Lessons Learned After ISO27001 / SOC2 Certification: Bridging DeFi Culture and Enterprise Standards

Transcript

All right. Hello everyone. Glad to be here. So today we will present uh lessons which you learned after passing through certifications ISO and so 2. But first of all let me represent myself. I am Ilia chief information officer from 1 in. And we have also Ivan our security and data protection officer and also we have a Roxy a specialist from zero shadow. Okay, as you can see that the second presentation in a row where zero shadow and one inch partnering.

All right, so let me start from a quick question for the audience. Do you so do you have if you see some words which you don't understand what really means please raise your hand. Okay, which one? What's that word? Okay. Continuity. Uh, anyone else? I I saw one more hand over there. No. Okay. So, only continuity. Okay.

That's very good enough. All right. So, yeah, as I said, we got uh ISO and the sock 2 type one certifications. And u why we did that? So first of all that's a partners and our clients demand pretty much obvious we are going to traditional finance and that's why we need to be prepared we need to be have a badges which will show our security pressure and so on and so forth then that's a pest to scalable credibility right how we are going to find new partners how we are going to attract new clients right so this certification not only this showing

think that yes we are ready, we are compliant and so on. And uh last one but not least, our original idea was pretty ambitious and enthusiastic. That's do this stuff right in terms that not only have a check marks that oh we are compatible we are compliant right but also have that really in our company have everything what's being kind of pushed in ISO in sock 2 uh into DNA of our company okay so that's our short history we spot demand in the 2023 we spent the whole year of a 2024 for uh transformation of

our infrastructure, how we are building CI/CD, DevOps and so on uh identity management. So that's took pretty much a while for us uh to be there and in 2025 we uh proceeded with the process transformation and also we already had obviously internal and external audits and our upcoming goals is by 2026 do have a second part of a sock two sock 2 type two to be honest that's probably will be a little bit challenging for us because I saw And so two type one I would call it theoretical one. And for sock two type two it will be much more

harder. We will need to bring much more evidences and so on and so forth. And uh uh also in the next year we are going to proceed potentially with other certifications which uh interested for our clients. All right. So who was doing our internal audit and external audit? So first of all thank you to zero shadow right they not only did our internal audit but also they helped to find a very good external auditor prison security.

All right. So the first thing which you should know that to get there uh to be major enough that's a multi-dimensional journey. Okay. So that's not only check marks. You should be mature enough on all listed directions. Right? So you should for example work on the ownership at the beginning when everything start up like uh everyone owns everything right but once you grow there should be clear um vision who is accountable for what documentation the same when you start documentation in people mind and

probably just a little bit in the code but once you grow you need to on board more people you need to be sure that everything is documented correctly that everything uh consistent with each other. So you should m became mature enough from documentation perspective um grow from a tribal knowledge to formal and easily to automated knowledge. Next one of course that's a processes right at the beginning it's ad hoc processes somebody just pushing somebody else hey go and do something and there is no processes at all no processes and once

you go you should understand what's repeatable things you are doing from everyday life and make sure that these uh things becoming your process that you understand how it works that you can bring more people into your team and they can do from day one. Okay, probably day two uh what's needed, what's requested from them. Next ones, that's a tools. Your tools should also become major enough, right? At the beginning, every developer might use whatever he wants, right? And once you grow, it's uh becoming a problem, right? because how you will transfer from one developer to

another developer, how other person will understand that how to um let's say connect dots with each other. So you should also work on a proper uh tool set for your company and sometimes even kill particular uh uh tools which are not being used. For example, in our company uh we killed uh notion in favor of confluence um and uh work on your innovation how you do innovation right at the beginning that something oh idea came to the mind and uh overnight I wrote the code right but uh in a reality in a

businessoriented um company right idea should go through some valid ation should uh go through some ediation, right? And uh you might have a subject matter experts involved and so on and so forth. So you should also work on how you innovate to make that sustainable. All right. So quick check on uh the left side you can see some phrases of hackers, right? Please count uh plus one if you feel that you more on the left side.

Right? So for example, if you believe that it works, ship it more closer to you right now. That's plus one for you. Okay? If you believe that everyone contributes closer to you, another plus one. Okay. So next one. Documentation slows us down. Access is temporary. I will clean it up later. Telegram message equals approval. Telegram or Slack or whatever. Uh security is everyone jobs. So it's fine.

Right now let's uh let's count who has uh six score. Six. Okay. No one. Five. Wow, I am impressed. Okay, four. I also impressed. Three. Okay. Probably one person. Okay. Two. All right. And one. [laughter] Good. Okay. So, everyone else I assume just too shy enough, right? Just don't want to acknowledge that yes, it's indeed six.

