Latest / Beyond Vibe Coding / #S2.13 The CISO’s Playbook for Moving Fast Without Losing Control - Mark Strande (miro)
Transcript
- Mark Strande: everyone is just waiting for the flattening out. And then they're thinking about the bubble, of course, the AI bubble. But does it flatten out? And even if it flattens out, most organizations have at least two or three years work of worth of backlog to actually just adopt Sebastian: Welcome to another episode of our new season of Beyond Vibecoding partnering with ImpalaSearch. André Neubauer: Die Go-To-Tech und Exekutiven-Search-Agentur in Deutschland. Sebastian: In this podcast, we explore the transformational change in software engineering and knowledge work in general. I am Sebastian Heidemeyer zu Erpen, CTO at Ecosia. André Neubauer: Ich Andre CTPO bei Trusted Jobs. ist Sie wieder In unserem Video mit Franzi aus Miro hat sie eine Sicherheitsbewegung an die Firma Und heute reden mit der Person, die für Information-Sicherheit an Miro Ich muss zugeben, dass so gespannt bin. Sebastian: Yes, so am I. And for good reason, Mark is very experienced. He has seen so many changes in his career and is giving a very calm and pragmatic perspective. And we really enjoyed the episode. We hope you enjoy the discussion as much as we do. So yeah, take a listen. Welcome to the episode, Mark. We're super happy to have you. it's been a long time in the making, and I'm really, really glad that now we can finally speak to you. We learned a little bit already about the security stance and posture at Miro from Franci a couple of episodes back, but now we're talking to the man who's responsible for everything. And yeah, like usual, please introduce yourself briefly to our listeners. Mark Strande: Well, Mark Strand and I've been CISO for Miro at about about three years now. before this, was CISO for Clarna for seven years and another bank which also had a German subsidiary before that. So yeah, I'm pretty much been doing mostly financial services, but always doing startups or scale ups. so the younger generation of technologies and I started in 96 so been doing this for 30 years and started with taking stock market trading online. so I'm sorry to say to Trade Republic that they weren't first but they certainly are coming hard into the market. So Sebastian: Awesome. That's quite a long time. And then basically yeah, you you've witnessed it all. So the first episodes of bringing financial topics on the web, right, for for everyone. And Mark Strande: Well, everything from really getting internet into your home, because I started when you still were having a dial-up modem, most of most of us, and went all the way up to the broadband, but even the home PC revolution was kind of under during the years that I worked. So it's it has gone full spectrum. It was the dot com era, dot com boom, dot-com crash. financial crash. So there's many different phases to this. And and it's interesting how some of these patterns kind of come back and repeat. And how they are now again basically repeating into the next paradigm shift. André Neubauer: Wir müssen das später retten. Wir sind auf diese Art von Patternen Wir hatten ein Video, wo wir auch über die vergangenen und wie wir das können, nicht nur beantworten, was passieren oder was passieren sondern auch, eine Art Sicherheit Aber ich würde wirklich gerne Ihre Pattern wie Sie gerade erwähnt haben. Vielleicht können wir... Ich würde eine Note Sebastian: Yes, let's let's double click on that later for sure. Yeah. One one question briefly. so you mentioned that late nineties I think you you brought trading stock trading online. So it was actually a a an application so probably a website where end c consumers could basically trade stocks, wasn't that? Mark Strande: Yes, so we built the Nordic's first platform for online trading. there was one actor in in Sweden that did it before, but they had basically a mail to form that sent the transaction to a trader. But we had something as strange as a Java applet back in the day running against André Neubauer: cool. Mark Strande: a Java server. Whilst Java was still in beta producing real-time data or stock market feeds and pushing the transactions all the way through back into the into the into the stock market. And this was basically the days where people still had pretty big phones with small screens, but they called their stockbroker and basically asked them to do trades. And I remember it very well when the traders Who were there for our initial first transactions, that they were like drinking champagne and but jokingly saying normal peop regular people trading on the stock market. Yeah, that will be the day. and well, it wasn't more than 10 years later, they were almost basically out of a job. So it's it's interesting how Sebastian: Wow. Amazing. Mark Strande: these things happen. I mean they go very, very quickly, but they also happen in a very smooth transition that you you don't even really feel it until you kind of realize, hey, everything just changed. Sebastian: Yes, yes. That that's pretty much exactly what we also discussed that w what what it takes time for people to adapt, right? But Mark Strande: Yes. Sebastian: the the the wave is coming, it's just like more smoothly than than you probably predict on the short term. Mark Strande: Well, how many years was it that you did your you had to go to your bank office to do most of your financial transactions and to do most of the stuff that you you had to deal with? and now you have like open banking, you have these APIs that are available, do you you have so many more capabilities and you just don't realize that hey it wasn't that long ago that that wasn't available. André Neubauer: Ja. Sebastian: Absolutely. Yeah. And I I vividly remember phone banking because phone banking was the the intermediate step, right? from you didn't have to go to the bank office, but you could do it from