Meet the experts who power Synack’s strategic security testing platform. Our Synack Red Team unites over 1,500 of the world’s most skilled and trusted security researchers, who work with patented technology to deliver best-in-class offensive security testing on a continuous basis.
Sean Zadig on the “Paranoids,” ethical hacking and crafting a security culture
Guest:
Sean Zadig
Published:
Updated:
Duration:
41 min
Episode summary
Sean Zadig has plenty to be paranoid about. The internet is a frightening place, and Yahoo’s Paranoids–the name for the company’s infosec team–have their work cut out for them protecting Yahoo’s more than one billion global users.
As vice president, chief information security officer and “Chief Paranoid” for Yahoo, Sean is charged with keeping sensitive company data safe from an onslaught of cyberthreats, working collaboratively across all Yahoo’s media and technology brands.
In the latest WE’RE IN! episode, Sean speaks to the need for balance in security messaging and shares how he addresses risks like Log4j.
It takes patience and finesse to build a strong culture of security in any organization, let alone a global tech and media company with thousands of employees.
“It’s important to not shame people, so you don’t want to say, ‘how could you miss this?’ Or, ‘what happened? Why, why did you commit that code?’” Sean says. “Instead, we use it as a learning experience.”
Tune in to discover how Sean keeps Yahoo on the right track and hear more about:
Yahoo’s approach to bug bounties and pentesting
His unlikely path to security leadership– “It was never my career aspiration to become a CISO”
Sean’s focus on examining what motivates the attackers targeting Yahoo every day
Incident response depends on earlier trust Sean says Yahoo's fast Log4Shell response rested on years of building trust with engineers, so when security asked teams to stop feature work and patch, they did.
Be the team of yes and Instead of blocking risky requests, the Paranoids look for a way to let the business proceed while reducing risk, and they stay open about mistakes during incidents.
Deputize developers The deputy paranoids program trains people inside development teams to act as security's eyes and ears, which speeds up code reviews and product launches.
Use an elite tier in bug bounty Yahoo invited 10 top researchers into a smaller program with expanded scope, early access, and promotions, then uses their findings to steer the broader bug bounty community.
Treat escaped bugs as learning When a vulnerability reaches production, Sean's team first asks how its own controls missed it and turns the case into just-in-time training rather than shaming the developer.
Notable quotes
We're paranoid so they don't have to be.
It's important to not shame people. And so you don't want to say like, how could you miss this?
It's not no, it's yes and. And so we became, I think, the team of yes and.
I see the bug bounty program as really, to use another metaphor, taking arrows out of the quiver of the attacker.
Questions this episode answers
Who are the Paranoids at Yahoo?
The Paranoids are Yahoo's information security team. Sean says they are paranoid on behalf of users so users can use Yahoo's services without worrying. Read this section
How did Yahoo handle the Log4j vulnerability?
Yahoo ran a significant response, but Sean says the real work began years earlier by building a security culture and trust with engineers. Because security does not overstate issues, teams paused roadmaps and patched when asked. Read this section
What is Yahoo's elite bug bounty program?
It is a small group of 10 researchers drawn from thousands on Yahoo's platform who get expanded scope, early access, and special promotions. Yahoo can point them at specific concerns like XSS or CSRF and then apply what it learns to the wider program. Read this section
What should a company do when a vulnerability slips into production?
Sean says not to shame people. His team looks at why its own controls missed the issue and may add just-in-time guidance, such as a prompt at code commit. Read this section
How do you become a CISO?
Sean never planned to be a CISO. He took on more scope when he saw problems to fix, like building APT and insider threat teams, and when colleagues left during Yahoo's acquisition by Verizon. Read this section
About the guest
At the time of recording, Sean Zadig was vice president, chief information security officer, and Chief Paranoid at Yahoo, leading the company's security team known as the Paranoids. He joined Yahoo almost eight years earlier to build its eCrimes investigation team and later started teams focused on advanced persistent threats and insider threats. Before Yahoo, he spent seven years as a special agent investigating cybercrime for the NASA Office of Inspector General.
I hear you there. Every time I hear about another one of my friends installing one of those Wi Fi connected smart home locks, I get a little bit nervous for them.
WE'RE IN is brought to you by Synack, the premier crowdsourced platform for on demand security expertise. Synack delivers twenty four seven pentesting, intelligence, and vulnerability management from a global network of vetted and trusted researchers. Their work is enhanced by smart technologies to accelerate your critical cybersecurity missions. Synack gives businesses the best chance of finding every vulnerability that matters. Find out more at synack.com. That's synack.com.
Hello, Sean. Welcome to the show. Jeremiah and I are both really, really excited to get to chat with you today. So first of all, in addition to being Yahoo's CISO, I've heard that you are also the chief paranoid. Could you tell us exactly what that means and who the paranoids are?
Yeah. And first off, thanks for having me. This is really cool to be here. So the paranoids, the paranoids are Yahoo's information security team. And so as you said, in addition to being the CISO, I'm also the chief paranoid. And the name is... You know, it's kind of fun. People, like, smile when they hear the paranoids. But also, you know, it has a serious side, and I think it sort of... It shows how we think about our users and their and their security and their safety. And we are essentially paranoid for them. We're paranoid so they don't have to be. So they don't... You know, they can come onto our websites, and they can use our services and, you know, kind of do it kind of worry free while we're the ones kind of behind the scenes being paranoid and looking at the threats and thinking about their safety.
So as the chief paranoid, do you think that that makes you more paranoid than everyone else? Or do you think that it's more of a case of you are leading the paranoia of your team?
I would think I'm probably helping guide and shape the paranoia. And I wouldn't say I'm more paranoid than others. I I have a lot of paranoid folks, who have really interesting backgrounds on the team with me. But I think I try to help them balance that paranoia and make sure we are kind of guiding it and and directing it in a very useful way. It's really easy to get taken... Like, to get carried away, I think. Thinking about threats and thinking about, you know, what could happen in in the Internet, it's a very scary place. But then balancing that with, like, what is happening? And are we, you know, as we try to bring people along, as we think about threats and risk, are we losing some people because we're talking about, you know, you know, very militaristic or, like, intelligence community focused terms, which I I do as well. But, you know, having that balance and making sure we're not being too high speed, too tactical, or whatever in our in our conversations with with our users and our stakeholders is probably the balance that I bring.
And how do you... Like, when when pursuing that balance, how do you know, if you've gone too far and you're in the kind of unproductive realm of paranoia? And if that happens, how do you come back to that more rooted in action and productivity version of this kind of work?
It's hard. I think people don't get it right or often don't get it right. I mean, I guess the clue is if you're talking and like people's eyes start glazing over, then that's that's a that's a sign. But I think, I mean, really, you know, you sort of have to check yourself and like, you using language that isn't inclusive, isn't well understood by, all the people you're trying to reach and support?
I was wondering if you could also discuss sort of the business side of what you do from CISO's perspective. What's the average day like for a CISO at Yahoo?
So I think my day probably resembles a lot of a lot of CISOs. It's kind of a mix between inward facing, so looking at the security team itself and, you know, meeting with members of the team, getting. So for example, today, I, attended what we call our quarterly ops reviews with different parts of the organization, where they... Like, I just got out of one with our cyber defense team, and they presented from the different parts of that team, like insider threats, our, threat detection team, eCrimes, other teams, they present, you know, what's what's happened in the quarter, some of the accomplishments and things they're proud of, projects they've completed, and then also areas of friction they might be having. And so I like to kind of spend time with the team, understand, you know, what's working, what's not, what might they need air cover on and, you know, some assistance with. So... Yeah.
So half my time is spent internally, and then the other half is spent sort of external to the security team. And that might include, you know, company stakeholders like our CEO, our CTO, or other executives, or company, you know, parts of the business where they might be doing, you know, mergers and acquisitions, or new products, or things that, you know, are new risky areas that they might need some security guidance with, or even outside the company. So other CISOs sharing threat information and best practices.
Hopefully, I'm allowed to talk about it. There may or may not be a, a community of, with with a virtual component where I can kind of go in and and talk to other CISOs in industry and, you know, have you seen this? Or if you're going for cyber insurance when you're old, you know, what what sort of, sort of things are you asking?
I love that because that's one of the problems in industry today and in cyber and in federal and in DOD and in everything is there's not enough information sharing and everything's kind of siloed off. So that's huge.
I think that has come up on some of our previous episodes, too, where we're I think like there has been what I think I and others have seen as sort of a shift towards more. And I guess it's not even really necessarily a recent shift. I don't want to sound dramatic there. But like over the years, there's been a shift towards more more of a collaborative environment in security where CISOs and companies and all different sectors really are sharing that information so that we can all, as a community, push towards better security. And it seems like that's really important. But I guess, as a CISO, what's your take on that in terms of importance? Like, why is that necessary?
I think it's super important. I think we're we're coming to the point in industry and, you know, in sort of our collective security consciousness that a lot of this is collective defense. And to use another cliche, the rising tide lifts all the boats.
So I'm gonna circle back around to the paranoid side for a second again with that same concept of information sharing. I know there are some in the industry who are afraid that if they share too much information with others, that might inadvertently cause them to become more vulnerable themselves. How do you all juggle that? And how do you get around that level of paranoia versus the rising tide cliche that we spoke about?
It is a balance. And so I think part of it is there needs to be a level of trust. And so I am going to share... You know, I'm gonna be more open perhaps with somebody from a a company that I've that I've worked with in the past or that I trust or I I get introduced via a trusted contact. Unfortunately, that that the network, the, like, you know, person to person network is really still very critical and doesn't scale very well, but it also... It is hard to sort of share openly because there are, you know, attackers. I was about to say adversaries, but there are attackers Bad guys. Who, you know, in... Yeah. It's hard not not say it. But they they break into... They infiltrate companies, infiltrate communications, you know, technologies. And so, you know, there's... I've been in situations where attackers are monitoring my communications and want to be sure that, you know, I'm having a a communication with somebody who I think is is trustworthy.
But, you know, once we've got past that kind of initial level of like, hey, do I trust you with this information? I think, you know, being as open as possible, is is really beneficial. And, you know, even with the general public, with with policymakers, like, it's... The the more... Our sort of impression is the more you can share, the better. And we use this another term, not a cliche, but a term of, no secret squirrels and, you know, try try to avoid, again, that sort of, like, non inclusive high speed language, like, that turns people off. And You don't want
So we've seen some really, you know, nasty vulnerabilities that have presented themselves over the last couple of years. With having to juggle everything going on at Yahoo from the CISO's perspective and these critical and high level vulnerabilities like Log4j, Log4Shell. Can you walk us through how you all handle those and how you go about exchanging information in such critical ways?
Yeah. That's the, so Log4j, Log4Shell was, you know, it's... I told the paranoids, at a recent all hands that this is hopefully one of those, incidents that you will only experience once every five to ten years. And it's one thing you'll look back on your career and say, wow, I'm really glad I went through that. I learned a lot during that period. So within Yahoo, you know, we had a very significant and serious response to that. I think for us, the real work began many years before that. And because we had to create essentially a culture inside the company of cybersecurity, we had to lay the groundwork that allowed us to respond quickly to Log4Shell. We had to really begin that many years in the past. Back to trust, we had to sort of establish trust with our business units, our engineers, software engineers across the company to show that we're, you know, responsible stewards of their time and attention.
And if we are ringing the bell and saying, this is the biggest deal in years, like it really needs to be. And people who, you know, who depend on us for securing their infrastructure and, you know, doing their code reviews and such, if we are sort of standing up and we're saying, this is really important, you need to stop everything you're doing, stop working on new features and patch this vulnerability, they understand that we mean it. And they're gonna do that even though it's gonna potentially disrupt their their roadmaps and their, their product launch calendars.
That's... So that's pretty hard. Right? Because there are so many different... I I was just thinking about the different components that are involved there, and that's a lot of... Logistically, that's a difficulty, I think. How are you and you all not seen as the bad guys and you become trusted partners with the rest of the business?
It's taken a long time. And I think I think we probably started out in that more adversarial perspective where, you know, initially, I think the company thought that we introduced friction, and we were there to slow them down and be the sort of department of no. So it's funny. I was never I was never an actor. I always sort of... As a sort of true nerd was behind the scenes doing, like, you know, theater lights and sound and things like that. But there was a line from... That my actor friends like to use when they were doing sort of stand up or what have you. And they would... It's not it's not no, it's yes and. And so we became, I think, the team of yes and. So somebody comes to us and they wanna do a certain thing that we think is kind of risky. Instead of just saying no and shutting the conversation down altogether, we'll say, let's find a way for you to get there in a way that makes us happy, still reduces risk, but allows for that business, important business transaction or deal or whatever it is to proceed.
