← Risk Never Sleeps Podcast
Risk Never Sleeps Podcast
Episode #150. Fail Fast, Learn Faster: Protecting People, Machines, and Data, with Matt Topper, CEO of UberEther
00:27:24
Loading summary
Transcript98 lines
- [00:00]
Matt Topper
Foreign.
- [00:06]
Ed Gaudette
Welcome to Risk Never Sleeps, where we meet and get to know the people delivering patient care and protecting patient safety. I'm your host, Ed Gaudette.
- [00:18]
Welcome to the Risk Never Sleeps podcast in which we learn about the people that are on the front lines protecting patient safety and delivering patient care. I'm Ed Gaudet, the host of our program, and today I am pleased to be joined by Matt Topper, the CEO of Uber Ether. Did I get that correct?
- [00:34]
Matt Topper
You did. I love that.
- [00:36]
Ed Gaudette
That's such a cool name.
- [00:37]
Matt Topper
Yeah, 14 years ago, or, heck, at this point, 15 plus years ago, moonlight and while I was at Oracle picked a name and here we are. It's stuck.
- [00:47]
Ed Gaudette
It's a good name. It's a catchy name.
- [00:49]
Matt Topper
So you realize our office is about 2 miles from Dulles Airport and we get regular calls daily about. I can't find my Uber driver. And you're just like at home, the people.
- [01:01]
Ed Gaudette
Well, the downside of that name the downside, at least you don't have someone calling you, hey, I'm hanging out in the ether here. Can you help bring me back to reality?
- [01:13]
Matt Topper
So isn't that a daily topic in cyber security?
- [01:17]
Ed Gaudette
It really isn't.
- [01:18]
Matt Topper
It.
- [01:18]
Ed Gaudette
It's like, oh my God, like, what are they going to throw at us next? Huh? It keeps it interesting though, right? You're never bored.
- [01:26]
Matt Topper
That is absolutely true.
- [01:27]
Ed Gaudette
Never without a problem to solve. So let's start off with sharing a little bit about your current role, your current company, with listeners.
- [01:34]
Matt Topper
Yeah. So as I mentioned, I started Uber ether almost 15 years ago now, had been working at Oracle Corporation in their National Security group. I was running their identity and access management implementation team, so. Right. I'm sure many of the people in the audience have dealt with Oracle over the years and their healthcare systems and still do. Yeah. And if you don't, there's a high chance you will because they're just gonna go acquire that company. But my line was always all of the I called them lies that the salespeople told you is my job and my team's job to turn into truths. And with that, in the National Security Group, I was dealing with a lot of our intelligence agencies in the United States, deploying with our five eyes partners for the most top secret information. And with that just continued down this deep cybersecurity path and really into Identity doesn't stop at the human, it moves to the devices. Whether we're talking IoT, we're talking pacemakers, we're talking MRI machines, or even the H Vac systems that are going into the buildings. They all have identities and relationships, each other and the humans. And how do we solve this problem at scale? And that's really what we focus on at Uber Ether is now that the castle walls have fallen with our traditional right in castle walls and mode approaches to network security. And then we've all moved to SaaS and distributed systems. Identity is kind of that last security thread to hold onto. And if you look at human and non human identity as the identity security layer, tend to think that's where the only real way to solve the problems.
- [03:13]
Ed Gaudette
Yeah, it has that consistency of water, but you also want it to have the strength and power of water at the same time.
- [03:19]
Matt Topper
Right.
- [03:21]
Ed Gaudette
So how do we make that happen? Right.
- [03:24]
Matt Topper
So do we now have to go watch a Kevin Costner Water World for inspiration?
- [03:31]
Ed Gaudette
Yeah, yeah, exactly. Or Sharknado. Sharknado might be a better. So how did you get into security? Like, what's your origin story?
- [03:41]
Matt Topper
I started out as a data nerd. I was lucky enough right out of high school to get an internship over the summer with a company that at that time they had all of the automotive vehicle information. So, right, you've got sales records from all of the manufacturers, but as soon as you buy the car and sell it, the manufacturers have no idea who owns that. So they would aggregate like all of the manufacturers the sales data. So you could do analysis of like, how good are our trucks versus Ford trucks? How good are this versus this? And then from there we also got all the registrations from all the different countries from the DMVs and brought that together. So if they had to do a recall or if they were trying to target you to come back into the service center, we had all of that data and built all the information and essentially was lucky enough to be at a point where we were moving all that data from the mainframe to open systems, which was Solaris giant E10Ks at the time, which were like the biggest things, right. Sun and Solaris ever built. Like you think of a rack, it was like five racks in one. And so got to build that, build some big BI systems off of that and won some cool awards. I kind of hit that cool curve of things going online, going onto the Internet, really rise of enterprise systems. But with that started seeing the problem of, okay, I've got this BI system and it works great when it's the people in our company, right? Because we've got our HR system and we know when people are hired, when they're fired, when they change jobs, they change roles. We can give them different things. When we move the salesperson from the Chrysler team at the time right to the General Motors team, like, okay, well there's now Chrysler data that they shouldn't be able to see anymore. But now when we've taken these systems and it's no longer like emailing in the report, like the whole thing was they would either call, fax or email in the report they wanted, go on the mainframe. Three days later we drop it in UPS and they get a stack of papers for the report. Well, now it's online. Now I've got General Motors employees that are coming in. At that point there were no federation standards.
- [05:53]
Ed Gaudette
Yeah. Or entitlement standards. Like how do you manage entitlements as long with that data as well as the authentication and access to it.
- [05:59]
Matt Topper
Yeah. So like I kind of started getting into it there and then I had won like Oracle developer year. I. It was like super early on. Like Google Maps wasn't even out yet. But right. Like we're talking. I was thinking to myself, kids can't.
- [06:15]
Ed Gaudette
Even picture a world without Google Maps.
- [06:17]
Matt Topper
Well, you remember how great an AppQuest was? I could send it out and take it and flip the pages in my car. Exactly. I realized the other day, I know out under counting years in the industry. I meant counting decades.
- [06:31]
Ed Gaudette
Yeah, I know, I know.
- [06:33]
Matt Topper
But like it's silly stuff where we started being able to do like dynamic thematic shaded maps of. Okay, we've got this data now I can go by county, by zip code, how many cars were sold in there? Oh, now I can overlay roads. And when people were doing dealer planning networks, they would be like, oh, we're going to do a dealer. Just call it every 40 miles. Well, they'd look at it and go, well, why do these people in Colorado drive 100 miles to this other dealer? And so that one that's only 20 away. Well, there's a mountain in between with. No, but like before that type of stuff you couldn't do that.
- [07:07]
Ed Gaudette
Yeah.
- [07:08]
Matt Topper
Or you have to go buy like an ESRI package and install it and nobody had budget for that.
- [07:13]
Ed Gaudette
Cyber speed misery 32 days. Yeah. Yeah.
- [07:17]
Matt Topper
Wow. So then got into consulting and I was still young and stupid at the time and got put on a bunch of cool high risk projects. And I strive for the hard stuff. And it was very much a. Nobody wanted to do the security stuff. No one wanted to do the identity stuff because all the people I worked with were like, yeah, you don't want to do that. That's where if you screw up people get fired. And the fire in me went, cool.
- [07:45]
Ed Gaudette
Someone can't do it.
- [07:46]
Matt Topper
Yeah, right. That's kind of how I got involved. And it's been a sick addiction ever since.
- [07:54]
Ed Gaudette
Yeah, it certainly is. I've always, I struggle with that. I was like, why next company I'm going to pick something just stupid simple like that. Anybody like stupid simple? I'm the same way. I gravitate towards the harder problems to solve.
- [08:09]
Matt Topper
So.
- [08:09]
Ed Gaudette
All right, well that makes sense. And then, you know, as you look at the next 24 months, what are those top initiatives you're thinking about? What are your strategies looking forward?
- [08:17]
Matt Topper
Yeah. So with us, what we've seen a lot of challenges, especially in big organizations is most of Identity has grown up as an industry from the compliance side of the world. Right. We've got HIPAA violations that right. People can only get the right amount of access the right amount of things at the right time or else you're going to have an audit finding or. Right. It's a financial audit finding with our friends at Enron is really what made the industry a thing 20 years ago at this point. And because of Identity kind of growing up in that side, a lot of the programs, a lot of the implementations were built around your kind of big four consulting companies that were just trading gigs of we're the auditor here, we can't do the implementation but our buddy at PwC or UI can for you. Yeah, but because of how that caught up or grew up, Identity traditionally hasn't made worked closely with the security teams and we're seeing a lot of the CISOs getting the identity teams along with their like SOC teams and that type of stuff. But it's still thought of as compliance. And because of that grow up and being really compliance related, it hasn't been looked at as enterprise systems and it hasn't been looked at as enterprise services. So you've got this vendor doing governance, this vendor doing single signing, this vendor doing maybe your directory a completely probably not even in your identity stack, doing your API security side of things. And for the big consulting orgs, right, that are traditionally your auditors, that's opportunity and revenue. And yeah, we saw customers very much taking 18 months after they bought a piece of software just to get an implementation and the first thing rolling through. So we say forbid this like the best practices for integration are there, the standards for integration are there. Let's take the best of breed vendors and then bring them together in a provisive package and then do vertical based overlays of okay Are you federal government? Are you healthcare? Are you higher education? And put kind of those best practices and then sell that back to customers. And that's been very successful. A lot of it's funny, we have Fedrampi as our certification, which then gets a state ramp, but we also have Department of Defense impact level five. And we were like, okay, this is great for government, but how many healthcare organizations are like, no, we want pay that extra amount to get a Fedramp's version because the government's holding you accountable to a standard higher than soft. And what I'm seeing over the next 24 months is we've kind of got our arm. I won't say it's solved right as an industry in general, but our arms are on the human side. With the rise of AI and MCP servers and all of these services that we're trying to get ahead with, we're kind of letting the horse out of the barn and all the data is flowing into these things. And I always tell people, like when the MCP spec first came out from Anthropic, the security section in the documentation was literally listed as whack, whack to do. Right? Like this is the new integration API standard for all things AI. And we just know security is going to be hard, so we're just going to figure it out later. So I think we went from flying.
- [11:35]
Ed Gaudette
Cars to picking shovels again. Yeah, yeah, we'll get back, we'll get back quickly. But no, it's a lot of infrastructure.
- [11:42]
Matt Topper
24 months exactly. You know, with the sales loft breach that we saw. Right? That's a. Okay, we got API keys, oauth tokens that went to Salesforce, that went to Google, that went to all these pieces. They took the keys and then came and rips the data with it. Right. So we really think that the focus is going to be on that side of the non human identity problem, or when a human interacts with a machine identity or a non human identity and then that tears on behalf of the human making those practices better. So that's where we see things going. The standards are still emerging, they're moving very fast. I'm enjoying watching finally the security communities as well as the identity communities come together and realize, oh wait, we all have like. For me, I laugh because I'm like, this is what we've been preaching the last 10 years. But growing up in the US intelligence community, like there was no identity without the security team being right there all the time. And every time they put up a new cloud environment they were smart enough to go, okay, the security team and the identity team are the first two tenants into that. Like, well guess what? The standards of practices and scars were built by the teams to protect it. So seeing this finally come together and publicly kind of those groups with standards and the people actually moving things forward going, oh, you've got that. I've got this. Literally this week's ietf, the metadata standard for clients to dynamically register with an OAUTH server. And being able to do that of like hey, I'm from Uber Ether, I'm from Salesforce, I'm from Google. Okay. Now I know who owns the trust with that thing like that metadata registration standard literally got solved and solidified in yesterday.
- [13:32]
Ed Gaudette
Yeah, I know it's funny, I wrote a patent for quorum based authentication years ago and it feels like now that's starting to become like a. We're leaning towards that approach to identity, especially with blockchain. It's really exciting.
