Evolving Enterprise 2021 - A Startup Founder's Guide to Cybersecurity

Foreign.

My name is Oren Younger. I'm an investor here at GGV Capital. I'm super excited to be here today to have a fireside chat about prioritizing cybersecurity from an early stage to help win enterprise customers. And I'm joined by two powerhouses in the field. Michelle Zetling, co founder, president and COO of cloudflare. Enrique Stathi, Cisof Twitter welcome both and, and thank you so much for joining us at Evolving Enterprise.

Thanks so much for having us. I'm really excited to be here.

Same, thanks for having us.

Awesome. So let's dive right in. Cybersecurity is a known domain in business today, but both of you started operating in this space before it was hot. Would love for you to share with our audience how you got involved in cybersecurity. Michelle, why don't you go ahead first?

Sure.

Yeah.

A lot has changed since I started Cloudflare about 11 years ago and it is more well known today, which I think is actually a really good thing. And I know we're going to talk more about that later in today's session, but how I found it was a little bit, I mean almost by accident. It was through a friend, through a classmate. I was doing my MBA at H at I was doing my MBA at school and a classmate was really proud of something they did that helped was called Project Honeypot that tracked kind of bad behavior online and, and this person, Matthew Prince was so proud of this, always talking about it and, and finally I kind of stopped to have a conversation saying wow, you're so proud of Project Honeypot. What is it? And he talked about this building this community that were helped tracking web spammers online. I didn't really understand why that was important and fast forward, it turned out to be important because if you were a small business owner, an entrepreneur, a non profit, it was actually really hard to get CyberSecurity Solutions about 11 years ago. If you were a big company there were solutions but for everyone else there wasn. And most of the world is everybody else. And actually that became inspiration for us to start Cloudflare. And today Cloudflare helps protect, speed up and make any Internet property more reliable. And I'm actually really proud to help make the Internet safe for every day. And so that's how I discovered it and fell in love with it.

That's amazing. That's a really good story. Rinky, how about you?

Yeah, similar actually. So I was graduating a couple decades ago, graduating with my computer science engineering degree and it was a bad time in the economy and I just was hoping and praying that I'd land a job. Most of my friends were going to go do their master's degree or almost decided maybe tech's not for them and started pursuing law degrees. I ended up There was a pizza night. One of my friends was being recruited by PG&E. I was not. She said, free pizza. I was a college student. That sounded fantastic. I went and just was schmoozing and talked to one of the hiring managers. He asked me, what's your favorite class that you're taking? I said, cryptography. And he said, I've actually got a role in information protection at PG&E and I'd love if you came and interviewed for the role. And so I did. And the rest is history. I've been in cybersecurity ever since.

Pizza is a great starter for a lot of great things. Really glad you chose this occupation. Well, this is awesome. Rinky, you have a really interesting charter running security at Twitter, but you also had opportunities of running security for really large, different corporations. What are some of the key differences between protecting an enterprise and protecting individuals?

There's a few, and I think there's actually a lot of things that are similar when you think about protecting an enterprise or because you're protecting people, you're protecting your company and the employees and your data. So there's a lot of things that are similar. I think the biggest thing for me, especially coming to Twitter, which is very unique, is that your tax surface is much broader and any change you make, good, bad or ugly, especially at Twitter, you're going to hear from your consumers right away. They're going to tell you what they think that you've done right, what you could do better. So it's a really interesting rule that everything we do is visible and you kind of have to really make sure that the decisions you're doing, how we're vetting them, everything is really well thought out. So super interesting working at Twitter, and I know we're going to be talking about this more later, but I would say even when you think about most consumer companies, Twitter is a different beast altogether.

That's super interesting. Yeah, I'm sure you get response right away from if something goes bad. I want to talk a little bit more about some of the changes you're seeing in the cybersecurity recognition within companies and the reason it is really important for businesses. Michelle, you spoke in the past about cybersecurity originating as an experts club of sorts and not a strategic endeavor. What have you seen change in recent years?

