The CISO Diaries

About Nick Werner:

Nick is an application security engineer and penetration tester and he is passionate about mentoring and helping others in the community break into cybersecurity. He has published a hand full of articles that discuss how to get your foot in the door, what skills are necessary for certain security positions, and how to gain those skills.

He is also a huge advocate of networking and reaching out to the right people to make opportunities happen instead of letting it come to you.

Nick is a very kind and passionate individual and you should reach out to him if you ever need help finding the right path or you just want to chat about security in general!

Contact Nick:

LinkedIn: https://www.linkedin.com/in/nick-werner-629122161/

Twitter: https://twitter.com/nicholaswernerr

Blog: https://nicholaswerner.medium.com

Shawn Bowen is the Vice President and Chief Information Security Officer of World Fuel Services, a Fortune 500 energy, commodities, and services company. 

He was formerly the Global Head of IT Security and Compliance (Chief Information Security Officer) for Restaurant Brands International (parent company of Burger King, Popeyes Louisiana Kitchen, and Tim Hortons). In this role, he was responsible for establishing the strategic direction, instituting comprehensive security programs, along with building a thorough data governance program and consumer privacy framework.

He has over 20 years of experience in information technology, primarily in cybersecurity. Previously, he was the first-ever Chief Information Security Officer of the US Marine Corps where he directed the Intelligence, Surveillance, and Reconnaissance Enterprise (MCISRE) Sensitive Compartmented Information (SCI) Cybersecurity Program. For over 23 years, he served as a reservist in the Air Force Cyber Command as a Command Chief Master Sergeant and Senior Enlisted Advisor.

Shawn is a Certified EC-Council Instructor (CEI) for the C|CISO course and is regarded as a highly passionate, transformative, thought leader in IT Security, with a record of leading successful strategies in various environments.

Shawn is passionate about people and educating them on cybersecurity. He 'wants the willing, no matter what your rank is.' "Meaning, find people who are interested in cybersecurity at any level in your organization: your cybersecurity champions. He notes that it’s more important for most of the staff to know a little about cybersecurity than a small percentage of staff know everything about it. It’s with this approach that people will start proactively reaching out to Shawn when they have questions and creating a more open dialogue about security throughout the organization."

He fuels this passion by serving on the Board of Advisors for YL Ventures and cloud security startup, CloudDefense.

Highlights:

0:00 - Introductions & Background

• Installing Windows 95 on his own kickstarted his interests in computers, etc
• 2000s getting "stuck" with an audit and learning about the challenges with security
• Problem solving and the difference between wicked and complex problems
• Curiosity and being satisfied with "never finishing"
• Daily puzzles on a calendar

8:05- Personal Bonding and Sharing Within The Team

• Story: In his 20's focused on the job, personal lives irrelevant, even his personal loss.
• Learned that he is not a robot and learned to address emotions through team meetings - Personal and professional ratings
• Understanding the trends between personal and professional performance to help the team to be real
• Importance of creating a safe place to fail and sharing leadership paths for the next generation leader
• Held up a solved puzzle during a tough meeting
• Recognizing different aspects within the team and partnerships
• EQ prior to Shawn's wife, he looked at personalities based on his assessment and what "value" they had to him.
• Learned to shift expectations from what the team could do for him and move toward how can he help the person achieve goals.

18:50 - What Is Shawn's Vision of Life After CISO?

• The evolution of CIO and CISO
• CISO is where Shawn wants to be
• Shawn sees a future of CISO as Board Members or Advisors
• Retirement plan - Advisory work

27:15 - Avoiding Burnout

• Soccer
• Hobby the last few years, sky diving!
• Managing risk and sky diving
• Finding the right balance between home life and work
• Passion helps keep things in interesting and fun
• Don't fake passion for the job, get away and do something else.
• Reddit comments are...

This week’s guest is persistent and has turned her passion into fuel to fight the good fight and help entry level people break into cybersecurity, while movin’ past the gatekeepers. Naomi Buckwalter, CISSP CISM is the Director of Information Security & IT at Beam Technologies. She has over 20 years' experience in IT and Security and has held roles in Software Engineering, Security Architecture, Security Engineering, and Security Leadership. As a cybersecurity career adviser and mentor for people around the world, her passion is helping people, particularly women, get into cybersecurity. Naomi is the founder and Executive Director of Cybersecurity Gatekeepers Foundation, a nonprofit dedicated to closing the demand gap in cybersecurity hiring and breaking down the gatekeeping mindset in cybersecurity. Naomi has two Masters’ degrees from Villanova University and a Bachelor of Engineering from Stevens Institute of Technology. In her spare time, Naomi plays volleyball and stays active as the mother of two boys.