All right. Um, so here you might have uh see some particular terms which you might you you should become professional of on your way for to maturity right at the beginning. It might look like a very alienated words for you but indeed you that should become you know part of your DNA. Something like vendor management right? How you on boarding partners? How are you on boarding new vendors into your company? Data protection and privacy very serious thing once you have a billions and billions of dollars going through uh your uh your startup and you indeed working with people data right uh

security incident response plan the same right it's better to be prepared ahead of a time while doing that on on a hawk um then I don't know risk assessment risk management right the same type of policy acknowledgement and so on and so forth. So we went through all these uh all these things and uh yeah uh on the path to maturity it's u it's necessary to see to learn all of that.

All right. So as you might lesson number one as you probably already understand that the key point for maturity that's a culture right culture is very very important uh once you grow you will feel it on a uh on your fingers what that's really means but what uh also means that culture u defined by uh your founders right and early employees and u once you grow changing a c culture becoming exponentially harder.

So please please pay attention to that and if you feel that your company is growing and something not going right uh it's probably do that change that fix that right now rather than fix that later it will be much more harder right so key point here that leadership define culture and you should do understand what's your actually culture means it might be I don't know as in our case uh we still doing hackathons Okay, we have a per around eight hackathons but we put a corresponding processes around that [snorts] to do that in the right way in a manageable way. All right, next one. Very very

important. That's a ownership must be explicit not implied. Right? When you start everyone responsible but once you grow it means that nobody is responsible. Nobody uh everybody kind of mentally uh mentally pointing out to another person, oh that's that guy responsible. But no, you should be pretty much clear who is responsible for what, who is doing uh CI/CD, who is doing uh uh code testing and so on and so forth.

Um all right. And uh next like a real uh lesson learned that's Telegram, not only Telegram, so as you but Telegram primary, right? Because in the crypto telegram became the factor standard right but as you might see it's uh hard to manage that in a enterprise way for example you have a secret uh chats secret um groups with your clients with your partners and then somebody quit your company and you have to manually delete that person from all of those uh

those groups. And the same with on boarding right somebody coming in how to bring that person into all these telegrams telegram groups. So we together with synapse uh build bot telegram board bot which made us compatible with identity management in our case that's uh octa we are using octa all right and probably Ivan yeah yeah that would be me hello hello here so I'm going to talk about policies but not configuration policies but the documents that we usually go Next, next, next.

Yes. Yes. To all apply, all goodbye and haven't thread them at all. So, it was a bit different because uh in order to do them, you need to have highest management buy in from them to read the policy policy owners to understand them to know what they're putting inside and then but let's first talk about the policies. So it's actually a document high level document where we actually say what do we want to do and why do we want to do whatever we want to do and now once we have that >> can I jump in quickly >> please so policies is like a smart contracts uh but for your company >> okay good yes so

we need to have policies in place we need to align with the policies and not only if we don't have them docu documented and followed it actually means we don't we don't know this we don't have even the structure within the the company. Next slide please. And not only the policies but we also need to have additional documents which are guidelines procedure that says who does what and in which way. So these are also the the the the really important thing that we need to have it because we need to write it down and we need to document it and uh the thing is where we think we had advantage on compared to other

companies is that we had a knowledge management team. So knowledge management team was able to uh gather all of this information, gather all of this data that we have and manage it properly. So it was much easier and faster for us to move during the the certification itself. So how did we actually did it? So we mapped the current state then we educated the people raise awareness what do we need? What they actually need to do? Of course there is a push back always. Why do I need to do the papers? I like to do what I'm doing. We don't want to do that. But okay at the end with the buyin from the highest management this was overridden at the end. And so we had a knowledge

management team who supported in all of this. We enforced it. And right now we are going to the sock to type two where all of this is continuously documented. I think that's it. Okay. >> Sorry. Rox is next. Sorry Rox. >> Thank you everyone. All right. Compliance accelerates maturity when done right. Very bold statement. The first thing we need to understand is what is compliance? Compliance is the adherence to laws, regulations, your contractual obligations to your clients or as a service provider. The second step is to understand what compliancy is applicable to me from

jurisdictional regulations to jurisdictional uh legislations and to obviously your contractual obligations. So the first step there when you start all of that and you understand that is we need to look at automation. Automation to scale we've got to have that at the back of our head. So while we doing all of this we need to understand okay what do we need to automate? What are the repetitive tasks? So when you look at compliance and and they say it reveals invisible weaknesses, it just ties into risk management because when you know what your compliancy uh applicability is, then you set parameters and when you set

parameters, you are able to identify the risks associated or the as they say here the failures before they actually happen. Um the second part is and this is a mythbuster. So when I go into a lot of companies, I ask them who's in charge or or who's responsible for security and the question that I or the feedback that I get is the head of security or the CIO or the CISO. But that is not correct. Security is a shared responsibility. So we do it every it's an inclusive um it's an inclusive game changer basically

in the company. So every single person in that company uh basically um contributes to security and then we talk about builds continuous accountability. So it takes you from reactive to proactive. So now you're not firefighting, you're fireproofing um because you're able to identify risks before they happen. You are a uh able to identify incidents before they occur. And that is what compliancy is and that's how it accelerates your maturity.

