Let’s Simplify Cybersecurity Language with Ayman Elsawah, Founder at Cloud Security Labs
Ayman explains that cybersecurity can be simplified by focusing on practical steps like enabling device encryption, implementing strong access controls, and prioritizing security culture. He emphasizes that for startups, security should be tailored to their specific needs and stage of growth, with a focus on foundational measures such as proper onboarding and offboarding processes, and using built-in security features rather than overcomplicating with expensive tools. He also highlights the importance of distinguishing between compliance and true security, noting that compliance alone does not ensure protection against real-world threats.
Transcript
Hey, really quick before we get into the podcast, we aim to bring you the most practical, impartial advice in cybersecurity. So if you like what we do and you want to help us out, please follow us on whatever platform you're listening to us on right now. Thank you. And let's get into the episode. If you're the smartest person in the room, you're in the wrong room. This podcast is my attempt to document lessons from cybersecurity experts who can go deeper than most on critical topics. My hope is that you use these insights to fortify your business and grow your career and maybe one day partner with SIFT to select your next cybersecurity vendor. 0:39 I hope you share and enjoy. Welcome to No BS Cybersecurity. I'm so excited to have you on here. And for the people who don't know who you are and what you do, give us a little introduction.
Yeah, thanks for having me. So I was born in... No, I'm just kidding. We won't start that early. So yeah, I am a fractional CISO. So I help startups with their security. And I do a few other things too. I have a podcast called Getting Into Infosec where I catalog people's journey into security so that other people can be inspired and learn. I wrote a book because I don't like repeating myself. So if we sat down for coffee, this is exactly what I would say on how to get into the field. 1:24 And then I have also a newsletter. I guess it all came together because I like to distill complex topics in security and make it easy for other people to understand. So, you know, I found myself repeating myself with my clients. And so I started last week as a VC. So where I distill hard security topics in an easy to understand format, hopefully, so that, you know, people that don't have security in their title can understand security. So it's I guess it's been a common theme. So I don't know. It's fun. 1:55 And yeah, that's what I do.
It's so needed to, right? Like cybersecurity has gotten so complex. It was already complicated and complex from a technical standpoint. And then you add in Richard Steenen coined the term, at least it coined it for me, of marketecture. These marketing teams get involved. They start creating acronyms for things mdr plus idr you know drp gartner and all these analyst firms they've added to the complexity and so you are a hero in my world for simplifying it man like what are some of the things that are common that you've been able to distill down and make them easy to understand
You know, I find myself, it's hard for me to even stay up with the terms, you know, like, you know, you have, you know, CNAP and this and that, SIM. I mean, you know, before it was simple, it was like, how do you pronounce SIM? Is it SEAM or is it SIM, right? But now it's just so much more complex. What are some examples well let's see i mean i took i took a whale watching trip and correlated it to fingerprinting so when you know i went whale watching and i realized they said that every whale fin is unique as a unique fingerprint so i took that and correlated it to like okay 3:15 Here's how we fingerprint in security. Like here's some heuristics to look for when someone's trying to attack your website or you're trying to investigate something, you know, using a user agent and a few other kind of things to figure out like device fingerprint, web fingerprint, things like that. So just trying to make it different, you know, so.
Yeah absolutely and like i said it is much needed man i talked to smbs and startup founders and they're like i don't even know where to start yeah they've never even heard the acronym mssp or vc so and so as they're raising funds in the startup world saying hey you know we just closed a seven million dollar big seed round and we need to start thinking about cyber security they hop on google and it's overwhelming it's information overload And they need people like you who can come in and say hey slow it down it's not that complicated here's what you need right and if that startup founder comes to you and says hey we just raised seven million bucks our vcs are telling us that we need to think about cyber security where do you start what do you tell them
Yeah, yeah, that's a really good question. So, you know, I kind of like my job is to calm them down and to give them the warm and fuzzy and, you know, kind of like a security therapist in a way. So, you know, there's a couple of types of security people out there. There are those that want to boil the ocean and say you have to do this and do that. But with startup security, it's a little nuanced. It's very different. And so the first thing I tell them is like, hey, listen, security is not black and white. It's 50 shades of gray. And that was an actual article I wrote to help kind of distill it down because for every company, it's different, right? 4:56 If you're a B2C company, your security footprint is a lot different than say a healthcare company or a company doing credit card transactions or FinTech, right? Or crypto. So each one, you know, each different type of client that I've had to work with has had a different, let's say, threat model. But there are some baselines that like are common for everyone. And you know the number one question that i get from founders is like how am i doing they want to grade they want to know like how am i doing compared to someone else did i get an a b a c like it's it's kind of interesting and you know i guess from you know from the vc perspective they want to make sure that their investment is protected and so you know 5:35 But there is many ways to there's it's you know as we all know security is a bunch of layers and so that's what I try to do I try to say hey listen here's a bunch of layers let's you know my approach personally is to live off the land so let's see what we can do without buying any extra tools or anything like that there's a lot of things that can be done internally You know, one of the main things to look at is offboarding and onboarding. So as you're a startup, you're growing. A lot of times your offboarding process is not that great. And so you'll find contractors and engineers or various people still with access to your systems. 6:08 Oops. So that's that's something to be cognizant of. And, you know, I'm happy to talk more, but.
