Latest / Code Story | Startup Podcast for CTOs, CEOs and Technical Founders / S12 Bonus: The Bearer Token Trap: Why API Secrets are Leaking and the Rise of Dynamic, Zero-Trust Machine Identity Providers with Anusha Iyer, Founder & CEO of Corsha

Transcript

S12 Bonus: The Bearer Token Trap: Why API Secrets are Leaking and the Rise of Dynamic, Zero-Trust Machine Identity Providers with Anusha Iyer, Founder & CEO of Corsha · Code Story | Startup Podcast for CTOs, CEOs and Technical Founders

• 0:01
  [SPEAKER_02]: The really neat thing about road maps for us today is that it's customer driven.
• 0:07
  [SPEAKER_02]: Early in, you don't always have that luxury.
• 0:10
  [SPEAKER_02]: And so you have to kind of imagine what a customer would want.
• 0:14
  [SPEAKER_02]: And so, maturing that road map, it's almost again like what we tried to do was be a little bit like cyclic around it, right?
• 0:24
  [SPEAKER_02]: Do obviously a lot of trade studies of the space
• 0:30
  [SPEAKER_02]: which you're making guesses.
• 0:32
  [SPEAKER_02]: And that's where I think a startup wouldn't be a startup without some pivots.
• 0:36
  [SPEAKER_02]: My name is Inushire, the CEO and founder of Korsha.
• 0:43
  [SPEAKER_00]: This is Kodesh story.
• 0:46
  [SPEAKER_00]: A podcast bringing you interviews with tech visionaries.
• 0:49
  [SPEAKER_00]: 6 months moonlighting goes.
• 0:50
  [SPEAKER_00]: It's the last and all the backends.
• 0:52
  [SPEAKER_00]: Who share what it takes to change an industry?
• 0:55
  [SPEAKER_00]: I don't exactly know what to do.
• 0:56
  [SPEAKER_00]: It's the same goes to get right.
• 0:59
  [SPEAKER_00]: who built the teams that have their bad company is its people.
• 1:03
  [SPEAKER_00]: The team's helped each other achieve this proud of our team.
• 1:05
  [SPEAKER_00]: Keeping scalability top of mind.
• 1:08
  [SPEAKER_00]: All that infrastructure was up there.
• 1:09
  [SPEAKER_00]: Yes, we've been fighting it as we grew up.
• 1:11
  [SPEAKER_00]: Total waste of time.
• 1:12
  [SPEAKER_00]: The stories you don't read in the headlines.
• 1:15
  [SPEAKER_00]: It's not an easy thing to achieve.
• 1:16
  [SPEAKER_00]: To get yourself a deficit off, try to begin.
• 1:19
  [SPEAKER_00]: To ride the ups and downs of the startup line.
• 1:22
  [SPEAKER_00]: Need to really want it.
• 1:24
  [SPEAKER_00]: Not just about technology.
• 1:25
  [SPEAKER_01]: All this and more on code story.
• 1:29
  [SPEAKER_01]: I'm your host, Noah Labpart.
• 1:31
  [SPEAKER_01]: And today, how Anushia Iyer is giving your machine an identity.
• 1:37
  [SPEAKER_01]: So you can securely automate and connect with confidence.
• 1:46
  [SPEAKER_01]: Anusha Ayer is a first-generation immigrant born in India.
• 1:49
  [SPEAKER_01]: She moved to the states with her family when her dad was going to grad school at Ohio State.
• 1:55
  [SPEAKER_01]: She finally remembers sitting on her dad's shoulders for Buckeye's football games, as he was fan of enough for the whole family.
• 2:01
  [SPEAKER_01]: Outside of her professional life, she has two kids and college who were coding since they could walk, neither of which ended up in computer science.
• 2:09
  [SPEAKER_01]: She loved to cook and notes that she is not a recipe follower.
• 2:19
  [SPEAKER_01]: Anusha has been in the cybersecurity space for quite some time, starting off in Naval Research in DC.
• 2:25
  [SPEAKER_01]: Further down her career, she had a friend reach out to pitch an idea, to build a platform for dynamic, machine identification.
• 2:36
  [SPEAKER_01]: This is the creation story of Korsha.
• 2:43
  [SPEAKER_02]: I've been in the cybersecurity space for about 25 years.
• 2:46
  [SPEAKER_02]: And it up meandering my way into starting the company.
• 2:49
  [SPEAKER_02]: The vision behind Korsha is to help industrial customers to really bring in identity.
• 2:58
  [SPEAKER_02]: an access management identity security into their day-to-day kind of processes, whether that's manufacturing, controls, transportation, so that they can really securely connect like a lot of legacy systems and machines to the AI and data revolution that's happening around us.
• 3:20
  [SPEAKER_02]: We built this, we're building, it's never done, this industrial identity security platform.
• 3:26
  [SPEAKER_02]: That really is almost like a focused on managing and securing connections for machines first over humans.
• 3:36
  [SPEAKER_02]: I'm in the DC area, and I started off in the space of the Naval Research Lab, so I was there for some time working on things like tactical edge networking and reverse engineering for some pretty interesting customers, so I actually taking code and being able to from the binaries tell what the code is doing, and then I disappeared into more of the intelligence community for a bit here in the area.
• 4:02
  [SPEAKER_02]: I jumped out and I started getting more involved in like cryptography, high assurance systems, ended up running some DARPA programs for the company out here.
• 4:11
  [SPEAKER_02]: And then a friend of mine reached out and said, let's go start this thing and took the leap of faith.
• 4:17
  [SPEAKER_02]: We were able to raise a little bit of seed money just off of the two of us in a PowerPoint and then jumped straight into hiring a small court team and jumping into the MVP.
• 4:30
  [SPEAKER_01]: That's a perfect segue in the next question, and so tell me about that MVP, the first version, that you and the team built, how long did it take to build and what sort of tools you're using to bring to life?
• 4:42
  [SPEAKER_02]: probably took about six months with four core engineers and myself.
• 4:48
  [SPEAKER_02]: In terms of the tools that we were using, we really were focused on having it be flexible and we'll say like cloud agnostic and that's one of the neat things about a startup, right?
• 5:02
  [SPEAKER_02]: You're starting from scratch and so you get to really use best to breed.
• 5:06
  [SPEAKER_02]: So we, at the time, jumped headfirst into containerization Kubernetes and took that whole route, especially being a company that was focused on securing automated communications.
• 5:19
  [SPEAKER_02]: Actually, funny story there.
• 5:21
  [SPEAKER_02]: Like we again, like as a startup, you're always trying to save a little bit here and there.
• 5:26
  [SPEAKER_02]: And so we made this conscious choice to
• 5:29
  [SPEAKER_02]: be Kubernetes native, but cloud agnostic so that you could run the MVP on really any cloud.
• 5:36
  [SPEAKER_02]: And one of the motivating factors there that since has turned into a really good capability was that at the time cloud providers were giving tons of credit to startups.
• 5:48
  [SPEAKER_02]: And so the ability to hop from one cloud provider to the next,
• 6:00
  [SPEAKER_01]: Let's stick in that a little bit.
• 6:02
  [SPEAKER_01]: I'm curious about a decision or trade off you had to make and how you shaped that MVP, how you went about delivering it, could be around feature limitation or tectat acceptance, all those sorts of things.
• 6:15
  [SPEAKER_01]: Tell me about one of those decisions that you had to make and how you cope with it.
• 6:18
  [SPEAKER_02]: It's interesting what we were really focused on was that
• 6:25
  [SPEAKER_02]: we really committed to the security design of it, right?
• 6:29
  [SPEAKER_02]: Because you're talking about a cybersecurity platform, you really want to make sure your own house is clean.
• 6:37
  [SPEAKER_02]: Now, what we were effectively doing,
• 6:40
  [SPEAKER_02]: was taking a lot of the hard parts of like identity, access management, like certificate management, and trying to abstract it and make it a lot easier for our customers, but that meant that we had to get it right internally and make the consume all of the hard stuff within the platform.
• 7:02
  [SPEAKER_02]: The trick is that it created a really good foundation, like a super strong foundation that to this day, I think we've gotten benefit from, but I think one of the early lessons I learned from that is that if you're focusing so much inwardly on the bones of the platform which you're sacrificing is some of the outward features that could have high impact.
• 7:26
  [SPEAKER_02]: right and this sort of user experience of all of it.
