Episode 23 of The Security Podcast of Silicon Valley aired on October 19, 2022, with Jon McLachlan hosting. The guest was David M’Raihi, chief product security officer at Rivian (Podbean, Apple Podcasts, Spotify). The episode is called “David M’Raihi: CPSO at Rivian, on Cryptography, Cars, and the Craft of Security.” Jon and David had worked together at Apple and again at Symphony, and on the tape Jon calls David his mentor.
Jon spelled out the title, CPSO, for listeners:
“it stands for Chief Product Security Officer, which is a really nice focus.”
Jon McLachlan, at 0:40
This page follows the conversation in order: a section for each part of it, fifteen figures, fifteen clips from the tape, two LinkedIn posts, the full transcript, and five tools: a quiz, a scorecard for security without a security team, a calculator for what interruptions cost, a timeline, and a to-do list. Where the decodes of the tape disagree on a word, the transcript puts its best guess in brackets, and the page doesn’t quote or retell those words.
A chief product security officer
Jon read out David’s path at the start of the show. Director of technology at Gemplus. Vice president of technology at Arxan, a company that obfuscates code. Principal architect at VeriSign. Security architect at Apple. Chief technology officer and vice president of engineering at Verayo. Chief security officer at Symphony. Engineering and technology leader at UnifyID. Head of product security at Pure Storage, right after the company went public, where David started the security team. An advisor to Lacework. And then the CPSO role at Rivian, the electric truck company.
Usually he hears CSO or CISO, Jon said, but CPSO has a nice ring to it.
“Very nice ring to it.”
David M’Raihi, at 0:52
David’s LinkedIn fills in the dates. Apple from April 2010 to June 2011, covering secure implementations on iOS, Mac OS and the hardware platforms, and protocols such as AirPlay, the App Store and FairPlay. Verayo from June 2011 to April 2014. Symphony from October 2014 to May 2017. Pure Storage from February 2018 to January 2021, where the team focused on hardening the software development lifecycle and on certifications such as FIPS and SOC 2. Rivian from January 2021 to December 2023. He also lists Sift Security, as an advisor and investor from October 2014 to July 2018, when Netskope acquired it (LinkedIn). Gemplus merged with Axalto in June 2006 to form Gemalto, a digital security company whose products include smart cards and tokens. Arxan specialized in anti-tamper and digital rights management, and in April 2020 it joined two other companies to form Digital.ai (Wikipedia, Wikipedia).
The two first met at a security conference. Jon remembered how:
“You actually reviewed one of the papers that I wrote as a graduate student.”
Jon McLachlan, at 2:04
David confirmed that he had.
David earned his PhD at the École normale supérieure, which Jon called the top school in France and compared to Harvard. Wikipedia describes the school as a grande école in Paris and a member of PSL University (Wikipedia). David’s LinkedIn gives the degree as a PhD in mathematics and computer science, with the thesis “Electronic Money and Privacy Regulation” (LinkedIn).
Copy protection came first
Jon asked what first pulled David into security. It started on the other side of the field, David said:
“I was always interested, I would say, by some security aspects”
David M’Raihi, at 4:07
When he was much younger, he did a little hacking. The question that held his interest was simple:
“How do you copy a program that actually is protected?”
David M’Raihi, at 4:27
It was a topic of some interest on the Apple II and Commodore machines. From there he saw that software had ways to protect an application and the intellectual property inside it. Then his interest moved to mathematics and computer science.
The other side of that question became a business. Arxan, where David was later vice president of technology, built anti-tamper protection for software (Wikipedia).
A friend’s doctorate in cryptography
David was working on a few projects when a friend, preparing a PhD in crypto, started to explain what crypto was about.
“And I was like, wow, that sounds kind of very cool, right?”
David M’Raihi, at 5:13
It had applications and it had theory. What hooked him was one sentence in French in his friend’s PhD work. David translated it as crypto is fun.
Back then, he said, crypto always meant algorithms and protecting data:
“there was nothing like cryptocurrencies or anything.”
David M’Raihi, at 6:03
Things changed a lot in the 10 or 15 years before the tape. He also explained a second word. Cryptology combines building systems with attacking systems, which is called cryptanalysis.
David got hooked and finished his own PhD. His LinkedIn names his advisor, Jacques Stern (LinkedIn). Wikipedia describes Stern as a cryptographer and a professor at the École normale supérieure, known for the cryptanalysis of many encryption and signature schemes, and he received the CNRS Gold medal in 2006 (Wikipedia).
“that’s how I went into security, more by the, I would say, the research angle.”
David M’Raihi, at 6:35
The codes on your phone
The episode doesn’t get to it, but David’s name is on two standards that many people use every day without knowing it.
In December 2005, the IETF published RFC 4226, “HOTP: An HMAC-Based One-Time Password Algorithm.” David is its first author, listed with VeriSign, and his coauthors were M. Bellare, F. Hoornaert, D. Naccache of Gemplus, and O. Ranen (RFC Editor). In May 2011 came RFC 6238, “TOTP: Time-Based One-Time Password Algorithm,” again with David as first author (RFC Editor). A third, RFC 6287, published in June 2011, describes OCRA, the OATH challenge-response algorithm, with David again among the authors (IETF).
Here is how they work. In HOTP, the server and the device share a secret key and a counter. Both compute a code from the key and the counter, and each side moves its counter forward on its own. Each counter value is used once, which makes each code good for one use (Wikipedia). TOTP replaces the counter with a value based on the current time. Its defaults are six digits, the SHA-1 algorithm, and a new code every 30 seconds. Authenticator apps set it up by scanning a QR code (Wikipedia). Both belong to the work of OATH, the Initiative for Open Authentication, an industry-wide collaboration on open standards for strong authentication (Wikipedia).
On April 24, 2024, David shared both RFCs on LinkedIn as a blast from the past. He wrote that most of the authors didn’t expect the algorithms to still be in use for strong authentication 10, 15, even 20 years later, counting from when HOTP was first shared in 2004. He has a running joke with friends that he is “(partly) responsible for those 4 and 6-digit codes.”
David on the RFCs behind one-time passwords.
David M'Raihi · April 24, 2024
A room full of bankers
Jon asked for David’s best day in the valley. David couldn’t pick a single day, but a couple stood out. One came at Symphony, when a small startup called Perzo became part of something bigger, and:
“that day when we were sitting in that big room with all the bankers”
David M’Raihi, at 10:33
He has had a day like that maybe two or three times in his life, he said.
Jon asked him to tell the story. Perzo focused on one part of communication:
“secure communication, efficient and private between not just two parties, but multiple parties.”
David M’Raihi, at 11:14
A text message is one thing, David said. Then come attachments, and then voice and video. The founders had many ideas, and the pivot was to financial applications:
“because there is really a need for security and privacy and also compliance.”
David M’Raihi, at 11:49
That is hard, he said, and not many companies wanted to take it on. Jon was there too. They sold to firms like Goldman Sachs, BlackRock and JPMorgan, he said.
Wikipedia describes Symphony as an instant messaging and communication service built for financial firms, with chat, voice, video and encryption. Its technology started inside Goldman Sachs. In October 2014, Goldman Sachs and 14 other financial institutions invested $66 million to set up Symphony Communication Services and acquire Perzo, which David Gurle had founded in 2012 (Wikipedia). David’s LinkedIn lists him as chief security officer at Perzo from April 2014 and at Symphony from October 2014, covering product security, from the design of the crypto libraries to code review, plus corporate and infrastructure security (LinkedIn).
From a technology to a company
The step from Perzo to Symphony led David to a point about startups:
“So I think moving from just having the technology to having a product and then having a company, that’s what makes a difference.”
