Integrating Software & Security – Matt Mead, SPR Consulting

This is Textron TV. The great pleasure being joined by Matt Mead a CTO with spr Consulting Welcome, Matt. I thanks for having me Matt.

I'm excited to be here. Thank you. Me too.

I'm especially excited because we're both kind of foot in both cans of camps of software and security and that's what we're going to talk about. Before we go there tell us about SP our Consulting in the kind of work that you all do. Sure.

Yeah. I mean, yeah, thank you Mitch. I mean for starters and I think this is helpful as a backdrop as we share different opinions and thoughts.

You know, where do I come from? You know Spar is a tech modernization firm. And so we adapt and build Enterprise systems and we're trying to strike that balance between, you know, the ever-evolving technology landscape and the you know technology that's available plus factoring in risks around cyber security and then you know, the other big thing is like user experience.

You know, how can we create something that's efficient and beautiful and intuitive but yet secure and you know using some of the latest and greatest tools, so that's what we're doing. We we build technology for our clients. My role as CTO at spr and I've been there for 23 years and I've been in the CTO role for about 10 years and grew up as a developer.

And so and now have a bunch of security responsibilities at spr and we work with security at our clients. So Security's a you know, a big part of my professional life. Fantastic, well congrats on that move to CTO a few years back 10 years back.

It's a let's quite a longevity these days to be so yeah years. No doubt. So you started as a software engineer, then correct holding applications and you know configuring servers and cloud and all that kind of stuff.

I'm guessing. Yeah, that's exactly correct with the exception that I started way before the cloud. So but yeah benefit of the doubt that back before graphical user interfaces of as a matter of fact, they were just sort of making their way into the commercial space so but yeah, but yeah building software for Corporate America basically for businesses to provide some sort of differentiation, you know build something that you just can't buy off.

The shelf is sort of where I've spent my whole career. Well, so let's let's talk about the software and the engineering world and I imagine this is something I'm sure your customers face this too. Right if you're if you live in the security camp and I spent maybe a half of my career there.

You know, you're used to protocols and networks and devices that you're securing and building kind of walls and boats and different ways of filtering and alerting and alarming doing all that kind of thing kind of building and protections. Then we throw in this world of everything is software. Now, you know, it kind of started happening in the network World virtualization happened there too.

Yeah, but now it's you know app security API security kubernetes container security Cloud security data security. Oh and then there's all the other security that we do for end users and devices and infrastructure. How do you as a leader of an organization with security reporting to you?

How do you sort of bridge that divide to help folks that are in the software World understand how to build more secure applications infrastructure and vice versa in any any successes or any failures, you know, you learn the hard way. Yeah. Wow, what a great question.

We could probably spend the next two days on this easily. I think. There's a bunch of things that come to mind.

I guess the first thing that comes to mind is that the single most important I guess the secret if there were a secret, although I don't think it's a secret to creating good cross-functional teams that can integrate the traditional software security professional and the developer architect you you know Step One is education and and it's not point in time education. It's continuous education because the landscape has ever changing. So I'd say that that's sort of maybe that and that's not very exciting and and that very secretive but but education continuing education will be number one, but I think And acknowledgment that we need to create the right teams with the right people and the right cross functional collaboration, which is a bunch of buzzwords is also critically important and and like calling out some of the stereotypes that are out there.

Like what I think about the security product professionals. I hope this is the same place to go. I hope this is a safe conversation and nobody nobody will hear this is okay.

Okay good. but but for the Security Professionals You know that the stereotypes I hear are that you know, he stopped telling me why I can't do something. And tell me how I can accomplish my business goals.

Let's like, you know, I can appreciate that. You want to keep things safe, but tell me how I can do. It.

Just don't keep telling me. No because if you always tell me no, I'm gonna actively try and work around you as a business professional right the business might try and work around them. I'm not speaking as me I'm speaking as this hypothetical business and with the developers, they're stereotypes have a lot of truths as well.

And this is the camp that I grew up in but you know, stop taking shortcuts that circumvent good security practices in order to sort of get something into proof of concept because you'll come back at some point and fix it right that there's never going to be a day when you when you have time and and energy and money to fix it. So, you know, I think for the developers they are sort of sometimes treated as though they're dangerous or on educated and you know, there's some tread the truth in that so so I think sort of talking about those stereotypes and putting together. cross-functional teams that have Security Professionals and have the Architects and developers on them as a collaborative team that have shared security and business goals are you know what we've seen as a success and get them speaking one language with one goal and and I think that solves a lot of problems that exist today within Corporate America and the What I'll call the lack of Effectiveness around many Security Programs certainly are two camps that have grown up in parallel often times not intersecting.

Well, I guess one way of described it before is both both. Both departments say no. It's just that the IT people say no upfront and the security people say no before you go to production because we left them out until the very end, right?

There's your bad stereotype for you, right? There's a green of Truth in that of course, but I think you're on to something which is, you know, I've been kind of circling around this question for a long time and for a while. I thought no security people should go learn software.

They should go learn how to write a little bit of code and software architecture and kind of immerse themselves in that they don't need to be a developer but you know learn about that because you can't secure what you don't understand and well security teams might be hiring more software people to do scripting and automation things like that in our socks and knocks asking security person to be a software person's not anymore effective than asking a software person to be a security person. So I think your point about Let's let's know enough to be able to walk. Maybe not a mile in each other's shoes, but a couple blocks we can least have a conversation.

I know enough about software. So teach me more about kubernetes or containers or issues around API security and I'll help you with you know, here's the things we can do. I know already know how to ski scan virtual images.

So here's how we scan container images make sure they don't have and we can put that into your what's your process look like for software. Oh devops cool we can put this in there too. And that's how that sort of back and forth works.

Is that does that make sense to you? Yeah 100% And and I think like what you're talking about and when I when I listen to what you're saying, I agree 100% I think the the magic is if they have the same goal if they're on the same team. and their their goals for this particular project that they're on our In unison, they're they're both trying to do the same thing.

And I think that allows them to work through the and and do that delicate balance of you know, what are the trade-offs what sort of business features are we trying to build maybe in a software system and and what are the corresponding risks and and what risks are we willing to take? And and what are some alternate paths that might get us the same end business value but maybe go about implementing it and you know the technology in a different way that you know makes the team Feel like it's a safer approach. I think that's I think there's I think that's a beautiful thing.

That's not commonplace. We're trying to implement that you know in in the places where we're doing work, but I would say by no means is that common. In fact, you know, it's sort of interesting.

I tell the story where If you talk to someone I always like to think of my mom or retired nurse if you asked her if she was at a picnic and she saw someone who said hey, I'm in it. I do security and hi. I'm an it.

I'm a developer. I read code, you know the average person on the street. That's maybe not Deeply rooted in the it space would assume these people.

Speak the same language. They work together on a daily basis. Hey, they're just part of this big happy it family and it turns out that there's a Pretty significant difference in the way.

They go about their roles. They sort of speak different languages. They have a very very different education as far as you know, how they've grown up in the industry and what things they know about technology and security and so I always just think about that and think that that's sort of one of the small things I'm trying to do is is sort of close that that Grand Canyon that's between those two disciplines and make them like like you said just sort of understand have a better appreciation for walking the other shoes and and then taking that knowledge and focusing on a shared goal that can provide value to the organization.

Yeah the yeah oftentimes they don't even walk down the same hallways right the building work together at least traditionally, you know to your point. I think that's spot on about try to make this Mutual admiration Society agree with you on that too, but it makes a difference if you have a common goal if your goal is a security person is to prevent the developers from doing stupid security wise then that's probably not going to be a common shared goal, right? They don't want to do anything right right non-secure code either but thank you very much.

I don't appreciate that attitude and vice versa. But if it was hey digital transformation, we've got to take our products and improve the customer experience. We've got a get to more mobile applications.

We've got to fill in the blank if that's what the company of the organization needs then let's work on that together of how we achieve that you wouldn't you know, you could use a a play or a sports team. You wouldn't all show up on the stage at the same time and say, okay, let's do the play. No, you'd work it out and plan it out together and execute right?

Same thing for our roles. Yeah, absolutely. What do you think?

What do you think organizationally? You're not asking about a specific customer, but you see different customers right you okay? Notice Trends are there are folks starting to get grapple with this problem and bring security and software together.

Is it still miles apart? And we've got a long ways to go what what you're kind of read of things. Yeah, what a great question.

I think that for organizations that are in highly regulated. Industries and organizations that are larger like maybe the fortune 1000 type companies and planet Earth. I would say those that sort of subset maybe is making strides in my opinion based on what I see through our clients and through my Professional Network.

I think they're making you know positive steps in this direction. I don't know that for that. I that I would say I'm seeing a whole lot for mid-market or smaller companies, I think.

There have significantly different security budgets first and foremost and and I think there's a reason for that which I could come back to if that's interesting. But but so there's sort of a small subset of these leaders that I think are making, you know, good positive steps by creating these these sort of cross-functional teams and their having security and software development software architecture better represented and and sort of working with one another instead of working against one another and I keep believing the business out. I guess the business would be also sort of part of that.

That'd be sort of the trifecta, you know, you got security sort of the the software development folks and then you've got the business, you know, I'll work inside by side and one team Well, you good points because oftentimes financial institutions though. They they can be very conservative. But they're also pick a bush the edge of Technology, right you think about chatting and things like that and yet the point I'd love to your thoughts about mid-market because my experience have been Market is they have almost all or maybe all the same requirements of large Enterprise.

It just have like one tenth or one 50th at the budget to try to do the same right or a smaller. It's an impossible job. I think it's it's really a tough place to be a great place to make a difference, but that's a hard right?

Yeah, I was looking at some research that talked about the role the the leader of security in an organization and I unfortunately don't remember the source which is terrible. But but they're talking about how in larger organizations the leader of security typically reports directly to the CEO. Maybe it's a c so, you know traditional see so or maybe it's a VP or EVP of it, but it's someone who has direct interaction with the CEO and is you know, basically, you know gonna be in board meetings from time to time.

So they have that sort of visibility and ability to create awareness and make folks that are controlling budget and controlling the direction of the company aware of the importance of security when you get into smaller organizations, like the mid Market organizations, for example, I think what we find is that there could be several levels of Separation, you know hierarchically in the organization between the like maybe the director or manager of it that also runs security And there are many levels from the CEO of the organization. If there's a board many, you know far far away from from the board. And so there isn't that a bit same ability in these mid-market companies to create awareness and have those conversations at the boardroom table.

And as a result, I you know, I think that's one of the areas that I saw doing some research that I think sort of leads to the huge difference in the amount of spend and I think overall effectiveness at some of the larger organizations versus these mid-market companies. That's at least I think that's consistent with what we're seeing in the marketplace. I've also heard that then the mid Market sometimes where those connections get made is either a board member who's concerned about I don't want to be in the papers.

How do we not have a breach or you have a breach and then you've got a communicate all the way up to the CEO or to the board and that's sort of not fun. The first time is that's yeah that yeah. Exactly.

I mean there's in those mid-market companies. There'd be very little proactive work at those most senior levels. There's I mean, it seems impossible to say there isn't a lot of concern but I think There could be concern it's not fair for me to say that amid Market company isn't concerned about cybersecurity but there does seem to be data that that shows that there's a disconnect between sort of corporate initiatives and corporate goals and funding and the person running security there seems to be a bit of a disconnect between those levels and that's sort of what this research that I was reading about was indicating and I think that certainly makes for a less than optimal security program and this conversation is about there's more money equal more, you know better security, right?

And I think well No more money doesn't always create better security. But but more money is almost always a good thing. Right because there's there's always ways.

It's not that it would guarantee a success right is sort of the the catch but but more money is helpful, you know security products tend to be fairly pricey and you know qualified Security Professionals also tend to be expensive and then you know, I keep talking about education. Well the education costs money, you know to have these continuing education programs. So money is good more money is good.

But but having the right connection to senior leadership and having the whole organization in alignment is is really important to have the most effective program that you can have. You know another part of having more money or having, you know, the funds available to do things is I've been in this situation too where I'd love to get the tool or buy some technology or do move to a different location to Cloud whatever I don't have anybody to do that. So I I might have money to buy something but I don't have the people that have the bandwidth to do that or I don't want to buy another tool that's gonna give me more alerts.

I've already I'm already swimming and that stuff or I don't make more work for me. So that's part of that challenge too is it isn't always buying another tool it right like getting more effective or efficient of what you have and using those funds to do other things with maybe getting some people maybe figuring out how you automate things. Right, right.

yeah, no great points and You know, I think a lot of the software I think pretty much everyone these days would buy before you build when it comes to software. I mean, there's a lot of softwares of service and very effective software that we can we can buy and we don't have to build even though I'm saying this even though we I make my living building cussing software, but you know, so of course where we spend our time is building software that differentiates our clients or provides that that back end system that they need in order to perform their business in an efficient way. And so when you talk about moving to the cloud or moving from One Cloud to another a lot of times what we're talking about, I I think what you're implying there is that we're we're moving custom stuff around and custom stuff is not it's not a cookie cutter operation.

It's you know, you sort of have to understand what's happening and there could be nuances and and it's sort of a one-off potentially. So it takes a lot of work and energy to sort of dig in and understand what you're doing and and how to do The right way so that is and and right now we're still seeing that it's really hard to find and hire talented. It folks across all disciplines these days, you know here and late 2022 still an issue.

I don't think that's a problem that's ever going to be solved. Maybe we'll someday but it seems like it has it. Yeah, well, he gets harder and harder.

You know, it's you're talking about building custom softwares, you know part of what your business about but even building custom software. Usually that involves integrating with other apps getting data from other systems connecting to other services making your software available is just you know is through an API or something to other things. So, you know, I like to say anybody in the organization who writes software but eventually gonna have to go it for either security data or to get the other applications.

So it all eventually touches, you know integrates with each other at some point, right and I imagine your world is similar or my off base. Absolutely. I mean many of our clients being large organizations.

They have hybrid Cloud setups where we're you know, shuttling data or calling functionality from different Cloud environments, and there could be an on-prem piece in there. So I think the infrastructure that we're seeing today for a lot of large Enterprise systems is incredibly complex and has A lot of things that need to be considered and understood up front. We need to have the Security Professionals, you know working with the Architects during the design phase.

So that were not getting that no right before going to production as you as you mentioned, you know sort of integrated from the get-go and focused on how can we how can we build this the best way in a way that's you know, the safest and it's sort of starts at the beginning. In fact, I would argue even groups in this might sound ridiculous, but I think even groups that do like user experience, you know, they're trying to figure out the the way to effectively design software so it's intuitive. So it's so it's effective even those groups.

I think should be doing ongoing security training which is what we do at spr, because they're introducing for example, low Fidelity prototypes early in the process maybe with the business and you know, the more that they build in just simple things like multi-factor authentication as an assump. And in the design, you know helps guarantee that some of these important features get implemented in the final, you know production implementation. So I think I think it's everybody, you know from the get-go.

We got to be thinking about security and it's not just involving the Security Professionals. It's everyone thinking about security from you know from the from the beginning and I mean integration is huge interacting with all these back-end systems is you know, what we do all day long. So all those complexities and you know, how do we Use techniques like zero trust to try and make sure that we make zero assumptions anywhere about you know, who should be handling what data is, you know all stuff that you know starts at the very beginning of the project if we want to get it, right?

Really good points. And by the way, we all know that prototypes never go into Productions. You don't have to wait, right?

We always have time budget and energy to redo them. Yeah, that's good. Let's go with that go.

Well that's been great talking with you feel a bit of a kindred spirit here at some of our experiences and so it's nice talking to him. Maybe it's a little bit of therapy for us both. I don't know but, you know one advantage I want to point out and I don't know your company you and I just met but you know, I know that working with organizations like SBR one of the advantages you should get to work on so many projects in organizations where you're working on those kind of challenges.

Well the app may be a little bit different domain or whatever how to build that software how to build security how to involve the right people in the organization, you know, the cross-functional teams. Sometimes you're you're kind of company is a great spark to start and down another path and Progress more quickly to getting security and software working together or getting more money out of your more effective than the side of your security budget. So I think it's one of the things I've done when I needed to make some big changes as get an outside group to help sort of jump start that change so, you know, oh folks we'll check out your website.

What's your where your your URL for? Yeah. com.

Yeah, and I and I appreciate the the kind words and I think that is true. We try and kind of take best practices that we see from across different Industries and put them to work for our clients. Okay, this was a pleasure talking to you here today.

I really appreciate the opportunity. You as well. I hope you'll come back soon.

Take care of that. Thanks. Bye.