Kyle Jones: Looking for Guidance for Businesses on Security Policy Development With your SaaS #226

Hello, hello everyone. This is your host, Akhil Jabbar, and welcome back to another episode of SaaS District. In today's episode, we'll be talking about looking for guidance for business on security policy developments with your SaaS. Today we have our guest Kyle Jones joining us. Kyle is a senior cybersecurity analyst at Remedic, who is a cloud security company that delivers cutting-edge cybersecurity, compliance, and data privacy solutions to contemporary SaaS enterprises. Kyle is dedicated to cybersecurity— who is a dedicated cybersecurity analyst whose expertise particularly shines in aligning SaaS cloud structures with industry benchmarks and regulations. So welcome, Kyle. That's been a mouthful. Super excited to have you on the show today.

Thank you. Thank you for having me. It's a pleasure.

So would love to just kick it off. I mean, let's, you know, the key topic of today's episode is really helping our SaaS founders thinking about building or implementing a cybersecurity policy and procedure. What are some things to keep in mind? What are some key considerations that startups should think about when developing their policies and procedures? Or where do I begin?

Yeah, I think it begins with your product or service, right? That's where the business starts, and that's also where your security program starts as well. So when implementing policies and procedures, you want to be aware of the different types of data that you're going to be handling. So if you're a SaaS application, are you going to have healthcare information, credit card information, any type of PII? If you're a service organization and, you know, let's say you You provide like a coaching business, what type of data are you receiving? So it all starts with the types of data that you're going to be dealing with, accessing, storing, processing, and you kind of work from there. And the reason I say that is because if you're dealing with healthcare information, for example, then you have a regulatory requirement to be compliant with HIPAA. And so once you identify that, And let's say you're also a SaaS application, then the industry standard for most SaaS applications is to have a SOC 2 report, right? SOC 2 is not a regulatory requirement like HIPAA. It's more of an industry standard. But if you have PII, you're a SaaS application, these are 2 things that you're going to have to take into consideration, and then you go from there. And so once you identify the types of data, that you're going to be handling, then you identify the regulatory requirements, you identify the industry standards, and each industry standard, each regulatory requirement has something called control families. I'm not quite sure if you're familiar with that, but essentially every cybersecurity framework, every regulatory framework has control families. For example, one control family that you're going to see across every cybersecurity framework is access controls. Right? So you have an access control family, you have human resource security control families. And so once you look at the type of data that you're dealing with and the different control families that apply to the regulatory requirements and the industry standards, then you can draft your topic-specific policies based upon those regulations and industry standards, right? And so when I say topic-specific policies, that means you're going to want to have an access control policy, right? Because each of these regulatory frameworks that you need to comply with based upon the data you're handling, has an access control family, right? So you'll need an access control policy to demonstrate compliance with that. Let's say if you are dealing with PCI, then PCI has a vulnerability management control family. So you're going to want a topic-specific policy for vulnerability management. And so as far as answering your question, you always want to start with what type of data are we dealing with? And once we identify the type of data we're dealing with, we can kind of work backwards from there.

So interesting. So now you've identified the data that you're looking to essentially protect, right? And then on the one side, you're trying to fulfill and make regulatory happy with your procedures and policies. But the other side is like, you know, what are we really protecting? What is the threat here? Maybe you can share a little bit of, you know, as a founder thinking here, what are common threats that we're really trying to, you know, be aware of and build and protect against here? that you've seen are pretty common?

Yeah, that's a good question. The reason policies are important from my perspective is it's protecting us against the biggest threat that we're facing. And the biggest threat that we're facing is people, right? Not to say that we have bad people in our organizations. I believe that people are naturally good. However, if someone doesn't know that they shouldn't be doing something, then they're going to do it, right?

Mm-hmm.

And so the biggest threat is people, and generally that's why policies are most important. And then other threats, right, such as network security threats, there's threat actors, there's hackers that are scanning our networks constantly to see if we have a port open that's not supposed to be open, right? And so if we have policies or if we have certain hardening standards within our policies, then that can protect against certain network security threats, certain access control threats. And so the policies themselves are designed to protect against the different threats that have been identified by our own risk assessments, but also by the risk assessments conducted by regulators and certain industry standard people who are on boards of certain industry standards. So the policies and how they're designed by nature is designed to protect against these threats, if that makes sense.

Makes perfect sense, yeah. So, you know, when it comes to the context of startups, right, like we're looking to, we agree that this is important, we wanna protect against threats, we wanna set up this procedure and policy, but maybe right now, you know, going, starting 2024, you know, budgets and fundraising isn't, you know, optimum. So maybe they're looking to balance a cybersecurity system with maybe limited resources or budgets. What do you suggest to people like that? or founders like that who are maybe facing that constraint? Or even better, is there some kind of AI application or automation that could maybe help streamline some of this process?

Yes, that's a great question. I think the reason I enjoy working at Remedy so much is because usually that is the case, right? We're dealing with SaaS startups that need to build a security program, usually because their customers require it, and they're also working off of a limited budget. And as a security professional, I understand that money is extremely important and you need your business to be profitable, but as far as balancing our security program, usually we start with risk. Because once we look at the different risk facing your organization, you may be motivated to expand your budget a bit or maybe deallocate capital from one aspect of your budget to— and allocate it to your security budget, right? So usually we start with the different risk facing your organization. The first thing we do when we meet with a CEO or a CTO or whoever's leading the security initiative from the particular startup is understand what their risk appetite is, right? So if you have a low risk appetite, that means any medium or high risk that we've identified in our risk assessment, you're committed to remediating them, right? And as far as you know, remediating them, we can look at the budget, the different budget constraints, and get creative on how we can remediate these risks or maybe reduce the risk from high to low since low is our risk appetite. But I try not to be too focused on the limited budget. I try to start with, here's the risk facing your organization, right? So let's say if your organization is located in, in an area in the United States that's subject to a lot of you know, bad weather, earthquakes, or whatever the case may be, and your servers are stored there, that's going to be a high risk, right? And you may not have the budget to address that risk, but we still need to take into consideration and find creative ways to move money around or consider financing options in order to address the risk itself. So I know that's kind of a workaround way to answer your question, but— It is a problem we face regularly dealing with SaaS startups, and our job as a security professional is to identify the different risks and threats and then find creative ways, including a limited budget, to reduce those risks completely, or at least reduce them from a high to a low. And that's the first way I would respond to the question. And then AI, I think AI can help us in terms of freeing up Resources, right? There's administrative tasks, there's regular things that we have to do as a part of our security program that we should automate so we can free up human resources to address other security needs.

That makes sense. So on one side, you know, it sounds like you have a pretty good solution on how you can provide a— or you can provide a solution for almost any type of budget. It all depends on how much you want to reduce your risk and how much you're willing to invest into reducing it. You know, but so say we move forward with that, we have the capital ready to move forward. Now, the other part of setting up a security system in place is sometimes it affects the performance of your infrastructure. What do you say or what do you suggest on how to implement these, some of these infrastructures, while still thinking about keeping optimization and the performance of the application?

Yeah, that's a good question. I think first we have to look at what our performance requirements are, right? So if we have any contractual commitments where we need to be available a certain, you know, percentage of time or certain hours per year, then we have to factor that into the performance because violating a customer contract is a risk in itself, right?

Mm-hmm.

And it actually is a higher risk depending on who that customer is and the contractual agreements, right? And so first we need to identify What type of performance are we aiming for, right? And then if these security controls or a particular security control is affecting the performance of the application, then we have to go back to the drawing board and get creative and say, we can't use this control. So because it's affecting performance, we have to look at some other compensating controls that will still achieve securing that particular data or that particular instance, but it's not gonna affect the performance of the application. So a lot of what we have to do when managing a security program requires us to get creative. If we run into a given bottleneck that affects performance or it affects the budget, then that's just gonna force us to get more creative. More recently, for example, one of the human resource security controls is to do background checks, right? And so our first suggestion is to use some type of background checker that's gonna kind of automate the process for you as soon as you onboard a new employee. But of course, that comes at a cost, right? And so what we have to do based upon the budget is reach out to previous employers, right? That's free.

Mm-hmm.

I mean, we have a phone bill, but it's still a compensating control, if that makes sense. And the same applies for performance. You know, when we implement a security control, we should implement it in the test environment first before, you know, before we introduce it into the production environment and it actually affects the customers. But let's say we notice in the test environment, this is affecting our CPU, this is affecting our database functionality, then we just have to go back to the drawing board, find a compensating control, and just really get creative about our strategy. I think security is more about strategy than people realize.

So having a really good strategy, really planning it, really digging in deep, and then coming up with ways to really fit the budget, fit optimization, but still keeping the threat under control. That makes perfect sense. Can you share maybe some stories that you've seen where not having a proper cybersecurity system or policy in place maybe has gone wrong, or people call you and say, hey, we're in this situation, or we're about to, or we're starting to face these threats? Or maybe as you started implementing, you started seeing these things, maybe examples where you've seen these and you've come around and successfully applied this and maybe mitigated some of these threats for these startups?

Yeah. So my first job actually was actually going in for like a healthcare doctor's visit essentially, and the patient data was on paper still. So obviously when we go to the doctor, most times it's automated. However, this particular doctor was still trusted paper. And so when I consider, where's this paper going after I complete it? I look around and it was just in the open. There's no locks or anything in the cabinets. And I'm assuming, or I know, that there's cleaning ladies, there's people that come in after hours, and they don't have to go up against any security controls in order to get my Social Security number. So that's actually how I kind of got introduced into the field, is, you know, identifying that issue. And so essentially the problem there was there wasn't any physical security controls, right, besides having maybe a door lock. And, you know, come to uncover a lot of other things there. So that's one example. And it was more of a personal experience where I realized, like, We don't have the server room locked. Like, we're still filling out paper and putting our information on paper, but there's no file cabinets with locks. It's just right there. And so that's one example. And then another example I've seen is regarding an acquisition. So there's a SaaS organization that acquired another SaaS organization, and rather than implementing their existing security controls, On the acquired system. It was more we acquired it and we have it now and we turn a blind eye to it. And that led to some particular issues because you don't have the security controls that we find standard implemented on this acquired system. So the biggest lesson learned there is if you are going to acquire another organization, you want to make sure that your existing security controls, you implement them on the acquired system. Don't assume that when you get in, when you acquire a system that is already secure, right?

That's a good point. Yeah, you come in there thinking your system, you know, will match up and it'll make things easier, but you have to balance it, right? 2 different teams, different employees, different processes. So completely different world that you got to account for. You know, it's interesting that you talk about, you know, still, you know, paper and pen, and that's kind of the main source of data that still floats around in the world. But that used to be the normal back then, right? And unfortunately, now we have to have all these kind of security systems in place because, you know, it's important. It's valuable data, and a lot of people have lost, you know, a lot of, you know, valuable time or money because of it, right? So glad to see what you guys are doing. You know, curious to understand your perspective or thoughts on the AI realm. And are you guys currently using any AI or automation within your existing, you know, process or systems, or is there some opportunity that you guys see that, you know, should be built or could be built in the You know, for this year?

Yeah, I think there's, there's a lot of opportunity to use AI. My CTO, Metin, is currently testing the things out that we can use. We currently have not leveraged AI, but it is something that we are looking into. To answer your question, there's huge opportunities. I even think there's an opportunity to, you know, leverage AI to create policies. I'm actually also working on something behind the scenes which will help us automate completing security questionnaires. I was actually playing around with Google Bard, which as of last week it's Gemini now, which is confusing. I'm not quite sure. Are you familiar with Google Bard?

I am. Yeah. And I think they just switched over, I think, a few days ago, right?

Yeah, I'm still calling it Bard. So I'm actually working on that behind the scenes to help automate completing security questionnaires for our team. This is something— this is the first time I'm actually announcing this here, but basically it's a huge time sink for us and it's also a high-value task at the same time.

Mm-hmm.

I'm not quite sure how familiar you are with third-party risk management, but oftentimes before, you know, we can earn a customer, let's say if that customer is Apple or Google or whatever the case may be, they have a third-party risk management program that's going to review our security controls. Usually that consists of them sending over a 100-question or 150-question questionnaire. And we have to complete that, and some of them are very detailed.

Mm-hmm.

And so since it's a huge time sink for us, it's something that I'm actually playing around with in the background. And also our CTO, Metin, is also looking at some AI. But to answer your question, there's huge opportunities in the security space for AI. I know threat actors are using it for these phishing campaigns. I've been seeing a lot of phishing campaigns this year that look real, and I know it's because The threat actors are using AI. I think on the defensive side of security, we're not leveraging AI as much as we should. So there's huge opportunities there.

Nice. So what is that called on the defensive side? Is that the red team, blue team, or how does that— is that the terminology?

Yeah, it's the blue team. So blue team is on the defensive side, and then the red team is the offensive side. Those are your pen testers, those that, you know, try to hack into the systems, the good hackers though.

The good hackers. Yeah. So they're using AI trying to get in. So you guys got to get yourself up and ready to protect yourself. So, you know, on one side, you know, there's the, you know, companies are ready to implement this. They spend the budget, they understand the value. Then the last part of it is, okay, how do you effectively communicate this to all your employees, all your teams, you know, within a startup environment that's growing so quickly and make sure they're compliant? Like you gave that example of the acquirer purchasing the acquiring company. You know, maybe there was some, you know, communication drop-off that may have happened there where, you know, they already paid for the system, they already have it, they understand it works. Why didn't they just put it on the other one, right? Or communicate it to those new employees and, you know, set that as a standard. So I'm curious to know, you know, how you'd suggest going about that.

Yeah, that's a good question. You know, and I think there's a quote that said 90% of problems can be solved with communication, you know, so it's very important. I think we have to look at what is communication, right? Communication involves the sender and receiver. And as someone who has to draft the policies, we need to make sure that we have empathy and consideration for our employees or whoever's gonna be on the receiving end of those policies. And so working at Remedy, some things I have learned, and I highly emphasize if you're a CEO, CTO, someone that's gonna roll out policies, the first thing you wanna focus on is knowing your audience, right? a marketing agency, you don't want to draft some heavily technical policies for your employees because the communication is going to fail, right? Most likely the employees are just going to read the first line where it says firewall and intrusion detection system and probably just say, okay, I approve the policy, you know?

Yeah.

And you don't want that. You don't want that because like I said, our biggest risk is people. So the first thing I would suggest is Know your audience, you know, know who you're communicating to because you want to tailor the language of your policies to them. If not, communication is going to fail on the receiving end. And then in order to really achieve that, you want to make sure you have like a subject matter expert drafting the policies, which that's where we come in at Remitik, where we can draft the policies, develop the policies for you. Because if you don't have a subject matter expert that understands the regulatory requirements that understands the industry standards, that understands what your customers want, then your policies are not going to achieve what we want them to achieve. And I think the quote, I can't recall if it was Einstein, but if you can't explain it to a 5-year-old, then you don't really understand it.

Mm-hmm.

And I really live by that quote. So you wanna make sure you know your audience. You also wanna make sure that you have a subject matter expert drafting the policies, you know? And I understand as a startup, you know, we wanna become profitable as soon as possible, which means we may have to cut costs cost somewhere. However, when it comes to getting your policies developed, I highly suggest you depend on an expert to do that. And so those are my first 2 tips as far as effectively communicating your policies. Something else I think that all organizations can do more of is emphasizing the importance of the policies. The policies are not an annual thing we review, we send it out to the employees, And it's done. It's a checkbox. We don't want to treat the policies that way. We want to find different ways to emphasize the policies, right? So let's say if we're in a meeting or if I have a meeting with a particular company that I work on their policies or I manage their security program and they ask me a question, I already know the answer. But just to emphasize, to emphasize the importance of the policies, my first response is always, let's see what the policy says.

Right.

That's one thing you can do to emphasize the importance of the policies. Also, if you're about to end a meeting 10 minutes early or 15 minutes early and it's kind of relevant to the meeting, let's take some time and review our human resource policy and see if there's anything we can change, make sure that we're still compliant with it. So you want to make sure that you want to emphasize the importance of the policies throughout the year, throughout the week. So people know in your organization, oh, let me start referring to the policy. Let me set aside some time to look at the policy, make sure I'm doing what I need to do. And I think it really will help if you wanna be a star employee, right? 'Cause you can start referencing the policies. And then the final thing I will say is you wanna build a security program around the policies, right? And so your security awareness training, the different training that you have, you wanna make sure that it's consistent with the different information security policies that you roll out to your employees just to strengthen the communication, right? We oftentimes feel like if I communicate it one time, then the message is received. And unfortunately, communication isn't that easy, right? We may have to repeat ourselves. I know it's a bit annoying, and that's kind of what it means when I say emphasize the policies, have training built out around the policies. And I think those 4 tips, it's itself will help communicate the policies effectively. So know your audience, make sure that the policies are drafted by a subject matter expert, emphasize the policies throughout the year when you can, and then also build a training program around the different policy language.

Love it. Yeah, I mean, that makes it— you want to simplify it as, you know, as much as possible because obviously this can get very technical. And if you can simplify it and share it, I like the idea of continuously I haven't heard of that, right? A lot of companies will build this for compliance, and that's what I said. We're like, hey, this is for compliance. We've done our job, we've checked off the box, and we move on. But keeping that reminder of like, hey, this is important. We've got to keep remembering that there is a policy here that we have to follow. I think that's great. Final question for you, Kyle, before we move towards the personal rapid-fire question, which is around where do you see opportunities? And you talked about finding an expert, right? An expert in this field, in cybersecurity. So if I'm looking to onboard or work with an expert in this field to develop my policy, what are the standards of today that qualify this person? Is there a specific course right now? Is there a specific accreditation or membership or whatever it is that sets the bar of like, this is a cybersecurity expert that you would recommend maybe to folks to maybe look to, to learn about, or to use it as a— As a guideline for their SaaS product?

Yeah, that's a good question. I think the first thing you want to look for is an organization or an individual that is well-versed in compliance, specifically multiple compliance frameworks, right? Because once we go back to your first question and we look at all the data that we're handling, that data may require you to be compliant with a wide range of different frameworks. So if you only go to a subject matter expert in SOC 2, they're only going to be able to draft those policies in accordance with SOC 2, right? And so what I would suggest you look for is someone who, one, is well-versed in compliance, because the beauty of compliance— I didn't realize this really until I started working at Remedyk— but the beauty of compliance is you get to touch all aspects of cybersecurity, right?

Mm-hmm.

Some of my friends at their jobs, they go in and they only focus on identity and access management, or they only go in and focus on asset management. And that's the limit. They have a limited view of security. No offense to my friends if they see this, right? But for compliance, we have to know all control families, right? And so that's why I suggest someone who works with compliance across multiple compliance frameworks like we do at Remetic. And so that would be my suggestion.

Okay, perfect. And there is— is Google the leader right now? IBM? Or who are the leaders in the space that are offering the best content out there right now?

For compliance, for policies, or—

Yeah, either or.

Yeah, I think it's hard to say IBM or Google because they have their hands in so many places.

Yeah.

You know, not to be biased, but I really do believe we are the best, specifically because we focus on compliance. For 7 years, that has been the primary thing that we focus on, unlike other organizations that have their hands in so many different things, right? You have Google, they're focused on AI now, like they just changed Bard to Gemini. You know, they, they have Android, they have phones. You know, you want someone who is specifically focused on compliance for the most part. You know, we're focused more on security as well now, but I think we are the best and I confidently say that.

Love it, man. Love the confidence. Cool. Kyle, let's shift gears. Let's go towards the rapid-fire questions. You ready?

Yeah, I'm ready.

All right. What's one activity you enjoy outside of work that gets you into a flow state?

Some people consider this work, but my activity is reading. I actually am an avid reader and it actually relaxes me and gets me into the flow state. So sometimes when I know I have to do something else and it requires me to focus, I'll just read for 5 minutes and I'll be ready. And so for me, it's actually reading.

Love it. What's one piece of advice you wish you had known? And if you can go back, you would tell your Let's say 20-year-old self.

I would, I would tell myself this Einstein quote that is now like my core value, which is basically don't strive to become a man of success, but strive to become a man of value. That is the most powerful advice that I've come across, and it's really shifted my focus to focusing on achieving the next thing and really focus on, okay, how can I become more valuable today? Right? Usually that's learning something new. And so I think that would be my advice is don't strive to become a man of success, but strive to become a man of value.

And service. Love it, man. What are some of the biggest challenges I guess you're currently facing in order to continue to grow with Remitik? And then, or is there anything that keeps you up at night these days with with the company?

Definitely. Definitely. I think my CEO would have to answer that one, you know, but for me, it's just we're working with startups, right? A lot of them are early-stage startups. And the worst thing that can happen is your reputation get blown out of the window because of some type of data breach. And so the main thing is knowing that some of the companies, a lot of the companies that I work with and manage the security program for are the future. You know, they have very powerful technologies, they have very innovative products. And the last thing I need is for them to have some type of data breach, and their reputation is blown out the— or is thrown out the window. And so that's really the main thing I think about is protecting their reputation, making sure that they're secure before they go public, before they get acquired, or whatever the case may be.

Makes sense, man. Reputation is important. Who or what are some of the best maybe resources that you can suggest, whether they're books? You said you would like to read a lot, mentors, or maybe people you follow in the space who you'd say have been, you know, most instrumental to your success in learning more about cybersecurity and compliance over these last few years.

Yeah, I would have to say number one is Remedic. I definitely have seen the growth in myself since I joined Remedic in October of 2022. There's a lot of talent. It's great leadership. And just the information that we have access to, it sets you up for success. I think any of my team members could attest to that. So number one, I will say Remedic, you know, just being in this environment, the different challenges we face, the different SaaS organizations we have to deal with, and the different technologies we have to learn is number one in my book, I would say. And then second to that, really, I would say Learning about cloud security, if you are cheap, you know, look up the Azure public documents or Google Cloud public documentation. Those are really great resources. I spent a lot of time reading them and it's public information. So oftentimes what people will do when they're studying for like a cloud security certification, they'll maybe buy a book or a course, but generally the books and the courses are designed around the public information.

Right.

And so I would say cloud providers' public documentation is a great resource for anyone that wants to get in the field or just upskill a bit. There's so many cloud services, it's hard to learn, specifically the AI cloud services. I mean, they're amazing if you learn to use them. That's one of my initiatives this year is learning how to use the different cloud AI services because I believe they're very powerful. So those would be the 2 things I would say. And then the final thing would be a book that I read a couple years ago. It's The Act of Will. It's by a psychologist, by Roberto— his name is Roberto Assagioggi. And that book is important because our field, a lot of people, or what our field could be known for is burnout.

Mm-hmm.

Like, it can be kind of taxing. And I actually learned how to manage it a couple years ago when I read this book. It's called The Act of Will, and just tapping into your willpower. And, um, I would, I would say that's really helped me and really helped just keep fighting, uh, this battle against the threat actors.

Love it, man. You gotta stay— you gotta stay sharp, you gotta stay in shape. Uh, Dr. Roberto Assagioli. Okay, awesome. We'll put the link to our show notes. I've never heard of that recommendation, so that's, uh, that's great. I appreciate you sharing that. Love it. I appreciate it. What does success mean to you today? And whether that's personally, business, financially, life, I guess there's no right answer. How do you define it?

Yeah, I think success to me, it goes back to my second question, right? Any day where I can become more valuable, usually it's reading a book, going to the gym, keeping a proper diet. That's success to me. Thankfully, I've been able to experience some successes early on in my life where I don't really get tied to the accomplishments, I would say. Now I just really focus on just becoming more valuable each and every day. That makes me feel good about myself.

Absolutely, man. Love it. This has been great, Kyle. Anything else you want to add? Or maybe if you just want to share, where can founders or anybody listening in our audience get in touch with you, learn more about you as well as Remedic?

Yeah, the best way to get in touch with me is actually remedic.com. That's R-H-Y-M-E-T-E-C.com. And reach out and I'm happy to talk, help you if you have any questions. I love this stuff.

So awesome. Thank you. Appreciate it, Kyle. And we'll add those links to the show notes. So make sure to check out kyle@rhymetic.com. So thanks again, Kyle.

Thank you.

Thank you all for watching this episode and joining SaaS District today. Don't forget to like, subscribe, and hit the bell for future episodes where we interview top leaders in the SaaS industry. If you're a SaaS company looking to grow and unlock the true value of your business, get in touch with us at Horizon Capital and myself or one of our consultants will provide a free assessment to help you get there and hit your goals. If you have any feedback or suggestions for this podcast, please comment down below. And help us improve our content for you all. Thanks again, and see you on the next one. Bye.