Next slide. Um IA right the auditor is not your enemy. So I use many caps and one is an auditor's cap and I hopefully not a scary looking person. So what the auditor does is it takes your intent which is your policies and the controls that you've implemented. So basically what you've operationalized and we as auditors validate that your controls are what they are. So when it says that they validate what actually works, it takes your existing controls that you've implemented um that's on paper and looks at it in a practical environment.

So they say accelerate maturity by forcing clarity, accountability and continuous improvement across teams. just means that now everybody's accountable. We've got responsible people in each area. So it is a I I would say a familyorientated um mission in terms of compliancy and that ties into your governance risk and compliance. >> Thank you. All right. probably I will skip a little bit payoff just in sake of a time but yeah we are measuring [laughter] more and more and hopefully from year to year it will become

uh so what what's key takeaways first of all compliance is not bureaucracy right if you think that is bureaucracy that means that yeah you should take a look more more closely uh culture shift is the hardest I hope that we explained that that's really culture that that's a key point there and uh then defy actually compatible with enterprise uh standards they not contradict they're compatible right and that from our perspective lead to sustainable innovation all right uh any questions That's hi wonderful presentation. Thank

you. Uh you mentioned you're moving from uh notion to Atlassian as an example of uh of different software. I will call them like web two in this in this example. What would be the examples of web three softwares that you had to move in order to in order to comply with this sort of standards? >> Sorry, what what sort of software in web three? like the CI/CD processes or monitoring infrastructure. Do you have examples of web three uh tools that you had to move in order to achieve these kind of standards? >> Uh from web three web three to be honest I don't remember that we removed something but we very very picky to on board new or do you remember somebody >> hyper native? Oh yes yes yes. Okay.

Yeah. Thank you. One more question. >> So what kind of advantages uh does it really give you to go through all this uh painful uh stress it is to get to be compliant and uh if you enjoy that are you going to the maximum pain and getting Dora as well >> Dora compliance. >> Yeah. Um yes a very good um uh very good topic Dora. Um yes that is something in the future but not at the moment in terms of what the applicability is um in the market. Um in terms of um continual

improvement and and what we do yes they do enjoy it. The company has 1 in has embraced compliancy. Um it's not a oneandone. Um it's continual improvement. We've transferred business knowledge across to the whole team. So it's everybody getting involved in it. So yeah, I think you guys are enjoying the journey. >> I do. Thank you. >> Yeah, thank you. Any other questions? >> One more. >> Thank you. Uh well, thank you for the talk. I I think uh to founders and a lot of early teams uh we obviously know this

is important and nice to have but the question is uh when and how much money we need to spend on it and especially if clients are not asking for it, partner not asking for it and government is not asking for it then uh how much money do we spend on this and why and when? >> Yeah. >> [laughter] >> So it's not about um you you can't just put a number on it. Um your your auditor's cost to get you validated.

Yes, there's a set cost, but when it comes to implementation, it depends on the uh size of your organization, the complexity of your platforms, um the people, the processes, the technology. So it's all dependent, yes, on your maturity posture. So at Zero Shadow, we meet you at your current state and we take you from there. We don't just say it's a blank slate or we use um a paintbrush across every client. It's dependent on the client's organization. So if you want to just come and chat to us.

>> Yeah. Just to add if you're interested in numbers. [laughter] So if you want just to have a check market ISO and so 2, yes, you can do it like really really cheap. But that will bring you like literally nothing. it will give you just these badges and every next let's say audit major audit can reveal that it's oh so that's a just a just a how to say just a picture okay so in our particular case let's say if you would want just check marks it's it's small amount but we spent I would say pretty much big amount of money like a six figureure uh for adopting you know

for bringing required systems to bringing required integrations to bring required companies as a partners and so on and so forth. So that's again that's that depends on your appetite. [laughter] >> Uh actually you can spend all of your money for certification and you can always upgrade your certification. you can you can spend all of your profit and you can still find a few more holes that you can fill. So the budget is not there. It's important that you mature so you have a team that knows what is doing that is patching what needs to be patched that is compliant and that's it basically.

>> Thank you. Thank you very much. I think we have a