The New CISO

Latest Episodes:

Landing a Seat in the C-Suite with Mike Woodson Aug 11, 2022

Show notes

In this episode of The New CISO, Steve is joined by Mike Woodson, Director of Information Security and Privacy at Sonesta International Hotel Corporation, to discuss the risk and rewards of being a CISO.

First starting his career in law enforcement and cybercrime investigation, Mike now applies his police mindset to cyber security leadership. With his varied experiences in mind, he shares how his unique background makes him a well-equipped CISO. Listen to the episode to learn more about getting to the root of a threat, working with global agencies, and why CISOs should be compensated well for their high-risk responsibilities.

Listen to Steve and Dr. Adrian discuss the value of mentorship and the ins and outs of a CISO career:

About Mike (1:46)

Host Steve Moore introduces our guest today, Mike Woodson. Mike reveals how long he’s worked for Sonesta International Hotel Corporation and how he started in the cyber security field.

Mike details his background in law enforcement and teaching, leading him to investigate global cyber crimes and begin his CISO career.

The Cyber Cop (9:09)

Steve presses Mike on how he applies his police investigative skills to the cyber security field.

Mike asks the right questions to understand what he’s dealing with during a threat. He understands that his various skill-sets are a unique asset to the CISO job and help him get to the root of the problem.

The Best Job (12:27)

When asked about his favorite job, Mike shares how much he enjoyed his time working for the Indonesian government. He worked with various global agencies investigating cyber crimes, which allowed him to make a difference and meet impressive people.

Mike’s Advice (14:53)

Mike’s advice to his younger self is not to settle and be adventurous. He did not plan to go to Indonesia or be a CISO, but he took his opportunities and listened to the mentors he had along the way.

Radio Days (18:57)

Mike shares his past as a radio DJ and how it was his first love. Steve also discusses his recent experience as a podcast host.

Interview Tips (22:35)

Steve presses Mike on his perspective on perfecting CISO interviews.

Mike reminds the listeners to be themselves and take the interview as it comes. Ultimately, you have to focus on being dynamic and asking probing questions. You have to “look before you leap.”

Why CISOs Quit (27:53)

Mike shares why some CISOS leave a position. If someone in this role is being treated as an afterthought by higher-ups, it can easily lead to dissatisfaction. For such a high-pressure job with crucial responsibilities, it’s essential to be taken seriously by management and paid appropriately.

Should We Ever Ask The CIO? (29:39)

Steve asks Mike if there are ever times a CISO should ever report to the CIO. To Mike, the answer is no.

The role of the CISO has grown, and if they are the chief executive officer of cyber security, they should have a seat at the table. For the business's survival, the CISO should be trusted based on their expertise.

Do We Need CSOs? (32:46)

Many companies have CISOs and CSOs, which share the same command line. Mike believes some organizations should have both positions, depending on their structure.

Setting The Tone (37:38)

Steve asks Mike how new CISOs can be proactive post-hire.

You'll do well if you focus on building relationships, listening to people, and learning the business. To Mike, a CISO is the person who looks, listens, and leans into his work.

Links mentioned:

Sonesta International Hotel Corporation

Train the Way You Fight, Fight the Way You Train with Dr. Adrian Mayers Jul 28, 2022

Show notes

In this episode of The New CISO, Steve is joined again by Dr. Adrian Mayers, VP and CISO at Premera Blue Cross, to dig deeper into his knowledge of insider threat management and intelligence.

As an experienced CISO, Dr. Adrian understands the difficulties of a cyber security career. With this in mind, he shares the day-to-day obstacles of the profession and what aspiring CISOs can expect from the job. Listen to the episode to learn more about the pressures CISOs face, the psychology of insider threats, and how to work past life's challenges.

Listen to Steve and Dr. Adrian discuss how to get through difficult life hurdles and manage cyber threats:

The “Superhero” CISO (1:44)

Host Steve Moore reintroduces our guest today, Dr. Adrian Mayers. They acknowledge the stress and pressure a CISO may feel to play a superhero role, stopping every cyber threat.

Although no one can prevent every obstacle, Dr. Adrian insists that every CISO must consistently attempt with high motivation to stop every threat that comes your way.

