4 Secrets to Using Data Security and Compliance as a Competitive Advantage with Very Good Security

Problem is that currency, while it is a key to driving top line growth, it actually presents several obstacles to creating new lines of revenue and building more innovative products. As the world transitions to more and more regulation, as a lot of these privacy laws are passed in different jurisdictions, as you're all familiar with the three and four letter acronyms like GDPR and ccpa, all of these things are effectively laws that govern the movement and interaction of data. Again, data is currency. So there's a parallel to how data is being governed and how money is being governed too. And so basically these are barriers that are put up to stop innovation from happening with data that potentially has regulatory overhead as you hold it. So to transform it from an obstacle into an opportunity is a competitive advantage for you and your business. And we're gonna be excited to share with you some of the use cases that have happened today about it. So your job is to extract value from data and that's why you're collecting it in the first place, otherwise why would we have it? Right? And so we found that successful startups have actually turned this into an advantage. And I will explain a little bit how the four secrets that they've learned, and obviously there's a lot more, but I think this is a common pattern, is that one is that they continue to laser focus on their core competency. What is it that they started the company to do, what is their mission, how are they going to achieve it? And it's typically never ever done by saying, ah, in order to achieve my obstacle, I have, you know, to my vision or I have to go and get data security and compliance first. No, that's typically a checkbox so that you're able to achieve the outcome that you started the business for in the first place. Right. So by focusing just on the thing that you're providing value on, you're differentiating yourself in the beginning. The second thing is, the thing that we found that more successful companies do here is they're able to extract value from their data without actually having access to the data. Just like you and I can exchange money today without physically carrying cash or currency. So that's one thing that we've noticed and there's a reason why being able to extract value from data is critical because it reduces, and this is the fourth secret, sorry, the third secret, it reduces the compliance scope and it actually future proofs your application and your business and your product line. Right. It allows you to quickly respond to, to new regulation and new laws as more and more companies go international, have to deal with different jurisdictional laws. By being able to not have to worry about data security, compliance and privacy regulations, you focus just on building the proper security posture in your organization and you're future proofed for any future regulation that potentially can be passed that could be disruptive to your business. But and the fourth most important option, the secret that really works, is really energizing and basically not disrupting your existing development and product line workflows. Right? By getting your employees and your teams to focus on core products services without the overhead of security and compliance, what ends up happening is that you're just producing a much better product that's laser focused to servicing why you started the business in the first place. And these are secrets that we've absolutely seen today. And I think it's important for us to talk a little bit how they do it from a high level. So how do these startups really turn this security and compliance into a competitive advantage? And it starts with really not having the data in the first place, right? But typically we need the data so that we can extract value from it. Otherwise how would we do that? So there's a bunch of utilities that are on the market today that offer this advantage for you. One way is that you don't actually need the physical data itself, you just need some representation. So you start out by thinking about how do I anonymize the data? There's different ways to do that. The most common one that you've all heard of is encryption, right? You encrypt the data, which basically means an encryption for everyone here. So that doesn't know what encryption is effectively using a way such that there's a way to encrypt the data but also decrypt the data. So it's a two way street. You can encrypt and decrypt, right? And so what that does is that the problem with encryption though is that it is typically key based, right? And so what that means is that if the data is backed up and you throw away the keys or you forget how the keys work or the keys are lost or there's some kind of disaster, A, you've already logged potentially that encrypted data, B, you have to decrypt the data to operate on it, but then C, you have to do all these things to manage the keys as well on it. That doesn't mean you don't encrypt. It's just a tool, a toolbox. It's not the silver bullet that everyone is thinking on how to secure but also extract value from your data. There's another thing called tokenization. We think of a tokenization as the way if you ever go to a circus or a fair and you play the skeeball machine and you get a bunch of tickets or tokens and you trade them in for a prize at the end, tokens are basically a representation of that. They take this ticket based approach, but the thing that it does is it does provide some good security. But I think the privacy and compliance hurdle compensation. But the problem that it doesn't solve is that you have to either a de tokenize again has solves the encryption problem where now all you do is if you can't extract value from your data, you have to effectively say, well what does this token represent? Let me see the underlying data. Or you're limited to just. And again taking the circus example, using the token to a particular vendor itself. So you're limited by the value that that ticket can be exchanged based on the vendor that you're using the token based on your tokenization vendor. And so the problem with that is it does maximize value, but it's a local maximum. You only restrict it to the value that your vendors can provide. You can't choose and pick who to route and who to make business with because you're basically beholden to the upstream vendor that is holding your data. The last approach that we've seen really successful is something called zero data. That means that's a very off putting term, but it's supposed to get you to think what does zero data really mean? The whole point of zero data is extracting value from your data. But without the custodianship of that data, without any of the security, without any of the compliance liabilities that come with holding that data. By replacing the data with something that mimics the underlying data, you can share it, you can access it, but you can also reduce the sprawl of the data to let you focus on achieving your business objectives very quickly. You can control all of your data and you can securely operate, share it and innovate in different ways because you've separated value extraction from the data as well as from the actual custodianship and storage of the data. Today, and this is something you do today. You put your money in a bank and you transact by moving instructions that move the value of that money. You don't actually physically get on a plane, for example, and ship that, send that currency to a destination. You actually just issue an instruction. But taking that same approach is something that's what we call the zero Data approach, companies are able to achieve these business outcomes significantly faster just by lifting and shifting the data off of them, but still retaining the value. And there are alternative approaches to doing data anonymization and masking like homomorphic encryption and privacy preserving analytics. All of these approaches include zero data, but they are actually this is something that you can get as a platform that allows you to extract value from your data. So without further ado, I'd like to turn it over to Christina who's going to tell you a little bit more about some of how our customers or how some companies are able to use this as a strategic advantage to really accelerate their business outcomes.

Yeah, thank you Mahmoud. So I'd like to go to deep dive into what you have just talked about and talk about a company that has successfully implemented zero data approach and what they gained as the result. So Unit Finance is a startup that created a banking as a service platform that allows companies to embed banking services like payments cards or accounts checking into their own businesses through an API. Unit Finance was in the midst of their new card product launch and they decided to partner with Visa dps. Because Visa DPS is the largest, largest processor of Visa transactions globally obviously. And they learned that to implement this partnership they would need to become PCI compliant. As their launch was planned within the next four months, their options were either to postpone the launch or to go to the market without Visa processing. And they didn't like either of these options. So they started to explore the third option of building PCI compliant environment in house and running their own audits. Their team has estimated that it would take them six to 12 months at least and two to three full time employees to do this implementation. So they realized that it would not be attainable for them to achieve PCI compliance within such a short. That's when they discovered zero Data approach and they saw the light in the end of the tunnel. So Unit Finances customers today are able to issue virtual cards without either Unit Finance or their customers seeing or touching sensitive data. So imagine they are in a card issuing business and they do not see any raw card data sensitive information. Bottom line, as Unit Finance was able to achieve PCI compliance within just a couple of weeks and they were actually acknowledged the company who went live on Visa DPS the fastest in the history. So they also saved some money on not building the PCI compliant CAR data environment in house and therefore they don't have to spend money today to maintain it. They are able this way to shift their resources and most importantly their strategic Attention to serving their customers and to innovating and developing their core business. So to summarize, the four secrets that train compliance and security from a burden into a competitive advantage are the focusing on your core competency, extracting value from your data, eliminating compliance scope and future proofing and minimizing impact on your team. If you would like to learn more about Zero data approach, and if you think that security and compliance are currently keeping you from adding more revenue streams to your business, come visit Very Good Security at our booth. And also get a chance to win a mini drone. How cool is that, right? Also, right after this event, we're going to host a lounge with payments experts. The links will be dropped here in the chat, so join and bring on some really tough questions about payments data security compliance. We love that. Thank you. Back to you, Brian.

Thank you. Very, very, very great session. All right, everybody, it is time for Q and A. I know there's got to be some questions in this audience or fun facts ready to be brought in, so I am ready to receive those questions. You can easily submit your question by just pulling up the chat section or raising your hand or hitting the Q and A area, but by all means, let's get those questions in. I'm going to get startup. I'm going to start us up here really quick with one question that's come in. How concerned should startups be about ransomware and what should we do about it? Maybe we want to start there.

Yeah, I could take that one. Thank you. So, look, ransomware is a real concern, right. But ultimately, what are they ransoming? They're ransoming your data. Right. And so, you know, ransomware is actually not too difficult to combat. Right. The first thing we have to do is we have to be able to, you know, just make sure that you have backups on what is essential, what is not essential. Right. And the second thing that you need to focus on is, you know, limit scope to who actually is accessing your data. But if you're starting something new, I don't think ransomware will affect you because there's typically, you know, if it's. If you're a new startup or, you know, and you are a company that's looking to get funding and you're pre seed, maybe pre Series A, I would think that the ransomware attackers are probably looking to ransom folks who are going to pay them in Bitcoin. So I don't think that would be a big problem. But I think as your organization starts, you need to start today by adding that security DNA so that you can build the culture, so that when it comes to combating ransomware, as you get more successful and as it becomes more interesting folks to target you and attack you, then you are able to deploy the right countermeasures. Right. But there's no one silver bullet. Otherwise we'd be seeing the silver bullet today. But it's just, in the words of Ben Horowitz, there's a bunch of lead bulls. Security is a defense in depth, and you just need multiple layers. And that starts with building a security culture in your organization and then just trying to understand, okay, do you really need the data that will probably be be ransomed? Do you need to store that to be able to use it? And so that's kind of like how you should think about that threat model.

Awesome. Another one from Asia. Is there a checklist for zero data security?

A checklist. So I think it's. That's actually an interesting. So I think we're trying to do away with the checklist. Right. The idea becomes one of the things that you should do is the checklist needs to become really is. Well, what types of data are you trying to store that are sensitive? Right. In the word of nist, like nist, the National Institute of Science Standards and Technology has basically stated that if you collect it, you must protect it. Right. Little aphorism that you can kind of like take away there. But the really interesting thing is if you protect it and you collect it, why do you need it? I think if you are able to just state the reasons for why you're collecting sensitive data, we can always try to find a way of how you're able to achieve that objective without needing to store the data but still retain its value. So I think just applying that simple question to all types of data that you're collecting will massively reduce the scope of having to build data security or compliance into your apps or lines of business.

Fantastic. I have one more. I think we have time for one more. How many additional engineers need to be brought in to do PCI compliance in house? Or what about SoC2?

Yeah, so it depends, right? So there's a few SoC2 vendors. You'll see a lot of this. That space. There's folks who like, really focus on, let's automate the checklist, which is effectively building a bigger mousetrap. They'll tell you that it'll take one or two weeks, it'll probably take you maybe two months to get it done. If you don't have the right posture in place to get SoC2, for example. But remember, it's really, you know, SoC2 up to you to define what your scope needs to be do. Would you like to get SOC2 compliant for your whole organization or is it really the only reason you need SOC2 is to protect the sensitive data so that you can are able to use that as a sales enablement tool. And if you think about that, then you could start to really reduce the amount of engineers that need to touch that by basically saying, hey, we're going to get the sensitive pieces of data that we're collecting or the sensitive or the private, you know, privacy preserving or the privacy regulated data that we're collecting off our plates so that we're able to achieve SOC 2 faster. Right? And so that's really the thing you have to understand if you want compliance, there are plenty of checkbox solutions out there if you want real security. So that if you'd like real security, then the idea is that you want to focus on really getting security to a situation where if you want real security, you want to be able to get to a point where you have the right data security posture so that you can understand the intent of compliance like that. But really you don't need engineers in house if you do that. Now if you are one, do this yourself. Typically it takes about, depends on the experience. But you know, I'll tell you that for us to get PSEC and when we first started the company it was three full engineers and they focused around six months time. But now because we are a lot larger, right, we take, I think it's like 15 people involved in every year's audit. So it depends on who you are and depends on how big your scope is. But it does start with like four or five folks and then it becomes, you know, at the end of the day, you know, it could become up to 15 and probably goes, you know, there's teams of hundreds of people of compliance firms and like JP Morgan and company. So take from that what you will. Hopefully that was a helpful answer and.

We hope for everyone to get to a size where they need teams of compliance people. For sure. This has been an impactful session. So first off, thank you Mahmoud. Thank you, Christina. Hey everyone, we have a lot more coming to you today, so see you in the next sessions. Bye everybody.

Thanks.