Access Control

Access Control

By TeleportBusinessEntrepreneurshipTechnology
Download on the App Store

Access Control episodes

  • How a BISO can help accelerate Fintech innovation
    Overview of Podcast

    For this 15th episode of Access Control Podcast, a podcast providing practical security advice for startups, Developer Relations Engineer at Teleport Ben Arent chats with Alyssa Miller. Alyssa is a seasoned hacker and highly experienced security executive. Alyssa began her career programming for a Wisconsin-based provider of financial software and services. Later moving into a leadership role within the ethical hacking team, conducting pen tests and app assessments. This was followed by working in consulting, which provided a unique perspective on the challenges of the security industry, and then working across multiple organizations and high-level executives to address security at a strategic level.

    This brings us to today, where Alyssa directs security strategy for S&P Global Ratings as a Business Information Security Officer (BISO). S&P Global is a 162-year-old finance services company, with over 50k employees. Today we’ll dive into how Fintech companies can learn the best practices and navigate the regulatory landscape, and how to embed these security practices to truly shift left and empower developers.

    Key topics on Access Control Podcast: Episode 15 - How a BISO Can Help Accelerate Fintech Innovation
    • BISO is a fairly young role within cybersecurity that gets structured
      • differently across organizations. A BISO's primary goal is to provide a bridge
      between the cybersecurity function of the organization and the individual business lines.
    • S&P Global Ratings, part of S&P Global, is focused on credit ratings for organizations and sovereign nations.
    • When looking to adopt new technologies, you have to consider what this means in terms of the regulatory environment.
    • If you're starting up a fintech, you're going to be working with regulatory bodies. Regulators can help you understand what the right ways are to be compliant with specific regulations.
    • The best thing you can do with a regulator is give them reason to trust you, by showing them that you're thinking about the things that you should be thinking about, and by doing the right things.
    • Compliance can be broader than regulation. Regulators such as SEC, FCA and ESMA vary based on the environment that they're in. The key is to work with them proactively.
    • Getting software to production involves what can be described as a three-headed monster of responsibility: software has to be delivered efficiently, has to be stable and has to be secure.
      • 42 min
    • Securing CI/CD
      How CircleCI secures CI/CD for CircleCI and it's customers

      Expanding your knowledge on Access Control Podcast: Episode 14 - Securing CI/CD and Supply Chain

      • CirclCI.com
      • Teleport 9 - Introducing Machine ID
      • Highly Evasive Attacker Leverages SolarWinds Supply Chain to Compromise Multiple Global Victims With SUNBURST Backdoor
      • Project Trebuchet: How SolarWinds is Using Open Source to Secure Their Supply Chain
      • Teleport Machine ID
      • Using Teleport Machine ID with Jenkins
        • 50 min
      • Security Compliance & FedRAMP
        What startups need to know about FedRAMP and how to work with your friendly compliance manager.

        For episode 13, I’ll be talking to Hisham Alhakim . Hisham is a Security Compliance Manager, and has focussed his camera on Security, Privacy, and Compliance. Hisham worked at both consulting firms, and in-house. For today's episode we’ll keep things high level and get the perspective of a compliance practitioner. Focusing on assurance, the advantages of FedRAMP, barriers, and underlying standard setting bodies and requirements like your NIST, CISA, FISMA.

        Since this episode is a deep dive into compliance, I’ll add a note that Hisham's opinions are that of a practitioner and don’t reflect any current of past employers . And with all policy and compliance advice, please consult with your in-house counsel before implementing any advice from a free podcast.

        42 min
      • Infosec for startups
        SOC2, Crypto and Building a security practice

        Key topics on Access Control Podcast: Episode 12 - Cryptography for Startups

        • One of the harder jobs in security is to be the first security person
          • at a startup since startups typically have various types of security problems, and you can't expect one person to cover all of those fields.
        • Considerations when evaluating security consultants are the breadth of services being offered and the billing model being used.
        • One way to describe the SOC 2 standard in the least number of words is: do you do what you say, and do you say what you do?
        • Seven best practices to pass SOC 2 are defined in LVH's The SOC 2 Starting Seven blog post.
        • The Crypto 101 e-book is an introduction to cryptography basics for application developers.
        • When determining the programming language to solve a given problem, it's important to use the right tool for the job.
          • 1 hr 11 min
        • When should a startup call the FBI
          Before the inevitable breach happens.
          Key topics on Access Control Podcast: Episode 11 - When a Startup Should Call the FBI

          ​

          • The FBI is the national law enforcement agency, and post-9/11, also the domestic security agency.
          • National security cyber matters comprise matters related to foreign states, foreign terrorist organizations, as well as domestic terrorism.
          • The COVID 19 pandemic has really accelerated cybercrime.
          • With the growth of ransomware as a service and the money mule network, even low-skill actors today are getting into the ransomware game.
          • You should have an incident response plan that you can put into action if you fall victim to a ransomware attack.
          • Business Email Compromise (BEC) occurs when someone sends you an email or text eliciting you to take some action and asks you to wire money.
          • With regard to intellectual property, you have to do your due diligence as an organization to protect your information.
          • To report an issue, ic3.gov is cyber-focused while tips.fbi.gov is for all tips that the FBI get.
          • As long as you're aware of what your exposure is, can weigh the risks, and have taken sufficient mitigation strategies for these risks, that's all you can do at the end of the day.
            • ​
            31 min
          • Securing Internal Applications
            How Figma protects internal web and CLI tools by leveraging off the shelf AWS services.
            Key topics on Access Control Podcast: Episode 10 - Protecting Internal Apps at Figma
            • In hyper growth companies, hyper growth itself is one of the key assets that need to be protected.
            • It's important not to draw too many lines between security roles in different subfields (securing engineering, data security, production security) since there are increasingly crossover points between infrastructure, security, and application security in the cloud age.
            • There are differences in how B2B and B2C companies think about scale and about compliance.
            • The desire to have nicely designed, effective internal web applications (such as a web UI to support various operations) is definitely growing. Figma decided to invest time in this area and built a really well-structured, effective approach early on.
            • Some functionality works best as a command line tool, and in certain cases, it’s the right approach.
            • Figma uses AWS for most of its cloud infrastructure, and uses Okta for employee authentication and authorization.
            • Application load balancers (ALBs) are powerful reverse proxies that Amazon provides as a service, basically giving you an API to configure them.
              • 49 min
            • SRE Powered Dev Productivity
              Mario Loria from Carta discusses improving developer productivity and securing Kubernetes.
              Key topics on Access Control Podcast: Episode 9 - SRE-Powered Dev Productivity
              • The DevOps movement is about how we can all work together to build a better pipeline for building, running, and shipping software and give our customers a better experience.
              • In the financial world, security is probably number one, followed by latency, and then resiliency/reliability.
              • It's important to determine what aspects one gets by default from their cloud platform and what the blind spots are.
              • Security in the context of Kubernetes has become an important issue.
              • Teleport is a Certificate Authority and an Access Plane for your infrastructure.
              • By working closely with developers, SRE teams can make sure that developers are getting what they expect.
              • By giving service ownership, service empowerment, and confidence to developers, SRE teams can enable them to manage their own applications.
                • 56 min
              • Securing Kubernetes
                Threat-driven Analysis and Defense for Securing Kubernetes
                Key topics on Access Control Podcast: Episode 8 - Securing Kubernetes
                • Evaluating a Kubernetes cluster can occur on several levels. Standard
                  • isolation questions include examining how traffic gets into a
                  cluster, how people can access the nodes, and whether the API server
                  is public or private.
                • The three common sources of compromise for Kubernetes clusters are supply chain risks, threat actors, and insider threats.
                • Most hosted Kubernetes systems, especially cloud provider systems, come with a hardened node image.
                • When companies get into feature delivery tunnel vision, security takes a back seat, and at some point, they might be left running an outdated node version.
                • Without smooth continuous delivery pipelines, the responsibility of managing your own infrastructure can be too much for an organization.
                • One preferred way of updating a Kubernetes cluster is to do a blue-green deployment, whereby there are two clusters behind the load balancer.
                • Misconfiguration is a main cause of security incidents, and preventing misconfigurations is about testing.
                • A Kubernetes namespace is not a security boundary in itself because there are things that are not namespaced, so there is no way to accurately correlate security criteria to the namespace.
                  • 58 min
                • Hacker-Powered Security
                  How companies can leverage the power of hacker community.

                  If anyone ever wants to ask Ben any questions about bug hunting, bug bounty programs, you're always welcome to reach out to be Ben at @NahamSec, https://nahamsec.com/ and on his Discord

                  Key topics on Access Control Podcast: Episode 7 - Hacker-Powered Security

                  • Bug bounty programs and vuln disclosure programs are similar,
                    • except the first pays and the second doesn't.
                  • The scope of bounty programs usually encompasses a company's main
                    • application where the production sites are happening. What is out of
                    scope is mostly third parties.
                  • Rules of engagement depend on the bug bounty program and the company.
                  • Some programs pay for credential stuffing, but not for phishing since companies don't want you to phish their employees and customers.
                  • How much hackers are paid in a bug bounty program is entirely up to the company and depends on its budget.
                  • Determining the bug severity level depends on a combination of the vuln type and how critical it is and the asset itself.
                  • Hackers care more about how fast they get paid than about how quickly the company fixes the issue.
                  • A bug bounty program doesn't make you a bigger target.
                  • Building a public bug bounty program depends on the product and size of the company.
                  • Improve Input validation to reduce bugs created
                    • 38 min
                  • HIPAA Compliance for startups
                    How VerticalChange obtained and stays HIPAA compliant

                    In this sixth episode of Access Control, a podcast providing practical security advice for startups, Ben Arent chats with Dylan Stamat, CTO at VerticalChange. VerticalChange is a simple data system application for the Social Sector. Dylan is a seasoned technology and startup founder with 10 years of experience building and growing businesses. VerticalChange was an early adopter of running HIPAA-related workloads on AWS during the early days of AWS circa 2012.

                    Key Topics on Access Control Podcast: Episode 6 – HIPAA Compliance for Startups
                    • VerticalChange was founded to create impact for the social sector and
                      • help its agencies digitize manual processes.
                    • VerticalChange provides a solution that combines CRM, analytics, and
                      • dynamic form-building.
                    • Regulations like HIPAA, HITRUST, and FERPA are very strict, and agencies have to put in place many controls in order to comply.
                    • Startups in the healthcare space need to have someone who understands HIPAA and is willing to put the time in to write all the policies and procedures that need to be in place to meet security and privacy rules.
                    • Using a combination of CloudTrail, Auth0 logs, and Teleport logs, VerticalChange is able to create a log flow and see what people are doing within the application.
                      • 25 min

                    About Access Control

                    From the publisher's feed

                    Access Control, a podcast providing practical security advice for startups.