Yeah, no, I think a lot has changed. If I again, I think about when I started Cloudflare 11 years ago to today, a lot has changed and I think Fast forward another 10 years from now, I actually think it's going to continue to evolve, which is a good thing. I used to think it was kind of an experts club, but you were an expert. And security cybersecurity was kind of for the IT team or the security team to deal with and the rest of the organization kind of went on with their roles. And today security is permeated to everybody's role within a company. Actually the best companies that's the case. I think there's some companies who still lag and hopefully they'll look at the people who are top quartile and get better at it. And what I mean by that is whether you are on the marketing team, whether you're an engineer, whether you're someone in the sales organization in finance. Actually security impacts everybody in a company and the really best companies take that seriously and know that. And it's not just the security team's job. Of course there's a job for the security team within an organization. They're incredibly important and Ricky's going to tell us more about that and what they do. And I think that super important. But you need your developers thinking about it. How do I write better code? You need your marketing teams thinking, well, I'm going to add this third party service to my website to track users. Well, are we sure it's not malicious? And because otherwise that's how really the best companies are operating today. And so I do think it's much more at the board level, much more a business concept. And if you are both starting a company or working a company today, you just kind of have to understand the ABCs of security and it's actually not that hard. And the leaders that are leaning in and say, okay, teach me the basics and let me talk about it are really well considered, top quartile among their peers and probably better positioned to grow their businesses going forward.

That's really interesting. I remember back in the day when I was running security, I was always talking with the board and management and trying to explain and asking them like this is important, this is important. But your point of this being an initiative of everybody in the organization where they're developers or marketing or hr, I think that is a much better way of analyzing it and getting widespread adoption. And this is really coming together that way.

Phenomenal.

Rinky, you held different Leadership roles and really large organizations. Have you witnessed any changes in the dynamics towards security in the last few years?

100%. I mean when I think about leading security, when at least when, even when I started off, you dealt with security incidents. It was a very back office role. Nobody kind of even knew that the security incident happened. It was the security team's responsibility to go and solve the issues and problems. And now I report to the board more than quarterly. There's risk committees being formed by different companies now that's very focused on cybersecurity and presenting to a risk committee. And so you're seeing that and you're seeing more CISOs and security leaders take board positions which I think just kind of like can't underscore the importance more around where security is kind of elevating into companies and how important it is. So, so massive change from where it was years ago where you didn't even know like the Infosec team and what they did to now it's very much front and center.

Well, continuing that thread, a lot of people have heard and still talking about the SolarWinds incident. There's the question of whether you're using or we're using SolarWinds. Another of any of my vendors are leveraging SolarWinds software. But even more disturbing one is can this happen to another known vendor? Just replace SolarWinds with another known brand that you know, rinky. How are you dealing with new vendors trying to integrate into Twitter?

Yeah, I mean we were not a SolarWinds customer on Twitter, but it did raise questions as to looking through our third party security program and just making sure that hey, is there anyone using this? Was there anyone impacted? So we did do our due diligence around that. You know, my point of view on this is breaches happen, companies are impacted by it. I think from a consumer perspective being prepared to deal with it, making sure, especially with your security vendors that you've got really good relationships with them and you're vetting that as a part of, you know, I always talk about this even when folks say there's, you know, your, the security space is inundated with vendors and new security technology and it's always the people and at that company that are the most, that mean the most to me, that if they have the values and the culture and that you have a good relationship with them, you're going to, you know, if the company, a vendor was to face a breach, you're going to get through it, you're going to work with them and you have to have your own incident response and kind of how you're going to recover from a crisis buttoned up pretty well. So that's my point of view on that. You know, I think it's a really tough one and I think SolarWinds was a real shake up too in terms of just thinking through vendor risk programs and you know, are they meaningful in the way they're shaped today or do we need to look at that differently?