home but via the phone. Interesting. Mark Strande: I still keep those brown envelope that we used to take the the the bills that we need to pay and the little green stamp that I had that I had to stamp it and sign the and send it into the bank. I still kept that one because it's it's kind of I came into that era with which really made that paradigm shift of me doing anything online. Sebastian: fascinating. Yeah. So we could probably talk for hours about these different times and the experiences. But we'll probably get to some parts of this. Andre took a note later in the episode, right? But now let's come to our usual segment, the status quo. So how are you working in your day to day? What's your tech stack? What kind of LLMs or agents are you using? Mark Strande: Well, my status quo my tech stack currently is it's pretty predominantly being on Claude most of the time. cursor, Open AI is still like it's coming back into my stack again. It left for a while. Gemini is also to some for some use cases. and then there's many other specialty models that I I didn't used to have that many different specialty tools for different use cases, but now I have much more of a palette of different things. but other than that, and and then I usually use Miro to kind of tie everything together. that's the place that we collaborate on. And that makes it easier for me to kind of also get I lead several teams. So for us, the collaboration space is is a quintessential core piece of this. Sebastian: Yes, makes a lot of sense. And I actually kind of have a similar like or a breadth of of tools. So I I just deinstalled clo cursor earlier today, so because I'm I'm not using it any longer. I'm I'm using anti-gravity as my IDE now. and but I use Claude, I use OpenAI also again after it was gone for a while, but I really like codex and yeah, curious so how do You yeah pretty much decide or or what what do you use the different tools for? Do you have some heuristics or is it just like yeah, what whatever comes to mind? Mark Strande: It's it's heuristics, mostly listening to others who who are experiencing or testing something out and then they share their experiences. it's not an easy thing to kind of disseminate the knowledge and how to do efficient work, and it keeps changing so fast. And I can tell you that over the last year or so, I had to basically go and reset my thinking several times. Because the things that I knew last summer wasn't applicable by basically December. And because I didn't have time to kind of focus on kind of retooling my own and putting effort into my own efficiency, like efficiencies and like the the day to days, I had to then basically take a step back and take several days to kind of reset and like recalibrate. And participating in another company's hackathon was actually one of those things that I did was to actually learn their harness, their ways of working and how to accomplish and that really helped me to reset how I was doing my work and then I could bring that back to my team. and there's so many things that keep on happening. And even the things that I did in January, some of them I have to refactor now in June when I did a hackathon with my own team. Because it it didn't, it wasn't applicable anymore. There was new things that made it much more efficient. André Neubauer: Das interessante Ansicht. War es die gleiche oder andere Firma, die das richtig Mark Strande: It was a different company. So I, of course, I participate in the things that we we do internally within our company. And I try, I want André Neubauer: Sure. Mark Strande: to be part of as many spaces within our engineering as possible. So basically talking both to kind of the infrastructure side of things as well as the application side and André Neubauer: Ja, ja. Mark Strande: so on. So having those multiple and even working with the data people. And because I have that diversity, I kind of have the opportunity. Opportunity of actually seeing multiple different teams of how they're working. But it does constrain you a little bit because there's every company has some kind of boundaries of what tooling you bring in and what ways of working. So going outside of this and working and doing a hackathon with a completely different company is actually quite useful. So, and I think that we also bring that back into I do some executive sponsorships, so where I meet other executives and tell them about how we're working and sharing that. And I think that this sharing is one of those key elements that we as an industry need to have because it's moves so fast and we can't listen to all the marketing BS, to be honest, right? So we have to we have to really see what what really works. And what is that, well, polished turd that someone is kind of trying to sell off to you? Sebastian: That's actually exactly why we're doing this podcast. Number one, also to get these this outside experience or the the like in Germany we we say you don't see the forest because of all the trees, right. And sometimes you just need the external perspective. And number two, also for sharing the the knowledge. Absolutely. Yeah. Mark Strande: Yeah, we have the exact same saying in Sweden. So it's it's it's it's a it's a very accurate accurate and timely like saying that fits right well into the industry right now. André Neubauer: Where can I sign up? Mark Strande: To what? To the hackathons? André Neubauer: Nicht zu den Heckerstunden für den Verkauf, du gerade erwähnt hast. Ich habe so oft über diese Art Modelle und es auch paar Jahre zurück Ich habe es sehr hart man nicht nur Firmen sondern auch NDAs und all diese Sachen der Es wird also sehr kompliziert, und ich mag die Beziehung. Wir machen das auf unseren Freitagsmaschinen. Wir können das mit anderen Unternehmen Das Podcast ist das Beste, wir sich vorstellen Aber das ist tolle Idee. Deswegen habe ich aufsteigen Mark Strande: Well, I I would say you have a great startup mentality and startup culture and startup scene in Berlin, right? You have a lot of different small companies and like a going to them. And I know that legal will hate my ass for saying this, but like having a good friend somewhere and then asking, Hey, can I just join your hackathon and guest? And maybe you need to sign an NDA as a contractor or something like that, but that's the easiest way to do it. Like we have a vibrant startup scene in Stockholm. So it's pretty easy for me to kind of go out into the city and sit down and eat lunch with someone and then kind of agree at that okay, well come next week and we'll do a hackathon. And it usually is a bit disconnected, like you're you're working on a specific task. So that's a good way to kind of knowledge transfer. I can tell you that sitting inside of like these CISO communities, I tried to sit in several of them where we were speaking about the work that we were doing. And I noticed the same thing the same thing was applied to kind of engineering as well. We were coming into kind of meetings and talking about the work, not really doing the work. And it was more of like this internal club for mutual admiration, where everyone was kind of like trying to show off and better better off than like what they are doing. And it didn't bring you forward. You didn't learn anything really. André Neubauer: Ja. Mark Strande: So And of course you have like these hacker conferences like DEF CON is was actually amazing and so on. So there's there's many of these places where you can actually learn from others. Sebastian: Awesome, yeah. l let's just w dive one level deeper into your tech stack before we then move to the main topic of this episode. you yeah mentioned like different kinds of providers that that you're using, right? Also do do you use some skills or agents that that you use for like regular things on a on a daily basis or something? Mark Strande: Yes, most of them I have built myself to kind of defined based on knowledge and experience that I have. and define and trying to kind of identify how I do a certain task is kind of quintessential to that. Of like how do I break down making a business case or how do I break down evaluating a business case or the most of these tasks that you do being able to kind of create a workflow of it and try trying to describe what is important in it. And then there's certain certain skills and and things that I definitely have asked AI to research for me. and to be honest, like with the newest models it becomes significantly much better. but you also have to give it some some good tests so you you know how to that you know that you're getting a quality out there. And then finally there's now starting to become a marketplace for for skills. I'm mostly am fascinated by the legal skills, to be honest. Those are I'm very much waiting for someone to publish more accounting skills. my personal accounting and and those things, I hate that work. So finding good ways to do that and efficiently, that's that's really something that I would love to love to have more of, but I haven't had time to kind of dive into Sebastian: So you basically then probably have your skills in your cloth setup, right? And then Mark Strande: Yeah. Sebastian: you're pretty much running these skills that you need whenever you need them. Mark Strande: And then I separate some of the skills, some of the things that I need to do. I also then separate them into the agents so that they can operate independently and have like their own context window so that you kind of get that Not adversarial approach, but at least like two opposite sides so that you get the segregation of duties between them. Sebastian: Yeah. But I assume as a CISO you never experien experimented with open claw or similar Mark Strande: I have. So yes, I I have, but I I don't I don't find it that useful because it's the the dynamic of the thing is kind of it consumes so much energy and so much well tokens just to kind of come back with something that actually is not that valuable. And then it has a lot of like it. lacks a lot of constraints that I like to have. so to be honest, I I I have still I'm still looking for the companies that are operating on top of OpenClaw and say that they are successful. Not just by doing one thing, but actually consistently being successful and doing the same thing. Not going from one air one industry into another one. Sebastian: Yeah, I can relate to that. So I I personally still use it, but very occasionally. So I I have these honed skills and workflows that I need to run occasionally where like the token consumption is not that relevant for me because I use it so rarely that it's below my limit. I my subscription is enough. and it's it's very Yeah, comfortable for me because it runs on its own machine. I can trigger it via the app and and it just does what it what it should, right? this is very for very specific cases. And I also think yeah, Hermes Agent and there are other frameworks that that are probably better suited for your companies and ba maybe even not even Hermes agent, but I I think there there's other frameworks that are needed in order to properly run a company where you rather, I don't know, wanna have a meta harness and then different kinds of agents that are triggered by certain events and whatnot. Mark Strande: We even had a we had an employee who who actually, or one of my team members who did build his own kind of framework for this. I think he published that externally as well. It was called Plastic, but it was much more of a security focused type of open claw approach. André Neubauer: Hm. Mark Strande: but the challenge that I face with it is that It it can go after opportunity, but it it's not very, it doesn't seem very proficient at like performing a consistent task. And a lot of things that we have in our work is repeated consistent tasks. I definitely want to give out work to do research, but now the models are pretty good to actually go do the research without having a large harness of multiple agents to actually achieve it. So I'm I'm pretty happy with the what you get out of both OpenAI and and definitely anthropic. Sebastian: For sure. Yeah. The harness Mark Strande: that Sebastian: doesn't matter as much as the the skill files, basically. The the markdown files that describe exactly what it should do, what it shouldn't do, what it should look at, how that there are tools that it uses in order to validate that the links for the show notes are actually working. So things like that, right? That that is more important. It's not the not the harness itself. Yeah. It's just a a legacy if you wish. Yeah. Anyhow, we d dove pretty deep into the tech this time. Maybe we maybe we can even cut out certain parts of it because it I'm not sure if everything of that is relevant for for our listeners. But anyway, now we should really segue into the main section of this episode. and yes, as I mentioned already in the in the beginning that our episode with Franzi really sparked our interest because she was speaking so enthusiastically about your security poster, Emerald, that we thought, well, we rarely heard someone say that speak so happily about the constraints that are coming from the CISO André Neubauer: Haha. Sebastian: that we thought, okay, so we need to speak to the man and that's the chance we have now. So yeah, please let us know, yeah, what were your thoughts going into the process? You already mentioned that you like introduce certain things in January. and maybe you can also tell us what you wanted to or need to refactor already now because half a year, right? So we things move fast, so we need to change. Mark Strande: Well, one of the things that we started off with as we were moving into to kind of how to create how to create checks and balances, especially when clawed code was developing and new enterprise features were coming out, th there there wasn't much guardrails that you could implement, right? It most of the things that you get out of the box wasn't that powerful in the very beginning. And figuring out how to kind of combine being on the bleeding edge whilst at the same time getting some levels of controls. And I think that the best way to look at it is is to kind of the combination of both working with base layer controls that give you foundation. Kind call it a backstop. Most most confuse guardrails with a bunch of different things. I consider guardrails is to be that backstop. They are not immovable rules. guardrails can't change. Otherwise, they wouldn't be guardrails, right? and then you want to add other software requirements on top of it, just like you did with do with humans. You You train humans, create awareness, you have all of these soft things like policies that you then expect people to kind of live by. But agents and AI don't know this. They don't have that context. They don't have that information unless you actually package it up for them and distill it usually because well, the context window of the human mind is still completely mind-blowing, whilst AI is still rather limited. It's very, it's very consistent and systemic, and it can do things tirelessly. But human mind can contain so much more information. So we call that AI principle or agentic principles that we add on top. They are not necessarily hard rules, but things that should be considered when you're doing your work. So this was kind of like the first things that we started implementing. And we came pretty quickly to kind of 11 rules for our engineering teams that we wanted to kind of have. And like the last one we had to kind of add to it was okay, we don't want AI to actually work on private repositories. But there are cases where we want them to work on private repositories. Repositories because our engineers are contributing into other other open source projects, or we have open source projects and so on. So we want to be able to contribute as well. So we can't make that a hard stop. We have to make it a more of a soft, like, did you consider this before you take that action? and that was Kind of like the first step. André Neubauer: Wie Sebastian: Andrea. André Neubauer: schützt ihr diese 11 Regeln? Manche sind etwas strenger, manche etwas lecker, die man sich beachten sollte. Aber es ein Art Package, wo packt und sie in den Schlafen des Miro Oder wie funktioniert Ich kann dass Engineering-Organisation sehr groß Mark Strande: Yes. André Neubauer: Die Konsistenz bei den Standards ist nicht so einfach. Mark Strande: No, and we're also n want to kind of allow for a lot of experimentation and differences within the engineering org, whilst you still want to move to some level of harmonization, just like you have most engineering organizations. You want to have an a software development lifecycle that is fairly homogenous. That the common denominators are kind of shared across the organization, but then they might change for certain projects and certain areas, right? so the way that we we use is basically using the enterprise capabilities of like sharing out MD files and pushing them, and even pushing them with our device management systems to André Neubauer: okay. Mark Strande: the endpoints. we have our own sandbox that we have built in house that has some capabilities. we also have now an agent capability that we talk about on our blog where we can run a lot of these standardized requirements into them. and then There is the more hard rules of like, okay, how do you control all your MCPs and all your integrations? Because that's usually where you really are trying to kind of really want to control things. And then you have the also the the really hard rules of like your pipelines, which can be basically instill requirements. Into your development lifecycle as well, and where you can have tests that break the pipeline or so on. So you you have to combine all of these together. And it's not just one solution for everything, it's like layering this all on top of each other. And André Neubauer: Ja. Mark Strande: then on top of this, you add like a real-time detection capability that understands AI. Where we have been working with one company that that basically gives us that capability and have a very quick, they are very quick to kind of adopt to the new technologies that arise to on the market, which is quintessential because you can't sit and wait because sometimes we want to be reuse we want to be using some newer technology that is really bleeding edge, and it's might be in a research preview. André Neubauer: Hm. Mark Strande: but you want to still use it in in contained environments. So you want to have control over that. And not just block it until it's mature. Sebastian: So it's again the Swiss cheese pretty much layering approach, right? Where you like not all the holes would be directly like in line and that's why André Neubauer: Witzig, oder? Ja. Sebastian: exactly, yeah. Mark Strande: It's it's it's an onioning of security layers that you have to Sebastian: Yeah, yeah. Mark Strande: put together and it's all the holistic. But if as soon as your the warning sign goes off for me when when you just have one layer that you're dependent on, it's only access controls or it's only this or it's only that this classification data classification or it's only it's it's not only, it's it's how you add all of these capabilities together. And I think this will become even more important as we we kind of move forward because I'll give you another example, which is the one that I find most interesting and most challenging right now. And that is you identities and entitlements, for example, for agents. You we all work in organization that has had access management and and Almost every organization suffers from overprivileged roles, right? because you don't want to have too many roles to administer, hence, you you overprivilege users and then you trust the user to impose some kind of segregation of duties or not combining different things or being the soft layer in between the different process steps, right? André Neubauer: Hm. Mark Strande: When you take AI into it. Then you can't do that. This paradigm basically falls apart. You don't want to over-entitle an AI. So then you have to kind of a thousand X or a hundred X the amount of entitlements or roles that you needed to have for humans. So you need to have a new approach of like automatically assigning them for the specific use cases because. we need to separate different privileges from different avoiding different toxic combinations, right? a good example is like the agent that receives your your invoices shouldn't be the same one that basically does the accounting, puts up the the transaction into the financial system, and then goes off and and basically sends it into the bank and then goes and approves it into the bank. You you You probably want to have a human here somewhere in all of this, but you don't even want to have an agent running on multiple of these. You want to have them segregated so that there is segregation in between. and then you because you want to both protect yourself against the malicious, like the the prompt injections. like the the simplicity of that AI just confuses data with its instructions. It's the powerful, it's the power of the AI. It's the same thing as the it's the Achilles heel. It's the same as like an SQL injection. It can't distinguish one from the other. so prompt injections haven't fixed, but even if you don't Even if you don't look at the malicious ones, you you have all of the non-malicious ones, the the all the baked-in assumptions that you have in your head, which you give to the AI to to or the agent to execute on, whilst you didn't explain all of the pieces that were still stuck in your brain, and now it does something different. And how many of us have sat there and it's like, no, but that's not what I wanted? And have to go back and and kind of redirect or restart. And my principle is usually I want to restart it because then I can actually make it much better because I can then figure André Neubauer: Mhm. Mark Strande: out what was missing in my my mental model. and of course hallucinations, but but we all know that, but they are becoming better. So mo mostly actually the the like into intuitive things or the assumptions that I have that I haven't baked into my agents that is missing. So that's why I want to kind of really have those segregations. And that I think is going to be really difficult to kind of fix because the tool sets aren't there yet for this. Sebastian: Mm-hmm. Mm-hmm. you also mentioned a technology that you use in order to detect malicious activity, right? So Mark Strande: Mm-hmm. Sebastian: can you describe a little bit how that works? How how you use this? Mark Strande: So it basically taps into the APIs on on the model providers. So it it can detect malicious patterns. It has anomaly detections. They run they run investigative agents and then combine that with human investigators and so on as well. So that allows it to be much more fast. And then the André Neubauer: Hm. Mark Strande: the very large data enrichment that they do, like they enrich with a lot of data sets, and they have been able to add more data sets quickly for us, which is quintessential. And then the enriched data actually can show those patterns that previously we were stuck with just using simple pattern recognitions in in singular dimensional logs that came from one source. Now we can just basically combine them all together and and see, these combinations are that's not a good thing. Sebastian: Interesting. that that's yeah, something that I think is a very good base layer, right? If you have this in place then a lot of stuff that can go wrong in other areas can be caught pretty much at this base layer, or at least it can be made visible, right? Mark Strande: Yeah, and and that visibility is quite valuable. Like I'll take the mini Chi Halud. we had teams that were using the affected repositories, but within hours we could actually get a clear picture that none of them had actually pulled the affected code. at that point in time, which meant we were we could verify that we were safe. And that wasn't that wouldn't been the case with for example log4 shell or something like that just a few years back, right? and I think that capability of doing that correlation and and being that quick is is extremely valuable. And also being able to kind of send in as much data as you absolutely can without there being an insane amount of cost to it. Because a lot of these sims they they bill you by the by the data set you pull in and and that becomes very expensive very quickly, but it also loses its efficiency if you try to kind of be saving on something. Sebastian: Sure, yeah. so most of the topics that you mentioned so far have been like focused rather on like no, no, it it's a mix. Not not only engineers, right? So MCPs and integrations are also relevant for for other knowledge workers. Pipelines is more more an engineering thing. mm, Franzi also told us that she was very very confident in or she she knew exactly for what she could use which AI and also like how to handle PII. Can you maybe double click on on this topic a little bit? Mark Strande: Well, well, it's a combination. You have to do awareness training. We we build our we have very custom made awareness training modules. this is a pattern that we s I started off already in my previous previous company where we build these highly tailored trainings because it's not very useful to to do to listen to a small talk about GDPR and personal data in the generics. Like André Neubauer: Hm. Mark Strande: most of the people that at least we employ, they are people who are smart, they have been around and they have heard most of the things. Why should I train them on things that they already know? So tailoring it into what's specific for us is much more valuable. Also, our ambition is to only train on things that they don't know. So where we have basically challenges. So that's one part of the the equation. But then also building in that capability into the system prompts or the the prompts that you you give the AI to have inside of those principles that you have to make sure that they are not they're not violating privacy. They're not using a tool for An unintended purpose. Sebastian: okay, so that's that's what you meant before when you said okay, you are I think you said you are distributing these via MDM, right? So Mark Strande: Yes. Sebastian: that everyone has this on on their device and then you have like already a pretty decent base layer of security due to the system prompt that is with every person who is using any of these LMs, right? Mark Strande: Well, they're not bulletproof. But but Sebastian: Yes, yes, for sure. Mark Strande: with a layered approach, they Sebastian: Yeah. Mark Strande: don't need to be because it's kind of like too many layers. It's there's an inertia to kind of get through to to to breach it. And then but if we're talking about malicious actors, because this is kind of the problem of the security industry in general, that everyone builds for the edge cases. So if you always build for the edge cases, then you don't have enough time to actually build for the 80% cases. And that's usually where it fails. and then foundational security aspects of like, okay, make sure that everything is patched and the latest versions is running on people's computers. everyone is using MFA. And preferably phishing proof MFA, or not phishing proof, but at least phishing resilient MFAs. those are things that like bring raise the bar quite significantly. And as long as you're not the slowest moving animal in the herd, then the attackers also can probably take someone else before you. And I don't think that's Sebastian: Yeah. Mark Strande: luck. That's that's more of like, okay, try to kind of stay two steps ahead. Sebastian: Yeah. That that's a great statement that I will definitely take away. that don't try to f always focus on the edge cases but try to get the eighty percent right. 'Cause yeah, those are the more important Mark Strande: Well, the engineers in us always want to make perfect solution and then we want to make elegant solutions and those two contradict and then we end up in this state stall that but I want to make a beautiful graceful solution and then I need to address the edge cases and then it gets slower to kind of deliver, whilst delivering something fast is actually very much more valuable most of the time these days. Even if it isn't perfect because you learned from it, then you did something. Sebastian: Absolutely. Also in the security area, it's better to have something quickly that gives certain levels of protection as opposed to having something close to perfect in the long term, right? So definitely, yeah. All right. Thanks a lot. I think we Andre, do you have a final question maybe in this second? André Neubauer: Ich zwei Dinge. Erstens meine Not, mein Erinnerung auf die Pattern, als die vergangenen größeren Veränderungen. Und zweitens, ich frage mich, ich bekomme hier die Begriffe von ich wollte nur das ausführen. einem Welt, wo die Agente, ich glaube, du hast das Mark, unbeleuchtet sie können einfach funktionieren. Ich frage ob 80 % gut genug Ich habe absolut besser etwas schnell als zu % Ich frage ob die Spielzeit in einer Art Man muss wirklich investieren, 100 % Denn der anderen Seite gibt es jemanden, der immer versucht, versucht, versucht. Und ich denke, das hat Das hat sich den Möglichkeiten die jetzt haben. Mark Strande: Yes, I I I understand what you're