hi i'm steve schmidt i'm the chief information security officer here at aws i'd like to welcome
you to verified presented by aws reinforce where we'll be discussing the latest in cyber security
privacy and the cloud today i'm joined by newport davis the evp chief product and information
security officer at comcast could you tell us a little bit about your background what led you to
pursue cyber security and eventually your current role at comcast that's a really good question so
um you know i kind of happened into cyber security um and i think that's one of the things about um
you know what we do you gotta be always open to new things so um i started my career as a software
developer and you know spent tennis years doing that and you know kind of started going up the
management um chain and and started working with the software engineering institute at
carnegie mellon because they were doing a lot of research um in that space at that time carnegie
mellon was going around the world setting up uh emergency response teams right for cyber security
the whole insider threat um vulnerability management class of all of that was happening
there so i got pulled into that and that's how i joined newport many companies are on a cloud
journey right now how do you suggest they embed security culture into the process of migration i
think it starts with everything that security has always done that collaboration so um you know at
comcast we stood up a cloud center of excellence and had a very collaborative approach to this so
network engineering cloud engineering and security are all kind of equal partners and we all come
together and make sure that you know we have um the governance set up the um technology set up um
the implementation setup the rollout and it's like you know our one place where it all comes together
in the past before public cloud there was really a separation of duties uh in a organization right so
the person who managed the firewalls you know knew the infrastructure and the network and knew that
really really well and the developers kind of you know did their thing and then worked with the team
the again that separation of duties um as we go to the cloud the development teams are now expected
to know that that there's not only supposed to be dev experts but infrastructure experts and and and
again i'm going to go back to collaboration that's how it works you've just got to the security team
has to be like embedded with all of the other other teams newport you've spoken previously
about inclusive hiring strategies how is that fed into the development of comcast's security program
so um one of the first things to focus on of course is hiring and again in that microculture
we focused on two things one is um what we call our injax program and in jax is really kind of gen
x and jen focus on young talent we also have a program called act two which is the other side
of it right which is how do we take people who've been out of the workforce and that
is usually women right who step out for a few years to get uh to focus on family and kids
and how do we get them re-entered so we will have you know specific positions that will just be open
to that act to um kind of a population i think a diverse leadership attracts diverse people
um my directs are 50 women um you know which is um and and and you know i i would love to
take credit for it but it's it's those women seek us out and you know when there's a a
center of gravity like when you have two women there'll be more interest than it was just one
when there's three there'll be even more interest when it was then it was just two
so i think those three things is you know how do we attract younger diverse population how do
we get people who've been out of the workforce to come back and then how do you you know mimic
and and reflect that you are open uh by by your own leadership could you tell us a little bit more
about the security program and organization at comcast the the kind of things i'm interested in
are you know how do you measure roi in in that kind of an investment process
and how did you build the program itself you know one of the things that we do at comcast is
especially for the security program is um you know i really believe in um what deming used to call
constancy of purpose um you know you you really need to set kind of like a vision and
uh a hill for the team to climb and then a hill for that organization to climb together and then
you know there's all of the minutia that you have to do behind the scenes but you always want that
like what is that next thing that we're going to conquer and then the way we measure it you
know the roi on it when we started our hypotheses was that look if people start building security in
then the kind of things that we find after the fact you know when the product's been released and
is being used will start going down and we just did our very first full you know quantitative
analysis right monte carlo simulation with uh analysis of varia variants you know the full anova
analysis right and we can now show scientifically that adoption of those build security and early
practices actually result in fewer vulnerabilities after the fact xero trust is a term that's
certainly bubbling up in everybody's consciousness right now in our business and it's a trend that's
been going on for a while given our current times it seems even more relevant than it was before
can you give me your take on how organizations should think about xero trust in the context of
a broader security strategy so the question you asked is really important because i think each
company is going to think about zero trust in its own way the way we think about it is really kind
of you know two parts one is you know the identity of every person every device and every application
that is trying to access your corporate resources right wherever they may be public
cloud private cloud in our data centers wherever the second part which is just as important to us
for zero trust is this principle that we're going to assume that despite our best efforts
that you know something bad is going to happen and when that happens how do we limit the blast radius
and you know a lot of focus is placed on that right is um identity is the new perimeter
uh you know with people working from home like i spent days now where you know i may be logged
into my network half an hour a day right i can do all of my work outside it so now you know how do i
how do i make sure that the device i'm using the network i'm using and who i'm proclaiming to be
are all trusted and verified one of the things i i would like to expand on a little bit that i think
is really important is many people think about zero trust as a way to deal with humans in the
the access of people when in reality one of the biggest levers we've got as a security industry
is service to service trust and getting rid of it really is a great way to limit the expansion
of access if a bad actor does make their way into something and it's an area that i think
a lot of people don't spend enough time or effort okay no conversation right now would be complete
with about a discussion around the state of what's going on in the world at the moment here
2020 brought a lot of firsts for a lot of companies i know we've radically shifted the way
we've done business i'm sure you have as well what are the sort of the first things that you've seen
at comcast the stuff that's come up for the first time the network has never been more important
you know what we're doing right now is over our network um you know people are now going to school
working entertainment um news um you know it's it's really that the network is the backbone of
all of that right and i'm so proud to say that you know all of that investment billions of dollars
over the years that that comcast has made in the network has really stood up to this so we really
conducted tens of millions of diagnostic tests that we conduct you know constantly
and and we accelerated that even more during this time to go
here's an issue how do we go deal with it so we added you know 35 terabits per second of capacity
this is on top of what we already had right this is just to handle peak capacity um
340 growth in our 100 gigabit circuits right which is um because again just to get ready to and like
you said you know this is not something you can do remotely these are our front line people who
go and and do this work they really are heroes um of the company who have done this during this time
so um amazing amazing amount of um investment in the network amazing amount of focus and amazing
amount of acceleration so you know we had programs underway for things like you know more artificial
intelligence more learning more how do we kind of constantly see here's an issue in the network
those road maps were accelerated by months and we did things in weeks that you know weren't planned
to be done for you know another four five six months newport thanks very much for joining us
today it's been awesome to talk to you steve it's been really fun this was this was great
you