Michael Malone, Founder and CEO of SmallStep, Certificates, Identity, X.509, and Authentication

0:00 Jon McLachlan

Welcome to the Security Podcast of Silicon Valley. I am here today with a very special guest, Mike Malone, who [was the] founder of Smallstep. Is it founder or founder, CEO?

0:11 Michael Malone

Founder, CEO, I suppose.

0:13 Jon McLachlan

Founder, CEO. All right, you're running the show. There we go. Of Smallstep, a security company right here in the Bay Area. You actually graduated from Virginia Tech. And after that, you were a computer technician for the United States Naval Academy. [Wow], thank you for your service. Then you did some consulting work for Digital Deck. You founded Stealth Wine Co., or the CTO there. And then you did a stint as an analyst at Accenture, followed by a web developer role at Pownce. You are a software engineer at Six Apart Limited, a lead architect at SimpleGeo. And I heard some of your coworkers had some very nice things to say about you, especially that database that was developed. So that was really cool. It's always nice to see praise being shared. You are an engineer at Urban Airship, a CTO at Betable, right before you founded Smallstep. So incredible experience that you bring to the table. Welcome to the show. It's great to have you, Mike.

1:18 Michael Malone

Great to be here. Thanks for having me, Jon.

1:20 Jon McLachlan

So would you like to speak a little bit about the problem that Smallstep focuses on and how you add value for your customers and what part of the security world you guys really help with?

1:38 Michael Malone

Yeah. We are, you know, venture-backed startup out of the Bay Area, primarily, although, you know, we're hiring and remote employees are great too. And our focus is on certificate management, specifically certificate management for DevOps or open core. So our core certificate management certificate authority in the tool chain for automating certificate issuance and renewal and revocation and whatnot. It's all open source, it's all in GitHub. I'm comfortable saying at this point with a straight face that if you're looking for certificate management tooling in the DevOps world, we have the best tool chain in that space. So check it out. And we have some product built on top of that, hosted and sort of run anywhere product that extends some of the open source capabilities and provides functionality that is more enterprise oriented.

2:31 Jon McLachlan

Oh, very nice. So that is such a needed solution out there. Identity management and certificates and binding identities to certain processes or to machines or even containers is a tough problem. I would never recommend anyone try to build that stuff themselves. I suppose you could go right to the open source core, but so why not take advantage of all of the nice bells and whistles? And I assume it's delivered as a service.

2:57 Michael Malone

That's right. Yeah. And it's all turnkey. You know, you can sign up on the website. There's a free tier. So if you have a home lab or just want to test it out, you know, go ahead and sign up. And it's really the easiest way to try it.

3:10 Jon McLachlan

Very nice. I know I've bumped into that problem many times over in my career here in the Valley. And every time that I bumped into it, it was like, uh-oh, got to go hire an expert team and let them build the thing. And that was a long time ago, long before Smallstep came to the [scene]. So I'm super happy that there's now a [drop-in] solution, literally turnkey, ready to go, help with all of that stuff. So when I, when you talk about identities, maybe there's a nifty comparison between your technology, I guess your technology is just like X.509 certificate management, and the other technology that rings a bell would be that SPIFFE and SPIRE identity. So how would you, how would you compare and contrast, maybe their problem space is different from what Smallstep helps with, or there's some overlap there?

4:05 Michael Malone

There's certainly overlap, and I'm pretty close with the SPIFFE folks. I participated in at least some of their early efforts around standardization there. So, yeah, there's overlap. I'd say that SPIFFE is maybe a little bit more opinionated, SPIFFE and SPIRE, and a little bit more focused on a particular sort of containerization microservice use case, which we address as well. But I think that our tool chain has a little bit broader reach. We support the ACME protocol, which is the protocol that Let's Encrypt uses. We can issue certificates using OpenID Connect. We're a little bit less opinionated around the identity model, [whereas] SPIFFE has, you know, we're getting pretty deep in the weeds here, but I'd say that there's certainly a better together story. I see them less competitive. And certainly, it's an open protocol, and you can actually use our tool chain to issue SPIFFE-compatible certificates. So not really competitive. I think anything that [is] sort of helping people in this space is a good thing. So happy to see them succeed as well.

