Author: Daisy Steel

Matthew Chiodi, the Chief Trust Officer at Cerby, joined us on Episode 37 of The Cyber Security Matters Podcast to share his insights into the industry. One of the topics that stood out to us was the best practices that he shared from Cerby’s work on securing cloud-native applications. Here are the highlights of his answers: 

“When people say cloud-native application, that refers to applications that are built cloud-first. If you have a VM that’s running on-prem and you move it to run in the cloud, that’s not cloud-native – that’s just cloud transferring. Quite frankly, it’s a waste of time and money to do that. Cloud-native means that your infrastructure was not built manually, but it was built using infrastructure as code templates, defining what your infrastructure would look like in code first. Then you’re using code to bring up things like lambda functions that only work during a certain period of execution. That doesn’t use a typical VM, it’s usually a microservices-based architecture. 

When it comes to cyber security, the basics still apply. Organisations have a massive data sprawl issue in the cloud because it’s so easy to upload to. If you go back 5+ years ago, if you needed a new data store, you had to open a ticket with your IT department and wait 2-3 weeks or even months, depending on the size of the organisation, before you got access to it. Data also tended to be much more centralised, and there were checks and balances. For a lot of cloud environments, that’s not a problem anymore. Developers generally have a fairly high level of access to create new services and they can create new data stores on demand by calling APIs, so you tend to get data in all different places. 

You have to know where your data is and what it is because if you don’t, sensitive data, like personally identifiable information, can easily end up in the wrong place. Health information that was intended to only be in a production environment can very easily be moved to lower environments that don’t have the same level of governance. I’d advise having a good tool that can tell you what you have and who has access to it. 

Knowing your code – specifically your application security code – is still highly important because you might know where your data is, and who has access to it, but if you’re writing crappy code, you’re introducing a vulnerability to your digital environment. So, you have to know who has access to your data and your code. If I get access to your data, I can do what I want with it. Or, if I get access to your code, I can inject things into your code that will then give me access to your data. 

In terms of what Cerby does; I usually say that in all organisations, you have two different types of applications. A lot of times we think of cloud apps versus on-prem apps, and that’s true, but really it comes down to identity and access management. You have standard apps that you can very easily integrate with your identity provider, and your IT team can manage them centrally in terms of who should have access through that type of identity provider. The other category is what we call non-standard applications or disconnected applications. This is a massive problem space because the apps that fall into the nonstandard category can’t be managed with your central identity systems. Cerby is focused on that non-standard space. 

We connect those non-standard applications back into identity platforms on trial ID. We did a little bit of research last year, and what we really wanted to understand was the scope and scale of the problem, and we found that organisations have a median of about 175 of these non-standard apps. We’ve spoken to some large healthcare companies who have 1000s of these, and we know there are hard costs associated with these applications because if you as an IT admin in one of these organisations have an employee who needs access to one of these non-standard apps, they can’t go through any kind of automated process – they can’t go into your access request system, they’re going to put a ticket in. Once you get to it, you have to manually log into this app, figure out what access they need, etc. and it’s all a lot of hassle. We make it so that you can centrally manage these non-standard disconnected apps, using your existing native tools.

To find out more about securing cloud-based applications, tune into Episode 37 of The Cyber Security Matters Podcast here. 

We sit down regularly with some of the biggest names in our industry, we dedicate our podcast to the stories of leaders in the technologies industries that bring us closer together. Follow the link here to see some of our latest episodes and don’t forget to subscribe.     

As the Cyber Security industry expands, growing your team has become more difficult than ever. On Episode 36 of The Cyber Security Matters Podcast we spoke with Julia Doronina, the Co-founder and CMO at G-71 Security, about the challenges she’s faced when it comes to scaling her team. Julia is also a passionate advocate and mentor for women in tech, giving her some valuable insights into diversifying the sector’s talent pool and making it more accessible. 

What are the key talent topics that need addressing the most?

I believe that it’s important to focus on employee development and to provide opportunities for career growth. With the rise of artificial intelligence, there are many new solutions and projects on the market, so companies and executive teams need to encourage their employees to learn new things and understand these new approaches because they can help optimise processes. The main thing is to support your employees and help them to grow themselves.

Do you struggle to hire based on talent shortages?

We’re a startup and we don’t have a big team right now. We were dealing with different outsourced people who can help us with different activities, like design, copywriting, analysis, and so on. I think that it’s very important when you’re talking with people who you want to attract to your company, to talk to them about the use cases for their skills, not just their CV, to understand how they think and how they can implement their skills into your business. Figure out how they can expand your current situation or activities. 

Early in my career, my skill set was straightforward. I knew the general and traditional channels, and I implemented them. Now I’m trying to use AI. I use Chat GPT, about 20, 30 or even 40 times per day for different tasks because it can help me optimise my processes. My worldview and approach to problem-solving are changing as the world evolves, and I think that we need to encourage people to develop themselves in the same way.

There’s a lack of diversity at a grassroots level, so what can we do to address this?

We need to create an inclusive culture in companies, even in startups. We need to include different inclusivity training and actively attract candidates from diverse demographic groups because they have a lot of insights and skills. It can be great to create programmes to support the development of underrepresented people. It’s important for companies to actively support these initiatives, mostly from the executive point of view, because they are the drivers of the company, so they need to support it.

To hear more from Julia, tune into Episode 36 of The Cyber Security Matters Podcast here.

We sit down regularly with some of the biggest names in our industry, we dedicate our podcast to the stories of leaders in the technologies industries that bring us closer together. Follow the link here to see some of our latest episodes and don’t forget to subscribe.     

Cyber Security is a growing sector, with plenty of startups evolving in the space to meet the need for unique solutions. On Episode 35 of The Cyber Security Matters Podcast we were joined by Alexandre Sieira, the Co-Founder and CTO of Tenchi Security, to talk about his experiences of startups and entrepreneurship within the sector. Alexandre is an executive with over two decades of experience in cyber security who is currently focused on helping companies leverage the benefits of cloud computing with security compliance through his startup, giving him some great insights into the topic. Here are the highlights of our conversation. 

What’s it like running a security startup?

It seems so glamorous – like it’s all staying in swanky hotels and talking to high-flying financiers in the VC world. Actually, it’s a lot of hard work. It’s it’s long hours. There’s no limit to the work you have to do – you can’t just say, ‘This is not my job description’ because, as an entrepreneur, your job description is infinite. When you’re an early-stage employee or a founder, you have to do everything from carrying boxes to making customers their coffee. You’re writing proposals, paying the accountant, double-checking the tax calculations, interviewing, hiring and leading people. It’s super hard to find people that are decent at all of those things or that enjoy doing all of those things, so at least 40-50% of the time, you’re doing stuff you’re not very good at or that you don’t enjoy until the company becomes big enough to hire people who are specialised in that task. You have to have a lot of energy to keep working, and you need a high tolerance for doing things you don’t enjoy. But the upside is getting to build something from scratch, and that’s super amazing.

You’ve been involved in several startups. Can you pinpoint any key themes that have made them successful?

It seems obvious when you say it, but you need to be doing something that people need. In technical startup terms, that’s called product market fit. You need to be building a product or service that people actually need and are willing to pay good money for. Then you need to execute it well because even if you are building something that people are willing to pay for, if you don’t make them aware that you exist, or you’re spending more than you’re earning on marketing, you’ll go broke. It all comes down to ideas and execution.

What do you think are the key ingredients you need to get investment?

I’ve been involved with three companies, one of which we started bootstrapped, then raised private equity for very late in the game. That was CIPHER. With a services company, it’s super easy for you to finance yourself, and you typically don’t need a lot of investment at the beginning like you do when you’re building a product. It’s very easy to get started and generate cash flow if you’re in the services business and you know what you’re doing. We wanted to do international expansion, so that’s when we raised private equity, which is a whole different ballgame from venture capital. 

Then with Niddel, we were a product company, but we weren’t bootstrapped. We could afford it because we had sold CIPHER, so we were using our own money to work for a year without getting paid because we had our savings. With Tenchi, this is our first VC-backed company, which is a completely different experience. It’s a different kind of sale. But, if you know how to run a company and you know how to sell, you just need to figure out what the buyer wants. You need to find the right buyers for what you’re selling and figure out the best way to communicate what you’re offering to them. Fundraising is no different. You need to be able to describe what you’re doing and why it’s interesting, and you need to find the right VCs who are active in your industry or sector but don’t have a conflict. 

