Friday, August 9, 2013

Security Innovation Values

We recently completed our values exercise and Security Innovation and I'd like to share the results. These were also shared by our CEO Ed Adams in a corporate blog post.


The following statements represent core Security Innovation values. These are the foundation on which we’ve built our success as a company, both in terms of delighted customers and happy long-term employees. We have an enviable track record of customer success, in which a vast majority of our business is repeat or word-of-mouth. We have an incredible record of employee satisfaction with turnover that is significantly lower than the average technology company or application security vendor. As the company grows we want to hold onto that success and maintain the SI feeling that we all love.In the sections below, External values are those that most directly affect our customers, how we interact with and provide value to our customers. The Internal values are those that most directly affect us as employees, how we interact with each other and maintain a high quality, professional environment and great work-life balance.


- Everyone has the right to secure software  
- Everyone has the right to use a computer without fear 
- We focus on the fix 
- Development team education is a key means to achieving better security 
- Everyone can create secure software 
- Increased awareness of security risks and mitigations will result in a healthier software ecosystem 
- 3rd party assessments of software can be used to keep development teams honest with themselves and their users 
- We can add the most value when our customers see us as a trusted advisor to improve security long term 
- We believe in measuring and holding ourselves accountable to customer satisfaction in our services and products 
- We honor our customer’s expectations regarding ethics and good conduct 
- We respect our customer’s right to privacy and do not share or publish sensitive information without consent 
- We follow the best-practices that we recommend, especially when it involves transmission or storage of sensitive customer information


- We empower our employees to learn and develop their skills 
- We create an environment of trust and open communication among all members of the organization  
- We focus on results, trusting our employees to work in the ways that are most effective for them 
- We create a flexible, rewarding work environment that supports a high quality of life for our employees 
- We believe in trustworthiness with our employees and with our customers and hold ourselves to the highest ethical standards in order to meet that goal

Thursday, June 6, 2013

Vision Mission Values

As Security Innovation gets bigger we've realized we need some way to preserve what makes the company special, for our customers and for our employees. I think it all comes down to Values, since that's what describes the 'Why' of what we do. Why is so much more important than What since it is the foundation, the motivation behind everything we do and in the end I think its the best way to capture the magic of who we are as a company. I think many people would start an excercise like this by defining Vision and Mission first, a top down approach. We've found its more powerful to start with values and build upwards from there.

First some definitions:

  • Vision: Where do you want to go? What's over the horizon?
  • Mission: Who are you? What do you do?
  • Values: What do you value? Why are you doing what you do? What's important and if you gave it up would destroy the value of the company?
I've also added in a couple of goals which I think of as a tactical approach to achieving the mission. Maybe they should just be folded into the mission itself.

Here's what we've come up with so far, its not complete, just a work in progress. What do you think?

  • A world free of security vulnerabilities
  • To be the most trusted application security partner on the planet.
  • To enable the success of our customer's application security programs.
  • Improve the security of every application we touch 
  • Provide the world’s best combination of security expertise, trustworthiness, effectiveness, and technology to our customers
  • Apply Standards, Education and Education (the Three Pillars of Success) to create a customized solution for each of our customers. 
  • Drive the success of each customer's application security program through a targetted set of standards, education and/or assessments based upon our understanding of their unique culture, process maturity and application security goals. 
  •  We believe everyone has the right to secure software 
  •  We believe everyone has the right to use a computer without fear
  •  We focus on the fix
  •  We believe developer education is a key means to achieving better security
  •  We believe increased awareness of security risks and mitigations will result in a healthier software ecosystem
  •  We believe 3rd party assessments of software can be used to keep development teams honest with themselves and their users
  •  We believe that can add the most value when our customers see us as a trusted advisor to improve security long term
  •  We believe in measuring and holding ourselves accountable to customer satisfaction in our services and products
  •  We believe in empowering our employees to learn and develop their skills
  •  We believe in an environment of trust and open communication amongst all members of the organization 

Sunday, January 27, 2013


I arrived in Zurich with a couple of days to kill. Plans had changed. Instead of meeting the family in Lisbon I would meet them in the Zurich airport and then we would all fly to Lisbon together. Upon exiting the airport I had the choice to take a taxi into town or ride the train. All my life I'd heard stories of the efficiency of Swiss trains, so the decision was easy. I puzzled through the German instructions, bought a ticket and before I knew it I was on a very clean, very on-time train heading into Zurich. The trip was short, but I had the chance to speak with a fellow traveler who was on his way home, somewhere in the French speaking areas of Switzerland. He had been in Italy and confided in me that after six months of travel he was ready for a little down time. I can understand, I've been away from home for six out of the last twelve months. Twelve out of the last twenty four. I love to travel, but after a while I too feel the pull of home.

The Zurich train station was large, busy and just far enough from my hotel that I needed a taxi. While I re-arranged my bags I caught the eye of a young swiss girl. She was probably 18 months old and stared at me for a very long time. Eventually, much to her parent's surprise, she decided I was OK and ran up to my leg, grabbed it and made the universal toddler noise of delight. 

Zurich is quiet. Well mostly quiet. At 7am most mornings all the church bells would ring at once, a loud cacophony that would wake me no matter how soundly I was sleeping. I never determined a pattern, but some mornings were quiet and some started with a blast of bells. Other than that, the streets were quiet, the people were quiet and the weather was quiet and grey with an occasional cold wind blowing off the lake. Snow was in the mountains but I was told it would be at least another month before any serious snow would accumulate in the city. Zurich is expensive. Really expensive. I looked at a few online indexes and Zurich was always in the top 10. I attribute it to the bankers, they were everywhere and just like any other commodity, money follows the rules of supply and demand. I talked to a few of the locals and they attribute it to taxes, which I guess are very high. The hotel seemed empty, but the rates were very high. The restaurants were all empty but everything cost two or four times more than what I am used to. I was on my own but at least my wallet felt like my family was with me.

One of the restaurants I went to was in a very old meeting hall, built in 1348. I was one of three tables, the other two were bankers in quiet lunch meetings. In Zurich I quickly learned to spot the bankers by their clothes and demeanor. The waiter was middle aged and wore a permanent frown. He took his food very seriously. I ate a quiet lunch, pondered the solutions to problems at work and watched as the two other tables left. One of the bankers, to my great surprise, walked out with a dog that had been under his table. I finished up my lunch in total silence, alone with the frowning waiter. As I was paying, I asked him what the typical tip was in Zurich. "You don't have to tip anything, nothing at all," he frowned. I pressed a little further and he admitted that five maybe ten percent would be the most anyone would ever tip him. I gave him a nice tip and his demeanor changed. He smiled. He spoke with enthusiasm. We had a nice conversation as he walked me out of the restaurant. He told me about his plans for the day, what he was going to do when he got home and what he expected to happen in the restaurant later that night. The floodgates had opened. I got the impression that he was speaking the truth, he hardly ever got a tip. What is it with those bankers?

On the last night of my stay I went downstairs to the hotel restaurant and was quickly intercepted by the hotel staff, "Oh no, you can't go in there tonight. Would you come sit in this room instead?" The dining room door was closed and I could hear strange noises. Was it singing? Maybe synchronized grunting of some sort, followed by applause. During dinner I asked one of the waiters to explain and learned that in Zurich they have 'History Clubs'. These are very old organizations and each one picks a banquet hall to be their own. In fact this hotel had been built and later re-built to the exact specifications of their resident history club, to ensure the rooms would give good service for their needs. I learned there is a rival club across the river in the restaurant I had eaten lunch. The clubs have four meetings per year, some of which require traditional dress, some of which require eating lots of different fish parts, and some of which require singing or grunting of some kind. I didn't fully understand it and I had to work very hard not to say anything flippant because it was quite clear that the waiter took the event extremely seriously and I got the impression that it is a very important part of Zurich culture.

The next day I took an early taxi to the Zurich airport, checked in and waited for my family at the top of the escalator leading out of passport control. I had about an hour to wait so I played a game of trying to guess the nationality of the people coming out. I was especially curious to see if I could recognize Americans by sight when the flight from the US arrived, so I examined each person as they came up. Nope. Nope. Nope. Maybe? Nope. Just as I was starting to lose confidence, a huge stream of Americans and then, to my great delight, my family emerged, bleary eyed and blinking into the light. 

Click here for pictures from the trip.

Thursday, January 24, 2013


I found myself having to go to Istanbul to meet with a customer and due to complicated rules of international chihuahua travel, I had to go alone. The plan was to leave home on a Wednesday, arrive in Istanbul on Thursday, meet with my customer on Friday (hopefully without too much jet lag), and then I had a day to myself on Saturday to see the city. After that I was to fly to Portugal, work from Lisbon for a few days and then meet the family, one week after I had departed, when we would all reunite in Portugal. 

The flight was about as good as I could ask for given that I traveled for 20 hours straight. I arrived reasonably fresh and well rested, which is a good thing given the madhouse of an airport that I found in Istanbul. I had managed to sleep a few hours over the Atlantic and had caffeinated myself in Zurich, where I found an airport so quiet, efficient and well managed I almost didn't recognize it as an airport. On the flight from Zurich to Istanbul I sat next to Walad from Dubhai. He was, of course, in the oil business and had flown with his family to Paris for the new year. When he said Paris I thought he was saying Belize, so for the first part of our conversation I had the surreal experience of learning that Belize didn't meet his expectations for new years due to a lack of fireworks, rude natives and a total disregard for the English language. Once I understood it was Paris he was talking about, everything made a lot more sense. Maybe I wasn't as well rested as I thought. For the rest of the trip Walad regaled me with tales of the United Arab Emirates, how wonderful a place it is and how different it is from Saudi Arabia. In Dhubai you can go to the beach! And wear a swimsuit if you like! You don't have to though, you can go to the other beach with all the people who wear full arab desert gear in the water if that's more your style. You can also wear shorts that are above the knee. In public! Compared to Saudi Arabia this is quite a relaxed culture because in Saudi Arabia you can get in trouble for what seem to outsiders like very mild infractions. He told me about the day his wife wasn't wearing her robe thingy quite right and maybe a little of her ankle was showing. A man in the street yelled at her and then raised a stick as if to hit her. Plucky Dubhai lady that she is, she took the stick from him, beat him about the arms and chased him off the street. I took a look at her from across the aisle and while she seemed very sweet, she was at least double my weight and apparently handy with a stick. I wouldn't mess with her.

In the Istanbul airport, I found myself surrounded by masses of people forming half a dozen lines all going to various spots that looked like important components of my goal to exit the airport. I paused near an airport person who looked like he could help and listened as a loud American from Washington DC yelled at him in an American accent while loudly proclaiming where he was from, what he thought of the chaos and what he needed the airport guy to do to fix it for him. I think this is how many Americans make their way in the world. It does make us easy to pick out in a crowd.

Eventually I made it to my hotel and had a chance to explore the area. Istanbul is huge. Really huge. It spans two continents, both sides of a large river (Bosphorus) and edges out into two seas (Black and Marmara). It feels big driving through it. It looks big from the air. When speaking with people in the city I heard anywhere from 13 to 20 million people in the metropolitan area. By any measure that makes Istanbul the second largest urban area in the world by population, just behind Shanghai. It is also high energy, vibrant and an interesting mix of east and west. It feels completely different than a Christian, Western country but it has recognizably strong connections to the west. I could walk the streets and pretend I was in any European city, I stepped into a Porsche Design store and looked at $30k watches, but then the call to prayer would echo over the streets, my eyes would lift to the nearest mosque tower and I would realize I was very, very far from home.

On Friday, after all my meetings were done, I had the chance to see the city. I hopped in a taxi and directed the driver to take me to Sultanahmet, to old Istanbul. The driver drove and we talked. He was a college student, studying public relations and hoping for a good job when he gets done. He has a brother in Bulgaria studying engineering. The rest of his family is back home. "Where?" I ask. "Syria." He explained that he was from a little part of Turkey wedged between Syria and Iraq but he thinks of himself as Syrian. It struck me in the cab at that moment that it is very easy to be scared of what you don't know. I mention Syria or Iraq to people back home and it sounds dangerous, exotic and foreign. But riding in the taxi I was just talking with another human who is studying and working to make his way in the world. We had a friendly conversation, he dropped me off, I left him a nice tip and wished him luck. With that he drove off and merged with the millions of other people and all the other bashed, dented taxi cabs roaming the streets.

I spent the morning touring the Blue Mosque, the Haghia Sophia, the Basilica Cisterns and then made my way to lunch at the Medusa Cafe. I was on my own and I felt strangely uncomfortable. I didn't know the rules and wasn't sure how to behave without giving offense, either personal or legal. At the Blue Mosque there was a sign with rules, including behavior and clothes, but I wasn't able to make it beyond the courtyard. The faithful were praying and outsiders weren't welcome. I walked along a wide parkway sprinkled with obelisks and towers erected in the 3rd or 4th centuries. I witnessed women getting harassed because they had no man with them, young men would grab an arm, "Hey, what are you doing here? Where's your boyfriend?"

While walking between historical sites I was approached by a young man myself. I made the mistake of making eye contact. Its hard for me, I'm from Montana and used to being friendly. He asked me a question, "Where are you from?" I made the mistake of answering and that encouraged him, "Oh I love your country, I've been there before, is it near Toronto?" He walked next to me, closely, like an old friend, his body language said he was taking me into his confidence, "Want to come see my shop?" I ended the encounter as quickly and conclusively as possible and could still hear him trying to get my attention as I walked away. The behavior here is forward, rude even. There isn't the civility and polite distance I am used to. It never felt physically dangerous, but I felt that there was a constant threat of uncomfortable interaction or confrontation.

Ahmet joined me at lunch, I'd met him the day before and he'd offered to show me around the city. He took me to the Topkapi Palace and explained to me the things I was seeing. We walked through the entrance and into the harems where a maze of brightly tiled rooms once held all of the Sultan's wives. Anyone is allowed in now, where only the Sultan, his wives and his eunuchs were once permitted. After the harems we went to see the sacred relics. Behind glass were the keys and locks of the Habab, the Beard of the Prophet, the Staff of Moses and various other relics from people famous to Islam. When we first entered I took out my cell phone and asked Ahmet if he thought it would be OK if I took pictures. Before he could respond a security guard approached me and asked me if I had taken any pictures. I said no and he became agitated. I iterated, and re-iterated, that I had not taken a picture. He began to yell and it became clear his English was not serviceable. Ahmet spoke to him in Turkish and that wasn't working either. He yelled about pictures, about video and then asked me to show him what I had taken pictures of. After my repeated attempts to explain, including showing him all the pictures on my phone, he suddenly smiled and said, "I understand" and left me alone. Feeling a wee bit trembly, I put my phone away and resolved to leave it in my pocket until well away from the sacred relics. As I looked around I saw many other cell phones, cameras even, and pictures being taken. Ahmet had told me earlier that I didn't look like a tourist, he felt I fit in, perhaps due to my subdued clothes and quiet manner. After the security guard I no longer felt so sure of that.

As we left the relics Ahmet mentioned that he had never made it into the exhibit before. He has always come in the summer and it is extremely full of Arab tourists, in the winter, however it was much less busy. He pointed over to the treasury, which was full, and stated that while the Arabs like relics, the Europeans seem to like the treasury best.

We wandered to the palace walls and paused to enjoy the view of the Bosphorus and Marmara Sea. "Do you see that island between the continents?" Ahmet asked. "That's Maiden Island, legend has it that the Sultan put his beautiful daughter there to protect her from the men who wanted to marry her. Or maybe from a snake, there are different legends. It was built a very long time ago. The daughter died when a snake hidden in a basket of fruit bit her. Now it is a famous and very nice restaurant. Expensive for Istanbul but maybe not so expensive for America." He paused, "The tower over there, that's the Galata Tower. Also a restaurant now. Everything is being turned into a restaurant it seems." And in this way old Istanbul is re-used for the purposes of new Istanbul.

We walked through corridors on our way out and Ahmet explained about the lives of the Sultan, the Queen mother and the various broods of children, "Have you seen the Tudors? It was like that but the mother kills all the brothers. It is to make the empire strong."

From the palace we took a tram to the Grand Bazaar and walked through its many covered streets. Ahmet used to walk through the market every day on his way home from school and knew it very well. But on our way through we happened upon a section he had never entered before and he had to stop to ask directions several times to point us towards the Spice Market. The Grand Bazaar is a labyrinth filled with an incredible collection of goods, exotic and kitsch, cheap and expensive, commonplace and rare. What chance would I have had to ever find my way out without a guide?

We walked from the enclosed streets of the Grand Bazaar to an open air market where we were regaled by the sales cries of the various vendors and shop keeps. All the sales pitches were in Turkish so I understood nothing, but Ahmet explained to me that in this market each vendor was making personal appeals to the people who passed by, "Here it is personal, not someone trying to sell to the crowd."

The Spice Market was much smaller and extremely aromatic. I felt as if all the spices of the orient were trying to make their way up my nose at once. After stopping to admire the goods we made our way through to the exit. Ahmet explained to me that the Grand Bazaar was mostly for tourists these days but the Spice Market is still used by people from Istanbul, "There is nowhere else that I can find spices this fresh and flavorful. They are wonderful."

We stood on the verge of the Galata Bridge which spans the Golden Horn from Sultanahmet to Galata. I admitted to Ahmet that I was beginning to get tired and perhaps a little cold. He looked at me strangely and said, "That is good, I was beginning to wonder if you are human." I guess my talk of Montana and the temperatures we experience had made an impression on him. We walked the lower level of the bridge, framed on one side by restaurants and on the other by dangling lines of fishermen above, tiny sardine-like fish wriggling on their way up. We could have stopped at any of the sea-side tables for a meal of flash-fried whole fish. On a nondescript corner we dodged traffic and entered a subway entrance. It is one of the oldest in the world, just after London. But it is also very short, we hopped on at one station and rode the subway uphill to the only other station where we hopped off. 

Before dinner we sat down for drinks at a rooftop bar in a building that is owned by his school, surrounded by people he knew (handshakes and kisses all around), and enjoyed a panoramic view of the city as the sun set. The conversation turned to politics and to American culture. He explained to me how American culture has given him a common ground with people all over the world. When he works with engineers his age in India, for example, he can strike up friendships that would otherwise be impossible. They've all grown up with American culture and have a foundation they can build upon. The older generation dislikes America and the conservatives who feel that way have been gaining more power, it makes life less comfortable.

We walked through the crowds to dinner. A street hawker was showing off a small children's toy. All day Ahmet had been asking if I wanted to buy anything, the opportunities for shopping were endless but I hadn't taken advantage of any of it. I'm not a shopper I guess. But this toy caught my eye and I wanted one for my kids. Ahmet stopped, talked to the vendor and insisted that he would pay for it, he couldn't let me buy it myself. "For me it will be 5 Lyra for you 20." After a short exchange in Turkish, he paid for one and he was given two.

For dinner we had sheep-gut sandwiches and fried mussels, both much more delicious than they sound, or looked. We got a taxi out of Taksim square and after a short ride I found myself safely back in my hotel.

For the most part, the story ends here, but there is one more thing to add. I took a taxi to the airport and as I was getting my luggage out of the back I heard an insistent voice behind me, "Hurry up. Hurry up! HURRY UP!" I was used to Istanbul at this point and I ignored it until my bags were all ready. When I turned around I saw none other than Walad standing on the curb in his suit and giving me a crooked smile. He had hoped to play a joke on me I guess. We stood in line, the first of many lines in the airport, and talked about our days in Istanbul. Do you believe in fate? I think some things happen for a purpose. What are the odds of me seeing Walad ever again? What are the odds of running into him in the airport? We exchanged contact information and he urged me to come to Dubhai with my family so he could show me his country and his culture. I encouraged him to come to the US so his family could see my country. After the line ended we parted ways, south to the Dubhai for him, north to Zurich for me.

Click here for pictures from the trip.
Click here for a video of the Blue Mosque.
Click here for a video of the Hagia Sophia.