Gong’s Jack Leidecker on Balancing Innovation and Security

I've never actually met a dev that wanted to write bad code. They need to get new code out. That's what they're doing. But they just want to do their job. And I think as silly as it is, if you can get that mentality, it's not a confrontational discussion. We want you to do it. I want the company to make money. That's where I get a lot of benefit from it too. How do we do that? So being able to integrate into that part and shifting the mentality of like, hey, we're not just here to find problems. We want to create better processes, we want to streamline it.

Welcome to the Ahead of the Breach podcast where we are dedicated to empowering security experts and practitioners with the knowledge, insights and actionable strategies to lead the future of cybersecurity. Here's your host, Casey Camilleri, CEO and founder of Sprocket Security. Now let's dive into today's episode.

Welcome to the Heather Breach podcast where we talk everything offensive. Cybersecurity. I'm your host, Case Camilleri and I'm here with Jack Lydecker. He has over 25 years experience developing successful global cybersecurity and compliance teams. He's CISO at gong where he has supported the company's rapid growth while building a world class cybersecurity program. Jack, welcome.

Thank you. Appreciate being here.

So how long have you been going to Black Hat and defcon?

Black Hat? I usually hang around a little bit. This year I got talked and going to the thesis summit, it was okay. Def Con is the one I really like always going to. So I mean, I've been going for around 25 years now. Wow, my perspective.

Yeah, 25 years. And so how did you get your start in cybersecurity?

Yeah, so it was a little complicated. I mean, back in the late 90s, security wasn't like a direct path. Right. So when I was in school, I figured out that I had fun breaking sites, right. Doing pen testing, doing things like that. So started off in that actually went to some of my first defcons. And back in the day, I'm not sure if you remember, but it was always this thing of like, if you're getting paid, you're selling out. And I was kind of the opposite. I'm like, why would I get paid for something I don't want to do? Yeah, right, right. So I'm like, let me actually get paid for this. So I actually did consulting, then I went into banking, pivoted into some compliance work just because nobody else Wanted to do it. And I was in my early 20s and I'm like, sure, why not? I'll jump into that. So that kind of helped me get into management and building programs and different things like that. But some of it was just more. It was fun, seemed interesting with it. And like I said, once I started doing it, it keeps you busy. I've been in a long time and there's always something different. So I don't think I could imagine myself doing something different than that.

Yeah, so you're the kid kind of like teetering on the verge of ethicalness, right?

Not as much. I think part of it was because, I mean, back in the day, I even played like, capture the Flag over at defcon, but it was. I don't like doing work without getting paid. I figured out pretty early. So, like, if I'm spending my time on it, and then also you get in trouble with it. Like, I know a lot of people did that. And especially back in the day, it was a bit different with it. But, like, for me, it was like, okay, the school had some stuff, teachers using other ones and even some small retail. So they needed some help with it. And that was, to me, more fun because I also wanted to see it get fixed. So I didn't just want to break it. I wanted to see, like, hey, look, this is where you have some issues. This is how we can fix it. This is how we can harden it. So even though I liked being on the pen testing side, I always enjoyed the fixing aspect and seeing what actually got better.

Yeah. As a pen tester myself, in my background, I found identifying the vulnerabilities and exploiting was the easy part.

Yeah.

The real hard part in business is actually fixing them, right?

Yeah, absolutely. I mean, even in some of my career too, because I did consulting for quite a while. Part of the reason where I pivoted to building programs again after, because initially I was at a bank, that bank bought out by a big, big bank. And I didn't want to move to Jersey. So I'm like, all right, forget it. I'm not going to go there. And I went back to consulting for a long time. But one of the things that I got annoyed with is when you're a consultant, you can only do so much, right. You don't own the budget. You don't really have your feet in the game all the way. So from that I'm like, I don't want to go back to the same customers and same clients, and they still have the same issues. They haven't fixed anything. Right. That gets frustrating for me. So that was part of the other reason where I kind of pivoted back. I'm like, all right, let me go start building some programs internally. Been a CISO quite a few different times now, but a lot of that pivot was just the fact that I didn't like the fact of going back and be like, wait, you still didn't do your basic patching? You still have the same issues. Why am I here? Like, doing your assessment will take, I don't know, a couple hours at most because you didn't change anything. And that's not, for me, very fulfilling.

So you took that offensive, proactive approach, and then now that you're a ciso, you carry that forward into the organization. Right. And lead with that in order to help secure the organization. What are some of the things you're doing currently?

Sure.

To help improve and be proactive.

Yeah. So, I mean, I'll even start what I did a little bit before versus even what we're doing now. So one of my first hires was getting an offensive security guy. Right. Because we're putting in a bunch of new processes and new technologies. We have our blue team do different things. I want to validate how things are going. Right. And you can always engage a third party, and we always did that. But those tend to be short engagements. Right. You want someone to focus. You want them to dig into it. You want to figure out what issues you can have. What are things that maybe you didn't think about as much. Right? So for me, finding those different areas, not just validating vulnerabilities, is the real value of it. Right. Because it's really easy. And sometimes pen testing gets a very interesting aspect of is it a pen test or is it a vulnerability scan? And for me, I've actually had some vendors where they'll know that I'm not happy. I'm like, guys, this wasn't creative. And if it's not creative and they're not actually doing something, I'm like, dude, all you did is nessus. Or like, there's no value there, Right? Yeah.

Pen test, puppy mail, Right? You know, just taking necessary.

Like, hey, it's 5K and you'll have something for your customers. I'm like, but there's no value. So if I have no value, I don't want to do that. So, I mean, that's always something. I always push with my vendors, too. It's like, look, we're paying. I want you to find something different. Right. I want you to get creative with it, let me know what you did. That's not just something that was scripted, because I can do that myself. And in fact, we do do that ourselves all the time. Right. We want to check what's happening. Some of the stuff we've done more recently with my new offensive security guy, he's been doing a lot of automated purple team work too, which is kind of cool. So that way we get a baseline, hey, are we not detecting this? How can we change it? What's going on with it? So even currently, we use that a lot. And I would say also, if you're thinking about from an executive perspective, being able to quantify impact and show what it actually does is very meaningful. Right. Because then you get out of that theory where it's like, well, we think we might have something. And it's like, no, no, this is what actually could happen. You're able to move faster. Because even at gong, I remember joining them and I came from a bigger company and they're like, oh, I know you've done a lot of hiring in the past year or two. That's not going to be here because we're smaller. You get a couple people, they're prepping.

You for your budget, Right? They were.

What was ironic about it though, because I've been through that quite a few times. I'm like, okay, well, let's see how fast you actually want to go. Because then when I came in and kind of did an assessment in the first few months, I'm like, well, if we want to do this, it's going to take this amount of time. And actually CEOs like, well, crap, we need to do a lot. So I actually ended up hiring more people at GONG than I did at a lot of my bigger companies because they wanted to move fast and we wanted to grow and need to do it correctly because we hold a lot of data. So it's important for us to raise our bar quickly.

Yeah. And how do you balance that? That's like rapid innovation development that, you know, GONG is doing. But at the same time you have a lot of security testing because, I mean, they're pushing code constantly. Right. So how do you balance that? How do you think about that approach? I mean.

Yeah, so I mean, I think a lot of it, some of it is even, I don't wanna say philosophy in a way. I always feel like I have to get some of my security guys mentality shifted a little bit. And what I mean by that is I've never actually met a dev that wanted to write bad code, right? They need to get new code out. That's what they're doing. But they just wanna do their job, right. And I think, as silly as it is, if you can get that mentality, it's not a confrontational discussion, right? We want you to do it. I want the company to make money, right? Like, that's where I get a lot of benefit from it too. How do we do that? Right? So being able to integrate into that part and shifting the mentality of like, hey, we're not just here to find problems, we want to create better processes, we want to streamline it. Integrating in our CICD pipeline helps quite a bit too. And then also being able to show that, hey, if we can fix this beforehand or start blocking it, which we've been doing more and more of, like, look, if you have an AMI that has a high vulnerability, it's not going to production anymore, right? Hey, we scan with our different code scanning ones and it's like, you know, that package has some vulnerabilities. Let's just stop it, right? And that wasn't an easy thing to put in place, I will say. So not everyone is able to do that, but it is one where if you do it, because then it makes it easier for them, right? Hey, you're not dealing with a whole bunch of vulnerabilities after the fact. We're stopping it before. So I think the more that you can get the teams that you're going to be working with to do that. And especially for us, when we write a lot of software and we've been big in all LLMs before, gen AI was cool and all that fun stuff, right?

We were there before, it was cool.

Yeah. I mean, we started. I mean, a lot of our stuff has been LLMs for the past seven years, right? And then we have other stuff on top of it. But like, because we're creating data and we're doing different things with it, we don't want to slow down to that innovation. And I think that's a key point, especially as a security professional. I want to make it go faster, right? Can I help them develop faster? How are we doing better with what are our customers expecting? How do we meet those obligations? Because really, you want security to be more of that enabler than a blocker, right? And that's the big thing. And especially even on the offset side, right? Finding the issues, seeing what's going on. Because we're finding it before someone else does, right? Even we had some stuff where we kept on Fishing ourselves a little bit too well. And then it was like a big push of like, you know, we're going to hardware tokens. Right. I'm tired of adaptive MFA with the replay that you can't turn off for 15 minutes. So we're like, forget it, we're turning it off and we'll move on to something else with it. So those are the things where having that to be able to show up.

But you identified that through an offensive approach, right?

Yeah. No, it was our own program. Right. Whereas like, again, it's kind of a hard discussion. It's like, look, it's too easy for us to fish ourselves. This is getting ridiculous. And even when we've added in all the other controls around it, the fact that you can do a replay attack that's too easy and serve with that middle proxy that unfortunately Octa still doesn't take away that stupid 15 minute timeframe. We had to do other stuff to you. Right. Because we wanted to like mitigate that. But it was completely from an offensive security engagement. And also one where it's like, hey, what can we do differently with it? Right. Like, how can we stop this? Because you don't want to do the same thing. We don't want to do the same thing. It's like, hey, if we put in hardware tokens, that's going to take away this attack. I'm like, all right, fine, let's see what we can do there. Yeah.

Now, you mentioned that one of your first hires on your team was someone that was offensive minded. Right. An actual red teamer to help me proactively play that. Should all organizations do that.

You need to be able to have the right mentality that it makes sense for what the org is doing.

Got it.

Right. So some aren't going to want you to do it because it can create some issues with it. Sometimes it's this hair. We really ready? Not ready for it. My perspective has always been if you're not ready, someone else is going to do it anyhow. So it's better to do it yourself. Sometimes you augment it with other companies too. Right. And so there's different ways to go about it. But I would say if you're not doing something that's beyond that, check the box like we talked about.

Yeah.

Like pen test in a box for a couple K. That's really a scan and not creative. Like you don't know what your risk is. Yeah. If you don't know your risk, how can you create a good program? How are you putting in the Right. Controls. How are you building a program? Because you're doing it based on a limited set of data at that point, which is dangerous. Yeah.

And I think you and I have a good understanding of maybe what to look for and you know, that proactive pen test partner, for example. But like in your experience, for our listeners, what tips could you give them to like, say, how do you make sure you don't hire the pen test puppy mill to come in and actually assess, you know, identify your risks in your organization?

I think couple keywords. As simple as it is, hey, are you guys going to be creative? What are you actually going to do? Understand, are they employing fuzzing? Are they doing something else with it or are they just running a scan? Right. How much time is it going to be now? Again, the bad part to some extent, especially with a lot of limited security budgets, is it's going to cost more. Right. Need more time, but that's where you can get the value. So I think it's understanding what it is, what's going on with it. And honestly, sometimes you don't really know until you get some results. But if you don't get anything that's kind of different or what you like, weren't expecting, it might not be one that you want to continue with.

Yeah. And how frequently should you be doing the testing? Right. We would say, you know, constantly. Continuously. That's our thing. But like budgets are limited. Is you can always do the testing continuously, but you just need to prioritize. Right. You just need to have a good understanding.

I think it's also what do you do more automated yourself to.

Yes.

Whether it's the company, whether it's open source, there's lots of stuff you can do with it. Right.

Build your spy. Right, Exactly. Yeah.

And then even with it, it's also when do you have a major change? Right. How are you looking at different things now? If you're doing a pen test once a year, probably not going to be super reflective of it. Again, cost does become a challenge for a lot of orgs, but it's how are you building it into your process that you understand what's going on? And even if you can't do a full pen test, what else can you do to help validate some of your controls? Right. Some red team exercises. Because there's a lot of stuff that's out there now. It's a lot easier than it used to be to be able to do it. Like a lot of times a lot of the blue teams want to be able to Jump into some of that too. Right. So you don't always have to have someone dedicated. If you can, awesome. That gives them a different focus. They can get more creative. I think it's super helpful. But if you can, even figuring out on your team who's interested and wants to do some of that, and how do you augment that with other people too?

Yeah, that's key. Good advice. I came across an article where you had, you know, three tips for building your CISO career that you wrote and I thought was really good. Could you just expand on, you know, how do you go from like a director level to a ciso? How do you make that jump in career? Because you've done that and you've come with a ton of experience. But for those that are listening, kind of just wanting to follow your path.

Sure.

What do they need to know?

Well, actually, CISO is probably one of the misunderstood, I think, titles as well. I've been a CISO like that. I've been a CISO at a much level. I've been a CISO where I was like five layers down. I've been one where I'm one or two at most. Right. So I think some of that just to kind of set it up, what do you actually want to be doing? Right. How do you want to do it? And I would even push it further than director. Hey, if you're an ic, I think one of the things that I've been actually liking a lot more, particularly in the last five years, you don't have to become a manager to go higher up in the ordering level or importance or salary. That wasn't always the case. Right. And I remember there's a lot of times, especially 10 years ago, it's like, hey, you're kind of hitting your limit. Your next step is managing people. But you may not want to manage people. Right? So if you don't want to manage people, it's not the right role. So I think part of the first thing is just figuring out, what do you want to do? Do you know what the actual role is? How are you looking at it? Do you want to deal with politics? Do you want to be dealing with headcount stuff? Not a lot of the things you might have been used to doing. So being able to figure that is key. And then I think too, it's like, okay, hey, I've already done that. I started to manage a team. Now I want to look at what else I can do. Right? Know the business more than anything else. A ciso, even if it's little C instead of big C in most places is intended to be a business leader. Right. So the more you're able to collaborate across your different orgs and be able to sell security internally to your team, that's where you can be successful, and that's where you can actually show the business that you're actually helping them move. And that's key to actually being a leader.

No, that's wise words. Because, you know, so many people think, oh, I need to go to ciso, but like, if they don't want to give up that tech, roll up the sleeves being that ic.

Yeah. And then now you have the mess with liability on top of it. Right. So if you're at a public company, it's kind of like, you know, Deputy CISO might be more fun. Like right now we're not public, so I don't need to worry about it. But it's a mess. Yeah. I mean, even the SEC was talking about some of the stuff recently. There's lots of stuff going back and forth with even some of the recent Tim Brown stuff got pushed out. But then there's still a lot left.

Yeah.

So it's a big unknown. So, I mean, even that perspective, you have the liability aspect, you have some of the headache, you may not actually make that much more than a lot of the lieutenants of a ciso. So even that is something to figure out. Like, do you really want to be in the spotlight now? There is a counterpoint of like, hey, I kind of want to own my own destiny a little bit. But really, even if you're the ciso, you're dependent on other business units to actually do the work, so you're never actually going to own it yourself anyhow.

Right. How often do you get, you know, in the command line now that you see.

So probably more than my team thinks I should at times, because it's also something I have fun with.

Right. Right.

Just to be able to do it. Or it's like, hey, what's going on with it? I'm like, did you check how this vulnerability does this part? Or did you triage this and things like, so if you ask my team, probably say I do it more than I should, but for me, it's fun. Right. Like, I've been doing it. It's where I started with it. I don't want to get too far removed. But it's definitely not my day to day. Right. So it's more of a fun thing than it is. Like, okay, I'm spending 30% of my time There or anything like that. It's like, all right, I'm bored at night. I feel like doing something else. Hello, let me see what's going on. Or, oh, hey, this looks really cool. How did that work?

But you scratch your itch that way.

Exactly. It's more of an itch than a roll at this point.

So at gong, you've literally built the program from scratch, and you've done that in other places as well. What tips for building a program from scratch that you can provide to others?

Yeah, so I think the main thing is understanding what are you trying to get to. And I think too often you can jump into a new role, and particularly I've done it where I've had to rebuild old teams, or a lot of times I'm the first one. I've done that a few different times, even at once where it was already a public company was like, wait, how did we not have anyone before? But sometimes that happens. Right? So I think you don't want to skip out on understanding what do you need to do and how can you align with the business? And what I mean by that is, are they just looking to get a checkbox? Are they really wanting to be more secure? What type of criteria do you have? And how can you create proposals back to the business on how you're going to be able to help them and what sort of timeframe it is? And as I kind of mentioned, GONG was kind of one for me where like, they really tried to push hard of, hey, you're only going to have a few people. Initially, again, I ended up hiring more. But even for me, I pushed with them too, in some areas where I think sometimes he forgets about it. But my key thing is, like, hey, if you just want someone to come in and help you get your sock to and do a checkbox, don't hire me. Yeah, absolutely do not hire me. I will not do it incorrectly. I am going to cost more, but we'll do it, right?

Yeah.

And sometimes that's probably scary to say, but I also have a reputation that this is what I want to do. Yeah, right. Because otherwise it's boring. Kind of like, even when I was consulting, I don't want to put something in place that's paper, that's not actually trying to fix the root problems. So being able to do that and also aligning with the business is key because again, kind of that other part of, how do you become that ciso? What's the benefit? Right. Why am I doing this? Is it just regulatory? Do my Customers care about it. And B2B, that's much easier, which is why I like being a B2B, not B2CISO. No one cares on the consumer side as much. But if you can align with what your revenue is doing or for me, we're able to do it on, hey, we're trying to go up market more. Right. So that was actually a really easy discussion because it's like, in order for us to get these customers, this is the level they expect up here, not down here. So we better get up there real quick or we're not going to get that up there.

Yeah, they care about quality, not the checkbox, right?

Yes. And they're going to dig deeper. Right. Because before everyone knows most of the questionnaires are garbage. They're going to want to understand it more. They're going to want to dig. I even set up a team that deals with a lot of that because I had like sales engineers doing it.

Okay.

And we had like 30, 40% error rate. And I'm like, I can't have that because if you get put in a bad box with a big company, you're.

Going to lose deals.

You're not gonna be able to get out easily. Like, I was still able to salvage some, but not all. Okay, right.

Because if you do get in, you're.

Gonna have a bad time, it's not gonna be fun, it's gonna take longer. So again, that kind of aligning to the business is key on how you're building that program, because again, then you're gonna be able to do things where it's more of a business decision versus, well, you only have 100k. It's like, hey, you want this? This is what'll take. If you don't want that, hey, it's gonna take us X amount of time to improve. Right. Or we want this capability. This is the cost, this is the headcount. Right. Being able to actually have that discussion is key to be able to build it. Because otherwise you get stuck in the aspect of like, well, we didn't spend any money and we already gave you like 200k, you're telling me you need another 700k? Like, are you insane? I told you, you get one headcount. Now you need six. Like, are you nuts? But if you're presenting it in a different manner, again of that benefit back to the business, then you can have a much different discussion. And again, it may not always go right. And I've been at some companies where that did happen. And I said, you know, What? I'm out? Yeah, we can't do it, then maybe you need to do something else, which is, I would say, unfortunately, one of the risks. So as you're doing that and you understand what you want to do, what is your line? That if the business isn't going to do it, are you actually going to walk away or not? Because I think if the business actually understands, like, no, no, he's not kidding. Like, we're going to do it or he's not going to be doing it anymore.

