Full Transcript for Chris John Riley -- MVSP: Minimum Viable Secure Product

fun along the way here. 00:02:54.317 --> 00:03:03.026 Uh, we're, we're super excited to be joined by Chris John Riley, um, who is the creator of, or the principal behind MVSP. 00:03:03.676 --> 00:03:05.326 We're going to unpack what that means. 00:03:05.627 --> 00:03:08.211 Minimum Viable Security Product. 00:03:08.262 --> 00:03:08.942 I think I got that right. 00:03:09.701 --> 00:03:09.961 But... 00:03:10.426 --> 00:03:10.877 Almost. 00:03:11.241 --> 00:03:12.972 Oh, you're gonna, you're gonna fix it for me. 00:03:12.972 --> 00:03:22.192 Cause I'm, I'm, I'm notorious for getting things wrong, but let's, let's, let's hear, uh, Chris, how you got into, to security, where did your journey begin? 00:03:22.192 --> 00:03:24.592 And just take us, uh, take us through that story if you would. 00:03:25.586 --> 00:03:25.866 Sure. 00:03:25.937 --> 00:03:27.907 Um, I mean, thanks so much for the invite. 00:03:27.956 --> 00:03:30.097 I appreciate the opportunity to chat to you. 00:03:30.097 --> 00:03:38.437 But I, I guess my, my journey started 25 years ago, dating myself a little bit now, uh, managing a Novell. 00:03:38.937 --> 00:03:47.512 Novell network environment in London, um, and I decided that this Novell network system, system admin thing was just not for me. 00:03:47.521 --> 00:03:52.181 It was just too tedious day to day, you know, creating accounts, deleting accounts. 00:03:52.262 --> 00:03:54.991 It's just, it wasn't what I wanted to do for the rest of my life. 00:03:54.991 --> 00:03:56.421 So I ended up moving to Germany. 00:03:57.201 --> 00:04:02.391 Um, to, to kind of broaden the horizons, work more in large Microsoft environments. 00:04:02.431 --> 00:04:13.382 I was working for a trading company at the time, um, and that was a interesting and eye opening experience, kind of moving from, from Novell to like wide scale, uh, NT environments. 00:04:13.792 --> 00:04:17.711 Obviously going through that learning curve of, you know, can you break a domain controller? 00:04:17.802 --> 00:04:20.242 The answer is yes, you can break a domain controller. 00:04:20.651 --> 00:04:22.541 Um, and, and I did several times. 00:04:22.841 --> 00:04:26.817 Um, And then after that, I kind of got the bug for security. 00:04:26.826 --> 00:04:29.257 It was something that cropped up a number of times. 00:04:29.257 --> 00:04:37.367 I ended up gravitating towards, you know, managing the SMS server for Windows, you know, managing the WSUS server and things like that. 00:04:37.396 --> 00:04:39.697 And it was like, Oh, patching and keeping things up to date. 00:04:39.716 --> 00:04:41.947 And why do we have VNC on these servers? 00:04:42.076 --> 00:04:43.416 You know, this is easily crackable. 00:04:44.132 --> 00:04:49.521 And, you know, and the most fun in that job was proving that, like, VNC is crackable. 00:04:49.651 --> 00:04:50.401 Okay, prove it. 00:04:50.442 --> 00:04:51.192 Okay, cool. 00:04:51.232 --> 00:04:52.841 Go off, crack VNC, come back. 00:04:52.851 --> 00:04:54.831 Look, like, we're wide open, right? 00:04:55.252 --> 00:04:56.742 Patch it and then move on to the next one. 00:04:56.742 --> 00:04:58.742 And I realized that that's just what I wanted to do. 00:04:59.206 --> 00:05:00.216 For a job, right? 00:05:00.226 --> 00:05:05.617 You know, getting paid to prove to people things are not as secure as they, as they seem. 00:05:06.197 --> 00:05:09.276 Um, and that prompted a move to Austria. 00:05:09.427 --> 00:05:10.646 I like moving countries. 00:05:10.737 --> 00:05:42.776 Um, so, uh, and I, I joined, uh, uh, a bank, um, as one of their pen tests leads, uh, doing penetration tests, PCI pen tests in their environment, but also like large scale tests for a variety of government agencies and things like that in Austria, lots of good experience there kind of diving into different environments and things like that, including on site pen tests Which are one of my favorite things that I never get to do anymore is like drop in Sit on someone's network and just go why can I listen to all your customer service calls? 00:05:42.916 --> 00:05:43.656 This is not right. 00:05:44.266 --> 00:05:45.057 And things like that. 00:05:45.326 --> 00:05:52.336 It's it was a lot of fun, but also You hit the barrier there where like, Oh, I've seen, seen this, I've done this. 00:05:52.357 --> 00:05:53.687 It's another web app test. 00:05:53.687 --> 00:05:54.867 It's a, it's another this. 00:05:55.177 --> 00:05:59.166 Um, and I decided that Austria was not for me anymore. 00:05:59.166 --> 00:06:00.286 I wanted to move somewhere else. 00:06:00.286 --> 00:06:08.507 And that's where I, uh, reached out to some friends in the industry, you know, through presentations at like DEF CON and local European conferences. 00:06:09.387 --> 00:06:14.447 I had some good connections in the industry and I reached out to a few and they said, sure, you should totally come and work for Google. 00:06:14.586 --> 00:06:20.956 So, uh, I went, turned up for the interview an hour late and somehow still managed to get the job. 00:06:21.067 --> 00:06:24.997 So, um, I think luck more than, more than anything else. 00:06:25.567 --> 00:06:42.257 And I've been doing, uh, you know, penetration testing, red teaming, vendor security work for, you know, close to nine years now with Google, uh, including running their vendor security assessment process or being the tech lead for that process for about seven years. 00:06:42.357 --> 00:06:46.276 So yeah, a good range of stuff from sysadmin all the way through. 00:06:46.487 --> 00:06:48.257 Just, just don't ask me to code anything. 00:06:48.276 --> 00:06:49.776 If anyone's seen my Python code. 00:06:50.377 --> 00:06:51.007 I'm sorry. 00:06:51.317 --> 00:06:52.367 It's not, it's not good. 00:06:53.862 --> 00:06:58.632 uh, that's a, a, a good nostalgic reminder of Novell Netware. 00:06:58.752 --> 00:06:59.141 So, Thank you. 00:06:59.466 --> 00:07:00.377 Which version though? 00:07:00.497 --> 00:07:01.786 Three or

four? 00:07:02.547 --> 00:07:08.437 Uh, ironically, I did all of my, all of my learning on four, and then the only work I ever did was 3.12. 00:07:09.226 --> 00:07:09.677 Okay. 00:07:10.466 --> 00:07:18.146 um, and almost the immediate project I got when I joined the, the, the company, uh, in London was, hey, can you migrate this to NT4? 00:07:18.687 --> 00:07:23.297 Uh, which when I say migrate, it was, hey, you have 35 accounts on here. 00:07:23.367 --> 00:07:26.726 There's not a lot of migration, but I can get this done in a day. 00:07:27.357 --> 00:07:29.076 Just, I'm going to set you up a new domain. 00:07:29.117 --> 00:07:29.797 So, yeah, 00:07:29.867 --> 00:07:30.416 Very cool. 00:07:31.036 --> 00:07:31.557 Very cool. 00:07:33.802 --> 00:07:43.641 So we want to dive in, Chris, on, on MVSP, uh, minimum, Minimum Viable Secure Product, if I remember correctly. 00:07:44.112 --> 00:07:53.122 Uh, but what's the difference between MVP and MVSP, uh, the difference and also what inspired the creation of MVSP? 00:07:54.057 --> 00:08:00.586 yeah, I mean, one of the things I wanted to make sure we call out here is this is an effort by a large group of people, right? 00:08:00.586 --> 00:08:02.567 So I tend to talk about it a lot. 00:08:02.596 --> 00:08:05.896 I work a lot on MVSP as part of my job at Google. 00:08:06.471 --> 00:08:19.791 But also that there's a lot of other people who've publicly put effort into this, um, Marat at Salesforce, um, you know, he, he's put a lot of effort into this and, and we started working on this in 2019 timeframe, right? 00:08:20.151 --> 00:08:24.872 So it's taken us a reasonable amount of time to even get to the point where there was an initial release. 00:08:24.982 --> 00:08:28.391 So, you know, agreeing with a large set of people. 00:08:28.786 --> 00:08:33.517 What a minimum is for AppSec is not an easy task. 00:08:33.606 --> 00:08:34.297 Let's put it that way. 00:08:34.647 --> 00:08:37.826 Uh, there, there is dissenting views and we should go in this direction. 00:08:37.826 --> 00:08:38.956 We should include these things. 00:08:39.346 --> 00:08:45.567 Um, but one of the core goals we had for the project since day one was it has to be minimum. 00:08:45.567 --> 00:08:46.767 It has to be realistic. 00:08:47.006 --> 00:08:52.297 We want to push the industry, but if you push the industry too far, too fast as a minimum. 00:08:53.027 --> 00:08:54.177 I mean, you're going to lose it, right? 00:08:54.177 --> 00:08:55.636 So how do you keep it relevant? 00:08:55.647 --> 00:09:03.886 How do you keep it in that sweet spot between this is too, too tough for a minimum, or this is ineffective as a minimum. 00:09:04.256 --> 00:09:06.736 And I don't know if we're succeeding in that. 00:09:07.057 --> 00:09:08.917 There's a lot of people saying this is too high. 00:09:08.917 --> 00:09:10.356 A lot of people saying this is too low. 00:09:10.667 --> 00:09:13.206 If we even them out, we seem somewhere in between those two. 00:09:13.206

