Adaptability

01:55 Do different age demographics require different management styles?

06:18 Customers’ use of your product can be inventive – prepare to be surprised.

10:25 The security team should never operate in a silo; partner with other departments.

Olivia Rose, CISO of Mailchimp, joins us for another Cyber360+ conversation. She talks about adapting to a new work environment and the challenge of managing different age demographics. 

She shares her experience of discovering a customer’s innovative way to interact with Mailchimp’s platform and suggests that CISOs should always be prepared to be surprised. Olivia believes it is important to educate customers on the security implications of their choices and on how regulation will affect their business. Importantly, security teams should not work in a silo. Olivia argues the best approach is to collaborate with other departments, particularly Legal and Privacy. 

Listen to more about the CISO role and regulation in our podcasts with Lester Godsey and Andrea Bonime-Blanc.

Insuring Cybersecurity

02:43 — You do need a cybersecurity insurance policy, but it is just a backstop not a cure-all.

04:28 — Cybersecurity is a business continuity issue. CISOs need to speak to the C-suite in their own language.

07:51 — Healthcare is a hot topic in cybersecurity. Healthcare providers need to assess the security of their supply chain.

11:03 — When pitching for budget, know your audience. Make them aware of the business implications of a breach.

13:33 — Enterprises without a CISO should consider partnering with an experienced best-in-breed vendor. 

17:49 — Boards have a fiduciary responsibility and they will increasingly be held accountable for cyber breaches.

19:29 — The conduit between enterprises and vendors.

Courtney discusses the concept of cybersecurity insurance as more than just a policy. She agrees that enterprises need cybersecurity insurance policies but cautions that these should be viewed as a last resort, not a catch-all. More important, she believes, is a good proactive strategy. She talks about the struggle for budget and the difficulty of CISO communication with the C-suite and the board. Her advice is that CISOs should speak to executives in language and context they understand.

In covering the hot topic of cybersecurity in hospitals and healthcare, Courtney says providers need to carefully assess the security of their supply chain and be very cautious about what they are indemnifying their partners against. Failure to do so means they’ve “opened up to a Pandora’s box, if you will, in terms of liability.”

Listen to more about healthcare and raising cybersecurity awareness in our podcasts with Taylor Lehmann and Scott Augenbaum.

Chief Scapegoat, Setup, and Sacrifice Officer

02:21— People first – always. We lost that in the 80s and business has suffered as a consequence.

04:15— Trust has been eroded in all areas of society. To regain it in business, we need to show people they come first.

06:29— Outcome-based security services means staying until the job is done.

11:08— Focus on yield – are the products purchased delivering effectiveness and efficiency?  

13:32— AI is a means to an end, but it is going to change jobs.

16:48— If you only focus on your own budget, you’re missing the point.

19:32— CISO = the Chief Scapegoat, Setup, and Sacrifice officer.

Malcolm Harkins, Chief Security and Trust Officer at Cymatic, and Corey White, Chief Executive and Employee Officer at Cyvatar join the podcast. They discuss the importance of a people-first mentality in business with regard to employees as well as customers, even if that slows the business down a little. They address the skills shortage from a yield perspective and suggest enterprises ensure the security products they buy deliver effectiveness and efficiency.

Corey describes providing outcome-based services and staying with your customer until the job is done. Malcolm talks about the critical nature of trust. They both agree that CISOs need to look beyond their own budgets as the effects of security are much broader. The podcast ends on a fact as sad as it is true: CISOs increasing feel their job has turned into the Chief Scapegoat, Setup, and Sacrifice officer.

02:05 — The CISO’s struggle to project positivity in a FUD environment.

04:38 — Make internal conversations partnership-based instead of adversarial.

06:24 — The successful vendor takes a customer-centric view and that means understanding who the CISO is serving.

09:35 — People communicate in different ways. As a CISO, it is crucial to not only listen, but speak to people in their own language.

11:56 — Conversations are two-sided; professionals who can’t accept practical criticism often burn out.

Helen Patton, CISO of Ohio State University, returns to the Cyber360+ podcast to talk about fear, uncertainty and doubt – FUD – in the security industry. She reminds vendors that FUD is not an effective marketing tool because it’s nothing new to CISOs. In fact, Helen points out that the most successful vendors are those with a customer-centric approach because they appear as partners to the business.

In talking about communication, Helen shares how important this is in the CISO role. She discusses the fine balancing act of talking to the business without disenfranchising the security team. She goes on to share her formula for reminding people of security implications without bursting their innovative bubbles; “The trick is,” she says, “learning how to turn your concerns into a productive conversation.”

Listen to more about advice for vendors and the CISO role in our podcasts with Gary Hayslip and Tammy Moskites,

Securing IoT

04:19 — Insider attacks are so hard to defend against because they look legitimate.

07:23 — Securing IoT: It’s not enough to know what devices are on your network, you need to know what they are connected to and what permissions they have.

10:11 — Is IoT security possible, and if so, who is responsible for it – the CIO, the CISO?

13:32 — Unless we can educate the youngest generations on the power they give up for the devices and applications they use, we will continue to have problems around privacy.

18:02 — Regulation and legislation of data security and protection is increasing globally.

Larry Lunetta talks about his career experiences, how they all feed off each other, and how that enables him to learn and then share. 

He discusses insider attacks and explains that they are so hard to defend against simply because they look legitimate from an IT perspective. He describes IoT as a new and challenging space but sees devices as somewhat easier to manage than users because their behavioral modality is constrained.