5:09 Jon McLachlan

Yeah, definitely. Yeah, they were recently acquired by HP not too long ago, right? So all of that, all of that work is now going to be supported by that large company. And I was happy to see that they're going to keep it open source too. You know, one of the problems with certificates. Well, actually, one of the problems that is solved by certificates is this, you know, [root] of trust: what is it that you trust? And if you have an in-house CA, you have your offline root of trust, and then there's intermediate CAs that then can issue certificates down. At the bottom, I guess we're getting, we're pretty much in the weeds now here in the technical shop talk, but just managing all of that can be very difficult. But it's really nice once you have it all set up that you have a single entity that you can trust that's offline that you don't have to worry about is going to be breached or hacked. And then it really enables.

6:04 Michael Malone

Yeah, I think that bottom turtle in the identity space can be really challenging. And yeah, just to reiterate, it's hard, but if you really wrap your head around it and figure it out, it makes a lot of other stuff easier. And I think a lot of people end up resolving that sort of bootstrapping and trust management problem sort of haphazardly and ad hoc repeatedly. And instead of having sort of one well-thought-out foundation, end up having six or eight poorly implemented solutions that are sort of [tacked] together. And, you know, I think that's bad for security and it's also just, it's harder, frankly.

6:44 Jon McLachlan

It's more expensive to maintain.

6:46 Michael Malone

Yeah. And I do think, as we get into shop talk, you know, and I'm happy to go deep on that. The other issue here is there's a huge knowledge gap. You know, public key infrastructure is not something that I think even like very educated, very experienced software engineers or DevOps people tend to have, it's not something they tend to know well. There's a gap. And I think in some cases, sort of an embarrassing gap, something that people are like a little bit wary to.

7:18 Jon McLachlan

Oh, I'll be the first to admit that I am absolutely no certificate expert, X.509 certificate. There are so many like frameworks and little pieces to those certificates. You really have to understand history to understand like how we got there and what those certificates are today. And it's, you're right.

7:34 Michael Malone

It's, it's [...]. I mean, one of the funny sort of like little background bits of knowledge there is, you know, speaking of history, [is] X.509, X.500 came out of ITU-T, which is like a telco standardization body. And if you've ever wondered why there are, you know, countries and localities [in] digital certificates that are meant for the web, where that stuff is sort of irrelevant? The answer is that they weren't meant for the web. X.500 and ITU-T was building a telephone directory, a global telephone directory. And that's what the standardization was originally developed for. And now we use it for the web. But that's what. So there's a lot of history and a lot of baggage.

8:20 Jon McLachlan

No, it's become an incredibly important standard for the web. This is how HTTPS works and mutual TLS authentication, if you want like a step above that. Now all of that's based on a huge chunk of history here, I guess.

8:36 Michael Malone

So, [we], I mean, TLS is the most widely deployed cryptographic protocol in the world. You know, there are a lot of things to not like about TLS, especially sort of earlier versions. Chances are you're already using it and you're already depending on the security of TLS. So if it doesn't work, you're already in trouble. Using more of it isn't going to increase your threat surface area, let's say.

9:00 Jon McLachlan

So, oh, and

9:02 Michael Malone

Oh, go ahead.

9:03 Jon McLachlan

Go ahead.

9:05 Michael Malone

Yeah, I mean, I was just going to sort of expand on that and say that's sort of how we got into this space. And I can speak more about the early history of the company, but we, we were originally actually working on authorization problems. It's a big story there, so I don't want to go too deep, but had a solution in that space and showed it to potential customers. And the feedback we got was basically, cool authorization product, but we don't have authentication yet.

9:31 Jon McLachlan

Oh, okay. So you had to back up a little bit, answer the question, who are you, before you could answer the question, what can you do?

9:39 Michael Malone

It's precisely, which led to, all right, what's the right default answer for authenticating components in a large distributed system? And, you know, researching that space, the answer we came up with was the right default is TLS because it is ubiquitous, because databases speak TLS and queues, and every standard library has an implementation. And so it's well supported, which then led to, okay, if TLS is so great, why isn't everybody already using it? The [...] question being certificate management is a giant thing and is really tricky to do in your distributed system. And there's no good tooling there. So here we are.