--> 00:09:16.986 So I feel like we're, we're hitting that sweet spot somewhere in the middle. 00:09:17.557 --> 00:09:35.076 Um, and then the, the reason why It's called MVSP is really that we wanted to play on that MVP is that, you know, an MVP is often very much, you know, quick to market, you know, make this product, prove that it works, put it out there, get some customers start to sell this. 00:09:35.447 --> 00:09:44.616 And we wanted to be able to say, look, if you want to move into the enterprise business to business, large scale market, this is the S that you should have in your MVP, right? 00:09:44.846 --> 00:09:53.881 If you go out for MVP and you're selling it to end users, there's a certain amout of leeway that you can rely on for you know, people who are just coming into the industry, it's a new product. 00:09:53.892 --> 00:09:58.392 They're not expecting a hundred person team on your security team, right? 00:09:58.402 --> 00:09:59.432 They know what they're getting. 00:09:59.682 --> 00:10:07.591 But once you move into that enterprise arena, there's a certain amount of things that you should have in place if you want enterprises to start adopting this technology. 00:10:07.892 --> 00:10:12.822 And that's really where we wanted to say, this is the minimum set that we expect to be in place. 00:10:13.606 --> 00:10:25.626 And, and that was built from opinions on Google side, opinions on, um, uh, Salesforce's side, Okta, um, Slack, which were the, the original, um, team who released the product. 00:10:26.047 --> 00:10:40.211 And then there's a bunch of other people who've come in over the last couple of years to bring in additional viewpoints, um, and a lot of people from additional companies who, You will have heard of, but they can't put a logo on a website because someone says logos on websites are hard. 00:10:40.251 --> 00:10:43.631 So, you know, we appreciate everyone who provides input in any way. 00:10:43.631 --> 00:10:46.841 So, you know, all of that has been been really, really helpful over the years. 00:10:49.326 --> 00:10:53.006 Does MVSP apply if I'm in Enterprise then? 00:10:53.326 --> 00:10:59.027 Or is it really, cause I think, I mean I know MVPs exist in Enterprise, like Enterprise is using that. 00:10:59.261 --> 00:11:09.131 That terminology now, when you send a small group of people off to spin something up quickly and, and try to make it viable under the umbrella of the large enterprise. 00:11:10.152 --> 00:11:19.892 So from your perspective, is this, if I am a large enterprise, can I use MVSP for myself, or is it only for me to assess startups that I'm working with? 00:11:20.711 --> 00:11:28.731 I mean, when we, when we came up with MVSP, um, the different players in the game had very different opinions on where they wanted to use this. 00:11:29.042 --> 00:11:51.241 Um, you know, personally, from my experience working in the vendor security assessment process, um, I wanted to use this as a, Uh, RFP, prequal, questionnaire, to make sure that we were getting good quality things into our pipeline and weren't realizing that a product doesn't meet our minimum security guidelines four months down the road of an assessment, right, which, which does happen. 00:11:51.802 --> 00:11:58.552 Um, other people wanted to make sure that this was in their contractual language because they were getting a lot of pushback on contractual language from vendors who they deal with. 00:11:59.366 --> 00:12:03.037 And there were other people who were saying, look, I work a lot with startups personally. 00:12:03.037 --> 00:12:03.636 I work a lot. 00:12:03.716 --> 00:12:17.511 I have worked a lot with investments in new and upcoming companies who were looking at moving into enterprise realms and they often say, what do you expect from a security point of view to be in a product before you'll buy it, before you'll use it. 00:12:17.822 --> 00:12:23.932 And this is kind of the answer to that is, hey, if you want to sell a product to a large scale enterprise, this is what should be there. 00:12:25.621 --> 00:12:31.142 So it's very much a case of you can use it for whatever you want to use it for and whatever makes sense. 00:12:31.172 --> 00:12:38.746 We've seen people using it for acquisition work, for example, where they're looking at an acquisition or they're looking to buy and saying, Where are they on this scale? 00:12:38.787 --> 00:12:39.976 Do they meet all the minimums? 00:12:39.996 --> 00:12:42.817 Or are we going to have to put in half a million in the first six months? 00:12:43.136 --> 00:12:43.346 Right? 00:12:43.366 --> 00:12:44.826 Where are you on this journey? 00:12:45.177 --> 00:12:47.746 Um, and we've seen it at large scale companies. 00:12:48.267 --> 00:12:58.917 We're using it as an underpinning for our new vendor assessment processes to be able to improve those, speed them up, and make sure that things coming into our process are a lot better quality. 00:13:00.912 --> 00:13:06.591 So can you take us through the kind of the origin story of MVSP itself? 00:13:06.591 --> 00:13:07.581 I'd love to hear. 00:13:07.937 --> 00:13:18.797 Like, what was the, what was the moment where you decided let's do something here and then what did the next period of time look like as you were working up towards the first release? 00:13:19.017 --> 00:13:19.256 Sure. 00:13:19.626 --> 00:13:26.001 So, I mean, this came about from a conversation I had with Uh, Marat from Salesforce, um, in Tokyo. 00:13:26.032 --> 00:13:28.611 He's based in Tokyo, and we were out there for a conference. 00:13:28.642 --> 00:13:31.432 Um, I, I was working in the vendor security area. 00:13:31.432 --> 00:13:39.711 He was working in a similar area, so we'd had some contact previously and, and we, we sat down and had lunch one day and we're talking about some of the issues that we were facing. 00:13:40.131 --> 00:13:45.812 Um, he had this idea of defining what we expect as a minimum set of controls. 00:13:46.121

--> 00:13:55.971 We had something like that, because obviously we're working in that area, but it was very much, uh, we're working with a company to develop something, hey, here's what we expect from you, right? 00:13:55.981 --> 00:14:09.322 And we had extensive guidelines on those kind of things, but we hadn't necessarily put out a set of controls, or a list, or an opinionated view to the world to say, hey, this is what we expect from the industry as a whole, um, which is a very different thing. 00:14:09.981 --> 00:14:31.386 And then over the course of, Probably 12 months, I think, um, we started to talk to other companies who are interested, we started to draft out what we thought the initial list was going to look like, and that went through many, many iterations, um, and a lot of those controls, um, from our side, we wanted to try and identify the building blocks of what we see as a secure application, right? 00:14:32.371 --> 00:14:41.011 You can't necessarily measure everything at the RFP stage because you don't want someone filling out 180 page questionnaire on, you know, and then not winning the business. 00:14:41.081 --> 00:14:42.011 That doesn't seem fair. 00:14:42.081 --> 00:14:51.591 So you, you want to ask pointed questions that give you enough information about the security of a product, how it's going to fit into your environment, how they're going to react if there's any kind of vulnerabilities. 