Taking A “Bad” Job (5:26)

Steve presses Dr. Adrian if someone should ever take a “bad” CISO job.

Dr. Adrian brings up that every CISO needs their eyes wide open with every gig, but that early in your career, you may have to take less than ideal positions in exchange for experience.

The Bad Day Factor (9:53)

When asked about his worst day on the job, Dr. Adrian reflects that there is always something you can learn from your most challenging moments.

Insider Threat Management (13:01)

Dr. Adrian shares that his affinity for investigating insider threats first developed from his love of video games. After extensive research on counter-intelligence, he understands that specific triggers in people’s lives can lead to unattended consequences or malicious intent.

Evaluating The Insider Threat (15:35)

Steve questions why an insider psychologically may want to compromise the security of their company.

Dr. Adrian states that every insider who goes against their company has one thing in common: a desire to deviate from the norm. And determining that motivation helps the CISO manage their investigation.

How Far Should The Staff Go (20:46)

Dr. Adrian states that your team needs to understand exactly what their doing before talking to vendors or others. By discussing with your team the boundaries for their current investigation, you can gain additional insights that will put everyone on the right path.

The “Why” For Education (22:31)

Years ago, Dr. Adrian decided to get a doctorate in business administration specializing in international security. He then decided to get additional certificates in the security field. Ultimately, his desire for further education came from his immense curiosity but also was prompted by the grief of losing his daughter.

Defining Quality Intel Programs (28:49)

“Threat intelligence is full-spectrum intelligence,” according to Dr. Adrian. By leveraging the information from your intel program and applying context around it, every security team should be able to determine the motivation for the threat and paint a more holistic picture.

Surprising Information (32:00)

Steve presses Dr. Adrian on the most surprising things he’s learned from his background in threat management.

Dr. Adrian reflects on the amount of data vacuumed from our adversaries. Another shocking piece is the amount of data our allies gather on the U.S. Though, of course, the reasoning for gathering that information varies.

Ph.D. Proud (35:54)

Dr. Adrian always puts his doctorate before his name for several reasons.

As a Black man from Canada living and working in the United States, he realized he would experience more hurdles than others in the field. This put him on the path to being better, and getting his education has always put him in the position to thrive.

Links mentioned:

Premera Blue Cross

Trusting Your Tech to Tackle Human Problems with Dr. Adrian Mayers Jul 14, 2022

Show notes

In this episode of The New CISO, Steve is joined by Dr. Adrian Mayers, VP and CISO at Premera Blue Cross, to discuss what to consider when interviewing for CISO positions and how to trust your tech in the security field.

Since fifth grade, Dr. Adrian Mayers has had a passion for computers. Now a CISO, he shares the role computers play in a security professional’s day-to-day life. Listen to the episode to hear more about Dr. Adrian’s advice for aspiring CISOs, the relationship between human behavior and tech, and his thoughts on the transition to automation.

Listen to Steve and Dr. Adrian discuss how to find the right security team and solve human problems with technology:

Meet Dr. Adrian (1:56)

Host Steve Moore introduces our guest today, Dr. Adrian Mayers, who shares a bit about his life before Premera Blue Cross and his childhood interest in computers.

The Power of Story-telling (5:43)

Dr. Adrian explains his love of narrative-based gaming and how escapism provides relief after difficult work days. He also shares how video games give him strategy ideas he uses in his current role.

The Character of a Leader (8:19)

When asked about his characterization of a leader, Dr. Adrian reflects that a leader is someone who has integrity at their core. He expresses the importance of evaluating who you are and ensuring you bring your values into a leadership position.

Advice For Aspiring CISOS (9:25)

Steve asks Dr. Adrian his advice for those interviewing for CISO positions.

Dr. Adrian shares why you should communicate how security plays into your day-to-day life and ask questions about the team's previous history when tackling security problems. The main thing is to be comfortable with who’s in front of you because you would build relationships with this team if offered the position.

Looking For Your Next Position (16:08)

There are different considerations if you’re courting a government position than evaluating a job at a start-up company. Ultimately, it depends on each security company's process and context when navigating the interview stages.

Solving Human Problems (18:25)

Steve asks Dr. Adrian about his thoughts on tech solving human problems.

Dr. Adrian reminds the listeners not to get so wrapped in the technology that they forget what they’re trying to do: tackle human problems. Ultimately, tech helps CISOs do this work, but focusing on the human elements will keep you centered and effective.

Not Trusting The Tech (21:44)

Dr. Adrian recognizes that many security professionals wonder if they can trust data platforms versus the insights of actual human beings.

He also understands that there is a difference between installing programs and implementing them. Overall, if you take the time to understand the tools, you can see how tech makes effective security decisions regarding human problems.

Defending Automation (26:27)

Steve presses Dr. Adrian on ways to convince security professionals to automate low-level tasks.

Dr. Adrian assures the listeners that these changes are being made daily in the security field. By clarifying to security professionals that they will not be replaced by automation but will have more space for high-level problem-solving, the transition will be easier for teams to accept.

The Definition of Good (29:49)

Dr. Adrian explains that the definition of “good” for security programs stems from people. If security professionals have a sense of purpose to show up every day and learn how to use the tech, then that is the measure of a quality program.

If you build a dialogue with your security team and understand their concerns and issues, they will have a sense of ease when moving in a technological direction.

Final Advice (38:45)

To Dr. Adrian, the most vital thing when interviewing for a CISO position is always to do your homework. If you are clear about your experience and how you can benefit the security team, you will be able to communicate why you are suitable for the role.

Ultimately, you want to show how you are ready to roll up your sleeves and get to work, despite potential difficult days ahead.

Links mentioned:

Premera Blue Cross

Solving Security Puzzles with Kevin DeLange Jun 30, 2022

Show notes

On this episode of The New CISO, Steve is joined by Kevin DeLange, the VP and CISO of IGT, to discuss how Kevin’s love of problem-solving led him to a career in cyber security.

Before joining the information security field, Kevin served in the military and completed a degree in Anthropology. Now a CISO, he reflects on how the skills he developed throughout these experiences brought him to where he is now. Listen to the episode to hear more about Kevin’s career journey, solving puzzles in the workplace, and his advice for those applying for CISO positions.

Listen to Steve and Kevin discuss how to define a problem before solving it and the value of real-world experience:

Meet Kevin (1:30)

Host Steve Moore introduces our guest today, Kevin DeLange, who shares more about IGT, a global leader in casino games, and how long he’s worked there.

Life Before IGT (2:43)

At seventeen, Kevin joined the military and worked on nuclear missiles. He credits this experience as his first foray into the security world.

The Practicality of Anthropology (5:58)

After completing his service, Kevin finished a degree in Anthropology. Kevin explores how this discipline allowed him to solve complex problems, which he has applied to his security career.

A Crooked Path (7:49)

Steve asks Kevin what he means by his “crooked path” into cyber security.

Kevin explains that life is not a straight line and that although he couldn’t predict his career in his youth, he understands that he acquired the right skills along the way.

Generational Differences (9:32)

Although there are college degrees now in the security field, Kevin recognizes that there is no substitute for real-life experience. Kevin then lists the traits he looks for when hiring a security professional, particularly highlighting the value of soft skills.

Working With Senior Management (13:56)

Steve asks Kevin the best ways to present a problem in the workplace and how to stand out to senior management.

Kevin says that you need to tailor your communication to the audience in front of you, whether technical or business groups. It’s also essential to ensure you have advocates outside the company to support you, which comes from building relationships.

CISOS And Their Sales Teams (17:51)

Kevin explains that the company’s goal is to make money and that his job is to ensure that the company is securely making money. Although understandably, security professionals and sales teams may not see eye-to-eye, it is a necessary working relationship with a common goal.

Making A Choice (20:12)

Balancing three full-time jobs, Kevin eventually had to choose what he wanted to pursue. Ultimately, Kevin decided on information security because he finds it exciting and himself well-equipped for its problem-solving component.

Simplifying The Problem (23:28)

The most challenging thing for Kevin is to simplify the problem before trying to solve it, though that is what he strives to do most. Kevin laments that it’s “difficult to prove a negative,” but the more he condenses what he’s communicating to senior management, the more he can get the support he needs.

Let Things Fail (28:12)

You cannot oversee your own work as a CISO, so it’s critical to pass that duty to someone on your security team. Since you cannot do it all, it’s sometimes better to let things fail to move forward.

His Best Advice (35:18)

Steve asks Kevin what his red flags are for people applying for security leadership positions. Kevin provides his main criteria, which is paying attention to the hiring company’s definition of a CISO.

Links mentioned:

IGT

Building The Right Relationships with Den Jones Jun 16, 2022

Show notes

On this episode of The New CISO, Steve is joined by Den Jones, the Chief Security Officer at Banyan Security, to discuss the importance of trustworthy and transparent relationships in the cyber security field.

Before joining the security intelligence industry, Den first worked as a postman walking the streets of his native Scotland and dreamed of becoming a musician. Now a CISO, he shares how to deal with misleading salespeople and create effective data security strategies. Listen to the episode to hear more about Den’s journey, the problems with vendors, and his thoughts on building relationships.

Listen to Steve and Den discuss the importance of building a network and proactive security intelligence:

Meet Den (1:40)

Host Steve Moore introduces our guest today, Den Jones, who shares a bit about his past and how he transitioned from postal work into cyber security.

The Must-Have Gear (3:31)

As a postman obsessed with music, Den saw his buddy's house and a Roland RSP-550 that he was dying to have. Seeing this quality of gear led Den to quit his job to find a more lucrative career path, which eventually brought him into the world of cyber security.

College in the UK (7:03)

Unlike college in the US, where you learn several subjects, Den only took classes focused on IT. Unable to finish his degree, Den reflects on how he had to drop out of school yet was the first out of his peers to get an IT job.

Get IT Started. Get IT Done. (12:18)

Den also discusses his Banyan Security podcast, Get IT Started. Get IT Done. Every episode, Den brings inspirational guests on to share their cyber security journeys and the full cycle of their business endeavors.

The Issue With Vendors (18:23)

Den recognizes that the hype around marketing distracts cyber security professionals from their work and that harassing salespeople can be a considerable frustration. Den explains how it’s better to have a “build relationships, not sell stuff” mentality in addition to ways to build transparent vendor relationships.

Building A Team (27:28)

Steve asks Den why he had the mission to build a strong security intelligence team.

Den explains that much of his motivation came from wanting to solve a major question the cyber security industry had not yet solved: “Was that you who logged in?” With a small team of college grads that Den organized, they built a data security platform that secures users from computer hackers through password protection.

Keeping Data Safe (32:58)

Den understands that executives do not share his interest in users' security and are motivated by staying out of the press, which a preventable security breach could cause. For practitioners, the goal then must be to help their firms maintain a solid reputation but also to find ways to use their work for good.

The Pillars Of The Job (36:35)

Steve presses Den on the ways to push and maintain proactive security intelligence.

Den explains how to determine the core questions that lead to protecting data and the vital importance of having users’ login information. By looking at identities, user devices, and the intelligence behind the users and the device, Den can develop data security strategies.

Tips and Recommendations (42:23)

All service accounts should be predictable because it allows their team to detect when there are deviations from the norm. Den recommends maintaining tight access and monitoring service accounts’ task functions to keep data safe.

What Does It Mean To Be A CISO Leader? (48:40)

To Den, being a CISO means building a solid network of healthy relationships. With the right people around you, you can leverage their wisdom and advice to be a productive leader in the cyber security world.

Links mentioned:

Podcast - Get IT Started. Get IT Done.

Banyan Security

Don’t Be Afraid to Break Things with David Lingenfelter Jun 02, 2022

Show notes

On this episode of The New CISO, Steve is joined by David Lingenfelter, the Vice President of Information Security at Penn National Gaming, to discuss the requirement to constantly learn and evolve in the IT security field.

After falling into his passion for IT, David quickly realized just how far his knowledge could take him if he constantly built upon it. Now after a nearly 30-year-long career in IT, with a focus on computer security, he shares his experiences growing and advancing through his work in the industry. Listen to the episode to hear more about David’s journey, his advice for beginners in the field, and his thoughts on IT management.

Listen to Steve and David discuss knowledge and advancement in security:

Meet David (1:20)

Host Steve Moore introduces our guest today, David Lingenfelter, who shares a bit about his past and how he got his start in cyber security.

The Wild West of IT (4:11)

When David began his career in IT in the early 90s, modern technology like remote access was not standard in work computers. Reflecting on his past, David discusses how he learned to market these new products to average users who didn't understand IT.