When talking about what technology means to the younger generations, Larry sees fewer boundaries — particularly geographical ones — to a career in tech but an increasing ignorance of privacy and data. He points out that the generations who are growing up using Facebook and Google “are not cognizant of what privacy is and what they give up.”

Listen to more about IoT, regulation, and privacy in our podcasts with Jake Olcott, Phil Dunkelberger, and Jason Haward-Grau.

Security, Transparency, and Ethics in AI

04:44 — What it means to grow up in a country with an established culture of trust.

09:54  — Transparency doesn’t mean that everything has to be open. It is about creating an environment where stakeholders have the correct information.

17:51 — We must move from establishing the principles of ethics in AI to application.

23:32 — Gender diversity in data science does need addressing, but the area of ethics has already attracted a lot of women.

Meeri Haataja talks about what it means to come from a country with an established culture of trust and how that affects the way Finns are training and implementing AI. She believes transparency in AI is important but that visibility should be determined by need — consumers, for example, will not require the same information as auditors. 

There has been much good work on the principles of ethics in AI, but now, Meeri argues, we need to look at applying those principles. She calls for a pragmatic approach to be headed by industry leaders. Importantly, Meeri would like to see this practical application happen collaboratively as this would help create a unified and citizen-centric approach.

On the subject of gender diversity, Meeri notes that while data science is still male dominated, the field of ethics has attracted a large number of women and wonders if we have realized that tech embraces more capabilities than just engineering. She discusses the challenges of creating a diverse team stating that means more than just gender or race it must include culture, career backgrounds, and experience.

Listen to more about AI, ethics, and privacy in our podcasts with Andrea Bonime-Blanc, Joe Stuntz of Virtru, and Laura Noren of Obsidian.

Kristina Podnar, Digital Policy Consultant, discusses the risks and opportunities brought by digital transformation.

02:00 — Digital natives versus digital immigrants

06:05 — Whose responsibility is it to protect data in third-party apps like Slack?

08:28 — Simple policies and practices can help protect your digital footprint.

10:51 — Vendors have an ethical and moral responsibility to support their customer’s security and privacy officers.

12:44 — Even in very small companies, the buck stops with the officers, they have a responsibility to protect the business.

Kristina joins Ashwin on the Cyber360+ podcast to discuss digital transformation and the two camps it has broadly placed people into — digital natives and digital immigrants. Kristina believes the commonality between the two groups is where we’ll find the opportunity for co-mentorship.  And there is much they can teach other: digital natives want to move fast which is great for fostering creativity but often ignores risk; digital immigrants are a more cautious bunch who factor in privacy and security concerns.

The tools embraced by digital natives, like Slack, bring speed and productivity but also risk to the enterprise. Just who should be responsible for protecting data in third party apps? Kristina argues that the policies and practices used to onboard employees or partners should be extended to the world of these new tools, and that this is the responsibility of the CISO. However she also publicly challenges those third-party vendors to support their customers. And if the vendors aren’t owning responsibility for privacy and security, then the enterprise must, no matter its size. Being small does not excuse you from protecting your assets and your customers.

Global Differences in Privacy and Regulation

Cat Coode, Data Privacy Expert at Binary Tattoo, talks privacy, misperceptions in cybersecurity, and helping smaller companies find their way through the regulatory maze.

06:54     Perception is the biggest problem in recruiting cybersecurity talent. We need to educate people on how many different roles there are in cyber.

09:49     Innovation versus user privacy — there are global differences in approaching privacy.

10:54     We are using outdated privacy acts from the 80s and 90s to govern the digital age. New rules and regulations are needed.

13:11     Global market forces are encouraging regulation — rather than lose customers, partners are falling into compliance.

14:01     A simple seven-step blueprint for smaller companies to embrace regulatory compliance.

16:36     Traditional industries, like the travel industry, are easy targets for hackers — lots of information, little tech capability.

19:21     Every organization needs someone responsible for privacy.

20:10     Privacy by design means this is all easier to implement and maintain.

Cat Coode Interview Transcript

A CISO’s Journey in Healthcare

Taylor talks about his journey through healthcare security, the unique loss of life challenges found there, and his personal motivation.

03:34       Vulnerability is necessary to build trust, and trust is crucial in cybersecurity.

07:12       Data breaches are not inevitable. We can do this right.

10:49       Understand your company’s mission, why employees come to work, and why customers buy your product.

12:01       A security career in healthcare – finding meaning and purpose in every job, every opportunity.

13:59       Applying a DevOps principle to cyber in healthcare: learn how the system works before trying to solve problems.

18:03       Vendors need to learn the industry — and the CISO — they are trying to sell to and show how and where they can help.

Taylor Lehmann Interview Transcript

Data Management

Lester Godsey, CISO/CPO of the City of Mesa, Arizona, talks data management in the context of privacy, security, responsibility, and regulation.

01:20     You need to understand what your data is and treat it as an asset.

04:36     Implementing a data management program is a good thing, but how do you catch up with the data you already own?

06:35     Who should be responsible for managing data: Chief data officer, privacy officer, internal auditor, CISO?

08:52     There are multiple kinds of data and issues related to it. A mature data management program can address them all.

11:21      The responsibility for securing data will depend upon your industry and geographical region.

13:19      Data management policies need to be shared within the organization; that is the responsibility of a Chief Privacy Officer.

Lester Godsey Interview Transcript October 2019