apiiro | Secure By Design

Hi everyone. Welcome to Gray Matter, where we share stories from company builders and business leaders. I'm Sam Motamity, a general partner at Greylock. Today I'm speaking with Idan Plotnik, CEO of Apyro Security, and Samir Sharif, Chief Information security officer of Imperva. We have a fascinating conversation covering the DevSecOps movement and how it addresses the new security challenges created by the acceleration of digital transformation in the enterprise. Thanks for joining us and enjoy the podcast. Let's start off by just introducing yourselves. Idan, maybe we'll start with you. Can you give our listeners a quick introduction?

Sure.

Thanks, Sam. So, I'm Idan Plotnik. I've been in the cybersecurity industry for more than 19 years now. Started my career in a cybersecurity unit at the idf. Left the army after five years and I founded a consulting services company focused on pen testing, risk assessment and secure design reviews. I sold this company in 2011 and then I founded a startup called Erato. We were basically pioneers in the user and entity behavior analytics space. The UEBA. Erato was acquired by Microsoft in 2015 and I was a director of engineering, running engineering, product security research, Data Science and DevOps across two product lines. And now I'm the founder and CEO with Appiro.

Awesome. And we're going to hear a lot more about Appiro and Sameer. Can you please introduce yourself?

Sure. Sameer Sharif, currently CISO at Imperva. Lucky Dan. I've been in the technology cyber business for quite a long time. I would say close to 22 years, most of it spent in the Citigroup where I was in the technology space, both from development, product management, audit, risk and compliance, and probably for the last 10 years in information security, running various programs related to application security, so including biometrics, digital efforts and programs around biometrics specifically to enable businesses for innovation and fraud management, but also the general security development, vulnerability assessment, risk assessments, and really driving a lot of changes in terms of policy development, but also tooling and innovation for the technology teams.

Great. Well, I'm excited to get both of your perspectives on a number of questions we have here. I want to start off by just talking about the trends we're seeing around digital transformation. I think, you know, we're recording this 2020 in the midst of the COVID pandemic, which has had a really interesting impact on software. And I think, you know, Satya Nadella, CEO of Microsoft, recently said something like two years of digital transformation have been compressed into a couple months and that's a trend I certainly hear a lot about from every large enterprise I talk to, which is digital transformation. Every company becoming a software company. Software development is a core competency and as part of that a move from waterfall to agile development to cicd and an increased focus on developer effectiveness and productivity. Iran, let's start with you. What does all that mean? And can you talk about how this transformation played out at Microsoft?

Yes, sure. In fact, I was fortunate enough to meet Satya Nadella in person. Most of the executives and board members already acknowledged that their business will be disrupted in the next two to five years. What I also noticed is that enterprises that allow developers to be responsible for the end to end delivery process are at the forefront of digital transformation. In these environments, development teams have the ownership, cross architecture, security controls, business logic, data flows and infrastructure. And the developer ownership is one of, I think from my point of view is one of the fundamental culture changes in the enterprises and it's what drive growth. And in a very short period of time I think this is the magic here. Even development teams begin to see their immediate impact on business growth and this is the unique moment where behind digital transformation culture. And this is my point of view. But last but not least, from a practical point of view, I think this is really practical. When you want to move fast and you want to adopt Agile and cicd, you don't have any long design specification processes, documents that you hand off to developers like what we did in waterfall. And this is something to think about if there may not be any design specifications that you as a security architect can review as part of your risk assessment. And you need to do a minimal design work. So the only thing that was left is that the code is the actual design. And if the code is the actual design, where do you identify security and compliance issues in the design? This is I think one of the interesting questions that we learned across ilearn and we as a pro learned when we worked with customers across their digital transformation process.

It's interesting like you're both talking about the opportunity here around driving more developer ownership and letting developers drive business metrics directly, but then also the challenges that get created when that happens around, you know, lack of or perhaps existing process and tooling not being effective in this new world. And so I want to talk a lot more about that. But first, Samir, I want to ask you the same question. I mean you've had a really interesting perspective into this, you know, at Citi and now in Perva. Talk to us about how you've led some of these efforts and what you think of the opportunities and challenges.