Yeah, you know, this is a good example I think for again the founders listening or if you're working on a growth company, you might have read about SolarWinds but actually don't know what happened. So let me just explain quickly what happened because again I think it back to just, it's the ABCs of security. This isn't rocket science. So SolarWinds is a vendor, lots of big companies actually their customers are mostly big companies. So less startups and more big companies bought their, their, their monitoring software. And all of those big companies have checks and balances before they bring on a vendor. And if you are a small company today, you might not do that, but that is your future. And now before we buy any third party software, it has to go through a security check through our security team vendor check. And like that is, you know, we start building a company and these are the sorts of processes you add over time. And it's a good thing, It's a good thing. And so all those big customers of SolarWinds, they did checks and balances and, and you know, SolarWinds got checked off. So what happened was they're running SolarWinds software and there was an update to the software and in one of the updates there was something, a vulnerability that could introduce and this on this, in this case it was on purpose. So somebody was maliciously trying to do something. And then the way that it got caught was one of the companies and an employee, they had their profile and they got an alert, kind of like with your credit card when you get an alert that maybe you can set up alerts on your credit, personal credit card when a charge is made. They got an alert saying hey, it looks like you added another device to your profile, just making sure that this is correct. And the employee said, I didn't add another device. And that's how the vulnerability got caught. And so now you think about, okay, I'm a founder of a company or I work at a growth company. You think, wow, that's actually great to have that check and balance implemented in my business, how I'm doing Business I want my employees back to. It's not just the security teams. It's everybody. I want my team thinking to know, get alerts if they're. If things are getting their profiles internally would have access to internal applications are being altered. And these are the sorts of things when we talk about identity and access management. That's why companies talk a lot about it and why it's so important. But this is an example of something. Oh, now that you understand that you can make better decisions as you at your company to get ahead of these things because security firewall drills are very stressful and they happen as. As Rinky said and you read about in the news and that's not. But it's much better to be trying to be proactive to get ahead of it so that you minimize the number of fire drills. Fire drills will happen, but you want to minimize them as a business leader building a company. And I think that that is again, back to the companies who are the best are the ones who are trying to say, okay, take this seriously. We take this seriously. We're trying to do the ABCs so that we minimize the number of fire drills and emergencies that then go send the company in tailspins. And when bad things happen, of course we'll deal with it. But it's. That's a little bit of bridging. What happened with solar flares to I think building a company today with many of you are doing.

Yeah, it's a really interesting take and I'm sure the founders in the room really appreciate it. Many of our founders look at security as kind of a hurdle you need to pass and it's kind of a checklist. But I think it's really interesting as you shape your business to not only pass that hurdle, but actually use it and leverage it and to become more powerful and actually a good selling point for you to other businesses, but reinforces the organization as a whole to move forward.

You know, just one point on this Oren, just to punch it up because again, I didn't really appreciate this when I started my company. Like again, we offer cybersecurity. That's why customers hire us to help them with these things. And so we've taken it seriously from day one and whatnot. But now we have over 1500 people around the world. We're a public company and we have a lot of people. We have an internal audit function because we're a public company. Do all these filings with the SEC socks. There's all these checks and balances. We have an amazing Chief Security Officer. We have an amazing cio. We have all these sorts of people who take these things really seriously. And you know what? I hear often from these very seasoned executives who come work at Clever, they say, wow, it's so nice to work at a company that takes this seriously. I kind of look at them, I'm like, I don't understand what you say. And it's exactly your point where, where it's, well, it's set from the top. Like you and Matthew and the other executives actually care about it. You talk about it making us a better company and that we, you know, we talk about it internally and that employees are reporting things and it's not like that everywhere else. And again, you only know what you know. But it's interesting that really this is a point of back to. It's like a business leadership skill and for everyone listening, you have the chance to build that company and you will be better prepared and I think win in the marketplace because of it.

That's actually a really good and interesting point a bit. Founders have a lot on their plates and they need to prioritize in a really resource constrained environment. Where in a founder's top priority list, do you see security falling rinky? What do you think? Is it like top one? Is it top 10, top 100?

I think it varies from company to company. I've seen, seen really good companies that focus on security from day one and they take it really seriously. You're seeing I see that more in especially security tech companies where they do understand security and they understand what a breach might cost them. Not every company unfortunately is like that. A lot of I've seen companies that don't do it right, they hire a CISO or they hire someone that's like a security architect just to have the role there and to be able to answer some questions that you know, you're going to be asked as a vendor questionnaire to the company that you're selling to and they don't make the proper investments in security. And I think that's a huge miss, right, Because I think that it ends up costing you so much more to go and do security right later than to really focus on that upfront and at the beginning. And I think founders who get it and who do do this right, they build a robust product and they don't have. They win. They win more than the ones that don't. And you know, they win the security teams and security teams. Whether it's a security product or not, no matter what company it is, you're buying security teams are always going to do reviews and if you sell them, it makes it the whole I think selling process just that much easier. But you know, I think it varies to ask is it the top one or ten? In some it's not even a priority. You see companies grow so large and then they go and bring in security teams. So it didn't even fall in their top list, even top hundred list in the beginning. But the companies who do do it right, I think it falls within the top three.

