The New CISO

LinkedIn: Steve Katz

Lessons Learned from the “First CISO” Part 1 Sep 03, 2020

Show notes

Early Days of Security at Morgan

Steve first began working in cybersecurity at JPMorgan, then known as Morgan Guarantee. He recounts the attitude towards CISOs in the 1980s, where many people didn’t really have a concept of cyber security or what it looks like. When Steve started, he had to change access rules and work against the resistance to PCs and Apple technology in banks. Listen on to hear his stories and how he overcame skepticism towards cybersecurity.

Building an Active Community

One of the many amazing experiences Steve tells is how all the data security officers from the NY banks would get together every three months. They would spend the morning eating donuts and drinking coffee, but also exchanging contact information, discussing what was going on in the field, and brainstorming together. Before Twitter—or even just internet—the CISOs would connect over breakfast and help each other out. In this episode, Steve recounts how 12 officers from different banks helped him make a deal with a difficult vendor.

A Board Presentation and its Lessons

One of the best, and most valuable stories Steve describes is in the early 80s, when he and his team discovered several PC viruses. When he told his boss, Steve had to stand in front of the Board of Directors with zero prep work and explain what computer viruses were and how they can impact Morgan. In under three minutes, he had acquired $400,000 to implement antivirus techniques. In this episode, he relays the incredible story and the life lessons he learned about communicating with executives and why being transparent is best.

Effective Explanations

Steve puts forth his theory on how most executives view themselves and how this influences the way in which you need to explain cybersecurity matters. He urges CISOs to go through everything carefully and logically, and to rehearse your explanation beforehand. He says your explanation needs to pass the “grandma test” before you speak to an executive. Listen to the episode to discover what he means by this. Steve also illuminates why a lot of security people struggle to explain themselves. He points to who they surround themselves with and how they need to shift their thinking when speaking to leadership.

Unrealistic Expectations and Stress on CISOs

In this episode, we also touch on how studies have shown that CISOs tend to have high levels of substance abuse, divorce, physically poor health all from stress, as we’ve discussed in previous episodes. Steve believes the problem is in how we define what goes with the job. CISOs go in afraid of being fired after a breech, but the industry hasn’t accepted the fact that a breech will happen. Every CISO gets fired at some point, but Steve states that you should get fired for doing the right thing, not the wrong thing. He encourages CISOs to come into the job by being clear about what’s feasible and what’s not. To explain that there’s no perfect cure, but we can reduce risk, and build trust and credibility with the executives. Most of all, don’t make promises you can’t keep. On this topic of the relationship to executives, Steve encourages CISOs to get to know the leadership before there’s a problem or breech, so they know who you are when it happens. Let them know why you’re there and what’s important to them, not to you, by focusing on business risks. Present these risks as you understand them, their impact, and the ways you can potentially mitigate. To help buffer personal stress, he explains why the ultimate risk is on the business itself and not on you, and how who you are isn’t the same as what you do.

What Steve Loves about the Job

While there are many stresses to the job, Steve brings up what he loves most about it. He feels stimulated by the constant challenges and loves the cybersecurity community. Listen to the episode to hear more about why this community means so much to him and why, in his opinion, it’s the best professional community out there.

The New CISO

Lastly for Part 1, we discuss what the new CISO means to Steve. His answer may surprise you. Tune into the episode to find out what that is.

Links:

LinkedIn: Steve Katz

The Benefits of Finding a Security Vendor Who Can Act as a Trusted Advisor Aug 20, 2020

Show notes

Improving the Sales Process

In this episode, we discuss how and why it’s so difficult for a security team leader to discover new trends in technologies in a safe and effective way. Damien points out that it can be challenging to discern who and what to rely on when broaching new systems. Listen to the episode to hear more about how to find the right balance of someone who understands the company and the importance of building a long term, trusted relationship.

Advice for the New Salesperson

One of the first points that Damien brings up is that the best way to increase your sales isn’t always trying to sell everything new. Rather, he encourages the salesperson to focus on building sustainable and genuine relationships with clients, that will then result in introductions to others in the field. We delve into why CISOs tend to shy away from salespeople and what to do about it.