Guest

Naomi Buckwalter

• LinkedIn: https://www.linkedin.com/in/naomi-buckwalter/ 
• Twitter: https://twitter.com/ineedmorecyber

Highlights:

0:00 - Introductions & Storytelling

• Naomi's "Why" on advocating for Cybersecurity
• Asymmetric skills and defenders: 12.5% of open jobs on LinkedIn are "Entry Level" but half require 5 years experience?
• Executives in enterprise have greater ramifications to society on cyber crime
• Cybercrime needs to be as rare as an airplane crash, not common
• Naomi's Why: To win against cybercrime and live in a better world

6:35 - Think About Where Ransomware Payments Are Going

• When a company pays a ransomware, money is going back for greater crimes
• It's not about data, it's bigger

8:00 - About Cybersecurity Gate Breakers - Non-Profit

• The goal is get talent the opportunity to break past the "gate keepers" of cybersecurity
• Focus is on encouraging hiring organizations to develop talent and stop looking for the "purple unicorn."
• Leaders need to critically look at their influence on the world of cybercrime
• Normalization of cybercrime doesn't need to happen
• We are all interconnected globally, ex. Midwest Police crime scene hack.
• Have the conversation and use democracy, education to help combat and help the community
• Critical thinking and challenging the facts, especially with assumptions on job requirements

15:42 - Give People Chances To Succeed

• Reforming from Gatekeeping to Advocate
• Shout out to Intern-Now Employee - Jessica!
• Give people a chance to blow expectations out of the water
• Be ok with being someone who knows nothing
• Give them the basics and guide them.
• Faking it until you make it is not the best way
• Naomi's mentor at Vanguard
• Train entry levels and give them a path so they don't have to "fake" it at mid-level positions

23:07 - Leadership Conversations & Pathway

• Look for people who have human skills: empathy, influence and persuasion, critical thinking, communication
• Difficult to teach, but great to grow and develop
• Technical skills can be taught, but coaching for the muscle to be trained and prepared
• Business mind and tactical ways of thinking are two different paths and skills

25:50 - Naomi's False Sense of Ego and Getting Fired

• Overcoming the ego and believing the hype on her success
• Getting Fired and bringing

About Chris Morales:

We’re here this week with an AI and threat modeling guru, Chris Morales! He’s Netenrich’s FIRST CISO and Head of Security Strategy overseeing the strategic development, implementation, and market execution of the company’s security solutions and processes. Chris has 20-something years of information security experience, having previously led advisory services and security analytics for Vectra AI – while at Vectra he educated many of the Cloud Security Alliance chapter members on dissecting a Microsoft Office 365 attack. During his career, he has advised and designed incident response and threat management programs for some of the world’s largest enterprises. Chris has held senior roles in cybersecurity engineering, consulting, sales and research at companies such as HyTrust, an Entrust company, NSS Labs, 451 Research, Accuvant (acquired by Blackstone Group), McAfee and IBM. He is also currently a council member with CompTIA Cybersecurity and advisory board member for Saporo.

He not only brings his wicked smart knowledge on cyber; his candor and wit is refreshing. To boot, he’s from the friendship state – Texas, so listen to this podcast – it’s like hearing from a friend!Guest

• Chris Morales
• LinkedIn: https://www.linkedin.com/in/cmatx/  
• Twitter: https://twitter.com/MoralesATX

Highlights:

0:00 - Introductions & About Netenrich

• Netenrich, Ingram Micro and expanding from roots
• Evolving IT & Security specialization
• Moving from consulting to CISO

7:10 - Pathway to CISO

• What's the definition who makes a good CxO?
• Six Types of CISO - Ref: Forrester Article, Jan 2020
• Identifying different types of personalities for industries
• Every company is a tech company

14:26 - Difference: Secure Operations vs. Security Operations

• Question of proactive vs reactive
• Two different focuses - predictive with cultural challenges and buy in
• Enhancing customer experience
• Situational awareness is important with looking at same set of data between groups to communicate daily.

18:16 - Bring Value of "Why Do I Care?"

• Entire management chain needs to care
• Alignment is important with the C-suite
• Look at data, threat modeling to share how and why it impacts key holder
• Chris learned a lot from statistical analysis and appreciation of data

22:48 - How Chris Came To Security

• Started as Computer Science to make video games
• Dropped out of college to launch his own business
• Joined the military
• Listened to his Dad talk about "The Art of War," Sun Tzu
• Spent time hacking to get video games
• Moving positions and being open to job challenges

31:35 - Advice to Future Leaders

• The title doesn't mean anything
• It's more important on what you do
• Have insight and empathy on why people do things, and learn their pain points
• Don't worry about being good at everything. Pick one thing and be good at it
• Hacking is social engineering
• Security breached through end users is a failure of the security team
• Don't be afraid to fail as a leader
• People are the victims, not the problem
• People are suffering from our technology problem

37:25 - How Chris Avoids Burn Out

• The question - How do you get more...

This week we chat with the guy who served as the first CISO for the state of Michigan, Dan Lohrmann in May 2002. Today he serves as Chief Security Officer at Security Mentor, Inc. He has advised senior leaders at the White House, National Governors™ Association (NGA), National Association of State CIOs (NASCIO), U.S. Department of Homeland Security (DHS), federal, state and local government agencies, Fortune 500 companies, small businesses and non-profit institutions. He’s a frequent author for GovTech and other blogs. Tune in to hear Dan’s story of the time he nearly got fired and why his personal favourite is Yorkshire tea!

 Guest

• Dan Lohrmann 
• LinkedIn: https://www.linkedin.com/in/danlohrmann/ 
• Twitter: https://twitter.com/govcso  

Highlights:

0:00 - Intros, Background & The Small Cybersecurity Family

• Cybersecurity is not for the feint of heart, but it's constantly fun and changing
• Y2K and Michigan
• Centralizing IT and creating the CISO role

8:09 - Applying Football to Career

• Siblings impact and influence
• Football is a lot like security
• Hockey analogy - Go to where the puck is going
• Leadership - Cuts across both personal and professional lives

14:45 - Getting "Fired"

• Dan was given a wifi project
• Staff Meeting - Dan and Teri Takai confrontation
• Lesson Learned: Get to YES and bring alternatives to business

22:22 - Importance of Relationships

• Build trust and relationships
• Go to lunch!
• Easy to say, but hard to do
• Have a good baseline and plan to get to goals
• Good leadership, relationships and partnerships are key to leadership success

Final Thoughts:

• The Best is Yet to Come
• Yorkshire Tea is Dan's Favorite!

This episode includes quite the pair – Greg Hatch, CEO, and Dan Ward, CTO, of a new cybersecurity startup focused on Continuous Security Improvement™ (CSI).

As serious as cybersecurity is for everyone and businesses, Greg still finds time to keep a sense of humor and have a positive impact on others. Dan is more than the technical brains behind Saepio’s technology - he’s an avid instructor and mentor to many in the industry.

Greg combines exceptional business and sales acumen with technical competency. He has helped organizations deliver on initiatives, revenue and business outcomes. Prior to building Saepio he was Vice President of Business Development at Managed Security Service Provider, Lightstream Technology. He has also held senior positions at Palo Alto Networks, McAfee, and Cisco. When he’s not busy improving organizations’ cybersecurity posture, you can find him flying over the Pacific Northwest mountains and water. 

Dan has been a leader in the information security industry for some time, having participated in the Black Hat NOC by assisting with the implementation and operation of Palo Alto Networks Firewalls that were utilized to secure the event network and protect attendee registration data. He served as Secretary on the Board of Directors for BSides Denver. Prior to Saep.io he held senior technical roles at Palo Alto Networks and Acxiom. He’s humble, so get to know him to find out his technology inventions that have propelled organizations cybersecurity posture forward. 

