Zane Lackey
As seen in:
a16z,
Forbes,
Entrepreneur,
Dark Reading,
Security Boulevard,
SD Times,
Total Retail,
ITOps Times
GP @a16z helping build amazing cybersecurity and platform engineering companies. Previously Co-Founder of @SignalSciences and CISO @Etsy
Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by Zane Lackey
Investing in Neo
America | Tech | Opinion | Culture | Charts The endpoint security market is entering its third generation. The first was antivirus: static signatures, easily evaded, built for a world of known malware. The second was behavioral detection and response such as SentinelOne, CrowdStrike, and the EDR category they created, which watched process behavior instead of file hashes and became the standard enterprise defense for over a decade.
Et Tu, Agent? Did You Install the Backdoor?
America | Tech | Opinion | Culture | Charts This week, someone hijacked one of the most popular packages on the internet and used it to install a backdoor on every machine that ran npm install. The package was Axios, which is the HTTP library that powers network requests in millions of applications. It gets downloaded over 100 million times a week. If you’ve built anything in JavaScript in the last decade, you’ve almost certainly used it, or something you depend on has used it for you.
Et Tu, Agent? Did You Install the Backdoor?
Et Tu, Agent? Did You Install the Backdoor? Table of Contents Share This week, someone hijacked one of the most popular packages on the internet and used it to install a backdoor on every machine that ran npm install. The package was Axios, which is the HTTP library that powers network requests in millions of applications. It gets downloaded over 100 million times a week.
Breaking the Cybersecurity Kill Chain with AI
Cybersecurity is a race where every move by attackers forces a counter. It has always been a cat-and-mouse game: attackers probe for weaknesses, defenders scramble to respond, and the cycle repeats. Over time, this arms race has produced an explosion of categories, frameworks, and labels: so many that the boundaries between them have grown blurry. The result is a landscape that often feels fragmented and overwhelming.
How to Think About Foundation Models for Cybersecurity
In this episode of the AI + a16z podcast, a16z General Partner Zane Lackey and a16z Partner Joel de la Garza sit down with Derrick Harris to discuss how generative AI — LLMs, in particular — and foundation models could effect profound change in cybersecurity. After years of AI-washing by security vendors, they explain why the hype is legitimate this time as AI provides a real opportunity to help security teams cut through the noise and automate away the types of drudgery that lead to mistakes.
Investing in Doppel
How many fake profiles of you popped up this week? Did your CEO message you asking you to buy gift certificates? Have you ordered a product online only to find the reviews for it were fake? Over the last two years, there has been a rampant acceleration in the number and quality of malicious impersonations online, from celebrities to early stage startup executives.
Building a Modern Security Program
by Zane Lackey, Rebecca Huehls Released August 2018 Publisher(s): O’Reilly Media, Inc. ISBN: 9781491956311 Read it now on the O’Reilly learning platform with a 10-day free trial. O’Reilly members get unlimited access to books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers. Read the rest of the article here.
Investing in Socket
Open source is the bedrock upon which all modern applications are built. But here’s the elephant in the room: There is a huge attack surface hidden within this seemingly solid foundation, and the proliferation of open source usage has opened a Pandora’s box of security threats. Ask any seasoned CISO in private how they feel about the risks associated with the open source supply chain, and you’ll hear any number of serious concerns.
It's Not Your Imagination: API and Web Security Is Getting Harder
We're living in a very different technology world. Change is happening so fast that enterprises often find themselves in a more challenging security position than they were in just a few years ago. Nobody is to blame, but the fact is that the traditional tools we use often cause more problems than they solve. The advent of the modern, decentralized enterprise requires a modern, consolidated approach to Web application and API security.
Dark Reading | Security | Protect The Business
Unforeseen circumstances can cause your security risk profile to shift in unexpected ways — and the consequences can be serious. In a world where change can happen suddenly, security teams can play a crucial role in helping their organizations stay protected no matter what happens. There's no way to anticipate and prepare for every possible scenario, but the right approach to business continuity can help you respond effectively in any situation. The key is to focus on agility and sustainability.
Prioritizing Application & API Security After the COVID Cloud Rush
This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726. As companies hit the gas to accommodate the rapid shift to work-from-home, security fell behind. Now, it's time to close those gaps. Companies often find themselves playing catch-up with their infrastructure.
Rethinking Security for the Next Normal -- Under Pressure
This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726. By making a commitment to a unified approach to security, then doing what's necessary to operationalize it, organizations can establish a better security model for the next normal.
Security Boulevard
“Our team switched to Signal Sciences from a legacy WAF roughly a year ago and we couldn’t be happier with the switch.” — Senior Security Engineer at Enterprise Services Company The above customer statement is just one of many examples that speaks volumes about why we started Signal Sciences and how we’re delivering on the promise of automated application protection.
Protecting your data in 2020: How to identify web attacks
As we reflect on the past year, it’s clear how far we’ve come in improving cybersecurity efforts. However, with that progress comes persistent efforts by hackers to try and infiltrate organizations. Cloud, web and mobile applications continue to be one of the top sources of successful breaches, according to the 2019 Verizon Data Breach Report (DBIR). It can be overwhelming to navigate the sheer number of attacks and attack types targeting applications, APIs and microservices.
It’s the Most Wonderful Time of the Year … for Hackers
There are so many ways for the holidays to turn sour for an online retailer. Gift cards and loyalty points, not subject to the same type of verification as credit cards, are stolen from customer accounts and used for fraudulent purposes. Compromised corporate credit cards are used to make high-volume purchases in the thousands of dollars and shipped to multiple locations — activity that might raise flags for a consumer card, but pass as business as usual during business gift season.
Can't Hire Security Talent? Try Growing Your Own
Pexels Pexels We all know how hard it is to hire security professionals. Given the countless open positions throughout the industry — even a flood of new talent would be soaked up too quickly to make a real difference. Instead of wishing for reinforcements who just aren’t coming, the companies scaling security successfully are taking a new approach.
For Real Security, Don't Let Failure Be Your Measure of Success
This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726. For too long, we've focused almost exclusively on keeping out the bad guys rather than what to do when they get in (and they will). Maintaining security is a critical mission for every business today, so you'd expect there to be a commonly accepted way to measure its success.
Shifting left for better security? It's just as important to shift right too
There’s been a lot of talk lately in security and development circles about the need to shift left in the software development lifecycle—and rightly so. By bringing security into the picture from the beginning, you can catch weak designs and bugs earlier, when they’re cheaper and easier to fix. So far, so good.
Why multi-cloud can be more secure—and make more possible - ITOps Times
Moving to the cloud can make your business more agile, flexible, and scalable—or it’s supposed to, anyway. Over time, though, many organizations are discovering that the choices you make as you implement your cloud strategy can actually limit your options. That’s especially true when it comes to security. If you’re not careful, it’s all too easy to end up with a cloud environment where security concerns force you to say no more often than yes.
Is security killing your digital transformation?
In-DepthLatest NewsPremium Published: October 26th, 2018 Zane Lackey Hackers love traditional security. So do your competitors. Want to ruin their day? Forget what you know about how faster development increases risk. If your approach to security is slowing you down, it’s only a question of which you’ll lose faster—your data or your customers. To begin, let’s agree on one fundamental principle: In the era of DevOps, Agile, and the cloud, survival depends on speed.
Your Cyber-Enemy May Not Be the Person You Suspect
The less-obvious risk often is the most dangerous. Protecting your company and personal assets starts with understanding real versus perceived threats. Opinions expressed by Entrepreneur contributors are their own. Your worst nightmare might not be launched from an Eastern European boiler room full of cybergeniuses wielding stolen NSA exploits. It could come from the desk of a teenager in middle America -- and she might cause more damage to your company than you imagined possible.
How to defend your apps in the age of DevOps
In a world built for speed, security operations can’t afford to be gatekeepers. As organizations decentralize deployment, the notion of a “gate” no longer applies. And as developers gain the ability to deploy production apps themselves, on their own cloud infrastructure, conversations with security staff become optional rather than mandatory.
How to defend your apps in the age of DevOps
How to defend your apps in the age of DevOps In a world built for speed, security operations can’t afford to be gatekeepers. As organizations decentralize deployment, the notion of a “gate” no longer applies. And as developers gain the ability to deploy production apps themselves, on their own cloud infrastructure, conversations with security staff become optional rather than mandatory.
Cybersecurity in 2018: Three predictions and one hope - Help Net Security
Effective cybersecurity means keeping a close eye on the threats you currently face, and an even closer eye on the threats to come. As you consider your security strategy and investments for the coming year, here are three key trends that will define the threat landscape in 2018, and one hope for a more effective approach to protection.
Sophisticated threats? It's usually the basic ones that get you - Help Net Security
To listen to the headlines, the threats we face today are so sophisticated and intense, they can only be evaded with the help of artificial intelligence and machine learning. Losing sleep over zero-day cyber APTs launched by nation states? You shouldn’t be. It’s much more likely to be a common password or an off-the-shelf web app attack that puts you at the mercy of hackers.
The future of AppSec: Stop fighting the last war - Help Net Security
It’s a cornerstone of military doctrine: when you focus too much on the last battle you faced, you miss signs of the new battleground taking shape. The principle holds as true for cybersecurity as it does for cavalries and tanks. The surest way to put your organization at risk is to keep your defense strategy rooted in the past – especially it wasn’t all that effective in the first place.
Is security killing your digital transformation? - SD Times
Hackers love traditional security. So do your competitors. Want to ruin their day? Forget what you know about how faster development increases risk. If your approach to security is slowing you down, it’s only a question of which you’ll lose faster — your data or your customers. To begin, let’s agree on one fundamental principle: In the era of DevOps, agile, and the cloud, survival depends on speed. If you’re not first to market with the innovations today’s customers demand, there’s no second prize.
Approaching security self-sufficiency - Help Net Security
As part of my role as CSO, I’m extremely lucky to get to have conversations with CISOs, CTOs, and other technology leaders across industries. One of the things that has always struck me throughout my career is how, while there are certainly issues specific to each business, the vast majority of the challenges we face as defenders are the same.
Building a Modern Security Engineering Organization | OpenView Labs
Over the past decade, the world has fundamentally changed in a variety of ways, with huge implications for business. We’ve seen the rise of transformational new technologies, for instance, such as cloud, mobile, and big data. When it comes to running a modern security engineering team that keeps your business secure, three changes have been particularly important: speed to market, continuous deployment, and increasing the cost of the attack. For starters, things move a lot faster than they used to.
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with Zane
Contact Zane, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack