Latest / The DEX Show: A Show for IT Change Makers / Reality Bytes #57: DEX and Cybersecurity: Proactively Building Trust

Transcript

Reality Bytes #57: DEX and Cybersecurity: Proactively Building Trust · The DEX Show: A Show for IT Change Makers

• 0:01
  Speaker 1: Welcome it change makers to the Deck Show with Tim
• 0:05
  Speaker 1: Flower and Tom McGraw. Let's get into it.
• 0:09
  Speaker 2: They're change makers, you know what it is. It's the
• 0:11
  Speaker 2: Deck Shows, show within a show within a show where
• 0:15
  Speaker 2: we speak to fascinating next thinkers about they're they're specialism,
• 0:21
  Speaker 2: if you will, And today very happy to welcome, along
• 0:24
  Speaker 2: with Megan and Oriana, John Connell to the show. Hey, John,
• 0:28
  Speaker 2: how's it going.
• 0:29
  Speaker 3: It's going, well, how's everything with you?
• 0:32
  Speaker 2: It's very well. We're always happy to do this. We've
• 0:34
  Speaker 2: had a bit of a bit of a bit of
• 0:36
  Speaker 2: a break, bit of a hiatus from doing these John,
• 0:38
  Speaker 2: because of all the all the experiences which would be
• 0:41
  Speaker 2: going on the last month we've been you know, as
• 0:44
  Speaker 2: a team jetting around the world so to speak, and
• 0:47
  Speaker 2: helping to put those events. And did you make it
• 0:49
  Speaker 2: to Boston? John?
• 0:50
  Speaker 3: I did not, although there's talks that next year I
• 0:53
  Speaker 3: might be heading that way, maybe the more than one,
• 0:57
  Speaker 3: but this year I did make it.
• 0:58
  Speaker 2: Any Yeah, well you should come along. They are they
• 1:02
  Speaker 2: are a good time for all concerned. I should mention
• 1:06
  Speaker 2: you are at for the security director And that's just
• 1:09
  Speaker 2: sort of topic we're going to be delving into today.
• 1:12
  Speaker 2: But I just begin by telling the audience something about
• 1:15
  Speaker 2: yourself and your role here and next thing.
• 1:17
  Speaker 3: Yeah, I've been next Thing for coming up on three years.
• 1:22
  Speaker 3: And so my role primarily is to answer questions that
• 1:26
  Speaker 3: come in from customers, primarily about security. You know, some
• 1:31
  Speaker 3: other things sort of sneak their way in about AI
• 1:33
  Speaker 3: and you know, support issues and things like that that
• 1:36
  Speaker 3: the customers want to know about. But I would say,
• 1:40
  Speaker 3: you know, ninety percent of the questions I get are
• 1:42
  Speaker 3: security related in one way, shape or form. And then
• 1:45
  Speaker 3: in addition to that, you know, I often review contracts
• 1:51
  Speaker 3: where there are specific security terms where you know, customers
• 1:53
  Speaker 3: are asking us for you know, some specific thing that
• 1:57
  Speaker 3: we're going to do from a security perspective, or steps
• 2:00
  Speaker 3: we're going to take or processes things like that, and
• 2:03
  Speaker 3: you know, make sure we can accommodate those in the
• 2:05
  Speaker 3: course of their contract. So, you know, I answer questions
• 2:08
  Speaker 3: from existing customers that you know, have been with us
• 2:10
  Speaker 3: for a long time and some uh and and for
• 2:13
  Speaker 3: new customers that are you know, contemplating a purchase.
• 2:17
  Speaker 2: Excellent. Well, you're going to be used to being asked questions,
• 2:19
  Speaker 2: Ben John, which is good because I know Oriana in
• 2:21
  Speaker 2: particular is champing of a bit to talk security, privacy
• 2:25
  Speaker 2: and compliances we're going to be discussing, but I think
• 2:29
  Speaker 2: first of all, john't give us an overview as to
• 2:33
  Speaker 2: why these issues matter in particular to DEX platforms.
• 2:37
  Speaker 3: Kind of specifically, well, i'd say that, you know, as
• 2:40
  Speaker 3: opposed to buying Microsoft Word or buying and you know
• 2:44
  Speaker 3: Office three sixty five, you know, email account or something
• 2:47
  Speaker 3: like that, the way that DEX software has to perform
• 2:53
  Speaker 3: generally requires you know a lot of interaction with users desktops,
• 3:00
  Speaker 3: which is going to you know, have some function of
• 3:03
  Speaker 3: you know, heightened levels or permissions. You're going to be
• 3:07
  Speaker 3: seeing technical data come in from uh, you know, applications
• 3:12
  Speaker 3: from the endpoint itself, potentially some networking things like when
• 3:15
  Speaker 3: you look at you know, the performance of of you know,
• 3:19
  Speaker 3: collaborative tools like Teams and Zoom and things like that.
• 3:21
  Speaker 3: So you know, when you're when a customer is making
• 3:26
  Speaker 3: a decision to purchase something, they're going to be you know,
• 3:30
  Speaker 3: putting something into their environment. And as we know with
• 3:32
  Speaker 3: a lot of customers, they already have a lot of
• 3:34
  Speaker 3: stuff running in their environment. They may have twenty agents
• 3:37
  Speaker 3: running on a machine already and in our case, you know,
• 3:41
  Speaker 3: we'll be the twenty first coming along, so you know,
• 3:44
  Speaker 3: before they make a purchasing decision, they're going to want
• 3:47
  Speaker 3: to make sure that they're comfortable with the tool that
• 3:49
  Speaker 3: they're buying. They want to understand how it's working, and
• 3:51
  Speaker 3: they want to make sure that we're going to be
• 3:52
  Speaker 3: protected over their data after we get it. So, you know,
• 3:55
  Speaker 3: it definitely plays a central role in this in this
• 3:58
  Speaker 3: sort of environment.
• 3:59
  Speaker 4: Thanks for that context, John, Can you tell us a
• 4:01
  Speaker 4: little bit more about what differentiates Next Things approached to security, privacy,
• 4:06
  Speaker 4: and compliance specifically, especially given the importance of those two decks.
• 4:12
  Speaker 3: Yeah, I mean, I would say Next Thing is sort
• 4:16
  Speaker 3: of uniquely positioned since it originated and its origins and
• 4:21
  Speaker 3: heritage were you know, a European company, so you know,
• 4:26
  Speaker 3: having started in Switzerland's uh, you know, privacy was top
• 4:29
  Speaker 3: of mind, you know, maybe more so than you know,
• 4:32
  Speaker 3: some American based companies, and so when I look at it,
• 4:38
  Speaker 3: you know a lot of the existing concerns an organization
• 4:43
  Speaker 3: might have about privacy and compliance are all you know,
• 4:48
  Speaker 3: we're sort of fundamentally baked into the product from its origins.
• 4:52
  Speaker 3: When you couple that with you know, uh, the investments
• 4:58
  Speaker 3: and the you know, the processes and the tools and
• 5:02
  Speaker 3: the support that we provide on the security side, I
• 5:05
  Speaker 3: would say that, you know, it allows organizations to feel
• 5:09
  Speaker 3: comfortable with you know, what we have in place from
• 5:13
  Speaker 3: a you know, a security standpoint, from uh, you know,
• 5:16
  Speaker 3: a data protection standpoint, and you know, we've taken great
• 5:20
  Speaker 3: links to ensure that our security not only is sort
• 5:23
  Speaker 3: of built into the product, but also maintained.
• 5:26
  Speaker 1: Right.
• 5:26
  Speaker 3: So we we have you know, a number of certifications,
• 5:30
  Speaker 3: uh you know, country based certifications and then also industry
• 5:33
  Speaker 3: based certifications like ISO and SoC two, you know, and
• 5:37
  Speaker 3: then we have certain uh you know governmental or you know,
• 5:40
  Speaker 3: regional certifications like cyber Essentials in the UK, E, N
• 5:45
  Speaker 3: S and Spain and so forth. So you know, it's
• 5:48
  Speaker 3: it's something that you know, we know our customers that
• 5:50
  Speaker 3: are going to require for this type of platform, and
• 5:53
  Speaker 3: so as a result, you know, it's it's definitely top
• 5:56
  Speaker 3: of mind when you know, design new features and functions.
• 6:02
  Speaker 4: That makes sense. Can you talk to us a little
• 6:04
  Speaker 4: bit more about how we implement that security, Maybe tell
• 6:09
  Speaker 4: us a little bit more about next things vulnerability management
• 6:11
  Speaker 4: process and how we implement those safeguards and make sure
• 6:15
  Speaker 4: that our users are protected in real time.
• 6:19
  Speaker 3: Yeah. So so we have obviously a lot of different
• 6:22
  Speaker 3: components we have to worry about. You know, We've got
• 6:25
  Speaker 3: the collector itself that you know is going to get
• 6:28
  Speaker 3: installed on users machines. We've got you know, our back
• 6:32
  Speaker 3: end platform which is hosted in a bus. So when
• 6:36
  Speaker 3: you look at that, we've got infrastructure, We've got the
• 6:40
  Speaker 3: application level, and then we've got the you know, the
• 6:43
  Speaker 3: actual collector, and then some of our browser extensions that
• 6:45
  Speaker 3: we have for like APPX and things like that. So
• 6:49
  Speaker 3: all of those things have to be included on the
• 6:51
  Speaker 3: umbrella security. Like we can't sort of say, well, our
• 6:53
  Speaker 3: AWS environment is secure, but the rest of the stuff
• 6:56
  Speaker 3: we do our best, Like, everything has to work together
• 6:58
  Speaker 3: and everything has to at the same level already baked in.
• 7:02
  Speaker 3: So you know, when we go through things like pen testing,
• 7:06
  Speaker 3: you know, we have essentially what amounts to a continuous
• 7:09
  Speaker 3: pen testing process, right, So our first pen test of
• 7:13
  Speaker 3: the year is a full scope pen test. That means
• 7:17
  Speaker 3: that everything from the collector to you know, our our
• 7:20
  Speaker 3: application level, to our you know, network level, hosts, servers,
• 7:26
  Speaker 3: everything is included in that pen test. And part of
• 7:28
  Speaker 3: that scope. Then with each new release that we come
• 7:32
  Speaker 3: along with, we come along with another pen test, right,
• 7:34
  Speaker 3: So anything that's been added to the to the tool.
