Latest / Chief in Tech Deep Dive Shortcast / Chief in Tech S1E57 - Alexandra Sfrijan, Laurent Bernier and Teodor Suteu : Secure by Design and Secure by Default – The Path to Digital Trust

Transcript

Chief in Tech S1E57 - Alexandra Sfrijan, Laurent Bernier and Teodor Suteu : Secure by Design and Secure by Default – The Path to Digital Trust · Chief in Tech Deep Dive Shortcast

• 0:00
  Imagine you're writing a massive, really intricate
• 0:03
  piece of software. Like a predictive AI for supply
• 0:05
  chains, maybe. Yeah, exactly. Or the back -end
• 0:09
  logic for a regional power grid, something critical.
• 0:11
  So you spend 18 months optimizing this code,
• 0:15
  shaving off milliseconds of latency, making the
• 0:18
  UI perfectly intuitive, and you deploy it. And
• 0:22
  it works flawlessly, I assume? Flawlessly. Until
• 0:25
  a week later, a single Compromised API endpoint
• 0:30
  brings the whole system down and exposes just
• 0:32
  terabytes of data. Which is unfortunately a terrifyingly
• 0:36
  common scenario these days. It really is. And
• 0:38
  why does it happen? Mostly because the development
• 0:41
  team treated security as this completely separate
• 0:43
  phase, like something to just layer on right
• 0:45
  before launch. Handed off to a completely different
• 0:47
  team. Exactly. And that is exactly why the fundamental
• 0:51
  architecture of how we build digital products
• 0:53
  is basically being ripped apart and rebuilt right
• 0:55
  now. Welcome to today's Deep Dive, by the way.
• 0:58
  Glad to be here. This is honestly the ultimate
• 1:01
  blind spot in modern tech. It really is. So for
• 1:04
  you listening today, we're pulling from some
• 1:06
  really fascinating session notes by Alexandros
• 1:09
  Frijan. She's a prominent cybersecurity leader.
• 1:12
  And the session is titled Secure by Design and
• 1:15
  Secure by Default, The Path to Digital Trust.
• 1:18
  which is a great title. And our mission today
• 1:20
  is really to explore this huge shift, how the
• 1:23
  industry is moving from security as an afterthought
• 1:26
  to, you know, embedding it as a foundational
• 1:29
  design principle. Before a single line of code
• 1:31
  is even written. Right, because for decades the
• 1:34
  industry operated on this model. It just prioritizes
• 1:37
  speed and feature delivery above literally everything
• 1:40
  else. Yeah, you build the functional logic and
• 1:42
  then you try to... I don't know, wrap a security
• 1:45
  blanket around it at the end. But the sheer complexity
• 1:48
  of our infrastructure now, especially with all
• 1:49
  these complex AI systems, it means a reactive
• 1:52
  model isn't just risky anymore. It's mathematically
• 1:55
  guaranteed to fail. I mean, the surface area
• 1:58
  for attacks is just way too vast to protect with
• 2:00
  some... bolted -on firewall. Right, let's unpack
• 2:04
  this concept a bit because to understand the
• 2:06
  solution, we have to really define the problem
• 2:08
  with the old way. The notes actually use a great
• 2:10
  phrase for this. Sirijan calls it a compliance
• 2:13
  facade. A compliance facade, wow. Yeah, I think
• 2:16
  that perfectly captures the dysfunction. Historically,
• 2:19
  a company builds a product, brings in a security
• 2:22
  testing team at the 11th hour. Right, just to
• 2:25
  find a few dozen vulnerabilities. Exactly, they
• 2:27
  patch the most critical ones, generate a report,
• 2:30
  and just, you know. satisfying auditor. It's
• 2:32
  totally performative just checking a box. It
• 2:35
  is and beneath that thin layer of patches the
• 2:38
  core architecture is still inherently fragile.
• 2:41
  I like to think of it like building a car. You
• 2:43
  wouldn't build the entire vehicle and then try
• 2:47
  to bolt seat belts and airbags onto the exterior.
• 2:50
  Right, as an afterthought. That would be ridiculous.
• 2:52
  They have to be designed into the chassis from
• 2:54
  day one. And software has to be built the exact
• 2:56
  same way. When you just bolt security onto a
• 2:59
  finished product, you're ignoring how the data
• 3:01
  actually flows through the system. Yeah, like
• 3:03
  designing a massive microservices architecture,
• 3:06
  ignoring how the services authenticate, and then
• 3:09
  just slapping a web application firewall on the
• 3:11
  perimeter. And calling it a day. Exactly. The
• 3:14
  minute one internal service is compromised, the
• 3:16
  attacker has free reign. The vulnerability was
• 3:19
  literally designed into the system. Which brings
• 3:22
  us to the new standard fighting this. It's really
• 3:24
  twofold, right? Secure by design and secure by
• 3:27
  default. Yes. So secure by design dictates that
• 3:31
  the threat model is built alongside the very
• 3:34
  first architectural wireframes. So if you're
• 3:37
  building a database, things like encryption standards
• 3:39
  or zero trust protocols, those are all decided
• 3:43
  and implemented at the foundational level. The
• 3:45
  security dictates the architecture, not the other
• 3:47
  way around. And then secure by default is the
• 3:50
  user -facing side of that coin. Right, which
• 3:52
  we've all experienced the opposite of. Oh, absolutely.
• 3:55
  You buy a router, and the instructions literally
• 3:58
  tell you to log in with admin and admin. And
• 4:00
  then kindly suggest you maybe change it later.
• 4:03
  Exactly. Secure by default means when you take
• 4:05
  it out of the digital box, it operates at its
• 4:07
  absolute most restrictive secure setting automatically.
• 4:11
  The user shouldn't have to navigate some labyrinth
• 4:13
  of settings to turn off telemetry. The burden
• 4:16
  of security is shifted from the user back to
• 4:18
  the manufacturer. That shift in burden is huge.
• 4:22
  For a long time, tech companies just relied on
• 4:24
  those massive end -user license agreements to
• 4:27
  dodge liability. The classic provided -as -is
• 4:29
  clause. Right. And if a breach happened, well,
• 4:33
  the user should have configured it better. But
• 4:35
  Spurgeon's session notes highlight that this
• 4:37
  model is being actively dismantled. It is. And
• 4:40
  it's not because developers suddenly had, like,
• 4:44
  collective moral awakening. No, of course not.
• 4:47
  It's happening because of two massive drivers.
• 4:51
  Heavy new regulations and the need for digital
• 4:54
  trust. Let's dig into those regulations because
• 4:56
  the notes call out NIS 2 and the Cyber Resilience
• 5:00
  Act or the CRA. And for anyone who hasn't been
• 5:02
  deep in European regulatory frameworks, these
• 5:05
  are not polite suggestions. No, these are tectonic
• 5:07
  shifts in how software can legally be sold. The
• 5:10
  NIS 2 directive vastly expands what's considered
• 5:13
  critical infrastructure. So it's not just energy
• 5:15
  and banking anymore. Exactly. It encompasses
• 5:18
  supply chains, digital providers, manufacturing,
• 5:20
  and it demands proactive, verifiable risk management.
• 5:24
  But the Cyber Resilience Act, the CRA, that's
• 5:28
  arguably the heavier hammer here, right? Oh,
• 5:30
  absolutely. The CRA introduces mandatory cybersecurity
• 5:33
  requirements for products before they can even
• 5:35
  be placed on the market. It's essentially demanding
• 5:37
  a CE mark for software. Like you wouldn't buy
• 5:40
  a toaster that might burn your house down. Right,
• 5:43
  you expect a safety certification. The CRA demands
• 5:46
  that digital products prove they're secure by
• 5:48
  design. They have to provide a software bill
• 5:51
  of materials. So everyone knows exactly what
• 5:55
  open source libraries are baked into the code.
• 5:57
  And the penalties for non -compliance are severe,
• 6:00
  right? A massive science. Mark it recalls. With
• 6:02
  NIS 2, C -suite executives can actually be held
• 6:06
  personally liable for gross negligence. Wow.
• 6:09
  So the regulators are demanding to see the architectural
• 6:11
  blueprints, not just the final paint job. Exactly.
• 6:14
  The era of the compliance facade is officially
• 6:17
  dying. Okay, here's where it gets really interesting
• 6:19
  though. I have to push back a little on this.
• 6:21
  Okay, let's hear it. Let's look at this from
• 6:23
  the perspective of a startup founder. or, you
• 6:26
  know, a lead engineer building the next AI tool.
• 6:29
  Their entire survival depends on velocity. AdJoy
• 6:32
  methodology is two -week sprints. Right. Rapid
• 6:35
  prototyping, shipping MVPs to gauge market fit.
• 6:38
  If an engineering team has to stop and analyze
• 6:41
  every single line of code against the CRA. And
• 6:44
  build a perfectly documented threat model. Yes.
• 6:47
  Doesn't that just entirely kill the pace of innovation?