- [13:46]
Matt Topper
Yeah. And that's really like right. We've had the at least five years at this point. I think it's closer to end the push towards zero trust and too many organizations, I see the Zero trust initiative is just putting their VPN 2.0 out there. Their Cisco, their Apollo, their Zspaler. And as long as we all put the same clients on all of our machines, it all works together. Yeah. Which is the case. Well, you other healthcare network, as long as you buy zstealer, it's fine. That's right. Well guess what, like no, you're dead. So the standards, as you said, a quorum based I call it right. A trust fabric is arising of okay, I trust these organizations, those organizations root of trust is defined in these areas. This is their identity provider, this is their certificate provider. This is how I attest that those things have not changed. And if they change, where do I look for the governance structure to go? That yeah, it really was their administrators that did that and not the hacker that pulled the keys off and did the next Solar Winds attack.
- [14:52]
Ed Gaudette
Yeah, it's almost like Uber Ether.
- [14:56]
Matt Topper
Might work that way. Yeah. It's like we've had these debates in the identity community of right, you've got DNS that right. We all know forever you could override and we can say whether DNSSEC is good, bad or indifferent. Right. It's got. Everything's got its warts. But that idea of okay, I know at least that the key on this domain and everything under it is signed with this. And I can attest that as Long as everything's signed to that key, we're good to go. We still need kind of that governance overlay for things in identity and non human identity and the zero trust realms that I don't think have been adopted well enough yet. So.
- [15:39]
Ed Gaudette
Yeah, well wasn't the Amazon issue recently a DNS resolution with Dynamo db? I mean when are we going to be. When are we going to be rid of that? Never down taking down like half the industry like what was. I've run into DynamoDB issues like years ago. You figured they would have this thing solved by now.
- [15:59]
Matt Topper
But sure enough, personally I enjoy those events because it proves a lot of the industry bullshit and really proves that oh yeah, we're in multiple availability zones in multiple regions and we're multi cloud. But that one change in AWS boned it all right. And as like both a consumer as well as helping customers buy those things, I use those as events to go back and don't point at AWS Vendor Ms. Vendor. You go look internally and figure out why you aren't resilient to that. And yeah, great place. And we're seeing like that points to some things we're seeing on identity too is right. Everyone's rushed to the cloud to take these things out of their data centers because at the end of the day they didn't have the budgets to build multiple data centers. Failover Dr. Yeah, do right. Biannual testing and validation and failover that they think their vendors are doing.
- [16:58]
Ed Gaudette
Which is opportunity like you said, like it's opportunity for many of us that have. Yeah. Been at this a long time, so.
- [17:04]
Matt Topper
But I'm definitely seeing the idea of a resilient identity provider come back that runs on premises. So we're seeing a lot in manufacturing, in retail. Right. Of like hey that's great that we've got all of our call it Home Depot inventory online or our ordering system for Chick Fil A. But even if we have a landline connection and a Starlink connection, both of those have gone down. And if we lose a Chick Fil A orders at lunch, if I can't get Internet orders, fine, but I still need to run the drive through and same thing with the Home Depot as a world or like manufacturing plants at large automotives or even God forbid, right. Healthcare networks. If you've got to terminate the Internet connection for a hospital, you've got to be able to run independently inside. And a lot of the cloud provider architectures don't let us do that anymore.
- [17:57]
Ed Gaudette
Yeah. Geez, I can't even imagine the cost of that, having that redundancy in place. Infrastructure is one a piece, but all the applications and other services we rely on that are now in the cloud.
- [18:10]
Matt Topper
Yeah, yeah. Like Epic. Right.
- [18:13]
Ed Gaudette
But Epic, even Epic, you can get hosted internal. You can have it internal, you can have an on prem version of it. Right. So. So you could theoretically see a world.
- [18:22]
Matt Topper
Where you're running both.
- [18:23]
Ed Gaudette
But most cloud providers don't have an on prem version of epic. That's the problem.
- [18:28]
Matt Topper
Yeah, yeah. And right. That's the risk thing of like, okay, if Epic goes down right at the end of the day, it's the charts that come out. Right. And people hand script shark for a couple hours that they pray it comes back.
- [18:40]
Ed Gaudette
Yeah, yeah.
- [18:42]
Matt Topper
It's good.
- [18:42]
Ed Gaudette
Yeah. It's a hard problem to solve. So as you think about your journey, if you could go back in time and see your 20 year old self, what would you tell that person? What would you say to Matt Topper, 20 years old, give up on this.
- [18:56]
Matt Topper
IT stuff and go do reworking or something a lot less stressful. Wow.
- [19:00]
Ed Gaudette
Okay, that's.
- [19:03]
Matt Topper
I'm a builder. At the end of the day I have to do something where I'm building something with my hands and it. I think people can realize, like I grew up in Detroit. All my high school buddies that I still get like hang out with, like, we'll be driving down the road and they're like, oh, I did the seats on that, I did the gas tank on that, I did the cost for that thing and I'm like, I built the site that helped you sell them. But like that's part of like the tangible piece of what we do.
- [19:28]
Ed Gaudette
Yeah.
- [19:28]
Matt Topper
To me it's kind of cool because we are getting into it in the physical world. I'm like, yeah. And I'm the one that lets you actually play Spotify on that radio and not have to pull out your phone to do it securely.
- [19:39]
Ed Gaudette
That's right. While you're changing that engine out.
- [19:43]
Matt Topper
You'Re.
- [19:43]
Ed Gaudette
Doing it with a smile on your face because Springsteen is streaming through those speakers because of me.
- [19:48]
Matt Topper
Damn it. I don't think I change much, to be honest. I've been very fortunate to have a high pressure but also highly rewarding journey so far.
- [19:59]
Ed Gaudette
Yeah, I think maybe that's what you say. It's going to be a good ride. Hang on.
- [20:03]
Matt Topper
Yeah. Don't worry about it from an IT cybersecurity side. Like the ride's been great. Learned a lot of lessons running a company and starting a company and probably would have said Trust more professionals that like running a company more than building cool shit sooner. But I've got a great leadership team now that we've built over the last five years that, like, I get to do the things I like and build cool stuff again rather than worrying about, like, who our payroll provider is and when the next healthcare bump of 15 to 20%.
- [20:37]
Ed Gaudette
It's always about the team. Like, it's always when you work with a great team, like, it makes so much of the difference in everything.
- [20:44]
Matt Topper
Yeah, yeah, that's probably the advice I'd be able to like, hey, you're really freaking smart. You've got this IT cybersecurity stuff. It's hard now, but you'll figure it out. But learn to trust other people who are experts in their areas too, and especially for the stuff you really don't enjoy doing.
- [21:01]
Ed Gaudette
Yeah, nice. So what's the riskiest thing you've ever done? This is a Risk Never Sleep podcast. I'll always ask guests on.
- [21:07]
Matt Topper
Oh my gosh, so many things. I'm a speed freak too.
- [21:10]
Ed Gaudette
Like, oh, okay, not speed, the amphetamine speed, but the.
- [21:15]
Matt Topper
I mean, we have the velocity, a little ADHD at this point. And my Adderall keeps me there every day, which is speed, basically. Which is, I don't know, the nice part about growing up in Detroit and having buddies on that work for the auto manufacturers. There's times where things are like, hey, we got done testing this. Do you want a supercharger for your truck? Absolutely. So, yeah, some fun road racing things. And sometimes official tracks, and sometimes not so official tracks. Just way out in the country, this.
- [21:47]
Ed Gaudette
Thing in the streets as another Springsteen reference for the show.
- [21:53]
Matt Topper
May have to find a seer reference before the end of the day being the Detroit guy, but. But no, probably the riskiest. I, early in my career was given a choice and the team had put out. I wasn't on the team at the time and they put out a release that failed miserably with a client and it was kind of the way forward for the entire company. And the CIO at the time brought me in his office and said, hey, I want you to run this. But essentially whoever's running this, if this doesn't succeed, will get fired. And for a 22 year old kid a year out of school, that's a big like pucker moment. Yeah. He goes, my, what I'm going to do is I'm going to put this other person in charge because I know how hard this is is. But I want you to run it and I know you're running it, but they're going to be the sacrificial lamb. Right? I'm 22. This guy. Yeah. Wow. Been right around the block. Multiple startups, VC funded, like, very well respected still in the industry today. And I looked him in the eye and went, no. That person was my mentor for the last four years. I will never put someone in that position. And if anyone's going to fail here, it's me. And I take the heat and honestly burn myself out. Burned my team out hard. But we made the date, we made the delivery, turned what was an $8 million a year product for that company into a $200 million a year product. Wow. But that was probably the riskiest of just. No, I, I don't put other people in the firefight if I'm not going to be on the front lines too. Yeah, that's great. That's great.
- [23:34]
Ed Gaudette
Oh, no, that's great. If, if you were on a desert island, you could bring five records with you.
- [23:40]
Matt Topper
Oh, man.
- [23:41]
Ed Gaudette
What would they be?
- [23:42]
Matt Topper
Oof. Oh. See, I'm Mr. Everything But country and. Okay. I'm such a music nerd. Like, we go on a. Every couple years, it's called the Rock Boat, which is like a week long floating music festival. And then the up and coming bands on that. We actually have a backyard concert series that we invite our friends and family over multiple times in the summer. So music is going to hit hard. I've got to go with something, Seeger. I've got to go with probably a Dave Matthews cd. Still like Original Dave, because that's kind of my high school days. I have to go Tupac. I have to go original, like Eminem, Slim Shady Records. And then because I don't want to think about being on a desert island without my kids, it's. I got two girls that are teenagers, so it's going to end up being a Taylor Swift record.
- [24:33]
Ed Gaudette
Oh, there you go.
- [24:34]
Matt Topper
There you go.
- [24:35]
Ed Gaudette
Nice. Oh, a father. Daughter. I've got. I have three daughters, so I. I kind of feel your pain and pleasure. Like it's been a good ride with girl.
- [24:44]
Matt Topper
Girls are great. Yeah. I got my two girls and then I got my son who's eight, so. Oh, okay.
- [24:48]
Ed Gaudette
So you have three.
- [24:49]
Matt Topper
Yeah, he'll be the one on the island, like building the raft and getting us out of there. No problem. At 8. He's already got it figured out.
- [24:58]
Ed Gaudette
Nice. That's awesome. So if you could give any advice to someone coming out of school that wants to get into cyber and. Or healthcare.
- [25:08]
Matt Topper
What Would you say to them, never stop learning? The industry doesn't stop. The adversaries don't stop. The challenges don't stop. There will never be the budget and time to do it perfect. But keep learning to understand the most efficient ways. Keep reading to understand the good, the bad, the ugly, and you will learn as much, probably more from your failures than you do your successes. So when you do push, when you don't get everything right the first time, realize that's a learning opportunity. And realize what you are not going to do again next time and how you're going to help the rest of your team not make the same mistakes. And if you ever end up working for an organization that takes your failures and punishes you for it or lets you go because of it, it's probably not a place you wanted to be anyways. Yeah.
- [25:59]
Ed Gaudette
Amen. Amen. Really good advice. And in fact, do we ever stop learning?
- [26:02]
Matt Topper
Really? No. Like you're either physically dead or mentally dead at that point. Yeah. No matter what you do in life, whether it's it. Whether it's healthcare, whether it is being a woodworker, as soon as you stop learning and you think you've mastered something is when it's over.
- [26:19]
Ed Gaudette
Yeah.
- [26:20]
Matt Topper
Agree.
- [26:21]
Ed Gaudette
I agree. Well, listen, it's been a real pleasure to have you on the show today. I really appreciate you and your time.
- [26:26]
Matt Topper
Yeah, I appreciate it, Ed. Hopefully my left, right, up, down, craziness, some people.
- [26:31]
Ed Gaudette
Oh, no, it's good, it's good, it's good. I follow the vertical trajectory.
- [26:39]
Matt Topper
So I.
- [26:40]
Ed Gaudette
Get where you're coming from. Anyway, this is the Risk Never Sleeps podcast. I'm Ed Gaudette, and if we're on the front lines protecting patient safety or delivering patient care, remember to stay vigilant because risk never sleeps.
- [26:55]
Thanks for listening to Risk Never Sleeps. For the show, notes, resources and more information and how to transform the protection of patient safety, Visit us@cincinnate.com that's C E N S I N E T dot com. I'm your host, Ed Gaudette. And until next time, stay vigilant because Risk never sleeps.