So what do you say to the security practitioner and this is probably of the old order someone that's been in the industry for 20 years who says you know what it is it is black and white it is that simple you need to look at your Have a way to detect if someone's, you know, attacking your environment, and then have some IR and some cyber insurance and some backups. It's that simple. 6:44 What do you say to that person who says these are the building blocks? If you have these in place, you're pretty much good to go.
Well good to go is a very tricky term so you know that I think the other issue in security overall is complacency so thinking that you've you know checked all the boxes and you've you've done everything you need to do and then you're done that is like my number one enemy basically is like telling people hey it's never done you know a founder just the other day or a vp of engineering I was working with one of clients is like I'm like what's your goal for this session
And it's a therapy session at the end of the day.
But I'm like, what's your goal for this session? And he's like, well, I want to know that we've done what we needed to do from a security perspective. So I had to be careful and not to be too pedantic and say, well, just to let you know, security is a journey. It's not a point in time thing. So just keep that in mind. And as long as you keep that in mind, then you're good.
And afterwards, go ahead. No, no, go ahead. I was going to ask if there's a level, is there a way to correlate the stage of the company and the maturity of the business to the level of maturity they should have from a cybersecurity perspective? And is that enough to say, hey, for your stage, you are where you should be. And as these things change and as you grow, here are the things that we're going to likely have to think about six months or a year down the road. 100%. 100%.
Actually, I have a couple different playbooks. So like I said, I have the baseline playbook. For a company that's like, say, under 50 employees or 25 employees, a lot of times they don't have an IT person, a full-time IT person or whatnot. And so I say, okay, as you're going to grow, like around 100, you know, I've seen companies with, you know, 200 employees and didn't have a full-time IT person. So I say, you know, like from my experience, you know, you're going to want like around 100 people, you're going to have an IT person, you're going to need an IT person, you're going to have to deal with like device management, things like that. 8:41 A lot of times companies are just having people, contractors use their own devices and laptops. I'm like, well, how are you handling device encryption and things like that? Are you allowing people to download things? So yeah, every stage of company has Talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria 9:14 Just consumer email and name. So, you know, what's the spectrum we're trying, what are we trying to protect? So size of the company, data that we're trying to protect, whether it's IEP or client information, and then, yeah, risks to the business in general, right? So that takes care of the whole threat model. So to answer your question, you know, are there different things for different size companies? Yes. You know, a 25 person startup is going to have different needs than I say 100 person startup. Also, are they B2B or B2C? 9:46 So when they're B2B, a lot of times they're facing enterprise clients, and the enterprise companies are the ones pushing down the requirements to them to have SOC 2 or answer these questionnaires, and nobody likes to answer questionnaires with a no. They're like, how can we, they come to me like, Ayman, how can we answer these questionnaires better? I'm like, okay, let's take a look. Let's see what we could actually turn into a yes, like internally in your environment, because we don't want to lie, right? And so, you know, what can we do here? And then what's the story that you can tell the company, you know, that's factual, that how you can achieve, you know, the gap, how you can fill the gap for that questionnaire? 10:24 Because these questionnaires are like sometimes 100, minimum 100 questions to like 400 questions sometimes.
Yeah, and it's impossible for a startup founder if they don't have you in their corner to tackle that on their own. It's just too complicated. The tools are expensive. There's no easy way to evaluate them. I mean, it's so complicated that they need expertise from people like you to just help them conduct business, especially trying to work with the enterprise. And now when we think about those smaller companies, it sounds like you have a pretty good understanding of here's the base layer, right? And I think you mentioned like that basic level. 11:01 Let's dive into that. What goes into that basic level of security? Break it down.