That's very interesting. Michelle is, you know, obviously Cloudflare is a huge success and it's a big company today, as you, as you mentioned. But if you were to start a new company today, where would you put security even if you're not building a security product?

Yeah, you know, so cybersecurity first of all means it's like a huge industry. So it's. So I think I put myself back to the early days when there are way more things to do than people do it. That's like, that's a first of all a sign of success. So that's a good thing. But and even fast forward today we have way more things to do than people to do it. And so the prioritization of any growth company is real. And I'm sure it's the same at Twitter. Actually there's a long list of things. I'm going to bring my product request to Ricky after this, after this call. Just joking anyhow. But so you think back and you're all building products. Like everyone that's listening to this works at a company that is trying to build a product or sell a product. And so the first thing is that product probably has some sort of digital first. Like it's probably connected to the Internet some way. Right. Whether through a website or it's an application that you're selling, it's a service. There's some, there's some tech component to it. Like step one is you got to make sure it's protected. Like you can't be naked on the Internet. You need some digital armor. And so like the basics is you need a web application firewall and DDoS protection. And I mean again, this is super self serving. This is what Cloudflare does. But this is an example where now it's literally 20amonth. You can get that like out of the box. So it's like what we see with startups is they say I'm just going to put that in front because I don't want to. If I don't what happens is my competitor knocks me offline or I get an attack by like, you know, an education technology company gets attacked by a student who doesn't want to take the test, and then all of a sudden they're knocked offline. You're building a gaming company, the gamers think it's funny. And they, instead of throwing eggs at each other's hosts, they like, they launch attacks to each other online and they think it's funny. But you're, you gotta, you gotta, you're building your product. You need to make sure you're delivering your customers. Getting knocked offline is not a fun experience. And so you just put a WAF and a DDoS protection in front. And that used to be very expensive and now it's very cheap. And again, Cloudflare is one of the reasons why that's the case, as many others. But it's this idea of nobody should be putting anything online that's naked anymore. Put some digital armor and a WAF and a DDoS. So, like, that everyone should do that on day one. And it literally costs very, very little money. And that's an easy answer. But then you start to ask yourself, okay, well, now all the traffic coming to use my product, are they legitimate, are they bots? And as you go along progressively in your business, you might care about that more. I don't think that's what some people care about on day one, but over time, you don't want people hogging tickets or taking places in line that legitimate customers would have. So bot management, all these sorts of things, like, these things become more important. That's on the product side. As you get more successful, your team is shipping a lot of code. What you don't want to happen is the solo fair thing. You don't want your team to ship security bugs to all of your customers. You've just built a great product that everyone's buying. The surest way to lose trust of your customers is to introduce bugs in the product that you're shipping. And so probably not day one, but as you get more successful, you got to think, oh, wow, our engineering team, do they have good security hygiene? And so there's some basic things you can do there for every, you know, if you're using Jira or Confluence or Wiki, basically for every Jira that describes how you're going to ship, the software have a corresponding security ticket. So even know who looked at the code, you even know who's like, you just know who's a check and balance. And this is really kind of best practices to get it into your architecture early on versus bolt on after the fact. That Rinky was saying, like, it's hard to add that off to the fact. If that's just how you build software at your company, it becomes very standard and those proactive things make a huge difference. Use fuzzing. You know, you buy fuzzing scanning to make sure there are no just common things to look for. You just catch that before you release it to your customers, which is good. That's proactive. The second piece is, as you get more successful, assume something's going to happen. Assume your all your passwords are going to leak, all your customers passwords are going to leak, and it's on the COVID of Hacker News. What would you do? And like just, I hope that never happens to you. But just think through internally, if something bad happened, what would we do? Who would do what, what would we write? How would we look into it? And if you kind of actually practice some of those emergencies and pretend it makes once you actually have to go through the emergency much better if you just know who you would call in and have a little bit of an emergency protocol. And nobody starts a company thinking that you need that. But those are the sorts of things that you would add in over time. And the last piece, I would say so you kind of, you've got your product online, you want to have some digital armor, security armor in front of it. You kind of have your internal development practices where maybe not on day one, but pretty early, you want to start to have that good security hygiene. And then the third element that comes in often as companies grow and are more successful is okay, how do we make sure a malicious person hasn't hacked into the company and stealing company secrets because boards, people really care about these things. Or how do I make sure someone internally isn't stealing information like an insider threat? And that often comes after the first two. And it's really important as you become more successful because companies are just groups of people. And if you either have an unauthorized person inside your work environment, you can think about what kind of damage they can do, or one of your own employees who is rogue doing things that they shouldn't be doing. Both are really equally bad. And, and that's kind of what often happens. The companies start to think about, okay, how do we get ahead of this? How do we make sure that we're not, that we have good checks and balances to make sure that people aren't getting unauthorized access to workflows and applications internally or sensitive Information. And, and I think that that's actually really good hygiene for a company who is successful. Like, you want that. We all want that. We want a world that is more safe. And so I think those kind of. There's these three different lenses. But again, I think everyone in the audience should be asking themselves, where are we? How are we going to get better across all three at the right time?

