The Security Collective Podcast

Michelle Price is the CEO of AustCyber, the Australian Cyber Security Growth Network Ltd, part of the Australian Government's Industry Growth Centres Initiative. Michelle has an extensive career and held several Government roles, including the first Senior Adviser for Cyber Security at the National Security College, various strategy and risk management roles including at the Department of the Prime Minister and Cabinet (PM&C), and roles in law enforcement and health portfolios. She has also worked in risk management and strategy in Australia's food industry and also in the advertising industry.

Michelle is passionate about Australia's cyber security sector enabling all Australian organisations to grow and take advantage of the cyber world. She is also a strong advocate for increasing diversity in the cyber security workforce and inspiring people with the possibilities of cyber innovation.

Michelle joins me once again as a guest –this time discussing the intersection of cybersecurity, privacy and safety. How do we build that cross-skill-capability in our staff? We also discuss how cyber in Australia compares to the rest of the world, and how/will organisations accelerate of out this pandemic?

Links:

Website

LinkedIn

Michelle Twitter

Austcyber Twitter

Time stamps:

• 01:16 What has changed in the world of cyber since Michelle was a guest in season 1
• 02:38 The growth of cybersecurity companies in Australia
• 03:39 The intersection between cybersecurity privacy and safety and the capability requirements
• 05:37 "the way that we go about our lives, we need to take…an account of the security, safety and privacy implications of what we're doing, because data is so intermingled"
• 08:59 How do we find people who can look at security through a risk lens & build that skill in our staff?
• 10:48 "it is encouraging those kinds of curiosities and those behaviours that really do question"
• 11:03 Encouraging a culture that is supportive of psychological safety and knowledge
• 13:06 "how we trust that the knowledge sharing is going to be for the overall betterment of those people that have come together, as opposed to one or two of them snatching and running"
• 15:05 When it comes to cyber, how does Australia compare to other countries?
• 16:25 "cyber is a pretty good example…because of the innovation that's required, at the same time as the deep tech…as the go to market, in a very intermingled noisy environment"
• 17:22 How are organisations going to be able to accelerate out of this pandemic into 2021?
• 19:04 "more innovative and agile companies to come in and help them meet teams in particular, who we need to survive in the economy, to be able to regroup and I would say evolve, not pivot"

Stuart Harrison is a passionate and motivated Information Technology Executive with strong business acumen and deep understanding IT services across multiple disciplines. A career spanning two decades primarily focused on the Cyber Security aspect of Information Technology, Stuart's experience ranges from some of the most simplistic systems and management, to some of the most complex, from low level technical engineering through to business leadership.

Stuart is the CISO of Medibank Private and in this episode he shares his story, how his skills evolved as he moved from technical roles to executive roles, and his approach when hiring security teams. "There are so many different facets of security, so many different things you could do".

Links:

• LinkedIn

Time Stamps:

• 00:55 Skills Stuart brought to his CISO role and how he stays current
• 02:56 That pivotal moment of moving from a technical leader to an executive
• 03:30 "It really taught me about how to run the business of technology, not just how to run technical aspects of a technology business"
• 04:45 Succession planning
• 05:56 "Becoming comfortable means you become complacent"
• 07:33 Stuart's approach when hiring
• 08:44 "We've tried to be as consistent, yet adaptable over time with who we're hiring
• 08:55 Medibank's shift and the role security plays
• 11:02 "If you drive to do the basics, and you do them really, really well, you've covered a substantial part of your business risk, not just your security risk"
• 11:45 Stuart's thoughts on the skill shortage in the security sector
• 13:40 "There are so many different facets of security, so many different things that you could do."
• 17:06 Starting a security team from scratch, who do you hire first?
• 21:06 "Making sure that your hiring process is ultimately going to complement the strength of the team in the medium to long term"
• 23:27 What do you wish you had known when you first started as a leader?
• 25:30 "It's not what you're saying, it's how you go about saying it."

David Fairman is a highly experienced professional in the Security & Fraud and has worked for, and consulted to several large financial institutions and Fortune 500 companies, across the UK & EU, North America and APAC. David is a passionate leader in Cyber Security and Financial Crime and has been actively involved in founding several industry alliances and expert groups, holding Board positions, across multiple regions with the aim of making it safer to do business and transact in the digital world.

David has been recognised as one of the Top CISOs to know, is a published author and adjunct professor.

David's current focus is driving collaboration and innovation across the industry to address current and emerging threats prevalent with digital risk and improve the cyber resiliency and literacy in the community.

Being a leader means we need to do more than just look after ourselves and focus on bettering ourselves - what do we do about bettering the country and bettering the community? In this episode David discusses how we can do this, and other tips and steps we can take to be great leaders.

Links:

LinkedIn

Time Stamps:

• 01:03 What shaped David's career journey
• 02:16 "as I progress through my career, I'm learning more things, you get exposed to more things, and you learn to what you like, what you don't like"
• 03:32 Transitioning from the armed services into a corporate world
• 05:10 What do you think plays a big role in how we resource our teams?
• 06:30 "something that I've really enjoyed is exploring people who have a curiosity"
• 07:34 How small and mid-tier businesses can learn from global organisations when it comes to building cyber security functions and teams
• 09:38 " a couple things that they can learn from is how they get those basics right"
• 10:12 Transitioning from a small/mid-tier to a large organisation
• 13:21 Staff retention tips
• 16:35 Stretching and nurturing employees
• 17:21 "your role as a leader is to help coach develop and mentor"
• 19:27 Advice you would give to your younger self
• 20:12 "…that cyber security space, it is tough, it is ambiguous, it changes rapidly. So embrace change, don't get frustrated with change"
• 20:59 When faced with an incident, how slow down critical thinking is best
• 21:51 "let's think for a minute, don't react"
• 21:54 Self-awareness and steps taken
• 23:53 "soft skills like you're never, you're never done with this stuff. You should be challenging yourself to get better every time"

This season I am again recording some solo episodes, and answering the big questions that I hear often when doing consulting work. I'm excited to share some of the experiences I have had during my career in security.

Receiving feedback can help you grow, but it does depend on how it's delivered. I recently received some feedback, which lead me to think about how best to give feedback in the recruitment process. In this episode I share these tips and what I have learnt.

Links:

• LinkedIn

• The Secure CIO

Time Stamps

• 01:32 The value Claire found in feedback she recently received
• 02:36 Providing feedback in the recruitment process
• 03:22 "giving great feedback is to make sure that the people that are in the process are absolutely contenders"
• 03:29 Giving feedback with actionable examples
• 04:45 How feedback is a two way conversation
• 05:08 "Giving them that opportunity for a two way conversation will make them feel heard"
• 05:29 Choosing your words wisely
• 07:17 Recap of feedback tips
• 07:55 "giving feedback that's too general…doesn't necessarily help people today"

Vijay leads UniSuper's Security Program and Strategy including Security Operations, Security Governance, Risk & Compliance, Security Architecture & Design and Identity & Access Management. In his role, he leads a multi-year security roadmap to reduce UniSuper security risk thus protecting UniSuper members.

Vijay has extensive experience in negotiating clear and concise security and technology outcomes in regulatory, policy and outsourcing agreements delivering value creation opportunities. He has large, diverse national and international organisational experience with extensive executive and Board level exposure. Previously he was leading the Information security practise at Transurban, accountable for IT and OT security including accountability for PCIDSS compliance.

Join me as I chat with Vijay as he shares his learnings on why having a great boss, who provides you with the right opportunities, can improve your career progression. We discuss why you should strive to join a company with aligning values, and how to hire differently during a pandemic.

Links:

• Linkedin

Time Stamps

• 01:12 Transitioning from network security leadership to the Head of Information Security
• 02:23 Acquiring soft skills
• 03:42 Advice for transitioning from a technical role to a CISO or Head of Security
• 04:48 "you have to combine your technical skills, with soft skills, with business acumen and strong stakeholder relationship skills."
• 05:11 When your boss provides you with the right opportunities
• 06:27 "you need to show that interest and the passion for it, and then the opportunities will come"
• 08:12 What to consider when joining a new organisation, in regards to strategy, team and op model
• 10:22 "finding a candidate who is a cultural fit for the organisation is far more important and valuable than the most impressive qualifications"
• 11:59 How recruitment differed during the pandemic
• 16:16 "look internally within the organisation, I'm sure there will be people within your organisation that have (a) passion for security"
• 17:17 How to help people make that internal transition to security
• 19:48 What would you say to your 20 year old self about building teams and leading teams?
• 20:16 "tune in to your gut and trust it"
• 20:24 "if you have a passion for something…go in with your full heart"
• 20:39 "your strong network becomes your extended support for future jobs"
• 21:28 "the no word is also very important skill that we need to learn in this role"
• 21:34 "just treat everyone with respect, it pays"

Jinan leads Forrester's security and risk research in Asia Pacific. Jinan's research focuses on enabling the success of the chief information security officer (CISO) role; creating transformational cybersecurity strategies; and building security awareness, behaviour, and culture programs at the heart of a security strategy.

Jinan is a champion for diversity and inclusion in security and brings a local and global perspective and cultural lens to her research and practice. Jinan's research remains pragmatic, as she recently returned to Forrester after several years as director of cyber strategy at Transport for NSW and a similar role with Qantas Airlines.

Jinan has built, stood up, and delivered significant cybertransformation strategies across the public and private sectors. She is an experienced people leader and international keynote speaker, and she's passionate around her purpose in the security field. Jinan holds two bachelor's degrees in science and commerce from the Australian National University.

When Jinan posted a simple question on social media about her research into the toxicity in cybersecurity teams, it exploded! 'We have all experienced toxicity, whether we've been leaders or we've been led'. In this episode Jinan shares how it enabled people to share their experiences, what she learnt and how she hopes to drive positive change in cybersecurity culture.

Links

• Forrester
• Twitter
• LinkedIn
• Email
• Microsoft study mentioned in episode

Time Stamps

• 00:58 What lead the research on toxic culture in security teams
• 02:18 "If you're serious about security, you have to retain talent. And you have to create a positive culture for people to stay in"
• 03:00 What happened with Jinan asked "what are the different causes of toxicity in cyber security specifically?"
• 03:24 "the experiences that people shared, I have to tell you, it was both heartbreaking and enriching"
• 05:03 The number one cause of toxicity in security teams and why
• 06:46 "…what I do like about the top 10 is that I managed to break it down a little bit…"
• 09:33 What if the CISO is causing the toxicity, and not the environment around them?
• 12:29 The future of the CISO - the 6 different types of CISOs and knowing who you are or what you want
• 13:29 "having that self awareness, what is your type? What is your leadership type"
• 14:55 Why a good mindspace can lead to better leadership
• 17:04 "the impact of your behaviour as a leader, how you're managing yourself, how you're managing your team has got huge impact on others"
• 17:53 Tips on turning a toxic culture around to retain employees who may be tired of previous leader habits
• 21:24 Steps to take when interviewing that could help identify a toxic predisposition
• 22:50 "… important to check for cultural fit and trust, versus only technical skills…"
• 23:33 The impact remote working has had on security teams that potentially had a toxic culture
• 28:16 "it's much harder to hide toxic behaviour, (it) comes to the surface a lot easier than it did in an office environment"

Samm MacLeod is an experienced CISO and Information Security Leader with experience across Financial Services, Retail, High Tech, Utilities and the Energy sectors. With more than 20 years' experience in technology risk management, security, and governance, Samm is an accomplished professional holding positions on executive boards relating to critical infrastructure (AEMO Industry Board), and Information Security education and research (Deakin Executive Board).

She has extensive experience developing Information Security Strategies and Operating Models; has built effective award winning security teams (winner 'AISA Cybersecurity Team on the Year', 2019). Having run a number of large Cybersecurity programs, Samm has experience helping business to imbed effective security practices. Samm's subject matter expertise comes from an Honours degree in Technology and a number of Professional certifications. She is an industry advisor in Information Security, Speaker, and advocate for Women in Technology. In this episode Samm and I discuss why it is important to have effective Security Operating Models. We cover how they can be different to an org chart, why it's important to be flexible when creating one, how to measure its effectiveness, and why sometimes outsourcing their creation can be best for your business. Links: LinkedIn Time Stamps:

• 00:47 How do you define security operating models?
• 01:04 "It's the component that will help drive the security team to operational excellence"
• 01:43 Why it's important to anchor your security operating model to a strategy
• 02:56 The risk of thinking a operating model is the same as an org chart
• 04:58 "…so they go hand in hand, but they are different"
• 05:14 What's the minimum you would need in an operating model to make it function against the strategy?
• 07:28 Other than not being effectively implement, what else could make an operating model fail?
• 11:17 "make sure failures are dealt with quickly, because there will always be some"
• 11:23 What to do if you realise the operating model is not working?
• 13:37 How do you measure if an operating model has been successful?
• 15:20 "a good operating model breaks down those barriers"
• 15:54 Why outsourcing the operating model can ensure it's delivered effectively, efficiently and within budget.
• 20:07 "…you've got to weigh up a few of those things and figure out which way is the best way for you"

This season I am again recording some solo episodes, and answering the big questions that I hear often when doing consulting work. I'm excited to share some of the experiences I have had during my career in security.