I'll give it to you from the perspective of recipient of the demand to innovate and change. Supporting a business within my previous experience obviously, but it's interesting. So the digital transformation, when I was being challenged around really looking at how we can streamline and innovate and move faster, was really about knowing how the customers and consumers are interacting. And what I mean by that is there's been a significant change obviously both in how companies and businesses, especially in the financial industry, want to change and also how quickly the consumers want to change at the same time. So for example, if you're used to picking up the phone and calling your broker and making a trade, now all of a sudden you can do it at the tip of your finger. What is the risk threshold? Is it a million dollars? Is it $100 million? What's the appetite for the company to actually take a risk? Do they really know who that person is behind the tablet? And that created an entirely different risk profile and challenge for the business on one angle is to innovate and move faster on the other side. All I would say in the middle side is all the connectivity that came with digital transformation, which is all the external relationships. So no longer is a dependency on somebody pushing paper around for authorizations approval. They're all integrated with external businesses. Other just think of APIs and B2B relationships, they've also been moving to the digital space. On top of that you have the regulators who are telling you well you are responsible for 1000 different controls and guess what, it hasn't changed. Now that you can do it systemically, if we want to move faster, we're going to expect you to be able to answer the same question. So the challenge for me supporting the business and also working with the technology heads and the developers was how can you now move to Agile, let alone DevOps, move to Agile and still be working like a waterfall model following the same waterfall risk and compliance requirements. It was mind boggling. It took many, many years to put together a really good strong automation. So much layers of complexity. Not only you have to innovate, move, support the business for digital transformation and cloud, moving to the cloud, but also using the same mentality to stay compliant and be risk averse and be fully cyber secure and implement all the right controls. I think that's where my discussions with companies like Appiro it really begins to answer a lot of those questions and bring upon maybe the concept of governance as code becoming a reality. Over time. I think that journey now is catching up finally and I think we're going to move even faster in the future.

I want to double click on one thing, Sameer. I think in the past you said something like everything is becoming code and there's a lot of positive there. Developers can spin up new infrastructure much more easily and quickly than ever before. But then to your point, it creates a whole new set of challenges. And how does it change how you prioritize your time and your efforts across different areas?

What I've done, even after joining Imperva, is kind of rethink security, technology, risk in general, more about business transformation, business enablement. And what I mean by that is we have to get out of the habit of just looking at the frameworks and this controls and saying, well, if the technology need and demand is X, then we have to apply Y. It doesn't work anymore. I think for all of us in the cybersecurity space is to really rethink and remind ourselves that we're actually there to support a business. We're not there just for security, which means we have to change the way we think. We have to actually innovate as well. It's understanding the innovations side of it, but more so really challenging the risk professionals to really rethink and enable some of the automation that needs to come along with it. Because if the two don't come together, we're never going to be able to support the businesses. Innovate.

Yeah, absolutely. You and I have talked a lot about some of these challenges you know, Samir is referencing and the problem with sort of existing approaches to risk and security and how they become blockers in this new world. Now's a good time to tell us why you started APPIRO and what, what EPIRO does and how EPIRO addresses some of the challenges Sameer is talking about.

