July 2023 Summaries

In this podcast episode, Shane interviews Rob Picard, the Security Lead at Vanta, about his career in security and his insights into the industry. Rob discusses his journey from an early interest in security during high school to his professional roles at companies like Robinhood and his experience founding the startup Observa. He emphasizes the importance of enabling rather than hindering progress in security roles, advocating for "guardrails not gates" to facilitate business operations while managing risk. Rob shares his experience with Vanta, a platform that helps companies achieve compliance and demonstrate their security posture, and highlights the need for effective security tools that provide high signal and low noise, especially for startups with limited resources. He discusses the importance of learning from breaches, citing CircleCI's open approach to their own incident as an example of how companies can improve their security posture by running exercises based on real-world events. Rob also touches on the evolving landscape of security tools, noting trends like AI integration and the focus on reducing noise to highlight significant risks. His emphasis on partnership, trust, and the strategic management of risk underscores the evolving role of security leaders in tech companies.

Evervault presents encryption by proxy as a solution for securing sensitive data by intercepting and encrypting it before it reaches company servers, positioning it as an alternative to traditional encryption at rest and a complement to encryption in transit. This method involves using a relay server within an attested enclave to encrypt data during network requests and decrypt it only when necessary, reducing the exposure of plaintext data to potential breaches. While encryption by proxy offers enhanced security and ease of management, it raises concerns about expanding the attack surface and the risks of outsourcing security, particularly in light of incidents like LastPass. Despite these concerns, Evervault argues that their approach reduces vulnerabilities by complicating unauthorized access and offers better isolation than in-house solutions, while acknowledging the importance of robust security measures to protect against potential breaches.

Decrypt with Evervault, a new podcast series, aims to bridge the gap between software engineering and security by featuring insightful conversations with leading security professionals and developers who prioritize security in their work. Hosted by Evervault's Founder Shane Curran and Developer Advocate Liz Moy, the show is designed to inspire listeners with practical security strategies and innovative solutions to protect sensitive data. The episodes, released bi-weekly, highlight how companies like Vanta, Tines, and Circle manage data security challenges, emphasizing the importance of encryption, particularly through Evervault's offerings like Cages, which leverage AWS Nitro Enclaves for secure data processing. The podcast underscores the evolving role of software engineers in security and the need for accessible tools that integrate seamlessly into development workflows, reflecting broader industry trends towards more technical and proactive security measures. As the series unfolds, it strives to make advanced security knowledge widely accessible, encouraging a culture of security-first thinking among developers and startups alike.

Evervault has introduced several updates, including new features and enhancements aimed at improving user experience and data security compliance for its clients. Significant among these is the launch of their HIPAA Compliance use case, designed to help Healthtech companies quickly secure electronic protected health information (ePHI). Additionally, Evervault has rolled out beta versions of Mobile SDKs for Android and iOS, supporting encryption operations and aiding PCI compliance, which will be available to select beta customers. To improve the First-Time User Experience (FTUX), Evervault has refined its dashboard to help new users navigate encryption patterns more easily, thereby reducing the time required to achieve their first encryption. Cages, Evervault's data security feature, have been enhanced with improved egress reliability and the ability to expose client IP addresses for IP-based allowlisting. The dashboard for Cages has also been upgraded with warnings for debug mode and better configuration display. The company has also released compelling content on topics like federated learning and quantum secrecy, further extending its thought leadership in data security.