Are you getting ready for the upcoming RSA Conference, the world’s leading information security conference and exposition? The event is quickly approaching, taking place May 6 – 9, 2024 at the Moscone Center in San Francisco. This year’s theme: The Art of Possible – as we collectively create works that will change our perspective on what we can accomplish. Let’s celebrate limitless opportunities, challenge the status quo, and explore new horizons together.
Ahead of the show, VMblog received an exclusive interview with Josh Lemos, Chief Information Security Officer at GitLab, the most comprehensive AI-powered DevSecOps platform.
VMblog: To kick things off, give VMblog readers a quick overview of the company.
Josh Lemos: GitLab is the most comprehensive AI-powered DevSecOps platform for software innovation.We empower developers to create secure code faster by enforcing security throughout the entire software development lifecycle.
VMblog: How can attendees find you at the show? What can attendees expect?
Lemos: RSA attendees can find us at booth #5360 in the North Expo. At the booth, visitors can take a deep dive into our DevSecOps platform, learn best practices from product experts, get answers to technical questions, and share feedback on what they’d like to see in upcoming product releases.
VMblog: How many times have you sponsored the RSA Conference?
Lemos: We are excited to return for our second year of sponsoring RSA. These events provide a great opportunity to engage with the security community, learn about new and emerging technologies, and meet new people. As an all-remote organization, we value every opportunity to get face-to-face time with our broader community, partners, team members, and contributors.
VMblog: What made you sponsor RSA this year? Is this a must sponsor event for your company?
Lemos: All companies are software companies now. To be competitive, companies need to be faster to market which requires a rapid and scalable approach to developing, managing, and securing software. At GitLab, we realize the importance of security to software development as we empower organizations to balance speed and security by automating software delivery and securing end-to-end software supply chains. Conferences become a town square that allow us to meet with peers and have discussions about key trends in the security industry.
VMblog: What key challenges are leaders facing today? What examples can you cite?
Lemos: Given our position in the software ecosystem, the two hot topics are GenAI and supply-chain security. Customers have a greater need to know how their software is built and maintain an inventory of all assets throughout their software builds. A shift to leveraging foundational models requires security teams to responsibly govern their companies data while leveraging the benefits of GenAI. Both security promises need to be met while maintaining release velocity.
Data governance and data supply chains are becoming critical issues because the technologies that underpin them are necessary to support AI. For example, in a data supply chain, if someone deletes data or a customer requests its removal and that data has already been used to train an LLM, it may be difficult or impossible to remove it. For companies building machine learning models, data supply chains require operational discipline, which falls under the domain of the CISO to manage.
VMblog: What is your message to RSA attendees coming out to the show this year?
Lemos: The generative AI hype cycle is peaking and provides the potential to level the playing field for addressing security flaws in software. However, organizations should adopt strict policies outlining the approved usage of AI-generated code, and when incorporating third-party platforms for AI, conduct a thorough due diligence assessment, ensuring that their data will not be used for AI/ML model training and fine-tuning. GenAI shows promise for security applications, but it should be viewed as an enhancement of product capabilities – not a replacement – enabling humans to develop secure software faster.
VMblog: What market needs or problems are you addressing in the security space?
Lemos: Heterogeneous tool-chains with DIY DevOps is slowing down digital transformations. Organizations have to work with hundreds of tools and multiple data models, which increases complexity and risk while reducing transparency.
According to GitLab‘s 2023 DevSecOps report, 57% of security respondents reported using six or more tools, and 69% of security respondents reported wanting to consolidate their toolchains.
GitLab brings the entire software development lifecycle into a single AI-powered application to streamline collaboration and eliminate context-switching. With the GitLab platform, organizations have one workflow to unite their security, development, and operations teams and enable end-to-end governance.
VMblog: What are some of the key takeaways of your solution that RSA conference goers should be aware of? And what sets you apart from the competition?
Lemos: GitLab brings all DevSecOps capabilities into one platform with a unified data store to improve the user experience and reduce context switching to help teams produce higher-quality code, make fewer mistakes, and ship better, more secure software faster.