We all know the famous saying Mark Adrisson in 2011 proclaimed that software is hitting the world. I think in 2020 is code is changing the world because in the cloud first area enterprises cannot distinguish anymore between software and infrastructure. It's all code. And if we'll take it one level down. And going back to what I said about developers ownership and digital transformation, developer will not open a ticket anymore for it or manually will go to the cloud provider UI to fire up a compute resource, change network structure, add roles or policies, or even change the API gateway configuration whenever they introduce a new API. It's all code. So the challenge we are facing to application security will be multitude by several levels this is basically how I see the picture and I see a huge shift to developers own the end to end process and basically codifying everything across the application security, compliance, governance and infrastructure. Going back to your question, so as a director of engineering at Microsoft, I was also an owner of product risk. I was responsible for prioritizing, remediating and also communicating risk to upper management. And I think, you know, basically it was a constant struggle. The number of features that we delivered to production grew exponentially and each change had to go through the same labor intensive processes that Sameer was talking about before deploying to production. Maybe we should cover only two or three of them. Like risk assessment and threat models, tools tend to rely heavily on self attestation which leads to eventually to poor data quality or inconsistent unreliable identification of or and remediation of risks. And in addition these tools were not being validated against code changes. You know, and this is what eventually delivered to production. And there was a huge wall between the risk practitioners and the developers and eventually the code that you deliver to production. Let's take just two more examples. Penetration testing, which is a labor intensive process that must be contextual to be able to produce meaningful insight. How do you do that? You have basically two options. One, you can interview the development teams and understand what are the material risky changes and focus on them or manually go one by one on your JIRA tickets and understand the context of these changes. But we're going back again this is rely on self attestation which vulnerability scanning tools like static code analysis and others identifying only vulnerabilities, the reason that they have or produce a lot of false positives because the lack of context around the developer knowledge and the behavior and the code changes. And this is why we formed a PIRO to reinvent the secure software developing lifecycle. Solve this board level challenge by bridging the gap between CIOs CISOs and build trust between development, security and compliance teams.

To add to that, the practical reality is as technology is moving much more to agile, it's been really around simple fact that instead of one big change that you take 2, 3 months to deploy, now it's become 50 small agile for risk professionals, for cyber everything was designed around well if there's a significant change then I need to do why I need to involve a privacy person retail view for cross border data transfer or I need to do a certain type of security assessment. But because they're now all dozens of small little changes, it's easy for them to bypass these controls. But then ultimately when you do release three months down the line, but everything's been developed in agile fashion, then you're still bound by the same regulatory requirements. Where do you get that visibility, even make that determination assessment? You can see what's been happening with some of the regulatory responses and some of the fines for companies with lack of effective controls, especially around moving to cloud and it's creating jitters in the marketplace and it's purely because of the lack of visibility that currently exists in the innovation space.

Yeah, absolutely. Sameer. I want to follow up on that and maybe with two questions. One is how much of this is a technology problem versus a cultural problem? And then the second piece is comment on a pro and your perspective on the role a Piro's product can play in driving transformation.

Sure, everybody's trying to move faster, but what really happens on the ground is the rules of the road are still there. The rules haven't changed, they've become a lot more stricter. Right. Regardless of where you operate in the world, you, you're going to be bound by a certain set of regulatory compliance requirements. And what's happening is the culture change has already started, but as it started with the business and digital teams, even the technology teams are adopting innovating very, very quickly. The challenge, though, the culture that hasn't really changed is the risk, compliance and security. And I think that's the challenge that we need to solve for. It makes perfect sense, but because everything, like I said, was moving to code, we also need to rethink about how we apply and change the risk tooling that we currently rely on. We need to really push them to the edge so they can also innovate and help the business to transform. There is really nothing in the industry that really gives you a context and view of a technology change, especially aggregating it, understanding where it's happening, who's doing what, and being able to systemically and more efficiently actually answer those compliance questions and not rely on hundreds of people on the ground who are just really constantly engaging directly with technology teams and developers to get visibility. If you can automate it and at least bring about some sort of technical capability to it, then that would be amazing.

Yeah, absolutely. One last question on Appiro. What's the status of the company, some of the learnings you've had from customers you're working with and the types of customers that could benefit from something like Appiro?

So Appira now is deployed across industries, including large banks, large enterprises in the gaming, healthcare and software development verticals. What we manage to do is to measure in a quantitative manner what are the success criteria. And this is the key element here. So our customers stopped using manual risk assessment questionnaires and they automated the assurance before releasing code to production. This is a quantitative measurement on how you can reduce time between compliance and security teams. You can allow them to focus on bringing value to the business instead of wasting time on tedious questions that repeat themselves again and again and again without basically validate them against the code changes. We also reduce the money that our customers invested on pen testing and they got better results because we narrowed down the scope on only on material changes that are risky that has business impact. And last but not least is that we allowed security and compliance practitioners just to focus on the changes that are really matter to the business. And even one more use case is that we reduce the amount of false positives that these customers got from different tools by enriching our own intellectual property around developer behavior and and business impact knowledge.