That's super interesting. And I'm sure a lot of those things, you know, founders do some of those things and others like those are really good for thought. But at some point, I'm sure in the organization, you need to bring somebody to tell you what to do. That person has a title that is fairly similar to what Rinky. Rinky is wearing. Rinky. When is the right time to hire a chief security officer?

I, you know, again, I say do it in like make that top priority. If you have that thinking right from the beginning as you build your company and you have that individual that's thinking about the risks and a lot of the things that Michelle just stated around having that crisis management plan, playing out the scenarios of what could go bad, having that basic digital armor, you start from the beginning and if you do it from the beginning, it's going to cost a lot less than doing it at the end. And so I think it's one of your first 10 hires, once you start thinking about your product that you bring somebody on. And I don't see that happening yet. But I do think that this is going to change that. Hopefully what we've been preaching in security again and again around invest in this in the beginning, because it's much like from a regulatory perspective, from what you're going to pay when you have a breach and all of these other things, it's going to cost so much more the more you wait to go and secure your company in the right way. So I think we're going to start seeing this earlier and earlier in how companies are starting and hiring security folks.

That's quite interesting. I've seen this movement of, you know, when you're a public company, you need to have a ciso. When you are going to become a public company and you need to have a ciso, then it goes down to like series D, C and B. But what you're saying is quite interesting and a very radical approach to this. Michel, do you agree?

I mean, you know, sometimes people start companies not knowing whether they're going to be successful or not. It's like as soon as you think you are going to have that you're going to stay in business. That is something you want to invest in, right? And it's just as soon as you know that you have kind of something product market fit that every successful business needs to have good security hygiene. So it's kind of back to what Rinky's saying is like as soon as you know you have a company, you need this. Like it's, it's not something you don't need, you're going to need it. And so it's, it's more. I think it's as soon as you realize you kind of have product market fit and that means different things to different founders. But it's really like, wow, there is something here. Then you want to start to invest it because otherwise it's really hard to bolt it after you can. Everything's possible but man, it will be cost you a lot of money and be very painful and you'll think why didn't I just do it earlier? It's so much easier to do it right from the beginning. And so I think that's, I think as soon as you realize you kind of have a real company and that now you got to go scale that company, you've solved a problem that feels like it's going to be of some size, then you have a responsibility to build a business around it and you're going to build a business. Security is really important piece of that.

Very cool. I want to shift gears a little bit. I want to talk about the biggest myth you think should be debunked about security as they might be seen by non security founders. Michelle, what do you think?

It's not important. It's boring. It's, it's too hard to understand. I guess those are like, those are which I've already spoken about. Like it's, it's really not hard to understand everybody. To be a digital citizen or, or work in tech, you need to understand the basics. Like to me it's like it's ABCs of security and, and from my parents to, to, to someone first fresh out of college working at a company, they should kind of understand the basics and that's a good thing. And, and, and the market has become much more broadly available. And you're. The fact that we even have this panel at this conference or the media talking about different sorts of things just kind of now part of general business news. And back to Rinky's point of it's getting built in much earlier. Like that's, it's just, it's part of doing business. It's like understanding, like how to understanding how to architect a product or what code language to what language programming language to use or you know, what's cool way to acquire customers. It's kind of the same. It's kind of the same now. It's what's the, what's the latest in security? So I think those are, those are the good things. I think those are the things that have to be debunked and then the last thing that has to be debunked in my opinion is that and this one is kind of down in the weeds, but I think it's an important thing. I wish I would understand, would have understood this better as a business leader earlier is hackers don't hack in usually. They usually log in. What I mean by that, it's not like a Mission Impossible Tom Cruise movie where there's like all this like really amazing research going on. Sometimes that happens, but it's much more. They're logging in and they're logging in because they found people's usernames and passwords online and then they write programs to go check it and they can check it really quickly and no one's got the digital armor to stop it. And so then they just log in and once you're in you can do a lot of things. And so I think that's the last piece of hackers aren't hacking and they're logging in. And so if you have better access and management controls you actually way you'll be much better off than the average company.