Key benefits of GitLab include:
- Secure by default: Integrating security throughout the platform for secure source code management, secure CI/CD, and secure AI. This enables customers to more efficiently manage vulnerabilities, improve code quality, and reduce security risk.
- Consolidated instrumentation: Enables organizations to adopt DevSecOps best practices while saving costs on internal tooling maintenance, automating manual tasks, and freeing up resources to be redeployed for value-driving feature development.
- AI throughout the entire software development lifecycle: Increasing efficiency, improving cycle time, and strengthening security. Accelerating a single phase of the SDLC limits the ability to realize the benefits of AI.
VMblog: Is your company launching anything new at the show? Can you give us a sneak peek?
Lemos: We are introducing new features with our major GitLab 17.0 release coming on May 16, 2024. Keep an eye out for what’s to come!
VMblog: What are some top priorities for security leaders at RSA to consider this year?
Lemos: First, with the influx of new LLM-enabled tools, security leaders need to evaluate how to safely enable their partners across the business to adopt AI technologies without risking unintentional data exposure. Privacy and data security concerns over large language models are still a barrier to entry, and understanding how to leverage generative AI features requires security leaders to consciously adopt a new approach to interacting with their codebase.
Secondly, software supply-chain security remains top of mind for security leaders. Capterra’s research reveals that software supply-chain attacks impacted almost two-thirds (61%) of all U.S. businesses from April 2022 to April 2023. I expect attacks in commercial and open-source software (OSS) supply chains will continue to accelerate, with attackers automating attacks in common OSS projects and package managers. Given this, it is key that CISOs and DevSecOps teams implement controls in their existing build systems to mitigate these threats.
VMblog: What are some of the security best practices you would deem critical?
Lemos: Secure by default requires having proper visibility and control over your builds. Here are a handful of security principles that we value at GitLab:
- Minimalism – Reducing the system dependencies, image, etc. to the least amount required to operate effectively.
- Authoritative Source of Record- A given inventory must serve as a canonical source for a given asset.
- Consistency – Though continuous programmatic discovery, inventories must remain complete and eventually consistent.
- Completeness – Attributes of the inventory must be complete and accurate.
- Interoperability – Inventories must support indexing, extensible APIs and have queryable interfaces to express value.
- Reproducibility – Given the source code software is reproducible through a CI/CD pipeline on an entirely new platform/environment.
- Non-Repudiation – Provide proof of the origin, authenticity, and integrity of data back to the data source or record.
- Ephemerality – Minimize the time a given system or credential is valid.
I recommend companies take a data-centric view of their security issues and work backward. Too often, security solutions promote novel ideas or approaches that are short-lived or brittle. In today’s environment, boring security fundamentals are as essential as ever.
VMblog: The keynote stage will be talking about major themes this year. But what trends is your company seeing that we should be aware of in 2024 and beyond?
Lemos: When we look back on 2024, I expect we’ll see it as an inflection point for the proliferation of supply-chain attacks. While OSS supply chain attacks are becoming more prevalent, we also need to anticipate that commercial vendors and integrated partners present considerable risk to companies. The cybersecurity landscape is already transforming, with a growing focus on mitigating supply chain vulnerabilities, enforcing data governance, and incorporating AI into security measures. This transformation promises to steer DevSecOps teams toward software development processes with efficiency and security at the forefront.
VMblog: Does your company have any speaking slots at RSA? If so, can you tell us more about those sessions so people can get them on their schedules?
Lemos: Francis Ofungwu, Global Field CISO at GitLab will be conducting a briefing presentation about shifting security responsibility left on May 8th from 3:10 – 3:30 pm at Moscone South- Booth 2100. The talk will examine the standards and regulations that software and application security leaders should care about, the impact of non-conformance on business, and recommendations for how to prepare for this sea change. You can also watch the session on-demand.
VMblog: Is your company giving away anything interesting at your booth?
Lemos: RSA attendees can swing by the GitLab booth (#5360 in the North Expo) to find swag items, including GitLab-branded bottle openers, plush keychains, luggage tags, socks, and stickers.
##
