Suggestions
Graham McNicoll
Co-founder & CEO at GrowthBook (YC W22)
Graham McNicoll is a technology entrepreneur and software engineer who currently serves as the Co-Founder and CEO of GrowthBook, a Y Combinator-backed startup that provides an open-source feature flagging and experimentation platform.23
Professional Background
McNicoll has an extensive career in technology and engineering, with notable experiences including:
-
Education Background: Graduated from Carnegie Mellon University with a Bachelor of Science in Physics from 1996 to 200012
-
Previous Roles:
- Vice President of Product and Engineering at Education.com (February 2020 - April 2020)
- Chief Technology Officer at Education.com (November 2014 - February 2020)
- Systems Architect at Education.com (January 2011 - November 2014)
- Senior Software Engineer at Education.com (August 2007 - May 2011)
- Co-founder and Senior Software Engineer at Worldlinked, Inc. (January 2004 - May 2007)2
Current Venture: GrowthBook
With GrowthBook, McNicoll aims to help companies make data-driven product decisions through feature flags and A/B testing. The platform solves common issues with existing SaaS solutions by using a company's existing data infrastructure and business metrics.3
Professional Skills
McNicoll has expertise in various technical skills, including:
- PHP
- MySQL
- JavaScript
- HTML5
- React.js
- Linux Server Administration
- Search Engine Optimization
- Database Design1
Personal Details
- Location: San Francisco Bay Area
- Email: [email protected], [email protected]
- Phone: +1972-221-3564
- Languages: English (native), Swahili (limited working proficiency)12
Highlights
𝐄𝐧𝐡𝐚𝐧𝐜𝐢𝐧𝐠 𝐒𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐢𝐧 𝐅𝐢𝐧𝐭𝐞𝐜𝐡: 𝐌𝐢𝐧𝐢𝐦𝐢𝐳𝐢𝐧𝐠 𝐀𝐭𝐭𝐚𝐜𝐤 𝐒𝐮𝐫𝐟𝐚𝐜𝐞𝐬
TL;DR: • Security certifications alone are not enough to prevent attacks. • The best way to secure data is to minimize the attack surface. • Self-hosting tools can significantly reduce the risk of data breaches.
I recently received a letter from my bank stating that I should ‘not worry; my account was safe.’ This immediately worried me. The email mentioned a data breach at a partner bank that may have exposed our account information. This attack was impressive in scale. Evolve Bank and Trust, the bank behind finance apps such like Mercury, Affirm, and Wise, was compromised. The attackers stole a whopping 33 terabytes of data-roughly equal to half the online data from the Library of Congress. This likely represents almost the entirety of Evolve’s Azure Cloud storage.
The troubling aspect of this breach is that Evolve Bank and Trust had all the expected security certifications, including SOC 2 Type II, HIPAA, HITRUST CSF, and PCI DSS. Despite these certifications, the attackers still managed to infiltrate their systems.
Although we still don't know how the attackers breached Evolve, this incident highlights the importance of robust security practices. Architecting secure systems involves many principles, but the best way to secure data is not exposing it in the first place, thereby limiting the attack surface.
The attack surface is the sum of points where an attacker can attempt to enter or extract data from an environment. Reducing this surface is crucial as it limits the potential entry points an attacker can exploit. In 2022, the financial sector experienced 566 data breaches, exposing over 254 million records. This statistic highlights the critical need for enhanced security measures in the fintech industry.
In fintech, where the stakes are high, minimizing the attack surface is crucial to reducing breach risks. The safest data is not connected to the public internet. While cloud-based applications are convenient, they often overlook the need to limit the attack surface, regardless of the vendor's certifications. Hosting a service on-premises is the best way to add functionality without increasing your attack surface.
Self-hosting tools, whether air-gapped or behind your firewalls, can significantly reduce vulnerabilities. This approach doesn't impede innovation; most systems, including GrowthBook's feature flagging and A/B testing platforms, offer self-hostable solutions. By adopting self-hosting, you maintain security while leveraging the best tools available.
GrowthBook 1.7 is now out! It includes a lot of new features, including dark mode (who doesn't like dark mode?), improved ratio metrics, SQL Server support, self-hosted SSO (Okta, Azure AD, Google, etc), and saved groups for easier targeting. This release covers over 50 projects- kudos to the amazing GrowthBook team! Read more about it here:
