NYSE Media Week CXO Series, theCUBE + NYSE Wired | Ty Sbano, Vercel

Clips
News
More from NYSE Media Week CXO Series, theCUBE + NYSE Wired

Ty Sbano

CISO

Vercel

Balancing innovation and resilience with built-in cybersecurity

Cybersecurity has become a cornerstone and a challenge for enterprises seeking to balance innovation with resilience. Businesses are incorporating cutting-edge technologies, such as artificial intelligence and cloud-native platforms, while many look to simplify the developer experience.For some, there’s been a goal to ensure a secure by default philosophy. That goal comes through eliminating common vulnerabilities, such as open ports, default credentials and insecure configurations, according to Ty Sbano (pictured), chief information security officer of Vercel Inc.“We’re dealing with a secure by default experience that you just go, ‘You know what? I want a web app. It’s on the web

play_circle_outline Revolutionizing Deployment: Vercel's Infra Workflow Streamlines Code Iteration with AI Integration for Developers

play_circle_outline Enhancing Security with Secure by Default Approach and Integrated Practices on Vercel Platform

play_circle_outline Addressing trust and safety issues and abuse on hosting platform.

play_circle_outline Strategic Collaboration Key in Combating Bad Actors: A Systematic Approach for Success

Info
Transcript

Ty Sbano, Vercel

Ty Sbano

CISO Vercel

Ty Sbano, the CISO of Vercel, focuses on simplifying code shipping process and ensuring platform security. With 20 years of experience in information security, Sbano emphasizes designing security from the start and integrating best practices. Vercel's platform offers secure hosting for custom code with built-in security measures. Sbano oversees security, IT, physical security, privacy compliance, and trust and safety at Vercel. By collaborating with partners and leveraging data analytics, Vercel aims to maintain a secure environment for developers and custome... Read more

explore Keep Exploring

What is Vercel and what does it provide for developers and companies? add

What is the new manifest called and what actions have been taken in relation to it, specifically in regards to the release of a web application firewall product in Q2? add

What measures is the hosting provider taking to address abuse on its platform? add

What strategies are being implemented to protect the internet and prevent bad behavior? add

bolt Powered by CUBE AI

Ty Sbano, Vercel

search

Dave Vellante

>> Hi everybody. This is Dave Vellante. We're wrapping up day two of our CXO series to theCUBE + NYSE Wired. We're high above the New York Stock Exchange Trading Floor. It's been just an awesome week. We were here yesterday. Sonny Singh from Oracle was ringing the bell. We had him on. Later on in the afternoon, we've had CEOs, CIOs, which is both chief information officers. We've had chief investment officers. We've had CTOs. We've had Chief information security officers. And we have another one here. Ty Sbano is the CISO of Vercel. Welcome to theCUBE.

Ty Sbano

>> Thanks for having me, Dave. Appreciate that.

Dave Vellante

>> You're very welcome. So I say CISO, do you say CISO or CISO?

Ty Sbano

>> I say CISO, but I do whatever is necessary. You can call me the janitor if you want to. We'll get it done.

Dave Vellante

>> A lot of people say CISO. I'm not really a deep cyber guy. Maybe I'm saying it wrong. Anyway, welcome. It's great to have you here. We just had the bell ring. We might hear the options exchange close in a little bit.

Ty Sbano

>> Fantastic. Very exciting.

Dave Vellante

>> Let's start with Vercel. Tell us about the company and your role.

Ty Sbano

>> Yeah, so Vercel is about eight years old now. It's a developer workflow managed infrastructure with a little bit of AI as of the past a year ago. And so what's really exciting is we enable developers and companies to ship the greatest products in the world. And what that means is iteration velocity. So as we all know, developing code can be very complex. And then what happens after you develop that code, getting it to a service out on the web and then getting that to your customer experience. There's a lot of steps that happen there. The bigger your company is, the more you want to control it, the more people involved. And so it gets very complex. And the one thing that Vercel does really well is simplifies that. And so by enabling a much more seamless experience, we allow that iteration velocity to occur. And that way as you take feedback, as your CEO doesn't like the cornflower blue or the specific black shade that's on the website, we can make those adjustments in real time. And so I think it's really exciting when it propagates and basically 15 milliseconds out onto our edge network.

Dave Vellante

>> Awesome. And you joined the company when?

Ty Sbano

>> When I joined the company about two and a half years ago, I met Guillermo, the founder of the company three years ago. And this is after being in the industry for about 20 years doing information security. And so I've mostly built software security programs and FinTech companies and a little bit of time in retail. But for me, when I met him, the vision was we're going to make the web better by changing how developers ship code. And I said, "Well, I'll help you make sure it's secure." And I didn't interview anywhere else. I met the team and it was a done deal for me after that, and they all just agreed on how to move forward.

Dave Vellante

>> I think Mark Zuckerberg's famous thing, "Go fast and break things." I was talking to a head of a financial services very well-known bank, and he said, "We got to move fast, but we can't break things anymore." And now you're in the move, fast business supporting developers, acceleration, but you got to help them be secure. So what are the unique aspects of securing your platform?

Ty Sbano

>> Yeah, so we have this manifest that's happening now called Secure by Default. And so I'm excited that we announced that in Q2 when we released our own web application firewall product. We have a lot of facets when it comes to security within the software development lifecycle. So those 20 years that I spent building, eight of them were in financial services. And so I understand what it is to deal with highly regulated environments. And so with that, what we take is a lot of the inspiration when it comes to the controls, we try to either make it easy with another integration partner or we just build it in so you don't even have to sweat it. And so where we start is at the framework level. So Next.js, Svelte, these other frameworks we host up to 35 and we make it easy to take that framework, get your custom code and ship it on Vercel. And once it's shipped there, we're not dealing with open ports, we're not dealing with default credentials, we're not dealing with insecure configurations. We're dealing with a secure by default experience that you just go, "You know what? I want a web app. It's on the web. I don't have to think about did I leave administration access open or not."

Dave Vellante

>> So you're taking highly regulated industry best practice, bringing it to an industry that's not regulated, say like the Wild West when you think about your world. And the other thing I'm inferring is people always talk about, and it's sort of this bromide that's thrown out there. You can't bolt on security. You got to design it. Everybody says yes, but what does that actually mean? You gave two examples. No open ports, no default credentials. Those are the kinds of things that you lock down from minute one. You start with we don't allow that. But just double click on that a little bit. What does it mean to not bolt on security and design it in?

Ty Sbano

>> So infrastructure is code. We all talk about it. We want it to be true. We talk about ephemeral infrastructure as well, so it's not long-lived. And so if there's something bad that happens like a zero day or a CBE, common vulnerability enumeration that is out there that people need to go fast and fix. Well, for us it could just be an assets that is static and temporary and then all of a sudden it's torn down and rebuilt. And so when we talk about default ports, we have ADM 443, and really it's all forced over 443, which is traditionally soft like SSL, TLS. And so as you secure HTTPS, as opposed to leaving it at port 80, which is unsecured without the SSL certificate, we just make that easy. So you don't have to stress, "Well, hang on, David. What ciphers are we using? We can't use those ciphers. Those are dated." We take care of that for you. So that abstraction, when you think about all the infrastructure, all the choices, and you talk about the big cloud providers, they're fantastic. Don't get me wrong. They're great. If you want the control, if you want the complexity, if you want all the people to do all the things, if you want to train the people to do the things, stay up to the date, send them to conferences, or you choose Vercel and you focus on your developer that is building the experience that you want your customers to have. And we take care of the rest.

Dave Vellante

>> Yeah, real need for this business because you're right, the cloud, fantastic. They do a great job for the most part. Most clouds.

Ty Sbano

>> It's getting harder.

Dave Vellante

>> Do a great job for their part of the shared responsibility model. But they really emphasize that shared responsibility. I remember the first AWS Reinforce people who were in the crowd were like, "Oh, shared response." I mean the C-sales understood it. The technical gurus were like, "Wait, shared responsibility." I thought it's in the cloud. And so this was well before COVID and people didn't really understand that they had responsibility to secure their... Whether it was their applications or their side of the S3 bucket, et cetera. And so you had the cloud which became the first line of defense, but it's not the only line of defense. And what happened is the poor developer was asked, "Oh, by the way, we want you to now be a security expert." And he or she was like, "Well, I don't want to be a security expert. I just want to write code."

Ty Sbano

>> And if everyone's the security expert, no one's the security expert. And so that's the challenge with that overly shared responsibility. You do need people on point. You do need to have the confidence. And I'm a firm believer, just like Vercel in the shared responsibility model. So understanding are you securing your code? Do you have proper authentication authorization in place? Are you going to rely on us for this authentication? When I go, "That's okay, you can do it on our platform. But if you already have single sign-on. Wouldn't you rather just point to that tenant? You've done all the hard work, you've made the investment, make it seamless for your engineers to get over too."

Dave Vellante

>> Ah, okay. So you can absorb existing practices. You don't have to rip and replace them to use Vercel.

Ty Sbano

>> Our focus is just integration that makes your life simple.

Dave Vellante

>> So who are some of your favorite customer examples? Maybe you can name names, maybe you can't, but ones that are sort of doing things that doing it right?

Ty Sbano

>> Yeah. We have a lot of great marquee customers, many customer stories on our website. I think Under Armor one is that near and dear to my heart. Someone that's going through a digital transformation and understanding how they want to evolve their experience. We have some other fintechs that are starting to choose our platform, which for me is very exciting because I know from the standpoint of what it's like to deliver in a banking or a FinTech environment, it's not fast. It's going to be very slow. And by the time you want to do the next thing, you're still waiting to get approval to do the first thing. And so for us, again, when we go back to that velocity of change, we're hoping that the performance as well becomes that much faster because that first click, when you go to any marquee website, when we go to david.com, we want that experience to load fast. We want it to be snappy. We don't want to wait there watching the loading screen and all these little widgets are loading and all you want to do is just check your bank account or check the latest update on the blog. And so for us, that speed is really important. And I think that's where our customers align with us when it comes to the concepts of that great digital experience.

Dave Vellante

>> So how do you spend your time? How much of your time is spent with customers? How much of your time is spent with internal engineers?

Ty Sbano

>> It's evolved over the two and a half years. And as I'm going into this next chapter, it will continue to evolve. So my neck of the woods, I have security, I have IT, I have physical facilities, I have privacy compliance, and I have trusted and safety. And so among all of those realms, I'm dipping my toe. But I'm also unifying a lot of the story because at the end of the day, if we make any mistakes there, let it be IT with getting people their laptops to do their life's work at our company or making a poor privacy decision or a great privacy decision to say, "We're going to get the data privacy framework out of the EU certified because US Privacy Shield has been defunct for a while." We want to stay ahead of the curve in meeting our customers where they want to be met at. Now can we do everything for them at all times? No, but we will absolutely take that feedback. And so for me it's probably about 80-85% internal and then 20-15% spending with customers.

Dave Vellante

>> So you're also in charge of physical security, so maybe you are the CSO, chief security officer. I asked somebody the other day, "What's the difference between a CSO and a CSO?"

Ty Sbano

>> I think we're in the middle of trying to figure out what my title should be, but for now CSO is totally fine with me.

Dave Vellante

>> No, but physical security is obviously an important part of the whole equation. So now are you part of the tech summit here? Have you participated?

Ty Sbano

>> Yeah, this is my first time at the tech summit. It's been really exciting to kind of hear different perspectives from CIOs to CFOs to even the most amount of CISOs I've seen on the stage at the same time talking about security in front of other folks. And so it's been a really exciting opportunity to fly out from San Francisco to come here to New York and finally make it into this wonderful facility.

Dave Vellante

>> So what are you hearing? What's the buzz? Everybody's talking about AI, securing AI, bad guys using AI, new seams, new threat vectors, etc. What's the buzz here about?

Ty Sbano

>> I think the real buzz is AI is here. It is real. I think when we looked at machine learning and the emergence of it felt early adoption was early. Certain workflows made sense, but now with generative AI and actually looking at models, testing models, our confidence level was going up. And so where I think it's very exciting is we're seeing the extrapolation where for folks like myself, we're going to eliminate a lot of the redundant repeat work. We're just going to create better workflows that will enable people to not just do the mundane, but to actually be with a core team of people that they really trust tuning these models and building companies in a very different way. And so I think the future of a lot of organizational development is also going to change rapidly before our eyes.

Dave Vellante

>> The other big buzzword we're hearing of course is agents and agentic. Nobody was talking about that six months ago. We started to write about it and research it a little bit. But that's a new scene. There's going to be new issues and vulnerabilities that rise up. Do you have any thoughts on that?

Ty Sbano

>> Yeah, I think the term agentic is new for me as about two months ago as well. Trustworthiness is not. Ensuring that we have quality outcomes and we're testing those models, they're built in by the native provider. I think this is an area that most teams will also be able to now build in on some of those guardrails. What are the things we don't want our employees asking about? What are the things that they shouldn't have access to? Should everyone be able to access salary data? No, probably not. But should the financial team be able to do it? Should the people operations team be able to do it? Yes. And so as we think of the permissions model, I think it's going to be critical as we think about these agents. Well, how much delegation are you granting it? This is nothing new. Authentication, authorization has been the same for a long time. Now you have real agents, real avatars that are doing work for you and on your behalf. Now it's going to be indistinguishable. So I think this concept of non-human identities and this term that's been coined is going to be a lot more long-standing. And then we're going to have to care about these actions that are happening while we sleep because we've programmatically set something up to do work while we're not awake.

Dave Vellante

>> And you're going to have to authenticate agents and people are going to be trying to... Deep fakes of agents. So it's going to come in and they're going to try to get credentials. And who knows what kind of havoc they're going to wreak. What's the number one challenge you face as a CISO, and is it the same or different than your CISO colleagues?

Ty Sbano

>> Yeah, it's not quite the same. As a hosting provider, it's going to be trust and safety. And so abuse on our platform is one of those unique nuances. As developers can create at that moment of inspiration and create the world's best products, guess what? So can the bad guys. And while we have the signals, we have intent, we can shut down individual sites very quickly. What we've done is now integrated a better mechanism of reporting. We're finding the right partners out in the world that are trying to protect the internet with us, and we're striking up the proper collaboration as well. And so for us, as we look at these systematic problems, we don't just try and do point and click shoot in one by one. We want to make sure that we're systematically understanding these signals and behaviors. Because if they show up on our platform one day, maybe they jump to a different provider, but they show up one day and they discover maybe we reverted some code, maybe they found a different bypass. We're now looking at a network and a series of events and signals to ensure that we can shut down a lot of that bad behavior. On top of that, we also want to retain and maintain the right levels of data so we're not just making it disappear and sweeping it under the rug, but we're actually capturing the information effectively so we can continue that analysis and also work with certain partners outside and government agencies to make sure that we take care of those bad individuals as well.

Dave Vellante

>> Well Ty, thanks for coming up here above the Stock Exchange Floor. Really appreciate your time and your perspectives. It was great having you.

Ty Sbano

>> Thanks, Dave. Appreciate it. You're very welcome.

Dave Vellante

>> All right, thank you for watching. That wraps up our second day here of our CXO series, the Media Week with theCUBE and NYSE Wired. Go to siliconangle.com to check out all the news. All these videos, they're always available on demand at thecube.net. And of course, check out thecuberesearch.com for all the deep dive research that we do. And don't forget to check out thecubeai.com. Thecubeai.com, that's our RAG, our retrieval augmented generated system. You can ask theCUBE a question, it'll give you an answer, it'll give you little short clips and outtakes. Really appreciate you watching. This is Dave Vellante for the entire CUBE team and the entire NYSE Wired team. Thanks for watching. We'll see you next time.