• 7:38
  Speaker 3: So if we get to release you know, twenty twenty
• 7:40
  Speaker 3: five dot two, you know, twenty twenty five dot one
• 7:44
  Speaker 3: is going to be a full scope pen test for
• 7:46
  Speaker 3: the entire platform, including the collector, including the browser extension,
• 7:49
  Speaker 3: including all those things. And then when you get to
• 7:52
  Speaker 3: UH you know, dot two, then all the new features
• 7:55
  Speaker 3: and functions that are baked into the product for that
• 7:57
  Speaker 3: release get included as part of the testing. Right. So,
• 8:00
  Speaker 3: so the idea is that you know, nothing gets added
• 8:04
  Speaker 3: to the tool over time that you know, it isn't
• 8:07
  Speaker 3: subject to testing, you know, and the results of those
• 8:10
  Speaker 3: tests then are fedback into our UH, into our vulnerability
• 8:14
  Speaker 3: management program you know, that get addressed you know, for
• 8:19
  Speaker 3: our policies and so forth. So the idea is that
• 8:22
  Speaker 3: we're we're iteratively fixing, you know, building new functions, testing
• 8:28
  Speaker 3: those identifying things, fixing so on and so forth, so
• 8:31
  Speaker 3: that cycle continues all the time. You know, we also
• 8:35
  Speaker 3: do some additional things on the vulnerability side, like you know,
• 8:39
  Speaker 3: tracking uh the some components of our tool. Right, So
• 8:43
  Speaker 3: if we include some open social source component that gets
• 8:46
  Speaker 3: tracked for vulnerability to vulnerability pops up six months from now,
• 8:50
  Speaker 3: you know, and some sub component that we're using, you
• 8:52
  Speaker 3: know that that gets tracked and identified and included as
• 8:54
  Speaker 3: part of vulnerability management. And then we do some other things, uh,
• 8:58
  Speaker 3: you know, around the vulnerability side, like making sure our
• 9:01
  Speaker 3: AWS environment is hardened. We do, you know, an annual
• 9:04
  Speaker 3: test with a third party that goes through and you know,
• 9:08
  Speaker 3: checks all of our settings in the a WS to
• 9:10
  Speaker 3: make sure nothing's exposed, make sure you know, all of
• 9:13
  Speaker 3: our accounts are set up appropriately, permissions are granted appropriately,
• 9:17
  Speaker 3: all those sorts of things. So you know, it's it's
• 9:19
  Speaker 3: a it's for some organizations you do an annual pen
• 9:23
  Speaker 3: test and you're you know, sort of good enough for
• 9:25
  Speaker 3: that year, and you check the box and you move
• 9:27
  Speaker 3: on to the next year, and you know, hope for
• 9:29
  Speaker 3: the best. For us, I mean, it's it's sort of
• 9:31
  Speaker 3: a constant grind, right, It's like a treadmill where you're
• 9:35
  Speaker 3: always on it, and you know, as a result, there's
• 9:37
  Speaker 3: always something any fixed, and there's always something new that
• 9:39
  Speaker 3: pops up and you you know, you add that to
• 9:41
  Speaker 3: the list and you address it. Based on its risk.
• 9:43
  Speaker 3: So you know, we're we're very risk focused, right. So,
• 9:47
  Speaker 3: any so if we had you know, since I've been
• 9:50
  Speaker 3: here in three years, that have probably been less than
• 9:53
  Speaker 3: half a dozen you know, things that have popped up
• 9:57
  Speaker 3: in the you know sort of in the cyber space
• 10:00
  Speaker 3: that draw a lot of attention. Like when I first
• 10:02
  Speaker 3: got here, there was a big concern with log Forge,
• 10:09
  Speaker 3: which was you know, basically an industry wide concern you know,
• 10:14
  Speaker 3: with with massive implications and you know, high levels of criticality,
• 10:18
  Speaker 3: high levels of risk like for us, that was identified
• 10:22
  Speaker 3: and immediately we sort of dropped everything to go deal
• 10:24
  Speaker 3: with that, and I believe we had most of our
• 10:27
  Speaker 3: major remediations in place within forty eight hour. You know,
• 10:30
  Speaker 3: something is a small level of risk or some little
• 10:33
  Speaker 3: informational thing like it still gets added to the list
• 10:35
  Speaker 3: for us to fix. But you know it might take us,
• 10:37
  Speaker 3: you know, sixty days or something like that to put
• 10:39
  Speaker 3: in a fix for it, and we'll sort of work
• 10:41
  Speaker 3: through that. But you know, it required sort of a
• 10:44
  Speaker 3: you know, eternal vigilance and you're on that treadmill, you know,
• 10:48
  Speaker 3: three hundred and sixty five days a year basically.
• 10:51
  Speaker 4: Yeah, I mean that seems to me to be the
• 10:53
  Speaker 4: nature of security is you're sort of, you know, always
• 10:57
  Speaker 4: always anticipating those different problems and trying to get ahead
• 11:02
  Speaker 4: of them.
• 11:02
  Speaker 3: Can you tell us something about one thing to sort
• 11:06
  Speaker 3: of add to that, is it's sort of like you
• 11:07
  Speaker 3: know the carnival game whack a mole, right, Like, you know,
• 11:09
  Speaker 3: little moles are packing popping up and you gotta hit them
• 11:11
  Speaker 3: with the hammer. Like as soon as you come up
• 11:14
  Speaker 3: with something and fix something, there's another bad guy or
• 11:16
  Speaker 3: another ill, you know, malintended person out there somewhere that
• 11:20
  Speaker 3: comes up with something new, and then you've got to
• 11:22
  Speaker 3: chase that down, right, So so it never stops and
• 11:25
  Speaker 3: you know, keep going. But as a result, you know,
• 11:27
  Speaker 3: we built our processes around.
• 11:28
  Speaker 4: That, Yeah, for sure. So sort of maybe less on
• 11:34
  Speaker 4: the red team and whack them all and more on
• 11:37
  Speaker 4: the preventative measures we take. Can you talk a little
• 11:40
  Speaker 4: bit as well about our technical and operational security measures
• 11:44
  Speaker 4: that we have in place to try and reduce risk,
• 11:47
  Speaker 4: like world based management, change management, things like that.