And so it took a while, I think, for the company to realize that we were committed to the success of the business, while simultaneously committed to the protection of, you know, our users and the data that they trust us with. And to be honest, the way the way to get there is to be as open as possible. And so when there's an incident like Log4Shell, we're not going to go into total lockdown mode and not communicate. We're gonna actually tell our, you know, our stakeholders, our business partners within the company what we're doing and what we're asking them to do. And if we make a mistake along the way, we'll tell them, hey, we made a mistake. We ticketed that thing we shouldn't have. It wasn't really vulnerable, but we're trying to move as quickly as we can to protect everybody. So like here's transparency, here's how we're going forward. And that seemed to work, I think.
I think something like this idea of a culture, cybersecurity more ingrained in the culture of a company in particular, I think that's something that we've talked about. I'm seeing more of a trend towards that. Something that I feel like always comes up when we talk about this is how to shift towards all levels of the business. How do more levels of the business move towards better cybersecurity or less friction, at least with cybersecurity?
It's a really difficult problem. I think, you know, we're still trying to get it right. Part of it is making sure that when you're communicating with your audience, in this case, our internal stakeholders, our executives, our product teams, we're approaching at the level that they... That's important to them. And so, you know, I may not go talk to our CEO who I have regular conversations with about security. I may not talk to him about vulnerability scanning or, you know, about, patch management. Like, I think I want to to speak to him at the at the level which he's at, which is really around business and around contracts and around, like, what's... What is important for him to know? What does he need to know to do his job? And having that kind of targeted conversation at all levels of the company, I think, really does help build trust with them. They kind of understand that you're... You speak their language. They don't have to learn your language necessarily.
Is it important for... In your professional opinion, is it important for executive leadership to take an onus upon themselves, though, to educate themselves more in this realm as well instead of just the CISO or the CIO having to 100% speak their language so that you can get the point across? Obviously, that's important, but should there also be reciprocity the other way?
I think there kind of has to be now. I mean, because cyber is so ingrained in the in the daily conversation now, you know, with what's happening in Ukraine, with ransomware gangs, with things like SolarWinds. I mean, like, these conversations are happening at the board level with our insurers, with our business partners. If there's a a partner who wants to sign a large deal with us, they're gonna ask us questions about our security posture. You know, our sales teams, our executives, our CEO, they need to know where we stand and what to say when they're asked in those in those venues because those conversations aren't happening just at the security team level anymore. They're really happening in all areas of the business. So, yeah, I think there is there is some kind of basic level of understanding that a CEO, a board member, you know, a VP of sales needs to have. And then they also need to know when do they call us, and then we come in into that conversation.
So I imagine that, you know, this this idea of a culture of cybersecurity or or building a security culture is is probably kind of a moving target. I I imagine it's something that is constantly evolving and changing. You know, with that in mind, success or how do you know when you're on the right path?
So I think one of the ways we know is when people come... Like our internal teams, for example, our products, they come to us and they ask for engagement earlier. And so we've kind of trained them on like, hey, if you're seeing a product, come to us before you launch and we'll review it and make sure it's safe. But we're getting even clamoring for more engagement. And, even so much so that we have a we have a program we call the deputy paranoids, where we actually sort of train and federate individuals within development teams. We give them special training, security training, we kind of deputize them to be like sort of our eyes and ears within the product team. And it allows them to go through code reviews faster, launch products faster. And, you know, we we get so much interest in that. Like, business leaders are like, we want people to be deputy paranoids too because it it helps them avoid, you know, problems that happen earlier in the product design or launch, or, you know, kind of engineering life cycle.
And to use another cliche, like, we're always trying to shift left. But this is something that really, you know, our business partners across the company are really excited about is like, we want deputy paranoids too. And I think when you get that level of engagement, when they come to you and they want, you know, want that, or they're coming to you and they're asking for your opinions on things like, you know, geopolitics and what does the situation with Russia and Ukraine mean for, you know, China and Taiwan, for example? Or a couple years ago, the Hong Kong national security law, how does that affect, you know, our personnel and data in Hong Kong? Those sort of things, getting that engagement from them, they come to us and they ask for our counsel, I think that shows we're on the right track.
I think that's super interesting. First time I've heard of a program like that actually in the security space within an organization, and I really like it. Early in the conversation, you had mentioned the paranoids sort of act as the paranoids on behalf of the customer. And then two, to Bella's question, how do you measure the success and how do you know you're going down the right track? How does that translate over to a communication to leadership on the success part?
Yeah. I think one thing we try to do is tell stories. And we have a lot of situations where, you know, we might have disrupted a a gang of South African BEC hijackers, for example, who were targeting, you know, certain types of professionals. And maybe, you know, we got, and this is, you know, not maybe, we did, we, you know, resulted in having some individuals in South Africa arrested based on an investigation we had done, where user accounts were being hijacked. And instead of kind of like taking that information and not sharing it with the company, we actually went on a roadshow. We talked about, here's the lessons that we learned. Here is, you know, what you need to understand for the product you're developing. Here's why, you know, this feature you wanna launch might... Maybe isn't... Maybe should be reconsidered or you should come to us for for some guidance earlier.
So I think sharing as many stories as we can, and we have a lot of good stories about... You know, we we we have a large platforms that are, you know, over a billion users around the world use our platforms in one way or another, hundreds of millions of active users, on a monthly basis. So as a security team, we get to see a lot of interesting things. And the more that we can do to share what we see from a sort of threat and a attacker profile perspective, what users are really doing on the products, how, you know, bad actors are thinking about about new products. Take that and kinda go on little roadshows inside the company. That helps us get the message across that we're a resource for them to engage with, and that, you know, they can they can come to us with questions. So, yeah, I I I think telling stories is a big part of that, the answer to that question.
So early in your security career, you worked at, as an eCrimes investigator for NASA. That's that's awesome. I think that sounds super interesting, and I was just kinda wondering what that was like and, how often were hackers trying to break into NASA's networks and steal data?
Yeah. So I spent seven years as a special agent with the NASA Office of Inspector General. They had a a computer crimes division, or now it's called cybercrimes division. And I was a a federal agent, carried a carried a gun and a badge and investigated cybercrime. It was not as glamorous as it sounds. It was, you know, I was... It's probably the nerdiest sort of federal law enforcement job you can have, but it was really rewarding. NASA is a is a really interesting environment. As you may know, they're in NASA, what they call centers all over the country of The United States, And each of them is kind of run like a university with their own security, you know, policies and posture and level of investment. And there are a lot of different types of attackers who are really interested in getting into NASA systems. And some of these could be, you know, nation state attackers who wanna steal, you know, rocket technology, which you could use for launching space shuttles, but also launching, you know, missiles.
But it's also like a lot of script kiddies, to be honest. And for some reason, the Romanians really loved hacking into nasa.gov servers and then popping on IRC and bragging.
Romania was, like, one of our most active countries. When I was there, I I spent some time, you know, working those threats. But Wow. Spent most of my time working on botnet and malware investigations. And those were actually situations where most of the time, the the attackers, the the bad actors were not targeting NASA itself. They actually were just looking for hosts that they can sell their malware on. Maybe it was spam sending malware, maybe it was click fraud, advertising fraud malware.
And then, know, I actually was really great. I got to sort of travel the world. I went to I went to Russia and met with the FSB. I went to Estonia and did a... You know, worked on a giant botnet takedown. I had, you know, individuals I was investigating and arresting in Nigeria and went to China and met with Chinese law enforcement to try to get a hacker arrested there. It was really kind of a fulfilling and exciting place to start my security career.
That's wild. I think it's interesting, something that we end up talking about a lot. I think we've talked about it on this podcast, but also just like, I have this conversation when talking with fellow security folks in general. This idea of a lot of the people that are working on security for large companies, government, how important is it to have insight into the opposite side, the attackers, know, whether firsthand as you know, I have a background in penetration testing, and informs everything that I do in the way that I think about security. But like does that kind of experience to seeing the attacker side of things inform the way that you do your job?
