

When to Automate and When Not to Automate

Now, if you think critically about how best to pursue the goals we’ve just described, you’ll realize that fully autonomous processes aren’t always the best ways to achieve the goals. Let’s go through each one carefully.

Faster Results

Automation can speed up processes by allowing operations to proceed without waiting on humans to sign off.

The caveat, however, is that if your automation tools run into a situation where they can’t make a decision about how to achieve something – which happens when a variable is introduced that your automation workflow didn’t anticipate – you can end up with more of a delay than you would face if you had a human in the loop to oversee things. You’ll probably get results much more slowly from a fully autonomous process that goes awry than you will from a process where you have a human in the loop to react to unexpected conditions.

Less Engineer Time

By a similar token, the total time that engineers have to invest in operations work may be lower if not all of your processes are completely automated.

The reason why is that if something goes wrong within a fully autonomous process, the response is likely to be highly distracting and time-consuming for your team. But, if you had a human in the loop to begin with, you’d face a lower risk of a disruption that would require an extensive manual response.

Greater Consistency

Automation is a good way to keep processes consistent — so long as those processes are 100 percent predictable and reliable.

But, when there are variables, or when you are dealing with a process where each use case is unique, automation won’t always breed consistency — at least, not the kind of consistency you want. It would be better to keep a human in the loop so that the human could react as needed to special circumstances.

Repeatability

It may be easier to reuse automation tooling, too, when you keep humans plugged into your automated processes.

The reason why is that — once again — each process may be unique, and so you can’t simply lift and shift the automations you’ve created for one process and apply them to a different one. But, if you leave some responsibility to humans, it becomes easier to keep your workflow adaptable enough so that you can use the same automations repeatedly, leaving it to the human to interpret the unique variables within each process and adapt the automations as required.

Using Partial Automation

To illustrate the points above, let’s consider a common process that might seem like a candidate for total automation, but actually is not.

The process is Just In Time (JIT) permissions granting. The goal of JIT permissions is to grant access rights when a user needs them, and revoke them when they are no longer necessary. Having humans configure these permissions each time in a totally manual way is not scalable, so you may think that you would want to automate the process as fully as possible.

But, in reality, it would make more sense to automate only part of your JIT permissions operations. You could automatically collect account and user information, for example, and use these to generate updated access control policies automatically.

But if you actually apply the policies automatically, you run the risk of something unexpected happening with highly negative security consequences. Maybe a user is requesting a JIT permissions update to access a system that was recently moved from testing to production, and that therefore has stricter access requirements. But your automation tooling isn’t aware of that change, so it will grant the permissions without considering the unique circumstances of the request in question.

If you require a human to sign off on the permissions change, however, there is a higher chance that the oversight will be caught. Manual sign-off could delay the process slightly, but the delay should not be significant if the rest of the process is well-automated.

Conclusion: The Limits of Automation

To be clear, we’re not saying automation is a bad thing, by any means.

What we are saying is that there are points within processes where full automation doesn’t always make sense. Although it may seem counterintuitive, there’s value in requiring human participation, even if making processes fully autonomous is a possibility.

SEE TORQ IN ACTION

Ready to automate everything?

“Torq takes the vision that’s in your head and actually puts it on paper and into practice.”

Corey Kaemming, Senior Director of InfoSec

“Torq HyperSOC offers unprecedented protection and drives extraordinary efficiency for RSM and our customers.”

Todd Willoughby, Director

Compuquip logo in white

“Torq saves hundreds of hours a month on analysis. Alert fatigue is a thing of the past.”

Phillip Tarrant, SOC Technical Manager

Fiverr logo in black

“The only limit Torq has is people’s imaginations.”

Gai Hanochi, VP Business Technologies

Carvana logo in black

“Torq Agentic AI now handles 100% of Carvana’s Tier-1 security alerts.”

Dina Mathers, CISO

Riskified logo in white

“Torq has transformed efficiency for all five of my security teams and enabled them to focus on much more high-value strategic work.”

Yossi Yeshua, CISO

How Wiz and Torq Combine to Mitigate Existential Cloud Security Threats

A single cloud security incident can stop an enterprise in its tracks, sometimes resulting in irreparable damage to its operation, reputation, and customer loyalty. One key strategy for preventing such incidents is combining complementary cybersecurity tools to defeat threats at scale.

A coherent Cyber Security Incident Response Planning (CSIRP) approach requires enterprises to select and integrate the right tools before a security incident occurs. Torq’s next-generation orchestration and automation capabilities combined with Wiz Cloud Detection & Response empowers forward-thinking security teams to analyze cloud events and alerts from services like Amazon GuardDuty alongside the rich context provided by the Wiz Security Graph.