• 11:51
  Speaker 3: Yeah, I mean it's one of the major areas that
• 11:55
  Speaker 3: customers you know, bring up all the time. Right, So
• 11:57
  Speaker 3: when you're developing software, you know, like for example, uh,
• 12:01
  Speaker 3: you know, one of the big ones that came up,
• 12:03
  Speaker 3: you know, I guess, I guess it was about eighteen
• 12:05
  Speaker 3: months twenty four months ago, and I remember exactly the time,
• 12:07
  Speaker 3: data time, but solar winds came came about, and you know,
• 12:12
  Speaker 3: that was essentially a supply chain attack right where you know,
• 12:17
  Speaker 3: you're able to introduce code into the environment and uh,
• 12:22
  Speaker 3: you know, sort of impact how the code is working
• 12:24
  Speaker 3: and as a result, create you know, gather a whole
• 12:26
  Speaker 3: bunch of data and you know, sort of misuse the tool,
• 12:29
  Speaker 3: you know, from what it was intended to do. So
• 12:31
  Speaker 3: given the fact that our tool is installed on organizations,
• 12:36
  Speaker 3: uh you know, desktops and that we're gathering this sort
• 12:39
  Speaker 3: of data, there's obviously a lot of concern about that.
• 12:42
  Speaker 3: And so what I would say is is that you know,
• 12:45
  Speaker 3: as part of our development process, you know, we follow
• 12:48
  Speaker 3: follow a very strict SDLC program where you know, we
• 12:52
  Speaker 3: keep our development, test, production, all those things separated. And
• 12:57
  Speaker 3: then in terms of who's got access and how changes
• 13:01
  Speaker 3: are made, you know, there's a very methodical number of
• 13:05
  Speaker 3: steps that go through to be able to take something
• 13:07
  Speaker 3: and write a piece of code somewhere and then actually
• 13:10
  Speaker 3: introduce it to the product and actually roll it to production. Right,
• 13:13
  Speaker 3: so you know, developers can't just sort of jump into
• 13:17
  Speaker 3: production and slam you know, one hundred lines of code
• 13:20
  Speaker 3: into things. Right. There's you go through your change management
• 13:22
  Speaker 3: process and then going through that sort of thing you
• 13:25
  Speaker 3: know that has to get multiple levels of management approval
• 13:28
  Speaker 3: before something gets introduced. You know, all those changes get tested,
• 13:32
  Speaker 3: you know, and then it's sort of a secondary measure obviously,
• 13:34
  Speaker 3: you know, it's potentially that stuff is subject to uh,
• 13:37
  Speaker 3: you know to pen testing as well. So you know,
• 13:40
  Speaker 3: our developers themselves are trained on you know, secure coding methodologies,
• 13:46
  Speaker 3: you know, for sort of the obvious sort of simple
• 13:48
  Speaker 3: stuff to make sure that they're not accidentally introducing vulnerabilities
• 13:52
  Speaker 3: you know, in sort of basic you know code development.
• 13:56
  Speaker 3: You know, then as part of our processes, you know,
• 13:59
  Speaker 3: our tools are looking for those. We run you know,
• 14:01
  Speaker 3: code scanners to try to find vulnerabilities that are written
• 14:05
  Speaker 3: in there, you know, to ensure that all those are
• 14:07
  Speaker 3: fixed before the code roads to production. And then on
• 14:11
  Speaker 3: the back end, like I said, you know, we're going
• 14:12
  Speaker 3: to run through pen testing, you know, and if if
• 14:15
  Speaker 3: something slips through the first couple levels, then you know
• 14:17
  Speaker 3: it should get caught in the pen testing phase and
• 14:19
  Speaker 3: and also you know, introduces vulnerability management to make sure
• 14:22
  Speaker 3: we you know, we get it fixed and keep everything rolling.
• 14:25
  Speaker 5: Very cool. Hi John, this is Megan. I'm really enjoying
• 14:29
  Speaker 5: this conversation. It's cool to get this peak under the
• 14:31
  Speaker 5: hood as somebod who doesn't work anywhere near our security
• 14:34
  Speaker 5: and compliance in the product. It's thank you for joining us.
• 14:38
  Speaker 5: This is this is kind of interesting. I'm wondering because
• 14:43
  Speaker 5: I work in marketing obviously, so I hear a lot
• 14:44
  Speaker 5: about our different partnerships, and one partnership I hear about
• 14:47
  Speaker 5: a lot is our partnership with a WS. So how
• 14:51
  Speaker 5: does that partnership contribute to the scalability to our security,
• 14:55
  Speaker 5: to our data querying, especially for our large client bases.
• 15:00
  Speaker 3: Yeah, I mean, I mean when you look at controls,
• 15:04
  Speaker 3: security controls, and I've been doing this twenty years, right,
• 15:08
  Speaker 3: so I've seen it from a lot of different perspectives
• 15:09
  Speaker 3: and a lot of different frameworks. A WS is a
• 15:14
  Speaker 3: central part of sort of our security program for certain
• 15:17
  Speaker 3: components of our you know of our security program, right,
• 15:20
  Speaker 3: so when you talk about physical security, you know, we
• 15:23
  Speaker 3: obviously have physical security controls built into our offices right
• 15:27
  Speaker 3: with badge scans and CCTV cameras and things like that.
• 15:30
  Speaker 3: We have you know, receptionists at the desk that to
• 15:32
  Speaker 3: wear a visitor badge and all that sort of good
• 15:35
  Speaker 3: hygiene stuff you have when you're walking through the office
• 15:37
  Speaker 3: if you you know, you bring a visitor into the
• 15:38
  Speaker 3: office or a customer into the office for a day.
• 15:41
  Speaker 3: But in terms of you know, the hardened data center aspect,
• 15:46
  Speaker 3: when you talk about redundancy, you talk about the physical controls, right.
• 15:50
  Speaker 3: You know, AWS is our major provider, that's where all
• 15:55
  Speaker 3: of our customer data goes, right, So all of those
• 15:58
  Speaker 3: sort of physical controls of you know, visitor access and
• 16:02
  Speaker 3: badges and man traps and securities security and you know
• 16:07
  Speaker 3: gates you know where you can't drive your car onto
• 16:10
  Speaker 3: the property and all that sort of stuff. A WS
• 16:11
  Speaker 3: handles all that, right, and so they have you know
• 16:15
  Speaker 3: a number of assessments just like we go through we
• 16:18
  Speaker 3: do our Sock two and we go through our ISO
• 16:20
  Speaker 3: certifications things like that. You know, AWS has probably got
• 16:24
  Speaker 3: about two dozen different certifications they go through where they
• 16:27
  Speaker 3: you know, they test their physical controls, you know, and
• 16:30
  Speaker 3: they and they ensure that you know, the data centers
• 16:33
  Speaker 3: are are you know, hardened and nobody can go in
• 16:36
  Speaker 3: and out and they handle all that access. We get
• 16:39
  Speaker 3: requests from our customers from time to time to be
• 16:41
  Speaker 3: able to audit our data centers, so to speak. And
• 16:45
  Speaker 3: you know, we are not even allowed in a w
• 16:47
  Speaker 3: S as data centers. All right, We're a customer there
• 16:49
  Speaker 3: as we spend millions of dollars of them, you know,
• 16:52
  Speaker 3: but you know, as an AWS customer, you can't sort
• 16:54
  Speaker 3: of walk up to the building and go, hey, I
• 16:56
  Speaker 3: spend a lot of money with you. Can I come
• 16:57
  Speaker 3: in like that's that's not how that part works. In
• 17:00
  Speaker 3: addition to that, you know sort of you know, besides
• 17:02
  Speaker 3: sort of the physical aspects of what a WUS provides us,
• 17:06
  Speaker 3: you know, there's two sort of key components that you know,
• 17:09
  Speaker 3: customers rely upon, one of which is on sort of
• 17:14
  Speaker 3: UH scalability and reliability. Right, So you know, we use
• 17:18
  Speaker 3: pretty much all cloud native tools and we use every
• 17:22
  Speaker 3: a w S service that we can for you know,
• 17:25
  Speaker 3: facilitate simplicity and have everything sort of under one umbrella
• 17:30
  Speaker 3: for load balancing for you know, UH scalability to be
• 17:34
  Speaker 3: able to scale up, scale down if necessary, you know,
• 17:37
  Speaker 3: be able to do uh, you know, predictive modeling on
• 17:40
  Speaker 3: you know, how much consumption we're going to need in
• 17:42
  Speaker 3: the cloud dis based uh usage things like that. So
• 17:46
  Speaker 3: you know, we do get some questions from customers on
• 17:48
  Speaker 3: from time to time about you know, how do we
• 17:51
  Speaker 3: you know, if I'm gonna put X number of I'm
• 17:53
  Speaker 3: gonna put three hundred thousand collectors into your environment, how
• 17:56
  Speaker 3: I know they're all going to work and a WS
• 17:58
  Speaker 3: going to handle all that stuff? Right, So that's been
• 18:00
  Speaker 3: tested and we've got you know, sort of predictive you know,
• 18:05
  Speaker 3: scalability uh teams that go through and look, you know,
• 18:08
  Speaker 3: to make sure we're going to have out of put
• 18:09
  Speaker 3: resources in place. And I think the last piece is
• 18:12
  Speaker 3: with sort of old school you know, disaster recovery and
• 18:16
  Speaker 3: business continuity and things like that. You know, we used
• 18:20
  Speaker 3: AWS availability zones, right, So it used to be, you know,
• 18:24
  Speaker 3: ten fifteen years ago, if you had a data center,
• 18:27
  Speaker 3: you usually had to have two, Right, you have a
• 18:28
  Speaker 3: data center in New York, and you'd have one in Washington,
• 18:31
  Speaker 3: d C. Or one in New York and Denver or
• 18:34
  Speaker 3: whatever it might be, because you'd have to split those
• 18:37
  Speaker 3: data centers and you'd have to have sort of adequate
• 18:39
  Speaker 3: distance between the data centers in case there was a disaster,
• 18:42
  Speaker 3: you know, hurricane, you know, some sort of you know,
• 18:44
  Speaker 3: natural disaster event, earthquake, whatnot, and so you'd have to
• 18:48
  Speaker 3: have sort of redundancy there to make sure that if
• 18:51
  Speaker 3: one site went down, the other one could handle it well.
• 18:54
  Speaker 3: All that stuff is sort of dynamically handled by AWS, right,
• 18:57
  Speaker 3: So availability zones are designed such a way that, you know,
• 19:00
  Speaker 3: a customer can pick whatever region they want, so they
• 19:04
  Speaker 3: can say, you know, if they're a US based company,
• 19:06
  Speaker 3: they want to put their data into US East or
• 19:09
  Speaker 3: US West or whatever it might be in AWS, and
• 19:12
  Speaker 3: all of their data will be located in the United States,
• 19:15
  Speaker 3: including the logs, including all the sort of subsequent data
• 19:18
  Speaker 3: that comes out of there, you know, the administrative data whatnot,
• 19:22
  Speaker 3: that all stays where they want it to stay. Similarly,
• 19:25
  Speaker 3: for European customer, they can pick Germany or the UK
• 19:28
  Speaker 3: or whatever they want, you know, to host their data.
• 19:31
  Speaker 3: And we've also got sites in the Middle East, we've
• 19:32
  Speaker 3: got sites in Asia pac you know, to allow us
• 19:35
  Speaker 3: to you know, locate data in certain places and within
• 19:39
  Speaker 3: those availability zones, there's automatic failover. So the idea is
• 19:43
  Speaker 3: that when you're in you know, the UK uh you
• 19:47
  Speaker 3: know zone, you're not in one data center, You're really
• 19:50
  Speaker 3: in like three or four. And the idea is that
• 19:52
  Speaker 3: one data center was to come offline, well because of
• 19:55
  Speaker 3: the load balancing that they have at AWS, essentially, you know,
• 20:00
  Speaker 3: your data will just continue to flow on the other
• 20:01
  Speaker 3: three like nothing happened, right, and there's really nothing we
• 20:04
  Speaker 3: need to do. You know, if there was a major
• 20:06
  Speaker 3: disruption where a couple of data centers came down, like
• 20:08
  Speaker 3: we you know, we might have to look at that
• 20:09
  Speaker 3: and sort of see what's going on. But you know,
• 20:11
  Speaker 3: to my knowledge, I'm knocking down with that's you know,
• 20:13
  Speaker 3: that hasn't happened. But the idea is that when you're
• 20:17
  Speaker 3: looking at that, all of that stuff is just sort
• 20:19
  Speaker 3: of taken care of. Right. You don't have to worry
• 20:21
  Speaker 3: about the worry about the application. You can worry about
• 20:23
  Speaker 3: new features, you can worry about you know, you know,
• 20:26
  Speaker 3: hardening and reliability and things like that, you don't have
• 20:28
  Speaker 3: to worry about sort of like these extraining factors. So
• 20:31
  Speaker 3: a b S is a you know, a key partner
• 20:33
  Speaker 3: for us, you know, and and you know, customers feel
• 20:36
  Speaker 3: safe knowing that they're that we're not. We don't have
• 20:39
  Speaker 3: our own personal cloud, we're not running our own data center.
• 20:41
  Speaker 3: They don't have to worry about all that stuff. It's
• 20:43
  Speaker 3: you know, there's the general level of acceptance in the
• 20:45
  Speaker 3: industry where you know, if you're using a bus, you're
• 20:47
  Speaker 3: you're probably gonna be okay in a lot of those regards.
• 20:51
  Speaker 5: Thank you. That was a was a great explanation of that.
• 20:54
  Speaker 5: Clearly a pretty key partner for us. You mentioned a
• 20:57
  Speaker 5: couple of times in that answer and earlier in the
• 21:00
  Speaker 5: podcast some certifications that we have. So I know this
• 21:04
  Speaker 5: might turn into just listing it out, but you don't
• 21:06
  Speaker 5: have to do that. But what are some of the
• 21:08
  Speaker 5: key ones, the key security compliance certifications we have and
• 21:12
  Speaker 5: why are they essential for client trust and market differentiation
• 21:16
  Speaker 5: and what sets us apart in this area?
• 21:18
  Speaker 3: Yeah, I mean I would say that, you know, we
• 21:21
  Speaker 3: have ISO twenty seven thousand and one, and from a
• 21:23
  Speaker 3: cybersecurity standpoint, that is universally accepted. You know, it's sort
• 21:29
  Speaker 3: of it's one of the major industry standards, you know,
• 21:33
  Speaker 3: for following a set of guidelines, having a certain set
• 21:35
  Speaker 3: of controls in place, and you've sort of got your
• 21:38
  Speaker 3: ducks in a row and it covers a broad scope
• 21:40
  Speaker 3: of what you've got right. So IO twenty seven thousand
• 21:43
  Speaker 3: and one is sort of the foundational piece of our
• 21:45
  Speaker 3: sort of cyber program. How we think about things, how
• 21:48
  Speaker 3: we protect things, you know, and you know, how we
• 21:52
  Speaker 3: enforce those and we go through audits every year you know,
• 21:56
  Speaker 3: and you know, maintain our certification and anyal base. We
• 21:58
  Speaker 3: get new certificate every summer you know, from our auditors
• 22:02
  Speaker 3: for ISO twenty seven thousand and one, and over time
• 22:05
  Speaker 3: we've actually extended that because IO is always developing new
• 22:08
  Speaker 3: certifications for things as things change, you know. So we
• 22:12
  Speaker 3: we have you know, ISO twenty seveny seventeen, which is
• 22:16
  Speaker 3: for cloud providers, I believe, and then we have eighteen
• 22:20
  Speaker 3: which is for privacy in the cloud, and then twenty
• 22:24
  Speaker 3: seven seven oh one, which is for you know, maintaining
• 22:28
  Speaker 3: a privacy management system. So like I said, it's having
• 22:31
  Speaker 3: you know, grown up in the EU and started in
• 22:34
  Speaker 3: the EU. Privacy is central focus. We're very focused on GDPR,
• 22:39
  Speaker 3: you know, and so having these certifications in place show
• 22:42
  Speaker 3: that it's not an afterthought for us. It's something that
• 22:45
  Speaker 3: we have to work towards every day to maintain these
• 22:47
  Speaker 3: certifications and it's key. And then I would say, you know,
• 22:50
  Speaker 3: the other major certification, you know, when you when you
• 22:53
  Speaker 3: have those other things in place, it sort of shows
• 22:56
  Speaker 3: you've got certain controls there. What we do is something
• 23:00
  Speaker 3: called SOCK two type two certification, which is you know,
• 23:04
  Speaker 3: an audited process that shows that you're maintaining these processes
• 23:09
  Speaker 3: over time. Right, So it's one thing to sort of
• 23:11
  Speaker 3: say you have change management in place, and you know
• 23:14
  Speaker 3: you've got to get certain levels of approvals to get
• 23:16
  Speaker 3: a change push through, or that you know, you've got
• 23:19
  Speaker 3: onboarding techniques where people get background screened, like before they
• 23:23
  Speaker 3: get hired, to make sure you're not hiring you know,
• 23:25
  Speaker 3: a hacker from you know, the Eastern Europe or something.