All right, cool. So first of all, your devices. So, you know, do you have device encryption enabled or not? Whether it's FileVault or BitLocker. So when you're downloading files, Why is that a good question? So when you're downloading, if you're handling sensitive files, if you're downloading files with sensitive information, if your device gets lost or stolen, and it's not encrypted, then you're at risk. Basically, you have to assume that information is stolen or lost, right? So if you download a spreadsheet with a whole bunch of social security numbers of like all the employees you onboarded, right? 11:40 Say the people person in your company or Talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria
I'm curious because this is the no BS cybersecurity podcast. So I want to make sure we get, you know, to brass tacks here. Dude, let's do it. Isn't it true that a small business, let's take a 50 person manufacturing plant in, you know, Iowa City, Iowa, right? And if they lose, they lose a laptop. It likely has a password on it right let's call it a macbook it's got a password on it the person who finds that laptop are they really trying to crack the password and get into the files and all of that sort of thing and even though that's possible isn't that an acceptable level of risk like likely that person finds a laptop they're going to try to reset it and sell it on craigslist right and so is that overkill to be thinking about encrypting every device like it 12:50 Or is that, I mean, tell me your perspective on that. Is it overkill?
I love it. Okay, along those lines, what information would be on that device?
Let's say it's a bunch of customer information, accounting information. Let's even say it's the accountant or the person who handles accounting's laptop. So they have the ability to send invoices and get payments and things like that.
Okay so let's say let's say for example so i think there's a couple different angles to this one the likelihood of someone going into that device and removing that data is going to be you know less likely you know it they're actually going to just wipe it or actually they're probably not even going to wipe it they're just going to sell it on craigslist as is so depending on who receives it if they have any technical know-how or curiosity I mean, you know, a lot of teenagers have curiosity and just see what's going on. 13:47 So, but here's, here's how you have to approach it, right? So, from a realistic perspective, if I have, let's just say I have spreadsheets or the person that lost the device said, Hey, I have a spreadsheet with all my, with, with every employee's social security number on there. Right. Or, or worse, patient information with all everybody's social security. So that information got lost. You have to assume that it got lost. As a cybersecurity person, that would result as an incident and you have to take the measures necessary to absolve that incident somehow, right? 14:25 So yes, is someone going to... Or for example, let's just keep it simple. If API keys, say an engineer, it's happened before. An engineer had their device stolen and they had API keys to AWS on their device, okay? And last we checked, that device was not encrypted. So is someone going to go in there and figure out what to do with the API keys and hop into AWS? Probably not. However, we should rotate those AWS keys as soon as possible because we have to assume that they've been lost, right? 15:01 Or they're out there in the ether. So that's the idea is, you know, we take the likelihood. Does that answer your question or like, you know, does that make sense?
Because I love the pushback. Yeah it does but it still makes me think that the data encryption is overkill for most small businesses like if the device is lost and it has the api keys like hey we're going to rotate the api keys the likelihood that the person who found that laptop sitting at the mall took it home put it on craigslist and then someone hacked the password to get into the macbook and then Even understands what they're looking for or what they have understands the api keys and then executes some action to you know attack the company i mean it seems so far-fetched and even though it's possible to me it feels like it's in the bucket of acceptable risk and instead of the encryption of every device it's hey let's rotate the api keys and we're probably good to go
Well, it really depends on what data is in there, right? So, you know, as a business owner, it's up to the business at the end of the day to decide if it's an acceptable risk or not. So, you know, to install, you know, to just go through every device and say, hey, can you just check to make sure you have encryption enabled? That exercise is that, would you rather go through that exercise or go through the concern of the device got stolen, figuring out or wondering what was on that device and if it would come back and haunt you later? Right. 16:26 So I think I think just balancing the two is and you have the right to figure, you know, you can pick either one. Right. You can choose to accept the risk. That's totally fine. My job as a security person is just to inform you what's what you should try to do to try to, you know, balance the risk. But you're totally welcome to. Of course. Yeah, you could totally do that.
It seems like in the security realm we're doing so many different things to solve for one risk and if you let's say you have the ability to do remote containment and you can power down a device and wipe it remotely yeah right and you use that as okay if there's a stolen device we're just going to isolate it from our network and wipe the machine Doesn't that take care of the problem? Wouldn't all of the additional layers of security be overkill because in this scenario, we're just going to wipe the device anyways? 17:21 Why have the encryption layer and all of those other features and tooling and defense strategies when we know the device was stolen, let's just isolate it and wipe it?
If you can actually reach it and wipe it, then yeah. But a lot of times it's not online enough. But if you can reach it and wipe it, sure. Yeah, that's great. I wouldn't necessarily use that as, you know, okay, we can wipe it, so let's not encrypt it, right? I would say, hey, if we are worried that all our devices are not encrypted and we don't have the bandwidth or whatever to go through and make sure everything's encrypted, do we have the capability to wipe everything in case it's lost or stolen? 18:04 I mean, with today's technology, they're almost the same switch. They're actually right next to each other. So if you can wipe a device, you could turn on encryption as well remotely.
A talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, NIST, FedRAMP, GDPR, HIPAA, SSO, IAM, OAuth, phishing, ransomware, pentest, OSCP, NIST, FedRAMP, GDPR, HIPAA, SSO, IAM, OAuth, phishing, ransomware, It's as easy as a click of a button. Yeah, why are that? I mean, they do, though, right? Like, they do have to have some expertise. And a lot of times, they buy a tool that's so complicated that they have to hire an entire other organization to manage the tool for them. 18:45 Why is that? If it's as simple as a click of a button? Why is it so difficult for a startup founder or a small business owner to manage their own cybersecurity posture?
Well, why is it hard for them to manage the cybersecurity posture? I guess because cyber, you know, what I've experienced, the hard part about for a startup founder specifically is prioritization, right? So a lot of times they know what needs to be done, but they're not sure what needs to be done like right now. So what needs to be done right now versus tomorrow? Because in startup land, prioritization is king, right? So, or is key. So, you know, in prioritization, you know, there's always all these features that you have to do and requests and bugs and whatever. 19:27 So like figuring out what has to be done now, today versus tomorrow. Same thing goes with security. What do we need to do today to give us our base level comfort of security that we're protecting our company or data or client stuff, reputation, you know, it depends on the industry you're in. So I think that's really at the crux of it. And then, of course, the tooling from a technical perspective is a pain in the butt. Like, you know, when you buy a bunch of Macs from Apple, there's no easy out of the box way to manage them. You have to, you know, utilize a store, you finally figure out some sort of MDM solution. 20:02 It's not like out of the box. With Windows, you could use Office 365 or like Google Workspace. There's different things, but then there's extra cost. So a lot of times the barrier to entry to use the fancy schmancy security tools that makes your life a little easier is like double the cost per user. And so a lot of times it comes down to the cost too.
Yeah. And then it becomes quadruple the cost because you go, I can't manage this shit on my own. And let's just pay for the fully managed solution. And so then I don't have to think about it as much.
I hate the fact that like, not only do you have to pay for the tools, but now you have to pay for a person to manage the tools. So, you know, that's why sometimes my job is tough because depending on the company, I mean, for some folks, they'll be like, yeah, put in SSO. But I'm like, do you know the cost of SSO? Like SSO is a big cost for a smaller company because not only do you have to pay the additional cost for SSO, but all the other applications to support SSO have an additional license fee, right? There's a great website called SSO.tax that goes through and lists all the companies and the 21:15 Different price tiers that you have to pay for SSO functionality. Now, don't get me wrong, I love SSO. SSO is awesome. If you can afford it, do it. Once you reach like 100 to 250 employees, you probably really do need it. It'll make your job a lot easier, your life easier, access reviews, onboarding, offboarding.
However, there's a cost, you know, time, money, and not everything else. For someone listening, and this might be their first time hearing the acronym SSO, what does it mean? What does it do? And if it resonates, how much would something like that cost for a 50-person startup ballpark?
Oh boy. Okay. So single sign-on is where you log into one place and from there you get access to all your different apps. Okay. So you log into a portal and that portal manages, that's the only one password that you need to know. Not to be associated with one password, but it's the only password that you need to know. So SSO is single sign-on. And so you log into a portal and you log in, you'll see a dashboard of apps, whether it's Google or Asana or Office 365, whatever. 22:23 You just click them and then you'll get access to those apps. You don't need to log in again, okay? And then from an administrator perspective, when you're done with the company, I disable that one login, that one particular login, and I keep using acronyms of companies that are out there, it's so funny. I don't mean to do that, but... And then you won't get access to apps anymore and it'll trickle down to all the other apps. Anyway, so that's it. From a cost perspective, you know, it could range from, there's different levels of SSO because there's like single sign-on plus MFA and they keep like adding a million different things and there's a really good feature of SSO where it will check the context of where you're logging in from. 23:07 So if you log in from New Jersey, but then somehow there's a login that comes in Talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, NIST, FedRAMP, GDPR, HIPAA, SSO, IAM, OAuth, phishing, ransomware, pentest, OSCP, NIST, FedRAMP, GDPR, HIPAA, SSO, IAM, OAuth, phishing, ransomware, pentest, OSCP, NIST, FedRAMP, GDPR, HIPAA, SSO, IAM, OAuth, phishing, ransomware, pentest, OSCP, NIST, FedRAMP, GDPR, HIPAA, SSO, IAM, OAuth, phishing, ransomware,
Hey, it's James here.
Really quick. Well done for making it to the midpoint of the episode. If you're enjoying what you're hearing, remember to give us a follow. And if you're really enjoying it, please drop us a review. We'd really appreciate it. Thank you. Now let's get back to the episode.
Yeah, now if you're listening, go do your own research. So how is SSO different from MFA and is one better than the other?
