The New CISO

Latest Episodes:

Influencing and Informing Non-Technical Business Partners on Security Issues Feb 17, 2021

Show notes

Curtis Simpson, CISO of Armis joins us to discuss the pros and cons of starting your career in a small organization versus a large enterprise. How can you influence and inform business partners from a security perspective? Why do people believe the CISO shouldn’t report to the CIO?

BACKGROUND

Curtis likes to say he was born with a keyboard in his hand. Growing up with his father working in IT, Curtis was already coding by age 8. He started his career in mass organizations and served in various roles at Sysco over the course of 10 years (including Vice President & Global CISO) before coming to Armis in 2019.

FROM TECH TO POLITICS

When asked what advice he had for his younger self, Curtis had one answer: stay close to what you enjoy. By spending nearly all of his time playing politics with larger organizations, he gravitated away from what he loves: tech. In large organizations, he had to constantly fight for every morsel of progress and spent a lot of time educating company members on why he was even talking to them in the first place.

LARGER VERSUS SMALLER ORGANIZATIONS

The biggest difference between the two? The ratio of time spent in the political realm. In certain situations, a situation that could be signed off on in 30 minutes takes three months. The ability to balance an understanding of the market and enterprise is an important aspect of the role, but being a CISO is not about spending all of your time forming relationships to have minor decisions made. Instead, it should be about leading teams and learning the evolution of the markets.

TIPS FOR STARTING SMALL

A mistake Curtis noted for himself when he was at larger organizations: he was too title hungry. However, at smaller organizations, there is more opportunity for fulfillment and confidence-building. Smaller teams usually understand their objectives and are very hungry to prove themselves in the market. In the smaller model, you can also continue to discover your interests within the industry.

TRANSPARENCY WITHIN THE INDUSTRY

When asked what irritates him the most about the industry, Curtis notes the transparency. Companies are rarely focused on the right thing because they are rarely honest about what they do and don’t know. This has been a cultural norm, one that the industry must continue to disrupt. While the transparency has improved, there are still individuals in the industry that are guarded in their conversation.

CISO AND THE CIO

One of the most painful elements of Curtis’ career is that the industry has long past the mark where CISOs should not report up through the CIOs. In many cases, CISOs are representing a message to a CIO that unfortunately doesn’t have as much of a grasp on security. As a result, the CISO spends a lot of time creating and delivering a message that can start to fall apart. For example, a CIO may want to paint a different picture to the board, so they will create a less transparent image of the situation.

THE NEW CISO

For Curtis, the new CISO is all about servant leadership. This episode discusses the success and fulfillment of building teams and enabling them to perform at high levels. Teams with an established workflow and culture will follow you through the greatest challenges.

LINKS

New CISO Podcast

Curtis Simpson - LinkedIn

How Do Leaders Cultivate Diversity of Thought Jan 21, 2021

Show notes

Artie Wilkowsky, CISO for Dish Network, joins us on this episode to speak about specialization, leadership skills, and the qualities he looks for in new hires.

Artie’s Background

Artie has been working at Dish for over two years, helping with all their lines of business, such as Sling, Contact, and Wireless. Before that he bounced between consulting and industry, working in financial services and aerospace.

Specialization vs. Generalization

In thinking about advice for his younger self, Artie would tell himself not to worry so much about specializing right away. It’s important to get a broader view of an industry, see how different sectors impact one another, and then decide if you want to specialize. Artie believes that the more you progress in security, the more you end up being a generalist anyway, so it’s good to start there so you have that holistic foundation.

Artie also encourages others to do the same; he helps people on his team shadow others in different areas of a company to have a better understanding of how they work.

Automation and Budgeting

Artie discuss how sometimes security and IT are not necessarily given a budget they need in order to excel in their areas. However, an unintended benefit of this is that CISOs or others who work in security are forced to become creative with their coding. Out of this creativity, you can have CISOs who must automate certain functions, as they can’t afford the staff to maintain them. These automations are not only impressive but strength the security.

Skills You Develop and Ditch

As you progress in security, there are certain skills that you will need to develop, and others you will need to ditch. Artie examines what skills have been helpful to hone or drop in his career and the careers of those around him. He believes that as a leader, you must be able to communicate, translate, and influence. Listen to the episode to hear more about what Artie means by these skills.

Artie emphasizes the importance of learning how to work with others, as well as learning to now delegate and manage. Instead of doing it yourself because its faster, take the time to teach someone else so that they can have that experience

Delegation

In particular, you must learn how and when to delegate. Artie relays that if you don’t delegate, you stifle those around you. You don’t give them an opportunity to grow their skills and their career, and as a result, they may not stay around for as long. Additionally, when you don’t delegate, you signal to your team that you don’t trust them. Listen to the episode to hear more discussions on how behavior in meetings can also affect trust amongst the team.

Responsibility of Growth

When discussing the leadership role, Artie reiterates that you must invest in the individual, letting people come on special projects and allowing them to grow. If not, talent may leave. If you don’t create an environment for growth, you’ll not only lose that talent but struggle to acquire it. You may put forth a reputation of stagnation, which will turn people away.

But whose responsibility is it to grow? The employee or the leader? Artie believes it’s a bit of both. The leader needs to create a space in which the individuals who want to grow can do so. However, the employee still has to advocate for him or herself, asking how they can improve and take on more.

Hiring

When Artie is hiring, he looks for specific skills in interviewees. He looks for people who ask why and who like solving problems. Particularly, people who are naturally curious. In addition, he seeks out those with verbal and written communication skills. Some people can write very well, but they don’t always know how to effectively communicate or express oneself.

Artie discusses how he asks certain questions in the interview that would allow you to see those skills present. Listen to the episode to hear how Artie approaches his interviews so he can better understand the candidates’ thought process.

Influence

As a CISO—or any leader—you need to know how to influence others, as your job includes influencing a team and other members of the organization. Artie believes it comes down to trusting yourself and your abilities. In addition, he stresses understanding yourself, being prepared, and asking for advice from those you admire. As it’s a newer profession, CISOs and those in cybersecurity must be self-reflective and always self improving.

New CISO

For Artie, the new CISO is someone who understands their business, who leads and mentors others, and who gives people the tools that they need to be successful.

Links:

New CISO Podcast

Artie Wilkowsky- LinkedIn

Balance Budget and Tools by Rationalizing Your Security Stack Jan 07, 2021

Show notes

Gorka Sadowski, the CSO of Exabeam, joins us on this episode to speak about his decades of experience in cybersecurity and what he’s learned about acquiring new technology.

Gorka’s Journey

Although Gorka became Chief Strategy Officer for Exabeam only three months ago, he has over 30 years of experience in cybersecurity. Gorka has learned many valuable lessons along the way, especially during his time at Gartner, the global IT service management company.

Each year, Gorka spoke to over 600-700 clients and vendors about their successes and failures. Although rigorous, the beauty of this is that by speaking to many different clients, he was able to recognize patterns on what works and what does not. Both vendors and clients benefit from these conversations. Newfound knowledge emerges, which is then studied in a more formal setting and is later published as research by Gartner.

Non- Gartner research then compliments what is learned in the conversations of Gartner clients and vendors.

The Pitch Problem

One of the biggest issues that Gorka has identified is a misalignment with expectations of a product and the value proposition it’s supposed to fill. He feels that vendors oftentimes like to take liberties on pitch of their products and sometimes, the readers of the pitch can get caught up in wishful thinking.

As someone who has spoken with both sides of this problem, Gorka feels it’s best to begin with why—why does someone need your tool? Then work your way through the how and the what. He discusses Toyota and their message as an example of the why aligns with the what. Listen to the episode to hear more on what Gorka means by this.

Building Trust

There are no shortages of huge claims or startups that promise everything. The CISO or the client organization need to learn how to pierce through the veil and filter the messaging they receive, and they need to do so diligently.

Gorka advises vendors to build trust by being consistent and have the humility to admit when your technology cannot accomplish what the client wants. Ultimately, this will help you. It takes time to build trust, which Gorka reminds us, is not a binary quantity. Growing trust occurs with baby steps. Ultimately, things don’t have to be perfect for things to be great.

What Covid Revealed

Gorka believes that Covid revealed that many companies are using outdated or underutilized technology. But the pandemic also brought out the need to take stock of what a company has and question if it needs to be changed, updated, or encouraged. If you realize there is some old technology that isn’t useful anymore, you benefit from not just getting rid of it, but from saving yourself the cost of maintenance. This will free up your budget for new technology.

The CISO and the Vendor

Many times, the CISO is—and should be—skeptical. Gorka believes you need a healthy dose of reality so that you can understand the factors at play and to avoid being burned. By the time someone reaches the position of CISO, they can “smell the BS,” as they know how to pay attention to body language and asking the qualifying questions.

Gorka also stresses the importance of the CISO creating an engaged process to buy new technology. He encourages CISOs to bring in many people and get more of the company involved. Listen to the episode to hear more of his thoughts on this.

The Why, the How, and the What

Gorka gives advice for the pitch itself. He iterates that the vendor and the client have to both understand why the tool is needed, in addition to how one can operationalize this tool. The organization must clearly see how they can embrace and implement this new tool.

It’s important to follow up with the specific question of what value can this specific company get out of this tool? Why is it good for them specifically? Gorka emphasizes how the company should have a checklist of what value they want out of the tool before the meeting with the vendor. They must understand what value they are seeking, and how this fits into their budget ad mission. Listen to the episode to hear more about what both the client and vendor should do before and during the meeting.

New CISO

Gorka believes that the new CISO needs a good balance of preventative measures and the humble acknowledgement that things sometimes do happen. In addition, the CISO must pay attention to how the organization as a whole looks at threat detection, investigation and response, particularly utilizing analytics to help aid in the work. Listen to the episode to hear more on Gorka’s thoughts of an analytics driven, automated cyber security team.

Links:

New CISO Podcast

Gorka Sadowski - LinkedIn

The Moments After a Major Breach Dec 23, 2020

Show notes

On today’s episode, David Damato, the CISO at Gemini Trust Company, joins us to speak about what occurs within organizations during and after a breach—and what should happen for the best outcome. He emphasizes communication, confidence, and clarity.

David’s Journey

David works for Gemini, one of the few regulated crypto currency exchanges out there. It is regulated by the New York Department of Financial Services, along with other entities. They must demonstrate that they’re a legitimate organization, as the field as a whole has had a lot of problems. They prioritize building trust, and David believes the industry is evolving to a more mature state.