Guests:

• Greg Hatch
• LinkedIn: https://www.linkedin.com/in/greg-hatch-3222bb4/
• Twitter: https://twitter.com/saep_io 
• Dan Ward
• LinkedIn: https://www.linkedin.com/in/p0lr/ 
• Twitter: https://twitter.com/saep_io 

Highlights:

0:00 - Intros & Launching Saepio in a Pandemic

• The importance of operationalization for Security
• Saepio mantra: Buy Less and use what you have better.
• "You can have the best tools and still have terrible security."
• How the pandemic affected IT and security

8:22 - Connecting with Clients and Prospects

• Interactions have evolved and people can tell when a vendor makes it about themselves
• Meet people where they are and walk with them to help their organization move forward
• Don't be "that vendor" that goes into vendor "pitch mode."
• Admit that if you don't have the solution, offer a suggestion of someone who can help them
• Follow the money with attacks like Ransomware. Make yourself Ft. Knox
• The importance of Outcome based Security. It's about efficacy

15:22 - Building a Culture of Connection

• Invest time every week to have regular cadence with clients and team
• Many companies are cutting budgets, so stay top of mind and stay in touch
• Continued Security Improvement (CSI™)
• "I wanna hold your hand" - The Beatles
• Don't shake up sales teams when they have a good rapport with clients

20:10 - Tips and Tricks in Working with Introverts

• Don't do the "light" conversations. Focus on meaningful conversations
• Meet folks where they're at and the connections can be stronger

23:10 - Greg and Dan's Cool Hobbies

• Back country flying and the tie ins with security
• Managing your risk profile, knowing...

Les Correia, Global Head of Application Security at The Estée Lauder Companies – Powerful Intriguing Force! 

This week we welcome the worldly Les Correia, who is the Global Head of Application Security at The Estée Lauder Companies Inc. In a previous life he held Senior/Advisory roles providing thought leadership at AT&T, Lucent, INS (now BT Professional services) and many other organizations in the US, Canada, Qatar, Germany, Brazil, and India. During his spare time, he enjoys flying aircraft and exploring New York museums and art galleries. Recently he also contributed to the Purple Book Community led by our friends at ArmorCode. Hear more about why he holds 14+ certifications and his globetrotting experiences.   

Connect with Les:

• Les Correia
• LinkedIn: https://www.linkedin.com/in/les-correia/ 

Highlights:

00:00 - Intros & Application Security

• AppSec is much more than "just development"
• Consider the points of connections, or "point boundaries"
• The hardest component is People and the importance of EQ

7:03 - Cybersecurity Sensationalism

• Watching out for "Hollywood" version vs. reality
• Hackathons and Ideation
• Looking at the bigger, holistic story
• Importance of understanding business in security

12:26 - Les' Career Path and Journey

• Les doing his "own thing" on learning
• How being intellectually curious propelled his path
• Practice what you are thinking and learn from those that came before you
• Piquing curiosity with culture in international travels and benefits of immersion
• Enjoy people!

22:03 - Soft Skills and Embracing People & Cultures

• Taking the time for discipline to LEARN
• How EQ, empathy and culture mix

26:08 - Definition of Qualifications - To Cert or Not To Cert?

• Why Les has so many certifications
• Having diverse backgrounds in search for skills and talent
• The value of thinking outside the box and thinking differently

30:05 - Les Outside the "Office"

• The need for speed!
• The cool folks in the Arts and the way creative people think
• Staycations rule
• Keeping the curious mind curious
• Go Explore!

37:14 - The Purple Book

• The thinking and people who piqued Les' interests for involvement
• Democratizing the concept of software and security in a conversation
• Shout out ArmorCode!

Final Thoughts with Les:

• Stay in touch with people you connect with and appreciate the value of the community we are in

This week we have the pleasure of having Mary N. Chaney, someone who's had one heck of a journey through our industry. Mary is a former Federal Bureau of Investigation (FBI) Special Agent where she investigated cybercrime and served as their Information Systems Security Officer. Currently, she practices cyber law for her own firm, specializing in helping the CIO, CISO and General Counsel understand each other to protect the enterprise. She also founded and runs Minorities in Cybersecurity, Inc., a non-profit focused on support, leadership and career development for women and minorities in cybersecurity. There’s more to her journey, so have a listen! 

Mary's Social Media:

• LinkedIn: https://www.linkedin.com/in/marynchaney/ 
• Twitter: https://twitter.com/marynchaney

Highlights:

0:00 – Intros and Mary’s Background         

• How a bad grade motivated Mary to do better and ultimately go to Law School        
• Take a weakness and turn it into strength         
• Tasking herself to graduate #1 in her law school class

4:45 – Mary’s Career With the FBI        

• Learning how to fight, difficult scenarios        
• Cybercrime Squad in LA - having fun fighting fraud and going on raids        
• Collateral duty as acting CISO for LA Field Office        
• After personal travels, the challenges of entrepreneurship and consulting        
• “It never ends up the way it ends up!”         
• Not all FBI jobs are the same or always in the street or “suit and tie”

10:06 – Where does an International Bad@ss come from? Is it genetic?         

• Krav Magra gives you confidence! Especially for the ladies      
• Confidence gives mental toughness         
• The value of sports, authenticity and importance of having a fighting spirit         
• Mary’s discovery of Ancestry DNA test…and Amazon Warriors?!? ·        
• Importance of working out and building resiliency         
• Dynamics of confidence and other issues between women and men
• Get to know yourself        
• Self-Doubt and Imperfection – What is perfection?         
• Focusing on learning opportunities vs. mistakes         
• Silencing the self-doubt earlier in career

23:00 – Mary’s CISO Journey and Pivoting  

• Life after the entrepreneurial “learning experience”        
• 2012 – Mary’s five year goal to be a CISO·        
• Mary’s experiences with GE Capital·        
• Great transparency from her manager, mentors and building allies·        
• Overcoming the setback after learning dynamics of mentorship and trust      
• Pivoting from the CISO journey        
• How Dak Prescott and getting away from...

The CISO Diaries is focused on the human side of CISO leadership. Not one path is alike and that draws the allure of getting to know those that are keeping businesses and people protected.

This introduction episode is a kick off to get to know hosts, Leah McLean and Syya Yasotornrat. Guests and audiences will experience authenticity, thoughtful conversations, and a bit of fun banter on The CISO Diaries. Formality will be avoided at all costs because, who writes a perfect diary entry? Consider The CISO Diaries exactly like any other diary - moments of happiness, frustration, thoughtfulness, but overall an opportunity to document and share great memories.

About Your Hosts:

LEAH McLEAN, CISSP Expected in 2022

Leah McLean is Vice President, Cybersecurity Specialist at Mastercard. She is focused on implementing strategy and programs to evolve cybersecurity risk management approaches and cybersecurity awareness and training. She actively contributes in community working groups to advance cybersecurity risk management and third-party risk. Leah is also a mentor to candidates breaking into cybersecurity careers, and collaborates with employers to rethink their workforce and hiring strategies.

Leah is a co-founder at Whole Cyber Human Initiative, a non-profit focused on redefining how we identify, train, equip, advance knowledge, and build workforce development within IT and Cybersecurity. She also volunteers for Cyber Future Foundation, a non-profit driving workforce development initiatives and private and public sector collaboration.

Previously Leah held senior level roles as a cybersecurity practitioner at Armor, a cloud security company protecting data for SMB and mid-market customers, Apstra (acquired by Juniper Networks), A10 Networks and Cisco Systems. Leah currently is on the Board of Advisors for Cloud Defense, Inc., a breach visibility cloud security startup and is on the board for the Cloud Security Alliance North Texas Chapter.

Leah holds a bachelor’s degree in Political Science, with an emphasis in International Relations from the University of California, Santa Barbara. She is an active outdoor junkie always chasing adventure.

Leah's Handles:

LinkedIn: https://www.linkedin.com/in/leahrmclean/

Twitter: https://twitter.com/lmclean

WCHI: https://www.wholecyberhumaninitiative.org/

SYYA YASOTORNRAT

Syya hails from a diverse background encompassing technology sales, IT recruitment, sales management, and hospitality. She's run through the gambit of selling and managing diverse sectors and markets, ranging from Fortune 50, SMB, public sector, and channel sales management in excess of $100M quotas. Bottom line, she knows how to hustle.

Syya is a proud alumni of San Francisco State University with a BA in History. She has two wonderful pups, Ellis and Ripley, and can be seen at many a local music venues in the DFW area.

Syya's Handles:

LinkedIn: https://www.linkedin.com/in/syyayasotornrat/

Twitter: @IamSyaso