Who Knows What Evil Lurks in the Heart of Low Code/No Code? (LIVE in Los Angeles)
Oct 22, 2024
auto_awesome
Cyrus Tibbs, CISO for PennyMac, dives into data minimization and the evolving challenges of low-code/no-code development. He emphasizes the importance of proactive security measures in a rapidly changing digital landscape. His insights highlight the need for organizational education to combat shadow IT. The conversation also critiques the limitations of Multi-Factor Authentication and promotes a culture of transparency and accountability within teams. Tibbs encourages open dialogue, ensuring robust vendor relationships and better cybersecurity strategies.
Organizations must prioritize data minimization and implement robust policies to safeguard sensitive information against rising data exposure incidents.
The rise of low-code and no-code tools highlights the need for security teams to educate employees on safe usage while enabling innovation.
Deep dives
Lessons from Early AI Adoption in Security
The transition from signature-based antivirus to early AI-driven solutions highlighted significant challenges in cybersecurity. The speaker shares personal experiences with adopting AI antivirus systems, leading to numerous operational outages and reputational damage. This experience emphasizes the importance of thoroughly evaluating new technologies and understanding their limitations before deployment. It serves as a cautionary tale for security professionals to approach new tools with diligence and an awareness of potential risks.
Data Minimization Strategies
Organizations are increasingly recognizing the need for data minimization in light of regulatory pressures and rising data exposure incidents. Implementing effective data retention policies and utilizing techniques like tokenization can help reduce sensitive data risks. The discussion emphasizes immediate actions that organizations can take, such as classifying data and establishing access controls to safeguard sensitive information. Long-term strategies, like configuring edge devices for better data processing, require careful planning but are essential for reducing data exposure.
Embracing Shadow Engineering and Low-Code Applications
The rise of low-code and no-code applications presents both opportunities and challenges in the cybersecurity landscape. There is a growing need for organizations to properly integrate these tools while maintaining security controls, particularly as employees without coding experience can easily create applications. Rather than stifling innovation, organizations should empower employees to use these tools safely and effectively while maintaining security awareness. Security teams must adapt by facilitating education and enabling employees to leverage these tools while keeping security considerations at the forefront.
Evolving Identity and Access Management Challenges
As organizations increasingly adopt multi-factor authentication (MFA), challenges regarding its implementation and user compliance have surfaced. Poorly executed MFA strategies can lead to new security vulnerabilities, including push notification bombing and social engineering attacks. It is crucial to educate users on the importance of MFA while promoting the use of strong authentication methods, such as FIDO2 keys, over knowledge-based factors. This shift is essential to enhance security, as relying on user knowledge alone is often insufficient to protect sensitive information.
Get a full inventory of all SaaS accounts ever created by anyone in your org, in minutes, along with automated workflows to scale SaaS security and governance. No agents, browser plug-ins or network changes required. Start today with a free 14-day trial.
Get the Snipd podcast app
Unlock the knowledge in podcasts with the podcast player of the future.
AI-powered podcast player
Listen to all your favourite podcasts with AI-powered features
Discover highlights
Listen to the best highlights from the podcasts you love and dive into the full episode
Save any moment
Hear something you like? Tap your headphones to save it with AI-generated key takeaways
Share & Export
Send highlights to Twitter, WhatsApp or export them to Notion, Readwise & more
AI-powered podcast player
Listen to all your favourite podcasts with AI-powered features
Discover highlights
Listen to the best highlights from the podcasts you love and dive into the full episode