For years, we’ve talked about the blurring line between work and personal devices. But increasingly we’re seeing signs that that line no longer exists for employees. If that’s the reality, what is the path of cybersecurity to keep company data secured when its continually commingling with personal devices?

This week’s episode is hosted by me, David Spark (@dspark), producer of CISO Series and Mike Johnson, CISO, Rivian. Joining us is our guest, TC Niedzialkowski, CISO, Nextdoor.

Got feedback? Join the conversation on LinkedIn.

Huge thanks to our sponsors, Eclypsium and Normalyze

Full Transcript

Intro

0:00.000

[Voiceover] Biggest mistake I ever made in security. Go!

[TC Niedzialkowski] I was doing a penetration assessment for a large-ticket sales site. I was told that we were not doing this in production, it was QA, so that’d be safe, right? And I got kind of lazy with the cross-site scripting testing, I used some broken HTML tags, and I took down their main site.

[Voiceover] You’re listening to CISO Series Podcast recorded in front of a live audience.

[Applause]

[David Spark] Welcome everybody to the CISO Series Podcast. My name is David Spark, and to my left right here is the co-host, been there since day one, none other than Mike Johnson, the CISO of Rivian. Let’s hear it for him!

[Applause]

[David Spark] Now, for those of you who are not familiar with the CISO Series Podcast, this is a live show right now, but we have lots of shows on our network, and you can check them out at CISOseries.com. Now, our sponsors for today’s episode, and I do want to mention them because they’re also sponsors at the event we’re at.

We are at the Planet Cyber Sec Conference in Mountain View, California. Let’s hear it for Planet Cyber Sec.

[Applause]

[David Spark] So, sponsoring us and also sponsoring Planet Cyber Sec, we have Eclypsium, supply chain security for the modern enterprise. Let’s hear it for them.

[Applause]

[David Spark] And we also have Normalyze, keep track of what matters most, your data. Let’s hear it for them! Thank you.

[Applause]

[David Spark] We’re going to be hearing a lot more from both of them a little bit later in the show, but first, Mike, we have done many a live show before. Let me ask you, we do the virtual shows where we’re sitting at home streaming, connecting through a Zoom-like call. What is the big difference between the fact that you know people like or dislike you in front of a live show?

[Mike Johnson] [Laughter] Oh, like or dislike. Really what I like about the live show is the energy, like you have that direct feedback.

[David Spark] So, I don’t give you enough energy virtually?

[Mike Johnson] No, sir. No, no. You’re just this little postage stamp on my screen.

[David Spark] You make the screen that small. All right. We appreciate the live energy here and also the fact that we got a chance to come to this event. So, I greatly appreciate it.

[Mike Johnson] Yes, yes.

[David Spark] I’m not going to waste any more time. I want to bring our guest here. He’s been on the show before, he is the CISO for Nextdoor, none other than TC Niedzialkowski. Let’s hear it for TC.

[Applause]

[TC Niedzialkowski] Great to be in Mountain View! [Laughter]

Surprising research just in!

2:46.945

[David Spark] Do we still need to care about what devices our employees are using? So, according to research from CyberArk, the issue isn’t employees blurring the line between work and personal devices. The line doesn’t exist at all. Shweta Sharma at CSO Online notes that over 97% of US office workers use the same device for work and personal activities.

Why don’t we might as well just say 100%? With 17% of them always commingling use cases on a single device. So, I will start with you, Mike. Is the answer for everyone to carry two devices or should this just push us to, “Whoa, like, he’s pulling them out,” for those who are just listening to this, should they just push us to double down on zero trust?

You’ve got two devices as you are showing to everybody here. What is the case, Mike?

[Mike Johnson] Yeah, so ever since I got a work cell phone, I’ve always been a two-phoner. That’s just been my personal mode of operating. And the past few companies that we’ve worked at, or I’ve worked at, it’s been very much, if you need access to company resources, you need to have MDM. That was just the standard.

And what that meant was if people wanted access from their personal phone, they had to install MDM. If they didn’t like the MDM policy, we would give them a work phone, like, “Cool, no problem. Understand that you’ve got concerns about that. Here’s a work phone.” And when I came to Rivian, it was like, “Oh, I’ll just do that again.

That’s worked successfully several times in the past.” And I heard the first good reason to not do that.

And so I work for an electric vehicle company, we actually care about the environment, and our CEO said, “I don’t want to contribute to the e-waste problem by buying thousands of phones. I don’t want to do that, so we need to find a different path forward.” So, I do think it’s a solvable problem. You just need to think about it in a different way.

And we’re looking at it from, it’s a data-centric approach. So, if you’re only going to be accessing email and calendar and whatnot, the risk is different than if you’re going to be accessing our internal Confluence or our internal intellectual property, and that’s where we draw the line. So, the way that I think about this is data centric, and that’s the way that we need to be thinking about this going forward.

[David Spark] All right. So, it’s not a full zero trust. It’s a tiered situation.

[Mike Johnson] It’s a tiered situation based on the data.

[David Spark] All right. TC, you have two devices? You just have one, right?

[TC Niedzialkowski] I think it depends on your threat model. So, when I was at the Federal Reserve, I had two devices and had a clear separation between my work device and my personal device.

[David Spark] Hold it. Did your federal one have a camera on it or no camera?

[TC Niedzialkowski] I don’t think it had a camera.

[David Spark] Okay.

[TC Niedzialkowski] I don’t think it had a camera. But part of the reason I got so excited being back in Mountain View, I started my career in the South Bay, and working at small startups, working at medium-sized startups, having a nice laptop is a perk. And one of the things we’re seeing going through the economy, all these layoffs, a lot of companies are even letting the employees that they lay off keep their laptop.

It’s a recognition that this is something that you need, it’s something that’s really nice, and it’s going to help you get that next job. And this is actually something powerful enough to help you do the coding, help you do the research that you need to stay employed.

So, I think these numbers, it totally makes sense to me to acknowledge that people are using their work devices as a personal device, unless you really have a threat model that requires something different, and I think the challenge is really sussing out what’s acceptable or not usage of that personal device.

And so I think there’s almost like theaters of war, right? So, there’s the endpoint. Obviously, you don’t want someone running malware on the computer. Obviously, you want to make sure it’s encrypted. You want all the MDM controls in place.

But then the other piece is the browser. So, I think when we talk about people doing non-work stuff on their work computer, it’s probably going to places, visiting websites, and that’s an area that’s really complex. It’s not just that you went to a non-work website. It’s all the potential plugins you can be running, things you’ve been granting.

If you’re a Google Workspace customer, granting access to your Google account on your behalf. There’s so much opportunity for data leakage. Or power that you’re giving, like we talked about, is zero trust going to solve this? It is that person using that computer, right? And it’s coming from their browser making this malicious request.

So, I think zero trust I don’t think is going to be a solution to this. We really need to focus on the browser, and that’s where these enterprise-secure browsers that we’re seeing are really powerful.

How scared should we be?

7:31.632

[David Spark] So, a little over a month ago, that’s from when we’re recording this episode, Postgres developer Andres Freund discovered threat actors that hijacked the open-source XZ project that could have installed a backdoor on millions of Linux systems overnight. Now this was a years-long sophisticated attack at the open-source supply chain, and researcher Kevin Beaumont put together a nice primer on it.

But the core issue was the volunteer maintainer of XZ was looking to hand off the project and fell victim to social engineering, and it was a long con here. So, there’s an old XKCD comic that all modern digital infrastructure rests on “a project some random person in Nebraska has been thanklessly maintaining since 2003.” This seems so far down the line of concerns, old open source, even if it is vital, how do you handle it?

I’m going to start with you, TC. Do you budget time and money for open source like a law firm does for pro bono work, or do you look to build new resilience programs? Of course, you want to do everything, but really, the number one thing is what is most effective here?

[TC Niedzialkowski] Yeah, I think this first part, budgeting time for open source, I think that really depends on the size of the enterprise. Do you have the money and time to commit those type of resources? And that’s not going to be every company. But in terms of what’s most effective, my understanding is there’s not an anti-malware or SAST or some sort of code analysis tool that was going to pick up this vulnerability.

It was luckily observed in terms of how long it was taking, what was it, SSL, to run on his machine? “Hey, it’s taking a bit longer than normal, let me look into this,” and he happened to find this vulnerability.

So, I think what we know is tonight, tomorrow, probably on a Friday evening, right before a three-day weekend, there’s going to be a new zero day. And we’re all going to have to look everywhere within our infrastructure, both our corporate assets, our laptops, and our cloud infrastructure, and if you have on prem, God bless you.

Right? But there’s going to be a new zero day, you need to find it, and you need to know is this actually something that’s exploitable that actually has an impact in my environment, and what do I need to do to tear it out? So, that capability, it’s happened for Log4j, it’s happened with LibWebP, it’s happened here in this case, instantly being able to look at that infrastructure, accurately identify where it is, and then get the engineering teams that can make that change and push it to production.

And that’s a key capability, especially for software companies.

[David Spark] All right. What do you think is most effective, Mike?

[Mike Johnson] What I like that you called out there is a lot of it comes back to inventory. Know that this stuff is in your environment. A lot of folks have SSH. I mean, it’s kind of a normal thing, but do you have SSH exposed to the internet? Are you running SSH in a configuration that this is a problem for you?

So, coming back to knowing your environment, knowing what you have can help you be better positioned when something like this happens again. This isn’t a solvable problem. We’ve been talking about open source and our dependency on open source back when Heartbleed was a thing many, many years ago, it was actually what inspired the XKCD comic.

And we’re still in the situation where our companies rely a lot on open source, and we can’t exhaustively look at everything that comes into the environment. But if you know it’s there, if you understand what’s going on in the broader community and you can react to it, and maybe you have some isolation capabilities, you have other mitigations that you can bring to bear, that’s what really matters.

[David Spark] So, I’m just doubling down on my opening question. Resilience is really the best way to deal with this.

[Mike Johnson] Yes.

[David Spark] Not going to find all the possible permutations because it seems like an impossible problem to even discover.

[Mike Johnson] It is being in a situation where you can be resilient to one of these being in your environment, and if something like this happens in your environment and you’re not capable of dealing with it, you’re going to have a bad day when it happens.

[TC Niedzialkowski] What you said about inventory, so like in cloud environments, right, there’s a cloud security posture management tooling that can help identify these types of libraries or vulnerabilities in your environment, and the capability for an agentless solution where you don’t need to have an agent running on the host.

So, that’s probably going to be the inventory you know about. It’s the inventory where you’ve made sure to put an agent on it. But having an agentless capability that says, “Hey, and I found it over here. Surprise, surprise. Maybe you do want to stick an agent on this host, but by the way, you have this critical vulnerability.” That’s a very powerful capability because I think the inventory problem, just recognizing that as a problem and almost like kind of changing the mathematical set, right?

Okay, well, whatever it is that we’re running in AWS, we’re running in these accounts. So, having an agentless solution that can look at those accounts and find everything inside them.

Sponsor – Eclypsium

12:26.870

[David Spark] So, let me mention one of our awesome sponsors, and that would be Eclypsium, the leader, and it’s very apropos, in supply chain security or critical software, firmware, and hardware in enterprise infrastructure. So, CISO Series listeners can learn more about Eclypsium by visiting their website Eclypsium.com/Spark.

That’s my last name, I’ll spell that in a second. Not my last name, but Eclypsium. But there, if you go there, you will find the ultimate guide to supply chain security, an on-demand webinar presented by Paul Asadorian called Unraveling Digital Supply Chain Threats and Risk, a paper on the relationship between ransomware and the supply chain, and a customer case study with DigitalOcean.

If you’re interested in seeing their product in action, you can also sign up for a demo. You can do all of it, just go to Eclypsium.com/Spark.

It’s time to play “What’s Worse?”

13:40.741

[David Spark] All right. For those of you who are not familiar with this show, this is a game that we play on the show, and it is a risk management exercise. I provide two horrible scenarios. Neither one is good.

[Mike Johnson] They both suck.

[David Spark] And they both stink, and you have to decide first, my guess, and I will go out to the audience, which one is worse? I always ask Mike, my co-host, to answer first, and then TC, you can agree or disagree with him. All right? So, here we go. Comes from an anonymous listener. Situation number one.

Vendor has a backlog for almost two years and never underwent a third-party cyber due diligence/risk assessment review for contracting. So, got two years of third-party vendors with no review. Got it?

[Mike Johnson] All right.

[David Spark] Sounds pretty bad.

[Mike Johnson] Yep.

[David Spark] All right. Board of directors, this is scenario two, board of directors that says they care about cybersecurity but refuse to use anything but their personal emails to share sensitive company information. Which one is worse?

[Mike Johnson] So, this is one of those where it’s not A and then the opposite of A.

[David Spark] Right. Which I purposely did so the little logic game will play a little differently here.

[Mike Johnson] Yeah. So, the first situation, you’ve got your supply chain, you’re trying to properly secure that, you’ve got two years’ worth of backlogs of vendors that you’ve signed on and you haven’t reviewed any of them. Right? So, the second one is the board of directors just uses personal email for all of their conversations.

[David Spark] Well, it’s all sensitive company information. So, it’s like you have no security on company data.

[Mike Johnson] But just for the board of directors?

[David Spark] Yes. Okay. Yeah. It’s just a board of directors. Good point.

[Mike Johnson] Okay.

[David Spark] Yes.

[Mike Johnson] All right. In scenario A, you’ve got data that’s flying around, you don’t know the security of that. Scenario B, you’ve got data flying around and you don’t know the security of that.

[David Spark] Yes.

[Mike Johnson] So, boiling it down to that, I really think A is the worst scenario where it’s not just the communications amongst the board that are the problem. It is your data, your customer’s data, the email that’s actually going to the board of directors, it’s all essentially insecure. You should assume this.

[David Spark] Well, hold on. Let me qualify that. It’s two years they never actually underwent the due diligence. That doesn’t mean it is for sure insecure. Your board of directors is for sure sharing data through sensitive information. So, you just haven’t done your due diligence. It could be you have awesome third-party vendors.

[Mike Johnson] Right. But you don’t know.

[David Spark] But you don’t know. The second case, you know they stink.

[Mike Johnson] No, they don’t. I mean, they could…

[David Spark] No, no, because they’re putting it through personal email, copying and pasting Social Security numbers right into a personal email.

[Mike Johnson] Well, that’s their Social Security.

[David Spark] It could be anybody’s.

[Mike Johnson] That’s their bad decision.

[David Spark] Yes, exactly.

[Mike Johnson] So, I really do think it’s the vast majority, it’s like the quantity versus quality problem.

[David Spark] Okay.

[Mike Johnson] The first case is just everything. The second case, it’s a small subset. So, I think it’s really just the orders of magnitude are different here. So, I think the scenario A is the worst one.

[David Spark] All right. Let’s hear it from TC. Which one’s worse?

[TC Niedzialkowski] Yeah, I forget the author. I think it was Rawls had this concept of a veil of ignorance where if we sat around and what kind of society do we want to live in and had to choose and make the rules before we enter that society, we would want to maximize our minimum level of satisfaction, right?

So, I guess the way I look at this problem, I know what those board emails are that are circulating in the second scenario, right? I know what data has been exposed. In the first scenario, it’s not just data being exposed. It’s actually what is our production infrastructure? What’s running on our production infrastructure?

Who are these vendors that we’re giving information to? What are they doing with that information?

There’s some really scummy stuff out there when you take a look at the way some of these vendors work, the way that they can monetize the information you give them. And then, how do you even back out of that? If you rely on that vendor and you’ve been doing that for years, how much work would it take to back out of that and recover from that situation?

So, I think the board email, I know how bad it is, I’d rather start with that than take a chance on how terrible the first scenario could be.

[David Spark] Okay. All right. Now, I’m going to throw this to the audience. So, we got agreement on this one, yes? Got agreement.

[Mike Johnson] Yeah. And actually, TC’s answer was better than mine. I just want to highlight that.

[David Spark] So, he’s one plus.

[Mike Johnson] Yes.

[David Spark] If you will. All right. I’m going to go to the audience. By applause, how many think the first scenario is worse, not doing due diligence on all the vendors for two years? By applause.

[Applause]

[David Spark] So, it’s pretty overwhelming. All right. By applause, how many think board of directors sending sensitive information through their personal email is worse? By applause.

[Faint applause]

[David Spark] All right. So, a few non-enthusiastic responses.

[Mike Johnson] They were very enthusiastic.

What is Dave’s mom talking about?

18:50.004

[David Spark] All right, everybody. This is a brand-new game, and I have to cover this up because I don’t want you to see it because these are where all they are.

[Mike Johnson] You don’t want me to cheat.

[David Spark] Don’t want you to cheat. Okay. Here’s the deal, everybody. I interviewed my mother about cybersecurity. I gave her some terms in cybersecurity, some technology names, I gave her some possible threats. She doesn’t know what these are, but just hearing the word, she did her best effort to describe what it is.

I’m going to give you one giant hint. They are all 100% wrong.

[Mike Johnson] Great.

[David Spark] Okay? My mother couldn’t explain any of these. So, you have to do some reverse logic thinking here and think, “If I had heard this term…” By the way, you know what these terms are, I just want to point that out. You heard this term for the first time, didn’t know anything about cyber, how would you describe it?

Okay? So, let’s see if you can do this. Here we go. The first one.

[Dave’s Mom] It’s like the Mega Millions. It’s the big payout.

[David Spark] What do you think my mother is describing? And I’ll give you a hint. It’s a type of technology. What? Someone get this? It’s not ransomware. It’s definitely not ransomware. Come on.

[Mike Johnson] I was going with some Mega Millions as like bug bounty.

[David Spark] No, not bug bounty, but that’s a good guess. What do you think, TC?

[TC Niedzialkowski] Oh, what is it for the phishing when you target the big catch whale?

[David Spark] Oh, that’s also good, but also incorrect. Anyone else here in the audience want to guess this one?

[Audience Member] Crypto.

[Audience Member] Blockchain [Inaudible 00:20:25].

[David Spark] Okay. No, all these are wrong.

[Mike Johnson] Blockchain sounds like the best answer.

[David Spark] No, we’re going to move on because I’m going to tell you what it is. Here, I’ll play it again.

[Dave’s Mom] It’s like the Mega Millions. It’s the big payout.

[David Spark] That would be a honey pot. Everyone following?

[TC Niedzialkowski] Oh, my gosh.

[David Spark] Now is everyone along the lines with my mom’s logic here? Okay? Got it?

[Mike Johnson] Okay.

[David Spark] All right. Here we go. Here’s another one.

[Dave’s Mom] The person who helps you put the stuff in a safe place for all your files.

[Mike Johnson] Person who helps you put your stuff in a safe place.

[David Spark] Again, this is a technology. What do you think this is?

[Audience Member] Can you play it again?

[David Spark] Yeah, I’ll play it again.

[Dave’s Mom] The person who helps you put the stuff in a safe place for all your files.

[Audience Member] DLP.

[David Spark] No. Hold it, DLP someone said. What else?

[Audience Member] Server.

[David Spark] Firewall? No. What did you say?

[Audience Member] Server.

[David Spark] No, not a server.

[Mike Johnson] Yeah, secure file transfer?

[David Spark] No.

[Audience Member] Data custodian.

[David Spark] Data custodian, no, by the way, but all good wrong guesses. You want to try this one, TC?

[Mike Johnson] We’re very good at being wrong.

[David Spark] As is my mother, I should point out.

[TC Niedzialkowski] I don’t know. [Laughter]

[David Spark] Okay. That would be a cloud access security broker.

[Mike Johnson] Oh, broker, broker, CASB.

[Dave’s Mom] The person who helps you put the stuff in a safe place for all your files.

[TC Niedzialkowski] She’s right. She’s right. We need to call Gartner.

[David Spark] Yeah. All right. We’re going to give you one last one. Let’s just do one last one. Let’s see if you can figure this one out.

[Dave’s Mom] If you have to check that what you’re writing with works so that your letters will go out.

[David Spark] This one you should be able to get. Think about it.

[Mike Johnson] Signatures?

[David Spark] Signatures, no. TC, you want to try this one?

[TC Niedzialkowski] Could you play it again? I’m sorry. These are so hard.

[David Spark] Listen, this one, really listen to this one. I think you can get it.

[Dave’s Mom] If you have to check that what you’re writing with works so that your letters will go out.

[TC Niedzialkowski] Is it test cases? I don’t know.

[David Spark] What is it?

[Audience Member] Pentest.

[David Spark] Pentesting is correct! The audience got it! Good job, audience!

[Applause]

[David Spark] All right.

What would you advise?

22:35.098

[David Spark] What can we learn from the NSA’s latest zero-trust guidance? Now back in March, the agency published a new best practices fact sheet, and Robert Lemos at Dark Reading distilled these into five key takeaways. One, expecting threat actors to breach the perimeter. Two, mapping data flows from day one.

Three, redefining network segmentation. Four, mature software-defined networking. And five, accepting iterative progress. So, I’ll start with you, Mike. Which one do you think most security leaders are not doing or are struggling to do?

[Mike Johnson] So, I first want to highlight that I didn’t know the NSA had guidance around zero trust, and it was actually really good.

[David Spark] Now you got it.

[Mike Johnson] Now I got it. So, I strongly encourage folks to go read that. But I think the reality is a lot of leaders struggle with all of these. I mean, these are far easier said than done. I think there’s general agreement that you can’t rely on the Edge [Phonetic 00:23:43] being your sole control.

I think we’re past the castle-and-moat models of security at this point, but I do think that if you look at modern cloud-only architectures, network segmentation becomes easier. So, I think some of these are easier to accomplish.

But the one that I really want to highlight, it actually is a little bit different than the other of these, is the struggle to accept iterative improvements. We as an industry struggle with the fact of letting best get in the way of better all the time. We’re not going to go do this thing because it’s not the perfect security, so we’re therefore not going to do anything, is a struggle that folks constantly are having to deal with.

So, I do think that if I were to say, “Hey, pick one of these and focus on this,” concentrate on iterative improvements. Slowly getting better over time is going to make you better a year from now. Sure, it’s not going to be perfect tomorrow, but that’s the one that I really want to see folks focus on, is just accept iterative improvements, accept getting a little bit better every day.

[David Spark] Yeah, I thought you would jump on that one. And that one I see all the time because, I mean, it’s hard to go from zero to 100 immediately. It’s impossible. TC?

[TC Niedzialkowski] Yeah, I think there’s a couple here. So, expecting threat actors to breach the perimeter. Just taking the model, let’s assume that they have all the access that they need, and then we need to respond to that. Because I think if that was something most companies were able to do, we wouldn’t see a lot of the headlines that we already get.

Like take the healthcare space. Let’s just assume the hospital’s been hacked and they’ve put malware on all the devices, right? Okay, what are you going to do? So, I think that that one really stands out.

Another one that I think is really complex is the mapping the data flows from day one, depending on kind of how you define data flows. So, we’re talking about third-party vendors and fourth-party, fifth-party, sixth-party vendors. We’re talking about potentially what people do in their browser, right, that they also do personal stuff on.

And then also just the speed of development and all the, like, SaaS tooling, right? So, I mean, there’s areas, like I know that for GDPR, you got to have a data map, right? And when it comes to really trying to refine, pin down that data map in real time, there’s a lot of vendors in the space. But there’s a lot of complexity to be able to understand how you’re leveraging different tools like Salesforce custom objects, exactly what type of data is being put here, the amount of customization that you need to get good performance out of those tools.

So, I think, again, expecting a breach from day one, most people I don’t think are doing that, are prepared for that. And then the data mapping, it’s very difficult given all the technology and how quickly it changes.

[David Spark] So, correct me if I’m wrong, but the two of you have some zero-trust effort in your organization, yes?

[TC Niedzialkowski] Absolutely, yeah.

[Mike Johnson] Yeah, I think these days it’s pretty common to at least embrace some of the concepts of zero trust, so yeah.