100%. I... If if your background as a penetration tester informs how you look at the world and security. I think my background as an investigator, as a... As somebody who investigated incidents and and situations and and criminal activity really, that really informs informs to this day how I look at the world and how I approach, security. And so I would say I am very focused on what motivates an attacker. Not necessarily like who they are. That's helpful sometimes, but I don't need to know like what building they work in or where they live. Sometimes that's useful. But knowing what motivates them, what are they after? If they if they get a foothold into a network, where are they gonna go? How long... You know, how well resourced are they? Are you seeing just a small portion of the attack? Are they... Are you seeing, you know, the whole thing? That really, as a defender, I think really helps kind of contextualize what you might be seeing in early stages of investigation.
It helps you really focus, you know, where you need to go. And really, I think has helped me as I think about, you know, investing and and how to, you know, strengthen a cybersecurity program, focusing on things like, you know, cyber threat intelligence is is really important. And I think we've had some situations where, you know, that... That's really proved its weight in in helping erect defenses that are very timely.
So taking what you just said there and tying it into current situations that are going on in the world today with, Ukraine and Russia. So given that kind of a background and thinking about how the attacker thinks, how are you all thinking about current threats from Russia towards Yahoo? I think
we are thinking about it a lot, first off. Yahoo is not just sort of a normal company. Like, we're not like a manufacturing or pharmaceutical company. We are a company that provides services to users around the world. And there are users in Russia or in Russia adjacent states like Ukraine, like Moldova, like other places where, you know, Russia has an interest. And, you know, we see Russian threat actors and threat groups targeting our consumers through spear phish, through malware, through, you know, information gathering of some sort. And so, you know, we need to make sure that we protect those users because there are situations where, you know, cyber targeting, which maybe at first glance seems innocuous, could have real world consequences. And you can see that, you know, what's happening in the news in Ukraine right now, where, you know, that that could result in an artillery strike being sent to someone's way, if their location is leaked from, you know, like a app they're using, for example.
So we take that really seriously. And we think about, you know, the user first. We also think about, you know, our our business and our partners and, you know, do we need to adjust how we how we do business in that part of the world? What's the current sanctions regime, OFAC compliance, and things like that, that might be happening? And that is a very rapidly changing environment. So I think there's a lot of different aspects to to that. And and frankly, one of the aspects is our employees have questions. They wanna know what does it mean for them? And, you know, what does it mean for the world if this is is happening? And we actually have a a page on our internal intranet where we update on a very regular basis, you know, new developments in the Ukraine and Russia war and, you know, try to kind of guide them toward, hey. This is this is the impact to you. This is the impact for our business. This is, you know, what's happening in the cyber world to enlighten them.
So out of curiosity, because you are so focused in providing services and and, products to individuals worldwide, do you all have anything like that like you have on your Internet external for maybe customers to also do some learning themselves?
Yeah. So one... That's one of the things that we are actually working on doing right now is we have what we call our behavioral engineering team, which focuses on using behavioral science techniques to encourage our employee base to adopt, you know, beneficial security technologies. And so that might be cleaning personal data from data broker sites, that might be enabling two factor on, you know, personal accounts, using password managers, things like that. We want to take this really kind of incredible content we've developed for our employees, and take those same kind of behavioral science, you know, psychology, sociology, economics perspective, and start deploying that to our consumer base. And, you know, really trying to get them to, you know, to adopt more 2FA or, you know, move from SMS to, to push or hardware token depending on their, you know, individual threat level, for example.
And so I think that's an area we're gonna be focusing on in the next year or so is really taking what we've learned for the past two to three years internally, and then deploying that externally to our consumers.
How do you make that like... We've talked a lot about internally focusing on gaining trust and creating this culture of security. And I think that that's one thing to do internally, right? But it's a whole other thing to do customer facing. And I think I'm curious, how do you approach making security seem feasible and attractive to customers?
I think it's a it's a multi pronged approach. So we need, for example, and you see built into our product marketing. And so as we launch new products, as we, you know, do what any company does and try to get users to adopt and to utilize our products, need to make sure that security is, you know, one of the things that... That's there and really sort of making sure that those consumers, those users can sort of feel like they can trust our products and they feel safe on our products. So that's that's one way, you know, sort of marketing angle. I think it's also... We have a, you know, fairly active blog. We have... We actually have our own podcast. We have a a very active Twitter account. We do a lot of engagement with with the Bug Bounty community as well. And we try to, you know, use that to kind of build a bit of street cred in a way and kind of have a long sort of backstory of credibility in the area that we can, you know, we can then leverage and and sort of speak with authority when it comes to, you know, getting getting my grandmother to adopt two factor, for example.
Yeah. We actually... We wanted... It's funny that you mentioned this because we we wanted to talk about bug bounty with you today. I know that Yahoo pays out millions of dollars to ethical hackers who find flaws in software. And last year I heard that Yahoo announced an elite bug bounty program, and we were curious what that is and how the program is going so far.
Yes. And this is actually going back to kind of my lens on, you know, on cybersecurity. Speaking as a former, you know, former investigator, former federal agent, I see the bug bounty program as really, to use another metaphor, taking arrows out of the quiver of the attacker. And so we are depriving the attacker of a a technique of a vulnerability that they could then, you know, use to hurt our users. We're paying a a... An ethical hacker to tell us about that first. And so that program has been around for for a long time. We have launched this this new elite program. And what this does is it... I mean, we really try to approach bug bounty as a whole with a scientific approach, scientific method in some ways. And so with our elite hackers, which are 10 hackers from our our... You know, the thousands of bug bounty hackers who, who do research on our platform, We've invited 10 into a much smaller community where they get expanded scope, they get early access, they get special promotions, and we get to sort of try out things on them.
And so say, for example, we're really concerned about XSS or CSRF or something on a certain part of our platform. We can point those those hackers, the elite researchers at it and see what they find. And, you know, they like it because they're getting these sort of promotions. There's nobody else competing with them, in that part of this... That part of the program. Maybe we even give them authenticated access into an environment that they wouldn't normally get. And then we get to sort of see, you know, what happens and then replicate those findings And you know, what we get with engaging with them into the broader community of the entire bug bounty, research community. So it's been going for, I think, about a year now or so, and, been really been really exciting, actually. Really, really got a lot out of it.
So I think, first off, we see a couple different levels of engagement we have with the research community. And so, you know, the first is just general, you know, bug bounty hacking on our platforms. Our scope is there. We also run bug bounty live hacking events. And so in those situations, sometimes they're in person. And then we'll actually bring hackers into a, you know, a central location. We'll even like, you know, we'll engage with them. Like, I've gone to some of these events. I've talked to them in person. We'll have our developers or engineers who work on the products kind of talk to them. And so, you know, the hackers are learning about our platforms, but then the, know, you our engineers are learning from them and thinking about, you know, how do hackers think and what are they after and, like, what motivates them. And so it's it's really valuable, I think, both ways. And then, of course, there's the elite program I mentioned earlier as that sort of third dimension. So, you know, the... I guess, the value of it, again, so yes, we are sort of depriving the attacker of those weapons, those sort of cyber weapons they could use against our users.
What happens when you find something that went to production, which means people maybe on your team throughout the company missed something? I've heard conversations a lot about like, the right way to approach that, right? Because if you come out with, how could you have missed this? That can potentially create an environment that's not the best for security. But also, it's really important to make sure that those things aren't missed. So I guess my question, what is your take on that? How do you create a security environment when you're responding to things that were missed in security checks?
Yeah, I think, you know, it's important to not shame people. And so you don't want to say like, how could you miss this? Or, you know, what what happened? Why why did you commit that code? And instead kind of... We use it as a learning experience. So how did our controls miss it? So, okay, a developer may have committed something, and got, you know, pushed to production that was, that was vulnerable. But should we have caught it ourselves with our, you know, our code scanning and our other controls we have? And so, you know, we first look inward, what did we miss? And then we might circulate that as a as a new type of, you know, just in time learning that we can do. And so if a developer is committing code, maybe we can do a pop up, like, right at that code commit and say, hey. You know, almost like Microsoft Clippy. Right? Like, it looks like you're, you know, about to SQL injection. Well, to to avoid that. Yeah. You know, it never it never gets old.
Opportunity to engage. And, you know, maybe it start... It sparks a conversation where, you know, we're like, hey. What else are you up to? Oh, it's interesting. You're you're you're working on that product. We had no idea. And, you know, it kind of becomes a more deeper relationship we can have with that, you know, team, for example. So lemons from lemonade, I guess.
So shift... I think there's so many... So much insight you can gain from a program like that. But shifting gears a little bit, I wanted to just sort of ask a more general question around individuals who might want some advice from you, if you would be willing to share how they too could become a CISO if that's something that they wanted to do.
And I'm stuck with it. It's it's super... I mean, to, you know, to be fair, it's very rewarding. I love I love this work. I love this team. But, you know, it was never my sort of career aspiration to become a CISO. I actually, on multiple occasions, was like, I love cyber defense work. I love investigations. I love getting my hands dirty in data. I don't want to do anything else besides that. But there come points in, you know, everybody's career when, there's an opportunity to take on a little more scope, take on a new project, take on, you know, a new team or something, or or you see a problem that needs to be addressed. And, you know, you raise your hand and say, hey, we should we should address this problem. So an example, I was hired at Yahoo almost eight years ago to build and start the... What's... We call our eCrimes team. That's our cybercrime investigation team. And in doing this, this was back in 2014 into 2015, we we realized it's not just criminals, like there's also nation states, there's also governments that, you know, we're also targeting our users.
And so I raised my hand, I'm like, hey, you know, maybe we should build a team that focuses on APT or advanced persistent threat actors, and got approval to do that. And then kind of kept going and then started to see, well, there's also this insider threat issue that maybe we should look at, and maybe we should build an insider threat team, got approval to do that. And so, you know, it's a combination of seeing a problem, asking, you know, basically saying, I wanna fix this and, proposing a plan to do it. But then also when opportunity, you know, happens, like say, for example, at Yahoo, the company, you know, got sold. Verizon acquired Yahoo for a couple years. And when that happened, a lot of people got really nervous. You're like, oh, I don't wanna work for Verizon. I'm out of here. And they didn't wait around to see, like, would it be okay or not. And so, you know, that that creates opportunities for people who decide not to leave to say, well, I'll take on a little expanded scope, I'll I'll fill in and do some of those duties of people who left.
Awesome. I love that. We just have one last question for you. It's the question that we ask everyone at the end of the show. Feel free to answer, say as much or as little as you'd like. But what is something that we wouldn't know about you just by looking at your LinkedIn or other online social media profiles?
And and the street I grew up on. And... Yeah. That's right. Yeah. So I think... Okay. So I might have mentioned... I might have hinted a few times that I'm kind of a nerd. And, one thing you probably wouldn't know from my online presence is that I recently got into, and this sounds so nerdy to say. I recently got into, again, board gaming, which is like tabletop board gaming. There's this game called, Warhammer 40K that I used to play when I was literally in high school and, like, early college, and have dropped it for twenty years. And I was like, I need a hobby. I need something to do that isn't, like, you know, work and family and, like... I love those things, but I also need something that's, like, my own thing. And so I literally, a couple weeks ago, bought, like, a set of, like, Warhammer models, and I'm, like, assembling them and gonna play nerdy games.
That's awesome. Honestly, you're in good company. I don't think that's that's not even nearly the most nerdy thing that I've heard in the last week. So
I'm so I'm a I'm a former D and D player as well. And my son who's eight, within the past year has started to play, once a week on Zoom with his friends from school. I'm just... My heart just, like, grew, like, three sizes. And
Sean, thank you so, so, so much for chatting with us today. This was really cool. Honestly, I feel like I could have kept talking forever. So thank you for for sticking with us and chatting with with us for for quite some time today.
If you like today's episode, please give us a five star rating and subscribe wherever you're listening to this. It'll really help us get noticed on your favorite podcast platforms. Also, share this episode with your friends. And if you haven't already, make sure to check out all the other really fascinating people that we've already interviewed. We're also open to suggestions. If you know someone we should be talking to, drop us a line at we'[email protected]. That's we're [email protected].
WE'RE IN is brought to you by Synack. If you're looking for on demand continuous access to the world's most skilled and trusted security researchers, you can learn more at synack.com. Synack recently launched its Empower Partner Program so that partner organizations can more easily offer the Synack Pen Testing platform to their own customers. This approach helps optimize Synack partners' technical competencies and allows them to better integrate Synack into their portfolios. It's a way that partners can win new business by adding continuous best in class solutions to cybersecurity, cloud, and DevSecOps offerings. Synack partners with organizations around the world to make them safer, more resistant to cyber attacks, and more capable of finding and fixing dangerous vulnerabilities before attackers are able to exploit them. Learn more at synack.com. That's synack.com.
