Programming Throwdown

Programming Throwdown talks cybersecurity with Dotan Nahum, CEO and Co-founder of Spectral. Dotan provides us with a high-level overview of the role of cybersecurity, its definition, evolution, and current challenges. He also shares tips for small- and medium-sized ventures on how to develop best practices.

The episode touches on the following key topics and ideas:

00:01:12 Evolution of modern cybersecurity 

00:06:06 When to integrate security in a design

00:11:54 Shadow IT

00:13:50 Hacker motives and motivations; SQL Injection explained

00:16:48 Firewalls and WAFs

00:20:29 Cybersecurity for small- and medium-sized companies 

00:23:52 “The last mile of developers”

00:26:47 dotfiles

00:32:23 Simple tools and good practices

00:40:42 Attack vectors, attack factors

00:44:16 Ransomware and phishing

00:48:19 Unsafe languages

00:50:02 Fuzzing

00:54:11 Rust programming language

00:55:54 Example security scenario with IntelliJ

00:59:42 More about Spectral, Dotan’s company

01:03:40 Staying virtual using Discord

Transcript:
Episode 110 Computer Security with Dotan Nahum

Jason Gauci: Programming Throwdown Episode 110, Security with Dotan Nahum. Take away, Patrick. 

[00:00:21] Patrick Wheeler: Hey everybody. We're here with a hundred and tenth episode, which is pretty exciting. And we have our guest to-- oh, yeah, go ahead. You want to... 

[00:00:30] Jason Gauci: I'm just saying, yeah!  (laugh) 

[00:00:32] Patrick Wheeler: So we're here with our guest today, Dotan, and you are CEO of Spectral. Why don't you go ahead and introduce yourself briefly, and then we'll get started.

[00:00:42] Dotan Nahum: Yep. So hi, guys. So I am Dotan, and by the way, 110 is binary, right? 

[00:00:48] Patrick Wheeler: Oh, there we go. That's right.  (laugh) 

[00:00:52] Dotan Nahum: So yeah, so I'm Dotan, CEO of Spectral. It's a cybersecurity company, geared towards developers. I mean, we like to say that we create tools for developers with security as a side effect. So yeah, so that's, that's, you know, that's what our focus is. 

[00:01:12] Patrick Wheeler: Awesome. Well, I mean, I guess that's a lot to unpack, so I think everybody would agree, security is very important, but maybe everyone doesn't understand what security is. So we were talking about this a little when we were doing, doing warmups. So if we talk about security, does that mean that you are developing antivirus for computers, for developers, or does it mean something more?

[00:01:35] Dotan Nahum: Yeah, I mean, I mean, it's kind of all goes back to, I guess, evolution of our, I guess it is our domain, our, our world, which is kind of a high-tech or softer, softer world? Time really gets compact with all these revolutions. We have a, we have evolution revolution. 

[00:01:57] So, I mean, if you go back to 2007, that was just before Facebook and just before iPhone, I guess. And if you go back to 2005, that that was before the rise of Microsoft, I guess the major rise of Microsoft as a .net shop, which really made, you know, made all the enterprise software come along and then kind of '98, 2000, the first bubble.

[00:02:27] So all these stages, they had, it's kind of a sprint to create technology. And, the focus is on creating technology that is supposed to give developers productivity, and supposed to make, you know, make companies very productive and create a very nice portfolio of products. 

[00:02:48] And almost always, I mean, maybe not intentionally, but almost always the security side of things, was kind of left behind. You know, I'm sure no one intended for it to be, but, there's a lot of more velocity under creating a great product at the time. Every, each and every step of this, like in the first bubble, and then in 2005, and then into 2007 and so on, rather than, okay, so let's create the technology and the product, and let's also make it, you know, kind of, dependent on making great security, be there for us. 

[00:03:35] So almost every time, security came after the revolution, after the evolution. So we had from, simple firewalls, to intrusion detection, which is, you know, the large kind of, systems that try, try their best to find anomalies in the, in the area of 2000, to the smarter firewalls. And even today, those like, this, mini kind of firewalls, of WAFs that you integrate as an SDK into your app. So yeah, so it's kind of come, it comes in waves, technology, and then, security comes in waves as well. 

[00:04:17] And yeah. So the latest, the latest we're seeing right now in terms of the evolution of software is that yeah, we know that software eats the world, but we are kind of feeling that it already ate the world? So, you know, you can do so much today that you couldn't have done, I mean, as little as three or four years ago, actually. You know, it can take a Lambda and you can pick up a bunch of SAS services and you're done. I mean, you build a product that used to be maybe three, four, five years ago, you know, used to take much more energy to build.

[00:04:58] So in that sense, as a developer, you have so much more power and so many more paths to get to the same end goal that... I'm not sure, I mean, I feel it for myself. I'm not sure the security world can even begin to realize, because they need, I mean, if we, if we think about them as they, then they need to understand how to develop as well as developers in order to give, to create great solutions for that developer, that glue stuff together, and, you know, invent stuff from existing, existing parts.

[00:05:37] Jason Gauci: Yeah, that that makes a bunch of sense. 

[00:05:39] Patrick Wheeler: I say, yeah, that covered, I mean, you, you went to the whole history of modern or last couple of decades of, computer software there, but I was going to say, so one of the interesting things I think before we get into the kind of specifics about, what needs to be secured, this, this kind of, thing you mentioned where people build a product first and then try to figure out security later.

[00:06:02] I guess that's an interesting balance where, if you're building something until it's built, maybe it doesn't really need security. Right? If this was a thought in my head, I don't need security. If people are going to start using it though, immediately, you need to start having some amounts of security. Do you have opinion on like, what is the balance there?

[00:06:19] So if you don't know yet what you're doing and what may be your risks, when is the right time to start considering security and what are some of the good, you know, first things to start considering? 

[00:06:30] Dotan Nahum: Yeah, so that, that's a great, great question. I mean, I think the balance is shifting towards really taking the time, in development time, in design time, and think about security on the security model.

[00:06:46] So, you know, this was kind of theoretical, yeah, everyone should do threat modeling and everyone should do secure by design and so on. And, and frankly, you know, you'll, you'll find these people who are extremely into security that are actually doing these th...

We chat with Kevin Urrutia about why marketing is so important to any project, how digital marketing is different than traditional marketing, and what tools we can use to market our ideas.  Thanks for listening!

Show notes: https://www.programmingthrowdown.com/episodes/109-digital-marketing-with

We’re having a duo episode for this month! Patrick and I discuss the relevance of Kotlin, a JVM language used for web backends and android development, and why you should look into it. Also we are testing out adding transcripts to the show notes. Let us know what you think! Show notes: https://www.programmingthrowdown.com/episodes/108-kotlin

Happy Holidays! In this show we make predictions about 2021 and take questions from YOU, our loyal fans! Show notes: https://www.programmingthrowdown.com/episodes/107-holiday-2020

This month we are speaking with Connel Gauld from Zappar about Augmented Reality. Connel is an AR genius and blows our mind with details on how AR works under the hood and how it's easy for anyone to make AR apps and websites. AR is the next great platform, so it's good to get in early. Give it a listen and tell us what you built! Show notes: https://www.programmingthrowdown.com/episodes/106-augmented-reality-with Teamistry: https://link.chtbl.com/teamistry?sid=podcast.throwdown

The September episode did arrive.... somewhat delayed, but it's worth the wait!! We have NEW INTRO MUSIC by amazing recording artist Eric Barndollar. We have a NEW PODCAST DEPLOYMENT SCRIPT which means the podcast timestamp will be correct and people won't have to hunt for our latest episodes. Last but not least, we have an AMAZING EPISODE where we interview Peter Voss, founder and CEO of aigo.ai and inventor of the term "Artificial General Intelligence", to discuss chatbots and general AI. Geeking out about AI may be my favorite thing to do on Earth, so I can't put in words how incredibly excited I am to share this episode with everyone. Show notes: https://www.programmingthrowdown.com/episodes/105-chatbot-with-brain-with Teamistry: https://link.chtbl.com/teamistry?sid=podcast.throwdown

How do the most popular websites stay online? How do mobile app developers release new versions safely and monitor them? Today we have Matt Watson from Stackify on the show to talk about Developer Operations (DevOps) and site reliability. These two areas are critical for writing software that people depend on. DevOps is both a software exercise but also an exercise in process creation and process management. In this episode, we unpack these topics and do a deep dive to explain how to deploy software that other people can trust to remain online and secure. Do you have any questions about DevOps? Ask away in our #questions channel on Discord! https://discord.gg/r4V2zpC Show notes: https://www.programmingthrowdown.com/episodes/104-devops-and-site-reliability

Many of us have found ourselves working from home due to current events. In this show, we chat with Adam Bell who has been working from home for the past decade. We also do the show interactive on Twitch.tv and take your questions! Give it a listen for a ton of great advice on working from home and some pitfalls to avoid. Thanks again for your donations in these tough times. We really appreciate your support! Feel free to continue the discussion on Discord (link in the show notes)! Show notes: https://www.programmingthrowdown.com/episodes/103-working-from-home

Many people have asked us for more content on machine learning and artificial intelligence. This episode covers probability and Bayesian math. Understanding random numbers is key to so many different technologies and solutions. Max and I dive deep and try to give as many pointers as possible. Give it a listen and let us know what you think! Max also has an awesome podcast, The Local Maximum. Check out his show on any podcast app or using the link in the show notes! Show notes: https://www.programmingthrowdown.com/episodes/102-bayesian-thinking-with-max

Hey all! In this episode we chat with Guillermo Rauch, co-founder of Next.js, about ReactJS. ReactJS is an amazing framework for web development that I've been a huge fan of for years. We dive deep into how ReactJS works and why it can lead to clean, structured development. We Introduce Next.js, a ReactJS framework that supercharges web development at scale. I recently built a site using Next.js and loved the developer experience! Check out the show notes for links to learn more about Vercel and Next.js. Show notes: https://www.programmingthrowdown.com/episodes/101-reactjs-with-guillermo-rauch