saying and and I'm definitely not saying that you shouldn't have the ambitions. Like I'm I'm a hundred ten percent ambition person. I put the bar at hundred and ten percent. Sorry? André Neubauer: ...bei Ruhl, by Rohrl, the way. By Rohrl, it's your Rohrl, like it needs to be like that, I get this. Mark Strande: Yeah. Yes. And and I'm I'm I'm always aiming very, very high. But I'm also going to be happy when I hit 80%. Because if you don't aim too high, then you're not gonna like you're not gonna come if you just aim for 80%, you're not gonna get to 60, André Neubauer: Schö. Mark Strande: right? But I think most people, and now I'm very much generalizing, basically suffer from the The fear of not making it good enough so that they take time to actually roll it out. And if you're considering that this is you're working, security people are there to kind of catch, they are thinking in all of the extreme edge cases. They are thinking about all of the risks. We are used to picking things apart and seeing the problem with them. Hence, it's very difficult for us to kind of deliver something, not calling it half-ass, but at least calling it something which is the first step. And then building on top of it because we're afraid that, it's not going to be good enough, or I'm not going to be and engineers usually tell me, but we will never be able to revisit this and improve upon it. And I think that's the first fallacy that we need to kind of quench that. No, you need to deliver that first thing, and then you need to build on top of it. Because if you are always aiming to kind of deliver the full package, you will never come back and revisit it because you always do this. You always do this pattern. But if you always add one more package to it, one more thing, one more step, then eventually it creates that virtuous circle. Where it feeds back on itself and it improves continuously. It's it's kind of like the Agile Manifesto, in a sense, André Neubauer: Ja! Mark Strande: just translated into the security space, if we might. Sebastian: Or to put it differently, perfect is the enemy of good, right? Mark Strande: Definitely. But you should always be aiming for perfection. Like Sebastian: Yes. Yes. Mark Strande: the ones that I admire the most is always kind of Japanese carpenters and and and these people that find an in André Neubauer: Ja. Mark Strande: an insane amount of pleasure of doing their profession really well. And I see my job as that as well. Even if I'm doing something of a document or something, I enjoy making it well. But I can't make it to the price that I don't deliver it on time. And when I'm talking about security, time is your enemy because the longer you are waiting, the larger is the risk or that something will occur. so you you have to continue to deliver, and hence this don't try to be perfect. From the first rollout. Sebastian: Now let's let's try to spend like a couple of minutes on the patterns, right Andre? André Neubauer: Ja, du siehst sehr entspannt Marc, während andere Leute nicht schreien. Sebastian: Hair on fire. André Neubauer: Sie sind auf Feuer. Du kannst das positiv Sie sind auf Feuer mit der neuen Fähigkeit. Hier Sebastian: I meant hair on fire, but there on fire is much better, yeah. Mark Strande: Yeah. André Neubauer: kann es Ich denke, alle sind gespannt. Lass das so Du hast viele verschiedene Technologien Was ist deine Sicht hier? Sind wir in etwas sehr, sehr Spezielles? Oder sehen Sie Schauspieler, die Sie vielleicht auch mit uns können, die Sie sehen, ein bisschen Sicherheit und Klarheit Mark Strande: Yeah. Like I I think that one of the most interesting patterns that we don't talk much ma b about is the democratization of development, right? Like remember back in the day when LAMP came out? Like everyone suddenly could, with very limited skill sets, you didn't need to have an engineering degree in order for you to kind of code. So they started building code which was well less than perfect. André Neubauer: Übrigens müssen wir Lampen denke nicht, dass man man alt ohne dass man alt Ich bin sicher, ob jeder sich vor Lampen Also wollen Sie das kurz Mark Strande: So basically the Linux stack with then having MySQL PHP on top of it, which was the basically what built Facebook. and many of these companies in the early IT or early dot-com stages were built on these stacks. Sebastian: And the Apache web server, that's where the A is coming. Yeah. Yeah. Mark Strande: Apache web server, yeah, that was the AE there. André Neubauer: Linux, Apache, MySQL, PHP. Sebastian: Yeah. Mark Strande: Yes. And those things put together, that that was a really a bad combination, especially in the hands of someone who wasn't proficient. Now you're building code with AI. And you haven't even seen the code. You don't even know that it's there. And you I built a product. I made a website. it's amazing. And you're so enthusiastic and you're happy. It's the same thing. We're repeating the same patterns. It took us, what was it? It took us almost 20 years to kind of perfect the CICD pipeline post-lamped. Post-lamp platform. how do you build and create that continuous delivery? Right. That took a lot of lot of time. Now most of that. Paradigm is being upset again and shaken about because now suddenly you have AI coding. Of course, we're building on top of the stack that we already have, but you're now introducing other elements. Back in the day, it was, we should do security training for engineers. How many of those mandatory security trainings have you gone through in your career? how many did Your AI pass through? I Sebastian: Yeah. Mark Strande: I'm not sure. Like it's and and there comes the kind of the challenge. You need to now add new toolkits to this. And you just have to have faith in that, okay. We need to kind of keep up, we need to have a pace here, we need to move fast. But there is a problem that it basically had a pattern and well, knock on wood, the world didn't go under. but definitely there's there's good reason for people to be nervous, but having your hair on fire doesn't mean you don't act. part of my job used to be helping companies who had data breaches. I was part of a company which was a managed security service provider. We started in 2001 in in the backlash of the IT dot com era. And selling security, managed security services wasn't really a thing. And here came the lamp stack, and then came a lot of companies who built technologies and they They didn't even have properly configured firewalls or detection capabilities and many of these other things that we today call are taking for granted. so of course they had breaches and and issues. and going around to companies and helping them through that crisis makes you kind of a have a very calm sense about this and thinking around, okay. doesn't mean I don't take it more less seriously. I just know that there's no reason for me to panic and shout wolf because that never helped. And poor CISOs who've gone off and shouted wolf to the to the to the board of directors or the management team, they all know where that ended up. They didn't they might have gotten money once, but then second time And in today, if they go off and go off to the board and say AI is very dangerous, there's a lot of vulnerabilities with it, then, or there's much of security issues with it, then what will you win? Because at the same time, the board is seeing, I need to make my company competitive. I need to innovate. And here comes a security person telling me it's all dangerous. What does that help me? Nothing. So you need to come with solutions to that problem. You need to cap a calm head and then like break down the problem and come with solutions. And then they will listen. at least the the sane ones. So André Neubauer: Danke für diese Perspektive. Sebastian: Alright. With that I would say it's about time to go to the final segments of our podcast episode, right? So number one, the reality check. So do you experience what the fuck moments or also wow moments recently with AI? Mark Strande: Yes, the stuff that I I I didn't anticipate. I can basically every time that it improves, it it gives me what the fuck moment all the time of like it it keeps on giving. And it keeps on improving. And then everyone is talking about well when when is it going to maybe it just flattens out now? And everyone is just waiting for the flattening out. And then they're thinking about the bubble, of course, the AI bubble. But does it flatten out? And even if it flattens out, most organizations have at least two or three years work of worth of backlog to actually just adopt to become like more AI driven or more capable. so but I I love the the being surprised. Connecting up old hardware that I have at home. I I used to do a lot of hardware hacking back in the day. And I have these season interfaces and stuff like that with serial ports that I can connect in smart cards and stuff. And the stuff that I can do with AI now connected to that is fascinating because it's it does a bunch of stuff that I never imagined. Imagine if I had those that gear, like twenty years earlier, I I definitely would have had much fun. Sebastian: Yes, absolutely. yeah, and last but not least, do you maybe have a prediction for our listeners? Mark Strande: I think that the companies that are learning how to collect institutional knowledge, they are the probably the biggest winners. There's a couple of things with institutional knowledge of like learning how an organization does something and then building it into a system and being able to repeat it. There's an aspect to that that is very difficult to also transfer. Like you can't really offboard it, right? You have created a bunch of models, you might have even trained something. You have tuned, you have created data sets, or but it's it's fairly untransferable. You can recreate it. Today, quite easily. But imagine that when you can accumulate a lot of this knowledge and a lot of these data sets, that will give you an enormous lock-in, an enormous power. And that's what you're seeing all of these companies also trying to do. that they are really trying to kind of get the user to live in their ecosystem because they are learning from that. so I don't think it's a very revolutionary prediction, but I think it's it's a it's a very important one. and then well, not really a prediction, but more of a like a recent a recent hindsight. Like look at all of the vulnerabilities that have been found very recently, even if half of them are false or not actually real. Like there's a lot of interest in weaponizing stuff. we need to be very quick about building new things. So the reactive security systems is going to be the biggest future, really. and we have to rethink how that works. André Neubauer: Das war mein Vorfeld, als ich gesagt habe, dass vielleicht 80 % nicht gut genug Ich denke, wir alle können sich gutes Anfangspunkt aber wir müssen mehr in das neue Welt-Auswahl Mark Strande: Yeah, and and I don't think that we can as humans keep up the pace. We have to basically sit there and we have to interact on top of the agents and the AI to then in like work with the underlying systems and the underlying teams. We we're not gonna be enough of these security professionals. André Neubauer: Absolut. Es kann nicht uns es wird auch die Agenten beiden Seiten Sebastian: thanks a lot. Was really André Neubauer: Thank you very much. Sebastian: great to talk to you and yeah, maybe we need to update also in I don't know half a year or so and and then see if we need to like refactor some of the some of the findings that we discussed today. So maybe would be great to talk to you in the future again. But for today, thanks a lot for coming on the show. Mark Strande: And thank you for having me. Sebastian: Bye bye. André Neubauer: Bye bye.