The biggest difference is that when you’re talking to a customer, you’re saying, ‘Hey, this is the product, these are the technical features, these are the benefits of using the product’. Whereas with VCs, they’re looking for different things. They’re trying to assess the team background, dynamics, founders etc, especially if you’re an early-stage startup. The thing you need to think always when you’re talking to VCs is that much like security people, they’re trying to mitigate their risks. They’re so interested in founders because a lot of companies and founders fight amongst themselves and split up. Venture capital is a high-risk investment strategy, so you need to try to mitigate your risk for them as much as possible. 

What makes a good entrepreneur?

You need to have a high tolerance for pressure, handling setbacks and adjusting to doing everything yourself. There are a lot of people who flourish in the large enterprise environment where your job is narrow, and they get super specialised in what they do. They get to know everyone, work the political channels inside the company to get things done and they get joy out of it. One of my startups was acquired by a large company, and we were able to deliver amazing results there, but I did not enjoy the process of working there as much as doing entrepreneurship. 

If you get the right person in the wrong environment, they’re not going to succeed. There are people that would be amazing at an enterprise that would suck at being entrepreneurs. I’m the reverse; I think I’m good at entrepreneurship, but if you put me in a large political enterprise with lots of well-established processes and bureaucracy, I’ll slowly wither and die. It’s just I’m not going to enjoy myself and I’m not going to flourish. It’s all about matching the person with the environment. 

To hear more from Alexandre, tune into Episode 35 of The Cyber Security Matters Podcast here. 

We sit down regularly with some of the biggest names in our industry, we dedicate our podcast to the stories of leaders in the technologies industries that bring us closer together. Follow the link here to see some of our latest episodes and don’t forget to subscribe.     

Gender diversity has been a pressing issue within the cyber security industry for a number of years. On Episode 34 of The Cyber Security Matters Podcast, we were joined by Julia Weimer, the Director of Professional Services, EMEA at Lacework, to discuss the issue. Julia is passionate about gender diversity in cyber security, and actively participates in industry events and forums as an advocate for women. Julia regularly shares her insights and guidance with aspiring professionals to empower them in entering the cyber security space. 

Do you think mentoring and public speaking are good ways to spread awareness of women in STEM and tech? 

Absolutely. This is an opportunity for women to speak but also hear about the struggles of women in the industry. That helps people in the room feel like they’re going through a similar experience to the speaker or maybe find a nugget of inspiration to take on a new challenge or do something different. I think that it’s worthwhile to explore events like that with women and men. I say that based on the sheer numbers alone because there are more men in the industry, so we will need their help to get us to the next stage. 

I’ve witnessed the benefits of sponsorship in my own career. If we can bring more men into the mission that we’re on, we’ll have an equal composition of men and women in tech in the industry much faster. I really do believe that the more we can bring our male allies in the better the industry will be. We can empower them to speak on our behalf when we are not able to, bring a woman to a meeting that she wasn’t invited to, and speak up on our behalf when they know that we’re not being paid the same as our male counterparts. Those are opportunities for us to bring men into the conversation and realise it’s a men and women problem.

What advice do you have for male allies who want to stand up for women more?

Invite them to that meeting, include them in the conversation, and get their advice. Getting feedback from diverse perspectives is so important in the business world, because business can be quite boring if everybody has the same perspective and the same opinions. It’s it’s healthy to be challenged and see problems from a different viewpoint. Invite women to meetings, speak up for them, and if you notice a woman is quiet in the room, ask for her advice after the fact or ask what she thinks during the meeting to make her feel included.

What advice would you give as a mother who is successful in your career?

Being a woman and mother in tech specifically makes you realise that so many things outside of motherhood really don’t matter. It’s given me the confidence to know that if I need to take my child to a doctor’s appointment rather than taking a meeting, I will do it every day. I’m privileged to have a job where that’s okay and where my peers respect that. My advice to other full-time working mums is to lean into both. You can absolutely have both. Don’t let anyone make you feel bad for choosing that lifestyle. 

A lot of mothers have faced judgement for choosing not to stay home – there’s a lot of judgement that’s passed on women in general. But as a mum in tech, I truly lean into both. However, realising that you can’t do it all is important too. By that, I mean making sure that you can let your to-do list carry over to the next day. If you have responsibilities at home and in your job, you have to recognise that you may not get to everything that day, but be able to make the right decision for yourself. One of the key points when you look for a new role is whether you will have the people around you to support what you’re trying to do as a mum but also as a full-time employee.

What’s one piece of advice you give to someone entering the industry?

Women statistically do not apply to jobs that we do not feel qualified for. If there’s a job that seems interesting to you, apply for it. It just takes the first meeting for someone to see your potential or hear what you have to say. I think there’s no problem in saying ‘Why not’ and just going for it and giving it your best. 

Breaking into the industry has seemingly become harder. It is about using relationships to open a door. The more networking events you can attend, the more people you can meet and interact with, the better. You’ll meet respectable people in the industry who can help you and connect with you on LinkedIn so that when you’re asking for help and using the network to be able to do that, the right people will see it.

To learn more about gender diversity and the opportunities for women in the industry, tune into Episode 34 of The Cyber Security Matters Podcast here. 

We sit down regularly with some of the biggest names in our industry, we dedicate our podcast to the stories of leaders in the technologies industries that bring us closer together. Follow the link here to see some of our latest episodes and don’t forget to subscribe.     

Mobile application security is a growing part of the Cyber Security industry. To help us understand and address those challenges, we were joined by Chris Roeckl, the Chief Product Officer at Appdome, on Episode 31 of The Cyber Security Matters Podcast. He shared his perspectives on the state of the sector, his insights into the key challenges of keeping mobile applications secure and its impact on compliance. Read on to find out what he said. 

How do you assess the state of the mobile security space as a whole?

The mobile app security market is rapidly changing. There are lots of reasons for that. Probably the most important one is that mobile apps are now the dominant channel for interacting with digital brands. It’s not about websites anymore, it’s all about mobile. The bad news here is that people who break into networks are zeroing in on mobile apps, which is driving the mobile security market. 

The challenge, particularly in today’s economy, is that CISOs and other decision-makers within mobile app security don’t have as many resources as they had in the past. They are either freezing their hiring or letting go of developed cybersecurity engineering teams just to cut costs. It’s like that old analogy of cutting off your nose to spite your face, but it is the reality of business today. They’re also trying to zero in on how to do more with less because 

budgets are under scrutiny. The thing is, bad actors aren’t taking the day off because of budget cuts and personnel reductions. The number of attacks just continues to grow and grow and grow. 

We don’t like to focus on scaring our customers or prospects, we want to help them. We don’t spend much time talking about the bad actors doing bad things, but they are, and the mobile brands we support know that. We don’t have to take that message to the market, so our focus is on getting them to an outcome. How do we how do we solve this problem? Every mobile brand’s challenge is unique, and our goal is to make sure that we can solve those unique challenges for them. 

How are these key challenges within mobile application security addressed?

The first thing that you have to realise is that web-based and desktop apps basically all have the same technological components, which makes it fairly simple to solve security problems. Now, in the mobile world, apps are built with 15 different development frameworks, which you can mix and match. You may have heard of things like Swift, Java, or Kotlin. They’re all different languages that you can code in. That creates unique scenarios. It’s not homogenous; it’s heterogeneous, which makes mobile app security difficult. 

The other thing is that there are a couple of different approaches to solving that. If you go back 5, or 10 years, software development kits were developed by security companies for mobile, and they basically give you some code. Your job as an enterprise or mobile brand was to add and maintain that code in your own application, which had its own challenges. The most simple challenge was that the software development kit you got might only work with 3 of the 15 development frameworks, so as a mobile developer, you have to make a choice to say either I need to rewrite my app to get in the security bits, or I need to go look for some other solution and then cobble it all together. 

At Appdome, we decided to take a completely different look at the market. We built a machine that takes account of all these frameworks and then builds an implementation of the security based on the buttons you tick on the platform for the security protections you need, and delivers that solution, with no coding needed. In a world where you’re losing resources, we think the movement to more of a machine-based approach to mobile app security is going to win the day. 

How does that impact the compliance side of things?

Cyber compliance is a really critical topic. Firstly, there are external regulatory compliance requirements. Secondly, there are a bunch of internal-facing requirements. Mobile brands oftentimes publish some sort of cyber pledge on their website for general security, saying ‘We protect your data this way.’ What is becoming very apparent is that those cyber pledges apply to the mobile app too – it’s not just about the website anymore. It’s not just about the way that your data is protected in the backend infrastructure; it is all about the mobile end user using a mobile app. 

