EP237 Making Security Personal at the Speed and Scale of TikTok

Security.

Hi there. Welcome to the Cloud Security Podcast by Google. Thanks for joining us today. Your hosts here are myself, Timothy Peacock, the Senior PM for Detection, UEBA, Risk, all kinds of good stuff in Google PsychOps, and Anton Chuvakin, a reformed analyst and senior staff in Google Cloud's Office of the CISO. You can find and subscribe to this podcast wherever you get your podcasts, as well as at our website, cloud.withgoogle.com/cloudsecurity/podcast. If you enjoy our content and want it delivered to you piping hot every Monday, please do hit that subscribe button. You can follow the show, argue with us and the rest of our Cloud Security Podcast listeners on the Google Cloud Security Community page. Anton, we have a guest today who is one of the few companies that operates a consumer product at a scale equal to, or in some cases even bigger than some of Google's consumer products.

Correct. And I think before, well, planning this podcast, we also had this Interesting anticipation about what kind of lessons we may learn from that episode. So, you would see some lessons that are conceptually very simple but practically very difficult. But also, you'd hear some gems that are just flat out new and interesting and never been heard before.

Since listeners, I wasn't part of recording this episode, is there any brain rot in this episode? Is it giving security?

I can't think of it. No, I think that it's—

Oh, that's a relief.

It's all very condensed, beautiful, structured and useful.

So we were able to speak about TikTok without speaking in TikTok. That's good.

I am more of a YouTube Shorts kind of person. I'm sorry.

Oh, listeners, you hear that? Anton knows where his bread is buttered. And so perhaps with that plug for YouTube Shorts, let's turn things over to today's guests.

Hi, everyone.

We're thrilled to have Kim Albarella, the global head of security at TikTok, here with us today. Kim, thanks so much for joining. I think before we kick it off, it'd be great if you could just share a really brief introduction of what you do at TikTok and maybe a few points about how you got here.

Hi, Marina. Thank you so much for having me here on this podcast. Marina and I met at an Executive Women's Forum event where we instantly connected, and she invited me to be part of this. And so I'm very thankful for the opportunity and excited to be here. To start with a little bit about myself, I'm Kim Albarella. I am a mother to 2, I'd say, young children, but they're about 14 and 11, not that young anymore. I'm also a wife and I have a dog. I'm based out of TikTok's New York City office, but I live right in New Jersey. So I'm also the head of global security here at TikTok, and that means that I spend my days protecting our platform and making sure that our over 1 billion users around the world can safely enjoy all of the content that we bring to our community every day.

Well, I'm sure that you get this question a lot, and I love that I had the opportunity to meet and connect with you earlier as well. And I just wanted to say, just, it really feels like in our conversation, security is very much a part of your DNA. And I wanted to see, like, how do you integrate that into your day-to-day at TikTok? And I'm sure you get this question a lot, but are there any tips that you would share in terms of staying safe online?

Yeah, absolutely. Security is 100% part of everything, not only that I do every single day, but that the company really takes seriously. And you're right, I get asked that question all the time. What are the things that I would recommend our users, my friends, my family, and our listeners to do every day to make themselves secure? To me, it's 2 things, 2 very simple things. The first is enabling 2-step verification on all of your accounts, all of your platforms. If you're a TikTok user, turn that little toggle button on, but don't stop at TikTok. Do it on all of your social media platforms. Put it on your banking platforms, your insurance company. Even if you're a traveler like me, I travel almost every week, make sure your frequent flyer miles are locked down. Every single thing you can think of, turn on 2-step verification. It's one of the easiest and most simple ways to protect yourself. The second tip that I always rely on is making sure that you have a different password for every account. Now, People have been saying that for years. You've probably heard lots of different speakers talk about that. The feedback I get, especially from people that don't work in corporate America or might not be as familiar with technology, is, Kim, that's impossible. How can I have a different password for every account? My father-in-law was just saying the other day that he is so angry with his investment company because they make him use 2-factor authentication and he hates it. And I was laughing with him because I said, too bad if you hate it, you have to do this. But truthfully, from a password perspective, my number one piece of advice is to select a really hard phrase, something that's easy for you to remember, represents yourself. Make it difficult, like I love soccer. Make the I an exclamation point and O a zero, something like that. But then add on something unique to the end of that every time. So if you're going to use TikTok, it could be I love soccer TikTok, I love soccer Amazon, I love soccer bank, or whatever it might be. That makes it easy for you to remember. But if it does get compromised, it only gets compromised for one account. And I think that's really critical. It makes it a little bit easier for my friends and family to remember, at least.

So I think passphrases over passwords is a good one because people have been pushing this whole long password message, and then you end up with yellow stickies and passwords in email. So, I think passphrases and MFA is something we'll definitely wholeheartedly agree to. And I think that your discussion about somebody he hates, he's banned his insurance company for this. This is like user friction at its most essential form. You have it in your family, and it's like, Yeah, but it's like you have compassion to this view, but sorry, buddy, you're doing it. There's no real way around it.

Like, right, right.

Yeah.

Because that's the first question people ask is, oh my God, my identity was stolen or somebody got into my bank account or somebody took over something. And the first question I ask is, did you have 2-factor turned on? And they're usually like, no, no.

Or what's it?

Or what is it? Yeah. And I say, well, I don't really know what to tell you then, you know.

Which, by the way, reminds us of some of the stuff that people— and by the way, everybody knows this joke who works in security because you sometimes hear people who say, oh, yeah, I have 2-factor authentication. Username is one factor, password is another.

Right.

And I mean, we all laugh at this, but I actually was told that somebody met an interview candidate who gave this answer in a security role interview. And of course, a lot of minds were blown as a result because it's like, what? I know it's a joke on social media, but I don't see this as somebody seriously thinking that. But apparently, people do seriously think that, even in our industry.

I'm sure they do. I'm sure they do. And we think about this stuff every day. We're living in the technology world every single day. We go through training. There are so many people in my daily life outside of work that don't have the luxury of having professional training or having these types of conversations. And You know, I think just being able to educate our users, it's one of the things I'm most passionate about because we've got a billion users who are not living in corporate America taking these types of trainings. And it's why I love what we do, and it's why I take education of our users, you know, so seriously.

So, I want to switch subjects to something that's related to this and that a lot of people living in corporate America are kind of brought maybe with all the technologies in mind, and they're more used to, you know, the old way of authentication, security controls. And you work at a very modern company. And so you deal with some of the compliance regulations. Marina would probably object if I call them legacy because they're not really legacy, they're current. But let's say many compliance regulations were written with all the technologies in mind. I used to deal with PCI DSS, a lot of stuff there. just smells like the '90s or early 2000s. So, how do you bridge the gap between these older requirements and the realities of a modern microservices-based tech stack? Like, this is, I don't know, like, I personally don't know how to answer it, so I really hope you would.

Well, I don't look at it as a challenge. You know, I think back to my experience in compliance right from when I started my career. And I started my career in consulting when Sarbanes-Oxley, had just been introduced. And that was a very new regulation at a time when we were reacting to, truthfully, the Enron collapse, for our listeners that may remember that. And at the time, it was considered this huge endeavor. Nobody knew what to do. It was brand new. The scopes were huge. Testing samples were huge. Fines were huge. And now today, you look back 20 years ago and it's It's kind of like, well, that was just a bump in the road. Now Sarbanes-Oxley is just run-of-the-mill. Everybody complies with it. It's not a big deal. You know, everyone knows what they have to do. Scopes have come down. Fines have come down. And it's something that's just built into everyday life. So, when I see a new compliance requirement, I use those lessons from back then because oftentimes a compliance regulation is set up because something happened. Something in some country somewhere, an event, a company, a breach, whatever it might be. And that regulation is set up to try to stop that thing from happening. And I always look at it with a very logical and patient perspective because I know that in just a couple of years, it's going to be like the Sarbanes-Oxley. We'll figure it out. And it's our job as the compliance and risk and security experts within the industry to help the regulators and the auditors and the clients' departments figure out what are we actually trying to prevent or solve for, and have we overregulated this thing in hopes of stopping an event, but is it really going to make that much of a difference? A recent example of this would be the NIS 2 compliance regulation that's out in Europe. This is a fast and furious moving regulation focused on critical infrastructure in Europe. And the definition of critical infrastructure has grown significantly and now does include some social media platforms. And TikTok falls into that. And while it's a new law, it sets a foundation for security in Europe that all companies should be already complying with anyway. So to me, it's an opportunity because it pushes us to do the right thing Every day, every time. And when something new comes out, if we've already adhered to the first thing, we're going to be in a much better spot going forward.

So, I like this enlightened stance by connecting compliance to some of the preventing some past bad event. And again, Sarbanes-Oxley 2002 is a great example. Yet, at the same time, as you start managing risks over time, you kind of use this as an input and not as an insurmountable challenge where you have to adapt to. I think that makes sense.

Absolutely.

So your background is not just in compliance, but compliance and risk management. And I think that it's weirdly enough, in many cases, you talk to security professionals and even security leaders, and they say they care about risk, but then they just buy appliances, enable services, push buttons. And it's almost like they believe in risk philosophically, but they don't operationally practice it. So how do you approach demonstrating the effectiveness of security control, not just their existence? To me, rapid change makes it really hard, and a lot of people struggle, and they do tend to just buy things and hope for the best.

You're absolutely right. So, my background is a bit unique when you look at other people in my position across the industry. I started my career in the compliance, audit, and risk field. And through building out ADP's enterprise risk management program, which was my job before TikTok, it's how I got into security in the first place. And I believe there's different ways of managing security. There's no one right or wrong way. But I come at security from a risk mitigation perspective. Everything that every area of my team is doing is meant to mitigate some type of risk within the company. Could be a security risk, could be a compliance risk, could be a reputational and trust risk, could be a client and financial type risk. There's lots of different types of risk. I come at it from a risk-first focus. Now, that's not everybody's philosophy. Some leaders, if you talk to in the industry, have different perspectives on threat-first approaches or geopolitical approaches. I have taken a unique stance here at TikTok where I'm coming at it from a risk-focused approach because TikTok's a very fast-moving company in a very risk-driven world where we are trying to take risk to advance our products, to build our business position, launch new things for our users, and maintain a position within the industry. So, unlike some of my previous experience in companies that were a little bit more conservative, this company is really focused on choosing to take the right risks that will enable the business to move faster. And that's why I come at it from that way.

Hmm.

That actually makes sense. That's the only way, right?

Yeah.

Yeah.

I think just pulling on that thread a little bit, I mean, especially as a global head, right, you have to take into account— I mean, certainly you're based in the US, but you have to take into account a really complex web of regulations because obviously TikTok operates on a global scale and also, aside from the regulations, has global users, all of whom have you know, slightly different expectations in terms of the security and the privacy expectations for the service. And so I'm curious in terms of how do you approach that balance of kind of accounting for the localized compliance requirements, Mm-hmm. but at the same time trying to drive a consistent global security posture so that you are able to have consistent controls and not have everything be quite so bespoke?

Right? There is a saying that I learned early on in my career that I use almost every day. My team hears me talk about it. And it's just simple. Comply once, comply many. I'm responsible and my team is responsible for the security of TikTok in all 120 countries in which we operate, with the exception of the United States, because that's a separate entity. That means that we have 120 countries times many regulations within each of those countries. Times all of our users, times all of the different features and products that we offer. This could very easily get extremely overwhelming very fast. But I see it as an opportunity. And what my team's been able to do is enable this concept of comply once, comply many. It means we hold ourselves to the highest required standard globally, Knowing that by meeting that high standard, it will allow us to meet all of the other responsibilities by meeting the highest bar. So this is why things like NIST 2 and the Digital Services Act in Europe, they set very high bars for every company. And so we've done the analysis of all the other countries that we have to operate in. And some of them have very strict laws, some don't. But most are not as strict as the European regulations. And so, by holding ourselves to those high bars, we're able to comply once, comply many, and go above and beyond in many of our regions.

So, I kind of had a weird sub-question to this. I've dealt with things like Unified Compliance Framework many years ago, and I think in this case, it would be like many years ago. And I've seen the promise of comply once and then cross-map, but there would still be fringes left. There would still be little pieces that you have to cover. What strategies do you use to sort of ensure confidence to stakeholders? How do you prove auditability from this? Because you can cross-map and you can cover the core, right? But then what about all the fringes?

That's an excellent point. There's always a fringe and there's always an edge case. And so, we just treat them as just day in the normal life because we do have 120 countries. So, for example, we're dealing with one particular compliance requirement right now in Luxembourg, which is a very specific license that we're looking to obtain. And it's got a different set of policies and a different set of requirements that we haven't previously assessed. And so we just go about it by doing a robust assessment of what are their requirements, how are they unique or different from what we currently have, and see where we can leverage what we currently have We have things like our ISO certification. We're TAG certified against fraud, brand safety. Of course, our PCI DSS certified. We have lots of other types of certifications that sometimes could cross-balance those things. But, you know, this happens all the time. We've had some examples in Korea where we've had to go a little bit above and beyond for some of their requirements that weren't able to be addressed through other ways. It's why I have a dedicated team of risk professionals and compliance professionals that truly sit around the world, and they have different regional expertise depending on what those regions require.

Yeah.

I mean, your Luxembourg example just made me shudder because it's like, yeah, sure, 120 countries. Yes, I know. Like, we look at Google's coverage, and it's like, that's not shocking. But then suddenly, you're like, a lot of likely very intelligent, very skilled, very well-paid people are Considering compliance with the Luxembourg mandate.

Right.

Like, that makes the job hard. I just want to express compassion about it.

Thank you.

Sorry, this is like—

It's true. It's, you know, it's never easy, but it is exciting because it's certainly never a boring day here. You never know what's going to be, you know, the next thing that we're facing. And we, like I said, we move really quickly. And the good thing is that we've invested so much in security We have a lot of employees. We have a follow-the-sun model. We're situated around the globe. And it at least gives us that level of expertise and diversity to enable us to address all of these challenges.

Can I actually take the opportunity and kind of pivot a little bit? I think we've been talking about how you're managing a lot of these, like, external requirements. And I recall in some of our past conversations, you talked about sort of the many hats that you wear in this role. We talked about advocacy. You mentioned that you were really big on training for the team. And so I'm just wondering if you can talk a little bit about how you foster that sort of strong security culture internally, as well as obviously making sure that it exists externally for your users.

Yeah. So fun fact, my first job in security was in security communications awareness and training. So when I say it's a passion, it's, It's truly where I got my start. And I firmly believe that security is always built into the culture of the company. It's not just a one-time training or one message from a leader. It has to be built into everything the company does. At TikTok, we have our ByteStyles. These are like our corporate values. And there's one or two that stick out to me, and it's be courageous, and aim for the highest. And these are embedded in everybody's performance review, everyone's OKRs. They're embedded in every leadership conversation. So these come to mind when I think about security truly being embedded in everyone's job. And aiming for the highest means that it's everyone's responsibility in everything that they do, whether they're building a product, securing a product, selling the product, creating a product, Whatever it might be, it's their responsibility to create a more secure environment and platform. So internally, we've invested a lot of time into— and resources into helping our employees understand what their role is and in making security personal. And then externally, we know it's hard to get people to care about security until it's personal. And that's why we brought the personal into the the employee side as well.

Sorry for interrupting. I'm sort of like, this is like really exciting in a strange way. Initially, I thought this is sort of like a just general truth. Yeah, personal, but, but connection of personal to like TikTok videos and short videos and stuff. Like, I intuitively feel there's a connection. But can you explain that? Yeah, I feel like magic. That is the magic. There's magic there.

Yeah.

So where our main goal is to meet people where they are, whether they're an employee or An external user. And for our users, that's of course on TikTok. And so we have created a channel, it's called TikTok Tips, and we use our employees, we use professionally created videos, whatever it might be, to give them these tips and trainings. And they pop up in your For You feed just like any other organic video. When I talk about it being personal, I truly think of a personal experience that I had about 8 to 10 years ago. There was a major data breach at a very large hotel chain that I won't name, but many of us probably remember.

I remember that one.

I was working for a different company at the time, and I was at the time running security awareness and training. And we had been doing all the formal trainings like every other company does. But it was at that moment that employees started reaching out to me and saying, oh my gosh, Kim, I'm really scared now because this hotel chain has my credit card number, my address, my passport, this, this, this, this, and this. And at the same time that my employees were reaching out to me, my friends and family were also reaching out to me. And it was an awakening moment where I realized people are talking about this because this is impacting them directly. This is their vacations. This isn't just, you know, an insurance company. Back then, we didn't hear about so many data breaches. So this was a huge deal. And at that point is when I really shifted my view on how we train people. I created— at the time it was on a different social media platform. Now it's on TikTok, but I have a platform called Securishe. It's my TikTok channel. And I originally created that to give tips to just normal people and educate them on what happened with that hotel breach and why that was an important breach and why that was a turning point in the cybersecurity industry and how people actually started paying attention. And since then, I've just really focused on making security fun, creative, engaging. It's something— the other analogy that I use sometimes is it's almost like a New Year's resolution. So, if at the beginning of the year you say, I want to lose 20 pounds, and you say, and I'm going to do it in 3 days, You can't go to the gym for 72 hours straight and lose 20 pounds and then just eat McDonald's for the next 11 months. Like, I look at it almost like that gym membership. If you're going to lose 20 pounds, you have to change the way you eat and the way you live. You've got to go to the gym every day. You've got to eat better, take vitamins, whatever it might be. Security is the same thing. You can't just give somebody one training or one video and then hope for the best and say, okay, the rest of the time I could be irresponsible because I took a training. And that's why I think consistency is critical. Engagement is critical. And really just making sure that you're getting people's attention and getting them to understand how it impacts them on a day-to-day basis.

I love that. And I think, you know, sticking with, as you said, something fun, we're coming up on time, but I am just really curious. Can you tell us a little bit about like what's in your TikTok?

This is my favorite question, Marina.

Oh, I really hope there's some security and risk management in there. Sorry.

There is. I do follow a lot of cyber creators, of course. I do get a lot of my news from a lot of the different news channels on TikTok. On the fun side, somehow I'm on the side of TikTok that's focused on the proms. Prom transitions, prom dresses. So I'm not going to a prom, my children aren't going to a prom, but I'm seeing prom dresses. And lately, somehow I'm seeing like horse grooming. And like, it must be sheep shearing season because I've gotten a lot of that. I'm also TikTok Shop's like number one biggest client. So I am—

Nothing to do with your job. I would assume nothing to do with your job.

Nothing to do with my job. My husband yells at me all the time, stop buying all this stuff. I say I have to do it for work. But I get, of course, I'm following a lot of like the clean talk stuff on all these cool cleaning appliances. And I don't know, it's crazy. But it is fun, as always.

Perfect.

This was really quite insightful. And by the way, I did not realize we just spent 27 minutes together. And I'm like, that just flew by. Thank you very much for being on the show. This was exciting and actually fun and useful. Please send us a link or somehow tell us how others can find your TikTok channel about security, because I feel like that's— others can benefit from this.

Yeah, it's just @Securishe, like security but with she at the end. S-E-C-U-R-I-S-H-E. But we could send it to you.

Perfect. Thank you very much. Really appreciate it. Thank you.

This was great. It was so great to meet both of you.

Thank you, Kim.

And now we are at time. Thank you very much for listening, and of course, for subscribing. Please subscribe so you can get new episodes piping hot. And if you love our content, please drop us a review on your platform of choice.

You can find this podcast on YouTube, Apple Podcasts, Spotify, or wherever you get your podcasts. Also, you can find us on our website, cloud.withgoogle.com/cloudsecurity/podcasts. You can argue with us on the Google Cloud Security Community site, You can follow us on X, x.com/cloudsecpodcast.

Tweet at us, email us, argue with us, and if we like or hate what we hear, we can invite you to the next episode.

See you on the next episode of the Cloud Security Podcast by Google.