Before Gemini, he spent about 10-15 years working at scrappy, small organizations. He had a lot of fun helping them grow into larger institutions and sharpened his expertise.

The Planning

David has aided over 100 organizations directly during a crisis, and indirectly has helped a couple hundred. In working with many institutions, he has found that the best outcomes occur when the company executes on the practice and the planning they had done prior to the breach in an organized manner. Planning starts way before a breach and is structured around the architecture, logging system, data and if the team engages in mental exercises.

David also explains that the size of the organization affects the outcome, as well as security’s status within the institution, and the two type of panic that rise: panic that people will find out or panic over the safety of the customers’ and their data. How David is often viewed, either has help or a hindrance, reveals the priorities of the leaders. An organization can either be grateful for his team exposing flaws so that they could fix them, or they try to hide mistakes. Listen to the episode to hear more examples of behavior that influence the crisis management.

Branding and Communication

Next, David speaks on communicating both internally and externally about the breach. An effective security team communicates with the rest of the institution about the importance of the job. If you can advertise to the right people about the threat and what you can do, you can receive more funding. If not, you might struggle to solidify your place in the institution.

David also points to the branding of the company as having an impact on how the breach is viewed or manage. He gives Google as an example. They have great trust in them and they participate on boards and at events. When there was a breach, they talked about it and talked about it in the right way. People already liked the business and the brand before the breach occurred, so they were more forgiving when it did. All of these factors helped the breach be better received.

Additionally, the figurehead of managing that breach is also important. David finds that non-technical executives need training so they can know what to say when a breach happens. Without this training, executives can sometimes misspeak out of lack of knowledge, or overshare without realizing this could worsen the threat. He emphasizes training and practice.

During and after a breach, how an organization communicates to the public is key. Therefore, those points of contact must be taken seriously: from phone calls, to interviews, to the letter. As an example, David and Steve run through a practice interview. Listen to the episode to hear what David presents as a solid response, an incompetent one, and the difference between the two.

David iterates on how institutions should have relationships with reporters who they trust and like. When these relationships are established, the news can be reported accurately by someone who understands cybersecurity. Additionally, they organization needs someone who understands what information should be public and what shouldn’t, for the safety of everyone involved.

Evolving Controls

David touches on how many institutions need to catch up with the evolving controls. Even not vendor specific systems, like the two-factor authentication, should be standard practice by now. Small, but important practices such as these can mitigate the risk of a large-scale breach.

David states that most large companies still have outdated cyber security systems, as they’ve grown out of their old systems. They need a complete revamp of their methods and technologies. When you have this older system, it forces the security team to tackle an array of low scale attacks as opposed to focusing on more advanced, dangerous threats.

Remediation Event

When a breach occurs, it can reveal an advance that has been infiltrating a system for some time, even for years. When they’ve been in a system for that long, you have to assume that the attacker has affected everything. This warrants a remediation event, in which you have enterprise-wide password resets, new set of controls, and the whole platform is taken off the internet. This occurs all within 48 hours.

Now that many businesses are on the Cloud, David discusses how this process has changed.

When a Breach Ends

David examines how we know when a breach has ended. He believes that it will take 2-4 years for the company to completely return to normal. For the first year, the team must manage the crisis. The second year is spent instrumenting new systems and getting used to them. However,

the memory will last as long as litigation is involved.

The New CISO

Each organization has a different idea of what a CISO is, however David provides a key trait. He states that the new CISO should be able to help enable the business while mitigating risk.

Links:

New CISO Podcast

Gemini Website

Gemini Taps David Damato as its Chief Security Officer

Building a Student-Run SOC to Meet Threats Head-On Dec 10, 2020

Show notes

On today’s episode, Aaron Baillio, the CISO of the University of Oklahoma, joins us to speak about his transition from the Department of Defense to higher education, how he managed merging teams, and how incorporating students into his SOC has benefitted everyone.

The Switch from DOD to Education

Before Aaron worked for the University of Oklahoma, he worked for the Department of Defense for 11 years. He reflects on how the DOD is primarily concerned about keeping secrets, whereas

The higher education space is ultimately about giving away all the secrets. He loves how open the community to exchanging ideas. Listen to the episode to hear more on what he learned in his transition.

Education vs. Commercial

Aaron also discusses the intrinsic values in education: how everything you do is meant to support the student and to help educate and prepare them for life. The DOD, however, is all geared towards supporting the solider. He finds it very satisfying to be among young people.

It’s also important to note that the salary in the education sector is about 12-13% less than commercial area. However, the education will offer free tuition for dependents, like children, and provides a better work-life balance, as they can’t compete with the salary.

Aaron also speaks on the different security perspectives between the Department of Defense and education. Listen to the episode to hear how one field offers very ad hoc or tribal knowledge, whereas the other provides methodical training.

Changes in the Job

When Aaron first began, there was already a CISO, and then 9 months later, the CISO left. He had to learn how to adjust while still adjusting to the job. Then, 4 years later the CISO leaves again but during immense change for the university. Aaron rose to the occasion and moved into the role. His advice during times of change in your institution is to perform at least at the same level, if not better, than before the change. He iterates that you cannot slack.

He learned that he had to let go of some of the technical information, and focus more on management side of the job, as well as learn the multiple layers of politics.

Taking on the Leadership Role

Fortunately, Aaron felt like he was supported by the university during his transition to a new role. He gives advice on what to do if your institution doesn’t support you. He encourages the listeners to get involved with charitable organizations or read books and listen to podcasts on leadership. However, when you’re practicing leadership, you will learn more, so it’s best to join organizations.

Centralization at OU

Campuses were so disorganized and disconnected

But then a years ago, they acquired a new president, who wanted to centralize and consolidate the campuses

Each campus had its own IT department and budget, so he had to oversee how to integrate this with grace and rationality

Biggest hurdle was standardizing the technology

While the faculty are the state employees and working towards tenure, they also act like contractors because they receive grant money and don’t want to conform to a standard way of doing things

Managing people’s feelings was the greatest difficulties

The people who didn’t want this amount of change left the organization

Student Incorporation

Aaron tells the story of a student coming to him and asking to learn cybersecurity. This sparked him to begin teaching a class on the 10 domains. Listen to the episode to hear his story.

He also discusses how the industry wants people to have experience to get any job in cybersecurity, but they can’t get experience without a job. It became clear to Aaron that graduates out of OU were struggling to get jobs because they didn’t and couldn’t have experience at 22 years old—this especially depends on where you live as well.

He speaks on how he thinks the industry got to this point and how every year, hundreds of thousands of cyber positions go unfilled, and not because of lack of talent. He urges CISOs to create more programs and opportunities that feed into the industry.

Aaron started hiring students and incorporating them more in their cybersecurity team to give them that experience. He built a SOC with a student slant two or three years ago, and since then, it’s only been a great experience of refining raw talent and helping place students into jobs after the program. Everyone benefits from this set up: the team gets more help and students get experience and exposure. Aaron believes that many students have the passion, energy, and fire to do well but they need a firm or mentor to help them channel their energy into a productive source. He encourages CISOs to expose the younger generations to the possibilities of this field.

Listen to the episode to hear more on how Aaron accomplished setting up a successful program, how he runs it, and how everyone benefits.

Internship Expectations

Aaron discusses how other industries have interns and expect graduates to have internships. They set up programs to help them with garnering experience during college. However, in the technology sector, we don’t have that expectation but also we don’t set it up for them. Aaron continues his talk on how to set up feeder programs. If your IT department doesn’t have the budget, he offers how else you can expose the younger generations to cybersecurity via free activities, through donations, and through national chapters.

New CISO to Aaron

On reflecting on what the new CISO means to Aaron, he gives three pieces of advice. He believes that every individual must find their unique leadership style, and to be true to their personality. He also iterates it’s important to learn how to adapt, especially letting go of being in the technology and instead focusing on providing guidance. Lastly, he encourages the listener to layer some confidence on top of all of that.

Links:

New CISO Podcast

Aaron Baillio - LinkedIn

The University of Oklahoma

2021 Cybersecurity Trends Nov 26, 2020

Show notes

On today’s special episode of the New CISO podcast, Steve Moore chats with Deneen DeFiore of United Airlines, Colin Anderson of Levi Strauss & Co. and Charlie McNerney of Expedia on what it’s been like as a CISO during the pandemic.

COVID and the Airline Industry

Deneen begins by discussing how she became the CISO for United Airlines right as COVID hit. When the pandemic reached the US, there was a lot of fear that the airline would not make it. Because of this additional stress, Deneen focused in on what the priorities were from a business stand point. She touches on how her team had to juggle the increase of cyber criminals and threat actors, as well as maintaining the business and transition to telework. This amalgamation of challenges made her really assess what’s the most bang for your buck in terms of security – especially when the business is tightening its budget already to survive the pandemic.

In terms of technology, Deneen and her team had to ask themselves what technology will help and protect the business right now and what can they put on hold. The incredible plans they had for the future had to be pushed back and implemented at a later date.

Adjustment for the Airline Industry

Like Deneen, Charlie is in the travel business, and speaks on how the change wasn’t gradual but rather sudden. Expedia had to adjust quickly, which was taxing from a digital and physical perspective. He says they had to focus on the most important questions: how do you take care of the employees as well as the travelers? In addition, how much self-care do you have for your system? Like every other business, Expedia’s initial plans had to go out the window. Then, they had to develop new plans and implement them in an effective manner.

In terms of the future, Charlie points to the new catchphrase: there was a lot of perspiration to shut everything down, but there’s also a lot of aspiration to open up again.

Opportunity in the time of COVID

Colin discusses how, while they experienced a dramatic decline in revenue, Levi’s thought they could innovate and come out of the pandemic better than before. The challenges they have faced have forced creativity and technology to evolve. While revenue is still hurting, they’re investing in the future. This situation has forced them to do 2 years of change in a 6-month period. Overall, he feels these past few months have been challenging but exciting.

Priorities for 2021

Going into 2021, Deneen and her team are focused on safety and less interaction. They are coming up with a system that keeps everyone save by using more online measures, biometrics, and new technologies. Unlike before, they now need to collect more health data, and find themselves with a greater dependency on digitization and automation. Biometrics, for example, is a technology that used to be a nice thing to have, a bonus element. Now, however, it’s a necessity. Listen to the episode to hear more about how they’re streamlining their process and expanding Clear.

Updates during COVID

Colin and his team used lockdown as an opportunity to update software and hardware that they’ve been wanting to but would’ve been too disruptive under normal circumstances. Because of this, they were able to push forward new solutions. Historically, the security budget was focused on enterprise security, with a small portion carved out for product security. Now, that’s flipped. Listen to the episode to hear more about Colin’s perspective.

Colin also discusses the importance of protecting the consumer and protecting the trust between the enterprise and the consumer, especially for a consumer facing business. He also touches on how to maintain trust with the customer, as well as placing yourself in the position of the attacker in order to better combat threats.

Perspective on Risk

Deneen relays how she and her team are altering their view and approach to risk. She believes the industry must move to a dynamic view of security. A security team can’t just check off the boxes and pass a test, they need to be constantly updating and evolving. She also believes that organizations need to do a better job integrating intelligence from all different sources. Listen to the episode to hear more about how she thinks the industry needs to evolve.

Third Party Risk and Increasing Issues

All three guests speak on mitigating third party risks through universal participation and cooperation. Not only do customers have to understand risk, so do the employees. They believe that CISOs need to focus on supply chain to help mitigate third-party risks. Charlie has had partners compromised and because of this, they have had to cut off access to data. He says it’s challenging but the business understands it because the number one priority is to protect the company, employees, and customers.

The issue, as they deliberate, is that every large company has hundreds of thousands of suppliers, which makes them more vulnerable. Each partner has a different risk and different impact to the enterprise. The guests also talk about their worries over API attacks. Deneen points out that they’re not always a detectable kind of issue because the developer only displayed what they need to on the front end, without showing the back-end data. She also emphasizes the backlog of vulnerabilities, as attackers are pivoting to something already out there because its low hanging fruit.

They conclude this segment by pointing out that the solution to increasing risk is talent. They believe that talent solves so many problems. As a leader, your job is to remove the roadblocks so that your team can perform well. Colin feels that you should find incredibly passionate, talented people and should invest in them and support them. Listen to the episode to hear more about the increasing risks the guests believe every CISO should be aware of.

Ownerships of Risk

Charlie iterates the importance of a healthy environment. He believes that risk is not just the security team’s responsibility, but rather trying to relay the message that everyone needs to be involved in the risk profile of the company. Once more people feel like it’s part of their responsibility, the less breeches you’ll have. He tells the story of how a chairman and a security guard practiced safe security protocols.

Employee Retention and the Mission

Deneen speaks on the specifics of the aviation industry—not only the uniqueness of the risk profile but also how it’s impacted the world. She has spent over half her career in the aviation industry and what’s she’s observed over those years and what has been exaggerated since the pandemic is that the people who stayed are the ones who want to push the industry forward and are the ones connected to the mission of helping the world.

Empathy as a Leader

Lastly, Colin touches on how empathy is key to being a leader. He believes that the human element will always be number one. The leader’s number one job is to find talent, curate that talent, and help it grow and improve. he gets so excited when he sees the success of his team and believes that communication skills and the soft skills are really important to getting the job done.

Links:

New CISO Podcast

Colin Anderson

Deneen DeFiore - LinkedIn

Charlie McNerney - LinkedIn

Are Hiring Policies Driving the Cybersecurity Skills Shortage? Nov 12, 2020

Show notes

On today’s episode, Steve Marshall, the CISO of the UK Group for Byte Software, discusses how he moved from biophysics to cyber security, how security impacts business decisions, and why he thinks the hiring process of the industry is overlooking talent for certifications.

Steve’s Journey

Steve originally studied physiology and was on his way to receiving his PhD when the IT world called to him. He ended up not completely his degree to work in IT and become the head of the department, and eventually, move into security across North America and the UK. For the past fifteen years, he’s been in a management position. Listen to the episode to hear more about his journey and how he went from physiology to CISO and CIO.

What is “good”?

Steve thoughtfully questions what a “good” CISO is in this episode. He believes there is no single answer, as each company needs something different. Steve also observes that the industry is moving towards having people of blended skill sets and different backgrounds, and therefore “good” for one organization could mean adequate for another. As technology is changing so quickly, the traditional standards of what a CISO should be, what qualifications they should have and what they should do are rapidly changing.

To Steve, a “good” CISO fulfills the needs of the individual company, as well as challenges that company to do better.

Security and Business

Like many CISOs, Steve initially struggled with talking to boards. He understands that many security people are really passionate about security and care about the business, so when they see the business making decisions that put them at a greater risk, they are bothered. However, Steve believes that they aren’t seeing the whole picture and miss out on the other factors that are driving these decisions.

Reach Across the Aisle

In order to get around this tunnel vision, Steve encourages CISOs to build connections with the movers and shakers of the other teams, so that you can better understand what drives decisions.

Steve goes on to explain why understanding different teams is imperative for business decisions, internal support, and collaboration. He stresses that the key is to listen. For Steve, he attends different meetings across different fields within the company to have a better idea of what each team is working on and what their needs are. Additionally, he tells a humorous story about how listening to the conversations during a smoke break made him well respected in his company. Listen on to hear that story and how connecting with other leaders makes you and the company stronger.

Steve’s Two Roles

Due to the dual nature of his roles, Steve has to sit in many sales meetings, while the typical CISO does not. No matter your role in security, every company is trying to sell a product, and it’s important to understand the sales team so that you can better assist, but also so that your voice is respected and heard when you have something to say.

Who Owns the Risk?

While many CISOs feel they own the risk, as we have discussed many times on this podcast, Steve feels that he doesn’t own the risk. Instead, he feels the business does as it’s the one who succeeds or fails based on the risk itself.

Steve’s perspective is that he’s in charge of understanding the data and making that data clear to the higher ups, but he doesn’t own the data itself. We talk about how you need to have a mature and respectful conversation with the other teams in the business in order to come to a consensus about risk. Listen to the episode to hear of Steve’s perspective and how this view of ownership affects the communication around the risk level, the proper controls the security team needs to put in place, and who signs off on risk decisions.

Reporting

When reporting to the CEO, Steve recommends focusing on the impact of the business, the future of the business, and the overall picture. As other guests have said, Steve encourages CISOs to align their reports with business strategy. The CEO doesn’t care, or has time to hear all the nitty, gritty details—that’s why they hired you.

Steve chooses to focus on security as it relates to the objectives of the business, and what will impact that or support that from an acceleration or goals-based perspective. It’s about speaking the business’s language, and not boring the management with unimportant details they don’t care about. Listen to the episode for more in depth advice on how to effectively communicate security issues with management.

Answering Security Questions

Oftentimes, management teams will reach out and ask CISOs questions about security risks they’ve read in the news. Not all management teams will be as proactive, but you will eventually find yourself in a situation where you have to answer unprompted questions. Steve’s view on this is that the higher up you go, the less time people have, so he suggests answering in a succinct way that explains how the security question relates to them.

Diversity in the Hiring Process

The last topic Steve dives into is the perspective on hiring and talent. He points out that people used to start on the factory floor and work their way up to CEO. However, that doesn’t happen anymore and sometimes as a result, leaders can lack a holistic perspective.

Steve believes there is value in having different backgrounds, even non-technical ones. The hiring attitude of the business sometimes emphasizes the degree so much that it overlooks talent, experience and those who would actually be best for the job. When hiring, it’s important to remember that not everyone has the same access to education and may have more experience as a result. He encourages those in hiring positions to put together the most diverse team possible, those who will challenge your beliefs and look at a problem from a different angle than you would. It’s the only way to push yourself and your team to be better.

Listen to the episode to hear more on Steve’s view of talent, education, and experience, and how those three factors can intersect in different ways in each individual, who may have more to offer than what’s on the paper.

Links:

Exabeam: Website

New CISO Podcast

Steve Marshall - LinkedIn

Translating Your Military Experience of Operationalizing Security into the Private Sector Oct 29, 2020

Show notes

On today’s episode, Jeff Schilling, the CISO for Teleperformance, joins us today to discuss the transition from a security career in the military to the private sector, the importance of relationships, and security in relation to the Cloud.

Transition from the Army to Civilian Life

Jeff recounts his career in CISO, first discussing Teleperformance, which he joined this year. He then dives into the 24 years he spent in the military, which ended with his retirement as a Colonel in 2012 from US Army. Though his army career was very varied, he loved every part of it.

When he left the military, Jeff did a 180 and decided not to work in government, which proved a more difficult path. He learned early on that the threat profile is very different in the civilian sector than it is for the military, as well as how that threat is discussed. One of the hardest parts of the transition is the lack of basic security knowledge or awareness in the civilian sector. In the military, everyone is speaking that language and thinking about security and security operations center. Listen to the episode to hear more about the challenges that Jeff overcame, and the insights learned.

Thorough Examination

One of the other important lessons the Army taught Jeff was diligence. He approaches every potential threat or breach with a thorough process. He believes that while many security officers excel in stopping a crisis in the moment, they forget to step back and assess why that crisis occurred in the first place.

Jeff speaks on how after a breach, many SOCs place the work on the IT team. However, he believes that everyone involved should examine what actually went wrong and make an effort to document the incident correctly. If the incident is documented thoroughly and accurately, then leadership has a better chance of properly understanding what occurred and how to prevent similar breaches in the future

At the end of the day, Jeff says “it’s what you measure, and how you measure it.”

The Importance of Relationships

Jeff next speaks on how he has witnessed many CISOs and CIOs say they will never work for each other. He believes this is the wrong attitude because those are all people that can help close your security gaps and make your job and life easier. He acknowledges that you don’t need to be buddy-buddy, but you do need to have an understanding of how someone else’s goals intersect with your own.

Jeff touches on how this relates to viewing the SOC as a whole. He advocates for a normalization of data across all sector in the risk management. Data needs to be translated into a risk statement that makes sense for that risk officer in order to show the gravity of the situation in a way that is clear and understandable. Listen on to hear more of Jeff’s thoughts on why clear communication and respectful relationships affect security.

Elevated Privileges

One area of security that Jeff points out is currently weak is the protection around elevated privileges. He illuminates how many major breaches have been a result of a security issue with those that have elevated privileges. For example, the lack of a two-factor authentication code for execs because they don’t want the extra step of looking at their phone poses a threat to security that could easily be solved.

The Security Environment in The Cloud

Jeff recounts a funny story in which he wound up speaking at Cloud Security conference as the expert for the Department of Defense, when only a few weeks prior, he had to Google what the cloud was. Listen to the episode to hear how this assuming antic occurred.

In talking more seriously about the Cloud, Jeff asserts that it’s actually easier to defend on the Cloud, as he no longer has to wait for someone to go to a data center and make sure all the right wires are in the right places. Now, he could design strong architecture via the software, with lots of efficiency gains and less overhead. In focusing more on building security around the Cloud, he emphasizes communication and integration between developers and analysts after the initial building of the Cloud software.

On this story, he also reflects on the importance of public speaking. While he does iterate that it is a learned skill, he encourages our listeners to speak at events if asked. He specified to leave room at the end of your speech for Q&A, as that is the most valuable part of the event.

Adversary Behavior in the Cloud

In order to fight against persistent adversaries, Jeff believes you need to have a rapidly changing, healthy environment. Unfortunately, he states that elevated credentials are still weak points in the Cloud environment, in addition to development staff being particularly under threat. Listen to the episode to hear more about the significant changes in security as a result of the Cloud and how to tackle them properly.

Tips for Security in the Cloud

We also expand our discussion to cover specific tips for analysts and developers listening the podcast now. Jeff says that the mindset for the response, containment and eradication is different for the Cloud. Instead of just individually fixing all the infected machines, you’re now looking more for the root cause, which requires a different approach than before.

The New CISO

Jeff believes that the new CISO needs to nurture relationships within his or her team or department, especially if the relationship is particularly adversary. He thinks that building healthy and trusting relationships not only benefits you and those involved, but the effectiveness of the team. He references what he learned in the army: “the jackass policy.” Listen to the episode to hear more about this policy!

Links:

Exabeam: Website

New CISO Podcast

Jeffery Schilling - LinkedIn

Culture Eats…Security for Breakfast Oct 15, 2020

Show notes

On today’s episode, George Finney, the CISO of Southern Methodist University, joins us to discuss how cybersecurity is a team sport that depends on openness and collaboration, and examine how culture can directly impact the likelihood of future breach.

How a Law Degree Helped George

George Finney is an accomplished CISO with a more unique background: he has a JD. While it’s becoming more common for CISOs to get an MBA, it’s rare that they would have a law degree. He attended night law school while working full time, reading thousands of pages of dry legal cases. George reflects on the process and says it helped push him to a new level of work, made him more efficient, and helped him understand the big picture of “why” with cybersecurity.

George says receiving higher education made him more curious and gave him more of a global understanding of the business. While he doesn’t encourage every CISO to apply to law school, he points out how useful it can be to understand security through another lens than just a technological one. Additionally, higher education degrees help CISOs more with employment opportunities.

Advice for 25-year-old George

George reflects on what advice he would give his younger self. He focuses on how your career is a process; he’s worked corporate jobs, startups, and attended law school. He believes that those different experiences can help prepare someone for a leadership position. He tells his younger self to embrace variety and wishes he had pursued more diversity in his career.

He touches on how he’d tell his younger self that cybersecurity is a team sport, which we delve more into later.

The Healthy Leadership Mindset

Traditionally, there is the idea in cybersecurity that the problem is always people-based, or that certain people are to blame. However, this pervasive attitude discredits employees and doesn’t allow them rise to the occasion. George speaks on how leadership needs to include mentorship, and needs to want people to succeed, instead of just waiting for them to fail.

Listen to the episode to hear more about the dangers of writing people off as “dumb” instead of taking the time to help them improve.

The CISO that Cried Wolf

George also discusses how the fear of being poorly perceived can impact security. He gives the example of Robert Ebeling, the engineer who tried to warn NASA about the space shuttle the Challenger. Unfortunately, he was ignored, as he told his management something NASA didn’t want to hear, and as a result, the astronauts died.

We speak on the nuances of trying to navigate the CISO position, as its purpose is to raise alarm when necessary. We talk about how you don’t want to be the CISO that cried wolf every time there is potential for risk. However, you also don’t want to keep quiet out of fear. Listen on to hear what George has to say on this topic.

Well-Aware: Master the Nine Cybersecurity Habits to Protect your Future

Whether you are a technical or non-technical leader, you can benefit from this book through the lessons you learn in his historical and psychological examples

George wrote the book because he wanted to help CISOs bridge the gap in speaking to other leadership positions within the company

Professional development book for CISOs specifically

Focusing on habits and small challenges that can make a huge difference

Potentially adjusting these habits can help prevent attacks

Listen to the episode to hear more on the nine habits and more about George’s book

Leadership in the Time of COVID

George urges team leaders to have extra compassion in this time. People are now in a seven-month long stress period—whether with kids at home or worrying after elderly parents. As a leader, it’s important to understand that your team isn’t going to perform as well as they did last year, and to be empathetic.

Phishing

As a result of COVID, phishing is up, perhaps because they recognize people are vulnerable in this time. George discusses how he sends out phishing emails to staff in order to test what campaigns are more effective than others. In studying psychological data, he discovered that analytical thinking is much higher in the mornings than in the afternoons, and that users are 10x more likely to click on his simulated phishing messages. Listen to the episode to hear how to incorporate this knowledge into training and how to adjust behavior to avoid this.

Culture

We reflect on how company and national culture can have an impact on culture. The company culture of the never-ending workday, i.e. the expectation to answer emails at any time, even late at night, also feeds into phishing.

In certain nations, questioning is more accepted than others. This culture on top of corporate culture can influence the likelihood of a future security breach. If people understand that learning and asking questions is safe, they may be less likely to click on a phishing email.

Cybersecurity and the Culture Audit

Diving further into this topic, George looked at the Glass Door of every company that had a security breach in 2018 and discovered that those with breaches were 3x more likely to have a below average culture score. This was across industries and included both small and large companies. Listen to the episode to hear more about the impact of culture—and diversity—on a company’s success.

The New CISO

George believes that the key to success is building relationships. To him, being smart isn’t enough. As security is everyone’s job, he believes that people are the solution, so it is essential to treat everyone well.

Links:

Exabeam: Website

New CISO Podcast

George Finney - LinkedIn

Well Aware: Master the Nine Cybersecurity Habits to Protect Your Future

Managing Risk While Building Trust in a Post - Breach Environment Oct 01, 2020

Show notes

On today’s episode, Charlie McNerney discusses shared responsibility in cybersecurity, the idea of trust, and how diagnosing a problem before treating it has aided him in his career.

Early Retirement and Intellectual Income

After working 25 years at Microsoft, Charlie retired early. Six months later—after getting a boat and a dog—he found himself bored and seeking, what he calls, an “intellectual income experience.” After a phone call from a friend, Charlie ended up consulting for Expedia Group, and eventually came on as a full-time CISO. Listen to the episode to hear more about what an intellectual income is and what it means to Charlie.

Shared Responsibility

In setting up Expedia to understand what they need in a CISO, Charlie had to encourage them to question if they understood their risk posture now, and who was responsible for risk. He delves into how a company can value risk and actively try to understand it, as the Expedia Group does, but still wonder who certain tasks fall to. Charlie relays how imperative it is to convey that everyone shares the responsibility of risk. We discuss the importance of recognizing how anyone can impact risk and how the security team needs to articulate this to the rest of the company.

Trust in a Company

Charlie also touches on how every company is at risk nowadays to hackers or breaches, as every company is now a tech company. As a result, trust in the company, for the customers, supplies or between the employees is so important. In order to be effective, the security needs the support and trust from the rest of the company, especially from company boards. If boards can value the trust in the company and understand how that impacts finances, then the security can be more effective.

The Medical Model for Security

Charlies believes in following the medical model in his approach to cyber security. What he means by this is to copy the way doctors tackle illness: symptoms, diagnoses, treatment, recovery. If you treat a problem before you diagnose, it leads to malpractice—the same applies to security. When you discover symptoms, you need to put the security risk in terms of their transactions, not in terms of risk. Charlie encourages the CISO to not sensationalize and scare people until you actually know what’s going on.

Building Trust During a Crisis

As we’ve discussed before on this podcast, having a playbook before there’s a crisis is imperative. What Charlie points out is also making sure everyone is aware of the playbook and comprehends it before a breach. His advice for a CISO during a breach: focus on data and not feed into fear. In addition, it’s important to communicate properly with other teams within the company. Liston on to hear what Charlie believes security teams need to convey to other departments in the business.

Competition and Cooperation

Charlie reflects on what advice he would’ve given his younger self. To him, when you’re younger and trying to understand your position in the company, you can get competitive with yourself and others. When you’re in that competitive mindset, you miss out on the cooperative mode. Charlies delves into how focusing on a title can lose relationships that you will need later. He shares his advice for how to be collaborative with others and how to have better emotional intelligence. Listen on to hear more about why cooperation is better than competition in the workspace.

Being a Respectful Leader and Finding Respectful Leadership

In this episode, we converse on how you need to love what you do and how even if you enjoy your job, if you hate your boss, you’ll hate your days. Charlie disagrees with the mentality of living for the weekend. Hear what else he has to say on the significance of work culture.

Legacy in Leadership

Charlie brings up being cogitative of legacy when you are a leader. He challenges our audience to ask themselves if the work they’re doing is something they’re willing to put their name on. He urges people to be intentional about the jobs you take and what you do for those jobs. Listen on to hear more about how legacy can take on many forms and be remembered in different ways.

Mentorship

Charlie dispels the idea that your boss always needs to be your mentor. Instead, he encourages you to search out other mentors and to keep seeking until you find someone who can guide you. He believes that having the right mentor will separate you in your career.

Hiring Process during COVID

Though COVID has disrupted our everyday lives, Charlie iterates that hiring remotely doesn’t need to be difficult. He is still looking for someone with energy and who wants to be at the company. Those young, energetic people are who Charlie wants to build up and help grow. In addition to the hiring process, he discusses how to be an engaged leader when it comes to promotions. He emphasizes specificity and clarity in reviews and feedback. Listen to the episode to hear more on how to change meetings into coachable moments.

The New CISO

Where thinking about the new CISO, Charlie encourages those in cybersecurity to really think about the nature of protection that you can provide to different positions within the company. He believes the new CISO must think of risk in a holistic way. Listen to the episode to hear more on this.

Links:

Exabeam: Website

New CISO Podcast

Charlie McNerney - LinkedIn

Our TOPPODCAST Picks

Follow Us

Stay Connected

Related Podcasts

Links

Stay Connected