Cloud Security Reinvented

Episode Highlights:

• Making Board Members Aware of the Significance of Cybersecurity Is of the Utmost Importance
• Access and Vulnerability Management Are Hot Topics for CSOs and Security Teams
• Aiming for the Unification of Security Policies
• Shaping and Influencing Policies

Episode Highlights:

• Making Board Members Aware of the Significance of Cybersecurity Is of the Utmost Importance
• Access and Vulnerability Management Are Hot Topics for CSOs and Security Teams
• Aiming for the Unification of Security Policies
• Shaping and Influencing Policies

This podcast is hosted by Orca Security

Key insights from this episode featuring Jeremy Turner, Deputy CISO at Paidy:

⚡ Security without passwords. "In a market like Japan, things are quite different. Thinking out of the box is probably the most critical skill we need. When we think about the consumer experience, they don't have to deal with [passwords], and that really does remove a lot of friction from the typical flow," Jeremy says.

⚡ There's so much potential in the cloud. "Now you can just whip out a prepaid card, get an account, and replicate a whole enterprise. Thanks to infrastructure as code, a lot of things can be consistent. So I think that is the biggest potential for growth — more people having access to the technology."

⚡ Understand your assets and data. "Sometimes, it feels like you are trying to fix a plane while it's in flight without it crashing, and it could be very delicate. It really can get complex if you don't understand your critical assets, especially data because we don't want to lose our data."

This podcast is hosted by Orca Security

Key insights from this episode featuring Jeremy Turner, Deputy CISO at Paidy:

⚡ Security without passwords. "In a market like Japan, things are quite different. Thinking out of the box is probably the most critical skill we need. When we think about the consumer experience, they don't have to deal with [passwords], and that really does remove a lot of friction from the typical flow," Jeremy says.

⚡ There's so much potential in the cloud. "Now you can just whip out a prepaid card, get an account, and replicate a whole enterprise. Thanks to infrastructure as code, a lot of things can be consistent. So I think that is the biggest potential for growth — more people having access to the technology."

⚡ Understand your assets and data. "Sometimes, it feels like you are trying to fix a plane while it's in flight without it crashing, and it could be very delicate. It really can get complex if you don't understand your critical assets, especially data because we don't want to lose our data."

Guest-at-a-Glance

💡 Name: Jay Thoden van Velzen

💡 What he does: He's the Strategic Advisor to the CSO at SAP.

💡 Noteworthy: SAP is one of the world's leading producers of software for the management of business processes and a company on a mission to help the world run better and improve people's lives.

Guest-at-a-Glance

💡 Name: Jay Thoden van Velzen

💡 What he does: He's the Strategic Advisor to the CSO at SAP.

💡 Noteworthy: SAP is one of the world's leading producers of software for the management of business processes and a company on a mission to help the world run better and improve people's lives.

This podcast is hosted by Orca Security

Guest-at-a-Glance

💡 Name: Jadee Hanson

💡 What she does: She's the CIO and CISO at Code42.

💡 Company: Code42

💡 Noteworthy: As CIO and CISO at Code42, Jadee Hanson leads global risk and compliance, security operations, incident response, and insider threat monitoring and investigations. She brings more than 17 years of experience in information security and a proven track record of building security programs. Before Code42, Jadee held several senior leadership roles in the security department of Target Corporation.

##

Key Insights

⚡ The world of security is always changing. Technology is rapidly changing and evolving. And cloud security is following along. Jadee explains what this means for the security industry. She says, "For security practitioners, we've always had to be really good at being resilient and adaptable. So, in our world, things always change. Technology is changing, the risk landscape is changing, and threat actors change. And as the cloud has become more prevalent, we had to flex our resilient and adaptable muscles and learn something new. And I would argue that the fundamental controls that we need to have in place for the cloud really haven't changed. What's changed is the 'how'; it's the 'how we meet those controls,' and that's it."

⚡ Bad actors use cloud services as much as security practitioners. Bad actors are early adopters when it comes to cloud security. Jadee talks about this significant challenge for security practitioners. She says, "One thing that has really surprised me is that when you think of the cloud movement, there are so many features and functionalities within a cloud architecture. We know this as security practitioners, but bad actors also know this, and they know this very well. So I think my biggest surprise is to see bad actors and bad APT groups use cloud services, just like we do every day."

⚡ Let your people be the heroes of the organization. When building security teams, it's essential to let them be heroes and give them exciting opportunities to grow. Jadee explains, "I think it's really all about the people. So my advice would be to find really great people who deliver quality work, continue to challenge them, and give them really interesting opportunities. It's funny. Lots of security practitioners aren't really motivated by tons of money. They're motivated by interesting opportunities. I also think it's really important that you don't make them adversaries in the organization."

This podcast is hosted by Orca Security

Guest-at-a-Glance

💡 Name: Jadee Hanson

💡 What she does: She's the CIO and CISO at Code42.

💡 Company: Code42

💡 Noteworthy: As CIO and CISO at Code42, Jadee Hanson leads global risk and compliance, security operations, incident response, and insider threat monitoring and investigations. She brings more than 17 years of experience in information security and a proven track record of building security programs. Before Code42, Jadee held several senior leadership roles in the security department of Target Corporation.

##

Key Insights

⚡ The world of security is always changing. Technology is rapidly changing and evolving. And cloud security is following along. Jadee explains what this means for the security industry. She says, "For security practitioners, we've always had to be really good at being resilient and adaptable. So, in our world, things always change. Technology is changing, the risk landscape is changing, and threat actors change. And as the cloud has become more prevalent, we had to flex our resilient and adaptable muscles and learn something new. And I would argue that the fundamental controls that we need to have in place for the cloud really haven't changed. What's changed is the 'how'; it's the 'how we meet those controls,' and that's it."

⚡ Bad actors use cloud services as much as security practitioners. Bad actors are early adopters when it comes to cloud security. Jadee talks about this significant challenge for security practitioners. She says, "One thing that has really surprised me is that when you think of the cloud movement, there are so many features and functionalities within a cloud architecture. We know this as security practitioners, but bad actors also know this, and they know this very well. So I think my biggest surprise is to see bad actors and bad APT groups use cloud services, just like we do every day."

⚡ Let your people be the heroes of the organization. When building security teams, it's essential to let them be heroes and give them exciting opportunities to grow. Jadee explains, "I think it's really all about the people. So my advice would be to find really great people who deliver quality work, continue to challenge them, and give them really interesting opportunities. It's funny. Lots of security practitioners aren't really motivated by tons of money. They're motivated by interesting opportunities. I also think it's really important that you don't make them adversaries in the organization."

💡 Guest: Kathy Wang, Chief Security Officer at Discord

💡 Company: Discord

💡 Noteworthy: Kathy is a security executive and leader with a strong background in project management, research, and business development. She has worked in government, commercial, and technology startup environments and currently advises startups that offer security services/products.

##

Key Insights

⚡ The importance of access control in security. Improving access control is one of the best ways to prevent potential security problems. Kathy says, "If I think about this from a security perspective, and you look at it from a public cloud SaaS environment perspective, there are so many organizations right now where there are far too many people who have more access than they need in production environments. And so we're always looking for ways to understand, audit, and reduce all of those accesses, and this is super important for improving security posture because if you can't control or understand what access people have, then you've got all sorts of problems like insider threat as well as takeover or breach type of issues."

⚡ Security is a hard sell. Even though the number of cyber threats increases every year, security is still hard to sell. Kathy explains, "GitLab was even less of a security product company. They've built security features and security capabilities, which I was super happy to help contribute to from a CSO perspective, as in, ‘Would I use this; would I buy this?’ However, it's not the same thing as talking to customers constantly about, 'Hey, we've detected this for you. What do you think?' And then getting a response, 'You know what? Yeah, it's true. You did, but I'm not sure I want to pay for that kind of detection, though.' This is exactly what makes security such a hard sell. You could be accurate. You could be technically good, but what is that other factor that will make people want to spend money on the product? That's hard."

⚡ Think outside the box when building your security teams. The key to building highly effective security teams is to differentiate yourself. Kathy says, "Building security teams is not an easy thing to do, as you know, and we're always competing for talent with a whole bunch of other companies. So what can you do to really differentiate yourself? One of the things I learned is that you can actually go looking for talent outside of the normal pools of talent that people look for. And GitLab was really great for reinforcing that."

This podcast is hosted by Orca Security

💡 Guest: Kathy Wang, Chief Security Officer at Discord

💡 Company: Discord

💡 Noteworthy: Kathy is a security executive and leader with a strong background in project management, research, and business development. She has worked in government, commercial, and technology startup environments and currently advises startups that offer security services/products.

##

Key Insights

⚡ The importance of access control in security. Improving access control is one of the best ways to prevent potential security problems. Kathy says, "If I think about this from a security perspective, and you look at it from a public cloud SaaS environment perspective, there are so many organizations right now where there are far too many people who have more access than they need in production environments. And so we're always looking for ways to understand, audit, and reduce all of those accesses, and this is super important for improving security posture because if you can't control or understand what access people have, then you've got all sorts of problems like insider threat as well as takeover or breach type of issues."

⚡ Security is a hard sell. Even though the number of cyber threats increases every year, security is still hard to sell. Kathy explains, "GitLab was even less of a security product company. They've built security features and security capabilities, which I was super happy to help contribute to from a CSO perspective, as in, ‘Would I use this; would I buy this?’ However, it's not the same thing as talking to customers constantly about, 'Hey, we've detected this for you. What do you think?' And then getting a response, 'You know what? Yeah, it's true. You did, but I'm not sure I want to pay for that kind of detection, though.' This is exactly what makes security such a hard sell. You could be accurate. You could be technically good, but what is that other factor that will make people want to spend money on the product? That's hard."

⚡ Think outside the box when building your security teams. The key to building highly effective security teams is to differentiate yourself. Kathy says, "Building security teams is not an easy thing to do, as you know, and we're always competing for talent with a whole bunch of other companies. So what can you do to really differentiate yourself? One of the things I learned is that you can actually go looking for talent outside of the normal pools of talent that people look for. And GitLab was really great for reinforcing that."