Being able to do things like ensure that the cyber protections are actually built into the app is a cyber requirement, but the work is done by developers. So how do you bring the developers and cyber team together? Do you produce artefacts within the production process that say, ‘This encryption was added’, ‘Obfuscation was added’, or do you reverse engineer whatever the features are that the mobile brand is looking for? The ability to do things like UI testing is super important too. All of those compliance elements have to fit together into this jigsaw puzzle called mobile app development. Over the last two years, we’ve seen this go from kind of a low-level thing to a high priority within cyber organisations.

To find out more about securing mobile applications, tune into Episode 31 of The Cyber Security Matters Podcast here. 

We sit down regularly with some of the biggest names in our industry, we dedicate our podcast to the stories of leaders in the technologies industries that bring us closer together. Follow the link here to see some of our latest episodes and don’t forget to subscribe.     

There are talent shortages across the Cyber Security sector, and startups are no exception. On Episode 30 of The Cyber Security Matters Podcast we were joined by Crystal Poenisch, the Director of Product Marketing at Chainguard, to talk about her views on the talent issues facing the sector. Read on to find out what she said. 

What do you think companies can do to attract people from diverse and non-traditional backgrounds into the cybersecurity industry?

I think they’re already attracted – I think they’re desperately trying to get in. There are people more qualified than me that can’t get jobs. Companies need to make their company accessible and welcoming to diverse people from different backgrounds. I couldn’t be a director at a public company, they had to give me a ‘head of’ title because I didn’t have a master’s degree or an MBA. That was just five years ago. There are people who are attracted to the industry, so it’s about recognising the ones we can bring in and train up and not looking at it like we’re training them from the ground up. People from non-traditional and diverse backgrounds are often the fastest learners and the most agile and innovative people I’ve ever employed. 

How have you seen diversity kind of change in the industry since you joined?

It hasn’t changed as much as I’d like. I wish it would change more. I think one big thing that is really heartening for me is that there are male allies and allies across the board for people from all backgrounds, not just women. There is a lot more blatant support for these things and a greater recognition of the need for diversity. We need to hire more people, so more people are coming in and it is more welcoming. I see that the women who have come after me have had a much easier time, and it’s a lot easier to join now as someone from a non-traditional background.

You mentioned that bringing in people from a wide range of backgrounds benefits growth. Could you explain that a bit more? 

When building a startup, you need people with skin in the game who want to win as much as you do. People who have not been given a shot are gonna be pretty hungry to win, and I think that was our competitive advantage at Okta. We intentionally hired people from non-traditional backgrounds all over the world, and we adopted an international, remote-first style of work, even before COVID. 

We said, ‘Let’s get people from all different backgrounds who align with our values, and hire team players who are resilient, who want you to win, and who aren’t just in it for the paycheck. We’re looking for the people who are genuinely trying to change their lives, and get into cybersecurity to make their life better for their family.’ Those people are deeply invested in your success and are going to help you grow in ways you may not even imagine. They have so much to offer from different backgrounds, and that will come in handy when you really need utility players who are passionate about your company. 

What are the key talent topics that need addressing the most at the moment?

I can only speak for what I see in startups, but I think the Cyber Security industry faces a massive talent shortage. There are stats out there saying that there are a million jobs that we need to fill that we’re not filling. There’s a lot of people saying we could just automate those roles, we don’t need to increase diversity, equity and inclusion in the talent base, or that we could figure out a technical solution. I don’t want to say that’s naive, but we need to think bigger than that. 

Some leaders do this well, but I think we don’t hire for things like grit, resilience or people who have something different to bring to the table. When you have people always solving the same problems the same way from the same backgrounds, you become worse problem solvers. We need to adopt the mindset that we have done a less than sufficient job securing our critical infrastructure for the last however many years because no one has paid attention to the industry as a whole. It hasn’t been regulated, and diversity has not existed in Cyber Security. We’re seeing a lot of holes, and we’re seeing the pitfalls of that. 

There are a lot of problems we cannot solve in this industry right now because we don’t have enough innovative people involved. I speak from a Western and American perspective, but our biggest challenge is finding talented people. We need to learn to recognise talent in a more broad and cross-functional way because different people bring a lot to the table. If they haven’t been working in cybersecurity for 20 years, that might actually be a benefit. We need to learn to recognise different skill sets that maybe we haven’t had traditionally. 