10:21 Jon McLachlan

[Yep], it's just a tough problem that needs a lot of love. And I'm glad that you were able to come along with a solid team and give it the love that it needs and make it easier for everybody, right? I know that there's a lot of trends, I'd say, out there in the security space that are completely dependent on having a root of trust. One of them that comes to mind is that zero trust business, right? So if you say that you're going to be zero trust or you have a zero trust service, usually what that means to me when I hear that is like, okay, that just means you don't have to trust like some central authority that's nebulously out there in the cloud that's disconnected from your infrastructure. Instead, there's a way to use that system to reroute the trust internally. And I usually think of a CA as being that [root of] trust internally. So whenever I hear like zero trust, that's usually what comes to mind. [It's] someone being clever with how they're going to be using certificates to deploy certificates in their system.

11:21 Michael Malone

I'd agree with you on that. I think zero trust is one of those marketing terms that is so overused at this point that it's almost lost all meaning. But it's also a bit of a misnomer since you can't actually have zero trust. It's more about managing trust. And I'd say that, yeah, what most people are doing when they're implementing a zero trust strategy is moving away from, they don't want to trust the network. They're moving away from network controls, firewalls, IP tables, things like that, to cryptographic controls, end-to-end cryptography. And if you're using cryptography, you got to manage keys. And one of the best ways to do that in a large distributed system is to use certificates.

12:11 Jon McLachlan

That is absolutely correct. That is actually what we do here at [Peacemaker]. And we did not, we very explicitly did not want to solve that root of trust problem. So we just integrated with the X.509 certificate, you know, standard, left it at that. But for a small step, maybe if we go back even further, like way back, maybe to your childhood, to maybe an experience that really made you or was fundamental in the way that you were shaped and now see the world, [that] led you to cross this bridge and start a security company, maybe a story that you'd like to share or a small piece of childhood?

12:52 Michael Malone

I think, um, I don't know if there's one defining moment in my early childhood, but I can say that there were themes. For one thing, I was a nerd. Going way, way back. And I grew up in, I grew up in Annapolis, Maryland, [...]. My parents were both academics. They both had PhDs. My mom taught at the Naval Academy, taught political science. My dad, before I was born, was an academic for a while. When I was growing up, [he] was a forensic engineer. So here he was, a real engineer, civil, mechanical, and did accident reconstruction. I thought it was the coolest job ever, you know, buildings falling down and cars crashing, and he'd fly out, figure out what happened. But it's, in a lot of what shaped me was my parents', particularly, it's in my dad and his worldview. He was into, you know, when he was teaching, he was teaching systems theory [and] engineering, which was really like looking at how engineering principles can be applied to social problems and logistical problems, like, you know, routing ambulances and stuff like that. And he was very into technology and stuff. So I think, you know, it pushed me in that direction and encouraged me to pursue my passions, which I think is like, you know, a big part of what led me to start a company is like, you know, the ability to control my destiny and what I'm working on and really do what I want to be doing in the world, which I think is a really important thing. But yeah, so that was my background. And I'm honestly not really, I wouldn't call myself a security person. I'd say my happy place is distributed systems engineering. I like building large software systems and building teams that build large software systems. And I have had the opportunity in my career, I've been lucky to do that a number of times. You went over sort of my long history of startups and acquisitions that I've been through and whatnot. But I'd been in this sort of like what we're now calling the cloud native world sort of my entire career. At Pownce, we were using S3 and EC2 when that was AWS. Like that's all they had, you know. So I've had the opportunity to build several greenfield distributed systems and to make probably all of the mistakes that you can make, most of the mistakes you can make doing that, and resolve the same problems over and over again. And one of the really hard unsolved problems that I saw myself resolving over and over again was this identity management, authentication, authorization challenges in that space. And I think there are other things that, you know, given infinite resources and infinite time, I would like to pursue that are sort of adjacent to these challenges, but this seemed like the most pressing, most immediate thing to solve first.

15:47 Jon McLachlan

That's really special. Thank you for sharing a bit about your background in your childhood that drove you to see those problems. And then the pain, I guess, associated with solving it over and over and over again and wanting to take a step back and look at the bigger picture and share the love with everybody, all of your experience and all of the blood, sweat, and tears that went into solving it over and over again. So if you see one truth in the world that most people miss, what do you think that might be?

16:20 Michael Malone

Yeah, that's a hard question to answer. I don't know that there's sort of one truth that I see that, like, I don't, I don't know that I have some like pearl of wisdom that, that's going to like enlighten people. But I guess the way I operate is just more pursuing those passions and trying to work on things that I believe in.

16:49 Jon McLachlan

Yeah. And [passionate] is important to be able to see, you know, a snippet of maybe a direction that you could take, not just what you're working on, but the entire world.

17:02 Michael Malone

Yeah. And in sort of building on that, I think like it's important to enjoy the journey, you know, and not be sort of looking to the past or to the future, but be working on something that excites you every day. So that's more how I operate. I think I'm lucky to be doing work that I find interesting and engaging. And I do sort of [try] to do what I think is the right thing and then hope that other people see it that way too and get really excited when they do. And when they don't, I guess the nice thing about operating that way is I don't have to feel that bad about it because at least I did what I thought was right.

17:44 Jon McLachlan

No, I get that. Well, one of the things that you mentioned that you really enjoy building are the teams, the teams of people themselves. What would you say is your leadership style?

17:51 Michael Malone

Oh, man. You should probably ask people who work for me, not me. But I mean, I think it's a little [...] and haphazard. But I'm an [...]. I don't know.

18:03 Jon McLachlan

If I were to ask the people that work for you, what do you think they would say?

18:06 Michael Malone

They would probably laugh. I am not a process person, I am not organized, but I like to get to know people and I like to understand what makes them tick and what they want to be doing. So, you know, one of my great interview questions is like, what do you want to be when you grow up? Right.

18:24 Jon McLachlan

Oh, I love it.

18:25 Michael Malone

Yeah, I get like the, you know, where do you want to be in 10 years questions, but like, and I've gotten like the weirdest but most awesome answers to that. And one of the nice things being in a small startup is you can be [really] outside of the box in accommodating what people really want to be doing with their lives. So, you know, one of the guys who works for me now, actually, who I hired back at Betable and worked for me there, wants to be, or at least told me when [I was hiring him] that he wanted to be a stand-up comedian. I was like, well, that's awesome. So, I don't know, I'd say that's my management style is, I suppose it sort of aligns with what I was saying about before, is like, I like to, I like to find people who are sort of similarly passionate and understand what they're passionate about. And hopefully there's some overlap between what they're passionate about and what the business needs.

19:18 Jon McLachlan

No, I hear you there. I remember the first time I was asked to interview someone, it was for a security role. And I was like, oh boy, like this is such a heavy responsibility. And in the beginning in my career, I always thought it was about the technical stuff, the technical grits. Do you know this technology? Can you solve this algorithm? Here's a little problem. And it was almost like intellectual flirting at that point. And then at some point along in my career, I realized that, you know, people are smart and they can learn whatever it is that they need to learn to be successful at any sort of job that their heart is passionate about. And I switched my interviewing style to be more passion-driven. So I looked for that fire. You know, if you, if you have that fire, I don't even know what to call it. I guess the French would call it the [je ne sais quoi], because it's the one thing that you can't teach someone. Or I don't know exactly how to learn it. I don't know how to learn a passion. It's either there and there's fire, or, you know, or it's just, you're missing the mark, right?

20:23 Michael Malone

So, yeah. [I'd say] like there's sort of two criteria I hire for. It's, are you smart? And are you passionate about something that I need you to be passionate about? And the first, you know, in interviewing somebody, figuring out whether someone's smart takes five minutes. It's the second part that I think is hard. And luckily, [it's] mutual, because if the person that you're trying to hire is not passionate about something that you need them to be passionate about, they shouldn't be working on the problem anyways. So I find that, you know, that's often much more of a conversation than an interview.

20:55 Jon McLachlan

Yep. And oftentimes, like, if the passion thing is [...], it's, passion is a two-way street, right? So as you were saying, I entirely expect that when I'm interviewing, I'm also being interviewed. Like, oh, is this the type of company? Is this the type of, versus the type of culture that would fuel my passion from their perspective? I didn't realize that we were going to see eye to eye on so many, so many topics. Was there an experience that led you to see that? Was there a journey that brought you to that point?

21:29 Michael Malone

I don't think it's rocket science. I think if anybody really sat down and thought about it and was intellectually honest about it, they'd probably come to the same conclusion. Like, I don't, I don't know. I don't think I'm smarter than everybody else, or something. To me, it's just obvious that that's what's important. I guess I will say I've done a lot of hiring. So I've been responsible for recruiting and hiring engineers and have done a lot of that stuff. So I suppose over time, you know, if you do enough of something, you get better at it. And my approach certainly was more standard when I was working for other people and had to sort of fit inside of existing policies and processes. But no, I don't, again, like more evolutionary than revolutionary, I suppose.

22:20 Jon McLachlan

No, that's nice. You have a very strong sense of humility about the whole thing, which is refreshing. It's very good. It's good. I think humility is one of those important qualities. And especially in cybersecurity, sometimes we have like, you know, we have so many experts all over the place, and you bump into them. And I always find that funny too, because on the converse side, I just see so many opportunities, [to] improve things, to make things better in the cybersecurity space. And so it's kind of like you scratch your head sometimes and wonder, okay, what are all these experts doing exactly? Yeah. So if you think back over the past five years, because you've been at Smallstep leading the charge for about five years, was there a single best day that you'd like to point out or share with us that you just felt on top of the world?

23:11 Michael Malone

Great. Well, I mean, I think, again, another really good, but really hard question to answer, sort of picking out those like singular moments over the course of years. Well, I'll start by saying that my experience with running a company is that every moment has good parts and bad parts. And you need to, you know, take the bad with the good, but hopefully focus on the good and not let the bad drag you down too much. It's very much a roller coaster ride, I think, running a company. And there are a lot of interesting, unique challenges. You know, it's, in a lot of ways, I look back and wish I was working for somebody else. At times, it's a lot easier because you have clear measurements. You know, somebody tells you to do something and you do it well or you do it poorly and, you know, you know, you know, you did your job. And if there was some strategic error and you were told to do the wrong thing, that's not your fault. You did your job. And that's a lot easier than being the one who makes a decision and then the one who executes and then sort of constantly questioning whether you executed well on the wrong thing, and it's still, you still screwed up. Right. So I'd say, like, going back, the obvious answer to like a moment that was really memorably good, raising money and sort of that first moment of having somebody, like this real external validation of the idea [and of] myself and it being real. But then sort of returning to that, that sort of good and bad. At the same time, it's sort of gut-wrenching because you realize that now this is real and you have to execute and you have to do all of these things that you told these people you are going to do. And if you don't, you're going to be held accountable. And so, right. And there's a dollar figure next to the accountability. So, like, this mixture of like euphoria and what have I gotten myself into? I'm very analytical, I think. Like I'm not driven by emotion so much. And even when I am emotional, I like get very meta-analytical about it, I suppose. But I can say that now is, you know, running a company, raising money and, you know, venture-backed companies, a very emotional experience.

25:23 Jon McLachlan

I bet. And you raised from some top VCs that I see [...] in there, like Boldstart Ventures, Upside Partners, Haystack. So, I mean, all of those are huge names here in the Valley.

25:34 Michael Malone

So we've got some great investors, and, you know, again, really fortunate to have all the people involved that we have. So, yeah, Bain Capital, Upside, Boldstart, Accel, some of my favorite people. If you're in the market for money, they're all great.

25:53 Jon McLachlan

[...] What about a worse day? Or you kind of answered it because you have to take every day.

25:59 Michael Malone

Yeah.

25:59 Jon McLachlan

But the good and the bad, you know.

26:02 Michael Malone

Yeah, I don't know if I have a worse day. And if I do, I probably force myself to forget it. But I can't think of [a day] that I would say was the worst day. Now, have there been bad moments? Sure. I mean, people, we've had people leave the company and that's always hard, always amicably, but, you know, it sucks. It's like losing, you know, a family member or something, you know, when you're so tight. And we've had, you know, releases that we've been really excited about that, you know, the world didn't sort of see eye to eye just on. So in those moments are not the best. But, you know, it's all about the journey for me. So I try to learn from those experiences and not dwell on the negative. I think learning is my emphasis. Mistakes are opportunities to learn something new. And I try not to make the same mistake twice. So if I have a bad day, I see it more as like a lesson and a thing to avoid in the future.

26:57 Jon McLachlan

Yeah, you pick up the pieces and you figure out learnings from it and make something good out of it and see the silver lining and you move forward.

27:04 Michael Malone

I think you have to, if you're doing what we do.

27:08 Jon McLachlan

I agree 100% because not only do you have to do the lessons and like see the silver lining and pick up the pieces, but you have to lead a team that also [helps] them pick up the pieces, see the silver lining, move forward. So if you don't believe it, people can smell it.

27:23 Michael Malone

That's right. Yeah, [it's hard]. So you better believe it.

27:30 Jon McLachlan

Whatever it is that, right? No, and you must have, you raised seed capital, what, five years ago? And so you must have been very successful in being able to find customers, pull in income, support the business, 'cause usually seed doesn't last for five years. At least seed capital doesn't. So props to you for building a sustainable company. That's really something. Usually VCs will try to push folks into a space where you spend, you spend, you spend, you grow, you grow, you grow, and you have to go back for more funding like 18 months, 24 months later. Clearly, your history shows that you haven't. So, doing something different, doing something outside the box.

28:11 Michael Malone

Yeah, we're doing, we're doing all right. We've, you know, we have raised additional funding along the way from insiders, and we brought in capital on board, which we're super excited about, a little over a year ago. So, you know, we've had additional chunks of capital here and there. But, um, but yeah, I mean, you're absolutely right. A venture is selling you money, and they want you to buy more of it. So the best way to get you to buy more of it is to get you to spend what you have. So I try to do what's right for the company and have been lucky to have investors who want [that] as well. But again, I think it's like, if you can have a good relationship with the people that are funding you and have candor with them, then that goes a long way. But you're absolutely right. I think we haven't really followed the grow at all costs, run it off the cliff sort of philosophy that I think a lot of other startups do.

29:04 Jon McLachlan

No, that's just, it's very refreshing. Nice to see every once in a while. So props to you for following your passion and doing what's right for the company at the end of the day, not necessarily the standard cookbook for Silicon Valley [startups]. And then, when you fast forward into the future, I don't know how far into the future you would like to fast forward, but when you look out there and you see success for Smallstep, what does that world look like? How does Smallstep fit into that future?

29:36 Michael Malone

Well, I mean, I guess I'd start by saying I think we've already achieved a lot of success. You know, we've created software and solutions that people are using to do real things, and I think sort of created value, to use a venture term. Looking forward, I want to do more of that. You know, I want to be in a place where I have more resources and more time and can grow and, you know, execute on some of the, maybe go back to some of the stuff that we were doing around authorization and some of these larger distributed systems challenges and build on this sort of identity as a foundation. And even in the identity space, there's a lot in what I would sort of call production identity that we would like to be doing that we aren't yet. So, more of the same, more of the same.

30:23 Jon McLachlan

No, that sounds great. Like, you've been successful. Let's want to see the successes continue. I love the little plug for authorization, the authZ space. That's a very interesting space I bumped into multiple times myself. Have you heard of OPA, the Open Policy Agent?

30:42 Michael Malone

Sure have. Yep. Yeah, pretty familiar with the OPA folks.

30:46 Jon McLachlan

Even with everything that they're doing, and Styra has their little GUI that they built on top of it, and they're all kind of open source as well. Like their core technology is all open source, but you still feel like there's opportunity in the authZ space?

31:00 Michael Malone

It's big space. It's a big space.

31:02 Jon McLachlan

That's definitely a big space. I couldn't agree more. I guess OPA is very laser focused on just policy-based answers to that question.

31:13 Michael Malone

That's right. Yeah. I think there's a lot of opportunity there. I don't think it's solved yet.

31:19 Jon McLachlan

All right. Well, we'll have to have you back on once you get into the authZ thing, or even before then. Even before then. Thank you so much, Mike, for joining me, for sharing all of the stories and a bit about Smallstep and your entrepreneurial journey and a bit of childhood memories [that sort of] shaped who you are today. And I'm so happy that you're working on this problem. It's a tough problem. I know this is a tough problem and express nothing but gratitude for smart people like you working through it for a long time, making it easier for the rest of us to stand on the shoulders of giants and build a better future for everyone. So huge thanks for coming on the show too.

32:00 Michael Malone

Thank you for having me. It's been really fun, and I'd be happy to come back anytime. So.

32:06 Jon McLachlan

All right. I'll hold you to it. Thanks, Mike.