EP201 Every CTO Should Be a CSTO (Or Else!) - Transformation Lessons from The Hoff
Dec 2, 2024
auto_awesome
Chris Hoff, Chief Secure Technology Officer at LastPass, shares his journey of transforming tech stacks post-incident. He emphasizes that every CTO should adopt a security-first approach, combining technology with cultural shifts. He reveals the importance of integrating security into decision-making and enhancing telemetry for observability. Hoff humorously navigates the complex world of cloud technology, highlighting the need for resilience and collaboration in security. His insights on proactive cybersecurity offer valuable lessons for others in tech.
The Chief Secure Technology Officer role is crucial in ensuring security is embedded in every aspect of technology development.
Rebuilding infrastructure post-security incident not only improved security measures but also enhanced performance by modernizing outdated systems.
Deep dives
The Role of Chief Secure Technology Officer
The position of Chief Secure Technology Officer (CSTO) is highlighted as a pivotal role in modern technology development. This title emphasizes that technology should be secure by default and by design, merging the responsibilities of both technology and security. It reflects a culture where security is embedded in every aspect of engineering, thus preventing conflicts between engineering and security teams. The goal is to ensure that every product and service developed prioritizes security, prompting a shift in how technology officers approach their roles.
Rebuilding After a Security Incident
The conversation addresses an actual security incident that accelerated the transition to a more secure and modern infrastructure. Following the incident, the decision was made to entirely recreate systems using improved security protocols rather than simply migrating existing frameworks. This approach not only enhanced security measures but also led to an impressive increase in performance due to the elimination of outdated on-premises dependencies. The strategic rebuilding provided a clean slate, allowing for better security practices to be integrated from the ground up.
Cultural and Team Dynamics During Transformation
The transition necessitated a significant cultural change within the organization to embrace cloud-native operations. Emphasis was placed on hiring personnel with experience in cloud environments to incite a positive cultural shift. Additionally, collaborative efforts were crucial in merging different geographical teams, fostering an environment of teamwork and innovation in the face of crisis. As a result, the organization developed a strong internal culture centered around security awareness, bolstered by initiatives such as a security champion program.
Complexity vs. Simplicity in Cloud Infrastructure
The discussion reflects on the perceived complexity of managing cloud infrastructure despite its inherent simplicity derived from abstraction. While moving to the cloud can lead to a more straightforward user experience, the necessary skill sets for effective management across different configurations introduce their own complexities. The conversation recognizes that effective cloud management requires an understanding of diverse environments and a strategic approach to balancing risks. Ultimately, the reality of cloud computing includes both simplified user interactions and complex operational demands.
Chris Hoff, Chief Secure Technology Officer at Last Pass
Topics:
I learned that you have a really cool title that feels very “now” - Chief Secure Technology Officer? What’s the story here? Weirdly, I now feel that every CTO better be a CSTO or quit their job :-)
After, ahem, not-so-recent events you had a chance to rebuild a lot of your stack, and in the process improve security. Can you share how it went, and what security capabilities are now built in?
How much of a culture change did that require? Was it purely a technological transformation or you had to change what people do and how they do it?
Would you recommend this to others (not the “recent events experience”, but the rebuild approach)? What benefits come from doing this before an incident occurs? Are there any?
How are you handling telemetry collection and observability for security in the new stack? I am curious how this was modernized
Cloud is simple, yet also complex, I think you called it “simplex.” How does this concept work?