David M’Raihi, at 12:00
That step is hard, he said, and it’s why many companies fail. Failing teaches a lot, he said, more than succeeding. Jon agreed. When you succeed:
“it just goes right to your head”
Jon McLachlan, at 12:31
David went on. When you succeed fast, things happen and there’s no time to digest them. Sometimes it’s luck, or the stars align, or 20 years of work meet the right idea at the right time. When you fail, you pause and try to understand what went wrong. There is usually a lesson, you grow, and the next challenge gets easier. Jon added that this takes a growth mindset, and some people don’t have it.
Then David came back to the three steps. There is a lot of confusion there, he said:
“people think that they have a company, and actually they just have a technology.”
David M’Raihi, at 14:25
Or they have a product with no market. A real company comes from a set of problems you have identified, and a solution better than the ones that exist, or the first one. Without that angle, you can build something, but it won’t be solid. Jon said that’s:
“perhaps the difference between a company and a hobby.”
Jon McLachlan, at 15:12
There is nothing wrong with a great idea that others use, David said. The open source movement lets people offer their technology, and many companies were built on it. Some people are good at business, some are researchers, and some are talented engineers who, asked to go and market their work, would say they have:
“zero interest in doing any of that.”
David M’Raihi, at 16:20
Jon called it what makes teams stronger than the sum of their parts. David added that the diversity that matters most is in how people approach things. That comes from each person’s experience and background, he said, and it brings a lot to any team.
The question people started asking
Jon asked whether David looks for diverse backgrounds when he builds a team. David’s first problem is simpler:
“It’s so difficult to find quality people.”
David M’Raihi, at 17:41
The two years before the tape had brought so many shocks, he said, from the economy to events in Europe to COVID, that nobody could predict the next year. People reacted by asking basic questions they had not had the time, or the wish, to ask before. He saw it even more in younger people, who have more flexibility. Why do this job, or why work with this person? People accepted a lot more a few years earlier, he said, and now they don’t. The power had swung from one extreme to the other, and he expected it to rebalance a little. But the question will stay at the back of people’s minds:
“am I really happy? Do I want to do that?”
David M’Raihi, at 20:10
Jon tied it to a life with purpose. He said it matters that we live:
“lives that are deliberate and intentional and aligned with our own personal values.”
Jon McLachlan, at 20:16
For some people, that means solving a hard open problem. For others, it means working to provide for the people they love. David agreed that there is nothing wrong with that.
Work itself had changed too, David said. A couple of years before the tape, choosing your days at home wasn’t an option, and Jon added that you’d have been an oddball for asking. Some jobs can’t be done remotely, David said, and many can, by people with the mindset for it. Work is just more open now, he said.
Office days and plant visits
Jon asked whether Rivian had a flexible work policy, and whether David worked from home. David tries to go into the office every week. He asked himself how many days he needed there, and found value in meeting his teams. Still:
“I think I can perform the vast majority of what I do remotely.”
David M’Raihi, at 23:34
The office isn’t the only place that counts. David had visited the plant a couple of times, and he feels he should go at least twice a year, to see and understand how the vehicles get made.
Other companies are different, he said. If you specialize in cloud security and build on AWS or GCP, the office is mostly about connecting with people. That connection matters at two moments. In a creative phase, sitting together at a whiteboard is easier. Jon said it’s faster and you get to the point sooner, and David added that you can see how people react. In a crisis, a call with a bunch of people on Zoom works:
“but it’s a little dry.”
David M’Raihi, at 25:28
“being in the room can help.”
David M’Raihi, at 25:34
In an execution phase, when there are few surprises and people know what to do, the office helps less. There, people get interrupted, and some have a hard time switching context.
The cost of a context switch
Jon knew the problem firsthand. He had announced publicly that he switches context slowly:
“I can do one thing very well”
Jon McLachlan, at 26:12
He needs focus, he said, and asked people to make sure an interruption was important. David remembered, and described what that means for a person like Jon:
“being interrupted like 10 times during the day”
David M’Raihi, at 26:30
That will hurt the person’s productivity significantly, he said.
The calculator below puts a number on it for your team, starting from David’s ten interruptions a day.
The hardest day, and the network after it
Jon asked about David’s worst day in Silicon Valley. The real answer was personal, David said:
“The worst days were always because of personal things”
David M’Raihi, at 29:06
“personal stuff is what matters the most.”
David M’Raihi, at 29:31
For a work day, he picked one in 2001. As the market melted down, the company he worked with cut back, like many others, and closed its Bay Area office. For a couple of months he had no job and didn’t know what came next.
Jon asked whether he wanted to write his own story or to see how this one ended. A network worked differently then, David said. There was no LinkedIn and no social networks, just a phone, a few people on email, and drinks. Still:
“I was not scared or worried.”
David M’Raihi, at 32:58
“It was more like, okay, what are the next steps, right?”
David M’Raihi, at 33:00
He knew a few people, reconnected with them, and joined a project that was starting. That was his rebound, and another project followed. Once you’re connected and have experience, he said, it all comes together.
Then Jon said something to his listeners:
“David here has actually been my mentor through my career.”
Jon McLachlan, at 34:27
From David, Jon learned leadership styles, security technologies and how to work with customers. And:
“you gave me my first opportunity to really lead a team”
Jon McLachlan, at 34:42
David said Jon was too kind:
“I learned a few things from you as well”
David M’Raihi, at 35:05
Security before the security team
Jon asked David to look into the future and describe a security industry he’d be proud of. David named one trend he sees as positive, with many companies working on it: SecDevOps, or security DevOps. It’s a broad term, he said, but he likes the space, because security has plenty of room to optimize. What has been missing is how to spend resources:
“When do we need a tool? When do we need a human?”
David M’Raihi, at 37:26
In vulnerability management, there are many players. You can run scans, do pen testing and analyze the code. Lacework came up, and David said it does more than that, in cloud security and in automating detection. The angle David cares about is a company like this:
“I don’t have a security team.”
David M’Raihi, at 38:16
It is starting to build products and asks what to do. Not the bare minimum, David said, but:
“what would be a good solution for me, knowing that I can’t hire 50 people?”
David M’Raihi, at 38:24
Such a company may not even be able to hire one security person, Jon said.
Today the field calls this DevSecOps. Wikipedia describes it as bringing DevOps into security practices: each delivery team builds the right security controls into its own delivery, and tests earlier in the lifecycle, which is called shifting left. Testing covers three areas: static, software composition and dynamic (Wikipedia). The scorecard below asks how much of that a small company has in place.
Fewer people, more tools
In security, people with experience and the right skills are hard to find, David said, and hard to afford. For a long time:
“we are kind of brute-forcing everything.”
David M’Raihi, at 39:03
You need 20 analysts, a security operations center, and more. Now there are options to be smarter. You still need a team, he said, but he can do today with 30 or 35 people what took about a hundred 20 years earlier.
Jon asked whether software-as-a-service security tools explained it. It’s a combination, David said: skills, experience and knowledge, and people who can do several things. People used to be more specialized. Now he sees engineers who handle infrastructure, operations and testing.
From public keys to email
Security isn’t a brand new industry, David said. Take encryption:
“the first time you had some public encryption algorithm, we are talking, you know, the 70s.”
David M’Raihi, at 40:37
The idea was a public key to encrypt and a private key to decrypt. Then people saw that the same keys could sign. It started with a few people in the mid-70s, he said, and the military and governments were a different story.
Then came the 80s, and email in the 90s. Once people could communicate, he said:
“then there are security issues associated with that.”
David M’Raihi, at 41:39
And security companies grew up alongside. Wikipedia gives the dates. Whitfield Diffie and Martin Hellman published the idea of public-key cryptography in 1976, and introduced digital signatures. Ron Rivest, Adi Shamir and Leonard Adleman publicly described RSA in 1977. An equivalent system was developed in secret at GCHQ, the British signals intelligence agency, by Clifford Cocks in 1973, and declassified in 1997 (Wikipedia). Taher Elgamal described ElGamal encryption, built on the Diffie-Hellman key exchange, in 1985 (Wikipedia). Taher was the guest on episode 61.
Cars as connected devices
People should be humble about all this, David said, when they hear that something doesn’t work yet. Take cars. They have been around for more than a hundred years, and an electric vehicle is built differently, he said:
“it’s more like a connected object”
David M’Raihi, at 42:15
“that’s a shift again.”
David M’Raihi, at 42:20
People need to understand what it takes to make that work, he said.
Wikipedia describes Rivian as an American electric vehicle maker and automotive technology company founded in 2009. Deliveries of its R1T pickup began in October 2021, and on November 10, 2021, it became a public company through an IPO (Wikipedia). David’s LinkedIn describes the product cybersecurity group he led there in four teams. One handled security integration and validation in the factory and the plant ramp-up. One did offensive security: pen tests of the vehicles and their connected infrastructure, an internal red team, and threat analysis and risk assessments. One did embedded work: hardening the vehicle’s electronic control units, cryptography and hardware security modules. And one built the infrastructure, on premises and in AWS and GCP, for key management and for secure communication between vehicle and cloud, charging and service (LinkedIn).
The rules changed around the same time. Wikipedia’s article on automotive security notes that in June 2020, a United Nations forum on vehicle regulations released R155 and R156, with performance and audit requirements for car makers on cybersecurity and software updates (Wikipedia).
When the hard problems get easier
Jon asked whether they would see RSA broken in their lifetimes. David pointed to quantum computers and post-quantum algorithms:
“certain things are going to be more vulnerable.”
David M’Raihi, at 43:00
It wasn’t clear to him yet whether those attacks really work, he said. Jon checked that he meant quantum computing as the thing that could break RSA. David answered that a lot of recent work went into algorithms based on different problems. The traditional ones come from number theory. RSA rests on factoring: there’s no way to extract the two numbers whose product you see. Much of internet security was built on two such problems, Jon added. So people asked what happens in a world where:
“these problems are not as hard as we think”
David M’Raihi, at 44:22
He didn’t think anyone needed to worry about it yet. He left open whether that changes in 20 years. New algorithms exist, he said, and there will be more.
Wikipedia fills in the threat and the answer. Peter Shor’s 1994 quantum algorithm finds the prime factors of an integer, and Shor also gave an algorithm for the discrete logarithm problem. Beating classical computers may take quantum computers with millions of qubits (Wikipedia). On August 13, 2024, NIST released its first three post-quantum standards. FIPS 203, ML-KEM, is the primary standard for general encryption. FIPS 204, ML-DSA, is the primary standard for digital signatures. FIPS 205, SLH-DSA, is a backup in case ML-DSA proves vulnerable. On March 11, 2025, NIST picked HQC, a code-based algorithm, as a backup for ML-KEM, with a draft standard expected in early 2026 (Wikipedia).
Computing on encrypted data
David is more interested in what new primitives make possible. Homomorphic encryption is his example. You produce encrypted objects, and:
“I can operate on these encrypted objects without having to decrypt them.”
David M’Raihi, at 45:15
“It’s almost fascinating”
David M’Raihi, at 45:25
It keeps everything secure along the way, he said.
Jon said that’s what Zama is working toward, and brought up Benoît, whom they knew from Apple. Benoît Chevallier-Mames, then team lead of machine learning at Zama, was the guest on episode 20, on open source homomorphic encryption. Wikipedia credits Craig Gentry with the first plausible construction of a fully homomorphic encryption scheme, in 2009, using lattice-based cryptography (Wikipedia).
The script, then the person
Jon asked what David looks for when he interviews, and for his favorite question. Most companies have a process, David said, to be fair and to compare candidates for a role. There’s a set of questions and a panel of different people. That’s hard to do in a fair and balanced way, and most companies do it reasonably well.
He goes a little off script. In a 45-minute interview, he spends 30 minutes on the questions his talent team needs answered. He keeps the other 15 minutes, or 20 in an hour, for personal questions about how the person thinks. What he’s after is fit with the company, the team and the organization’s values.
When a hire didn’t work out, it was rarely about skills, he said, unless you hire a sailor to bake a cake. If someone is good in C and wants to learn, the gap is:
“something that you can easily fix over six months or a year.”
David M’Raihi, at 48:29
A big gap in values is different. Jon put it as a good person who isn’t the best fit. When David hesitates about a candidate, it’s rarely about technical skill. Most of the time, 80 or 90 percent, it’s a gut feeling about fit, he said.
“And it goes both ways”
David M’Raihi, at 49:24
Hiring the wrong fit does the person a disservice. They try their best, and it doesn’t work. That’s why he’s careful, he said.
Pick a direction early
Jon asked David for words of wisdom he’d give his younger self.
“As soon as you can, find your North Star, and don’t listen to people if they tell you it’s not the North.”
David M’Raihi, at 50:18
“Just ignore them and go after it.”
David M’Raihi, at 50:26
Jon told listeners not to hesitate, and to be deliberate and intentional. A big mistake is better than doing nothing, David said, and Jon added that you only regret the action you don’t take. David agreed, and gave an example:
“it’s always the books that you decide not to buy that you regret, never the books that you bought.”
David M’Raihi, at 50:59
What happened after the tape
From Rivian to CARIAD. David’s LinkedIn lists him as Rivian’s CPSO until December 2023. In April 2024 he joined CARIAD, Inc. as global vice president and lead security. He started as chief product security officer for its software-defined vehicle hub and later served as interim vice president of software development for the hub. His main focus, he writes, is to “integrate AI technologies to improve our SDLC,” with an interest in AI agents for vulnerability management, incident response and risk scoring. From April 1, 2026, he is also the acting CISO for CARIAD Inc. (LinkedIn). Wikipedia describes Cariad as the Volkswagen Group’s automotive software subsidiary. It was set up in 2020 as the Car.Software Organisation, took the name Cariad in March 2021, from “Car, I Am Digital,” and develops software for the group’s cars, from driver assistance and infotainment to vehicle controls and online services (Wikipedia).
Building a team again. On April 24, 2024, the same day as his post on the one-time password RFCs, David wrote that building a security organization is probably one of his favorite projects at work, and that he was hiring again across product security: coding, testing, validation, offensive security and integration. He added: “Bonus points if you drive a cool car.”
David on building a security organization again, and hiring.
David M'Raihi · April 24, 2024
Volkswagen invests in Rivian. On June 25, 2024, the Volkswagen Group announced that it would invest up to $5 billion in Rivian. The two then launched a joint venture to develop next-generation software-defined vehicle platforms, combining Rivian’s software with Volkswagen’s scale and manufacturing (Wikipedia). That links the company David left with the group behind the one he joined.
Lacework joins Fortinet. On the tape, Lacework wasn’t public yet. In June 2024, Fortinet acquired Lacework, “a data-driven cloud security company,” for an undisclosed amount (Wikipedia). David’s LinkedIn lists him as a Lacework advisor from June 2019 to May 2022.
Rivian’s next model. Rivian started deliveries of its R2, a midsize SUV, in June 2026 (Wikipedia).
