Transcript
I'm your host, Megan Garza. Today's guest is Doug Cox, a principal security architect at Salesforce. Welcome to the show, Doug. Thanks. It's good to be here. Doug is an IT professional with over 20 years of experience in data warehousing, enterprise data, and cloud security. He's skilled in SaaS, security, encryption, and tokenization, and is a Salesforce certified AI associate. Doug currently works with account teams to focus on the Salesforce principles of trust. In his words, he enjoys helping customers unravel security and compliance to understand and meet their complex challenges. Doug, you studied communication and media in college. What made you want to go into cybersecurity? Well, I can tell you that in 1981, there was no cybersecurity. I wanted to be a DJ. I wanted to go out and I wanted to talk to people, which I do today. I'm kind of crazy. I went to school to become a DJ and be in entertainment and in media, and now I'm actually broadcasting all day from my house. But there really was no cybersecurity back then. When I was a kid in high school, we had one computer. I learned how to do a loop and I was able to print out something bad about teachers a hundred times. I got in trouble and then I had to pay for the paper. My parents grounded me. I was in a lot of trouble. So it was like my first hacking attempt. Cybersecurity started to really kind of show up with the phone hacking, right? Back in the day, you could use this 2,600 megahertz sound and open up a long distance call. And then, as the internet grew, we became more aware of cybersecurity with every job I took. So how has the threat landscape changed since then? Back in the day, in the eighties, we were more concerned about physical security than we were anything else. There were literally bursting printouts, putting them into these cubbies where people just take them. Oh, there's all this information. We were more concerned about the people getting in and messing with equipment and things like that. But once I started getting into the Unix world, I started to understand things like the change mod, you know, giving access controls out to people who actually needed them. Basically my first foray into least privilege, if you will. But then when I started to get into databases, which is the lion's share of my career, I was really starting to understand access controls for data and who should have access to what and try and keep that all under control. So it was mainly the threat landscape went from nothing to everything now. So it's been quite a journey. And now you typically work with customers in the health and life sciences sector. What challenges do you see with HLS customers specifically? Highly regulated industries have a lot of extra stuff to worry about. Mainly it's about the landscape of regulations. HIPAA is something that I have to deal with on a daily basis and HIPAA tends to be a little bit of a murky thing, you know, so our customers can kind of interpret it the way they will. But there are some really hard requirements that our customers have to face when it comes to HIPAA and then as well as high trust as well, you know, understanding how to encrypt, understanding, you know, saving data, changes to data, that kind of thing. So our customers really struggle with that, their interpretation of HIPAA, but also things like this change health care issue that happened a few months ago. They really want to know about ransomware and how SaaS environments are handling things like ransomware, how they can help prevent ransomware and other attacks at their org level, but also what SaaS environments do at the infrastructure to head that kind of thing off and deal with it if it potentially happens. And speaking of ransomware, I would think that health and life sciences sector might have some of the most important or the most critical data that they certainly want to protect from ransomware. One hundred percent. And, you know, and then one company paying off that ransomware also puts all the other companies at risk, though, you know, I didn't really get a lot of interest, a lot of calls around that incident that happened a couple of months ago until they paid it off. And then everyone started to get a little nervous because they set a precedent, set a precedent, you know, and it's a lot of very sensitive information that contained in health record. So, sure. The big deal. And what do you think it takes to be a successful security leader? I mean, you have to stay, you have to be expert, you have to stay informed of everything, cybersecurity, try to keep a grip on the news and what's going on out there. Stay informed. Absolutely. Also, you know, having a good team around you helps, you know, we all have different domains and I'm I'm an encryption guy. My last couple of jobs before starting in Salesforce were encryption vendors. I have, you know, a friend that worked at Oracle on my team and he's really good with IDP and, you know, so we all have our own domain. We all work together to try to help our customers. So, you know, it's important to be able to to create teams that have vision as well. You know, what is the next move technologically speaking for us, you know, and how can we help our customers adopt this kind of technology to create more secure environments? And what do you think is the most important thing to remember when working in cybersecurity? You need to listen. You need to understand our customers all have different reasons why they're upset right now with cybersecurity in this world of ever, you know, ever changing landscape of security. So it's important to stay, you know, proactive so we don't have to react. Right. You know, I always try to teach my customers to stay proactive. And another thing is vision, right? We want to understand the upcoming risks and we need to be able to plan for it and instill this onto our customers or sometimes they instill it on me. My customers are telling me things that I don't even know, which is which is kind of crazy. So, you know, we all work together as a team, whether it's customers and Salesforce or, you know, my team member. And then finally, you have to really understand things like ethical standards as well. You know, we talk about this in our AI world, you know, like we want to make sure AI is done ethically and correctly for our customers as well as purely. It sounds very collaborative the way you describe it. 100 percent. It has to be. And now I might know the answer to this question based on our previous conversation a little bit ago. But if you weren't in cybersecurity, what would you be doing? If I was not in cybersecurity, which, you know, could happen in the next 10 years, I've been around a lot. I'll probably be writing music, drumming and producing music with my wife. I have always wanted to learn how to play the drum, but I don't have the hand eye coordination to where like I'm doing one thing with this hand, one thing with this hand, and then the foot like can't do it. The good thing is you can you can actually close your eyes and do it. They don't even need the hand. I coordinate. That's a good trick. I'll have to remember that. Right. Well, thank you for joining me today, Doug. I appreciate you taking time out to chat with me and teaching me a little bit about the tricks to drumming and for joining me on this week's episode of Speed Data. Have a good one. Yeah, you too.