[David Spark] And you can speak to now or in the past or whatever, when you sort of started down that road, what was the thing that you struggled with?

[Mike Johnson] I think it really is one of those because part of the model around zero trust is it’s as much figuring out what you care about, it’s also setting aside the things that you’re not going to care about. You’re not going to care about the network that those devices are on because you don’t have to trust that network.

And so that mental reset of, “We’re going to treat these as a coffee shop,” it can get really difficult. You end up with this, “But what about…? But what if something does get infected? What if something does get in that network?” And being able to set aside in your mind that you’re just not going to care about that is one of the difficult things you have to get past.

[David Spark] TC?

[TC Niedzialkowski] The hardest part I have with this is the name, right? Zero trust.

[David Spark] Oh, yeah.

[Mike Johnson] [Laughter]

[TC Niedzialkowski] So, okay. Raise your hand if you are not multi-cloud, if you’re literally just in AWS or GCP or Azure, but not the other ones.

[Crosstalk 00:27:54]

[TC Niedzialkowski] You’re trusting someone.

[Mike Johnson] Oh, I want that so badly.

Sponsor – Normalyze

27:59.722

[David Spark] So, let me tell you about our other sponsor, so thrilled that they’re on board here, and that is Normalyze, a pioneering provider of cloud data security solutions, helping customers secure their data, applications, identities, and infrastructure across hybrid cloud environments. So, with Normalyze, organizations can discover and visualize their data attack surface within minutes and get real-time visibility and control into their security posture, including access, configurations, and sensitive data to secure it at scale and prevent expensive data breaches.

So, Normalyze takes a unique approach to assess and associate a monetary value to every data store that is discovered and classified in the customer environment. We’ve talked about this before. Once you discover it and classify it, you can do a lot with it. So, you want to learn more how to do it? You got to go to their site.

It’s Normalyze.ai.

There’s got to be a better way to handle this.

29:13.121

[David Spark] So, we were having a long discussion earlier about Reddit and the value of Reddit and how there’s a lot of snarkiness that comes up on Reddit, and here is a little bit more of it. I think it was so popular, this snarky comment, that I think there might be some truth to it, so I want to delve into it.

So, why are we still dealing with the golden oldies when it comes to web app security? Now, this topic came up on the cybersecurity subreddit asking why something like an SQL injection, which developers have known about for decades, still is in the OWASP Top 10. Now, one redditor said, and here’s a snarky comment, get ready, hold on to your seats, said, “The reason for this problem is that ‘experienced’ developers leave and they are replaced by less experienced developers.” So, I will start with you, TC.

Is this popular comment just a cheeky response, and people were just laughing and that’s why they liked it so much, or is it true that this is the or a reason we still have this problem with things like SQL injection?

[TC Niedzialkowski] I think probably the reason they have SQL injection is because of the frameworks that the experienced developers used when they first built the app, and that if the less experienced developers built it from scratch today, that wouldn’t even be possible. So, I think just frameworks, that basically the software is still around, right?

The other part I’d say is how do the less experienced developers become more experienced developers? And it’s probably dealing with an incident, whether it’s a production outage unrelated to security, or security, or dealing with security, getting this feedback. But I think there’s a learning process.

I think what’s interesting about SQL injection and cross-site scripting and how they’ve been stamped out of modern frameworks today is that now we have AI, and we have prompt injection and it’s a really familiar pattern. So, I think maybe the patterns for these are going to stay, but the incremental progress we’re making along the way is just making it so it’s safe for developers, where they don’t need to know about SQL injection because that’s not going to happen with the technologies they use.

[David Spark] All right. By the way, I’m going to ask you the same. Is there any validity to this statement about experience versus less experienced developers, why we have these problems, or are we going with TC’s answer?

[Mike Johnson] So, I actually really like what TC said, which was almost more the experienced developers are the problem. And I think relying on the experienced developers and just assuming that experienced developers are never going to make a mistake, that’s really the problem that folks need to focus on here.

It’s not the fact that people can’t understand their code. It’s the fact that they wrote the code in the first place. And if you actually wrote things with modern frameworks, SQL injection is actually really hard to implement within your code, and that’s where we need to get. We need to have these secure frameworks.

[David Spark] Somebody needs to wipe out and greenfield it again.

[Mike Johnson] In some situations, that is actually worth considering. I mean, if you’ve got code that nobody understands how it works anymore, you’re only going to make it worse if you continue it.

[David Spark] And also that’s a ticking time bomb…

[Mike Johnson] Absolutely.

[David Spark] …if any of that’s going to happen.

[Mike Johnson] There’s going to be other bugs, availability. The thing’s going to crash someday and nobody’s going to be able to bring it back online. And that’s what folks really need to be talking about. Not the fact that, hey, we’ve got a new developer who doesn’t understand this Fortran code and can’t possibly maintain it.

It’s a ticking time bomb, like you said.

[David Spark] So, really the answer to this, and I think great answers from both of you, is that the reason we have these classic problems is that there’s classic infrastructures still out there. It’s like there is still Windows XP and NT servers out there operating, and yeah, you’re going to have problems if those are still running critical.

[TC Niedzialkowski] Yeah, I think we’re picking on SQL injection and some of these other OWASP top vulnerabilities, but one of the ideas is just kind of having an API that exposes information that it shouldn’t, right? Or that allows you a type of access that it shouldn’t allow. That totally hasn’t changed over the past 20 years.

And so to me, I understand where this person’s writing from. It’s, I think, a place of resentment. It’s a really hard economy right now. There’s a lot of cost reduction going on.

[David Spark] There’s a lot of resentment on Reddit. We know that.

[TC Niedzialkowski] But I think also the trend is actually the opposite, where essentially a lot of companies, what they’re doing is they’re not hiring junior developers. They’re maybe not even doing their internship program. They’re actually more crutching on the senior developers because that’s seen as more cost efficient.

So, I think the trend in the industry is the opposite. More senior developers, less junior developers. But I think the good measure of a senior developer or a senior architect is someone that can construct a system where the more junior staff in it are safe. They’re not going to make a critical mistake like one of these vulnerabilities.

You’re only as fast as the rest of your team, and so as they go through different changes, moving over to Kubernetes or moving to a new IEC language, whatever it is, being able to construct it in such a way that it’s not completely reliant on you and other people can still make good decisions and not really shoot the company in the foot.

That, I think, is the expectation for a senior developer.

It’s time for the audience question speed round.

34:31.804

[David Spark] All right. In my hand, I have a bunch of questions from you, the audience, and with the little time that we’ve got left, we are going to try to get through as many of these questions as possible. So, here’s the first one, and either of you jump in here. I like this one. Comes from Yash Kosaraju of Sendbird, and Yash asks what’s your favorite interview question that tells you about the person?

[TC Niedzialkowski] Oh, yeah, we just talked about this. So, basically, you’re a manager, right? And you have someone on your team that’s basically a brilliant jerk, right? The most complex stuff that just comes down business needs to make this change, they’ve already done it, they’ve already coded that up.

That’s already done, ready to move. They don’t make mistakes. They’re completely reliable. They intuit the business, but they’re completely insufferable to deal with. Do you keep them on your team or not?

[David Spark] That being the actual question. Okay.

[Mike Johnson] Yeah, I think it’s a great question.

[David Spark] And for those of you who are not big followers, yes, Bill just noticed something. Mike is not a fan of the brilliant jerk.

[Mike Johnson] We’re getting rid of that person.

[David Spark] Yes. All right. So, Mike, what’s your favorite question?

[Mike Johnson] Oh, gosh, they’re almost always experiential, and it’s based on the person that I’m talking to. And so tell me about a time that you solved this problem. They’re not particularly exciting in this kind of a room, but to be able to ask a question that is related to that person’s experience is where you can really get a lot of insights.

[David Spark] All right. Next question from Mike Skurko, president over at ISSA Silicon Valley, there he is in the back of the room. We talk a lot, by the way, about getting security into the rest of the company, but he’s actually asking the 180 of that. How do you design corporate culture into the security team?

[Mike Johnson] I think it’s actually a very good question because it’s critical. Your security team needs to understand how the company operates. Otherwise, they can’t impact change. If they’re just going around, laying out policies, saying, “Thou shalt,” those kinds of things, it’s not going to get very far.

So, I really do think a lot of it comes down to being involved, being visible, participating in some of those conversations, being active on your company’s Slack channels and just the corporate meme channels, just getting out there and understanding what people are talking and how people talk and driving your own team to do that.

That’s how you get involved, and that’s how you understand is just soak in it. You’ll figure it out pretty quickly.

[David Spark] What do you think, DC?

[TC Niedzialkowski] Yeah, a nice example of this, and I haven’t had to do this, but I heard the way DoorDash works is that everybody at DoorDash, all employees, all corporate employees, they’re going to have to do a delivery something like once a month. And so I think that idea of just walking in the other person’s shoes.

One way to do that is team rotations, right? So, if there’s an area that you really need to advance security’s understanding and maybe the security posture of that area, have someone from the security team do a job rotation. It could even be like four to six weeks. And then they’re the person who can help you translate with that other team, and they’re going to know a lot more about that team’s pains.

[David Spark] All right. I have two questions here, and they’re very much related, the first from Bil Harmer of Craft Ventures, the next from Francisco Igual of SOAProjects, and it’s very relevant. We had Joe Sullivan here speak earlier, and he was phenomenal. So, very relevant to his presentation. Is it worth it being a CISO anymore, and how do you assess personal risk to yourself being a CISO?

[Mike Johnson] So, the answer to the first question is yes. And the way that I look at this, I was actually literally talking about this earlier today. I got into this field to try and make the world a better place. Like, this is my opportunity. I can help secure companies; I can help secure data. That actually can have an impact on the world.

For me, that will always be there, and that will always be worth being involved. From a personal risk perspective, I’ve talked with Joe about this in the past. A lot of it comes down to documenting things, making sure that you… I think the term the kids use these days, make sure you’ve got the receipts, right?

Make sure that you know and have that evidence in case something is going off the rails, but also do your best to not get into those situations in the first place. A lot of those things, you can avoid them. You can see them coming of, that’s not going to go well, I’m just not going to get involved in it.

And that’s the best way to protect yourself. Just avoid it entirely.

[David Spark] All right. It’s like the bully at the school. All right. What’s your take, TC?

[TC Niedzialkowski] Yeah, I think it’s absolutely worth it. I mean, that’s why I got into this as well. I’m very driven to help protect other people. And this is, I think, the perfect role for at least me to be able to do that. But I think what Mike was saying, what I would add to that is integrity, right?

So, there’s the example before you send an email, just picture it being projected in the front of a courtroom, right? So, carrying yourself with integrity. You have duties and obligations to your customers, to your employees, to your stakeholders, to investors. And then if you see something coming up, and based on what happened [Inaudible 00:40:11], you should know some of the warning signs, right?

Seek help. So, reach out to your network, find out what your options are, but really be fully eyes open in terms of the potential impact it could have to you.

[David Spark] All right. I want to squeeze one last question in. Here it is. I think this is a great question from Tyler Pinckard of SupportLogic. I’ll start with you, TC. How do you instill the safe ability for your staff to have the freedom to share their perspective, even though it may be something you don’t want to hear or someone else, and they won’t get repercussions for saying it?

Like, you want to have that free flow of communications. How do you make them feel like… Everyone can say, “Oh, you can come to me to say anything,” but sometimes that’s not so clear.

[TC Niedzialkowski] I think this is one of those things where it’s the only way you can do it is by doing it, and it takes time to build trust. I think the other thing would be to solicit people’s perspectives. And I think one way it could happen is when you have a team meeting, when you’re brainstorming, or when you’re doing a post incident review or a retro, making space where the team knows that it’s part of your agenda.

You’re going to ask each person there for their perspective.

[David Spark] So, be proactive about it.

[TC Niedzialkowski] Be proactive.

[David Spark] Don’t sit there and wait for them to come to you.

[TC Niedzialkowski] Exactly. Be proactive, ask them for it, give them the space and be respectful. Write it down and don’t dismiss it. And if they see that you actively seek people’s perspectives and you provide them the respect for that, then I think they might feel more encouraged to provide that themselves because they see you respecting others.

[David Spark] Good answer. Mike?

[Mike Johnson] When I joined Rivian, one of my team members gave me a gift. We were in the first introduction, all hands, I was introducing myself to the team. And someone stood up and they asked a question, and it was a tough question, and they were the kind of person that just did that, that was just in their nature.

And it gave me the opportunity to answer that difficult question and do so in a way that was respecting the person who asked the question. And so to TC’s point, you just have to live it. You have to give the evidence, have those situations, and maybe you’ve got to plan it. Maybe you have someone on your team, and you plan in advance of like, “Hey, please ask me a really difficult question in front of the team, and I will answer it.

You don’t have to ask me right now. Just ask me a difficult question. I will answer it.” And that way you can actually walk the walk in front of the team. They see it, other people emulate that, and then it just builds from there.

[TC Niedzialkowski] I just want to add to that. I think that’s part of the job of a leader, right? And not just that they feel comfortable with that difficult question in front of you, but that they feel comfortable with that difficult question in front of others even higher than you in the organization because that’s what leadership in the organization needs to hear in order to grow.

Closing

43:10.481

[David Spark] Well, thank you very much, TC and Mike.

[Applause]

[David Spark] That brings us to the very end of the show. I want to thank our sponsors. That would be Eclypsium – supply chain security for the modern enterprise – and also Normalyze – keep track of what matters most, your data. Remember, Normalyze is Normalyze.ai, and Eclypsium, Eclypsium.com/Spark.

Go check them out. A huge thanks to Richard Greenberg and the entire Planet Cyber Sec team for inviting us out here. Let’s hear it for them.

[Applause]

[David Spark] And we really appreciate you supporting us. Thank you. If you’re not already subscribed to the CISO Series, please do. As always, we greatly appreciate your contributions and listening to the CISO Series Podcast.

[Applause]

[Voiceover] That wraps up another episode. If you haven’t subscribed to the podcast, please do. We have lots more shows on our website, CISOseries.com. Please join us on Fridays for our live shows – Super Cyber Friday, our virtual meetup, and Cybersecurity Headlines Week in Review. This show thrives on your input.

Go to the Participate menu on our site for plenty of ways to get involved, including recording a question or a comment for the show. If you’re interested in sponsoring the podcast, contact David Spark directly at David@CISOseries.com. Thank you for listening to the CISO Series Podcast.