More on this site. On episode 61, Taher Elgamal, the cryptographer behind ElGamal encryption, explained why SSL required a certificate from the server and only offered one to the client, which is how the web ended up with passwords. On episode 92, Jasson Casey of Beyond Identity argued that the trouble with passwords, API keys and session cookies is that they move. On episode 25, Jon traced the path of David Gurle, who founded Perzo, from Microsoft and Skype to Symphony and Hive. And on episode 20, Benoît Chevallier-Mames of Zama talked about open source homomorphic encryption.
Did you catch it? A seven-question quiz
Seven questions from the episode. Each answer links the moment in the transcript or its section.
Quiz · seven questions
Did you catch it?
Pick an answer to see whether you caught it.
-
What did David want to know when he was much younger?
a. "How do you copy a program that actually is protected?" Transcript, 4:27.
-
How did David translate the line in French from his friend's PhD work?
b. He translated the line as crypto is fun. See A friend's doctorate in cryptography.
-
Why did financial firms need what Perzo and Symphony built?
c. "because there is really a need for security and privacy and also compliance." Transcript, 11:49.
-
Where does a real company start, according to David?
a. A technology alone isn't a company, and a product needs a market. See From a technology to a company.
-
How many interruptions a day did David use as his example?
b. "being interrupted like 10 times during the day" Transcript, 26:30.
-
How many people does David need today for work that took about a hundred 20 years earlier?
c. With 30 to 35 people, he could do what took about a hundred 20 years earlier. See Fewer people, more tools.
-
In a 45-minute interview, how many minutes does David keep for personal questions?
b. The other 30 go to the questions his talent team needs answered. See The script, then the person.
Can you run security without a security team?
Eight questions for a company like the one David described: building products, with no security team yet. Each tip links the section behind it.
Scorecard · eight questions
Can you run security without a security team?
Answer for your company as it runs today. If two answers fit, pick the lower one.
-
Does one person own security by name, with time set aside for it?
- Nobody owns it
- Shared, informally
- A named owner, with time on the calendar
David's question starts with a company that can't hire a team. See Security before the security team.
-
Do admin, cloud and code accounts all require a second factor?
- Passwords only
- Some accounts
- All of them, with one-time codes or passkeys
The six-digit codes come from standards David helped write. See The codes on your phone.
-
Do code and dependency scans run on every build?
- No scans
- On some repositories
- Every repository, every build
Static and software composition testing are two of the three areas DevSecOps covers. See Security before the security team.
-
Does a tool watch your cloud configuration?
- No
- Someone checks by hand now and then
- All the time, with alerts someone reads
Cloud security and automated detection came up with Lacework. See Security before the security team.
-
Has someone outside tested your product in the last year?
- Never
- More than a year ago
- In the last year, with the findings fixed
Pen testing is part of the vulnerability work David described. See Security before the security team.
-
Does every vulnerability get an owner and a deadline?
- No
- The serious ones
- All of them, tracked to closure
When do you need a tool, and when a human? See Security before the security team.
-
Do your engineers get hours without interruptions?
- Rarely
- Some days
- Most days, with set times for questions
Ten interruptions a day add up. See The cost of a context switch.
-
Do you know where your products rely on RSA or other public-key algorithms that quantum computers threaten?
- No
- Partly
- Yes, with a plan for the new NIST standards
The first post-quantum standards came out in 2024. See When the hard problems get easier.
Security waits for a hire that may not come soon. Name an owner, and turn on a second factor for every admin account this week.
Some of the basics run on their own, and some depend on someone remembering. Next, put scans in every build and give every finding an owner and a deadline.
Tools do the repeat work, and people handle the rest. Keep the outside test yearly, and start planning for the post-quantum standards.
What do interruptions cost your team?
David pictured someone interrupted ten times a day. This calculator adds up the time it takes your team to get back into the work after each one.
Calculator
What do interruptions cost your team?
Five numbers: the people on the team, the interruptions each gets a day, the minutes it takes to get back into the work, what an engineering hour costs you, and working days a year.
Interruptions cost your team 3,067 h of focus a year, or 76.7 engineer-weeks, at a cost of $306,667. That's 1.7 hours a day for each person.
The calculator counts the time to get back into the work, and leaves out the interruptions themselves and the mistakes they cause. The defaults are placeholders: ten interruptions a day comes from David's example on the tape, and ten minutes to get back into the work is a guess. Put in your own numbers.
From public keys to post-quantum
The cryptography David talked about, his roles, the companies around him, and this show. Filter by topic.
Timeline
From public keys to post-quantum
- A secret first
Clifford Cocks develops an RSA-equivalent system at GCHQ, declassified in 1997 (Wikipedia, on this page).
- Public keys
Whitfield Diffie and Martin Hellman publish the idea, and digital signatures (Wikipedia).
- RSA
Rivest, Shamir and Adleman describe it publicly (Wikipedia).
- ElGamal
Taher Elgamal describes his encryption system (Wikipedia).
- Shor's algorithm
A quantum algorithm for factoring, and for discrete logarithms (Wikipedia, on this page).
- HOTP
RFC 4226, with David as first author (RFC Editor, on this page).
- Gemalto
Gemplus and Axalto merge (Wikipedia).
- Rivian
The company is founded (Wikipedia).
- Fully homomorphic encryption
Craig Gentry's first plausible construction (Wikipedia, on this page).
- Apple
Security architect, to June 2011 (LinkedIn).
- TOTP
RFC 6238, the time-based version, again with David as first author (RFC Editor).
- Verayo
CTO and VP of engineering, to April 2014 (LinkedIn).
- Perzo
Chief security officer, until Symphony bought it (LinkedIn).
- Symphony
Goldman Sachs and 14 other institutions invest $66 million and acquire Perzo, and David becomes Symphony's chief security officer (Wikipedia, on this page).
- Pure Storage
Head of product security, to January 2021 (LinkedIn).
- R155 and R156
UN rules for car makers on cybersecurity and software updates (Wikipedia).
- Rivian
Chief product security officer, to December 2023 (LinkedIn, on this page).
- The R1T
Rivian starts delivering its pickup to customers (Wikipedia).
- Rivian's IPO
Rivian becomes a public company (Wikipedia).
- Episode 20
Benoît Chevallier-Mames of Zama (episode page).
- Episode 23
David on the show (Podbean, transcript).
- Episode 25
David Gurle, who founded Perzo (episode page).
- CARIAD
Global vice president and lead security (LinkedIn, on this page).
- A blast from the past
David shares the HOTP and TOTP RFCs (LinkedIn).
- Fortinet buys Lacework
For an undisclosed amount (Wikipedia).
- Volkswagen and Rivian
Volkswagen announces it will invest up to $5 billion (Wikipedia).
- Post-quantum standards
NIST releases FIPS 203, 204 and 205 (Wikipedia).
- Episode 61
Taher Elgamal on SSL and passwords (episode page).
- HQC
NIST picks a code-based backup for ML-KEM (Wikipedia).
- Acting CISO
For CARIAD Inc., alongside his role (LinkedIn).
- Episode 92
Jasson Casey on secrets that move (episode page).
- The R2
Rivian starts deliveries of its midsize SUV (Wikipedia).
What to do this week
Five things, in the order of the episode.
- Turn on a second factor everywhere. Put one-time codes or passkeys on every admin, cloud and code account, as in The codes on your phone.
- Protect time for focus. Set times for questions, so nobody on the team gets interrupted ten times a day, as in The cost of a context switch.
- Name an owner for security. Even before you can hire a team, one person should own it, with tools doing the repeat work, as in Security before the security team.
- List where you rely on RSA. Find the products and services that depend on public-key algorithms, and plan for the NIST post-quantum standards, as in When the hard problems get easier.
- Get help with it. Our Product Security work secures what you build, Penetration Testing tests it from the outside, and vCISO Services give you a security leader before you can hire one. If you want to talk it through, book 15 minutes with us.