Meet the experts who power Synack’s strategic security testing platform. Our Synack Red Team unites over 1,500 of the world’s most skilled and trusted security researchers, who work with patented technology to deliver best-in-class offensive security testing on a continuous basis.
Google Cloud Evangelist Stephanie Wong on “blameless” security culture
Guest:
Stephanie Wong
Published:
Updated:
Duration:
43 min
Episode summary
In this episode, Stephanie Wong, head of Google Cloud Developer Engagement, explores Google’s security culture, why it conducts “blameless” postmortems after security testing and how it’s working to dispel lingering misconceptions about the cloud. She also talks about her journey in Silicon Valley and how her experiences winning pageants such as Miss Asian North America 2020 helped her become one of today’s most visible technology content gurus.
Learn how to build an effective cybersecurity culture within your organization.
Get the inside scoop on the security precautions that Google takes with its physical data center.
Hear about what Google is doing to overcome misperceptions about cloud security.
Figure out how to conduct security postmortems the Google way.
If you don’t know about the “pancake principle,” you’ll find out why it matters, and how it can work for you.
Zero trust reauthorizes every interaction BeyondCorp began as an internal Google project so employees could work from untrusted networks without a VPN, with every interaction between user, application, and infrastructure reauthorized.
Customers still own a large share Under shared responsibility, the provider handles items like secure boot, encryption, and DDoS protection, while customers configure firewall rules, routing, identity and access management, and trusted container images.
Least privilege applies physically too In Google data centers, badge readers at every access point limit people to the layers and times their job requires, and doors left open too long trigger alerts to prevent tailgating.
Blameless postmortems after every test Google hires unannounced adversaries posing as exterminators or delivery people, then reviews results without pointing fingers so the organization can improve.
Structure security talks as a story Stephanie uses a five point argument model: set up the challenge, cover a few key areas with evidence or a demo, address caveats, and end with a call to action.
Topics covered
Cloud Security
Security Testing
Notable quotes
…having a blameless culture, No pointing fingers. If something goes wrong, it's all about how can we improve as a whole.
We wanna see that the users are actually the strongest link here.
But if people aren't also rallying for it and understand the value of that, then it can only go so far.
…the first one is that least privilege is the rule to live by.
Questions this episode answers
What is BeyondCorp?
BeyondCorp is Google's implementation of a zero trust model, where each interaction from user to application and from application to infrastructure must be reauthorized. Stephanie says it lets Googlers work from untrusted networks without a VPN. Read this section
What is the shared responsibility model in cloud security?
It divides security duties between the cloud provider and the customer. The provider handles hardware, encryption, and network protections, while the customer is responsible for firewall rules, routing, access management, trusted images, and company culture. Read this section
Why are companies hesitant to move to the cloud?
Leaders have invested heavily in existing systems, worry about trusting a provider, maintaining governance and compliance, data privacy in multi-tenant environments, and data locality rules for regulations like FedRAMP, HIPAA, and CCPA. Read this section
How does Google secure its data centers physically?
Through least privilege badge access at every point, anti-tailgating alerts, circle locks with iris scans, an isolated secure loading dock, tracking and crushing of hard drives, and unannounced red team testing. Read this section
What is a blameless postmortem?
A review after a test or incident that avoids pointing fingers and focuses on how the whole organization can improve. Stephanie says a culture of fear makes people less likely to stay or improve. Read this section
About the guest
Stephanie Wong studied communication studies at UCLA with a minor in digital humanities and worked as a sales engineer at Oracle before joining Google. At the time of recording, she is a senior developer advocate at Google, creating videos, podcasts, and talks about Google Cloud. She won Miss Chinatown USA 2016 and Miss Asian North America 2020.
Stephanie talks about her journey from entertainment into the tech industry. She gives advice on how to create smart and effective content about the cybersecurity issues today, including protecting the cloud.
WE'RE IN is brought to you by Synack, the premier crowdsourced platform for on demand security expertise. Synack delivers twenty four seven testing, intelligence, and vulnerability management from a global network of researchers whose work is enhanced by smart technologies to accelerate your critical cybersecurity missions. And now here are your hosts, Bella and Jeremiah.
You've got a really interesting background that we've, you know, taken a look at, and you've got on, you know, your website, stephrwong.com, and just tons of tons of cool stuff. And and I'd like to maybe touch on a couple of those things if if you're cool with that, which is, you know, one of those is, initially, you started off, you know, going towards the direction of entertainment and production. And so I'm just kinda curious how you went from, you know, that direction over to shifting into technology and what the story is there.
I did not expect to be where I am today at all. So maybe I can start with where I began. I went to university and like many students, I did not know what I wanted to do. I was very indecisive and in many ways I still am. But I ended up going into communication studies because UCLA was known for that. And I was interested in entertainment and production because I just love all the jazz around it. And I also was interested in the theory of interpersonal communication and understanding how humans interact. So that was a natural fit for me. And in the midst of it, I also did a minor called digital humanities, which is a brand new field intersecting humanities and technology. And so it was about modernizing the practices of how we analyze various fields within humanities, whether it's history, art, etcetera.
And so I did a few projects around social media analytics in relation to various events that were happening around the time, live events. And so I would take data from Twitter, API, and Facebook, etcetera, Reddit, and try to see if we could do any sentiment analysis around it. And so I gained some hard skills and some technical skills to... Through that, but I was more interested in the application of the technology and how it impacts society at large.
Absolutely. It's a very interdisciplinary field and that's why it's so new. Think because, you know, these practices have been more traditionally analog and pen to paper. And so now with the advent of more digital means of collecting data, they wanted to introduce information systems and information studies into the field. And so it's it's really is a mix of all of these various areas.
Yeah. And ironically, I did one of my projects back then on Google Glass and how it impacts society, how augmented reality impacts society. And so I did a whole thing on that, not knowing that I would ultimately, like, actually be working at Google one day. And I think Google's actually refocusing some efforts on Google Glass because I know it was on hiatus for a while. But, yeah, it kinda came full circle.
You won the the miss Miss Asian North America twenty twenty and the Miss Chinatown USA twenty sixteen, and you've participated in a number of other events like Miss Chinese International twenty seventeen. I'm wondering how that ties into what you currently do.
I don't consider myself a pageant girl or, I guess, in the stereotypical sense and did not, again, expect to go into pageants at all. But once I graduated from college, so to kinda connect the dots here, I ended up working at Oracle for a couple years and I was a sales engineer because it did combine my skills of communications and technology. And so it was a great fit at that point too. And at the time I felt like, well, I love side projects outside of work. I love a healthy work life balance. And so when I knew that they were accepting applications for Miss Chinatown USA, this is something I had always looked up to when I was a child because the winner sits on the float at the end of the parade for the Chinese New Year parade every year in shining lights and glitter. It was... It... You know, it's just one of those childhood things. And so I was like, you know, I'll just supply and see what happens. And it was absolutely wonderful experience.
I met so many talented women from technology, real estate, medical field. I mean, these women are accomplished and it really pushes yourself to go outside of your comfort zone, be on stage in front of hundreds of people and ultimately be a huge ambassador for your community because it is a representation of your culture. It brought me so much closer to my heritage and I was able to participate in yearly events around the community in San Francisco and beyond. So tying between that pageant, Miss Asian North America, Miss Chinese International, all of these really expanded my horizons and brought me closer to my culture. And I think that comes out in what I do today, which is being a developer advocate at Google. Not only am I talking about technology on on camera all the time and running podcasts like this, but I travel, I empathize, and I listen to, and I communicate with our developer audiences to make sure that I can understand their pain points and their experiences.
And so I think having that broader cultural experience and having those listening skills as well as the communication skills on stage all come full circle. And I think, they they culminate in how well you can do your job as a developer advocate.
I was initially unfamiliar with the Google Cloud video series that that they've produced. And since then, I've become very familiar with them, and I've watched several of the videos that that you've created in collaboration with with Google Cloud and and that that you've added instructions on. And you just have a plethora of videos that are currently available even on YouTube right now, and they're so eloquently presented. I think I've... They structured them really well, and you have such a persona that's that's wrapped around that. And I feel like, you know, those are executed really well just, you know, from the ones that I've seen so far.