To hear more from Crystal, tune in to Episode 30 of The Cyber Security Matters Podcast here. 

We sit down regularly with some of the biggest names in our industry, we dedicate our podcast to the stories of leaders in the technologies industries that bring us closer together. Follow the link here to see some of our latest episodes and don’t forget to subscribe.     

Diversity and inclusion have been prevalent topics across the Cyber Security industry for a number of years. On Episode 28 of The Cyber Security Matters Podcast we spoke to Aarti Gadhia, the Principal Security Specialist at Microsoft and the Founder & CEO of Standout To Lead, about her perspectives of diversity in the industry. With over 15 years of experience in the Cyber Security space, as well as being named as one of the Top 20 Women in Cyber Security Canada, Aarti has some incredible insights on the topic. She also shared her advice for companies who are looking to address diversity at a grassroots level, which you can read below. 

“Change is taking place – which is good – but we need to accelerate that change. There are so many statistics that show how far we still have to come. ERG’s have been formed to influence changes at an organisational level, but everyone has to solve this problem. We shouldn’t just leave it to the affected groups to solve it. The first thing we could do better for diversity is acknowledge that everyone has a bias, including me, and we need to challenge it. Hiring managers need to find ways to challenge their own biases, which means starting by looking at your existing process and seeing where you could improve it. Each hiring manager needs to challenge their own process and look beyond just having 50% of resumes that are from diverse candidates. That process needs to be changing. 

The industry as a whole has been talking about changing the requirements. Instead of putting the emphasis on the number of years’ experience that you need to have in order to get a management position, the emphasis should be on demonstrating strong leadership qualities, right? Just changing that will give people an opportunity. There’s a great one that I saw on LinkedIn, where men get hired on what they’ll bring to the company or role, versus women, who are hired based on what they have to prove. Give everyone an opportunity! Instead of pursuing the standard or traditional qualification you’ve always hoped for, change your requirements to give other people a chance. 

After that you need to look at retention. The industry is doing a good job in bringing more women, but that’s not what it’s about, because at the same time women are leaving the industry. There are two reasons for this: the first is a barrier for growth opportunities, and the second is a lack of inclusion or belonging. We’ve heard in one of your other podcasts someone who shared that she was told she was emotional at work. The issue is that feeling of being labelled. We don’t feel welcomed when we can’t bring our true authentic selves to work, and that’s why we leave. 

I’ve seen many organisations try to solve this problem by sending us all on leadership courses, but it’s not about a lack of leadership skills. It’s about opening the doors and fixing that broken rung on the ladder. You’ve got women in your company, but what are you going to do to retain us? Are you going to give us the opportunity to develop? That’s another thing that the industry needs to really think about; how do we grow diverse talent and retain them? How do we make sure that they can continue to be their authentic selves? 

Finally, we need allies. We’re seeing allies in the industry who are supporting us, but we need more to take action. I get so many allies that come to me saying, ‘this is important because I’ve got daughters’. My next question to them is, ‘if you didn’t have daughters, would this still be important to you?’ It shouldn’t be a checkmark exercise for individuals. Everyone needs to solve this problem. It shouldn’t be hard to solve this problem if everybody’s on board. For allies, think about what you can do. Start thinking about what you can start implementing – don’t wait to be told. Don’t worry about saying the wrong things, because what really matters is that you’re genuine. We just need your voices. We need everyone to be on board, because that’s how change is going to take place. Try different things out – even try reverse mentoring. There’s a lot that you can learn. Try seeing things through our lens to better understand what’s happening. 

There’s a lot I could talk about when it comes to what needs to change. Fundamentally though, it comes back to those three things: bias, retention, and allies.

To hear more from Aarti, tune into Episode 28 of The Cyber Security Matters Podcast here. 

We sit down regularly with some of the biggest names in our industry, we dedicate our podcast to the stories of leaders in the technologies industries that bring us closer together. Follow the link here to see some of our latest episodes and don’t forget to subscribe.     

The role of a Chief Technology Officer develops as rapidly as the technology that they work with. On Episode 27 of The Cyber Security Matters Podcast, we were joined by Nurettin Erginoz, the CTO at Radiflow, to explore his experiences in the role. Here’s what he said:

Can you tell us about your journey to becoming Radiflow’s CTO? 