“The combination of Torq’s no-code security automation approach that delivers immediately actionable response and Wiz’s comprehensive contextual and accurate malicious activity identification means we can focus on high-level threats without being overwhelmed by cloud alerts. Torq and Wiz work seamlessly together to give us a major real-time advantage in mitigating the ever-evolving cloud-based threat landscape.” CISO of a major gaming company

Customers are already seeing that combining Torq and Wiz means the whole is far greater than the sum of the parts.

Achieve a Coherent CSIRP with Wiz and Torq

In its Computer Security Incident Handling Guide (Special Publication 800-61), NIST advises organizations to strengthen their capabilities in four broad areas:

  1. Preparation
  2. Detection and Analysis
  3. Containment / Eradication / Recovery
  4. Post-Incident Lessons Learned and Documentation

To better understand these areas, let’s apply them to a hypothetical brute-force attack.

Preparation

To be prepared for a brute force attack, you should:

1. Set up the infrastructure to identify potential attacks

Amazon GuardDuty can continuously monitor network and endpoint activity in production cloud environments to detect brute force attacks (amongst many others). Furthermore, Amazon CloudWatch Events or Amazon EventBridge should be configured to monitor events on new or updated GuardDuty findings. These events will later be consumed by an automation and orchestration system to enrich, analyze, and remediate the issues.

2. Analyze the assets’ context

Understanding the topology of your cloud environment, maintaining up-to-date connection states, and knowing which assets have access to sensitive data are critical to prioritizing response efforts to an attempted brute force attack. The Wiz  Security Graph discovers and correlates these signals, providing incident responders with important context. For example, Wiz will alert on an SSH brute force attack when attempted on a publicly exposed asset that allows password authentication and has high permissions to the organization’s cloud environment.

3. Orchestrate analysis and resolution

Notifications of new potential threats must be handled and interpreted consistently and programmatically (i.e. with minor involvement of human analysts) in order to operate at scale. Torq allows enterprises to automate data and response flows generated by the Wiz Security Graph, making it possible to route remediations either directly to DevOps or after a quick triage process of the security team. The owners of the at-risk assets receive all the relevant contextual information around the alert to quickly resolve the issue and shorten the MTTR significantly. Torq’s no-code automation platform lets you build these workflows from scratch, leverage hundreds of security process templates, and adjust them to the needs of every environment.

Here’s how Torq combines with Wiz to create autonomous responses to security events:

The detection stage begins with Wiz delivering an alert based on an Amazon GuardDuty event together with the context of the cloud environment. The alert immediately drives the execution of an automated response workflow in Torq.

Analysis

In the analysis stage, contextual data about external exposure to the asset is retrieved from Wiz Cloud Security Graph as part of the alert. If there was internal exposure, further analysis would be conducted to understand the possible connections between the attacked asset and the crown jewels that might be exposed to it.

Containment

In the containment stage, particular sources of the attack can be blocked by modifying the Security Groups and Access Control Lists, as well as by prompting an additional wider response to the potential threat. Further eradication of an issue can be achieved by orchestrating changes in the configuration of the cloud assets to improve their security posture and by enforcing multi-factor authentication and strong passwords.

Torq enables enterprises to respond by both triggering containment flows and alerting the relevant teams in the organization on the event, preventing them from wasting crucial time.

Post-Incident

The incident audit trail is created to chronicle lessons learned to better mitigate related threats in the future. Security teams can use the audit trail together with the visibility they get from the Wiz Security Graph to identify potential weak points and work to mitigate them in advance

Learn more

To learn more, see how you can reduce alert fatigue and focus on the most critical security gaps with Wiz and Get Started with Torq’s no-code security automation platform to handle these and similar threats at scale.

First posted by our partners at Wiz

SEE TORQ IN ACTION

Ready to automate everything?

“Torq takes the vision that’s in your head and actually puts it on paper and into practice.”

Corey Kaemming, Senior Director of InfoSec

“Torq HyperSOC offers unprecedented protection and drives extraordinary efficiency for RSM and our customers.”

Todd Willoughby, Director

Compuquip logo in white

“Torq saves hundreds of hours a month on analysis. Alert fatigue is a thing of the past.”

Phillip Tarrant, SOC Technical Manager

Fiverr logo in black

“The only limit Torq has is people’s imaginations.”

Gai Hanochi, VP Business Technologies

Carvana logo in black

“Torq Agentic AI now handles 100% of Carvana’s Tier-1 security alerts.”

Dina Mathers, CISO

Riskified logo in white

“Torq has transformed efficiency for all five of my security teams and enabled them to focus on much more high-value strategic work.”

Yossi Yeshua, CISO