00:14:52.731 --> 00:14:56.067 But also it needs to be grounded in, in facts, right? 00:14:56.106 --> 00:15:00.226 If you're asking for controls that make no sense, why are you asking this? 00:15:00.506 --> 00:15:09.996 And a lot of the controls that are in MVSP now come down to areas where we saw companies consistently failing when they would come through some of our processes. 00:15:10.287 --> 00:15:14.447 You know, they'd get to four months in and they'd say, sorry, we don't support single sign on. 00:15:14.586 --> 00:15:19.527 And you're like, okay, this is like, fundamental for an enterprise to be able to have control over these kind of things. 00:15:19.826 --> 00:15:24.076 Or we'd say, great, can you make sure you make logs available in the event that there's an issue? 00:15:24.076 --> 00:15:25.417 And they're like, well, we don't log these things. 00:15:25.657 --> 00:15:26.767 It's too late now. 00:15:27.386 --> 00:15:35.336 You know, if there's an issue, you need to have identified the logs you require up front, because if you're trying to change your logging when an incident happens, you've already lost. 00:15:35.726 --> 00:15:38.856 So a lot of this stuff was very much the building block. 00:15:39.226 --> 00:15:41.057 And there's going to be more stuff on top of this, right? 00:15:41.126 --> 00:15:45.736 I mean, there's always a maturity model for, for application security that builds up and up and up, right? 00:15:45.736 --> 00:15:49.116 And all the way to, you know, are you implementing trusted types? 00:15:49.116 --> 00:15:56.976 Are you implementing these new technologies that are likely to break a lot of stuff, but are very, very useful in certain areas, but you can't expect that from a minimum. 00:15:57.126 --> 00:16:07.312 So, we started to figure out what those building blocks look like, figure out what the best coverage was, but also still maintain that minimum vibe, right? 00:16:07.611 --> 00:16:10.182 If you're asking for too much, you're losing people. 00:16:10.201 --> 00:16:12.442 If you're not asking for enough, it's not useful. 00:16:12.682 --> 00:16:14.662 So making sure we balance. 00:16:14.721 --> 00:16:16.241 And there's differing opinions, right? 00:16:16.392 --> 00:16:21.032 We solicited opinions from, I think we probably got opinions from like 30 different companies. 00:16:22.246 --> 00:16:24.397 Some were saying this definitely needs to be here. 00:16:24.407 --> 00:16:26.976 Others are like that same thing definitely shouldn't be here. 00:16:26.976 --> 00:16:37.947 So as an industry, we are an opinionated set of people and, and based on the experience that people have, it's like, this is a critical for me, but maybe it's not critical for you. 00:16:38.006 --> 00:16:40.817 So we tried to take controls in and out. 00:16:40.846 --> 00:16:43.897 And then we finally came up with, at the time, 24 controls. 00:16:44.246 --> 00:16:48.677 Um, since then we've kind of extended, extended out to 25, but we really want to keep it. 00:16:49.376 --> 00:16:50.197 Short and sweet. 00:16:50.326 --> 00:16:52.096 Yes, no, not applicable. 00:16:52.746 --> 00:16:55.277 We, you know, it should be easy to go through. 00:16:55.476 --> 00:16:59.527 And to answer the question of, you know, if you're an enterprise, can you use this for your products? 00:16:59.697 --> 00:17:02.547 Sure, but it should be a five minute exercise. 00:17:02.697 --> 00:17:06.277 It should be, sure, we do this and so much more, tick, tick, tick, tick, tick. 00:17:06.537 --> 00:17:14.791 If, uh, if there's a, if there's a big area where you're not doing those things, it's probably worth looking at the AppSec program and figuring out where there's a gap. 00:17:15.307 --> 00:17:15.317 hmm. 00:17:15.326 --> 00:17:15.646 Mm hmm. 00:17:16.626 --> 00:17:28.291 You mentioned that, uh, a number of the requirements came from what you were already doing at Google as kind of when you entered into this project. 00:17:29.241 --> 00:17:40.301 What percentage of those requirements and controls would you say carried forward into the, what, what an MVSP exists as today? 00:17:40.301 --> 00:17:53.491 Like, is it still primarily a foundational pieces that came from Google's best practices, or I know you said there's 30 different companies that have played in this, how is it, how has it morphed and blended over time? 00:17:54.152 --> 00:18:05.112 I mean, I'd say I think at the beginning we tried to bring in the top 10 findings that we had from from our processes, where you'd say, okay, this is a key gap here.

00:18:05.582 --> 00:18:09.061 Some of them had to be discarded because they're not application security, right? 00:18:09.061 --> 00:18:12.912 They're enterprise security issues, which is not where MVSP wants to be, right? 00:18:13.922 --> 00:18:16.852 If there's a question about, do you have EDR on your systems? 00:18:17.086 --> 00:18:19.777 That's enterprise security and not application security. 00:18:19.777 --> 00:18:24.497 So there's a lot of misconceptions there that MVSP misses all of these enterprise controls. 00:18:24.557 --> 00:18:25.797 And the answer is yes, it does. 00:18:25.906 --> 00:18:28.727 It's not designed to be an enterprise control checklist. 00:18:29.156 --> 00:18:34.707 Um, the minimum enterprise security product, maybe for the future. 00:18:34.737 --> 00:18:42.707 But, um, I think that originally we probably had less than, less than we have now. 00:18:42.757 --> 00:18:47.446 And we tried to build it up, but then we tried to figure out kind of where there's duplicates, where we needed to remove things. 00:18:48.106 --> 00:18:58.366 And more critically, where a control relied on another control to exist, in which case, we should ask for the lowest control there and say, does this exist? 00:18:58.547 --> 00:19:05.676 Because if it does, and you, as a company, you want that higher control, it's easier to build on a strong foundation than it is to... 00:19:05.936 --> 00:19:08.457 Try and underpin your, your, your building, right? 00:19:08.457 --> 00:19:12.946 If you build on the sand, your, your building is going to crumble, right? 00:19:12.977 --> 00:19:24.676 So our goal with MVSP is can you build that solid foundation and then if you want more from, from a product, it's easier to build that on top of a strong foundation and a good understanding of, of how things fit together. 00:19:25.797 --> 00:19:29.007 It, it also helps us to understand, I think, one of the controls that. 00:19:29.817 --> 00:19:31.126 We got a lot of pushback. 00:19:31.136 --> 00:19:38.017 We've, we've, we've, uh, discussed it with many different people, is this idea about having an annual third party penetration test. 00:19:38.247 --> 00:19:40.876 And a lot of people say, sure, this is normal, right? 00:19:40.876 --> 00:19:44.866 If you're PCI, DSS, you have a penetration test that's tightly scoped to. 00:19:45.342 --> 00:19:50.352 Two systems, depending on how you architect it, um, but you have a pen test, right? 00:19:50.582 --> 00:19:53.862 And in certain other areas, you know, in SOC compliance, there's, there's testing there. 00:19:53.892 --> 00:20:03.811 So it's not out of, outside the realms of possibility that you're already doing this, but for companies who don't necessarily need those kinds of controls, having an annual penetration test tells me so much, right? 00:20:03.811 --> 00:20:10.527 It tells me that you understand the value of manual testing and the patching and releasing products is not the end all and be all. 00:20:10.797 --> 00:20:19.616 It tells me that you know how to scope a test, so you know where your systems sit, you know where the data sits, you know where the, um, the issues in your system are. 00:20:19.977 --> 00:20:26.457 You value feedback on where you're doing things wrong, and you can handle remediation, patching, and correction of issues. 00:20:26.797 --> 00:20:28.527 All of that comes from one control. 00:20:28.656 --> 00:20:30.686 If you don't ask about penetration testing, then... 00:20:30.991 --> 00:20:40.122 Maybe you're patching, maybe you're not, maybe you're, maybe you know where your data is, maybe you don't, but some of these controls give you a lot of signals when you dig in and understand how they really fit together. 00:20:42.321 --> 00:20:55.451 Let me read back then the use case for MVSP and, and maybe you can elaborate a little bit more and provide a little bit more perspective here, so. 00:20:58.922 --> 00:21:19.261 As a company that's looking to purchase SAST solutions, or maybe even other software based solutions, MVSP then gives me a basic set of standards and controls that I can evaluate quickly, I can evaluate that provider of technology against this basic set of controls. 00:21:20.402 --> 00:21:29.971 and that can then be a, I guess a goal line of one of the marker lines in the procurement process. 00:21:30.352 --> 00:21:32.392 It may not be the end all be all. 00:21:32.471 --> 00:21:40.557 There may be more things, but at least it gives me a good understanding that there are basic security controls that exist in this product. 00:21:40.557 --> 00:21:45.507 So like your example, I'm not going to get four months in and go, but wait, you don't do single sign on. 00:21:45.727 --> 00:21:46.307 Hold on. 00:21:46.666 --> 00:21:55.957 This is going to be a problem for the enterprise because we have 27, 000 users and I'm not going to enter them all into a web form and hit submit 27, 000 times. 00:21:55.967 --> 00:21:59.686 So is that, what other context would you give on kind of the benefits behind it? 00:22:00.162 --> 00:22:07.332 I mean, that's one of the key benefits there is really being able to, the way we've described is top and tail. 00:22:07.422 --> 00:22:15.211 So, at the very beginning of the process, at the RFP stage, you want to know if a vendor is going to fail your follow up processes. 00:22:15.251 --> 00:22:22.051 Because the earlier you realize they're going to fail, the easier you can disregard them, or at least advise the business this is going to take you longer. 00:22:22.352 --> 00:22:22.612 Right? 00:22:22.612 --> 00:22:28.807 Because if this is the only player in the game, and they miss a bunch of controls, You know, maybe the business still needs to go with it, right? 00:22:28.807 --> 00:22:29.997 But it's an information source. 00:22:30.237 --> 00:22:41.277 And then at the other end of the process, when you're doing contractual controls, um, you don't want to give this to a lawyer and have them say, well, we can't

do this, we can't do this, we can't, we can't provide logs, we can't contact you if there's a breach. 00:22:41.767 --> 00:22:43.287 And all of this sits in MVSP. 00:22:43.287 --> 00:22:48.967 So if you meet the requirements at the beginning, you're not gonna, you know, cross these out on the contractual controls at the end. 00:22:49.227 --> 00:22:51.686 So it streamlines both of, both of those processes. 00:22:52.787 --> 00:23:12.086 I mean, as a guideline, the reason why It was particularly interesting for us as it was seeing vendors come into a process where they would answer questions about the quality of their product and we would rate them, you know, based on like varying different controls and the risk. 00:23:12.277 --> 00:23:17.176 And if if a vendor came in and they were initially related as quite poor, um, it took. 00:23:17.571 --> 00:23:21.991 Like hundreds of days for them to get from poor to a very good status. 00:23:22.892 --> 00:23:26.912 And a lot of vendors were unable to get from poor to good, right? 00:23:26.912 --> 00:23:28.271 Which is like one jump up. 00:23:28.561 --> 00:23:35.771 In which case you're spending hundreds of days, thousands of engineering hours, delaying projects, and. 00:23:36.067 --> 00:23:48.017 Um, maybe possibly getting risk exceptions in certain cases for a vendor who is never going to be able to offer the product that you expect, you know, everyone wants to use products that rate as perfect across the board. 00:23:48.207 --> 00:23:49.227 It's not realistic, right? 00:23:49.227 --> 00:23:58.642 There's always going to be some missing thing here or there, but taking a product that doesn't meet even the minimum, um, and putting it into your process just eats up the resources. 00:23:58.692 --> 00:24:09.112 And this is the reason why you start to see, um, your vendor assessment programs, either they move towards compliance, they outsource everything, they, you know, up their risk bar, right? 00:24:09.192 --> 00:24:12.701 All of these things to try and deal with the growth of things that need to get reviewed. 00:24:13.182 --> 00:24:20.406 And one of those controls that we hope to put in place and have been putting into place is earlier detection of vendors who are not going to meet the The requirements. 00:24:20.696 --> 00:24:38.156 And at that point, if you can filter those out, you can spend 80 percent of your time on the 20 percent highest risk instead of 80 percent time on the 20% worst vendors or lowest rated vendors to try and bring them up to acceptable levels, um, which seems like it's a, it's a hamster wheel of pain. 00:24:38.217 --> 00:24:38.757 Effectively. 00:24:38.757 --> 00:24:43.497 You're constantly trying to remediate minor things that should never really exist. 00:24:43.557 --> 00:24:46.467 So I'd rather spend that time on the, the most risky things. 00:24:47.557 --> 00:24:48.346 Yeah, that makes sense. 00:24:48.346 --> 00:24:51.116 And, and, you know, you mentioned contractual requirements.

00:24:51.116 --> 00:24:51.757 I hadn't thought about that. 00:24:52.017 --> 00:24:59.376 This, these controls going from the assessment phase and then becoming part of the contract. 00:24:59.376 --> 00:25:07.287 And I mean, it's, it doesn't surprise me that you have some startups that can't get from poor to good. 00:25:08.906 --> 00:25:11.707 Because they're just creating things or trying to move fast. 00:25:12.067 --> 00:25:17.666 I guess that's one of my unfair advantages is when I start companies, they're, I'm a security engineer at heart. 00:25:17.757 --> 00:25:19.747 And so like, what do you mean we're not doing all these things? 00:25:19.747 --> 00:25:20.836 Of course we're doing these things. 00:25:21.166 --> 00:25:27.946 This is just how we build products from the ground up, but I realize not everybody has that perspective when they're building products in this day and age. 00:25:28.497 --> 00:25:34.017 I mean, one of the, one of the things that I, MVPs that prove the point are perfect, right? 00:25:34.037 --> 00:25:37.707 You're going to market, you're proving that it's viable, you're proving that there's a market for this. 00:25:37.707 --> 00:25:38.096 Great. 00:25:38.727 --> 00:25:49.727 Then if you keep that MVP and continue to try and tweak it and move it, was it architected from day one to be scalable, to be secure, to meet all those contractual requirements? 00:25:49.727 --> 00:25:51.326 And do you keep logs? 00:25:51.336 --> 00:25:56.017 You know, things like this, going back and attaching all of these things on later. 00:25:56.567 --> 00:25:57.967 Sometimes it works, sometimes it doesn't. 00:25:58.067 --> 00:26:07.086 Sometimes what you end up with at the end of the day is a, you know, some kind of mutated thing with 15 different modules, each trying to do one thing, but failing at it. 00:26:07.467 --> 00:26:13.122 So even if you look at MVSP and say, For our MVP right now, that's not where we are. 00:26:13.152 --> 00:26:15.352 We're not going in at the enterprise level. 00:26:15.511 --> 00:26:20.561 We're going in a, you know, small Soho mom and pop shops trying to prove that there's an industry. 00:26:20.771 --> 00:26:28.211 But there's three things here that we should consider for the architecture and design of our product so that we can move there in the future. 00:26:28.701 --> 00:26:33.132 You don't have to be there on day one, but if you design your product, so it's never going to be there. 00:26:33.656 --> 00:26:34.517 That's, that's a problem. 00:26:34.606 --> 00:26:42.666 So you can use this as a control framework to say we don't need to do this now, but we need to know how we can do this in the future when we have the resources, the time and the money. 00:26:43.596 --> 00:26:46.547 Yeah, that's, that's a good, a good use case right there. 00:26:46.547 --> 00:26:53.936 And, and for folks that are building startups from scratch right now, they should at least be aware of the framework and the controls available. 00:26:54.136 --> 00:27:06.257 To your point, even if they don't implement them all from the very beginning, there are things you can be doing things that you should not be doing that will save you much pain in the end. 00:27:06.257 --> 00:27:09.467 So, um, I think we've been, we've been talking about this for a long time. 00:27:09.467 --> 00:27:10.277 We should probably. 00:27:11.176 --> 00:27:29.196 I'm going to and, and do a little demonstration of it for our listeners, or I guess for our watchers, those watching on YouTube, the listeners, we won't, uh, be able to, perhaps they'll have to follow along, um, and the site is mvsp.dev, just in case you're listening and you want to stop and follow along. 00:27:29.207 --> 00:27:35.051 But, um, Chris, why don't you just take us through, um, Take us, just give us a high level tour of this. 00:27:35.051 --> 00:27:42.092 Like I'm, I'm curious to get kind of your take on some of these things and just give me a heads up if you want me to scroll down further or whatever. 00:27:42.527 --> 00:27:42.817 Yeah. 00:27:42.817 --> 00:27:47.467 So we try and break out the controls into four different sections and feel free to scroll down. 00:27:47.467 --> 00:27:55.227 So starting with business controls, um, we're talking very much about, you know, The controls that your business has around your product, right? 00:27:55.227 --> 00:27:56.987 So MVSP is very product centric. 00:27:57.297 --> 00:27:59.817 So it's, you know, how do you report bugs in these kind of products? 00:27:59.936 --> 00:28:06.406 How does customers come in and test your products if they, if they want to take a look at how your product interacts and functions? 00:28:06.826 --> 00:28:09.886 Um, we obviously reference self assessment because we want people to. 00:28:10.136 --> 00:28:12.237 Do the MVSP checklist on an annual basis. 00:28:12.267 --> 00:28:14.797 We understand things change during the year, right? 00:28:14.817 --> 00:28:16.517 You know, a year is a long time in technology. 00:28:17.047 --> 00:28:25.086 Um, and then we cover some of the high level stuff on, you know, what we were talking about before, which is external testing, penetration testing of your environment on an annual basis. 00:28:25.426 --> 00:28:31.696 Make sure you're doing the training, the compliance, and the incident handling that You expect and your customer expects to be in place. 00:28:32.096 --> 00:28:40.696 Um, so one of the things I want to call out as we call out compliance here and some of the feedback that we've got quite recently is that, well, if you're doing these compliance, why do you need this checklist? 00:28:41.317 --> 00:28:44.426 The answer is, if you have these compliances, you probably don't need this checklist, right? 00:28:44.457 --> 00:28:51.527 If you comply with SOC 2, you probably have all of this where there are some differences here is that. 00:28:51.652 --> 00:28:58.362 ISO 27001, um, you know, SSAE 18 and a few other standards.

00:28:58.362 --> 00:29:03.751 There's a few examples here, but they don't specifically look at products, right? 00:29:03.751 --> 00:29:09.922 So ISO 27001 is a company wide certification that you're following these guidelines. 00:29:10.291 --> 00:29:16.031 Does that mean that every single product in your portfolio meets the exact same set of controls and has no deviations? 00:29:16.787 --> 00:29:17.737 Probably not, right? 00:29:17.757 --> 00:29:22.957 A product that you've just created six months ago is likely not as mature as a product you've been running for 10 years. 00:29:23.406 --> 00:29:27.277 So, MVSP tries to deal with things on a product level. 00:29:27.326 --> 00:29:33.287 You know, if you have 10 products, you should have 10 MVSP reviews of those products to see where there are deviations in the products. 00:29:33.686 --> 00:29:35.717 Um, so, a lot of this stuff is. 00:29:36.967 --> 00:29:46.967 Different, taking a different view of, of compliance and saying, well, this is more about how you secure your product, less about how you secure your company and how you get compliance for your company. 00:29:47.747 --> 00:29:55.977 Well, we can't ignore the fact that if you are handling credit card details, you need some kind of PCI reviews and PCI compliance. 00:29:56.872 --> 00:29:58.152 And this you outsource it, obviously. 00:30:00.471 --> 00:30:03.531 Looking at the second section, we look at application design controls. 00:30:03.582 --> 00:30:06.382 That's very much where a lot of the meat is on the technical controls. 00:30:06.392 --> 00:30:10.321 Things like making sure you support single sign on, HTTPS only. 00:30:10.961 --> 00:30:13.481 These things, you know, should be simple and out of the box. 00:30:13.811 --> 00:30:17.082 Um, you know, make sure you have some security headers in place. 00:30:17.142 --> 00:30:21.491 Particularly, we're talking about content security policy, which is another one of these areas where... 00:30:21.826 --> 00:30:26.297 If you design it in from the, from the day one, this is easy, right? 00:30:26.297 --> 00:30:28.376 If you, if you do CSP from day one, it's easy. 00:30:28.376 --> 00:30:40.317 If you try and do CSP on a five year old application, where you've suddenly realized you want to sell it to the enterprise, it's going to be a horror show because CSP is something you need to architect for, as opposed to just slap on there, right? 00:30:41.366 --> 00:30:45.396 And then we start to talk, we try and align to the password policies in NIST 800. 00:30:47.551 --> 00:30:50.352 53 because it doesn't make sense for us to reinvent the wheel here. 00:30:50.352 --> 00:30:56.672 So if you do have a requirement to have, um, single sign on and local accounts, which does happen, right? 00:30:56.991 --> 00:30:59.862 Um, then, you know, making sure that you're doing that in a secure way. 00:31:00.142 --> 00:31:01.842 Things like the things that spring to mind are. 00:31:02.882 --> 00:31:04.981 Insurance companies,

health companies, things like that. 00:31:05.221 --> 00:31:14.211 Stuff where if, um, if I have a health insurance policy through my company, if I leave my company, I still need access to that portal and I can't do single sign on anymore. 00:31:14.231 --> 00:31:17.001 So there are occasions where you're going to need to support both of these things. 00:31:17.632 --> 00:31:18.251 It does happen. 00:31:19.241 --> 00:31:21.627 And then we talk about security libraries, making sure that. 00:31:22.126 --> 00:31:23.547 Don't reinvent the wheel, right? 00:31:23.547 --> 00:31:29.767 Why, you know, having individual libraries for every single application in separate ones doesn't make sense. 00:31:29.767 --> 00:31:38.156 Like solidify on a single library, make sure you trust that library, your engineers know how to implement that library, and you're less likely to have bugs in your, in your products. 00:31:38.686 --> 00:31:43.146 Um, and then obviously we talk about patching, logging, and encryption, right? 00:31:43.146 --> 00:31:46.936 Encryption, um, both in, you know, in transit and at rest, right? 00:31:46.936 --> 00:31:48.436 Which all seems... 00:31:48.836 --> 00:31:50.106 Relatively straightforward, right? 00:31:50.106 --> 00:31:54.836 There's nothing here that jumps out and is like, Oh my God, this is like five years work for an application. 00:31:55.196 --> 00:31:57.666 This is, this is all pretty, pretty basic. 00:31:58.886 --> 00:32:11.487 Uh, for application implementation controls, um, we talk a little bit about, um, listing data and data flow, um, which sounds very complicated, but realistically for an application, just understand where your data is. 00:32:12.071 --> 00:32:12.352 Right. 00:32:12.352 --> 00:32:26.932 You know, if your data goes through a load balancer that offloads SSL, and then it goes to a reverse proxy, and then it goes to a database server in the back end, sure, you could diagram that out on a, on a napkin and understand where your data flows, where your data sits. 00:32:27.152 --> 00:32:31.082 But for more complex environments, this is critical to understand where your data is sitting. 00:32:31.471 --> 00:32:37.192 Um, so just having a diagram where you understand kind of where the data flows and sits and what kind of data is in your. 00:32:37.531 --> 00:32:40.132 in your application, uh, is, is really, really useful. 00:32:40.622 --> 00:32:54.092 Um, we talk about training, uh, developers for vulnerability prevention, and we, we have a number of categories here, but obviously dependent on what your application does, how it functions, there's going to be different training depending on what your developers need and don't need, right? 00:32:54.092 --> 00:33:07.791 If your developers are specifically working with SOAP or things like that, then spending time, you know, teaching them how to do that in a secure way is much more effective than teaching them this bog standard list of things that they may not find useful in their

day to day. 00:33:08.926 --> 00:33:11.636 And then we talk about time to fix and 3. 00:33:11.707 --> 00:33:20.356 5 control, which is build processes, is the one that we brought in last year during review, where we say, um, we're aligning to SLSA. 00:33:20.376 --> 00:33:38.162 I don't know if you're familiar with the slsa.dev project, which is something that people at Google are working on, which is very much around automating building software with provenance, so you can trust that that software hasn't been altered, um, or, um, the supply chain hasn't been affected. 00:33:38.172 --> 00:33:46.761 So we start to try and align to level one, which is very, very low requirements as an introduction to, Hey, you should look at SLSA for, for various areas. 00:33:46.791 --> 00:33:51.981 'cause I think this is useful beyond MVSP, but obviously we don't wanna push to towards higher levels. 00:33:53.221 --> 00:34:00.842 And then for operational controls, we talk about some, some of the slightly broader areas that start to touch on enterprise security. 00:34:00.902 --> 00:34:02.761 And we are, uh, very aware of. 00:34:03.051 --> 00:34:12.612 How far in that direction you want to go, but for application security, you want to talk about physical access, who has physical access to to the key systems that are providing these services. 00:34:13.112 --> 00:34:16.351 You want to talk about logical access, who has access to this customer data? 00:34:16.452 --> 00:34:19.402 You know, can they just VPN in with a username and password? 00:34:19.862 --> 00:34:22.871 Um, and you download all of the data from your systems. 00:34:23.192 --> 00:34:27.751 Um, and then we start to talk about subprocesses, backup and disaster recovery, right? 00:34:27.751 --> 00:34:47.681 So understanding where your data sits, understanding who has access to your data, um, and making sure that you can recover from a disaster and there's been some recent examples, I believe, of people who back up to a different region and then wonder why a hacker has deleted both their production environment and their backup in a different region. 00:34:48.192 --> 00:34:59.244 So, you know, making sure you're backing up to different locations and actually have a good quality disaster recovery program that's tested is very important for an application. 00:34:59.905 --> 00:35:00.711 And that's very much it. 00:35:00.791 --> 00:35:02.001 It's 25 controls. 00:35:02.722 --> 00:35:04.422 It doesn't, uh, doesn't go beyond that. 00:35:04.452 --> 00:35:05.492 It doesn't need to go beyond that. 00:35:05.492 --> 00:35:09.322 And if it, if it did, then I don't think it would meet the purposes that it's designed to meet. 00:35:09.492 --> 00:35:09.762 So, 00:35:10.686 --> 00:35:15.166 Yeah, I don't see anything that's, that I'm looking at this and going, that's just unreasonable. 00:35:15.376 --> 00:35:23.936 Like everything here is, is, and that's, that's something that I've been investigating and thinking about a lot is this concept of reasonable application security. 00:35:24.672 --> 00:35:34.172 Because there are a lot of things we require of people in, in, for those of us that have been in insecurity for a long time, we require a lot of unreasonable things and expectations. 00:35:34.202 --> 00:35:37.492 But I'm looking at this and I'm going, this, this seems reasonable. 00:35:37.501 --> 00:35:47.722 Like, I don't see anything where I'm like, if I was on the startup or small company side and you told me, you sent me this list of requirements, there's really nothing here. 00:35:48.137 --> 00:35:52.137 You know, because you're not telling me that I have to comply with particular standards, for example. 00:35:52.246 --> 00:35:54.757 It's the relevant standards for your business needs. 00:35:54.757 --> 00:36:02.757 And like we know, you know, from PCI DSS, if I use an outsourced credit card processor, I don't have to do anything with PCI DSS. 00:36:02.757 --> 00:36:04.867 I outsource that responsibility, right? 00:36:05.197 --> 00:36:08.987 And so, um, It's, I've got that coverage there. 00:36:08.987 --> 00:36:12.317 So you're not, you're not saying I have to be SOC 2, for example. 00:36:12.536 --> 00:36:14.766 You're saying the things that are relevant to our business. 00:36:15.327 --> 00:36:22.717 Incident handling, things like this, um, you know, we want to be able to deal with an incident and it shouldn't be chaos, right? 00:36:22.726 --> 00:36:22.956 In 00:36:23.041 --> 00:36:29.702 well, I mean, it will always be chaos, but, uh, it was controlled chaos, I think is the, is the best plan for, for most people. 00:36:29.936 --> 00:36:31.007 Yeah, definitely. 00:36:31.007 --> 00:36:33.856 And I worked incident response early in my career. 00:36:33.867 --> 00:36:35.047 And, uh, yes. 00:36:35.056 --> 00:36:43.016 Controlled chaos was a, a very good way to think about what was happening in the process and who was yelling at me at any given moment. 00:36:44.081 --> 00:36:50.052 I think one of the things that's important to call out is kind of how MVSP differs from some of the other areas is, is that. 00:36:50.356 --> 00:37:01.527 We're not specifically saying you need to check your application sets, this individual control in the Java configuration in order to be secure, right? 00:37:01.817 --> 00:37:08.867 MVSP is designed to be broadly applicable to a large range of systems, environments, and architectures. 00:37:09.817 --> 00:37:13.876 Where there are things that people call out and say you're missing this, this needs to be in place. 00:37:14.086 --> 00:37:21.382 It's often very specific architectures and and designs that people have in mind where it's like, but that's oddly specific. 00:37:21.391 --> 00:37:24.222 It's 1 percent less than 1 percent of what we're looking at here. 00:37:24.561 --> 00:37:28.592 And we try and be as broadly applicable to the, to the industry as we can. 00:37:28.942 --> 00:37:31.291 Otherwise people start to look at it and say, well,

we don't use Java. 00:37:31.291 --> 00:37:32.782 So I don't care about these five things. 00:37:32.811 --> 00:37:36.192 And, you know, we, we don't, we don't have databases. 00:37:36.192 --> 00:37:38.092 So we don't care about these three things, right? 00:37:38.672 --> 00:37:44.521 At that point, you start to lose people because a lot of the controls don't really line up to what they are looking for, right? 00:37:44.731 --> 00:37:46.621 So we try and be broadly applicable. 00:37:47.996 --> 00:37:48.306 Okay. 00:37:48.317 --> 00:37:54.947 So you might have to, you might have to do some noodling on this one, but I'm going to ask it anyway. 00:37:57.317 --> 00:37:59.867 Let's imagine a, let's just a startup. 00:37:59.887 --> 00:38:00.106 Okay. 00:38:00.137 --> 00:38:00.956 We've got a startup. 00:38:01.206 --> 00:38:04.097 They're coming in cold to this list. 00:38:04.447 --> 00:38:05.456 And so they've done nothing. 00:38:06.112 --> 00:38:07.472 I know that's probably not reasonable. 00:38:07.472 --> 00:38:14.882 There's probably some, most people probably done something on the list, but let's just imagine for, for a thought experiment, they've done nothing. 00:38:15.021 --> 00:38:16.422 They're coming in completely cold. 00:38:17.121 --> 00:38:30.621 And based on all what you know about this set of controls and requirements and whatnot, how much effort, you can give me an order of magnitude if you need to, how much effort are they going to have to put in to get to that? 00:38:30.621 --> 00:38:35.291 Let's just say that first notch you said it was a good was the first kind of notch. 00:38:35.931 --> 00:38:36.311 Poor. 00:38:36.791 --> 00:38:37.132 Poor. 00:38:37.141 --> 00:38:37.751 Okay, so poor. 00:38:37.882 --> 00:38:38.552 To get past poor. 00:38:38.751 --> 00:38:42.592 Let's say to get from above poor, so they're not in that category. 00:38:42.751 --> 00:38:47.512 What is a rough order of magnitude based on what you know about the controls for what someone would have to put into it? 00:38:48.172 --> 00:38:49.672 I mean, it's very difficult to answer. 00:38:49.672 --> 00:38:50.211 I mean, you're right. 00:38:50.211 --> 00:38:53.641 I have to noodle on this one because it's very application specific. 00:38:53.641 --> 00:38:55.501 It's very environment specific. 00:38:55.501 --> 00:38:57.161 It's very industry specific. 00:38:57.521 --> 00:39:03.972 I mean, for example, if you come in and you don't have any of these controls and you process credit cards, you're 12 months away. 00:39:04.371 --> 00:39:09.481 from having a product that is even compliant with the minimum set of things, right? 00:39:09.492 --> 00:39:29.271 So, uh, if you can engineer away some of those issues by saying we don't need to be PCI compliant because we'll, we'll use a third party provider, we'll, we'll, then you start to look at things like how do you iframe them in and things like that, but moving beyond that, I think a majority of these things are second nature for someone who's rolling out an application. 00:39:29.291 --> 00:39:32.902 I very much doubt anyone could walk in and say we don't meet any of these things. 00:39:33.192 --> 00:39:33.521 Right. 00:39:33.851 --> 00:39:48.992 I think, I think off the bat, off the bat, people could, could roll in and say, we probably meet 50 percent of these things purely by having an understanding of how our application works and an understanding about whether or not we need to meet GDPR compliance or we do credit card processing. 00:39:48.992 --> 00:39:50.371 I mean, and physical security. 00:39:50.371 --> 00:39:53.581 If you're using a cloud provider, you're already ticking all those boxes. 00:39:53.751 --> 00:39:54.001 Like, 00:39:54.251 --> 00:39:54.422 Right. 00:39:54.751 --> 00:40:00.092 And, and it's often, often a misconsideration where people look at it and they go, well, we don't have our servers, so we're failing that. 00:40:00.132 --> 00:40:04.342 Like, no, if you don't have servers, then your cloud provider is providing this for you, right? 00:40:04.342 --> 00:40:05.472 This is, this is reasonable. 00:40:05.851 --> 00:40:07.541 I'm A lot of. 00:40:08.072 --> 00:40:13.552 A lot of startups now, when they come on board and they're producing their MVP, the answer is they don't have an environment. 00:40:13.581 --> 00:40:14.931 They don't have a physical environment. 00:40:14.952 --> 00:40:18.322 They have five people with laptops located at various ends of the country. 00:40:18.681 --> 00:40:23.692 And do you have secure authentication on access to production data? 00:40:23.751 --> 00:40:29.382 Yes, because it's all in the cloud and it's all single sign on and it's all 2FA. 00:40:29.422 --> 00:40:34.811 And, you know, if you don't have 2FA turned on, that's not going to be a lot of effort for five people. 00:40:35.016 --> 00:40:35.277 Right. 00:40:35.476 --> 00:40:36.456 You log in, you turn it on. 00:40:36.476 --> 00:40:36.987 Great done. 00:40:37.447 --> 00:41:03.331 If you've architected your application specifically to be, um, the old school of, of web, where it's like username and password, you can't log on with anything else, um, there's a database in the background and, you know, it uses HTTP as the initial login point before it goes to HTTP, you know, all of those bad, It's 1999 type design aspects, then it's going to take you a little while to get to these things. 00:41:03.581 --> 00:41:15.302 But the way I look at this is, and this is another way that MVSP is being used in certain areas is, um, mostly with acquisitions, is that this is like the hit list of things you need to address, right? 00:41:15.342 --> 00:41:17.442 You can't address all of these issues at once. 00:41:17.442 --> 00:41:21.242 You need to systemically go through and say, okay, we don't meet five of these controls. 00:41:21.692 --> 00:41:22.621 This is our roadmap. 00:41:22.916 --> 00:41:25.376 in six months we'll meet all of those controls, right? 00:41:25.567 --> 00:41:33.376

And this is also a good way if you're in development, you're in security, you're at a small startup and someone says, how do we get to enterprise grade? 00:41:33.387 --> 00:41:37.827 It's like, well, here's a, here's a top 20 list of things we need to do, right? 00:41:38.166 --> 00:41:39.177 Do we have all of these? 00:41:39.186 --> 00:41:42.666 Cause if we don't, these three things should be on our objectives for this quarter. 00:41:42.871 --> 00:41:43.141 Right. 00:41:43.452 --> 00:41:45.192 Can we get these things done? 00:41:45.231 --> 00:41:45.501 Right. 00:41:45.722 --> 00:41:57.831 And I think that spending time on these things, as opposed to spending time on trusted types and other much more complex controls that might break a lot of the applications is likely a lot more worthwhile. 00:41:58.532 --> 00:42:04.581 Um, obviously securing your enterprise is also worthwhile, but we're talking about AppSec, so let's skip over that one for now. 00:42:05.532 --> 00:42:08.052 So where do you see MVSP going in the future? 00:42:08.072 --> 00:42:12.692 Like is, I mean, you mentioned that the SLSA control was added in for Build Providence. 00:42:12.722 --> 00:42:13.411 Makes sense. 00:42:13.411 --> 00:42:18.612 You want to be able to trace software in the supply chain and have providence for that. 00:42:19.021 --> 00:42:20.402 What do you think's gonna happen in the future? 00:42:20.407 --> 00:42:22.742 You gonna add a bunch of additional controls? 00:42:22.891 --> 00:42:24.481 Are things ever gonna come off the list? 00:42:24.487 --> 00:42:25.411 What do you, what do you see? 00:42:26.092 --> 00:42:32.931 So MVSP is designed to be Evolutionary, not revolutionary, right? 00:42:32.931 --> 00:42:43.112 I think is the term we throw around in the working group is that if someone comes in with a revolutionary idea about an amazing control, it's likely not suitable for MVSP, right? 00:42:43.992 --> 00:42:54.382 Every year we do a refresh of controls, we talk to a variety of people in the industry, we talk to a variety of people in the working group, and we agree on what changes we need to make, and we should make changes on a regular basis. 00:42:54.822 --> 00:42:56.211 You know, things become less important. 00:42:56.697 --> 00:42:58.246 Sometimes things become more important. 00:42:58.777 --> 00:43:10.266 Um, I mean, specifically if, if modern browsers start to no longer be vulnerable to some of these issues, then why do we insist that this is a control for minimums, right? 00:43:10.456 --> 00:43:12.597 You know, suddenly this becomes less of an issue. 00:43:12.606 --> 00:43:17.507 Obviously, people use old browsers all the time, but once you hit a certain point, you can say, well, this doesn't need to be. 00:43:18.106 --> 00:43:19.246 Be a control anymore. 00:43:19.737 --> 00:43:21.987 And I think the idea is not to grow the controls. 00:43:22.306 --> 00:43:29.056 The idea is to maintain the controls, make sure it's clear about what we're expecting to meet these controls. 00:43:30.166 --> 00:43:34.266 Where we can push the industry, we do so in small ways. 00:43:34.336 --> 00:43:39.467 Like, you know, we, we started with third party penetration testing to say, hey, this is important, right? 00:43:39.487 --> 00:43:51.126 Don't just trust your internal services and, you know, the developers have someone else take a look at it with fresh eyes, not because anyone's wrong, but because sometimes fresh eyes and more experienced eyes find things. 00:43:51.177 --> 00:43:52.677 And that's, that's really the way it is. 00:43:53.157 --> 00:43:56.077 And we started to push a little bit on build environments, but I think. 00:43:56.416 --> 00:44:01.177 This year is very much about clarity and making sure that we're clear about what's expected here. 00:44:01.597 --> 00:44:04.077 And that's, it's been useful. 00:44:04.077 --> 00:44:08.817 We've had a number of feedback from a variety of people about where there's not as much clarity as we'd want. 00:44:09.387 --> 00:44:11.996 This is written by engineers for engineers, right? 00:44:12.036 --> 00:44:21.097 You know, no, no one said we need the ISO editor to look at these controls and come up with a 350 page report and put it behind a paywall, right? 00:44:21.367 --> 00:44:22.416 This is designed to be free. 00:44:22.416 --> 00:44:26.827 It's designed to be accessible and it's designed by engineers and as such engineers will... 00:44:27.481 --> 00:44:29.592 yeah, we'll spell things wrong occasionally, right? 00:44:29.592 --> 00:44:32.431 But we'll do our best to make sure that it makes sense to people. 00:44:32.822 --> 00:44:40.452 Um, it's, it's going to slowly move upwards, but there again, every minimum should slowly move upwards. 00:44:40.452 --> 00:44:43.771 Otherwise it's, it becomes dated after a period of time. 00:44:45.231 --> 00:44:45.561 All right. 00:44:45.581 --> 00:44:50.081 Well, Robert, take us into our lightning round here, if you would with 00:44:50.166 --> 00:44:50.597 Sure. 00:44:51.657 --> 00:44:54.597 So Chris, uh, we have three questions that we usually ask. 00:44:54.686 --> 00:45:01.067 Uh, first question is what's your most controversial opinion on application security and why do you hold that view? 00:45:06.342 --> 00:45:08.242 I don't know if my views are controversial. 00:45:08.271 --> 00:45:14.481 Um, I mean, I guess I would go back to the penetration testing, right? 00:45:14.512 --> 00:45:29.657 I think that no matter how big you are, no matter how secure you think you are, and not having regular testing of your environment, Not having a, uh, a vulnerability rewards program or a bug bounty program, um, is a mistake, right? 00:45:29.677 --> 00:45:33.306 Every single company has an issue somewhere, right? 00:45:33.336 --> 00:45:36.016 If you don't have one now, you may have one in a week, right? 00:45:36.016 --> 00:45:37.657 Things, things change very fast. 00:45:38.086 --> 00:45:40.726 Um, but I don't think that's particularly

controversial. 00:45:41.197 --> 00:45:47.706 Um, I guess the closest I get to controversial on that is I wouldn't buy a piece of software if you'd never done a pen test on it. 00:45:48.757 --> 00:45:49.286 Simple as that. 00:45:50.277 --> 00:45:53.956 If you've never tested it, as far as I'm concerned, it's, it's just unproven software. 00:45:54.492 --> 00:45:57.501 And it shouldn't go anywhere near sensitive data in any way. 00:45:58.577 --> 00:45:59.166 Makes sense. 00:46:00.117 --> 00:46:07.907 Uh, second question is, uh, what would it say if you could display a single message on a billboard at the RSA or Black Hat conference? 00:46:10.692 --> 00:46:13.442 Um, translation failed. 00:46:13.581 --> 00:46:13.992 I don't know. 00:46:14.012 --> 00:46:17.632 Um, so I'm thinking about the Chinese, the Beijing Olympics. 00:46:18.021 --> 00:46:20.711 Um, but, uh, don't know. 00:46:20.711 --> 00:46:25.271 I guess it would probably say, uh, none of these products are going to solve your problems. 00:46:26.561 --> 00:46:28.411 Uh, maybe that's the controversial opinion. 00:46:29.061 --> 00:46:30.911 Way to bring both of them together there. 00:46:30.981 --> 00:46:32.211 Controversial opinion. 00:46:32.672 --> 00:46:34.972 let's see if I can bring the third one in and it's the same thing. 00:46:34.972 --> 00:46:43.681 But I, I honestly think that if, if you have a budget and you're spending it on something with blinky lights in the hope that it's going to solve all your problems, you'd have two problems. 00:46:48.086 --> 00:46:48.487 Excellent. 00:46:49.556 --> 00:46:54.907 And then a third question is, uh, what's your top book recommendation and why do you find it valuable? 00:46:56.601 --> 00:46:59.952 So I had a couple, actually, I was thinking about this a little bit before the call. 00:47:00.072 --> 00:47:04.791 Um, the first one I, I, I have is, um, Eugene Spafford. 00:47:05.266 --> 00:47:28.876 Um, did a, did a great book, uh, Cybersecurity Myths and Misconceptions, um, which talks a lot about, you know, he did a presentation at the first conference, uh, earlier in the year, and we had a chance to chat on, on the first podcast, uh, plug for the first podcast there, um, but, uh, we, uh, we went in depth on how the security industry tries to describe things by using analogies. 00:47:29.141 --> 00:47:43.141 But people take different things from those analogies, and I think that that's a very interesting take when we talk to people about certain things and describe them in a way that certain cultures and areas of the world are just not going to understand them in the same way that we do. 00:47:43.371 --> 00:47:46.882 So if you're interested in that area of things, then take a look. 00:47:47.402 --> 00:47:58.362 And my other recommendation was, um, Phantoms in the Brain, which is a book about brain injuries, but it's very interesting about what the body does and weird brain stuff. 00:47:58.391 --> 00:47:58.862 I'm kind of... 00:47:59.311 --> 00:48:01.942 I'm not a fan of those kind of weird books, but, uh, highly recommend. 00:48:03.831 --> 00:48:04.362 Very cool. 00:48:04.422 --> 00:48:12.891 Well, Chris, give us a key takeaway or maybe a call to actions or something you want the audience to do as a result of our conversation today. 00:48:14.021 --> 00:48:27.592 I guess if there was one thing I'd ask the people to do, um, you know, is, you know, use your RFP processes to filter out vendors who don't meet your requirements. 00:48:27.632 --> 00:48:34.081 And don't be afraid to turn around to those vendors and say we didn't proceed with you because you don't meet security requirements. 00:48:34.481 --> 00:48:39.411 I think as an industry, we have a tendency to focus a lot on business requirements. 00:48:39.896 --> 00:48:43.027 and ignore what security needs to do to make it work. 00:48:43.507 --> 00:48:51.766 And I think that, uh, being more opinionated about what we expect to be in place is the only way that we can bring up that minimum level of the industry. 00:48:52.137 --> 00:49:01.001 You know, rising tide lifts all boats, as they say, but effectively if we don't If we don't try and raise that tide, we're always going to be at a deficit. 00:49:01.052 --> 00:49:05.882 So, you know, that and spay and neuter your pets. 00:49:05.902 --> 00:49:07.181 Isn't that the thing? 00:49:08.811 --> 00:49:09.512 Uh, yes. 00:49:09.842 --> 00:49:10.411 It is. 00:49:11.021 --> 00:49:11.481 All right. 00:49:11.481 --> 00:49:18.141 Well, Chris, thank you for joining us to share all things about the MVSP. 00:49:18.402 --> 00:49:24.481 And thank you to all the team members out there who participated in this that are behind the scenes. 00:49:25.041 --> 00:49:32.092 We know that a project like this does take a lot of effort from a lot of different people, and it's a very valuable set of controls. 00:49:32.132 --> 00:49:39.132 And I'd encourage anybody that's building a company, building new products, you should be looking at this set of controls as your baseline. 00:49:39.652 --> 00:49:50.692 And you can, you can grow into bigger requirements in the future, but this is an excellent baseline to get started and be able to say, when someone asks, what is your approach to security with your products? 00:49:50.692 --> 00:49:54.961 Well, we use MVSP and that's our baseline set of controls. 00:49:55.112 --> 00:49:56.251 You're going to be in good shape. 00:49:56.251 --> 00:50:01.751 You're going to be at the top 10 percent in the new startup world, if that's your answer right off the bat. 00:50:01.762 --> 00:50:03.512 So, uh, Chris, thanks for being here. 00:50:04.262 --> 00:50:04.711 A problem. 00:50:04.722 --> 00:50:06.751 And, uh, if you like MVSP, let us know. 00:50:06.871 --> 00:50:08.822 And if you hate it, let us know, right? 00:50:09.871 --> 00:50:10.711 Any feedback's great. 00:50:11.452 --> 00:50:12.092 And thanks very much.