Enterprise Security Magazine: Specials Magazine

Christopher Russell, the Chief Information Security Officer (CISO) and Head of Tokenization at tZERO Group, Inc., is a seasoned cybersecurity expert with extensive experience in the ever-evolving world of information security. With a strong background in enterprise risk management, incident response, and application security, Russell has been at the forefront of integrating security measures into the fabric of tZERO’s innovative blockchain-based services. His expertise lies not only in traditional cybersecurity but also in ensuring that cutting-edge technologies like tokenization and smart contracts are secure from the ground up. Before joining tZERO, Russell held various senior security roles, where he honed his skills in creating resilient and proactive security infrastructures for technology-driven businesses. His journey has been marked by a commitment to continuous learning and adaptation in a world where cyber threats evolve at an alarming pace. Today, as CISO and Head of Tokenization, he leads a team that ensures tZERO’s technology stack remains secure while supporting the company’s growth in tokenization and blockchain technology. BUILDING SECURITY INTO THE PRODUCTS At tZERO, my role as CISO and Head of Tokenization encompasses a diverse set of responsibilities that combine traditional security measures with emerging technologies. My primary responsibilities include overseeing enterprise risk management, application security, vulnerability management, endpoint detection and response, and incident response. These form the foundation of our security posture, ensuring that we maintain a resilient environment against ever-evolving threats.

Why do legacy SIEM architectures fail under modern telemetry scale and complexity? Enterprise security is only as strong as the breadth and integrity of the data it preserves. As cloud use expands, operational technology environments remain critical, and AI adoption introduces new operational layers; telemetry volumes have grown beyond what legacy tools and architectures were designed to handle. Many traditional security information and event management (SIEM) platforms were built as analytics engines first and databases second—if at all. That design worked when data volumes were manageable; 500 gigabytes used to be considered ‘big data.’ Now, organizations are creating terabytes to petabytes of data every day. Despite leaps and bounds in security technology, legacy SIEMs and log management tools struggle to store such massive quantities of raw telemetry for extended periods while needing to maintain search performance and cost predictability. Gravwell was built from the outset to address that structural limitation, posing the question, “What would a SIEM look like if built from scratch with the lessons learned over the past decade?” Positioned as a security data platform (SDP) rather than just a SIEM or detection engine, Gravwell is a time-series data lake with SIEM capabilities and analytics built on top, separating the function of storing ground-truth telemetry from the tools that analyze it to enable organizations to economically ingest and store all their data in full fidelity. At the core of Gravwell’s architecture is a structure-on-query model. Instead of normalizing logs before ingestion, the platform preserves raw records, including binary data, NetFlow, full packet capture and even malformed logs, exactly as received. This model only applies structure at query time, enabling organizations to ingest data types that legacy SIEMs can’t because they parse data on ingest and force it into rigid schemas. This results in dropped data and blind spots across the organization where threats can go undetected..