Marc Castejon is the CEO and Founder of Silent Breach, a cybersecurity startup that specializes in network security and digital asset protection. With over 20 years of experience in the US retail market, Marc and his team have recently developed a software product to help retailers proactively protect their businesses.
(Image Credit: Marc Castejon, CEO and Founder of Silent Breach / Image Credit © Anna Katina / Silicon Luxembourg)
Can you tell us a bit more about Silent Breach?
Our startup specializes in network security across various sectors, with a strong focus on the retail sector, which comprises some of our largest clients. We opened our first office in St. Petersburg, Florida, where the market was ripe for our solutions. Since then, we have opened offices in Luxembourg and Singapore as well.
Silent Breach believes that cybersecurity is a mindset rather than a one-shot solution. To keep their business safe, clients need to maintain a cautious attitude and regularly monitor their systems. Monthly or weekly audits are no longer sufficient to counter hackers. In the retail sector in particular, compliance is very different from risk management. Fortunately, there is a growing awareness that compliance is the bare minimum for combatting cyber threats and that retailers need a more proactive approach geared toward the industry’s changing risk posture. Furthermore, breach response readiness is a crucial element of risk management. As retailers scramble to detect threats, they are well aware that it’s not a matter of ‘if’ but ‘when’ they will encounter a breach.
Silent Breach’s solution to the growing threat retailers are facing is called Continuous Shield Protect. Proactive vulnerability scanning, along with log analysis and configuration change management, is key to continuously monitor the digital assets that retailers are seeking to protect. When combined with services to determine the retailer’s security posture, such as penetration testing and vulnerability assessments, Silent Breach is able to offer 360-degree protection. Retail websites are exposed to millions of visitors and in a world where time is money, vulnerabilities need to be detected as soon as they occur.
“Our ultimate goal is to be able to monitor one million devices with a single solution.”
What are the specificities of the retail sector that you need to deal with as a cybersecurity company?
The biggest challenge in the retail sector is scale. Each store has its own network, with multiple subnets, and this can potentially result in several hundred thousand machines that need monitoring. By deploying our technology in the US, we had the opportunity to experiment with very large customers and adapt our product architecture and protocols to the massive amount of information we collect.
At the moment, the US market is ahead of the EU in terms of continuous monitoring, and they are well aware that being proactive is key to staying one step ahead of hackers.
For over a year now, we have been developing a tailor-made product, proposing a softer and more efficient approach than a simple vulnerability scan. The key element was to find the best balance between security and usability, one that could not be offered by traditional scanners.
We are very ambitious with our product; our ultimate goal is to be able to monitor one million devices with a single solution. Our architecture choices and the technology we leverage are all geared towards this objective.
“Cybersecurity must be understood holistically as a matrix comprised of technology, regulation and human behavior. Statistics show that the human factor is still the number one source of breaches in cyberattacks.”
How exposed are retailers to cyberattacks compared to other companies?
Because of the innovation retailers deliver to reach customers — omnichannel approaches, social media, efficiency efforts — the way they work is very different from other industries. While that presents great opportunities, it also raises the stakes of the game. The attack surface is suddenly expanding much faster than IT security teams are able to protect it, leaving the door open to potential intentional or unintentional attacks.
Continuous monitoring allows our clients to measure and monitor the attack surface, while reporting back with several security metrics, which provide retailers with a real-time awareness of their exposure. Each modification in their network configuration will be flagged, and any changes to the attack surface will be scanned for vulnerabilities. To complement this surveillance, we also parse log files to spot potential signs of an attack.
“The more threat intelligence we acquire, the better we can protect our clients. It is all about cooperation and communication.”
How do you respond when your clients are hacked?
Data breaches are growing more and more spectacular not only in terms of their size, but also due to the relentless pace at which they occur. It is our goal to offer the best product possible. Therefore, every breach is carefully analyzed and counter-measures are put in place to prevent future incidents.
On that front, we cooperate with the Computer Incident Response Center Luxembourg and Malware Information Sharing Platform (CIRCL MISP), which is developed in Luxembourg and supported by the Belgian Defense and NATO program. This helps us improve our responsiveness to cybersecurity attacks: the more threat intelligence we acquire, the better we can protect our clients. It is all about cooperation and communication.
We also have forensic experts working closely with government authorities in order to assist with legal procedures and, when possible, pursue hackers by giving proof of their actions.
Lastly and most importantly, cybersecurity must be understood holistically as a matrix comprised of technology, regulation and human behavior. Statistics show that the human factor is still the number one source of breaches in cyberattacks. With that in mind, Silent Breach plays an active role in Luxembourg’s House of Training by running workshops to increase cybersecurity vigilance.
These measures highlight Silent Breach’s philosophy that cybersecurity is an attitude of perpetual caution and awareness, rather than a single solution.