Yeah. Or we accept the risk right now.

Even if you accept the risk, like, honest. Well, everyone's different. There's some risks I don't think you can accept. Even if they want to sign off, especially at a CISO level with personal liability and other stuff. And as you saw, they're not going after the CEO like they probably should. Yeah.

You've been probably put in that position then before.

100%. Or it's like, hey, we're going to do it. It's like, you know what if we don't do that and this is a different company, we're not meeting our contractual obligations you signed up for. That's legal liability I don't want a part of. Right. So it's like, you better fix it or this is going to blow up. And if you guys don't want to, you know what? Then I'm going to go do something else.

Yeah.

And again, that's a hard thing for a lot of people do. Especially if you're like, you want your first CISO gigs where you're like, you.

Don'T want to be the person to, like, put down that. That hardware, new ciso. But, like, you need to understand when you should and when you shouldn't.

And you need to understand what's your own limits with us, too. Yeah, right. And honestly, in some cases, depending on your company, that actually buys you some more credibility. Like, oh, hey, you're not just following a checkbox. You're not doing, like, you are serious. I thought you were kidding. All right, well, maybe let's have a discussion with it again. May not always be successful, but I think that's a much better approach to. Than just, like, oh, I can't do what I need to do, and I'm, like, complaining about it, but I'm documenting a bunch of stuff and I have all these risk acceptances. I don't think that makes sense. And especially if you're supposed to be a business leader, that risk should be visible. The board should be informed. Your investors should understand what the risk is and everything else. So there's lots of leverage you can pull on top of it if you're not. But again, taking that step is also very risky that I would also say that you need to be prepared that it may not go the way you want.

Yeah. So where will people find you at DEF con, Jack?

I'll be around everywhere.

You go to talks?

No, I go to some talks. I hang out with different things. I like going to some of the villages, run into different people. Ioactive has like an event. I have a CISO panel Friday that I'll be doing, so I'll be there for a little bit as well. But I think one of the things I like about DEF CON is it's usually different every year, Right. And kind of pit this seems interesting. Maybe I keep on going that way. I think this year's forcing me to be more on the floor. So I do miss DEF CON tv because there's a couple of times, like if there's a few talks I want.

I was just going to mention I.

Could stay in my room and not worry about, but I'm not staying over to because I wasn't sure that they were going to have that. Right. So now it's like, well, crap, now I need to go and see. Can I get into. Not get into that, have it this year.

Do you know that I don't know.

If they actually got it. I know they don't have it in the hotel I'm staying. So for me it wasn't as relevant.

It was pretty awesome. Because then you get all your friends in one room and be like, look at that. So I'm like that, not that.

Yeah, because I'll usually get like a suite, no line, nothing, and have a couple of TVs even going to where it's like, okay, hey, in this room we have this talk, this room we have this talk. And then there's some you want to go down and see. And then you still do that, right? Because you don't want to just hang out in your hotel room. But it was really nice when it was the back to back ones you want. Like, hey, I really want to hear what the DOD guy is doing. But I also want to see this new exploit with it. And you know if they're back to back, you're not getting in both of them. Like DEFCON's gotten too big unfortunately to do that. So it's like this time I have to pick a bit more. And I also have most of my team here, so that's going to be interesting. I have a whole bunch of people everywhere, so should be fun.

Hey, I appreciate the conversation, Jack. Anyone wants to reach out to you or follow your work, where can they find you?

Yeah, I'm on LinkedIn. That's probably the thing. Like everyone in that regards.

Like all the seasons.

Yeah, exactly. It's like our Facebook or whatever we want to call it these days, sadly, in a way.

Thanks, Jack.

Sounds good. Appreciate it.

Thank you for listening to another episode of the Ahead of the Breach podcast. If you enjoyed today's episode, please leave us a review on Apple Podcasts or Spotify. If you're interested in exploring how Sprocket is shaping the future of offensive security, be sure to check out our website, sprocket Rocketsecurity. Com. Thank you again for joining us. See you on the next episode.