Oh, yeah, one is different. So MFA is just a fundamental, MFA multi-factor authentication. Which requires you to not only know your password but to have some other thing in addition to your password to log in so MFA is where i log in i log in sorry there's two fa there's MFA so where i log into my website using my password and it's going to ask me for a token or number that could be sent to me via sms which is not recommended anymore 24:48 Or an app that's generating a new number every minute. And so you enter that number because it's something you know, which is a password and something you have, which is that token. And so that's what MFA. So MFA is fundamental, like that's like super required. SSO is like a nice to have in an environment that makes administrative access and management way easier to handle. So what about Yubikeys?
I mean, are those better than MFA and single sign-on or are they just in a different bucket?
YubiKeys are a form of MFA, so they act as a factor. So when you log in, you could log into your password and either you enter that token number, or if you have a YubiKey, you enter and use your YubiKey to log in.
And how much more secure, and I sound like a founder asking you for a letter grade here, but how much more secure is a business if they have nothing else besides MFA with YubiKeys?
I mean, that's a great step. If they have MFA with YubiKeys on all their critical logins, especially admin logins, or even all their apps, they're so much more ahead than many other companies out there. Why is that? Because most companies are just, they just username login, username password login, that's it. So there's a couple of different classes of logins, right? So there's a regular login where you just log in and do your thing. But if you have administrative privilege, right, then that's a coveted type of login and access, right? 26:16 So if you are also the administrator for Gmail and your session, if you go to a malicious website or whatnot, and your session gets hijacked or stolen, Then that person now has administrative access to your Gmail workspace and create users and steal drives, data, and all that kind of stuff. And then bank account logins, right? So I think a lot of banks now enforce 2FA, but before it wasn't. But like your Stripe login, right? Do you have MFA on your Stripe login? 26:47 Stripe is the place where most of the revenue for companies lives, or maybe PayPal or whatnot, or your AWS login. So if you're logging into AWS and you have MFA and you're using YubiKeys, that's great, especially for admin logins. So what YubiKey is, is you actually have to physically have the key. So it's less susceptible to being stolen because you actually have to have the key. There's a cryptographic signature on the key there and you press the button to indicate that you are there. 27:22 And it's different than mf you know there's something called MFA fatigue attack where basically people or attackers will prompt an MFA and you're just so tired you're hitting yes and stuff and you just hit yes by accident not realizing you just let an attacker in so yubikey helps slow that down and i think that's a fundamental thing to understand is all these things are not like one all v alls right they're just a step in helping slow down an attack Talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria
Yeah absolutely and i think it's important to bring up the types of attacks and what's actually happening for small businesses for startups right and in my perspective it feels like a lot of the market from the vendor side is selling on fud right fear uncertainty and doubt And they're saying hey you have your car parked in your driveway and you need a SWAT team watching that car 24 7 365 when in reality you likely just need to lock your doors roll your windows up and have a car alarm and then if something happens and there's a break-in the alarm goes off you call the police that's your incident response retainer right and if they steal something you hopefully have backups which you should have and then cyber insurance right just like your car insurance right and so it feels like 28:59 90% of the market is overkill for these startups and these small businesses. How does that resonate with you? Like if Yubikeys is one of the blocks, like, is it as simple as you have vulnerabilities, which is making sure your doors and windows are locked, and then have a way to detect and respond to things? Or do we need all of these other complicated ways to detect alerts and things like that?
No, I'm with you 100%. You remember LoJack? Remember LoJack? Yeah, yeah. Like, you know, tracking your car and know where your car is. I don't know if you've ever seen this video. Maybe we could find it. But like, I don't know if you've ever seen the video of someone trying to steal a car and then flames come out of the sides of the car. Have you seen that? So that was in, I think, South Africa, where carjacking was a really big thing. And so they showed this defense where like flames would come out of the sides of the car. 29:53 So it really depends on like the security that you're trying to do. I don't believe in FUD. I definitely don't believe in FUD. And again, it comes down to threat modeling. What are we trying to protect against, right? And so there's definitely overkill. I mean, like asking a small company to buy a SIM, for example, oh, you need to track all your logs and everything like that. Sorry, I don't know if my video got moved here. Okay. You know yeah you know asking a company to buy a sim and having them track all their logs when they're only like a 10 person or a 25 person startup no but you could tell them hey listen just turn on your logs right so before in aws cloud shell was not enabled by default so a simple thing is just enable cloud shell locks right 30:39 Now, thankfully, finally, AWS, many years later, it's on by default, right? So, and I think the car, actually, I've been using the car analogy lately. So, for example, WAF, you know, people are like, oh, should I have a WAF or not? Like, well, it depends on your application, how good your code is, how much traffic you're getting, right? If you're a really small company and you don't have much traffic, then WAF might not be an issue for you. But make sure you have good code. 31:10 There's a lot of built-in protections like, you know, in Ruby and React that protect against CSRF and some of these basic things. So, you know, but for example, if your code is like several versions out of date, right? Talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria. Listen, we all wear seatbelts, right? 31:42 So you wear your seatbelt, you take a look at your tires, you make sure the tread is good, you make sure all the different things in your car are taken care of, right? But you still might get into an accident, right? It's possible. But the thing is you did what you can, right? And even if you look at the SEC, you know, did companies do everything that they should have done, right? And that's the hard part in security. It's hard to really determine what should have been done, especially when there's a lot of pushback from executive management to like, hey, we don't have time to do this. So you're like Chicken Little trying to scream and sometimes you have to resort to FUD, which is unfortunate. 32:17 So, however, if you don't put your seatbelt on, And if you're the tread on your tires is really like, you know, bare skin, and you know, and then you get into an accident, then you know, what, what went wrong there, right? So I think that's the way to approach it. Let's do all the things from my again, I try to live off the land. So let's turn on all the knobs and switches we can from all the tools that we have already that we're paying for, right? Because a lot of times there's checkboxes are not just not turned on by default. And i kind of i don't want to say blame but i mean right now like file vault is encrypted by default right so if you get a mac it's it's on it's on by default right sometimes people turn it off though you know so that's good there's a lot of things that are done by default i think the industry should do things in their software to turn on by default and that's where i advise startup founders in their product security like i like hey you should build bake in some basic security things like you know 33:12 Talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah,
Defense by default right and they secure by default then the onus of cyber security and all those things would be a lot easier for the everyday consumer and the people in these businesses who are buying these tools if they are secure by default but i don't think people are buying tools because they're secure by default and so it becomes this you know chicken and the egg problem where like why build it if people aren't willing to buy more of what we have to sell because we're doing that
So I've heard this so many times where, oh, it's going to increase friction for our users and things like that. Well, there are some security tools, tooling in your product. If we're talking about product security, right? If we're talking about product security, there are some things you can do to help reduce friction, like passwordless login. Like that's amazing, right? Just like not having to remember a password, right? But there are other instances where businesses have decided to take the risk of poor user security. 34:36 So for example, where a user will create a login and reuse their password that's already been stolen. So like one suggestion I usually have is, Talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria 35:08 Bots use recycled stolen passwords to try to get into an application so they're willing to take the downtime and the risk of a credential stuffing attack versus you know taking care of ahead of time i've seen that happen and that's a business decision however a lot of times not everyone is involved in that decision but you know that kind of then falls on engineering when they get hit with a credential stuffing attack they have to like you know tune their bot things and it takes away from engineering time So it's really like, you know, about deciding what's, and also there's an expectation of security in companies these days. 35:43 So what's the expectation of security that you're taking? Because, you know, a lot of people, I tell people, you know, there's a lot of public companies that don't have a CISO or main security person. They're like, really? I'm like, yeah, there's a lot of companies that don't have someone in charge for security. And so I guess, you know, what's the expectation of security from your users and from the community?
To go back to your question i guess can you re-ask that quite or does that make sense from let's take b2b solutions and b2b companies do you see a demand for secure by default or is this wishful thinking from people that care about the space and want to see a brighter future but not actually tangible in reality where people maybe they aren't asking for it so people aren't building it
No so my philosophy is that if we all take security seriously we're all better off right because think about it when i go log into a health portal i have an expectation that my records are going to be taken care of and there's some sort of security protection for my records to be stolen you know for example there was a healthcare psychology Like a similar like a better health like a better help but in europe that had patient psychology records transcripts of these records stolen and just out there and the and the thief conducted you know was threatening the people to the actual users themselves that they were going to release the data or the transcripts of their personal conversations with therapists like that's scary man 37:20 So, you know, those kind of things. So what's the expectations? So as you know, my personal belief is that if we all take security a little seriously, you know, we don't have to boil the ocean, just like, let's take it a little seriously, then we're all better off as a society. Now, that's That's like a utopian kind of view. But all the different roles, right? So if you're B2B, you can be guaranteed that your enterprise customer is going to have an expectation for you to do security, right? Why? So there's a few things. 37:52 They want to CYA themselves, right? Because in their policies, according to their cyber insurance thing, every contractor they deal with has to do these security things. So it's all trickle-down effect from a CYA perspective. So that's one view. The other view is like, hey, if I'm actually going to use your product in my enterprise for my customers, I want to make sure you're doing the right thing because if you get breached, then I look bad because customers are not going to care where this really happened. 38:22 They're going to care that Talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria I have heard different stories, but like you might have board members that just they want to know they've done the checkbox security. 38:55 They don't really understand like the security complexity. And at the end of the day, they're going to decide to do business versus do security. I've seen it. I've seen them like, hey, we really need to do this. I recommend we do this. You know, they're like, we don't care. We need to make money. So, yeah. So, you know, when the business is in survival mode and they need to like survive, everything else falls down on the way, including security.
Yeah. And so I see that from in terms of shifting our conversation from kind of the demand for secure by default to the influence of VC in the space. You work with startups every day and you're helping them with security. How much of the VC dollars influences the cybersecurity market, the vendor side, the startups themselves? What role does VC play in cybersecurity? 39:50 And can you lift the veil for people who maybe don't think VC has any role in cybersecurity?
I would love to. I have to say I'm not an expert yet on VC. I'm still kind of like learning about the field. It's interesting. The whole VC, VCs are interesting. It's kind of like, you know, a small club in a way. So generally, if they, if a VC is invested in a security company, they're going to recommend that company to be used at the other portfolio companies. So that's the first tier, right? So a lot of times, and then the second tier is recommendations. 40:27 So if a VC has had a good experience with a security company, then they're going to recommend them. But, you know, VCs are cost conscious, right? You know, they are, you know, even though they may seem like there's a lot of money rolling around, But at the end of the day, they're going to do a cost evaluation. You know, like, are we getting what we're looking for, for the cost? And they're going to compare different ones. So, you know, as far as protecting their portfolio, I think, I think, 41:01 I think a lot of times the conversation is not necessarily driven by VCs to get cybersecurity. It's 50-50. I think sometimes the board might bring it up. The founder may be concerned about it because there's a couple of different types of security. There's one, can we just get the compliance checkbox done? And then the other one is, After a while after you've done the compliance now do we actually care about security and i love those i love the latter ones i've actually had the privilege to work with some of those folks where they've already done the compliance work and then now they're like hey we're actually worried about getting a breach because we all know that like compliance is not necessarily great security and so i love that and that's been told to me several times hey we're compliant we have SOC 2 we're HIPAA whatever but i just want to make sure we don't get hit with a breach
Yeah, and it's like once they go down that rabbit hole, then they start to see the bigger picture.
Yeah, because security is multi-layer, you know? You're building a multi-tenant software, right? You want to make sure that one tenant doesn't get access to the other tenant.
How do you protect that?
Right. You know, you, you could, you know, do you have bug bounty, right? Do you have a bug bounty program? This is now for like a more mature startup. Now we're talking like you're a little more mature. You have, you know, if you had businesses now you're expanding and whatnot. And so, you know, do you have a bug bounty? Have you been doing, I mean, pen tests. It's hit or miss, but I like bug bounties, right? Because bug bounties are continuous and they're in your product and things like that. Are you updating your code? You might want to go another step level, another level up and have encryption enabled within column level encryption in your database that's tied to your customers so that only customer A can access customer A data and customer B can't see the data. 42:53 Say your S3 bucket gets leaked, right? If you have another layer of encryption set up, Talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria
Yeah. And so I know we want to get some shorts for LinkedIn and YouTube shorts and whatnot. And I think this could be a really good one. And so I'm going to ask you this question in mind that I think this would be a good clip to clip. Can you explain to the startup founder who's thinking about cybersecurity why checking the boxes for compliance isn't the same thing as securing their organization and their data?
Yeah so checking the box is only going to get you so far checking the box you know is checking the box but it doesn't go deep especially depending on the compliance framework that you're going through believe it or not like compliance frameworks like SOC 2 are not a prescriptive framework you can decide what the scope is and what you need to secure so you know Believe it or not you can get away with a lot you could be compliant but not secure and so how does that work why i mean what does just checking the box look like versus being secure yeah so 44:33 I mean, you know, it comes down to scope. I mean, we could get deep into it, but basically, checking the box means that you've, you know, okay, do you have a policy? Yes, I have a policy. Okay, what's in that policy? I don't, you know, do we go into details about what's in your policy? Have people understood the policy? Is the policy enforced? I mean, like, give me a break. In the policy, it says, if you don't follow this policy, then you could be fired and, or your contract terminated. How many people actually do that? How many people actually enforce their policies? 45:06 Like, you know, give me a break. How many, I mean, let alone read the policies, right? But how many people, so we want to have policies that one are actually in motion and they're actually doing, you know, being done, right? And however, we don't want to follow policy just blindly, right? So policies there as a, Talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria.
It's really interesting because, you know, I don't think a lot of people understand that checking a box for compliance isn't the same thing as being secure. And to your point, it says, do you have a policy in place? It's like, yes. But being secure means enforcing that policy and having systems and procedures and tools in place to detect people who are breaking the policy and having a playbook to take action on that. And that's what being truly secure looks like. 46:15 It's something that I think needs to be talked about more often, especially for startups who, to your point, are just trying to check the box so they can do business with larger organizations, right? And so they don't get hit with fines. But being secure is really where the focus needs to be. How difficult is it for you and your conversations with founders if they come to you and say, we just need, you know, to be compliant?
Like do you push back on that and say hey you need to be thinking about being secure as well or do you say great here's how i can help yeah you know true security is about culture true security is about culture so i tell them yeah and i have a whole section of my course about just about culture Because culture is really where true security is going to come into play. And we'll talk about that in a second. Like, so, yeah, I can, you know, a lot of times someone comes to me and say, hey, I, you know, the one thing I love the most is like, I want to know my unknown unknowns. 47:11 Right. You know, I can, we can do a deep dive and go through all the things and I'll give you a list of things to do, you know, to take care of your security. Now, if I come back six months or a year later and find that you haven't done anything in that list, you know, what's the benefit of, what's the, you know, that hurts me inside, right? Like, us security people want to see people like following our advice. And some of my best clients have graduated because they actually followed my advice and they, you know, I helped them hire full-time CISOs. It was like, it was awesome. So, but let's go back to security culture. 47:41 Let's go back to checkbox. So, okay, let's go back to encryption, for example, right? So let's say we have the checkbox say device encryption is enabled.
Great.
Okay, cool. Now, but, okay, so you have device encryption enabled, but what if your users are downloading CSVs of patient data and putting it on their USB disks? Right? Because now you have also a policy too, or not even, we didn't have to go that far, but say they're just downloading the data or, you know, emailing it and things like that. Again, you can have that covered in your policy, right? Don't email this information, things like that. But if we have a security culture, that's what I'm trying to get to. If we have a security culture, people are going to think twice about handling sensitive data and throwing it all around. 48:24 If they see something being done incorrectly in a different part of the org, they're going to tell that person or tell the security or engineering or whoever it is that's in charge of security, hey, I think we're not doing this well, we should probably do it this way. Because the people that know the most about a system are going to be the employees and the builders. A lot of people want to do the right thing from security. Sometimes they're not informed or enabled. And so if there's not a path, take a look at the SolarWinds. I didn't want to go down that path, but a lot of people inside knew that security wasn't being done correctly, right? 49:00 And so you have engineers. I've worked with engineers. They're like, we really need to do this. Can you help me, Ayman? Ayman, can you help convince manager this that we can do this? I'm like, okay, I'll give it a go. Because these engineers know what good security looks like. But a lot of times the pushback comes from the I'm like, do not put API keys in code. Like, let's, you know, things like that. So, you know, my long answer, my antidote to checkbox security is security culture. 49:34 I guess that would be it. You know, having good security culture where it's culture is part of the company, just like in any startup, you have startup culture and the culture of the company, every company has a different culture, right, based on leadership. Same thing with security. It's the same thing.
Yeah, absolutely. And where can people read more about security culture? It sounds like you've put some things together.
Yeah, I have a newsletter. I have a bunch of things. My newsletter is called Last Week as a vCISO. But everything Ayman, I'm trying to consolidate it to coffeewithayman.com. So from there, you could find my newsletter. You could find my company, Cloud Security Labs. So you can find me on Twitter or LinkedIn. So coffeewithayman.com or coffeewithayman on Twitter. And yeah.
Yeah. And for the LinkedIn power users who are listening, Ayman, if they follow you, what sort of things are you going to talk about? What will they see in their feed?
Oh, they're gonna see a bunch of videos. So I have a bunch of videos just like this, where I just break down security into plain English terms. So yeah, definitely follow me on LinkedIn. And my feed is going to be littered with just security advice. I just like Keep putting it out there. Sometimes I get a little, you know, snarky, but not all the time. But it's more like just chill security. Like, here's how it is. Not too complicated, not too curmudgeon. Actually, not curmudgeon at all. 50:55 Actually, there's a lot of curmudgeon security out there. I try to be the anti-curmudgeon. I love it.
Chill security. I mean, that's so cool. Ayman, thank you so much. This was awesome catching up. I can't wait to go back and watch this episode and just gave so many insights to startup founders and small business owners and made it really easy for folks to understand. I mean, Ayman's the guy that is really setting the bar. So thanks for joining.
I appreciate it. Welcome to Security Cafe. Join the community. I got some courses in community coming up. So I would love to have you. It's called Security Cafe because I love coffee, as you can see. So coffee and security are the two things I like the most. Beautiful.
Ayman, thank you so much, man. I'll talk to you soon. All right. Thanks a lot. Take care. All right. See you. No BS Cybersecurity is brought to you by SIFT.ai. Remember to subscribe wherever you listen to your podcasts. On behalf of the team here at SIFT, thank you for learning with me.