• 23:29
  Speaker 3: But the idea is that when you go through the
• 23:31
  Speaker 3: SoC two type two certification, you you have to present
• 23:35
  Speaker 3: to the auditors and show that, okay, we hired you know,
• 23:38
  Speaker 3: these three hundred people this year, and in doing so
• 23:41
  Speaker 3: they'll say okay, they'll randomly select you know, twenty different
• 23:45
  Speaker 3: you know, new hires and say show me where you
• 23:47
  Speaker 3: did the background screens for these twenty people before they started,
• 23:51
  Speaker 3: you know, or or you know, as you know, as
• 23:52
  Speaker 3: they were coming on board, and we have to be
• 23:54
  Speaker 3: able to demonstrate that you know, you know we we
• 23:56
  Speaker 3: you know, HR did the certificate, did the background check,
• 23:58
  Speaker 3: we got the results, came back clean, they got hired, all.
• 24:01
  Speaker 2: That sort of stuff.
• 24:01
  Speaker 3: So you know, SoC two type two is is going
• 24:05
  Speaker 3: to keep you honest that you can't just sort of
• 24:07
  Speaker 3: say you do something because if you don't, the auditors
• 24:10
  Speaker 3: will find it and they'll catch it. And then you know,
• 24:12
  Speaker 3: our customers ask us for copy of those are reports
• 24:14
  Speaker 3: and they're going to ask us questions too, So you know,
• 24:16
  Speaker 3: i'd say those are probably the biggest ones. I would
• 24:19
  Speaker 3: say that, you know, probably the thing that's top of
• 24:24
  Speaker 3: mind for a lot of customers, and I deal with
• 24:27
  Speaker 3: questions sort of globally. Is it's happened a lot more
• 24:31
  Speaker 3: in the last five years especially, I'd say in the
• 24:33
  Speaker 3: last three is countries are coming up with more and
• 24:36
  Speaker 3: more specific certifications to their country and their geographic region
• 24:42
  Speaker 3: so to speak. So you know, depending on you know,
• 24:46
  Speaker 3: the countries we were operating in, you know, like for
• 24:48
  Speaker 3: things like privacy, you know, Japan generally accepts EU certification
• 24:54
  Speaker 3: or EU compliance as you know, you know, essentially translating
• 24:58
  Speaker 3: to what they require over there, you know, but certain
• 25:02
  Speaker 3: you know, especially for government agencies and government contractors and
• 25:05
  Speaker 3: things like that. You know, they want to see certain
• 25:08
  Speaker 3: UH certifications for their country, which puts you sort of
• 25:12
  Speaker 3: an improved with So I know, for like, you know,
• 25:14
  Speaker 3: the UK, we've got cyber essentials. In Spain, we've got
• 25:17
  Speaker 3: E and S certification, you know, which shows that you know,
• 25:20
  Speaker 3: in addition to sort of all the good housekeeping stuff
• 25:23
  Speaker 3: we do for the whole organization, that we also have
• 25:26
  Speaker 3: to specifically respond to these countries or requirements to make
• 25:30
  Speaker 3: sure we're upholding those. Generally, the idea is that if
• 25:32
  Speaker 3: you're doing all the right stuff and those other you know,
• 25:34
  Speaker 3: those foundational ones, the other one shouldn't be too bad.
• 25:37
  Speaker 3: But there's always a couple of unique requirements that these
• 25:39
  Speaker 3: country might have or something they want to see, and
• 25:42
  Speaker 3: you have to you know, make sure you're adhering to
• 25:43
  Speaker 3: all that stuff too. So you know, we have a
• 25:47
  Speaker 3: you know, a compliance team that all they do all
• 25:50
  Speaker 3: year round is support these certifications. You know, they they
• 25:53
  Speaker 3: go through the audit cycles. You know, the auditors go
• 25:56
  Speaker 3: to our offices, they visit us in Spain and Switzerland
• 25:59
  Speaker 3: and Boston, you know, India, you know, so you know,
• 26:02
  Speaker 3: they come and look at our controls. If we say
• 26:04
  Speaker 3: we've got CCTV, they're going to come make sure that
• 26:07
  Speaker 3: there's cameras there we say there are. So, you know,
• 26:10
  Speaker 3: all those certifications are a lot of work to get,
• 26:14
  Speaker 3: a lot of work to maintain, but you know, it
• 26:16
  Speaker 3: offers some level of reassurance to our customers that we're
• 26:21
  Speaker 3: not just sort of saying this stuff during the sales cycle.
• 26:23
  Speaker 3: And and you know, once we've sold, you know, sold
• 26:26
  Speaker 3: the software that you know, we're going to go, we
• 26:28
  Speaker 3: have to keep going with this and make sure we're
• 26:30
  Speaker 3: we're maintaining uh, you know, our security to a level
• 26:34
  Speaker 3: that's going to maintain these certifications and you know, make
• 26:36
  Speaker 3: our customers feel safe.
• 26:38
  Speaker 2: Given this level john of scrupulousness obviously applied across the
• 26:42
  Speaker 2: board here, how do you stay ahead of the curve
• 26:46
  Speaker 2: in terms of new technologies and with it evolving industry standards.
• 26:53
  Speaker 3: Yeah, I mean we have to keep track, you know,
• 26:59
  Speaker 3: of our tool so every time, so for example, if
• 27:03
  Speaker 3: we were using a certain development platform, or we're using
• 27:07
  Speaker 3: you know, you know, a certain uh you know, code repository,
• 27:12
  Speaker 3: if we considered making a change to that, we have
• 27:15
  Speaker 3: to think about all the impacts to all these existing certifications.
• 27:19
  Speaker 3: Not only that, but also the processes that we're saying. So,
• 27:23
  Speaker 3: like I said, the change management stuff, if you were
• 27:26
  Speaker 3: to change you know, if you were considered making a
• 27:29
  Speaker 3: change to our to our change management tool set, you
• 27:33
  Speaker 3: can't then just say well, we're going to stop doing
• 27:34
  Speaker 3: these ten processes that you know, we used to do
• 27:37
  Speaker 3: because we have a new tool now, right, You've got
• 27:39
  Speaker 3: to make sure those those tools can support our processes
• 27:41
  Speaker 3: and processes can work in those tools.