There are times in the hiring process when you will need to surround yourself with certain people - professionals and peers, that are not involved in the day-to-day security or technology function. Having that help and support will ensure you make the best attempt at finding the right security leader. In this episode, I share tips on who can support and help when recruiting for new security talent.

Links:

• LinkedIn

• The Secure CIO

Time Stamps:

• 00:50 Getting a referral is a great place to start
• 02:22 The key benefits of a referred candidate
• 03:39 Why networking is a winning formula
• 06:04 Choosing the right people to co-interview with
• 07:56 Key takeaway

As a neo-generalist, Laura Staples has navigated multiple domains - across transformation, organisational development and human resources - in a variety of leadership roles. Laura is the Head of People & Performance at Laminex Australia and has spent the last 15 years pushing the boundaries in organisations with an eye on the future, seeking out the best experiences to fuel her knowledge and passion for the future of work. Laura is passionate about untangling complexity - be it people, processes or systems - and uncovering the hidden opportunities to transform ways of working. Naturally curious and at times outspoken, Laura is known for her creative leadership and ability to design innovative and commercially viable solutions which surprise and delight.

In this episode Laura shares how just several months after COVID-19 forced us all into lockdown, Laminex Australia transitioned to a permanent work from home environment. She discusses how they made the change, having to take into consideration their current employees needs, as well as the recruitment and on-boarding of new employees.

Links

• Laminex Australia

Time Stamps

• 00:46 What working from home (WFH) now means for Laminex Australia
• 01:21 "And then suddenly overnight…the world transitioned into the largest work from home experiment"
• 03:11 What Laminex Australia has learnt about virtual recruitment and on-boarding
• 04:29 "We're designing recruitment experiences where the candidate can put themselves in a real life scenario that may occur within the business, so that we can test how they would respond or react"
• 07:34 Ways in which communication has changed at Laminex Australia to support the on-boarding of new staff
• 08:50 "We created an online strategy festival...we broadcast that out to over 200 employees via zoom"
• 12:05 Managing reward and recognition in a workforce that's so dispersed
• 15:34 How Laminex Australia is helping WFH employees switch off once the workday is over
• 17:06 "What's the physical thing that you can switch off at the end of the day, which is the symbolic shift from, I've left the office now and now I'm at home"

Started in 2017 by founder Carl Gough, Meet Magic is a new philanthropic platform that matches Executives with Vendors who want to meet with them. Their mission is to inspire a world of meaningful human connections, that simultaneously empower organisational growth and social change by creating conversations that count.

Carl's background is very humble and colourful being raised with a Jamaican family in Nottingham. Leaving school at 15, home at 16, with no university degrees, he set about trying to survive life. And here we are...

In this episode Carl shares how he started Meet Magic and subsequently partnered with The Starlight Foundation and created Meetings for Good - which has found a way to to bring Executives and Vendors together for curated business discussions, whilst helping sick children at the same time. .

Links

• www.meetmagic.org
• www.meetingforgood.org.au

Time Stamps

• 00:25 Claire's introduction of Carl
• 01:30 How Meetings for Good started
• 05:13 How Meetings for Good works by overcoming the usual vendor/client issues
• 07:09 "The vendors get to see the list of executives who have pledged their time, and they can pick off that list, who they want to go and see"
• 09:16 The executives and leader benefits from being a part of Meetings for Good
• 09:39 "You end up going off and having a great day and being a better person to be around for a start, because you've just done some good"
• 10:00 Why lead to Meetings for Good partnering with The Starlight Foundation
• 12:20 Having targeted Vendor meetings means valuing everyone's time
• 14:24 "They're coming back for more. And they love the outcomes of the meetings"
• 14:59 Carl's goal for Meet Magic
• 18:06 "1000 meetings a month in 10 cities around the world. That's a huge business.…it's making a massive contribution back to society in helping all these different charities"
• 20:41 How you can get involved with Meet Magic and Meetings for Good