• 7:30
  [SPEAKER_02]: If I had to do it again, I would probably trade off a little bit of the posture knowing that we have to come back to it and always keep iterating, obviously, in an agile fashion, but equally focused on stuff that people can experience and feel.
• 7:47
  [SPEAKER_01]: I'm curious about how you progressed it from that point, right?
• 7:51
  [SPEAKER_01]: And to wrap that question in a box a little bit around maturation, how did you build your roadmap?
• 7:57
  [SPEAKER_01]: How did you go about deciding that, okay, this is the next most important thing to build or address with Corsion.
• 8:04
  [SPEAKER_02]: The really neat thing about roadmaps for us today is that it's customer driven, right?
• 8:11
  [SPEAKER_02]: Our customers are the ones that are kind of telling us, hey, this is what I care about.
• 8:15
  [SPEAKER_02]: This is what's important to me.
• 8:16
  [SPEAKER_02]: This was what would move the needle in terms of the problems I'm trying to solve.
• 8:20
  [SPEAKER_02]: Early in, you don't always have that luxury.
• 8:23
  [SPEAKER_02]: And so you have to kind of imagine what a customer would want.
• 8:27
  [SPEAKER_02]: And so, maturing that road map, it's almost again like what we tried to do was be a little bit like cyclic around it, right?
• 8:36
  [SPEAKER_02]: Do obviously a lot of trade studies of the space, understanding the personas of the customers, which are making guesses.
• 8:44
  [SPEAKER_02]: And that's where I think a startup wouldn't be a startup without some pivots.
• 8:48
  [SPEAKER_02]: And so about, I think, a couple years in, we actually started engaging with the Air Force and one of our customers who moved in ab and working with three years was like, all right, you guys are talking about machines, right?
• 9:02
  [SPEAKER_02]: Can you actually do real machines?
• 9:04
  [SPEAKER_02]: And I think my initial response to him was, what are you talking about?
• 9:09
  [SPEAKER_02]: A Kubernetes pod is a real machine, right?
• 9:11
  [SPEAKER_02]: And so then we started looking at what they were classifying as real machines.
• 9:16
  [SPEAKER_02]: And they're talking about life-size or room-size robotic arms that are managing manufacturing lines, right?
• 9:23
  [SPEAKER_02]: Or really just like physical industrial equipment, that's when we realized that this was a
• 9:29
  [SPEAKER_02]: pretty unserved space from a cybersecurity perspective, and we made a really conscious kind of decision to pivot and go after that space, and that's really what's driven our road map since then.
• 9:44
  [SPEAKER_01]: You know, here you're saying, we tell me about how you built your team, and what did you look for in those people to indicate that they were the winning horses to join you?
• 9:53
  [SPEAKER_02]: by far the thing I'm most grateful for today is just having a fantastic team and there's always been a few attributes from day one that have been really important in terms of who we bring on this journey with us and one is curiosity right and I think that comes expressed into full one you want to be curious not judgmental and the second is that curiosity is what's going to get you to
• 10:19
  [SPEAKER_02]: Keep pulling the thread and asking the questions of sometimes a lot of uncharted territory.
• 10:24
  [SPEAKER_02]: The second is being data driven and making sure that all of the choices that we're making are actually rooted in something tangible in some data that you can point back to.
• 10:36
  [SPEAKER_02]: As you're continuing to learn, you can refine it.
• 10:39
  [SPEAKER_02]: But we always say around here that as long as you've learned something from it is not a failure.
• 10:45
  [SPEAKER_02]: And then the third is being like earnest and eager to solve problems.
• 10:49
  [SPEAKER_02]: Because at the end of the day, whether it is a substantial, like, customer problem, or market problem, or whether it is something you have to do day to day, like approaching that with an optimism is super important.
• 11:01
  [SPEAKER_02]: Think the big thing we like to think of ourselves as is, like, cyber optimists.
• 11:05
  [SPEAKER_02]: It's not the world is filled with doom and gloom.
• 11:08
  [SPEAKER_02]: We don't need to add to that, right?
• 11:13
  [SPEAKER_01]: Let's move into scalability and this will be interesting given that the problem you're trying to solve I'm curious about how you approach scale from, you know, the beginning and also, I'm really interested here if there's been interesting areas that you've had to fight it as you've grown.
• 11:30
  [SPEAKER_02]: This goes back to actually pouring a lot into the foundation early on has created what's turned out to be a highly scalable platform.
• 11:42
  [SPEAKER_02]: Now, when we think about scale, that is obviously it can mean different things to different people.
• 11:50
  [SPEAKER_02]: scale when you're thinking say on the order of Netflix is obviously very different than scale when you're thinking on the order of say one industrial facility.
• 12:01
  [SPEAKER_02]: But at the same time they may have different concerns they're looking to solve for the what we really tuned to for the space that we're in.
• 12:11
  [SPEAKER_02]: is really understanding that when you're trying to protect industrial systems, manufacturing systems, all of these operational systems that run our world, do we're important to prioritize availability and safety as much as it is to think about security, right?
• 12:29
  [SPEAKER_02]: And so that can mean
• 12:30
  [SPEAKER_02]: like you're trying to run real-time operations or running a manufacturing line that is producing consumer goods, even going down for a minute could be thousands, if not hundreds of thousands of dollars, right?
• 12:45
  [SPEAKER_02]: And so that scale we have to take into account in a different way than perhaps dealing out our system.
• 12:55
  [SPEAKER_01]: So, as you step out on the balcony, you look across all that you've built, thus far with Korsha, what are you most proud of?
• 13:03
  [SPEAKER_02]: By far, the neatest thing is being able to, not just build something from nothing, it's the ability to see others willing to pick up your vision and carry it forward.
• 13:18
  [SPEAKER_02]: I'll tell you, these days as we're hiring new folks and bringing them onto the team was a funny story a few weeks ago where we brought someone on and I think I was kind of, I don't actually remember what it was.
• 13:30
  [SPEAKER_02]: I think I was like sitting down with them and looking at
• 13:33
  [SPEAKER_02]: particular system, or maybe a way that we do agile.
• 13:37
  [SPEAKER_02]: In the funny thing is, I think I put that system together a few years ago, and they were explaining it to me, and they were like, oh, we have this way that we do agile development, and it means this, and that, and so the idea of just seeing others carry forward, but your vision is just, it's incredible.
• 14:00
  [SPEAKER_01]: Okay, let's flip the script a little bit.
• 14:02
  [SPEAKER_01]: Tell me about a mistake you made and how you and your team responded to it.
• 14:08
  [SPEAKER_02]: alluded to maybe one of them are focusing too much inwardly and on the foundation.
• 14:15
  [SPEAKER_02]: So that's definitely one.
• 14:17
  [SPEAKER_02]: I think you always want to iterate quickly and get real feedback quickly.
• 14:24
  [SPEAKER_02]: I'd say the other mistakes things like,
• 14:29
  [SPEAKER_02]: not doing enough discovery before saying, deploying something into a customer environment.
• 14:35
  [SPEAKER_02]: Inevitably, like you're going to, as you're learning and building and growing, cause maybe an outage in a customer environment.
• 14:43
  [SPEAKER_02]: And I would say that the first time that happened for us,
• 14:48
  [SPEAKER_02]: What really I think solidified almost improved the trust on the customer side was making sure that we owned what we did and just being a hundred percent committed to fixing it and rectify it.
• 15:01
  [SPEAKER_02]: And that's I think a huge part of it is we're all going to make mistakes.
• 15:05
  [SPEAKER_02]: It's about owning it and being willing to learn.
• 15:09
  [SPEAKER_02]: What we do is there's a big term in this
• 15:17
  [SPEAKER_02]: I actually really, much prefer calling them because rather than post-mortems, it has the negative connotation almost like after event learnings, right?
• 15:26
  [SPEAKER_02]: As long as we're learning from it and we're growing, moving forward, that's about the most you can expect.
• 15:35
  [SPEAKER_01]: Okay, Nisha, let's move forward.
• 15:36
  [SPEAKER_01]: What does the future look like for Korsha?
• 15:39
  [SPEAKER_01]: For the product, for your team, where the industry is going, all the things.
• 15:45
  [SPEAKER_02]: It's a super exciting space when we think about industrial security, industrial identity security.
• 15:53
  [SPEAKER_02]: Because if you think about it, there is increasingly this pressure to connect everything, right?
• 15:59
  [SPEAKER_02]: And bring almost AI into everything and just really up the amount of data and analytics that we're using to make decisions today and augment our decisions.
• 16:12
  [SPEAKER_02]: that.
• 16:13
  [SPEAKER_02]: So some of these more legacy spaces or traditional spaces like manufacturing industrial control systems are not immune to that.
• 16:24
  [SPEAKER_02]: And now the challenge that they face is that
• 16:29
  [SPEAKER_02]: They are sometimes running legacy equipment that's older than we are, right?
• 16:34
  [SPEAKER_02]: But now there's this pressure to bring in all of this modernization.
• 16:38
  [SPEAKER_02]: And these are oftentimes spaces that have never been connected before never can really share data.
• 16:45
  [SPEAKER_02]: And that's really where we're going is helping them securely connect, securely unlock the data so that they can operate faster, more efficiently, smarter, stay ahead of competition, kind of keep adversaries at bay.
• 17:00
  [SPEAKER_02]: And really our hope is in short order.
• 17:04
  [SPEAKER_02]: We're really protecting almost every machine that manufacturers controls processes builds.
• 17:11
  [SPEAKER_02]: across entire industries, right, because eventually it is going to everything is going to be connected and communicating.
• 17:21
  [SPEAKER_01]: So, so what's you?
• 17:22
  [SPEAKER_01]: Who influences the way that you work?
• 17:24
  [SPEAKER_01]: Name a person or many persons or something.
• 17:27
  [SPEAKER_01]: You look up to him.
• 17:28
  [SPEAKER_01]: Why?
• 17:30
  [SPEAKER_02]: I have had the benefit of just a fantastic set of mentors, right?
• 17:37
  [SPEAKER_02]: I think I organically grew into management as many of us do, right?
• 17:43
  [SPEAKER_02]: You end up more often than not.
• 17:45
  [SPEAKER_02]: You hear the story of basically, I was a good engineer and somehow I stumbled my way into managing a team, right?
• 17:51
  [SPEAKER_02]: And it was probably me a few couple of jobs to go.
• 17:54
  [SPEAKER_02]: And so I'm always looking and continually learning for
• 17:59
  [SPEAKER_02]: how to be a better technical leader, how to be someone that motivates the people around me and I've had the benefit on my board of having a couple of folks that have been incredible operators and really built fantastic companies themselves.
• 18:16
  [SPEAKER_02]: So I think that's really what I look up to today.
• 18:19
  [SPEAKER_02]: It's probably where I'm focused on my own growth.
• 18:25
  [SPEAKER_01]: Okay, last question, Anusha, so you're getting on a plane, and you're sitting next to a young entrepreneur who's built the next big thing.
• 18:32
  [SPEAKER_01]: They're jazzed about it, they can't wait to show it off to the world, and get my short to you right there on a plane.
• 18:36
  [SPEAKER_01]: What do you advice to give that person having on down this road a bit?
• 18:39
  [SPEAKER_02]: hold on to that enthusiasm, right?
• 18:41
  [SPEAKER_02]: Like, bottle that up and never let that go.
• 18:43
  [SPEAKER_02]: That's really what is going to kind of define your success, right?
• 18:50
  [SPEAKER_02]: If we can be optimistic and excited about what we're building, then it's infectious.
• 18:55
  [SPEAKER_02]: And that is...
• 18:56
  [SPEAKER_02]: It's infectious not only to the folks that want to come join in that mission but also to customers to people that you want to partner up with, I think that is so much of it is every single day, show up without enthusiasm.
• 19:12
  [SPEAKER_01]: I think that's fantastic advice.
• 19:13
  [SPEAKER_01]: Couldn't agree more.
• 19:14
  [SPEAKER_01]: Well, Nisha, thank you for being on the show today and thank you for telling the creation story of Korsha.
• 19:20
  [SPEAKER_02]: Thank you.
• 19:20
  [SPEAKER_02]: Thanks for having me.
• 19:23
  [SPEAKER_01]: And this concludes another chapter of
• 19:33
  [SPEAKER_01]: code story is hosted and produced by Noah Labhart.
• 19:37
  [SPEAKER_01]: Be sure to subscribe on Apple podcast, Spotify, or the podcasting app at your choice.
• 19:42
  [SPEAKER_01]: And when you get a chance, leave us a review.
• 19:44
  [SPEAKER_01]: Both things help us out tremendously.
• 19:49
  [SPEAKER_01]: And thanks again for listening.