Counterintuitive Supply Chain Security
Tyro Payments CISO Arun Singh shares critical insights into modern cybersecurity, beginning with the paradoxical nature of supply chain attacks. For years, security teams have urged developers to keep packages and dependencies up to date. However, threat actors have weaponized this behavior, compromising new packages that developers are then told to install due to reported vulnerabilities. The result? A breach from a seemingly secure update.
"Protecting those supply chain attacks is difficult. It's counterintuitive,"
"You want to patch vulnerabilities, but not too fast."
He advocates for implementing a "cool down period," suggesting a 7-day delay for any new package to allow time to identify potential malicious activity. This requires trust and understanding from engineering teams, which Arun achieved through detailed workshops.
Earning Developer Trust Through Authenticity
Arun emphasizes that security professionals must understand the developer's world. Imposing friction without context erodes trust. He recalls an early career mistake: removing local administrator rights from all workstations, which severely impacted software engineers who needed these permissions for system-level tweaks.
As the host notes,
"Friction without explanation is just friction. No one likes that."
Arun reflects on this experience, acknowledging that winning back that trust took a year. He now prioritizes demonstrating attack chains through red-teaming, showing how small incidents can halt a quarter's work. Crucially, security teams must solicit feedback after implementing controls and be willing to compromise to minimize friction while maintaining security.
The Evolving CISO and AI's Dual Edge
The role of the CISO is rapidly changing, demanding technical depth and a strong business mindset. Arun argues that security leaders must be able to challenge technical decisions and understand the nuances of modern threats, like API security, beyond basic defense-in-depth concepts. "You could be the Albert Einstein of cyber security, but if you cannot influence the business... you're no good," he asserts.
Looking ahead, Arun identifies AI as the next major challenge. While AI promises accelerated productivity, it also amplifies security threats. Many security teams are not integrated into AI strategy or guardrail implementation, leading to a dangerous gap. "AI is going to accelerate productivity. It's going to accelerate security threats, and the small team that you had before that was doing okay is not going to be able to keep up," he warns. Security professionals need to be actively involved, using AI tools themselves, and understand code generated by AI to properly assess risks, rather than relying solely on automated vulnerability reports.
Essential Tools for Developer Security
When it comes to essential tools for developer teams, Arun highlights two key categories. First, an application security (AppSec) tool that integrates directly into the developer's IDE. This helps identify insecure coding patterns, secrets, or vulnerabilities as code is being written, rather than post-commit when it's often too late. Second, robust device protection for developer workstations. This provides crucial visibility into installed packages and dependencies and allows for frictionless policy enforcement, enabling developers to install necessary tools easily while maintaining security oversight.