• 6:51
  I mean, it sounds like an astronomical amount
• 6:53
  of friction for a team racing against the clock.
• 6:55
  It's a completely valid concern. It's the exact
• 6:58
  friction point that causes developers to roll
• 7:02
  their eyes at the word DevSecOps. Oh, totally.
• 7:04
  But the source material addresses this head on.
• 7:06
  Building without foundational security actually
• 7:09
  destroys velocity in the long run. How so? Well,
• 7:12
  look at complex AI systems. Retrofitting security
• 7:15
  late in the cycle is exponentially more expensive
• 7:17
  and time consuming than just building it right.
• 7:20
  Ah, I see. Because if you build an AI trained
• 7:22
  on unsecured data and a regulator audits you
• 7:25
  right before launch, You can't just slap a patch
• 7:27
  on it. You might have to scrap the entire model
• 7:29
  and retrain it from scratch. Which is devastating,
• 7:32
  tearing the house down to the studs. Exactly.
• 7:34
  But more importantly, Srijan connects this to
• 7:38
  digital trust. Trust is the fundamental currency
• 7:41
  of the tech economy now. Right. If you rush an
• 7:44
  AI integration and it leaks client data because
• 7:47
  the API wasn't secure by design. You don't just
• 7:50
  lose a client. You lose your license to operate.
• 7:53
  Trust evaporates completely. So Secure by Design
• 7:56
  might add overhead in Sprint Zero, but it's what
• 7:59
  guarantees the product survives contact with
• 8:02
  the real world. Yes, it's what actually enables
• 8:05
  sustainable innovation. That makes perfect sense
• 8:07
  theoretically. Digital trust as the runway for
• 8:09
  innovation. But theory doesn't write code. No,
• 8:12
  it certainly doesn't. When a developer is in
• 8:14
  their IDE hitting a deadline, they don't want
• 8:16
  to read a 200 page legal document on the CRA.
• 8:19
  They want to write Python or Rust. Exactly. And
• 8:22
  this is where the notes pivot to something incredibly
• 8:24
  practical. Srijan is the COO and co -founder
• 8:28
  of Cybalgores, and she built a solution called
• 8:31
  Cybernoe. Right, Cybernoe is the first secure
• 8:34
  -by -design assistant. It's built specifically
• 8:36
  for developers and AI solution architects. And
• 8:40
  the word assistant is doing a lot of heavy lifting
• 8:42
  there. It integrates directly into the workflow.
• 8:45
  It translates all those abstract regulatory demands
• 8:47
  into concrete actionable engineering tasks. The
• 8:51
  notes use three very specific words for this.
• 8:54
  Structured, traceable, and practical. Practical,
• 8:58
  meaning it integrates natively. Structured means
• 9:00
  it maps to known frameworks. But traceable is
• 9:04
  really the operative word. Let's focus on traceability.
• 9:07
  Because if a system is traceable, security isn't
• 9:09
  just an invisible attribute. Right, it's a logged,
• 9:12
  verifiable chain of events. So if an auditor
• 9:14
  asks how you ensure data integrity for an AI
• 9:17
  module... Under the old model, you'd point to
• 9:20
  a penetration test from the very end. But with
• 9:22
  CyberNOI, you have a map. You show the exact
• 9:24
  sprint, the specific security parameters, the
• 9:27
  code commits. And the automated test that validated
• 9:29
  them. It essentially auto -generates the audit
• 9:32
  trail as a byproduct of development. That is
• 9:35
  massive. You don't have to reverse engineer your
• 9:37
  compliance. It's mathematically proven in the
• 9:40
  commit history. It changes the whole relationship
• 9:42
  between developers and security. The security
• 9:45
  team stops being the department of no. And the
• 9:48
  secure way actually becomes the path of least
• 9:51
  resistance. Which is crucial for AI. AI is incredibly
• 9:55
  complex and evolves constantly. If you don't
• 9:57
  have a structured security architecture from
• 10:00
  the first neural network layer, you can't guarantee
• 10:04
  it won't be susceptible to data poisoning later.
• 10:06
  You have to build a cage before you put the lion
• 10:08
  in it. Cybernoe provides the blueprints and materials
• 10:11
  for that cage. I love that analogy. But there
• 10:14
  is an inherent limitation to software tools,
• 10:17
  right? What do you mean? Well... You can deploy
• 10:19
  the best assistant in the world, but if the organizational
• 10:22
  culture only rewards engineers for shipping features
• 10:25
  fast... They'll find a way to bypass the tool.
• 10:27
  Exactly. They'll ignore the warnings. So this
• 10:30
  isn't just a technical problem, it's a human
• 10:32
  problem. It's entirely a cultural problem. And
• 10:35
  if you look at Srijan's profile in the notes,
• 10:38
  she understands that perfectly. Her leadership
• 10:40
  roles outside her company are pretty extensive.
• 10:43
  She's a WomenForce Cyber Ambassador, an executive
• 10:46
  member of the WomenTech Network, and VP of Strategy
• 10:48
  at the Secure by Design Romania Association.
• 10:51
  So she's attacking this from multiple vectors,
• 10:54
  building communities that inherently value secure
• 10:57
  engineering. Take the WomenForce cyber involvement.
• 11:00
  The cybersecurity field has historically lacked
• 11:03
  diversity. Right. But threat modeling The foundation
• 11:06
  of Secure by Design requires diverse perspectives.
• 11:10
  Because if a team all has the exact same background,
• 11:13
  they'll have the exact same blind spots. Exactly.
• 11:16
  They'll build a system with the exact same vulnerabilities
• 11:18
  no matter what tools they use. Fostering diverse
• 11:21
  communities strengthens the creative problem
• 11:23
  -solving you need to anticipate how an attacker
• 11:25
  might break in. It's brilliant. Security requires
• 11:28
  thinking like an adversary. And her role with
• 11:31
  the Secure by Design Romania Association really
• 11:34
  speaks to the educational side. The cultural
• 11:36
  shift has to start in the classroom. Right now,
• 11:38
  a student can get a whole degree learning how
• 11:41
  to make things work. And maybe take one elective
• 11:44
  in their senior year on how to make things safe.
• 11:47
  Which is exactly the paradigm that created the
• 11:49
  fragile infrastructure we have today. It's like
• 11:51
  teaching an architect to design a skyscraper,
• 11:54
  but saving load -bearing walls for a weekend
• 11:56
  seminar right before they graduate. It's totally
• 11:59
  backwards. Zero trust architecture. data minimization,
• 12:03
  these need to be taught alongside basic syntax.
• 12:06
  So it's this holistic approach. Education, community,
• 12:10
  practical tools like Cybernoe, and strict regulations.
• 12:13
  That's the only way to actually achieve the digital
• 12:16
  trust the notes emphasize. Without the cultural
• 12:18
  buy -in, the regulations are just red tape and
• 12:21
  the tools are just shelf wear. We're watching
• 12:23
  the digital age mature in real time here. The
• 12:26
  early internet was a wild west. Now it's about
• 12:29
  making it resilient. So to synthesize everything
• 12:32
  we've explored for you listening, the tech industry
• 12:34
  is being dragged out of the era of bolt -on security.
• 12:37
  Driven by Nice2 and the CRA, Secure by Design
• 12:41
  is the new baseline. But thanks to leaders like
• 12:43
  Spregen and tools like Cybernoe, this doesn't
• 12:45
  have to kill agile innovation. The burden of
• 12:47
  compliance is seamlessly integrated. Transforming
• 12:50
  security from a roadblock into the very foundation
• 12:53
  of digital trust. Exactly. But... As always,
• 12:57
  we want to leave you with something to consider
• 12:59
  on your own. A little thought experiment. Right.
• 13:02
  We spent this whole deep dive discussing the
• 13:04
  effort to make code perfectly secure, verifiable
• 13:08
  digital fortresses from the very first line.
• 13:11
  So what happens if they succeed? Yes. If this
• 13:14
  movement succeeds and the software becomes virtually
• 13:17
  impenetrable, how does cyber warfare shift? Attackers
• 13:21
  aren't just going to give up. No. If they're
• 13:23
  locked out of the architecture because APIs are
• 13:26
  perfect and data is flawlessly encrypted, they'll
• 13:29
  pivot to the path of least resistance. Meaning
• 13:31
  they pivot away from the code entirely. Exactly.
• 13:34
  They will pivot to us. If the software is impenetrable,
• 13:37
  human psychology becomes the only viable attack
• 13:40
  vector left. We're already seeing it with deep
• 13:42
  fakes and hyper -targeted phishing. Right. If
• 13:44
  we build a world where code is perfectly secure
• 13:46
  by default, do we, the human operators, become
• 13:50
  the ultimate vulnerability? It's a complex reality
• 13:53
  to navigate. It really is. We want to thank you
• 13:56
  for joining us on this deep dive. Keep examining
• 13:58
  the invisible structures around you. Stay curious
• 14:01
  and we will catch you next time.