Great. Two closing questions I think. One, you know it's so interesting to be on this podcast with Idan, someone who's built multiple security companies from scratch, and Samir, who's helped lead some of the largest security programs in the world. Talk about how you work with each other and how can startups be most effective in working with large enterprises and delivering new innovative solutions to large enterprises. Maybe Samir, we can start with you.

Sure. I think the best way to engage with startups around innovation and change is really. Yes, I agree. Starting at the top and my engagement with Idan, I think the visibility around really what goes on in the heavily regulated industry is helpful. But it's also transformed our conversation to even more around risk management. The reality is even smaller and mid sized organizations who may not have the robust risk culture, risk frameworks can begin to use tools like Apphero and really begin to much more quickly adopt similar capabilities like a lot of the larger organizations have to follow because regardless, at the end of the day they're servicing the same industry. Right. Or similar industries, whether it's healthcare or some of the other critical infrastructures. And I think coming with that mindset is important to help shape where the technology needs to go and I think that's where the value comes in significantly.

Absolutely. And Idan, I'd love to get your perspective.

So I think it's priceless, I will say it's priceless to have someone like Sameer with the knowledge and the day by day struggle of such a large organizations and complex security programs and to understand and hear firsthand from a person like Samir about these challenges helped me personally shape the strategy of Appiro, the product of Appiro. And it helped us also provide solution to other large enterprises that had similar challenges. Every startup must have someone, you know, like Sameer or like other CISOs in large enterprises and just listen, just sit with them and just listen, don't talk and listen to their insights and eventually compile the insight into a working product that solves real world challenges.

Yeah, you're hitting on a really important thing that we see, which is companies early need to have a very tight feedback loop from customers back to product. And you want that feedback loop to iterate as quickly as possible.

Right. And have an open mind.

Absolutely.

Don't invest in entrepreneurs that are not like that. And you cannot succeed, you cannot build a large company without this specific process.

I like to close these podcasts with a personal question. So we're sitting here in 2020. It's an unusual year for both of you guys, either in your personal lives or with the teams that you help lead. What's an interesting routine that you've adopted in 2020 to stay balanced, energized, you know, refreshed as we all work through this year? Maybe Idana, we'll start with you.

So I will do a tactical answer and a bigger one or a strategic answer from a tactical point of view. You know, it's just sending wine beers to your team and jump on a zoom call and just talk about not work. You know, have fun with the team across Zoom and let them know that you care about them even if you are not sitting next to them at the office. That's one thing. And the second thing, which is the broader picture is you need to train your team or give them the tools to interact with your customers over a video conference and train them and talk to them. And this is what I did. I invested, I think I will say between two to four hours a month to allow my team to, to understand what are the processes and tools they need to do to implement, to build the trust over with customers over Zoom and other things that the customer will feel. You know, we are working with the largest enterprises in the world. They need to deploy EPIRO if it's on prem or as a software, as a service, they need to trust us over video.

Those are both great recommendations and I'm looking forward to my wine delivery before the next EPIRO board meeting. Sameer, same question for you.

The only thing I would add is encouragement of everyone to get out, do as much physical movement exercise refresh. We are social humans. At the end of the day, our creativity really comes out when we are together in a room collaborating and doing things like that. But now because of COVID we're changing our habits. Zoom is helping, but it's not solving the basic questions around the humanity. I think everyone on my organization and my team have been encouraged to do more outdoors. I think we're all riding bikes and doing different things just to kind of just, you know, remind ourselves that we do need to stand up and do something different. And the flexibility that allows us now is we're all remote. So the work life balance, I think is significantly better.

Absolutely. It's such an important point.

Samir.

Well, Idan, Samir, thank you both for joining us on Gray Matter and thanks everyone for listening.

Thank you.

Thank you for having us.

That concludes this episode of Gray Matter. You can subscribe to our podcast on soundcloud.com greylock partners or wherever you get your podcasts. You can also find new episodes and blogs on our website, greylock.com you can also follow us on Twitter at greylockvc. I'm Saam Motamity, and thanks for listening.