So you don't need a black hoodie and a matrix background in order to understand security. Is that what you're saying?

You could have that if that is your thing. And it could also be a purple dress and long hair.

Yeah, definitely. We only have a few minutes left. I want to finish with a future Ford pov. What are some of the areas do you see right for innovation disruption, security in 2021 and beyond? Rinky, could you go ahead first?

Yeah, I think it's super interesting just having this time of COVID has it's like it's fueled innovation in the security space. And so I just see so many new vendors. What I think is really interesting is that there's more security companies thinking about how do we make lives easier for engineers and they started solving these niche little areas and I think the companies that are starting to think about building a platform around that, especially when you think about cloud and you think about developer security, I think there's some. Those are the areas on like rather than solving that niche, building a solid platform that does everything from your development stage to how do we solve security to the operational stage, thinking about development all the way to ops and building a platform around that. And especially I think that's where I'm seeing a lot of disruption. There's some companies that are really emerging and they're not even necessarily, I think targeting security folks and I think that's what makes it super interesting. So I think that's a big one where we're going to see a change. On where are security companies really targeting. Is it security folks or they're trying to really solve pain points that exist elsewhere and seeing some of those companies really emerge as platforms?

Yeah, I really love the concept of selling security not to security into Michelle's earlier point, I think it makes a whole lot of sense. So you have this huge amount of constituents inside the organization that need security solutions and you don't want to be in that position that you need to force it down. You want to have this bottoms up movement that where users are using the tools that they love and they're delighted by. Well, Michelle, what are your bets?

I'll tell you my bet, but just I was thinking about Ricky's answer and I saw a tweet on Twitter about someone mentioning that the three best businesses are either you be the biggest of something, you offer a niche service, or you build the platform which all powers everything else. And so this idea of security being easier to use and opening it up really, really speaks to me and I couldn't agree with more. I mean if I look back, it's a big company, you're a big global 2000 on average a CISO is buying 70 security vendors. And that is not the future. I just don't think that's the future. You're going to see platforms where you can buy more of these security services from one company. And again that's a self serving thing for me to say because that's one of the things Cloudflare does. We have something that does all these different types of security. So there's that. The other piece that I think is super interesting is now companies used to secure their offices, right? It was kind of a castle moat world. But now all of a sudden, overnight everyone's working at home for many businesses because of the pandemic and Covid and going forward, all of a sudden it's not just about securing your building, your actual physical office location, it's what about everywhere our employees work from home and the devices they're bringing home. And I think that that's super interesting. We're seeing a lot of innovation because I think that one of the things that you hear about trends accelerating is this idea of more distributed work, more remote workers, not always having to come into the castle. Right. That it's not, we can't build a perimeter. So this perimeter is going away. And it's more proving who you are, making sure you have access, making sure you're not bringing malicious things into the work environment, even if you're at home. And I think that that is interesting while not. While not having a performance tax. You know, we talked a lot about security today, but the other trend that I'm seeing in addition to this ease of use and platform is that security used to be so isolated. And not only is it becoming wildly accessible, it's blurring lines with how do you do it while also speeding things up, how do you do it while also making things more reliable. And those are these old lines that used to exist are really starting to blend, and that's opening up opportunity for a lot of new innovation and ways to attack problems, which is great for the set of founders that are listening to this and what they're building. I think that there's lots of opportunity.

Amazing insights. Michelle Rinke, thank you so much for spending time with us today and sharing such interesting perspective about cybersecurity with evolving enterprise community. Thank you.

Thanks so much for having us.

Thank you.