Shiran Rubin, Microsoft | Yalla DevOps 2022

This is texturung TV. Hey everyone. We're back here at yala devops rounding out our afternoon of having a lot of interviews meeting.

A lot of people in the community. My next guest is Sharon Rubin and Sharon is with Jay Park. Yeah.

I used to be with Jay frog. Oh used to be. Oh, yeah, three.

You're the former. We met yes. It's a terrible thing to get old.

It's gonna happen to you one day, but she wrote all in your mind. I know talk to us tell us what you do give us a little bit about your background. So I was in Jay frog at 2012 for five years and I started I was the core team who started I've been Trey.

Yeah, and after that I moved on to another company and right now I'm in Microsoft in CSC team. It's a commercial for engineering. Yeah, and I'm even having lightning talk today Yeah about what yeah about private data how to be beware of it how to be careful of private data specifically Pi eyes and make sure that you're doing the right thing with your data.

Yes, so let's talk about that a little bit. Yeah. To me, there's two issues.

The threshold issue is do you even realize that this day there is pii data, so we had a recent. Give you a real world example. We went to a an event a conference about 12 of my of us from my company about half of them got sick with covid at the event.

it's a whole nother story and we wanted to tell the company who had covid and and I today we're gonna do it. I said stop we can't we can't release this data even to our own people. Yeah, right and and everyone why why why because it was that's kind of confidential pii kind of date or about people's health conditions and we it shouldn't be out on our slack or out in public or even having someone attend some kind of event.

He might not want everyone to know he attended that you know that they were there exactly there are many regulations which came out. Even the late latest one. We jump for me the way it is the job the gdpr mmm, which is which really turned tables around too many companies who just figured out that they need to do so many regulations and so many things regarding private that and how to maintain it and how to keep logs and how to keep permissions over the logs that the people who really To see it are the ones that actually viewing that data right?

It's very hard. I think to be in that state of mind and make sure that you don't expose anything outside and make sure that even talking about a customer or something like that who you work with. Sometimes that customer don't want to to publicize that he's absolutely client here.

Yeah, we ran into it all the time. So that's the threshold is identifying. What is confidential data.

What is Piaf pii data then the second piece of it is? Okay. Now that I've said it is How do I how do I lock it down?

How do I make sure it does it inadvertently make its way out or forget inadvertently. How do I make sure you know, it doesn't get broken into anything. What what is my responsibility of Duty?

that information so there are many ways to keep that information and it really depends on. What trying to achieve if you're trying to achieve security mechanism, there are many ways to have users with permissions which can view the data if you're trying to achieve. People viewing the data without the pi eyes.

That's what I'm going to talk about it pii by the ways personally personally identifiable information such as names addresses emails and date of birth. Even yeah, very simple thing that you think how can I even connect it phone numbers? Those things you don't want to expose in externally sometimes and even in logs which developers read.

You cannot show them the pii you need to make sure they're Out of there. So what basically Presidio which is one of the open source that we're working on does is just take that text and knows very fast very easily. It has two mechanisms want to analyze the text and the other one to anonymize the text and just take that text analyze it find the pi eyes and after that anonymized it so you say nonamines what really you mean?

So when I say anonymize, I mean that After it found the text, you can decide what to do with it. You can say okay. I don't want to see it at all and I'm just putting blank instead or I can put some kind of other text instead.

It's your decision. Presidio gives you that option to decide what you want to do with it. You know because to me, so I've been at security for 25 years.

Before I started all this to me, this is very analogous to what we were doing in PCI, you know payment card credit card numbers. Yeah, right before PCI. It wasn't unusual for people to store the credit cards of their customers and and every a lot of people had access.

I mean many offices they would write it down. They had it in a file even today it happens. And even today when I go into the side, there's a developer.

I know to look for the pcis and also I go into the iframe of the credit card to make sure that they're not storing it. Yeah, and it was a big thing in peace. I very similar to what you're saying that even in when developers were using data sets to help develop and do that.

They anonymize the pciated the credit cards were truncated or you know, that was a big thing right? Thanks. Just let's for dig.

Yeah, and in that way we we stop doing it, but the biggest the bigger thing was is that we finally got people to stop storing credit cards. It was a lot of not that yeah credit cards unless you have to I know people are still doing absolutely there's a lot of companies that Offer third-party credit card data storage, which kind of absolves you from having it, you know on your for PCI purposes. Yeah.

Are we heading there for pii where maybe people should stop storing it? Because it's Just a problem waiting to happen. I think it is possible today with the tools out there, but I think most companies don't want to invest the time or the resources for it, but As the regulation goes further as it starts to bite exactly as it start to bite and people getting fines and paying a lot of money companies are paying a lot of money for gdpr validation.

then the companies will pay then the company's will invest the time. I I sir recent article the gdpr had passed the hundred million. Fine Mark like so there's not not any one company, but collectively there's been a hundred million dollars in fines levied for gdpr violations now, which is it's a lot of money it is.

Um, But I I do think that that's coming. I mean the problem with pii versus PCI is look credit cards. It was a very simple thing to say.

What do you need that credit card number for you doing reoccurring billing is why you would need it. Other than that? With pii like you said a lot of people think it's innocuous, right?

That's just a name just the girl. Yeah. I want to make sure they're an adult that they're over 18.

That's all but you do you really need that date of birth to do such a thing. They're missing such an important part because someone can come and open an account from for in your name with your dad. He's impersonating you he can still your it can steal your identity.

You can get a credit cards in your name. Social security number for example and stuff like that. Yeah, very easy to just get a credit card and get you into that.

and companies don't understand the importance of people's privacy and the person who doesn't want to be a part of a of something which is so open. Yeah, I want to make sure my privacy is protected. I want to know that if I sign up for a site not everyone is familiar with it.

There was a story by the way seven years ago, I think. About the dating site that was hacked and all the actually Madison exactly. So that was the that wasn't just a regular dating site.

That was a dating site for married people. Yeah, I know and yeah, I got pretty embarrassing very embarrassing but so in my mind is this too potential Solutions one is education, right educating people about why you need to treat this differently about how if you don't need it don't keep it the flip side is kind of automating solutions. Greatly you said you have solutions that went through and saw pii and anonymized it.

Yeah, you can example for example, you can use it as a Cron job as a cicd part as a function. You can really do it very easily to go over your database your logs your configurations and just anonymize whatever you want the issue with that is I think people like to save data about users because it gives them power right issue. I think you know, I'm glad you said it not me but that is that's a big issue.

Right? I mean, even we see it in my business right because our business is so beyond doing these kinds of things right our mailing list. Where we're doing events or webinars or what have you and we have companies that want to reach our readers and but it's not enough to reach them because they don't want to reach every reader they want to retreaters who are in this geography have this kind of job working this kind of company.

I don't have to tell you right the entire industry of advertisement. He's built on that personalization. And so, how do you I I see that our own company.

How do you anonymize pii but still able to offer that kind of targeting that's a good question. And this is something that the companies will need to figure out and still stand in the right guidelines. Yeah of the rules.

I mean, we you know, I can only speak for my own company. We this is something we battle all the time, right? Yeah, because she died.

I just first of all people don't like to give you all that information for every question you add to their ID a certain amount of people will just leave and not fill it out. Yep. Then when you do have that information, it's kind of fungible right because people move around or whatever.

I I don't know. It's it's hard. It is hard.

It's a hard thing. You mentioned this open source program. You work that Microsoft is working with so Microsoft has open sources many not only one repository but several the Presidio one is the one that are grouped CSE built-in and we're maintaining it doing the maintenance and everything that needs to be done.

It's on GitHub free for everyone if anyone wants to search for it. It's for Studio. So Presidio our GitHub reproach.

Yeah. com slash Presidio or slash Microsoft slash for Studio, absolutely. All right.

Well, hey, I want to thank you for stopping by so much. I hope you're enjoying our definitely amazing. Good show.

All right, we're gonna take a break. We'll be back in a little bit here at yalla.