Constantly Learning (7:46)

Before beginning his career, David was told, "if you never want to be bored, if you want to constantly be learning, go into Security." As a beginner in the field, he constantly played with new technology and learned defense methods against the ever-evolving security attacks on IT systems.

Make It or Break It (11:44)

The IT security field is demanding new strategies and technologies to combat threats. David stays sharp by constantly theorizing with colleagues, "how can we make this work? And better yet, how can we break it?" He found that by working together to build something or tear it apart, you can learn how different technologies would typically work in the security space.

Go Play - Go Learn (15:12)

Steve asks David for his advice to those who wish to start or evolve in the IT security field. Additionally, they share their thoughts on creating educational lab environments and needing to have the genuine desire to learn and grow in computer security.

Business Management & Security Leadership (19:25)

David is now a VP of a company, which is a significant transition from where he started in IT. He describes the differences that he noticed between being a technical leader and being a business leader. Additionally, he and Steve discuss the new responsibilities that come with the business side of computer security, like product investments, protecting intellectual property, and more.

Mark Your Celebrations (28:50)

How do you celebrate when you receive funding to create technological advancements in computer security? David shares the ways that he demonstrates the value of his product creations to funders.

Operational Mantras (31:36)

David holds monthly meetings with his company's IT team to show them different things that they're doing from a security sprint, different threats coming up, etc. He values communication with his team as one of the ways to connect all operations of his business.

End User Maturity (34:12)

Implementing new security protocols for end users can often be met with resistance. David shares his thoughts on the topic and how to balance focus on implementing security and doing so in a way that has the least impact on end users.

Building Confidence & Asking Questions (38:04)

It is essential for leaders in the workplace to feel confident in their team. Steve asks David to share the one thing a security leader can do to increase their confidence in their team that represents the analytic capability of their organization. David cites the importance of communicating with team members, asking questions, and finding answers.

Investing in Your Security Team with Zane Gittins Apr 14, 2022

Show notes

Episode summary:

On this special episode of The New CISO, Tim Lowe and Katie Hatch sit down with Zane Gittins, IT security manager. The co-founder of Rincon Security, Zane discusses what he’s learned building and managing an IT team. From computer science to consulting, Zane shares the journey of his career, and what has led him to focus on cyber security visibility. Listen to the episode to hear more about Zane’s day-to-day, his news intake, and how he manages his growing team.

Listen to Tim, Katie and Zane discuss security management:

Zane’s Background (1:58)

Zane discusses his background in IT security management and consulting with his company Rincon. A small organization, Zane wears a lot of hats and tackles a variety of issue.

Staffing (3:58)

Zane breaks down the misconception that it’s impossible to find good staff. He believes that if you invest in junior employees, as well as off the right packages, you can put together a great team.

He believes that people who are great communicators perform well in security. Zane sets up “lunch and learns” as a way to meet and bond with people in other areas of the business.

Education (7:01)

One internship can change the course of your career. At least, that’s what happened when Zane took on a security internship in college. Interested in computers from a young age, his education helped focus his path.

Advice to the Younger Self (8:54)

If Zane could change one thing about his journey in security, it would be to meet key members of the business sooner. Through making connections, Zane has learned what their concerns and risks are when it comes to security, and how he can help in those areas.

The Day-to-Day (11:00)

With security visibility as his top priority, Zane focuses on updating the systems and tools of the business, onboarding new people, helping the business move in the direction it desires.

Zane spends several hours a week staying up to date on current trends, utilizing Twitter to identify cybersecurity news. This preparation also helps him give context to family, friends and coworker who hear about security stories in the media.

Managing the Security (16:26)

A high-pressure job, Zane must stay on top of things to prevent threats. In particular, he is concerned about supply chain attacks and any new type of attack we do not yet know exists.

On the other side of the coin, Zane enjoys the technical side of the job. He shares a time where he had to act like a cyber detective while consulting.

Motivating the Team (20:17)

Hunting down false positives every day, all day, can be fatiguing. Zane shares how weekly practice challenges have boosted the confidence and knowledge of his team.

Growing Team (24:07)

Zane chats about the specific skills and tools he and his team have utilized as they’ve grown. As there are a lot of tools to learn, Zane encourages team members to become experts in certain tools and platforms.

Security Threats and People (27:44)

When consulting, Zane is most considered with external threats.

Overall, he believes that everyone has something to bring to this growing industry. When it comes to hiring and training, Zane looks to people with passion. By documenting everything, Zane and his team can better scale and onboard.

24/7 Coverage (32:25)

Zane talks about what it’s like to cover the environments 24/7 and still allow himself and his team to sleep.

Links mentioned:

Rincon Security

Exabeam Podcasts

Cybersecurity Trends and Practices Mar 31, 2022

Show notes

On this special episode of The New CISO, Steve chats once again with Chuck Markarian and Sean Murphy. The CISO for Paccar and BEC U respectively, Chuck and Sean share their insights on the current trends in cybersecurity, as well as delve into their predictions for the field and the changing relationships within it. Listen to the episode to hear more about how the government has influenced cybersecurity, the importance of cyber insurance, and much more.

Listen to Steve, Chuck and Sean discuss cybersecurity trends:

Who are Chuck and Sean? (2:23)

Chuck and Sean explain their current roles at Paccar and BEC U respectively, as well as the backgrounds that led them there.

Political Influence (4:32)

Steve, Chuck, and Sean touch on the increasing presence of politics in cybersecurity. Sean weighs in on how relationships to law enforcement are altering, as well as how perceptions on cybersecurity have evolved and changed.

The Perception of the Hacker (9:57)

As the government becomes more involved, the blame on organizations for being attacked has now shifted to the attacker, rightfully so. No longer are hackers a kid in basement; hackers are real and dangerous threats that need to be stopped. This greater understanding of cyber warfare has better informed the public and organizations of what could truly happen.

Investment and Involvement (14:22)

With this increasing awareness of cybercrimes, boards and executes are more willing to invest in CISOs and their teams. It’s better to invest in preventative tools than to pay a bigger price after an attack. Steve, Chuck, and Sean also discuss what changes when the FBI gets involved and when organizations have to wait to fix problems.

Tabletops (21:30)

When simulating a breech, Chuck and Sean urge any leaders to really mimic the chaos that would naturally happen at that time. Be sure to include executives in this simulation, so they can gain practice and understanding of what will be a stressful situation in the future. In doing so, you’ll also be able to identify who is making what decisions before an event occurs.

Cyber Insurance (24:20)

Cyber insurance is becoming more common. CISOs need to educate themselves on policies and the language of cyber insurance. This brings up other questions such as, should individuals have coverage? Should CISOs and board members? Additionally, insurance forces companies and leadership to define what an incident and breech are. This helps in determining what to report externally.

A Third Party (34:43)

With a third party involved, like vendors, your risk level increases. From there, you need to assess how important that third party is and the level of risk with which you’re comfortable. It is part of the CISO’s job to help navigate those relationships and dynamics, and to make sure the organization is still protected.

The New CISO (45:27)

Before wrapping up, Sean touches on the importance of connecting and having conversations with other CISOs. If listeners have any questions, they can contact him via LinkedIn.

Links:

Exabeam Podcasts

Sean Murphy - LinkedIn

Management Training: Learning How To Manage Managers Mar 10, 2022

Show notes

On this episode of The New CISO podcast, Jeremy Sneeden joins Steve to chat about needing management training to learn how to manage others, advocate for his team, and quantify risks. As someone with a technical background, Jeremy had to learn a whole new set of skills for his managerial role at Allina Health. He talks about how the “focus funnel” approach for his new team helped save time and money, as well as how he removes obstacles so his team can do their job. Now the Director of Operations and Engineering, Jeremy coordinates with other managers to ensure the different organizational groups are up and running. While he excels in his position, he believes in continuing to learn and support others.

Listen to Steve and Jeremy discuss management training:

Jeremy’s Background (1:47)

Jeremy chats about his current position as the Director of Operations and Engineering at Allina Health. Originally a technician, Jeremy still views himself as a security engineer, despite now being in management.

Management Training (6:35)

When asked to be a manager, Jeremy was terrified. He had to learn a new set of skills on his own. He advocates for better training for managers, as well as finding a philosophy that fits your style.

Tools for Your Team (10:30)

A great manager removes obstacles for their team. Jeremy discusses how his job is helping his people do their job, particularly in obtaining the right tools so that they can do so.

Talking Money and Partnerships (14:45)

Oftentimes, Jeremy needs to pitch higher-ups on a new tool or equipment. In order to gain approval, he recommends talking in specific dollars and cents. Additionally, he pairs up with other infrastructure groups who want the same things as he does. Together, they ask for additional money or tools for their teams.

Knowing Your Numbers and Team (19:10)

Know your assets—and their costs. When quantifying security risks, Jeremy had to understand the business better, as well as how important those assets are in dollars and cents.

The Focus Funnel (25:12)

After three years of managing, Jeremy became director. In charge of IT Asset Management, he sat down with his new team to examine their current tasks. If the task could be automated, they started that process. While it took time and upfront money, they saved hours and millions of dollars in the long-term.

Embracing the Fear (34:01)

A great manager pays attention, genuinely cares, take care of their people. They handle tasks that go unnoticed such as dealing with angry customers to advocating for your promotion. Jeremy believes that a great manager is also willing to get uncomfortable—or even scared—in order to grow and do what’s best for the team.

Manger of Managers (40:30)

As someone who manages other managers, Jeremy has learned when to get involved and when to back off. He has adapted to letting go of certain tasks and oversights, with the help of communication.

The CISO in Training (45:44)

Being a CISO-in-training to Jeremy means listening to his mentors, and continuing to learn and take care of his employees.

Links:

Exabeam Podcasts

Managing Your First Zero-Day Attack Dec 23, 2021

Show notes

On today’s episode, we are joined by Chris Wolski, the CISO of Port of Houston. He chats about job hunting, the aftermath of an attack and more.

Becoming a CISO

A returning guest, the last time Chris was on the show, he was unemployed. From being let go to landing his current position, the process took Chris six months. He chats about what that was like and the normal CISO versus the “Rockstar” CISO. Despite his limited experience in maritime, Chris took a chance and was rewarded.

Socializing as a CISO

Via events and even LinkedIn, Chris was able to expand his network. Through his connections, he was able to educate himself well enough in maritime transportation, laws and security to better understand his current job. Overall, Chris encourages you to do your homework on the industry, company and people when job searching.

The First CISO

The first CISO at Port of Houston, Chris has faced unique challenges. In part, he’s had to convince the port why cybersecurity is needed, and how it can impact cargo movement.

Attacks and Risks

Recently, the port had an attack. Having a zero-day used against them, Chris found the experience eye-opening. Thankfully, Chris already had an action plan, as well as a risk metrics to guide him. Within 2 hours, the attack was contained and fully remediated after 10 hours.

The Aftermath of an Attack

Although doubted initially, Chris found himself trusted, despite it being done after an incident. He documented everything and encourages other CISOs to do the same. As a result of his work, he was elevated within the organization and the maritime community. There was no doubt of Chris’s ability and purpose within the organization. Within two hours, the port saw its ROI.

After the incident, they shared what had happened in the hopes of opening up communication. By sharing, Chris can help others avoid what happened to Port Houston.

Getting Help

Due to the severity of the attack, Chris explains why the Coast Guard, FBI and other entities had to offer assistance. While it may be hard to juggle all those organizations, they have access to resources that Chris couldn’t have had otherwise. Again, it came down to reaching out to connections.

Indifferent Insiders

Do you need to have a major incident in order for an entire organization to believe in the role of a CISO? Chris explains how equating cybersecurity to something others already know can help convince them of its importance so they can better understand. With Port Houston, Chris compared cybersecurity to physical security to put everyone at ease.

Nowadays, cybersecurity impacts everyone. Any machinery, manufacturing and more has computer chips in their parts, which makes them susceptible to an attack. It’s important to convey the severity of cybersecurity to others.

The New CISO

To Chris, being a new CISO means doing your homework on your industry, company, and the people around you. Be willing to learn and you’ll find success.

Links:

Chris Wolski - LinkedIn

Maritime Security Talk - YouTube Channel

Exabeam Podcasts

Our TOPPODCAST Picks

Follow Us

Stay Connected

Links mentioned:

Links mentioned:

Related Podcasts

Links

Stay Connected