1Password CISO Jacob DePriest explains how to build a strong security team

Running a security team can be challenging. You have to defend against an ever-growing range of threats, from credential theft to AI-powered social engineering attacks, without impacting productivity or the company's broader goals.

Where do you begin? Jacob DePriest, VP of Security and Chief Information Security Officer (CISO) at 1Password, has plenty of advice. He sat down with Michael “Roo” Fey on the Random but Memorable podcast to share his approach and what he thinks about common security concepts like zero trust and secure by design.

Read the interview highlights below or check out the full episode in your podcast player of choice. When you've finished, join the conversation in our episode discussion thread!

Michael Fey: What’s it like to manage security at 1Password?

Jacob DePriest: The folks on the 1Password security team, and the company in general, are passionate about what we do. It's really difficult to find anybody who doesn't care deeply about the products we're building and the impact they have on our users. That includes consumers and the companies that rely on our capabilities for their existence. And we get that. That understanding drives a lot of the passion and helps keep us focused on the things we need to be focused on.

We also realize from a security perspective that one of the reasons why 1Password is so loved in the community is that we value and prioritize the user experience. It's just gotten better and better over the years. You talk to folks outside the company and people will say: “We just love what you're doing. We want you to keep doing what you're doing. It's great to use.”

We don't want to just do security for security's sake. Any security person knows that the most secure app or device is the one that's turned off. It's powered down. But that's not going to help anybody. That's not our goal.

"We don't want to just do security for security's sake."

We ask ourselves a lot on the security team: How can we not just make sure our products and the company is secure, but also support what the products are trying to do for our customers? Because we care about that broader security goal for the ecosystem. 

So all of those things come together to create a really fun environment for us. We get that there's a lot of responsibility but it's also motivating.

MF: Do you feel like you have a high pressure job?

JDP: I talked to a lot of peers about this. And friends in other professions – I was recently talking to a friend who's a doctor and regularly works in operating rooms. 

I tell my team that we do have a big responsibility in the ecosystem, but we also have a great team. We have to rely on each other. We have a great team not just in security but the wider tech organization. We also have a great leadership team at 1Password. And so it really takes all of us to come together. 

The other thing that makes the job fulfilling and helps me work through that pressure is the knowledge that the company is filled with people who love security and care about it. 

There are a lot of security leaders out there who work at companies where security is low on the list of priorities. It's a thing that must be done for compliance reasons but it's not first and foremost in people's minds. And I get it. From a business perspective it’s not necessarily wrong. But it's great to work at a company where you can talk about security things with almost anybody and they'll say: “Yeah, I get it. That makes sense. That's what we should do for our users. How do we think about balancing productivity with risk?”

MF: It wouldn't be a Random but Memorable episode if we didn't talk about AI. What advice do you have for organizations that are worried about AI-powered threats?

JDP: On the one hand, AI is accelerating the types and quality of the threats that we're seeing, particularly in the social engineering space. But we're starting to see it show up in other ways as well. 

On the other hand, the threats are still largely the same for most companies and most teams. Unless you're a company that's in the AI development space – then there may be some additional things to think about in terms of protections.

For the most part, we're still seeing the vast majority of successful attacks involve credentials and credential theft. So most of the time I go back to the fundamentals. Are you using phishing-resistant MFA? Don't click on links or respond to text messages from the CEO in the middle of the night if you’re not 100% sure they’re legitimate. Keep your phone and laptop up to date, patch your production systems. That's still the best approach for most security teams.

 "Most of the time I go back to the fundamentals."

With that said, I think it's incumbent upon security teams, security leaders and really anybody in the technology space to keep up with what's possible with AI.

If your company isn't approving AI usage for work, get an account on the weekend and see what you can do. See what coding is like with it. Do a simulated attack with AI and see what's happening. Because there’s a risk that if we don't all keep up with what's possible, there’s a risk that new capabilities will come out and catch teams by surprise.

MF: Are secure by design and zero trust becoming the default now? Do you think most people understand what these terms mean and how they can follow best practices at work?

JDP: Zero trust and secure by design are becoming the go-to ideal states that a lot of security teams are comparing themselves against. Companies are asking: How are we doing on the scale? 

But it's important to realize there's probably not one solution or blueprint that companies can just snap to. Like you can't go buy a thing or work with a partner and solve everything in eight months. You can’t say you've “done” zero trust or you've “done” secure by design. 

However, those concepts are helping shape what good looks like and helping all of us in the security industry think through good solutions for common attack patterns. 

In general, I think secure by design is really critical. Thinking about it from the security industry's perspective, the goal is to encourage companies to build in secure settings, secure workflows, and secure password defaults out of the box. We need to put some responsibility back on companies to take a stand and say:  “No, we're not just gonna put everything on the end user. We're gonna actually work together to try and level up the security ecosystem together.” I think that’s really important.

"You can’t say you've 'done' zero trust or you've 'done' secure by design."

It's things like making sure that MFA is required for most users, particularly on social platforms and larger platforms where phishing is a large threat or there aren’t other mitigating factors in place. So I think we do have to keep doing that as an industry.

With that said, most companies are still just trying to figure out the best way they can ship some security with the resources they have while keeping productivity high. Companies know security is something they have to do, but they don’t have a five-year plan to ship zero trust or be secure by design.

The big ones? Maybe. But the vast majority of small and medium companies just aren't thinking about that.

Again, this is why I'm excited about where we're headed as a company with 1Password Extended Access Management. If we can help the companies with smaller resources and teams solve a huge chunk of these problems and implement a lot of these defaults out of the gate … that's fantastic. We have an opportunity to level up these smaller teams and bigger teams with the things we're building.

MF: How do you ensure that 1Password is staying ahead of evolving cyber threats? 

JDP: I generally come back to the core fundamentals of what we have to do as a team. Are we putting in place processes, solutions, and training that enable every employee to know what they need to do, to have secure by default settings, to ensure that we're protecting against common attacks. 

What does that mean in practice? We're making sure that our access management is buttoned up. We're making sure that logins are secure. We're making sure our endpoints are secure. Vulnerability management. All of those kinds of things that we think of as fundamental to security programs. Sure, they're not focused on some of the more esoteric attacks that we see in the news, which we’re also paying attention to. 

But if you don't have the fundamentals in place first, then trying to go chase the more exotic attacks can be a distraction. We're not gonna get distracted by those things, but we'll continue to pay attention to them and make sure we're protecting against them.

"If you don't have the fundamentals in place first, then trying to go chase the more exotic attacks can be a distraction."

The other part is partnership. I believe that any security team can't scale security outcomes on their own. It has to be a partnership with engineering and tech, but also HR and product and sales. They all have a role in thinking about how security impacts what we do as a company and how it impacts our customers. This is why I spent some time with the GTM team actually this week talking about these things and talking about how we can put in place the right defaults even in our contracts to help talk about what we're doing from a security perspective and give our customers that confidence. 

Particularly on the engineering and tech side, we have to partner to make sure that what’s happening across the company is secure by default and that all the right guardrails are in place.

The last bit for me is continuing to hire amazing people. We already have a great team. But it’s about building the team and getting the right folks with the right passion and skills to take that journey with us. That's probably the most important thing we can do because that scales.

MF: Do you have advice for anyone trying to build a strong and diverse security team?

JDP: Folks have to start thinking about security from the perspective of: What are the company goals? And what are the needs of the company? It's easy to grab the latest blog post or book that explains how to build security teams and just snap to that playbook. But that may or may not be successful depending on what the company needs. And so I tend to approach it that way.

What are the company goals? Is it maintaining customers? Is it speed to market? And then from a security perspective, what are the top risks that could affect those goals? They could be security risks. And from a security perspective, that tends to be how I think about it. So if “X” happened, how would that affect company goals? And if the answer is “it would affect them drastically”, then maybe we should go spend some time there. 

From there, I think about: What are the key programs that would help the company achieve its goals while also addressing the risk? So it's that balance going forward. Every company is going to have a different equation and weighted scale to look at that. 

"Start with your company’s goals and risks and work from there."

Once you've answered those questions, it’s time to ask whether you have the right people on your team to help you achieve those goals. And that's agreed to by leadership. That’s the fourth pillar.

The details will be different for everyone. There are just so many nuances to consider. Some companies don't need to worry about company laptops because everyone is working on a platform that's got baked in security. Other companies have way more security concerns. I worked in a place for many years where you couldn’t bring anything home. You had to drive to a secure facility and leave your phone in your car and be cut off from the world for eight to 10 hours a day. There's just such a large spectrum. So you have to start with your company’s goals and risks and work from there.

MF: Finally, are there any misconceptions about cybersecurity professionals you would like to dispel?

JDP: Every cyber security person I know genuinely wants to do the right thing to protect the product, the data, the services, the apps – whatever it is they're charged with protecting.

But sometimes things go wrong, right? It’s a common saying in security: it's not if, it's when. Security incidents are going to happen. It's going to happen to every company everywhere. There are no exceptions. 

I would ask folks to give some love and empathy and respect to those teams that are working through those things. And realize it may seem like they're grumpy about some security thing or it may feel a little bit adversarial, but generally they really want to do the right thing for the company. 

The teams out there that I've worked with and know are working really hard to try. They're just trying to do the best they can.

Subscribe to Random but Memorable

Listen to the 1Password podcast for lighthearted, practical security advice, in-depth interviews with industry experts, deep dives into data breaches, and some random but fun security games.