Crossroads: Where Privacy & Compliance Meet | DataGrail Summit

Crossroads: Where Privacy & Compliance Meet

Moderated Panel

Participants

Privacy. Compliance. Security. These terms are often used interchangeably. However, while similar, they aren’t the same. Hear from three industry-seasoned CISOs about how they define each term, how and where they intersect to execute on privacy, and where legal fits into the mix.

Chris Deibler (00:13):
Hi, how's everyone doing? We have the comfy chairs apparently. What's everyone's energy level? We want to make this spicy or smooth?
audience (00:22): Spicy.
Chris Deibler (00:23):
It's been my life's dream to stand in front of a crowd and everyone yells spicy, so thank you for helping me accomplish that. Notes. Okay. Hey, I'm Chris Deibler. I'm the VP of security at DataGrail and I'm here with Ty and Matt and we are here to change the topic entirely and talk about the intersection of security and privacy. And in this case of course, compliance, which is what makes this great.

Ty Sbano (01:27):
Perfect. Hello everyone. Ty Sbano. I've been doing this for about 18 or 20 years depending on how you look at it. Functionally, I started out in consulting and then I pivoted over to financial services, so JP Morgan Chase, Capital One Financial. I was there when all the mobile experiences started to emerge and everything went to a much different experience of how we interact with the web. I went to Target for about a year. I ran immediately away after 365 days, out here to the Bay Area to get back to FinTech and then eventually pivoted down to startups where I really wanted to be. So I joined a data analytics shop called Periscope Data. We were acquired a year into the journey. Whole bunch of fun stuff happened. You remember the pandemic.

Matt Hillary (02:33):
Thanks, Ty. I'm Matt Hillary. I'm the Vice President of Security and Chief Information Security Officer at Drata. I've been at Drata about five months now. It's been a very eventful five months. Prior to Drata, I've been the security leader at a number of companies, both big, small, public, private. Just a little about Drata. Drata is a security compliance automation platform, helps you automate all the painful parts of a compliance program and saves you a lot of time and it's helped enhance a lot of programs along the way.

Ty Sbano (03:00):
You know what's cool? I talked to his founders before they looked for him and then they found him and it's been cool to go back and say, "You found the right guy."

Chris Deibler (03:09):
All right, so the topic is the intersection and compliance is kind of the new element that we're bringing to everyone here today. We'll start with a softball, which is basically tell us how these different silos report into the executive stack within your organization. And then also why did it wind up that way? Was it organic? Was it a choice? Again, left to right.

Ty Sbano (03:32):
I'm happy to start this one. When I joined Vercel, ultimately privacy was just kind of floating. In my past shop in an early stage series B, it was also a floating narrative, but also GDPR was new, so I had some experience around the privacy domain. I think the intersection between security and privacy as well as trust really worked themselves into the same category of teams and resources that go have the conversations with engineers. So within my world, it actually started with, I joined. There was a head of legal, that person said, "I would like privacy." And I said, "Hello, I'm our CISO. I have no idea what any of this looks like yet, but I'm going to dig in." I already knew my security program was going to be a lot of work. So I said, "By all means have privacy."

(04:14):
Well, 90 days after they said that they were no longer employed there, and I said, welcome back privacy. Let's do this together. And since then I've hired two great people, Kacee Taylor, Sabrina Benassaya, as part of our team to really next level how we think about privacy first analytics, privacy first front end clouds.

(04:54):
And it allows our team to fundamentally, again, interact with engineers as things are being designed, as analytics are being created from data sets that we're like, are we comfortable surfacing this for our customers? And if so, how does that actually work? So it ends up becoming a real paradigm shift for the organization as we went from more just a front end cloud developer experience to now, how does privacy fit into the narrative? So it's been extremely, extremely exciting.

Chris Deibler (05:20):
So you loved it and you let it go and it came back to you?

Ty Sbano (05:24):
It was meant to be.

Chris Deibler (05:27):
Matt.

Matt Hillary (05:28):
No, it's been organic at every company I've been at. I think Brandon joked earlier about, hey, we're going to do rock paper scissors with the chief legal counselor and say who's got privacy? I think now it's morphed into a more mature conversation to say, hey, privacy is important for us, it's important for our customers. We want to make sure it's owned wholly. And so at Drata, when I joined recently, sat down with our VP of legal and said, hey, same conversation. There's this organic marriage between legal and security in general, one that you want to have a very strong and just competent relationship with them.

(06:05):
Right now I do act as our DPO. That was a very intentional conversation, but it was one that needed to be had to say, hey, what makes sense right now? I do see that organically changing over time depending on what's happening, but right now we have actually two members of our compliance team, they actually own managed privacy for us and really care about our customers.

Ty Sbano (06:25):
Yeah, one interesting aspect of where we're at in Vercel's journey, we had that legal person I mentioned, since then it's scared some people of introducing a legal entity internally. So we don't actually have legal counsel inside. We have external counsel, we have trusted partners that we really appreciate. Luckily Kacee has a JD and we just go point to her and say she's our lawyer for the day. But in reality, it changes how you interact with legal.

(07:11):
Because it's someone from the outside in, we actually have to play to that business narrative as well. Because they're not going to fundamentally understand the workflow.

Chris Deibler (07:21):
Speaking specifically to the compliance piece of it though, at the end of the day, if you bounce on the compliance regime, does that go accountable to you? Do you also own those?

Ty Sbano (07:21):
Yes. I think for me it's security, compliance and privacy, IT and trust and safety.

Matt Hillary (08:21):
Yes, absolutely. Just like Ty explained, I look at those same directions. We have IT, we have compliance and privacy, we have security as well. There is significant overlap.

Chris Deibler (08:45):
I've referred to security organizations in numerous past lives as the silo of care of last resorts or the place where broken toys go. If there is a risk to an organization for the very large capital R definition of risk, and that risk is not owned, security people can be expected to just pick that up because someone certainly has to care about that. And we should talk on that more.

(09:21):
Which is just about we speak risk. It's our core language in security folks. And so it makes a lot of sense to bring privacy into the thing. Hey, what is the risk of having this data? I think we talk about the difference between security and privacy a lot in the sense of security people say, hey, give me all of your data.

(10:08):
And in that lifecycle, people can ask, hey, what do you have? And so it adds that extra layer of complexity. But honestly, when you talk about building trust with other people, that level of transparency I think helps establish and maintain that.

Chris Deibler (10:20):
Is there a conflict in your head between the security response of, please encrypt this, versus the privacy response, which is please stop collecting this?

Matt Hillary (10:30):
It's almost like the same question as, hey, does security equal compliance? Does compliance equal privacy and does the privacy equal security? That whole spectrum. I think they're all intertwined in an ecosystem...

Ty Sbano (10:48):
I'm very well aligned. I think there's the concept of the Goldilocks principle of what is the data that's just right for the organization and what did we disclose as part of our privacy policy...

(12:25):

Speaker Notes: