Welcome to the intersection of technology, cyber security, and society. Welcome to ITSB Magazine. You're listening to a new episode of Nightlife with Alyssa Knight. Alyssa and other nightlife guests will explore the trichotomy of passions in Alyssa's life: cyber security, content creation, and entrepreneurship. Knowledge is power now more than ever.
You're the CISO of Twitter. You've been the CISO since September of 2020. You've had a string of advisory roles for companies and VC funds like Wild Ventures. Been an advisor to API security, which is very near and dear to my heart as an API security VP of information security for huge companies like Palo Alto Networks, eBay, Intuit, IBM. We could spend an entire episode talking about your career and your resume, so I won't do that. And I hate it when people give my bio right in front of me. So why don't you tell everyone who you are, who is Rinki, and we'll start from there.
Yeah, it's an honor to be on your show, Alyssa. And yeah, a little bit about me. So I was born and raised in the Bay Area. I graduated from UC Davis with a computer science engineering degree. Later pursued my master's degree in information security. I've been in cyber security, gosh, for almost two decades now. It flies, it flew by. Like you said, I'm currently at Twitter. Prior to that, I was the CISO of a company called Rubrik, a cloud data management startup company in the Bay Area. I've worked at IBM, at eBay, Intuit, Palo Alto Networks.
You've definitely been around the block.
Definitely. Yeah, I've been around the block a few times. And so, held various different security roles at all these different companies. Aside from the day-to-day work, I am very passionate about bringing in more people into cyber security, increasing the number of women in technology, ensuring that kids have cyber security education. And so, you'll see me involved in efforts outside of work or using work as a platform to enable some of the initiatives in those areas. And I have two kids of my own who teach me cyber security lessons every day, too. So, that's me in a nutshell.
That's amazing. No, I'm really impressed with what you've been able to do and also just to meet another woman in an executive leadership role, especially at a company like Twitter. So, one of the things that I like to do is I try and think of the questions that my audience would want to ask you if they were sitting here in front of you. And you know me, which I don't really talk too much about, is my role at Quantic Bank and being in a security leadership role. I really want to ask you, when you stepped into your role at Twitter, did you decide, okay, we're going to do NIST CSF at Twitter or we're going to do ISO 27001? Obviously, you inherited some things from your predecessor. Did you end up building a brand new information security program there? And if so, what framework did you choose?
Yeah. So I'll talk about my first 90 days. I'll talk about frameworks and then I'll tell you kind of what happened and what we've been doing. So I came into Twitter during a really interesting time, right? I came right after the security breach but right before the US election. So it was not a time of calm. It was kind of like dig right in. Let's prepare and make sure we're serving the public conversation in a secure, protected way. And yet, we're still trying to come out of the breach and make sure that we remedied the things that we needed to fix within the company. And so that's what I was marching into. I was fortunate in the sense that there were a lot of investments being made in security at the time. The team did already choose to go down the ISO 27001 framework side, and so that has been something we're working through. And then as we were going through this kind of tumultuous time, if you will, we then came into the new year into 2021 and I spent a lot of time really thinking about where are the areas where we have significant gaps from a security strategy perspective and where do we need to really uplift. And in the context of Twitter, and Twitter operates very differently and it's a very different company with different challenges than prior companies I've worked at. And so really getting that in the Twitter context and building a strong security strategy, ensuring that we have everything from what is our mission statement to what are the different strategic themes for the next two years that we're going to operate under and what are the projects, programs, work streams that all line up to that and what are the success metrics. And so that also all ties back in very nicely into the ISO 27001 framework. But that's kind of how we've been operating. The first 90 days, I've read that book, right? Your First 90 Days. And it was, I had to throw that out the window. And it's kind of interesting because in previous companies I've been at, I've been able to go and really operate leveraging that book saying like I'm going to spend time with the executives, clear all the gaps, ensure that we have then a strategy that's built out, get board approval on it. Ensure that you're meeting with all the right folks. Make sure the team that works for me, that I have good relationships with them. All of that was thrown out the window here. I didn't.
I always say life is what happens when you're planning other things, right?
Yeah, that's exactly what happens. So, I had to kind of just go with the flow and we're now, I'm now nine, ten months in at Twitter. And we have a strategy. We've got things that are now in place.
Oh, that's exciting. Well, now it's interesting because when I was stalking you, I went through the first part of your career and you and I really kind of come from the same background and grew up in the, I'm 21 years in as well. I know they say it's dog years in cyber security, but you started as a security engineer for roughly, keep me honest here, but I believe about 12 years. And it's interesting, you worked as a security engineer for Walmart and some really high-profile brands. What was that moment where you said, you know what, I can't live in the bash shell anymore. I want to move into a CISO role. I want to move into a leadership role. Or was that always the plan? Did you or did you kind of wake up one day and said, you know what, I'm not going to do the whole interpreter shell anymore. Like time to move on.
No. So I don't think so. Let me think back when I was an engineer. I didn't necessarily say that I want to go into management. It happened. And it happened when I was at eBay that I started building out a security culture program for eBay. I was a security engineer. I joined eBay as a security engineer and they really needed a focus on security culture. And this is at a time where spear phishing was at a high. They were seeing some very early attacks as a victim when I was there and so they started saying we really need to focus on education for employees. And I started building out the program and the program became so big I couldn't do it on my own and we just needed team members to join the team. And so without even knowing it, I hopped into a manager role. And wow, I had to kind of learn the skills of being a manager because it's so different than being an individual contributor. And at the time there weren't a lot of female CISOs surprisingly enough. And so I never thought that I would be a CISO. It was more like that seems like an interesting role. I always thought I would work for one. And that shifted for me when I started getting more and more into leadership roles. I started really enjoying it and I realized that I had a knack for leading people. And I loved it and it was one of the things that brought me the most joy because I actually did go from being an engineer to a manager going back to being an IC because I was like I just got burnt out and I thought I need to focus on myself and my two little kids at home and I can't be parenting at home and at work. So I took a step back and they asked me to take on a leadership role again and I realized that you know I do have a knack for it and so that's when I started seeing kind of that this might be a path for me. And it was at Palo Alto Networks that I really started aspiring that I think my next role I want to take on is a CISO role.
Oh, wow. That's amazing. Yeah. I always like to ask my guests what was that ladder? What did that ladder look like for you? And it sounds like you became an accidental CISO. You just accidentally, accidental leader just kind of fell into it. That's interesting. So, who is your, I'm assuming the first thing that you did when you found yourself in a leadership role was trying to figure out all the books you should read. You know, who are some of the people that inspired you? Was it the Simon Sineks of the world and leading with why or you know, were there, or you know, can you think of anyone that just kind of inspired you along the way in leadership?
Yeah, you know it's really interesting. I've read so many books. I love Why is a great book. And there's so many books I've read around that especially around like teams and how do you build really strong teams. I love the book Sapiens. I think that has some very inspiring just how did we all come to be and why are we the way we are and just kind of going back into that. But what really inspired me, or didn't inspire me and where I've learned the most from are other people that I've worked with and or worked for. Peers of mine, leaders of mine, either doing things that I love and I think that like those are traits that I want to copy and do the same and do that even better, or areas where it's like I never want to be a manager like that. I'm never going to do the things that that person did. And both are in, you know, both have taught me different lessons and I believe helped me be a better leader. And I've surrounded myself, fortunately, with peers and people that do give me feedback when I'm doing good things or when I'm doing things that need to be corrected. And I try to become better through that way. And I think that's been my best way of learning is through others around me.
Well, very early, you talked about, you know, your, when we were, you and I were talking together earlier, you talked about your work in mental health, and I think this is a really important topic, and I myself have even begun getting involved in these areas of healthcare, healthcare security. One of the things I do want to touch on though is really with the pandemic and some of the even mental health concerns that have come up as a result of the pandemic. Especially people that are in an abusive home and now they're forced to shelter in place with that abusive family member. You know, there's all kinds of issues that have sprung up as a result of the pandemic. But from a, with your CISO hat on, how has the pandemic changed your cyber security program and plan? Right. So, you know, you came in obviously, like you said, you know, getting your 90-day book out and trying to follow it chapter by chapter, but then there's this pandemic and how has that sort of changed your plan? Did it, you know, I know you mentioned having to throw it out the window, but what's different now, especially with so much of the workforce working from home?
Yeah, I have a lot to say on this topic. And so Alyssa, cut me off if I'm going too long.
Yeah, no problem. No problem. Yeah.
First of all, I went through an identity crisis of my own when the pandemic hit, right? And it was, I was at a company where we had to take a step back and we had to really look at like how is the company going to survive through the pandemic? What does the pandemic mean? And if you remember back to when that moment hit, it was really scary because you didn't know how long things were going to be shut down for. Were companies still going to buy security products? All these questions. And we had to scale back a little bit. The IPO plans got delayed. And it became a time for me where because of all of that, the security program took a hit and we had to scale back on that too. And I had more free time on my hands because of that. And so then like I'm a person where I love my work and I'm very passionate about it. And it got to a point where I went through an identity crisis and that's what led me to Twitter actually because I really felt like I needed to do something where I was impacting the world in a meaningful way and that I was being challenged because otherwise I was sitting at home making, and I'm not a great cook, and I was making extravagant meals for the family every day and that was not what brought me joy and happiness. And so I think I went through my own thing. I also was dealing with a very close family member who has schizophrenia and is bipolar and I had to go through that during the pandemic and helping manage a very close family member who's suffered with this for decades now. But had to really work with them and support them and it's such a thankless, very draining role to play a caretaker for someone that's going through that. And so I just think our system is not structured in a way to really support folks with mental health and this pandemic only underscored that where folks were now alienated, stuck inside the home, especially folks that were alone. And so when that happens, you go to work and you're more prone to be making mistakes, right? If your mental health is not in the right place. And so you can call it insider threat or you can call it whatever you want, but it's folks that are internal. Are they in a good place? Are they going to make mistakes or is their mental health going to affect their work in some way? And so that has to be baked into a security program. Is thinking about that insider threat component both from malicious insiders but also from the accidents that might happen. So I think you really saw an uptake of robust insider threat programs. I think also during the pandemic, it was also how do we support hybrid environments whether folks are at home, you're no longer dependent on the perimeter so you saw programs take a shift. And I was actually at Rubrik and we saw many of our customers during the pandemic say like I don't know that I want to, I think we need to move faster and accelerate our movement into the cloud now and really look at more SaaS applications and all of that. So you saw this huge shift in the way that folks were thinking about technology and enabling remote workforce and all that got baked into the cyber security program as well.
Yeah. And one of the things that I really wanted to ask you as part of that is sort of a question, one question, a sub question is, with your employees working from home, on-prem network intrusion detection prevention maybe wasn't as important now as endpoint security. Did your security control framework change? So did you want to divert more of your budget to endpoint security agents? Before the pandemic, every CISO was like, no, no more agent-based anything. You know, the CTO is going to get pissed at me if I put more agents out there. No more agents. And now we're in this very disparate sort of infrastructure where people are everywhere even more so than before. And it begs the question if there is a future for network intrusion detection prevention on-prem in the corporate network when a lot of employees aren't even VPNing in anymore because they don't need to and they're going directly to the internet. So did that change your budget planning and your security control framework on where you think you needed controls?
I think it not really. So what happened was, I think what happened, and this is what I'm hearing from my peers too. It wasn't necessarily that we're not going to invest in network intrusion detection or that, and the agent story is still always the agent story and we don't want agents but we have to have them. And so what happened though was this concept of zero trust. Everybody was talking about it and everybody was saying that right, and like it's a long journey to get there but that's the model that we're going to follow is a zero trust principle and all of that. What happened was plans got accelerated. So if anything the budget got pulled forward to what can we do to accelerate our path to zero trust? How do we rely on our identity solutions in a more meaningful way as things are hybrid? How do we ensure that we're deploying a zero trust model whether it comes to our identity or VPN on the network whatever it is. And so that's where I think that there was a massive acceleration in getting to that zero trust and companies that weren't thinking about that have I think started putting that on the table and that's kind of being talked about in CISO circles more and more now.
Yeah, you know, it's, I think especially the question of with software-defined networking, if there's even a future for VPNs. You know, there's all these new conversations and religious debates over these discussions about whether or not the sun is setting on certain controls in this new work environment that we're in. So one of the things that I know is, and I'll end the security control talk with this question, is whether or not you, what your opinion is on the future of DLP, right? So, cloud access security brokers, everyone's moving to the cloud. Everything's in the cloud now. Active directory, email, there's really no reason anymore, especially with cloud drives to even VPN into the network anymore to access anything because everything's in the cloud anyway. Do you think traditional DLP is sort of going away? We haven't really seen any innovation here in the last decade with DLP. It's pretty much all the same main players. With CASB looking more and more like DLP, I feel like it itself is experiencing an identity crisis. So what do you think, if you're to opine on the future of DLP and whether or not it's being replaced by CASB, what's your opinion?
Yeah, I'm with you on that. Like I haven't heard the terminology DLP in a long time.
I know, it's like no one talks about it anymore.
No one talks about it and I think they talk about it in the context of CASB. And even CASB, you've seen kind of like CASB solutions now be rolled up into what do they call it? They're calling it actually just like security operations now or cloud, I'm even seeing it labeled as asset management.
Yeah. And now, did you know there's this new product category? I've never, I didn't even know this was a product category but there's one called insider threat management or ITM solutions.