Reaching Executives You Don’t Know

If you are in sales and struggles to cut through the hesitation and cynicism to reach executives you personally don’t know, how can you do your job? Damien suggests several strategies including referrals and what that requires, as well as attending conferences and how to properly go about starting conversations with new people.

Two Types of CISOs

In examining the culture around CISOs, Damien identifies the two personas that frequently crop up and the problems with each. First, there is the traditional CISOs that are aggressive in order to reach the top of that particular environment, and as a result, can have a superiority complex—even towards other CISOs. Unfortunately, these people are hard to change when it comes to sales relationships. Then, there are the steady and calm leaders, who have consistently delivered. However, sometimes they feel overwhelmed and when they get cold sales calls, they can be dismissive.

Damien reminds everyone is human and to give everyone a chance.

Social Hierarchy of CISOs

In this episode, we talk about what good-natured CISOs can fall prey to, and what we mean by a “Hollywood” CISO. Damien identifies real leaders as those who want to learn, but also want to pay it forward through education, experience and introductions. He believes this is what makes a good CISO with a longstanding reputation in the industry.

The Problems with the Award Systems

The idea of “Hollywood” CISOs brings up the point that there are some companies that

have better marketing and PR, and therefore result in the same individuals winning awards. We discuss how unfortunately, this creates a boy’s club, so to speak, that ends up shutting out those of different backgrounds, cultures, experiences. Listen on to hear about the consequences of generating a myopic view of leadership.

Factions in the Industry and Shifting Positions

Particularly in Australia, Damien delves into how the CISO is starting to morph into the CSO and the factions that are forming in the industry. While some people believe the position is all about the tech and data, others believe it incorporates consideration about the work culture and organization. Although there are different theories, one thing remains clear: one person can’t do all the responsibilities anymore. Listen on to discover why this fragmentation occurs and how leadership backgrounds provide different lens through which to view the role of a CISO.

Misaligned Incentive and How Capitalism Affects the Technology

We delve deep into how and why politics and business now seep into technology decisions. Capitalism pushes companies to look for growth from year to year, which incentivizes employees but can also have many negative consequences. We touch on how this effects salespeople and creates a vicious cycle for them, as well as how it breaks down their relationships with CISOs.

As the industry sometimes forces growth, new softwares are rushed through with little time spent on design and testing. We discuss how this rushed process impacts the software itself, the product team, the utilization of the program with potential mistakes.

Damien advocates for not trying to tick a box, but rather seeking out added value for the business.

Remediation

As a result of this rushed software, we touch on the importance of remediation and its business consequences. Damien brings up the prevelance of half-baked installations that remain in the network once abandoned and the importance and cost of cleaning those out.

Offshore Vulnerability

We shift our conversation to focus on how COVID-19 highlights vulnerabilities of organizations with offshore facilities. Companies must decide if they want to pay to bring those services back onshore or relax standards and let people work on sensitive information from home in different countries.

COVID-19’s Effect on Australia and Why a Vaccine isn’t a Simple Fix

As Damien is a part of Deakin University in Australia, he touches on how COVID-19 has greatly affected one of Australia’s top three exports: education. With a travel ban, foreign students can’t come into the country to receive their degrees from universities that are sometimes comprised of 50-70% international students.

With a background in biology and chemistry, Damien also discusses why a vaccine isn’t a magic bullet for normalacy and the unintended consequences of a vaccine. He also talks about how misinformation can be exploited by foreign threats and the question of safety and privacy.

What does the New CISO mean to Damien?

Lastly, Damien answers the question, what does the new CISO mean to him. He asserts an attention to a positive work culture, and the strive towards improved behavior and an inclusive industry.

Links:

Damien Manuel - LinkedIn

Why the “Shiny New Thing” in Cybersecurity Isn’t Necessarily the Best Solution Aug 06, 2020

Show notes

In this episode of the Exabeam Podcast, the host, Steve, and guest Chris Ard, discuss the more human aspects of the CISO role, effective leadership, and how complacency can be a dangerous quality.

Work-Life Balance

The first topic we covered was finding a work-life balance that benefits you and your family. Chris spent twenty years working for Microsoft, traveling all over to companies with major security breaches and helping them control the situation. Although he learned a lot and loved his job, he realized he barely spent any time at home, and when he did, he was always on calls. We discussed how easy it can be to settle into a role that you enjoy, but then end up remaining in your comfort zone. Once Chris acquired a new job did he find himself growing once again and spending more time with his family.

Good Talent, Bad Breaches

Spending two decades assisting different companies, Chris picked up on an interesting discrepancy between the talent and the security breaches. While breaches happen to everyone, some seem completely avoidable or like a mistake. As we talk about, many companies hire talented, intelligent people—and yet these preventable situations occur. Chris weighs in that many times, leadership can influence the strength of the security. If a CISO is willing to accept cookie-cutter systems as oppose to implementing a more holistic approach, their security can suffer.

M&M Model

Chris outlines a great metaphor for the condition of many security measures—the M&M model. The team has built a hard exterior with a soft interior, meaning, once an advisory has breached the initial wall, its free to move about in that environment with no obstacles. Listen on to hear more about how this happens.

Bad Actor Residency

We also speak on how it can sometimes take not just weeks, but sometimes months or even years to detect bad actors. We point to reasons why adversaries can remain in an environment for so long, and how teams or companies can overlook root causes.

CISO’s Ownership of Breaches

In today’s episode, we also pull outward to look at the hiring and firing system of CISOs and how it may not be the most effective system. When there is a breach, the CISO often takes the blame—but so much so that they end up having to leave. The issue with the CISO leaving is that they can never learn where things went wrong for that program and work towards growth. Listen on to hear about the teams Chris has encountered that do not get rid of their CISOs and how this effects their security overall.

Invested Leadership

The extent to which a leader makes an effort with the rest of the team has a surprising impact on how well that team performs. From sitting down with junior analysts, to receiving less filtered information, CISOs can transform how their team handles a crisis just by getting to understand them and their concerns prior to that crisis. Additionally, we touch on the commonality of leadership being pressured to alter assessments to fit certain initiatives.

Marathon or a Sprint?

The intense schedule of any CISO causes us to ask if this job is really a marathon or a sprint. In a way, you have to maintain the energy for daily tasks like a marathon, but in other ways, you burst towards the finish line while trying to stop a crisis. In thinking about the CISO burn out rate, we debate on how more problems can arise if one side is neglected, or if the team communication breaks down, leading to wasted energies. Hear about our different opinions on the matter in this episode.

Pen Testing and Compliance

A great point that Chris brings up is the failures of the pen tests, and how we can improve them. Oftentimes, the pen testing is so restricted that it fails to foster a realistic crisis-situation, leaving the team out to dry when there really is a crisis. As we point out, some companies would rather appear solid now, only later to be proven wrong, than to look weak upfront and solve real issues.

Along with this pen testing is the idea of compliance. We perform the test annually in order to comply with industry standards, but as Chris says, we need more. We need more to motivate us to do well than just compliance—we need meticulousness and hard work.

Continued Education

In this episode, we also discuss the importance of always pushing to be better. Chris highlights that CISOs get good at their day jobs, but they don’t always push themselves to learn better crisis management when an incident does occur. As the landscape is constantly changing, we must change along with it in order to be able to assess new types of threats.

Marketing

While the security does not bring in revenue, they certainly can help prevent revenue loss by allowing the rest of leadership to focus on their goals. That’s why it’s important to explain what the team is doing and why it’s important to the rest of the company.

Culture

When transitioning to a new position, Chris stresses the importance of not just getting to know your team but also other executive leaders. Reaching out to a peer and getting to know him/her facilitates better communication and a. professional relationship overall.

A CISO’s Role in a Board Meeting

Lastly, Chris took us through his journey through board meetings after joining a new company as a CISO. He discusses how much time he was given to present, and how the attitude of the board members towards the significance of cybersecurity shifted overtime.

Additionally, Chris imparts his advice on advancing in your company and learning to enjoy the process.

Links:

Chris Ard - Zoom Info

Newmont Corporation

Making the Leap from Engineering to Cybersecurity Leadership Jul 23, 2020

Show notes

In this episode of The New CISO Podcast, the host, Steve, and guest David Rule of HarbourVest, discuss the skills he learned to transition from engineering to executive management, the evolution of leadership styles, and better ways to prepare for crisis management.

Transition from Engineer to Executive Manager

The first topic we covered was David’s transition from being on the tech side of security, to assuming a CISO position. We discuss how this change may be more challenging than originally anticipated, so in order to focus on developing leadership skills, David suggests entering a management role in a field in which you are familiar. He understood security and coding, and therefore he could spend more of his time learning how to be an effective leader.

Nontechnical Managers

While David’s path benefitted him, we also talked about the growth of more nontechnical leaders in cybersecurity. There are advantages and disadvantages to working under a nontechnical manager. How can you, as the employee, support your boss? Well, David points to the important skill of communication. Learning how to explain complicated concepts to someone who has less specific knowledge than you do proves to be an imperative skill for yourself, your manager, and the team.

While nontechnical managers offer knowledge in other areas such as business or client relations, they have to be careful when it comes to proposals. If the company proposes a specific plan, the nontechnical manager could sometimes miss spotting future issues once s/he delves deeper into the tech itself.

Administrative Rights of the Technical Manager

As a technical manager has specific background in cybersecurity, s/he can be tempted to fiddle with the coding. However, the technical manager must stay away from the daily, more administrative tasks, for several reasons. Listen to the podcast to hear our different points on this subject!

Advice for the Younger Self

Another interesting conversation we had was on the type of advice we would give to our younger selves. David feels he should have been more self-aware, and more willing to accept constructive criticism. To him, feedback is a gift, and you can only improve once you see it as such. In addition to self-awareness, we discussed situational awareness. This skill helps guide you in knowing when to speak and when to listen. Listen on to hear more about how this tool can aid you in meetings and increase your social relations at work.

Client Relations

A key aspect to any management role that other employees do not always have is navigating relationships with clients. David walks us through his approach to speaking with new clients—and it doesn’t begin with the tech. You can hear more about the specifics in this episode.

We also covered mentoring junior staff when it comes to client relations. David points out that meetings with clients helps junior staff members in two ways: you can explain to them what needs to be accomplished in the meeting, and then they can see you do it in person. This real-life experience helps them grow as an employee at a much more rapid rate. From you, they can learn how to deliver difficult news and still maintain grace.

Crisis Management

Another essential topic we spoke on was how to best train your team to manage a crisis in an effective way. David points out an astute observation: that by the time people have reached a leadership role, they haven’t worked through the problem at that level. They find themselves spending time on introductions and acclimating to the situation, which, in a crisis, is the worst time to have to do these things. To resolve this issue, David began an executive tabletop crisis discussion to help teach CISOs and other mangers how to handle a breach in a controlled environment. We also dive into getting ahead of the breach in terms of communication with clients, and how to manage their fears. Listen on to hear more specifics to how he facilitated conversations with not just the cybersecurity team, but the marketing and PR teams, and how to address clients in the face of a crisis.

Different Metrics for Different CISOs

We conversed about how formulating a program is an art, not a science. Every CISO builds a program that incorporates different sets of data. As a result, each CISO measures the success of his/her program via different metrics.

A Good CISO vs. a Great CISO

As different CISOs generate various styles of measuring the success of the program, it can be difficult to determine if your program is excelling. How do you know if you’re a great CISO—or just an average one? We talk about how world events influence the CISO position greatly and what the best CISOs do that separates them from the crowd. This role is a demanding one, and with the support and trust of the team, CISOs can effectively build trust in how their system works.

Links:

HarbourVest Website

David Rule - LinkedIn

Is Our Understanding of who Owns Risk Driving CISOs to the Edge? Jul 09, 2020

Show notes

In this episode of The New CISO Podcast, the host Steve Moore, and guest Gary Hayslip discuss the difficulties veterans face when transitioning to the business world. They also converse on how to remedy security failings, and how risk ownership mentally and physically impacts CISOs.

A Challenging Transition for Military Personnel

After serving in the military for however many years, enlisted personnel receive one class on how to transition to civilian life. While the class teaches how to format resumes, it doesn’t provide the amount of support military need to adjust to a new lifestyle.

When you are in the military, everything is organized and planned out for you, from your day, to your week, to your month, to your year. You always understand what you need to do, and what path to follow.