Thank you. I I cannot take all the credit for that because I work with a fantastic team. It takes a village as you might know, especially in the last year having a film at home. Yeah. We have a fantastic team that helps with the production. But I also attribute a lot of the support to my broader developer relations team that helps create content and has helped coach me and guide me on how to write stories for technical audiences at the end
Yeah. So a developer advocate, our mission is to drive customer success by winning the hearts and minds of developers through inspiring and educating them about Google Cloud. And so this can take the form of our largest conferences, podcasts like this one, speaking on stage, creating technical videos, how to's, and interviews. And for me on my team, we're specifically focused on scalable online content. So that means videos, podcasts, tutorials, but it's not limited to that. I can also do conferences, talks, anything really to outreach to our community. And so I've gone through many, many rounds of writing my own talks and podcast episodes and various videos for audiences of different levels of depth depth. Other DAs may also be focused on building product demos, sample applications, integrations with our product, client libraries, tutorials, and overall supporting our product teams with engaging with our developer audiences.
I think it's making me realize how helpful it would be to have, like, a a human person there to assist you with learning how to use new tools. Like, I've never personally worked as a developer, but I have been around technology tools in my career as a security engineer. And I'm just now thinking about, like, imagine how much easier it would be to learn all technology if there was, like, a human face being like, here's how it works.
Yeah. I know. It's kind of a relatively new field because there was engineering and there was sales and there was marketing, but there wasn't really a source of trusted information or people to go to as a developer or a community that wasn't marketing the material. You wanted someone that you could really engage with and could empathize with your concerns. And you also want a representative to build the community from the ground up, for products that are just starting out.
So there's been a lot of emphasis on cloud adoption recently, especially this past year when everyone has started to work from home or at least more people have started to work from home. How did that shift change the way that you have talked about cloud security?
Well, to be honest, it hasn't changed how we talk about cloud network security or cloud security too much, especially given Google's model and how we approach security. But if anything, it gave it more urgency, especially when it comes to endpoint security or creating a secure software supply chain or how to ensure you have secure policies in place for moving your code into production. And just to give some background, obviously, there was a very unplanned and rapid shift to remote working. And that meant that, you know, CIOs and CISOs had to work quickly to counter all of these risks before the adversaries were able to capitalize on them. And so it's become really clear that remote work will be a very defining characteristics of the new normal, and modernizing security is going to be imperative.
And so I guess just to start from an endpoint perspective, we have devices everywhere and people are joining from mobile devices and we have generally less control or at least less centralized control. And so CISOs today are using this as an opportunity to modernize because they want it to go in that direction anyway. And so if anything, this was the acceleration that they needed. At least from Google's perspective, we've always had this model in place where we have a zero trust model. And so this is something called BeyondCorp Enterprise. And it's because our teams are really horrified by network based security because network based security is hackable even with two factor authentication. And so BeyondCorp is Google's implementation of zero trust model where every single interaction with your application from the user to the application and the app to the other infrastructure all the way through, they all have to be reauthorized every time.
And this all began as an internal Google project to enable every employee to work from untrusted networks even without the use of a VPN. So now this is used by pretty much every Googler every day to provide user and device based authentication and authorization to our core infrastructure and every single corporate resource. And so the three tenants that exist here are we have to publish applications behind web proxies. We want to make sure that we know everything about the user, the location, the device that they're using. It's key to understanding, you know, any abnormal behavior that might be happening. And then on the client side, we have a lot of security features built into Chrome. So we have an in-depth view of the client side as well. And I think it's like about finding balance too. You don't wanna create too many friction points for a user where they have to have a a much
Yeah. A much worse user experience. So it's a it's a balancing act. Can you talk a little bit about why it's important to adopt a zero trust model with a network based model where you have a layer of VPN? If somebody were to circumvent that, you are essentially opening them up to the world of possibilities of still accessing corporate resources. And so you're essentially adding more checks and balances in place so that you have policies at every layer to reauthorize the user, making sure that they are within the allowed access control for every single application that they face. And so this is really just, I would say a more sure way of protecting your corporate resources at every single layer down to the infrastructure.
And then you mentioned that there are definite security concerns related with to cloud adoption. And we talked about all of the different endpoints and all the different devices that users are now connecting to a corporate network from. Are there any other risks associated with the cloud adoption?
Yeah. Specifically with cloud, a lot of leaders today are hesitant to move to the cloud for a number of understandable reasons. If you tell people to just simply move their resources to the cloud, rip and replace doesn't really resonate with many company leaders. And they'll probably tell you to just get lost because it's a very high investment. And they've already invested a lot in their existing systems like Active Directory, Okta, whatever they're using, right? And so I think one of the questions we wanna ask is how can I enable my team to work effectively without impeding on their productivity, creating friction, as I said? And another cloud's concern is how can I trust the cloud provider to manage these systems on my behalf? As cloud systems grow, you're moving more applications to the cloud. You know, companies are very concerned about integrating their security practices into their own cloud environment and sort of moving a little bit more of the responsibility to the cloud provider.
And the other concern that pops up is as an IT administrator or a cloud administrator, how do I maintain governance and control and compliance with regulations that I need to comply with? So it's all about the way you approach security in an on premise environment versus a cloud environment and really understanding the nuanced differences between the two. Lastly, data privacy. I think there's concerns around, you know, is my data really private in a multi tenant environment in the cloud? And lastly, can I comply with the regulatory compliance like FedRAMP, HIPAA, CCPA? Can I keep my data in one location? Because some of those require data locality requirements. And so there's a lot, a lot, a lot that goes into it that our cloud engineers are are having very in-depth conversations with customers about these.
How are you all trying to help, you know, not only inform people about the risks, but also arm them or educate them on the information they need to keep their systems and or cloud data secure. How do you all approach that?
It's a challenging space to be in because security is something that you have to attack from many angles, whether it's for developers, your cloud security engineers, and also just typical data users, data analysts, people who are leveraging the information in your cloud environment. So what we try to do is we create content that both underlines the clear risks and challenges of it, yet also tell a new story. You don't need to rip and replace. You can actually use existing tools and integrate new cloud security protocols and tools. So, you know, your existing security posture may not be leveraging some of the latest and most secure technologies and approaches that we can help you with. Let me show you how. So it's really more about enabling your users and flipping the message of friction on your users. We wanna see that the users are actually the strongest link here.
Websites, phishing in emails, etcetera. And then if it's like the develop... Development tools, like, show them the tools, educate them with your views, and just be a little bit more fun and a little bit less serious if it's possible.
There's a whole lot of effort that goes into that on the back end and trying to think like the user and trying to figure out what it is they would do and how they would do it. How is that... How does that tie into some of the earlier skills that you've developed from the psychology and sociology perspective?
Every time I create a new piece of content, I'm thinking, okay, how can we hit the main points of what I wanna talk about in terms of the technology itself, the concepts that I wanna teach here, but how can I intertwine a story into it as well? And so that's sort of how I bring in, you know, more of that perspective and communication psychology skills into it. But if you're talking about, okay, how do we guess what the user or the audience is looking for next? What do we know about them? How can we anticipate the types of skills and the messaging that they wanna hear from? I think it's really about treating the... Treating your content like a blank canvas. Like, if you were in their shoes, what would you wanna learn about in your cloud journey? It's about encouraging people to understand a new cloud model. I think I... Being in Silicon Valley, we're often in a bubble where we assume that a lot of people already understand these concepts or understand the value of cloud and what it brings.
But in reality, a lot of enterprises, organizations, and even students are still just learning about the value of the cloud and how it can actually increase your security posture overall as opposed to you trying to undertake a new security project overall for your own organization. And so it's like, how can we convey that it's not about jumping across the Grand Canyon but about creating stepping stones to get across and build trust by explaining that, you know, the decades of experience that the cloud provider might have in fortifying your systems, you know, that can help you. And we as developers, me the content creator, myself can understand and empathize with the developer and the IT leader concerns because we've been there. So it's all about just being an author, a storyteller, putting yourself in their shoes and just getting rid of the ego, getting rid of the walls and just saying, this is me one to one telling you how I would want to to learn this information.
I wanna talk a little bit about the shared responsibility matrix. Can you explain what that is and why it's such an important thing when it comes to cloud security?
So security for things like data classification or network controls and physical security, they all need very clear owners. And the division of the responsibilities is known as shared responsibility for cloud security. And cloud often handles a lot of it like using a secure boot stack and the machine identity on our hardware or the cloud provider's hardware or handling data encryption at rest and in transit all the way to handling the robust network that can absorb DDoS attacks and give you the monitoring and the alerting capabilities so you can immediately take action. And the cloud provider may also be creating many default settings on your cloud environment to protect your environment from things like any unwanted traffic ingress.
So anything like default deny ingress traffic to your instances. But there's a huge part of it that is still your responsibility. It's up to you to deploy your own firewall rules, build your own specific routing tables when you want your traffic to go to particular instances, set up identity aware proxies to further protect your applications based on identity and context and even ensuring any container images that you deploy are trusted by using something that we call binary authorization. And then finally ensuring that your organization and the people that make up your teams reflect the security protocols you expect. So it really goes all the way through from the technology all the way to the culture of your company. And holding up your end of the bargain with a shared responsibility model is obviously easier said than done.
And that's because your responsibility will vary depending on your workload environment, your own requirements, what compliance needs you have. But there are definitely a lot of best practices we try to teach and impart on our audiences. Like for example, easy things that you can do right off the bat with security are setting up identity and aware... Identity access management. And that's hugely important because it's about choosing if you want to manage and rotate your own encryption keys to store data, choosing who accesses the resources, choosing which teams will have overarching control over which level of resources, who is gonna be the first one to respond to security alerts, choosing which teams will review postmortems. Is it gonna be the Cloud Admin team? Is it going to be the network engineering team? Or do you have a dedicated security team? So as you can see, there's no silver bullet to security as we like to say.
You need constant revisiting, iteration, learning. And if you need to comply with any compliance like HIPAA, for example, sometimes you do need to ensure that you're deploying your own practices in your cloud environment. There's also a checklist of items that you should do when you start designing your systems. We often recommend that developers and security engineers should collaborate and sit closely together to ensure that one is not, you know, deploying resources out of sync with another's
Yeah. I have a little bit of background and a whole lot of interest in threat modeling, And this totally reminds me of the threat modeling perspective of making sure that you understand where everything is connected and and like this idea of, okay, how and who will be using these assets, these pieces of technology that you're connecting, just kind of like almost checking all of your assumptions, which it's interesting to hear that as... Or to talk about that as such an important part of cloud technology because it's not technology in in some sense. Right? It's interpersonal. It's humans. It's all the ways that us wonderful humans can introduce errors, but it's such an important part of the design.
As much automation as you can build into your development life cycle, there's still always going to be a human element to it because you could automate and add checks and balances policy, binary authorization, make sure you have a secure software supply chain. But if people aren't also rallying for it and understand the value of that, then, you know, it can only go so far. So I think, yes, automation first and foremost, move security to the left in your development life cycle as we like to say. But it's all about building a culture around security really.
You have to implement that security as a culture. The start of doing that is to review your corporate policies for humans and how that layers into what they do from from a systemic, you know, corporate culture around security.
Yeah. I was talking to the CISO of MongoDB months ago, but she also was telling me that she was making sure that every person within the company felt like they were... They had an ownership in ensuring a secure culture, ensuring secure practices in the day to day of what they did. But also, I think they said that they had champions on Teams and they had a champion team for security folks from various departments, not even necessarily security departments, but any other business departments too and areas of function. And so it's just all about making sure people feel ownership and it's it's... It really permeates the company.
There are also physical security risks associated. I know you've spent some time touring cloud storage facilities. What was that like and what security lessons did you take away from that?
Yeah. I got a very rare opportunity to visit a Google data center, which was such an amazing experience. It was like the pinnacle of my time at Google. And so I got to really see the security practices at a Google data center, at least from a physical perspective, which was awesome. It's like more secure than an airport in some cases. I think some of the people who work there in the military, they've seen a lot of various practices in the past and they were like, this place is more secure than military facilities. So that was really cool. But, the lessons that I took away from that for sure, the first one is that least privilege is the rule to live by. And this goes for cloud resources that you deploy but this goes for physical access points too. There are two rules strictly enforced at all times at Google data centers, which is least privilege.
This is a protocol and the idea that someone should have only the bare minimum privileges necessary to perform their job. So if your least privilege is to enter this section or layer two of the data center, then you will not have luck moving to layer three. And so each person's access permissions are checked at badge readers that exist at every single access point to gain access and permissions. And it could be time constrained too. So maybe your access is limited to an hour so that you can perform your duties and drop something off and then you get locked out after that. And there's always someone watching. So, yeah, you can't really slip by. And then the other rule that exists is to prevent a vehicle or individual closely following another person through a door. So if the door was open Tailgating? Yeah. And so it's if a door is open for too long, for example, like somebody is alerted immediately.
And there's also these circular doors that you... And one person can only enter at a time. And I got my irises scanned. I had to check my badge, and then the other side of the the tube will open. It's almost like Star Trek. It's like you enter this tubular circle lock.
There are certain facilities in the DC area for the government that also have those, which are excellent. I love them. And I always feel super cool anytime I get the opportunity to go through them because I'm like, yeah, going through a Star Trek.
I mean, you don't exactly get beamed up, but you do... The other side opens and you're suddenly in somewhere very secure. Yeah. And in my case, was the data center floor, which is where all the servers are. So that was really awesome. The other couple takeaways from that experience where bad badge checks are super important, you know, about dual, dual authentication or two factor authentication. So, you know, when you try to sign into account, you might have a one time password sent to your phone. We take a similar approach at the data centers to verify a person's identity and access. So at some layers of the data center, you're required to swipe your badge and then enter a circle lock, which is this tubular doorway. And that also checks your eyes or scans your eyes for biometric data to make sure that you are the person you say you are. And then there's also another secure area called the secure loading dock where shipments are shut or where shipments are sent.
And this is a special isolated area. And that's where they use this room to receive and send shipments of materials like new hardware and new servers. All the truck deliveries go there and you have to be specially authenticated or authorized to go into this room. And so if you are someone who just works for the shipment vendor, then you can just go directly there. And then the last part that was cool is that all hard drives are meticulously tracked. And so hard drive tracking is very important to the security of data, of course. They all contain encrypted sensitive information. And so Google meticulously tracks the location and status of these hard drives from acquisition to destruction. And so throughout the life cycle, if they deem that, you know, it's can't be recycled and, you know, it needs to be decommissioned, then they will use this giant machine that essentially crushes all the hard drives which I got to witness and just all these shredded pieces falling out.
So that was fun. And then the last part is this testing program. So we actually hire unannounced skilled adversaries to pretend to get into the data center.
That's the best. Exactly. I'm like imagining people sneakily just rappelling off a helicopter into the data center. People have asked that on the YouTube video that I made about it. Like, what happens if someone just drops into the data center from the air? And I'm like
That's that's exactly what Bella and I do when we go in and and we're gonna be conducting an assessment on a building. We rappel in. And one, I'm flying the helicopter too. Once we get there, we put it in automation mode, and then Bella and I just rappel in.
It is interesting that you say that because, like, I I can tell that I really... That I'm a security person. Right? Because the whole time that you were talking about all of this, I'm I'm literally thinking like, I wonder, like, what would happen if... Like, what if... Do do people think about this? Not that I have any good ideas, especially about that about eye scans. That's definitely not my area of expertise, but it is I think like I'm just thinking about how I've been in this industry just long enough that that's all my brain does now.
Oh, yeah. Don't you love being in tech? That happens to me on a daily basis. But yeah, the data center experience was super fun. We always have a blameless post postmortem after these testing attempts. So it's not like we just do them and then, you know
Disparage anyone who, you know, we just... It's all about blameless postmortems and a blameless culture. And I think that's another kind of reminder back to just the security culture that we're talking about is as having a blameless culture, No pointing fingers. If something goes wrong, it's all about how can we improve as a whole.
And I love that you mentioned that because, you know, having a culture built around education and bettering themselves is a huge importance rather than building a culture around fear and persecution.
Especially in a very high stress position or a high stress environment when it comes to security. And even when it's not a test and it... And and something does happen, blameless culture is what will allow you to progress as an organization and allow individuals to feel like, okay. Yes. Mistakes are made and we need to improve depending on the severity of it. Also, what we need to do. But at least let's not just operate in a culture of fear because that, you know, no one's gonna want to stay or improve as an individual in their particular field or domain. In a previous role, worked as a penetration tester. And some of
the most successful engagements that I had were the engagements where when I found a really cool vulnerability, the response from the customer was, woah, how do you do that? Can you explain it to me? Let's get on a call. Walk me through it. Right? Because it's that it's that culture of like, okay, cool. We've made a mistake. Let's learn everything that we can about it so that we can improve it versus the alternative, which is, no, I don't think that's right. I don't wanna hear about it, which doesn't help anyone. It doesn't lead to improvements. It doesn't lead to better security.
Yeah. I think with the recent, like, Colonial Pipeline and other attacks that have happened that have made their way to the desk of the president, you know, organizations are now beginning to take a much more proactive stance about penetration testing and hiring adversaries to hack or make sure that they can discover and uncover any potential vulnerabilities in their systems.
100% agree. If you're operating from a planned, systematic, streamlined approach that incorporates security, it's gonna be smooth and easy. And it goes to communication. Right? Communicating things effectively about technology and security so that they can be implemented, which is, you know, in my personal opinion, essential. What advice based off of your experience? What advice could you give to those system owners, those businesses, those CISOs who may be struggling in that arena?
Some of my tips around communicating or creating content really at the end of the day is about practice. One formula that works quite well in creating talks, videos, any kind of content, even short form or long form is using this five point argument model. And I know Disney uses something similar in how they create story arcs, but kind of laying the land in the beginning about the challenge space. You know, why is security important? You know, why is the... You could talk about the recent hacks. You could talk about why it's so front and center today, the amount of revenue lost as a result of being reactive in the space. And then kinda talk about, okay, this is why we need to talk about that today. Let's talk about specific, you know, three technology areas that we should invest in and why. You go into the evidence and you go into a demo perhaps, and then you wrap up with caveats, things where it's not going to specifically be relevant or maybe, you know, you...
You've tried a couple other options or routes and they didn't work out and why you're focusing on this approach. And then you wrap up with like your call to action at the end. So that formula has worked really well with capturing the attention of your audience and overall just persuasive communication.
What are those questions that you ask yourself when you're creating the content that you create? Is there any more that you could expand upon from that from the question space?
Number one question you should ask. Who's your audience? What's the pain point they're experiencing, and what am I trying to solve with this content piece or this talk? And would I personally find this interesting? Would somebody who doesn't know much about this topic understand it, and is it that the intention? And so once you kind of fine tune your audience and the level of depth and what the whole point of the whole talk is, you generally can consider the content to fall into three general buckets. And that is maybe definitions or basic laying the foundation, defining terms around the topic, like what is App Engine? What is Kubernetes Engine? Cloud security basics one zero one. Perhaps it's about best practices. That's the second category, outlining and explaining the best practices around the topic. And then the last set of questions you can ask yourself is what is the main measurable outcome that you want from this content?
Are you looking for specific behavior from your audience? What kind of change in behavior do you want? Is it a change in thinking? Or do you want their change in a sentiment about the topic that you're talking about? And lastly, can you trim this content down into something that's a little bit more problem and solution oriented? We used to have a monopoly when it came to learning. Like you said, it's like buy this thousand dollar course or this book. And that's... It's largely due to the ubiquity of a lot of online courses and everything. Now people have a lot of choice. Right? People generally prefer to learn online at their own pace, and it's more accessible than ever, as you said. When it comes to building a culture at your organization, you need to have this growth mindset. And the first step is to hire hire smart. You wanna look for people who are intrinsically driven to learn, who want to figure out what needs to be done, how to find a way to do it and do it before you even know about it.
And also teach others how to do things instead of what. And really just encourage people to explain beyond just this is what you need to know, but how can you actually achieve that? And I think the one thing that I've appreciated at the places that I've been in so far is that there's always been this culture of encouraging candor and dissent and, you know, just making sure that there's a lot of engagement and openness between one another. Like, ask me the tough questions. Ask your manager the tough questions. Question things. Go out of your formal reporting lines and discuss ideas and issues without fear. The one thing that's also been just absolutely fantastic on my current team is supporting a lot of risk taking and failing forward and failing fast. So as long as people are taking an acceptable risk and learning cultures are supporting them, even though they fail, we're here to, you know, pick you back up and it's okay.
So we call this the first pancake principle because you know when you're making your first pancake, it's like the griddle is too hot, the batter is too thick, and you're probably gonna burn your pancake. When I'm creating a new piece of content and I'm knowledge sharing on behalf of my team or I'm doing it on YouTube, it's like the first episode is not gonna be great. That's the whole point is to just put it out there. It doesn't need to be perfect. Understanding the point of diminishing returns also, right? And making sure that your team really supports this mission and this culture and practice humility and just be a team and not have individual stars kind of come out of it. My managers said something that really resonated with me, which was, if you wanna go fast, go alone. If you wanna go far, go together. The second part of my answer is about knowledge sharing as a whole.
So just encouraging one another to share their findings on your team, creating a place where you can share your wins, share your knowledge, share tips and guidance. And if you do want to encourage knowledge sharing externally on YouTube for free, for example, have a clear workflow and process for your teammates and contributors to write their own content on your company blog or just putting it up on your YouTube channel, having a podcast like this one. So just having clear ownership of these areas and and actually investing in them as a company because the best way to advocate and evangelize your product is for your employees to be the ones to create this, you know, this impactful content that is going to benefit from the economies of scale. Right? When you have individuals doing it on your on your behalf. A lot
of what you said resonated with me a lot as a... What... How do I say this? A recovering perfectionist and person person with relatively... Definitely still their social anxiety. Like, this podcast alone has been a huge way for me to kind of practice some of the things that you're talking about. And it's really the prospect of facilitate like me playing a role in facilitating other folks learning is really exciting and helps me remember like, hey, you know, we're gonna make mistakes and we're gonna learn from them.
Yes. I know. I've gone through that so many times in different parts of my career. And it's like people are like, how do you come out with content so frequently? And I'm like, well, it definitely... I didn't start this way. I had to make a lot of mistakes and trip many many times. And then finally through iteration, I was able to fine tune my process, streamline it, get better at writing, get better at hosting, get better at speaking, and then just become second nature. It's like anything in life. It just takes practice. And I think we're our harshest critic and it's just giving yourself that space and that forgiveness to do that because nobody else is expecting perfection from you.
Well, you can follow me on Twitter at Steph r underscore Wong. And my LinkedIn is Steph r Wong. So everything's similar. On my LinkedIn, you can also see links to my YouTube playlist of all the stuff that I've ever done at Google. You can also check out my personal YouTube channel, which is called Steph You Should Know. A little bit of a pun there.
This is a question that we ask every new hire at Synack. So what is one thing that people wouldn't be able to tell about you just by looking at your LinkedIn profile?
I love this question because it reminds me of, like, tell me a fun fact except it's, like, better than that question. And me and my friends have now created this list of, like, unfun fun facts that people say, and it's just funny. But I recently had this little win, this little fun fact. And my friends were like, oh, you gotta add that to your fun fact list in case someone asks you. So mine is that I recently won a Just Dance competition against 63 countries on Nintendo Switch. Oh my gosh. I was just by myself in a basement playing against 63 people from different countries. And I
But, yeah, I've been a hip hop dancer for my whole life and I haven't gotten to do enough of it during the pandemic. And so Just Dance has been my outlet. What?
I love that so much. I I grew up dancing, and I don't do it anymore because, like, what... Yeah. What... How would I? And I've been trying to convince my partner to get Just Dance for the longest time, and he's just, like, absolutely not interested.
Thank you so much for your time, Stephanie. We've really enjoyed having you on the show, and, you know, look forward to, you know, seeing more from you in the future for sure.
Cloud cybersecurity is a large penetration point for malicious actors. See how your organization can be protected at synack.com. That's synack.com. Check out the show notes to learn more.
