Sramana Mitra: How long have you sold the service?
Stephanie Leffler: We started in January 2011 – about five years.
Sramana Mitra: Tell me a little bit more about how this services business ramped up. Amazon was sending you people. You were managing their larger Mechanical Turk project using your platform. Did all leads come from Amazon or did you start marketing yourself?
Stephanie Leffler: In the beginning, all leads came from Amazon. We did start marketing ourselves. It’s funny. Thinking through the entrepreneurial journey, we found ourselves in a position where we never understood how good we had it in our first business with people searching online, finding exactly >>>
Stephanie Leffler: I remember Amazon called us about a year into this project and said, “How are you pushing so much work through Mechanical Turk?” We said, “We built this software platform to manage it, so it’s really easy for us to push a lot of work out there.” They asked us to come out and demo it for them. They were very impressed and said, “We’re trying to build a partner channel for this product. We need software providers like this to make our product more usable. Have you guys ever thought about going into business and selling the software?”
At that time we were like, “No, we’ve done the software thing. We’re in this thing now where you can just make money through advertising revenue. You don’t need to have any customers.” Two to three months later, we couldn’t get it out of our head. As our product got better and better, we thought that this is something that could actually impact the future of work. >>>
Leo Taddeo: We’re going to see more focus on data privacy and protection and controlling access to content in an enterprise. That dovetails with this trend towards using Big Data for business analytics. Here’s what I mean. There’s tension between allowing employees access to data they need and maintaining privacy and confidentiality of data. Those two things need to be balanced.
They’re difficult to balance because classification and access management becomes difficult in a large enterprise. The trend towards allowing our employees to access the data they need for analytical purposes is in tension with our need to maintain privacy and confidentiality of records. I think cyber security vendors who can manage the very fine granularity and tight control of what a person can access will provide real value to a trend that is emerging and developing. That is a trend towards really focused use of large datasets to analyse business problems. >>>
Leo Taddeo: What some people spend a lot of time on is embrace the return on investment type of calculation. We’ve seen studies where people have put a dollar value on a loss of a data record. It’s somewhere between $80 and $200. Then they count up the number of records that they have, potentially, at risk, and do a simple multiplication.
Then they’ll say, “Our return on investment is in the tens of millions of dollars because we could potentially use all of these records, and they cost a hundred dollars each.” That appeals to a numbers-oriented enterprise but to me, it doesn’t have a lot of value because the numbers are so subjective. It looks like data, but it’s not. It looks like a formula, but it’s not. We see some breaches where the data loss can be very small but impactful. We see other breaches where there’s a lot of data loss and not so impactful. >>>
Leo Taddeo: The second challenge I think a lot of them are facing is the complexity requirement and the specialization of the IT security staff that they need. CISOs in every private enterprise and in every government agency out there are competing for the same talent. They’re competing for the same experts. The lack of these experts and the cost of these experts is driving up security cost. It’s bringing security down because the turnover in security personnel reduces the security posture for an enterprise. >>>
Leo Taddeo: Our approach is that it’s very difficult to protect user credentials, and so the philosophy behind the software-defined perimeter is not only to do a very robust authentication of the user through attributes on the machine and other verifiable attributes, but also to prevent that user from going beyond the resources that they have legitimate access to. That, in effect, prevents critical stages of every attack that we’ve seen in the last 10 years. The attacker needs to move from an unprotected part of the network into a more sensitive part of the network. >>>
This discussion starts with perimeter security, and expands into a broader study of CISO priorities.
Sramana Mitra: Let’s start by introducing our audience to yourself as well as to Cryptzone.
Leo Taddeo: I’m the Chief Security Officer of Cryptzone. Cryptzone is a technology company providing security software to small and large enterprises and a number of organisations in between from financials to manufacturers. We provide security software in the form of an enterprise gateway called AppGate and two other data loss prevention products: Security Sheriff and Compliance Sheriff. >>>
Mary Beth Westmoreland: We want to be open and we want to help and enable it, but we may not always be the best provider of those programs and services. I can give you 500 different use cases about the missions of these wonderful organizations that we serve whether it be on the ground in Africa where the only connection they have is via cell service, or working with some of the poverty-driven institutions.
How do you leverage an ERP system to deliver food in areas that are underserved? I work with some of these entrepreneurs. I was just attending the Forbes Women Summit where the 30 Under 30 are women who are doing some amazing things around non-profits and driving impact through programs. I talked to them about how we want to help and enable via our platforms and make something like that happen. >>>