• 27:43
  Speaker 1: Right.
• 27:43
  Speaker 3: So there's a lot of give and take with that,
• 27:45
  Speaker 3: and so there's a constant level sort of evaluation, you know.
• 27:49
  Speaker 3: And I'd say that you know, over time, as certain
• 27:53
  Speaker 3: types of of you know, attacks happened in the media,
• 27:57
  Speaker 3: you know, where you know, something makes New York Times
• 28:00
  Speaker 3: a certain you know, or Washington Post or you know,
• 28:02
  Speaker 3: London Financial Times. When there's a big attack that's announced,
• 28:05
  Speaker 3: everybody then starts to look at that and say, okay,
• 28:08
  Speaker 3: am I vulnerable this? So right, so when when solar
• 28:11
  Speaker 3: winds happened a couple of years back, everybody stopped and said, okay,
• 28:15
  Speaker 3: that was really bad, and then are my tools going
• 28:19
  Speaker 3: to potentially put me at risk for that, right, and
• 28:21
  Speaker 3: we're one of those tools people are going to evaluate,
• 28:24
  Speaker 3: you know, so we've got to constantly sort of stay
• 28:26
  Speaker 3: on top of that, and i'd say things like, you know,
• 28:28
  Speaker 3: over the next twelve to eighteen months, you know, are
• 28:32
  Speaker 3: things like AI, you know, and the inclusion of AI.
• 28:34
  Speaker 3: You know, some customers can't wait for it because they
• 28:38
  Speaker 3: want to use the benefits of it. They want to
• 28:40
  Speaker 3: you know, they want the the efficiencies, they want the speed.
• 28:44
  Speaker 3: While other customers, as I've seen, are very wary of it,
• 28:47
  Speaker 3: and they want a lot of controls around it, and
• 28:49
  Speaker 3: they're very particular about you know, their use of AI
• 28:51
  Speaker 3: and how that's going to work. And so in return,
• 28:56
  Speaker 3: we need to keep up with that, right. So, like internally,
• 28:58
  Speaker 3: we formed AI committees, we've you know, we're you know,
• 29:01
  Speaker 3: we're putting together our policies and you know, there's a
• 29:04
  Speaker 3: whole bunch of you know, on the development side and
• 29:07
  Speaker 3: on the legal side and everywhere else there. You know,
• 29:09
  Speaker 3: there's going to be a whole bunch of responsibilities that
• 29:11
  Speaker 3: are allocated to make sure that we don't just sort
• 29:14
  Speaker 3: of throw AI into our tool very haphazardly. We've got
• 29:17
  Speaker 3: to be very metered about it. We've got to make
• 29:19
  Speaker 3: sure we've investigated it, we've tested it, the models are
• 29:23
  Speaker 3: trained appropriately that you know. You know, we're using sort
• 29:26
  Speaker 3: of industry standard tools, you know, so you know we
• 29:29
  Speaker 3: use some of the things from Google and so on
• 29:31
  Speaker 3: and so forth. Right, so you know customers are going
• 29:35
  Speaker 3: to if we don't sort of stay on top of it.
• 29:38
  Speaker 3: Our customers will keep us on as whether we like
• 29:40
  Speaker 3: it or not. Right, So we've got to sort of
• 29:43
  Speaker 3: stay at least in step with them, if not a
• 29:46
  Speaker 3: step ahead of them, to make sure that when they
• 29:47
  Speaker 3: ask the questions say, okay, you're telling me you've got
• 29:50
  Speaker 3: this new AI thing, you know, tell me how that works.
• 29:53
  Speaker 3: We've got to build answer those questions. Right, So it
• 29:55
  Speaker 3: is sort of a constant reshaping and you know, refining
• 29:59
  Speaker 3: as to you know how they is work, you know,
• 30:01
  Speaker 3: but you know it's it's what sort of keeps you know,
• 30:06
  Speaker 3: you know, customers feeling comfortable and new customers feeling comfortable
• 30:09
  Speaker 3: to join the platform and and you know, read the benefits.
• 30:12
  Speaker 2: Yeah, I think that's a really really good last note actually, John,
• 30:16
  Speaker 2: And as I think Megan news a phrase it was
• 30:19
  Speaker 2: it was great to get a peek under the Hood.
• 30:22
  Speaker 2: Talking to you today, it really was and great illustration
• 30:25
  Speaker 2: of why this show is so much fun. You know,
• 30:27
  Speaker 2: you get particular experts and you hear about really really
• 30:30
  Speaker 2: interesting topics. So it was great to talk to you.
• 30:32
  Speaker 2: I hope you enjoy coming on the show and we
• 30:35
  Speaker 2: hope to see you.
• 30:35
  Speaker 3: Again any anytime you guys want to chat or you
• 30:39
  Speaker 3: know there's any new developments, feel free to reach out
• 30:41
  Speaker 3: and happy to hap it up out.
• 30:42
  Speaker 2: Thanks so much, John, we appreciate it.
• 30:46
  Speaker 1: To make sure that you never miss an episode, subscribe
• 30:49
  Speaker 1: to the show in Apple Podcasts, Spotify, or your favorite
• 30:52
  Speaker 1: podcast player, and if you're listening on Apple podcasts, make
• 30:56
  Speaker 1: sure to leave a rating of the show. Just have
• 30:58
  Speaker 1: the number of stars you think the podcast deserves. If
• 31:01
  Speaker 1: you'd like to learn more about how next Think can
• 31:03
  Speaker 1: help me improve your digital employee experience, head over to
• 31:06
  Speaker 1: nextthink dot com. Thank you so much for listening. Until
• 31:09
  Speaker 1: next time,