McKinnon: Enterprise security requires tiered data classification to balance risk and speed
Todd McKinnon · a16z Podcast | Making Security More Useable · Jan 2, 2019 · at 22:13
Todd McKinnon, CEO and co-founder of Okta, discusses cybersecurity frameworks and enterprise data risk management on the a16z Podcast.
0:00 / 0:32exact quote · 32.1s
▶ Watch the full episode on YouTube → 720p mp4 · rendered on demand · StarZero watermark
“I think companies need to have that kind of framework. Maybe not that formal, but they have to define what's super sensitive, lock that down in a way that's commensurate with the sensitivity of the information, and then think of it like concentric rings outside of that. The things that aren't as sensitive or classified be more flexible, be faster, but at the end, if they get that risk reward right, they can, I think, take the appropriate amount of focus and care for the super important things, the secret sauce, and things that aren't as sensitive can be faster and more flexible and maybe take more risk.”
quote is from the automated transcript, cleaned for reading: filler sounds and stutters are removed, nothing is rephrased. names can be misheard (the analysis reads context, assessments check outside sources). how →
More from Todd McKinnon
McKinnon: Winning in cybersecurity means moving forward, not achieving zero breaches
“I think that if you think about, winning is not zero breaches. I think winning is moving your organization forward.”
McKinnon: Board cybersecurity focus spiked recently while CISO concern remained consistent
“One of the things that we've seen, it's the people that are chief security officers, or security professionals, or even CIOs, their level of vigilance and their level of concern about this over the last 18 months is pretty consistent. What's clearly changed is…”
McKinnon: Forcing inconvenient security protocols on end-users is a losing battle
“I think it's an uphill battle to try to get, especially in the modern era of IT, to try to get users to do something that is inconvenient or out of band. I think that, and what we see in our customer base and the prospect base that Companies in IT departments …”
McKinnon: Enterprise IoT security must anchor to individual human identities
“And ultimately, it's going to go back to a person. The person's going to want to consume the data or understand where that asset is, and that's why we think that having that logical map all the way back to the person is very valuable.”
McKinnon: Major security breaches are usually caused by simple administrative errors
“If you look a lot of these cases, ah, these breaches, it was, Very basic things that were used or problems that were used to take advantage of these networks or these systems, and it was just simple stuff that wasn't cleaned up.”
McKinnon: Unlike CISOs, corporate boards still assume they have not been breached
“What we see is that, that, like earlier, I was talking about the CEO board level and then CIO chief security officer, We see that the CIOs and the chief security officers, they understand that, that they've likely been breached and they're very into monitoring…”