I had just started as a teaching assistant at the University when DDoS attacks became much more popular in some hacking groups. They were targeting some government places and agencies. I got an invitation from one of the companies that is famous for innovative application firewalls and DDoS mitigation and protection services. I joined them as an information security management and technical director. 

Then IBM has a role there too. I was initially responsible for Central and East Europe there, but they upgraded my position to the whole of Europe. That gave me the chance to meet different cultures and see different attacks in different geographies and sectors. 

A big milestone for me is going to big educational places or different sectors like government, military, etc. to see exactly what is happening there. I built a team as a Deputy General Manager from scratch – I created the whole cybersecurity team and SOC and forensics labs as well. Afterwards, I jumped into a startup, which we took to exit in three years. I got hands-on experience with mergers and acquisitions, then transitioned directly into this CTO position, concentrated on the strategic part, because security is a live sector. 

Even day-to-day, everything is changing in our sector, so strategy is very important here. From a product perspective, the attack surface and technical elements, together with the strategic selling points, mean that there is a lot to stay on top of—even before reaching regulatory milestones.

What are the main challenges that are that are faced by any CTO?

For any CTO, it is a challenging role. Previously, it would have consisted of managing the research and development team and focusing on coding, but now everything is changing. We have DevOps teams and SEC ops teams, and everything is connected. The threat landscape is changing too, so CTOs have to understand whether they’re coming from cyber or not. All CTOs have to understand the threat landscape, because of the concerns around security and balancing it with business goals. The product should be running without security blocking its process or development. 

Compliance and regulations are another challenge for CTOs. The number of regulations is increasing day by day, so CTOs are having to get familiar with the area that their product or company is in. When their management adds another topic connected to the supply chain, that adds more security as well that we have to understand. It’s a CTO’s responsibility to manage the vendors and understand performance and risk levels as well. 

There are so many challenges to juggle, like incident response, cloud security, IoT mobility, and the board and executive committees’ coordination. Communication is another big topic that all CTOs must concentrate on because we are always talking with stakeholders. 

To find out more about life in a CTO role, tune into Episode 27 of The Cyber Security Matters Podcast here. 

We sit down regularly with some of the biggest names in our industry, we dedicate our podcast to the stories of leaders in the technologies industries that bring us closer together. Follow the link here to see some of our latest episodes and don’t forget to subscribe.     

The Cyber Security industry faces challenges on a daily basis due to the nature of its work. However, its challenges aren’t just security threats. On Episode 24 of The Cyber Security Matters Podcast we were joined by Michele Chubirka, a Cloud Security Advocate at Google, to talk about the wider challenges in the industry. Michelle has led a remarkable two-decade career in cyber security and has a background as a cloud native expert, giving her a wealth of insights into the space. Here’s what she shared with us: 

“Information security can be a struggle. There’s something called witnessing windows or common shock, which is when we see the small violence and violation that happens in our day to day lives. Well, that’s information security to a tee. You have the big breaches and traumatic events – you’re reading about it now with the movement hacks, ransomware, etc. – but every day you experience the vulnerabilities in your organisation. You report on them, saying ‘Hey, you have these vulnerabilities and they don’t get remediated’, and the solution technically seems very simple, but it’s really an adaptive challenge because it has a lot of dependencies and unpredictable human beings are involved. 

A lot of security people experience burnout after a while, because you want to do the right things, but there’s a social issue where people don’t or won’t collaborate well enough to solve the problem. Cyber Security is a challenging field because people are drawn to doing technical things and being engineers, but then find out that they have to work with people, which is a very different skill set. When I started, teams were super small and you could solve a problem end to end yourself. That’s not the case anymore. Now you have huge teams of hundreds of people working on a single application. Now you have to worry about getting people to talk to each other. You have to resolve conflict. 

I wish somebody had taught me to improve my people skills as well as focussing on my technical skills in my professional development. The social science that I’m studying is restorative practices and restorative justice, which is about building human capital or social capital by finding ways to repair harm, restore relationships and build community. If our organisations and companies aren’t communities, we’re going to struggle to build a truly secure cyber environment. 

The problem is that people are really attached to this idea of security being like law enforcement or a military framework. We think of threats as attackers, and there’s a lot of accepted victim shaming. When something happens within an organisation and the bad guys leave, you’ve got to clean up and recover from the trauma of what happened. That’s when the blame shifts. People start asking ‘Who can we blame internally for this problem?’ Then you get some victim-perpetrator oscillation where there’s a blaming game. Then the victims are being held to account as perpetrators because they didn’t secure their systems or they didn’t do the things that you asked them to do. That’s not helpful. 

There are a lot of reasons why developers don’t always write secure code or update their dependencies. Sometimes the systems that security people put in place are not friendly or easily consumable. Developers may be under really tight timelines and they’ve got way too much on their plates, so how much is really their fault? There are often swirling, interpersonal, conflict-ridden situations that create anger and resentment, because security professionals are doing their best but they feel like they can’t make enough change. This is exactly what happens when you’re faced with these witnessing windows, where people are disempowered but aware of what’s happening. When you’re in that situation, you know what the problem is but you can’t change it, the results are stress and eventual burnout. 

That’s really the problem with information security right now. People are building great technologies and there are new techniques coming out every year, but the attacks only get worse, and the job seems to get harder. So what are we doing? I think the reason that the situation is the way it is is because we’re having people problems – it’s not simply a technology problem. 

To learn more about the challenges facing the Cyber Security industry, tune into The Cyber Security Matters Podcast here. 

We sit down regularly with some of the biggest names in our industry, we dedicate our podcast to the stories of leaders in the technologies industries that bring us closer together. Follow the link here to see some of our latest episodes and don’t forget to subscribe.     

In recent years there have been growing concerns around privacy and data loss. On Episode 22 of The Cyber Security Matters Podcast we spoke to Chris Denbigh-White, the Chief Security Officer at Next, about data loss and how it’s affecting the industry. Here are his thoughts: 

Data loss prevention has always been the ugly friend of cyber security. If you mention DLP to 9 out of 10 cyber professionals they’ll say, ‘this doesn’t work, but we’ve got to do it’. It’s effectively a tick-box exercise, but it’s a box that does nothing. It’s the old adage of a firewall that has allow rules going both ways. We have to do it though, because otherwise some of our users either complain massively, or are blocked from doing their job. That’s something that Next aims to address; we’re trying to provide DLP that makes sense. That means using machine learning to understand user behaviour. 

I like to understand people’s business processes and build guardrails around what they actually need for security. We’re here to ensure that people who do business and make money don’t lose all their data or have it stolen, as well as protecting them from getting massive GDPR fines. Security itself doesn’t make the business any money, but not having security can cost a business a lot. That means that we need to understand what is valuable to the business and find a way to protect it. 

That’s different from typical data loss prevention tools. We need to understand things like ‘how does this company deal with things like insider risk and insider threats?’ We’ll think outside the box, like ‘Why don’t we address risks through behavioural change and training people on better cyber practices, rather than relying on draconian controls?’ I strongly believe that what we’re doing increases business cadence and reduces friction by approaching DLP in that way. That’s something that I think AI and machine learning are going to help people understand better, because they’ll be used to understand the people around us better and therefore they’ll uncover internal and external threat actors more effectively. 

The way that we approach things is by helping companies understand what normal is, and helping them to address the question ‘Am I happy with what that normal is?’ Our solutions are built by asking things like, ‘Do I want people uploading things to this web application and not that web application?’ That’s a well trodden path to data loss. Another common issue is the use of copy and paste. On one hand, I want users to be able to copy and paste because we’re advocates of strong and long passphrases and the use of password managers – all of which utilise copy and paste. But on the other hand, I don’t want people copying and pasting swathes of sensitive data from sensitive apps and into a text file that’s then emailed off. 

We’ve moved away from just file based data loss, because people lose data in more ways than you’d think. There are copy and pastes, web uploads, Chat GPT prompts… being able to understand and control your data in those ways is its own tool. There’s a business process where we help companies identify their normal and their risks, then we set up specialised guardrails in a super simple process. I think that’s the future of the space. Companies that develop schooling to support security that’s done with people are going to succeed moving forward, whereas increasing levels of draconian control and intrusions are going to come to an end. 

To learn more about protecting your data, tune into Episode 22 of The Cyber Security Matters Podcast. 

We sit down regularly with some of the biggest names in our industry, we dedicate our podcast to the stories of leaders in the technologies industries that bring us closer together. Follow the link here to see some of our latest episodes and don’t forget to subscribe.