When that type of strict structure falls away after duty, many veterans feel lost. They enter a new world filled with so much uncertainty. Suddenly, they have nothing planned out—they don’t even know what they’re doing the next hour.

Overcoming Fears

In order to overcome this anxiety, Hayslip stresses that you must begin planning your civilian life while during your tour—and more than just in the last six months of your time. He suggests planning out civilian life as early as two years ahead of time. If you start early, you leave room for any road bumps you may encounter.

Moore and Hayslip recognize that this transition is a period of intense personal and professional growth. Oftentimes, vets can feel helpless, wondering how they will provide for their families. Hayslip suggests that military can rely on what they already know: community and mission.

We discuss on today’s episode what Hayslip means by discovering a new community, one that connects them to a broader purpose and to others. We also talk about finding a new mission, and how this can help transitioning vets find themselves again.

How Non-vet Employers Can Help

As a non-veteran, Moore asks how employers can help their recently hired vet-employees. Hayslip suggests that veterans need to be provided guidance, but also a level of flexibility. Military personnel need to understand how much room they have to move. We deliberate on the nuances of steering vet-employees, and how to communicate the level of risk they are allowed to have.

The AAR Process

In broadening the topic from veterans to cybersecurity companies in general, we discuss the proper and most effective way to process an AAR.

Hayslip emphasizes constant documentation and how AAR needs to be information and solution focused. This includes as much data and documentation as possible.

In addition to data and documentation, Hayslip advocates for providing opinion and experience. If you offer why you made a specific decision based on previous experiences, then the team leader can have a better context to what happened. The leader can focus on why your decision worked one time and not another.

What doesn’t work for AARs

However, we believe that sometimes the process of an AAR becomes muddled.

Hayslip points to when blame enters the equation, the AAR becomes ineffective. If one group is blamed in particular, then no one learns what actually happened. It also leads to people shying away from honesty. Moore highlights how bad leadership uses an AAR as a weapon against the employees, which only breeds mistrust and inefficiency.

Hayslip offers his solutions to combat a toxic environment surrounding an AAR, such as breaking the teams down into small groups and facilitating self-reflection. In this episode, he dives into why this strategy works and how best to remove blame from the situation.

A Mission vs. a Mission Statement

We also touch on what we believe is the difference between a company mission and the sometimes corporate-sounding mission statement.

Hayslip acknowledges that a mission statement is an attempt to get different groups of people focused in the same direction. But does a bland, emotionless statement do the trick? Not always. He points to focusing on purpose—what is the purpose of this company, other than to survive? He challenges businesses to remove the capitalistic goals for a moment and ask themselves what their purpose is. What does their product do for society? As your company evolves, so should your mission statement to reflect that change.

Hayslip also proposes a way to structure mission statements with subsets, such as an action statement. He delves into why multiple statements help clarify the goals of each team, and of the overall company. Listen to the episode to hear the additional statements!

Inclusive Culture

Facilitating a more inclusive work culture in companies and cyber security teams can only benefit everyone involved. Hayslip offers ideas such as a “Lunch and Learn” or visiting other departments in order to grant more visibility to all parts of a company. Listen on to discover how these events helped bridge relationships with other teams, how it relates to the mission statement and what came of inclusivity.

Risk Ownership

Towards the end of the episode, we touch on how the idea of risk ownership impacts CISOs mentally and physically.

Moore and Hayslip ask the question: who owns the risk? Many CISOs feel the responsibility falls solely on their shoulders, leading to a high stress level and burn-out rate. Hayslip jokes that the pressure could give you an ulcer—and it has for some leaders. However, risk is also made up of many things that those leaders cannot control. While the lack of control exasperates the stress for CISOs, it’s also important to understand that if you can’t control everything, then risk is not all on you. As Hayslip says, risk ownership is for the whole company.

The Essential Guide to Cyber Security for SMBs

Lastly, Moore mentions Hayslip’s recent book, The Essential Guide to Cyber Security for SMBs. In his book, he covers how many SMB’s believe they don’t need cyber security because they think they are too small. However, Hayslip puts forth that if you are on the internet, you are a target, especially SMBs. Check out his book to find out why!

Links: