Episode 33 of The Security Podcast of Silicon Valley aired on November 1, 2023, with Jon McLachlan hosting. The guest was Elizabeth Nammour, who goes by Lizzy, co-founder and CEO of Teleskope (Podbean, Apple Podcasts, Spotify). The episode is called “Elizabeth Nammour, Co-Founder and CEO of Teleskope, Navigating Data Security Frontiers.” Before Teleskope, she worked on data security at Airbnb.
Jon saw the idea for Teleskope in her first task there:
“my first task was they gave me a dump of like all the columns in the data warehouse.”
Elizabeth Nammour, at 0:53
This page follows the conversation in order: a section for each part of it, fourteen figures, twenty clips from the tape, two posts from Lizzy on LinkedIn, the full transcript, and five tools: a quiz, a scorecard for where your sensitive data lives, a calculator for a manual PII review, a timeline, and a to-do list. Where the decodes of the tape disagree on a word, the transcript puts its best guess in brackets, and the page doesn’t quote or retell those words.
Every column, by hand
Jon opened with Airbnb, where Lizzy was a senior software engineer on the data security team. She joined in 2017, and the timing was good. Airbnb was starting to tackle the GDPR and the CCPA, she said:
“and we had nothing built out at that time.”
Elizabeth Nammour, at 0:35
That let her build something from scratch. Jon guessed she made friends with the lawyers along the way, and she said they became good friends. The hard part came in her first three weeks. She got a dump of every column in the data warehouse, with one request:
“And they’re like, oh, please identify PII in all of those columns.”
Elizabeth Nammour, at 0:59
She went through them one by one, by hand.
“And that was like the biggest pain.”
Elizabeth Nammour, at 1:06
Jon could see where some of the idea for Teleskope came from, and she agreed. Personal data, also called personally identifiable information or PII, is any information related to an identifiable person (Wikipedia). The General Data Protection Regulation was adopted on April 14, 2016 and took effect on May 25, 2018 (Wikipedia). California’s Consumer Privacy Act was signed into law on June 28, 2018 and took effect on January 1, 2020 (Wikipedia). Both ask a company to know what personal data it holds.
Into security by chance
Before Airbnb, Lizzy interned at Amazon, on a Kindle analytics team. The work was about data, she said, and not about security at all. She studied computer science at the University of Pennsylvania and called it a great college. Her LinkedIn adds the dates: a strategic innovation internship at Booz Allen Hamilton from June to August 2015, the software developer internship at Amazon from June to August 2016, and Airbnb from August 2017 to February 2022 (LinkedIn).
Jon asked if a childhood story had pulled her toward security.
“To be honest, I got into it by chance at Airbnb.”
Elizabeth Nammour, at 2:30
She could probably find a story, she said, because she loves problem solving:
“I love like breaking things in order to fix it.”
Elizabeth Nammour, at 2:39
At the time, Airbnb hired new graduates as generic software engineers. Teams with openings pitched the problems they were working on, and each new engineer picked one. That’s how she got into security. Jon liked the honesty. People often land in a field by chance, he said, and before long they’re experts. A few years is enough, she said:
“It’s like you just need to sometimes be put in that situation”
Elizabeth Nammour, at 3:31
Then you realize it’s what you’ve wanted to do.
What Teleskope does
Jon asked what Teleskope does. It grew out of her work at Airbnb and the problems her team faced there:
“So we’re basically building a modern and AI-driven data protection platform to help companies automate security, privacy, and compliance at scale and in a developer-friendly way.”
Elizabeth Nammour, at 3:47
Her LinkedIn dates the company to March 2022. Teleskope’s site describes the product today in three steps: understand the data through discovery and classification, decide what to do with policies, and enforce them with remediation (Teleskope).
Built by people who felt the pain
Jon asked for the one thing Teleskope does better than anyone else in the world. Her answer was the team’s own experience:
“because we’ve actually been there and we’ve actually solved this problem like at a larger tech company.”
Elizabeth Nammour, at 4:18
She doesn’t think most competitors have been in that seat:
“Whereas I think a lot of our competitors have never truly felt the pain”
Elizabeth Nammour, at 4:22
That perspective, she said, lets them build a product that works in complex environments and doesn’t add headaches for the engineers who run it. Jon said it sounded like she fell in love with the problem. People who fall in love with a solution cling to it, he said, even after something better comes along. People who fall in love with the problem keep looking for the best way to solve it.
Selling for the first time
Teleskope was a year and three months old. Jon guessed that equals three or four years at a large company, because things move so fast at a startup. She has learned a lot of new things, starting with sales:
“Like, I’ve never sold before this. I’ve never had to sell anything. I’ve never had to market anything.”
Elizabeth Nammour, at 5:23
That world has been interesting and fun, she said, and not fun in some ways. Jon called it nerve-wracking and exciting at the same time. She has help. One of Teleskope’s advisors is the chief operating officer of another security company. Selling is his main job, and she called him the best salesperson ever. The rest comes from practice:
“But sometimes you have to try and fail and see why you failed”
Elizabeth Nammour, at 6:07
Then you fix the strategy and try again, and again, until something works. The wording has to be right, and you have to reach the right people, which means working out your target persona. She called that hard to do. Jon asked for a favorite book on marketing or sales. She doesn’t have one yet:
“I’m more the type to try and like do things and then learn from that versus like reading books that teach me how to do something.”
Elizabeth Nammour, at 6:34
Jon called that an entrepreneurial spirit, with good things coming out of failures in small feedback loops. A book can list the best tactics, she said, but it can’t show you why one beats another until you’ve tried both. Tactics change from company to company:
“Even different types of people have to use different sales tactics.”
Elizabeth Nammour, at 7:09
Jon agreed. A tactic has to fit your personality, and you have to wear it.
“If you’re not convinced, no one else is going to be convinced.”
Jon McLachlan, at 7:17
Mornings for email, afternoons for code
Jon asked about a typical day. There isn’t one, she said, but there is a routine. The team of five works in an office almost every day, and she recommends it:
“I would recommend for anyone having a startup to not do it remotely, do it in person.”
Elizabeth Nammour, at 7:39
It’s more efficient and more fun, she said. She gets in around eight and handles LinkedIn and email in the morning. Meetings and questions fill the day.
“And then after that, in the afternoon, I code.”
Elizabeth Nammour, at 8:11
She can’t let go, she said, and called that bad. Jon called it good and bad, and with five people maybe still good. He described a kind of coding for leaders:
“There’s a way, I think, to code where it’s more like leadership coding”
Jon McLachlan, at 8:29
That means foundations, interfaces and reviews, a level above picking a library and filling in the rest. She agreed. Her rule is to build big features and skip small extensions to existing ones.
A first customer and a first no
Jon asked about her best day so far. She had two candidates:
“it could be either like the day we got our first customer”
Elizabeth Nammour, at 9:05
That was exciting, she said, and signing took a while:
“And it’s so nerve-wracking because, you know, the whole legal process takes forever.”
Elizabeth Nammour, at 9:16
You get into your head, she said, with scenarios that aren’t logical at all, and once it’s signed you’re so happy. The second was growing the team past its two co-founders:
“When we hired our first employee, it was also so fun”
Elizabeth Nammour, at 9:38
She had never hired anyone before.
Jon pointed out that the first hire’s livelihood now depends on the company doing well, a stress that is also exhilarating. Then he asked about the worst day. It came early, when an investor first said no. The first no hits the hardest, she said. She wasn’t used to hearing it. That changed:
“Now I hear no all the time and it barely affects me.”
Elizabeth Nammour, at 10:27
After a no you keep asking what you could have done better. Sometimes there was something, she said, and sometimes it wasn’t the right fit, and that perspective comes with time. Teleskope had no board yet, and she said its advisors and investors had been great. Fit matters with advisors too, and looking great on paper isn’t enough:
“you have to click with the person”
Elizabeth Nammour, at 11:16
Jon agreed. Something good has to come out of those relationships, and when two people don’t click, it’s important to see that.
From a hundred tools to one
Jon asked her to look ahead to a smashing success, as far out as she liked. She started with how security teams buy today:
“because everyone knows you have to buy 20 to 100 different tools on a security team”
Elizabeth Nammour, at 12:15
Twenty years out, she said, Teleskope would be a one-stop shop for anything security related, past data security. Five years out:
“I think five years from now, we do want to be the leading data security and privacy platform out there.”
Elizabeth Nammour, at 12:26
Jon called it ambitious and said he loved it. With his chief security officer hat on, one platform for everything sounds good. It simplifies a lot, and there are so many vendors. She added the cost:
“And you’re not paying like 10 million for each vendor.”
Elizabeth Nammour, at 13:08
Interview questions with no trick
Lizzy has done a lot of interviewing, at Airbnb and now at Teleskope. Jon asked for her favorite question. It depends on the interview, she said: coding, architecture or the person. For coding, she avoids questions that hinge on knowing one algorithm:
“building a data structure and like them interacting with that data structure.”
Elizabeth Nammour, at 13:53
Sometimes a candidate doesn’t get the algorithm in the hour they have:
“and that doesn’t mean you’re a bad software engineer.”
Elizabeth Nammour, at 14:00
People are human and don’t remember everything, and dynamic programming came up as another example. So did graphs. When, she asked, have you ever had to build one from scratch? Jon pointed out that there are databases for that. For architecture, she keeps it open-ended. She asks candidates to describe their favorite project at their last company, what its purpose was, and why they took it on, so she can see whether they understand the why of things and care.
“You don’t want someone who’s just doing something to do something.”
Elizabeth Nammour, at 14:57
Jon summed it up as connecting the details of a project to the bigger picture, and being passionate about it.
Green flags and red flags
Jon asked about the flags that decide a hire. Curiosity is the green one:
“if I give them feedback and they ask why and they’re curious, like that’s always a great green flag.”
Elizabeth Nammour, at 15:25
The red one is a candidate who pushes back on feedback. At Airbnb she would offer a hint during an interview, and some candidates ignored it completely. Jon called it a nice little hint that gets ignored.
“That’s like the biggest red flag.”
Elizabeth Nammour, at 15:54
It raises the question of how you would work together. Jon put it as chemistry and communication, and whether someone listens. She put it more sharply:
“And if you’re not listening to me in an interview where I’m interviewing you, when are you going to listen to me?”
Elizabeth Nammour, at 16:05
Jon said an interview shows a person on their best behavior. Everyone has an off day, he said, and you can stumble through a question and still be a delightful person. She agreed that performance varies, and said personality red flags stay red flags. Then she told a story:
“one guy never turned on his camera, and that was also a red flag towards the end.”
Elizabeth Nammour, at 16:39
With everyone remote during COVID, she said, one interview with the camera off is understandable. Every time, it feels like something is off. Jon said human connection matters, even remote.
Trust comes first
Jon told how he pitched investors during COVID. He set up the camera and a light on his face, and put the deck behind the camera:
“so it looked like I was looking directly at everybody”
Jon McLachlan, at 17:30
It worked even when he was reading notes from the deck.
Eye contact matters a lot, Jon said. Lizzy said she could get better at it on Zoom, where you look at your slides. Jon tied it to trust. In security, he said, trust is all we have. Once there’s trust between two people, in an interview or a sale, you can have a real conversation. An early-stage startup has to build that trust from nothing, she said. People ask who you are:
“Like, why should I trust you?”
Elizabeth Nammour, at 18:18
The person in front of them fills the gap:
“that human connection helps them build trust, because they trust you, and so they end up trusting the company.”
Elizabeth Nammour, at 18:24
Jon asked about hard questions from customers, and answers that built trust. Her answer was honesty about the features you support and the ones you don’t:
“I think when you’re very honest”
Elizabeth Nammour, at 18:46
In security, she said, people claim to do a lot of things, and then it turns out they don’t. So she tells a buyer when a feature isn’t supported yet, and offers to work with them on it. Buyers like that answer, because it shows she isn’t overcommitting. With other vendors, you can’t tell whether a feature is there:
“You just don’t know until you deploy. And sometimes they don’t even run pilots.”
Elizabeth Nammour, at 19:21
Then you buy the tool and find out it doesn’t do what the vendor said.
Investors, hype and honesty
Jon asked what it’s like to be a female founder in a field with so many men, and in security in particular. Her team at the time was four women and one man, she said, which happened by chance. Customers weren’t the hard part. Investors were, she said, because they tend to click with certain personality types, people who flaunt every aspect of themselves. In her view, women are often harder on themselves and won’t say they know something unless they know it 100%. Investor conversations reward the opposite.
Jon called the flaunting peacocking: the feathers go up, the colors spread, and it’s still a little bird. He said he values honesty, and he isn’t an investor. He had noticed what she described: a small club where everyone talks to each other, and once you talk to one, the rest know about you. He called it hype.
She took the hype to Gen AI. If you’re a Gen AI startup, she said, raising money is easy, and Teleskope was in that group:
“we use large language models, so we’re definitely playing that card.”
Elizabeth Nammour, at 22:00
Jon said the technology fits the problem, since you have to identify what type of data is flying around a system. She agreed, and made a distinction:
“I don’t think Gen AI is a hype in a bad way.”
Elizabeth Nammour, at 22:12
The technology is cool, she said. The hype comes from how people talk about it, and the technology has been around a long time. Jon compared it to the housing bubble, where the houses had nothing to do with it and the people did. Would it happen again? Jon answered:
“I mean, a history unlearned is a history repeated.”
Jon McLachlan, at 22:50
Hope, and anger as a signal
Jon asked for a book or movie that changed how she sees the world.
“my favorite movie ever would be Shawshank Redemption, even though I know that’s like a cliche answer.”
Elizabeth Nammour, at 24:03
Jon said everyone loves a cliche answer. She doesn’t think it’s a controversial pick. She likes it because it shows how important optimism and hope are. Even in the most dire situation, the characters stay hopeful, and in the end it works out. Jon said the two of them share the habit of finding the silver lining. If you always think about the bad, she said, you’ll never be happy. She asked whether that’s what meditation teaches, changing your perspective on what happens to you. Jon described one kind, where you become an observer. You feel an emotion like anger all the way through, he said, and ask yourself why you feel it. It stops being overpowering:
“It just becomes like data.”
Jon McLachlan, at 26:03
It’s a signal about what’s happening around you, he said, and whether it lines up with your values. She finished the thought:
“You take action, but you’re not, like, drowning in that feeling for days and days and days.”
Elizabeth Nammour, at 26:19
Advice to a younger self
Jon asked what advice she’d give her younger self.
“I think it’s to not be overly stressed about like the next goal.”
Elizabeth Nammour, at 29:11
Getting into the best college was the biggest stress of her life, she said, with all those A’s, and now she wonders whether it mattered. Studying matters, she said, and so does doing well. Being that focused on the next goal is what she’d change:
“You’re going to achieve that goal one way or another.”
Elizabeth Nammour, at 29:34
She also stressed about worst cases, like not getting into college, and doesn’t know why she kept thinking about them. Jon said it’s good to look back and see how much we’ve grown. He asked whether Teleskope helped her grow. Definitely, she said. You get used to hearing no. She could never have imagined messaging a stranger on LinkedIn:
“But now I do this all the time. I don’t have a barrier.”
Elizabeth Nammour, at 30:52
She used to worry she was bothering people. She likes messaging people now.
Top down first, freemium later
Jon asked about Teleskope’s go-to-market strategy. At such an early stage, she said:
“So right now it has to be like top-down”
Elizabeth Nammour, at 31:15
Then she described a bottom-up motion. Developers and security engineers try the tool on a freemium plan, and Teleskope sells the bigger platform from there.
For anyone who wants to try it, the first step was a demo. Teleskope shows the whole tool, and then sets things up with you.
Find it, fix it, and reach it through an API
Jon summed up the product: know what types of data you have and in which systems, and how to comply with GDPR, CCPA or HIPAA. She added that Teleskope also helps fix the issues it finds. HIPAA, the Health Insurance Portability and Accountability Act, was signed on August 21, 1996, and sets guidelines for protecting personally identifiable information held by healthcare and health insurance companies (Wikipedia). Then she named what she sees as the product’s strength:
“Our true power is that we’re really developer friendly.”
Elizabeth Nammour, at 32:10
“So all of our insights, you access them via APIs.”
Elizabeth Nammour, at 32:13
“So you can build your own security and privacy controls.”
Elizabeth Nammour, at 32:17
Every company runs its own internal systems and services, she said, so she can’t build everything out of the box for them. Jon said that sounds like bigger customers, with internal tools they want to feed the data into. That way, she said, Teleskope isn’t another tool that doesn’t talk to the others. Customers can plug it in.
One tenant per customer
Jon asked whether Teleskope runs as SaaS or only on-prem. It can be either:
“single-tenant SaaS or on-prem, whichever you prefer.”
Elizabeth Nammour, at 33:02
Jon said single tenancy makes him feel secure, kept apart from everything else in the cloud. She called it network segregation:
“Like, you only allow access for one customer.”
Elizabeth Nammour, at 33:18
That makes the system more secure and easier to manage, she said. It also helps at the end. If a company wants its data destroyed, single tenancy makes it much easier for Teleskope to confirm it deleted all the metadata it stores for them. In a multitenant design, one instance of the software serves many tenants (Wikipedia).
Policies on one side, engineering on the other
Jon asked, with no obligation to answer, whether Teleskope competes with Drata and Vanta.
“No, not at all.”
Elizabeth Nammour, at 33:33
The companies have synergies, she said. Drata and Vanta help with policies:
“they tell you what you need to do, but they don’t tell you whether you’re actually doing them or not, or how to fix them”
Elizabeth Nammour, at 33:41
Teleskope works from the engineering side:
“So we can tell you, these are all your databases that have PII.”
Elizabeth Nammour, at 33:52
You can upload that list to Drata, she said, because GDPR and even SOC 2 ask where you store sensitive data. Often, nobody knows the answer.
SOC 2 is one of the System and Organization Controls reports defined by the AICPA, which service organizations use to report on the internal controls over their information systems (Wikipedia). On episode 64, Daniel Marashlian, Drata’s co-founder and CTO, told how a SOC 2 request at his previous company pulled three of six engineers off the roadmap.
Mystery databases
Jon had been in large companies where nobody knew the answer.
“And then you get databases, mystery databases that show up.”
Jon McLachlan, at 34:12
Sometimes they hold prod data, he said, because a developer wanted to do the right thing and test. Then the copy gets left behind by accident. It’s so easy to forget, she said, and the numbers work against you:
“if you have 10,000 engineers, how are you going to keep up?”
Elizabeth Nammour, at 34:33
Everything has backups, Jon said, and backups of backups, and the data flies all over the place. She added more places for it to go, with thousands of SaaS vendors on top:
“you have three different clouds”
Elizabeth Nammour, at 34:43
Jon asked how Teleskope sees into all of that. The bigger vision, she said, is to discover a company’s AWS accounts on its own, by plugging into email or billing software, and to work out which vendors it uses. At the time of the show:
“But now all you need to do is just give us like an IAM role, and we’re able to discover everything within that account.”
Elizabeth Nammour, at 35:15
That covers everything within the AWS organization. Jon said the crawl and its results stay the customer’s own in a single-tenant instance. He had never been in a large company without this problem. She said it starts early, at around 150 to 200 employees. At that size, companies start working out what they need for compliance, and Teleskope can help put the controls in place from the engineering side.
The install script that failed
Jon raised the barrier to entry with any vendor: the sludge you run through to set one up. Even a small proof of concept takes a ton of work. Sometimes a month, she said, and that’s optimistic. Jon set a lower bar:
“but I’m counting even like 30 minutes as like a sludge.”
Jon McLachlan, at 36:46
She agreed, and asked about his worst onboarding experience. He wouldn’t name the company, which he said has a popular name. It went on and on:
“and then I ended up being their QA.”
Jon McLachlan, at 37:06
He had agreement from the C-level executives, and he told the vendor to take his money and send the install script. It didn’t work. Nothing worked. His team had to move fast, so they didn’t do the deal. Open source alternatives that they deployed themselves worked, with a strong community behind them. The vendor was huge, Jon said, and the story was recent. The larger the company, the harder it is to fix its own bugs. Lizzy had expected more from the vendor:
“I get everything else, but like the install, like, that should be the only thing that works.”
Elizabeth Nammour, at 38:20
When Jon said no, the vendor asked for logs from a giant system:
“And I looked at the logs, and it had like all of this other data in it”
Jon McLachlan, at 38:48
He couldn’t share them, he said, so he told the vendor how to reproduce the bug. They kept asking for the logs. She named the tradeoff with on-prem:
“you’re going to have to do a lot of like hand-holding to help them fix it.”
Elizabeth Nammour, at 39:17
With SaaS, a vendor can see the bugs itself.
Documentation that writes itself
Jon asks guests for a pain point someone should build a company around. She had one ready:
“I think documentation needs to be fixed”
Elizabeth Nammour, at 39:46
Engineers won’t write it or update it, she said. Her fix:
“So if there could be something that like basically crawled the code and then wrote the documentation for it automatically.”
Elizabeth Nammour, at 39:57
With the new kinds of AI, she thinks that’s possible now. Jon loved the idea. Maybe people write documentation once, she said, but when they change something, they don’t go back to it:
“No one’s going to update their documentation.”
Elizabeth Nammour, at 40:19
Jon remembered an engineer he worked with at Symphony Communications. Someone asked about the documentation for his code, and the engineer answered:
“the code is the documentation.”
Jon McLachlan, at 40:50
The code was pretty good, Jon said, and he still sympathized with the person asking. He didn’t want to reverse engineer how a server was stood up just to find an endpoint. He wanted to know what goes in and what comes out, the contract a service has with the rest of the world. An AI that scans code for contracts and publishes them would be great, Jon said. Today’s tools generate documentation from the comments you write, she said, and Jon named Swagger and OpenAPI. Someone still has to write the comments:
“people don’t even want to write that in the first place.”
Elizabeth Nammour, at 42:17
The OpenAPI Specification, called the Swagger Specification before, is a machine-readable language for describing web services. Tony Tam began Swagger at Wordnik in early 2010, and OpenAPI became its own project in 2015 under the OpenAPI Initiative (Wikipedia).
Keep pushing
Jon asked for words of wisdom to close the show. She said she was on the spot, and they knocked on wood for the day she runs a large unicorn. She said to keep the optimism:
“just keep pushing through”
Elizabeth Nammour, at 43:02
Startups fail when founders give up, she said. Jon called it the only reason they fail, and shared the serious one of a couple of sayings he’d heard:
“a founder is the first to know that something is going to fail and the last to believe it.”
Jon McLachlan, at 43:21
You can always find the solution, she said, and Jon said there’s always a way forward.
What happened after the tape
Out of stealth, then generally available. Teleskope’s About page puts the start of development in 2022. The company came out of stealth in 2024 with its contextual classification engine, and reached general availability with native remediation in January 2025 (Teleskope).
A $25 million Series A. On November 3, 2025, Teleskope announced $25 million in Series A funding led by M13, with repeat participation from Primary Venture Partners and Lerer Hippeau. The round brought its total funding to $32.2 million (Business Wire). In the release, Lizzy said that at Airbnb she had to catalog and classify hundreds of petabytes of data across dozens of platforms, and “the tools we used simply couldn’t keep up.” It’s the same problem as her first task on the tape. Fortune ran the news as “Former Airbnb engineer raises $25 million for AI security platform Teleskope” (Fortune).
Lizzy Nammour on LinkedIn, November 10, 2025: Teleskope's Series A, led by M13, with Primary Venture Partners and Lerer Hippeau, and an invitation to join the team.
Elizabeth Nammour · November 10, 2025
New products, and a channel. Teleskope launched its Data Reasoning Layer on June 11, 2026, and Kosmo, which it calls an AI co-pilot for data security teams, on October 8, 2026. On October 29, 2026, it announced that GuidePoint Security now offers Teleskope to its customers (Teleskope).
What security leaders said. On August 27, 2026, Lizzy shared a survey of security leaders. Seventy percent named AI data exposure or sensitive data sprawl as their top risk for the next year, ahead of identity, cloud, compliance and third-party risk. Half said remediation is mostly or fully manual. A team sees 195 alerts a day, and a high-priority one takes one to four hours to triage and resolve (LinkedIn). The calculator below runs the same kind of math on a review done by hand.
Lizzy Nammour on LinkedIn, August 27, 2026: what security leaders named as their top data risk, and how much of the fix is still manual.
Elizabeth Nammour · August 27, 2026
More on this site. On episode 24, Aman LaChapelle of Modular made the case for holding as little personal data as you can, since data you don’t have can’t leak. On episode 47, Clea Ostendorf, then a field CISO at Code42, talked about insider risk and data loss prevention. And on episode 41, Michael Moore, then chief privacy officer at Lacework, described how stolen personal data can destroy credit and wreck finances.
Did you catch it? A seven-question quiz
Seven questions from the episode. Each answer links the moment in the transcript.
Quiz · seven questions
Did you catch it?
Pick an answer to see whether you caught it.
-
What was Lizzy's first task at Airbnb?
b. "And they're like, oh, please identify PII in all of those columns." Transcript, 0:59.
-
How did she end up working in security?
a. "To be honest, I got into it by chance at Airbnb." Transcript, 2:30.
-
What does she still do in the afternoons?
c. "And then after that, in the afternoon, I code." Transcript, 8:11.
-
What was her worst day at Teleskope so far?
a. The first no came early, and it hit the hardest. See A first customer and a first no.
-
What's a great green flag in one of her interviews?
b. "if I give them feedback and they ask why and they're curious, like that's always a great green flag." Transcript, 15:25.
-
What does Teleskope need to discover the data in an AWS account?
c. "But now all you need to do is just give us like an IAM role, and we're able to discover everything within that account." Transcript, 35:15.
-
What company does she wish someone would build?
b. "So if there could be something that like basically crawled the code and then wrote the documentation for it automatically." Transcript, 39:57.
Do you know where your sensitive data lives?
Eight questions on finding, labeling and deleting sensitive data, built from the episode. Each tip links the section behind it.
Scorecard · eight questions
Do you know where your sensitive data lives?
Answer for your company as it runs today. If two answers fit, pick the lower one.
-
Do you keep a current list of every place personal data lives?
- No list
- Some systems, kept by hand
- Every database, warehouse, bucket and SaaS tool, kept current
Lizzy's first task at Airbnb was finding it by hand. See Every column, by hand.
-
Is every column or field that holds personal data labeled?
- No labels
- Some, labeled once
- All of them, and new columns get checked as they appear
A one-time review goes stale as columns change. See Every column, by hand.
-
Do test environments use copies of production data?
- Yes, and the copies stay around
- Yes, and we delete them after the test
- No, only masked or synthetic data
A copy made for one test gets forgotten. See Mystery databases.
-
Do you know every cloud account your company runs?
- No
- Most of them
- All of them, found automatically
Discovery starts with the accounts. See Mystery databases.
-
Can you delete a customer's data on request and show that it's gone?
- No
- From the main database only
- Everywhere, backups included, with a record
Single tenancy makes deletion easier to confirm. See One tenant per customer.
-
Do backups follow the same retention and deletion rules as the source?
- No rules for backups
- Some of them
- The same rules, enforced
Backups of backups spread the data. See Mystery databases.
-
Does someone check data before it leaves for a vendor, such as logs for a support ticket?
- Never
- Sometimes
- Every time, with a named owner
Jon found other data in the logs a vendor asked for. See The install script that failed.
-
Do findings about sensitive data reach engineers in a tool they already use?
- A report nobody reads
- A ticket now and then
- Through an API or a ticket queue, each with an owner
Findings help when they reach your own controls. See Find it, fix it, and reach it through an API.
You can't yet say where all your sensitive data lives. Start a list this week, beginning with your data warehouse and your cloud accounts.
You know the main stores. Next, check new columns as they appear, and stop copying production data into tests.
You know where the data lives and act on what you find. Hold backups and vendor shares to the same rules.
How long would a manual PII review take?
Lizzy’s first task was a column-by-column review. This calculator prices one for your warehouse.
Calculator
How long would a manual PII review take?
Four numbers: the columns in your warehouse, the minutes it takes to check one, the new columns you add each month, and what an engineering hour costs you.
A first pass takes 333 h, about 8.3 weeks for one engineer, at a cost of $33,333. New columns add 8 h of review every month.
The calculator counts one look at each column, and leaves out the tables outside the warehouse, backups, and the copies made for tests. The defaults are placeholders: count the columns in your warehouse's information schema, time yourself on twenty of them, and put in your own numbers.
From HIPAA to a data security Series A
The privacy laws and standards from the episode, Lizzy’s roles, Teleskope, and this show. Filter by topic.
Timeline
From HIPAA to a data security Series A
- HIPAA
Signed into law, with guidelines for protecting personal information in healthcare (Wikipedia, on this page).
- Airbnb
Founded by Brian Chesky, Nathan Blecharczyk and Joe Gebbia (Wikipedia).
- Swagger
Tony Tam begins the project at Wordnik (Wikipedia).
- The OpenAPI Initiative
The specification becomes its own project (Wikipedia, on this page).
- Booz Allen Hamilton
Strategic innovation intern, to August 2015 (LinkedIn).
- The GDPR
Adopted by the European Parliament and Council (Wikipedia).
- Amazon
Software developer intern, on a Kindle analytics team, to August 2016 (LinkedIn, on this page).
- Trust Services Criteria
The AICPA sets the five categories behind SOC 2 controls (Wikipedia).
- Airbnb data security
Senior software engineer on data security, to February 2022 (LinkedIn, on this page).
- The GDPR takes effect
Across the European Union (Wikipedia).
- The CCPA
Signed into law in California (Wikipedia).
- The CCPA takes effect
California residents get new privacy rights (Wikipedia).
- Proposition 24
Voters pass the California Privacy Rights Act, which amends and expands the CCPA (Wikipedia).
- Teleskope
Lizzy starts the company as founder and CEO (LinkedIn, Teleskope).
- Episode 24
Aman LaChapelle of Modular on holding less data (episode page).
- Episode 33
Lizzy on the show (Podbean, transcript).
- Out of stealth
With a contextual classification engine (Teleskope).
- Episode 41
Michael Moore of Lacework on privacy (episode page).
- Episode 47
Clea Ostendorf of Code42 on insider risk (episode page).
- General availability
With native remediation (Teleskope).
- Episode 64
Daniel Marashlian of Drata on compliance (episode page).
- A $25 million Series A
Led by M13, for $32.2 million in total funding (Business Wire, on this page).
- The Data Reasoning Layer
A new product launch (Teleskope).
- A survey of security leaders
Seventy percent named AI data exposure or sensitive data sprawl as their top risk (LinkedIn).
- Kosmo
An AI co-pilot for data security teams (Teleskope).
- GuidePoint Security
Teleskope is now offered through GuidePoint (Teleskope).
What to do this week
Five things, in the order of the episode.
- List where personal data lives. Start with your data warehouse and your cloud accounts, and label the columns that hold it, as in Every column, by hand.
- Stop copying production data into tests. Use masked or synthetic data, and delete the copies that exist, as in Mystery databases.
- Keep sensitive logs inside. Give vendors a way to reproduce a bug, and check anything you send them, as in The install script that failed.
- Send findings where engineers work. Route them through an API or a ticket queue with an owner, as in Find it, fix it, and reach it through an API.
- Get help with it. Our vCISO Services team builds the data inventory and the program around it, our SOC 2 Type 2 team gets you ready for the auditor’s questions about where sensitive data lives, and our Product Security work designs deletion and tenancy into the product. If you want to talk it through, book 15 minutes with us.