[Music]
we're small San Francisco based security
and compliance automation startup I
think you've all seen my slides now for
a little while so thanks for bearing
with us um if you've ever seen
billboards with a llama and the slogan
compliance that doesn't sock too much or
happened upon this great Reddit thread
that's us um as an aside this is my
first ever time at s con um and my
second time in Utah I have to say you
all have it pretty great here it's
beautiful I think I have a favorite new
conference so thank you doubly excited
to be here speaking with all of
you so to introduce myself uh pirate of
anti as part of the security teams at
Robin Hood and Dropbox born hats within
security and privacy engineering
behavioral security engineering and
security culture and it teams so kind of
seen it all um before that I was and I
still am a professional musician I play
the viola I realize that doesn't sound
as cool as some other instruments um and
in real life you'll find me tping my
personal life I've got two young kids um
including a three month old uh and I'm
constantly threat modeling and planning
um and making lots of things on their
Collective
behalf today I'll be talking about V's
approach to defining and scaling our
security culture in an environment where
we're all trying to do more with less as
a small startup we're always TR trying
to tackle things in a way that allows us
to have multiplicative impact um and
from what I've heard so far this week it
sounds like a lot of you are in similar
situations um and so I'll start by
defining security culture providing an
overview of the principles we use to
approach um this atanta and I'll wrap up
with some tips for how to scale your
security culture and yourselves along
the way and share some resources for
getting
started so you might be wondering why
all this matters I'm sure we've all seen
this statistic from the 2023 DB that 74%
of breaches involve the human element
whether through social engineering error
or more we often jump to addressing this
with the usual right simulated fishing
attacks um looking at the rates of
fishing reporting and assigning
remediation training um if someone
interacts with a fishing email and I've
been in this position to crafting
convincing fishes um reporting on
metrics and um even crafting Rules of
Engagement for ensuring that these
fishing campaigns go wonderfully um and
if you're lucky you might be thinking
about how to um hiring someone to
specifically focus on security culture
and awareness for your organization but
what more can we do and differently
especially if you're not someone who has
those resources you don't have that
headcount or you're part of a tiny team
that's trying to do it all oops that was
supposed to show up so what else can we
do to help people exercise good security
judgment and make informed security
related decisions so enter security
culture this matters because people are
our best and strongest defense and in in
today's day and age they may also make
security related decisions in their
personal lives that will impact their
professional lives in addition having a
healthy culture of security helps you do
the things you already do but better and
with more support building a culture of
security actually doesn't take as much
effort as you might be worried about but
it does take deliberate excuse me and
conscious effort to Define it and get it
up and running for
real getting started at a foundational
level at vanta my team defines security
culture as the Norms behaviors and
attitudes around security this can feel
a little bit abstract so we have broken
this down a little bit further into the
following indicators of a strong
security culture with a llama for
dramatic effect first that vtin which is
what we call our employees and staff
care about security that is security is
valued
second that vant understand their
responsibilities when it comes to
keeping the company secure meaning they
actually have the knowledge to make
those decisions and lastly that they
actually reach out when they have
questions and need to make those
informed security related decisions
meaning that they practice the behaviors
that you want to see and you really do
need all three to have a healthy
security culture so for example someone
can care about security and understand
their responsibilities but they make a
misguided decision because they opt to
not ask for guidance at a critical
Junction in their project
an employee who doesn't care about
security probably also doesn't
understand their responsibilities and
definitely will not reach out to you
when they need to ask for security
guidance so a healthy security culture
requires all three operating together
Lance spitzner put together this great
list of what to look for these
indicators for what this looks like
including things like an employee
feeling safe reporting an incident even
if they may have caused it security um
teams feeling comfortable asking the
security team questions and getting the
team involved in projects early on big
win and requests to partner with
security that come from many different
teams across organization not just
specific teams and
more so in short as my teammate Allan
says do you want to be a security team
that people hide from or a team that
they come to not to give it away or
anything but we certainly would like to
be a team that people come
to so to make that happen with a small
team at a fast moving startup here are
three ways we approach this so first
establishing Partnerships with cross
functional teams this allows us to scale
our impact in ways that we otherwise
would not be able to do ourselves we
regularly partner with teams that come
to you know to mind like it or
Enterprise engineering team is what we
call it privacy risk and compliance and
engineering and product dog fooding our
own product but partnering with our
Communications team and our leadership
team have been really effective for
strengthening our security culture an
example of a small ask High leverage
item is something we call 60 seconds of
security it's a regular slot on our
company all hands and we use this slot
to share a security update or a reminder
or a tip either from someone on security
or for more of a splash and honestly
more impact from someone else at the
company honestly it's more like 2
minutes of security it's hard to pack it
into 60 seconds but 60 seconds sounds
much cooler but the real point is that
Hearing security messages that come from
across the company especially from
leadership helps drive home those points
in a way that's even stronger than just
coming from us um and yes that is a
sheep getting Zapped by lightning
because they clearly plugged into USB um
we also issue periodic threat briefings
for any bad actor activity that we see
that may be relevant to our employees or
our company so people aren't left
wondering we also create and use selfs
serve resources and workflows so that
vants can help themselves this then
frees up our team's time for work that's
higher leverage or more urgent or more
impactful so some examples include
building and self- serve Security
workflows in our internal ticketing
system for different types of access and
software requests a team Wiki with
resources tips and frequently asked
questions that apply to different orgs
and different roles and a security team
decision log so we be really consistent
and clear in our guidance we're also
around for Consulting and questions as
needed but having those resources in
place allows our internal teams to take
steps on their own and for us to just be
pulled in when needed and when people
reach out we're really timely we're
human we're supportive with how we
respond and we work to understand each
situation or question and find the best
path forward hand inhand with those
self- serve resources we use a shared
responsibility model for practicing
strong security hygiene and following
our security policies so as a security
company you know this is obviously part
of every team's Charter and
responsibility not only for vanta itself
but more importantly for our customers
and their data but as a team we're
really deliberate about sharing the love
for security and explicitly stay away
from fear-based messaging we also avoid
any messaging that could convey that
security is always watching or that it's
Security's responsibility this could
take away from the agency that
individuals and their teams have over
their security and safety in their own
day-to-day
work and as a security team we primarily
interact with our employees vtin either
in person or um over Slack or tooling or
systems that the security team builds or
maintains so I'll dive into talking
about those human and tooling touch
points
next so let's start with the human
interactions and the principles that we
use behind them one is culture of yes my
team's job is to help Vantin again is
what we call our staff do their jobs in
a way that maintains security privacy
and reliability while feeling supported
and enabled our goal is to nurture a
culture or teams come to us to work
towards Solutions together and where we
understand areas of friction toward um
against security controls and guidance
two is guards are better than Gates um
the experience and productivity ADV
anant is critical to making sure our
systems and processes um are more secure
especially that of our developers and
we're constantly working to create
guardrails that make the right and
secure things super easy to do and
intuitive instead of gates that make
people hide from us three be predictable
and consistent we provide practical and
consistent guidance and we're really
transparent when we don't know where the
right answer is um we want to make sure
folks don't have to guess our position
or go shopping for answers from
different people and the decision log I
mentioned earlier is one way we stay
really consistent and hold ourselves
accountable as a team four security is
accessible so we provide regular updates
to the whole company about what we're
working on a team and and why which
helps partner teams understand what our
priorities are we have missed sending
one out and people were like where is
the update um we create fun and inviting
and accessible ways to learn about
security such as tabletop exercises open
to lots of people CT FS a slack channel
that serves as our lightweight security
reading club and more and five is build
a security mindset from the start so to
help make sure that each Von plays a
role in keeping our company secure we
introduce Security on day one when new
folks on board and during the session we
provide practical Hands-On training and
we regularly provide additional team
trainings as needed so here's a couple
examples I know those are all principles
um so there's you know invites to fund
security learning with optional monthly
ctfs tabletops and events events we make
learning about security and privacy fun
engaging in high quality here are two
images from um screen grabs from our
security training video we also offer
our customers the same exact library of
security and privacy training and then
here are some examples of the type of
security engagement we get in slack
questions that are fueled by curiosity
such as the question in yellow about
ubis care right in purple and
responsibility folks just asking ahead
of time to make sure there's no security
implications or considerations they
should take into account ahead of time
we also run regular surveys I know
there's a lot of skepticism in general
about surveys but the goal here is just
to understand and measure our security
culture and friction against that and
give people an outlet to share their
feedback so here are some examples of
the questions we've asked we run these
twice a year across our whole company
it's a joint survey with our friends on
privacy risk and compliance as well as
our it team a few things that have
helped people are really really busy and
they don't want to take your survey and
so we um you know make sure we
communicate a clear expectation of time
could take survey is optional all
questions are optional and lastly we
have a free response section so people
can share more detail on their feedback
especially if it doesn't fit into an
existing
question and finally I mentioned how um
we introduced security from the start
day one when folks on board we deliver
this through a rotation of folks in our
security and our it teams employee
onboarding is always super busy it's a
critical time and we worked closely with
our people or HR team to get this set up
on day one here are a couple examples of
the interaction interaction Ive
discussions and the exercises we do we
try to keep it as Lively and applied as
possible um you know questions where
people are asked to consider their roles
and the sensitive information they may
have and who might want it it's not a
question that most people have thought
through before they start at your
company and then um in the grid you know
we talk a lot about social engineering
but we really break it down into what
are the emotional tactics at play and
then we go through a couple exercises
where folks are asked identify those
emotional tactics so they can do that in
real life
too moving done to tooling here are a
few principles we keep in mind as a
super small and mighty team one is to
prioritize developer experience so in
order to ensure we have the greatest
adoption of tooling it's important for
us to understand and address those
potential points of friction um and also
to use workflows that our developers
already use as mentioned earlier we
measure friction through that survey um
and we work to reduce this over time and
people see that and they understand that
they can provide really honest feedback
and we will read every single response
in addition we're always working to push
controls closer to the building phase of
the software development process we
champion and we use tools that
prioritize reduction of developer
fatigue and we provide them with
self-served resources such as semrep and
socket um and giving them the agency to
dismiss findings as well U minimizing
alert fatigue we're always working to f-
tune our monitoring and alerting
especially for things that go beyond our
team um to minimize alert fatigue and uh
easy dismissal of alerts that does
create a negative culture of clicking
through security speed bumps and
ultimately ignoring them and lastly um
secure by default right so we want to
build systems and processes that are
secure out of the box
there's no way though that we can
possibly conceive of every need or
requirement so we try to build options
with enough flexibility um so that teams
can use them to make informed decisions
and our goal again is to balance the
right levels of security and
productivity and to provide clear
guidance when
needed so here are a few examples of the
principles behind our tooling touch
points um such as our use of tools like
semrep um we do you know review any new
and dismissed findings and we can jump
in with a code review to manually triage
or address them self- serve guidance for
developers with a good sense of humor
that speaks to all levels of experience
and background we use a ticketing system
to streamline reviews and requests I
mentioned this earlier we have some Auto
approvals for requests and lowrisk apps
that are role-based and then others that
require more levels of review and
approval this kind of system allows
vanton to selfs serve in a secure and
auditable way um with visibility in the
right chain of approvals as
needed and lastly here are some
responses from that friction survey I
mentioned a little bit earlier
specifically from Developers um these
responses definitely made us feel really
relieved I don't know that in my life I
will ever hear someone say I feel really
good about working with security but I
was really happy for that um and don't
worry we did also get plenty of critical
feedback but you can see that people are
fairly honest um and we really
appreciated that
sentiment another example is investing
in building our company's muscle for
threat modeling not something only done
by security so here's an example from a
threat modeling exercise we did with a
product team recently on a new feature
using a super simple template and figma
um and lightweight questions for
discussion we guided them through the
initial portion and then let them threat
model on their own um not only did the
team continue the discussion well beyond
the session itself but they've actually
continued to carry this mindset forward
they'll check in with us um and they've
even had some really good laughs like
along the way this is a type of work
that enables us to scale ourselves by
scaling our security
culture so as we look to apply this to
your organizations and companies I did
promise some tips and resources for
leveling up and here it is I may have
oversimplified this but I think this
could actually be three steps that would
be a short team exercise 30 to 45
minutes depending on how you run
it so step one is all about foundational
questions for designing a security
culture you want to see if you're new to
thinking about security culture these
will be foundational questions but if
you've kind of been there and done that
and thought about these these will be
more reminders and considerations to
keep in mind when you're either refining
or expanding upon it so first take a
step back and ask yourself some
questions to imion what you'd like and
what you could work with so for example
what does a healthy security culture
look like to you and your organization
right another way to think about this
what are the Norms behaviors and
attitudes towards security you would
actually like to see two what are your
areas of security friction currently
where your team could make the most
impact and what could you do to reduce
those could also be current areas of
security confusion if people don't know
how to get help three what are three
things you want to be known for as a
security team um regardless of whether
you're a team of one or if you're a team
of many
four what are your team's interests
skill sets and goals if you're wondering
how this last one is related it's not
really um but it can help you be
creative as you figure out um with your
team how you want to approach being more
deliberate about building your security
culture for example who might want to
hose the tabletop um someone might want
to give an internal talk so on and so
forth answering these questions can help
you understand the shape of your
security culture and paths toward what
you want to
build next if you feel like you're a
security team that people hide from or
even if you're not um here's a practice
practical framework for just
understanding your current state of
security culture and what opportunities
you could tackle I've divided this into
three sections just based on what's
worked well for us at vanta um with
security Partnerships self- serve
resources and strong security hygiene
for security Partnerships think about
what can help you extend your impact
whether it's something like updating a
shared company process um you know to
include a good risk RIS risk assessment
or partnering with another team on a
direct initiative like your workplace or
facilities team on a framework of
physical security controls for Global
office build outs look at the underlying
data you have such as around incidents
or questions and look for patterns to
see if there's any High leverage items
you can tackle first are there any other
opportunities for strengthening your
culture and is there anyone who can
support you and then at larger
organizations it can sometimes help to
have an executive sponsor who helps
Champion your security culture and gets
you additional visibility at that
leadership level um this does help you
multiply your impact and make sure that
the messages getting across to the right
folks self- serve resources do a quick
check of the resources you offer and
identify anything that's net new you
want to create ask yourself if your
employees know how to sound the alarm or
get help with requests um when
something's urgent and whether it's only
certain teams who are reaching out or
whether everybody kind of seems to know
you can even write along with someone or
run a security culture survey to learn
more about their experience um another
thing you could do to scale ourselves is
just look at the questions you get most
at a as a team and the requests and
create an FAQ to address these by
category you it might take you a half
hour an hour and it gets you a lot more
time back and lastly for security h ask
yourself um what your human and tooling
touch points are and how well they're
working what types of trainings do you
provide when why and to whom and what
other trainings do you want to provide
and why finally ask yourself whether the
tone of the um security related messages
sent to your employee reflects the tone
that you want to create um if it doesn't
then figure out what your dos and don'ts
are make sure people know and create a
lightweight guide for how you'll
communicate security related messages
going forward so obviously a lot of
questions but this is just intended to
to help you take a closer look at all
the things you could potentially
tackle finally step three is all about
capturing your answers to the previous
questions in a super lightweight Gap
analysis figuring how you'll get there
so your inputs in the red and yellow
columns for current state and future
state are your answers um to basically
uh you know step one and two here and
your output is an action plan in the
green column that you can prioritize
based on things such as time required
level of effort and impact I know these
sound a little a little bit like
Overkill but spend 30 to 45 minutes
going through them as a team and you'll
come out with three things at least that
you can do strategically to strengthen
your security culture and help you do
the things you're trying to do but
better so to close here's a super
oversimplified list of tips to bring it
back one start by defining the
principles for how the security Team
Works in Partners or even how you'd like
to be known as a
team two identify the folks whose buying
you need to help support the efforts
you'd like to put together again these
can be but they're not limited to your
leadership
team three identify establish and set up
the tools and platforms you'll need for
supporting strong security behaviors the
pass password managers the sem grips Etc
of your world and lastly be sure to
actively listen to and solicit feedback
from across the company on a regular
basis be human identify any areas of
friction and continuously make them
better and less friction
full so that's all I've got thanks for
joining me to learn about how we
approach this atanta does anyone have
any
questions okay I don't see any but I'm
happy to hang around if anyone wants to
come up after thanks so much thank you
st con and excited to chat with more of
[Applause]
you