The dangers of third-party data breaches have never been more apparent. Everyone is familiar with the problem. Given the interconnectedness of so many organizations, our problems don’t stop with our direct vendors, but our vendors’ vendors and so on. How deep (4th parties or further?) and how often do security audits have to go? And what does this mean for an organization’s incident response strategy?

This week’s episode is hosted by me, David Spark (@dspark), producer of CISO Series and Mike Johnson, CISO, Rivian. Joining us is George Finney, CISO, The University of Texas System and author of Project Zero Trust.

Got feedback? Join the conversation on LinkedIn.

Huge thanks to our sponsor, Vanta

Full Transcript

Intro 

0:00.000

[Voiceover] Best advice I ever got in security. Go!

[George Finney] When I first became a CISO, my CIO described the security team as a black box, meaning no one knew what was going on. And so the keys to success were going to be transparency, communication, and collaboration. 

[Voiceover] It’s time to begin the CISO Series Podcast. 

[David Spark] Welcome to the CISO Series Podcast. My name is David Spark. I’m the producer of the CISO Series. And joining me is my co-host, you know him, you love him. It’s Mike Johnson. He is the CISO over at Rivian. Mike, say hello to the audience. 

[Mike Johnson] Hello, audience. Glad to be with you again. 

[David Spark] He loves being with you. 

[Mike Johnson] I do. 

[David Spark] He’s true to that. 

[Mike Johnson] Yes. I truly mean it. 

[David Spark] Mike, you wouldn’t lie about loving being with the audience, would you? 

[Mike Johnson] I would not. I’m not crossing my fingers. This is my honest face. 

[David Spark] No, he never does that backtalk of when the mic’s off, he goes, “Oh, I never want to talk to that audience again!” That’s not Mike Johnson. 

[Mike Johnson] Nope, not me. Might be David… 

[David Spark] What? 

[Mike Johnson] …but it’s not me.

[David Spark] [Laughter] What?

[Mike Johnson] What? 

[David Spark] Hold it.

[Mike Johnson] What?

[David Spark] Hey. Huh? You know, we’re available at CISOseries.com. Are you familiar with that website, Mike? 

[Mike Johnson] I’ve been there once or twice. 

[David Spark] You should go there often. In fact, I recommend everyone go there at least six times a day. It will actually improve your health. We currently have that being checked out by the ADA, the American Dental Association. 

[Mike Johnson] I think it’ll check out. 

[David Spark] And the FDA. They’re looking at both of these right now. 

[Mike Johnson] Yeah. Seems likely. 

[David Spark] Our sponsor for today’s episode is Vanta – automate compliance, manage risk, improve trust continuously. And Vanta has continuously been a wonderful sponsor, so we love having them on board, and more about them later in the show. All right, Mike, we are just a few weeks into 2025, and actually from the day that we’re recording this, tomorrow, I’m going to be on a show that you’ve been on, and I’ve been on, and is the Daily Tech News Show.

[Mike Johnson] I love that show. 

[David Spark] And I’m specifically on an episode that is going to be about predictions. 

[Mike Johnson] Ah, the Predictions Show. 

[David Spark] Now, here’s something that they are doing that I think is awesome, and A, I never thought of it, and why doesn’t everyone do this with prediction shows is I’m doing prediction, but I’m required to come back next year…

[Mike Johnson] Yes. [Laughter] 

[David Spark] …to see if my prediction actually panned out which…

[Mike Johnson] It makes for a very good show. 

[David Spark] It makes for a very good show, and I love the fact they do it. And I’m like, “Why don’t all of these prediction shows do this?” 

[Mike Johnson] I think it actually holds you a little bit more accountable for making your predictions in the first place.

[David Spark] Yes.

[Mike Johnson] If you know you’re going to have to come back and answer, “What happened?” then maybe you put a little bit more thought into that prediction. 

[David Spark] Now, I threw out a bunch of predictions and one prediction, which by the way, always comes true and I make it every year, is when people say, and I’ve said this before on the show, and I’ll ask you if you agree or you have a different one, people say, “What is the prediction for cybersecurity?” And I say, “You remember what we just had?

Expect more of it.” And I’m always right. 

[Mike Johnson] I think that is one of the safest predictions ever in cybersecurity is that thing that we did plus a little bit more. 

[David Spark] Yeah, plus a little bit. Maybe a lot more. 

[Mike Johnson] Maybe a lot more. Like it’s a bad year if it’s a lot more. Well, we’ll take a little bit more and call that a good year. 

[David Spark] You’ll be safe hedging your bets ahead there. 

[Mike Johnson] Yes. [Laughter] 

[David Spark] But do you have a different prediction for 2025? 

[Mike Johnson] I think that’s actually a very safe prediction is a little bit of Groundhog Day of like, “Well, we’re doing this again? Okay.” 

[David Spark] Yeah. Well, there you go. All right, let’s bring on our guest. I’m so thrilled that our guest is here because we’ve had him on before and I realized, “Oh, my God. It’s been a long time since we’ve had him on,” and he’s great. He is the CISO for the University of Texas System and the author of Project Zero Trust, none other than George Finney.

George, thank you so much for joining us. 

[George Finney] Howdy y’all. Thank you so much for having me. It’s good to be here. 

Surprising research just in! 

4:05.713

[David Spark] “Consumers who believe strongly that corporations are responsible for maintaining data privacy are more inclined to purchase from marketers who are perceived as doing a good job of maintaining data privacy.” This was one of the conclusions from a study by researchers at Marist College.

Privacy is a competitive differentiator, but that flies directly in the face of the goal of the marketing team, which is to gather and track as much data about customers and potential customers as possible. It’s always easier to make the argument to collect more data from your customers. So, I’m going to start with you, Mike.

So, how, as a CISO, can we better make the case for emphasizing privacy and data minimization as good for business and customers? Because that seems like two opposing forces to me. Do you agree or disagree? 

[Mike Johnson] I want to start with a misperception. 

[David Spark] Okay.

[Mike Johnson] I do not think that marketers are trying to collect personal information. They’re not trying to track people. That’s not what they care about. 

[David Spark] But they are trying to collect a lot of data. I mean, go to the Dreamforce conference. You were at Salesforce, you know this. 

[Mike Johnson] The reason why they do that is what they really care about is demographics and market segments. They don’t care what me as an individual do. They care what people like me do. They care about what CISOs do. 

[David Spark] Well, they do want to sell to you individually and tailor as best they can to you. 

[Mike Johnson] I think that is then when you’re moving into the sales cycle, right? So, again, marketers versus sales, two different things. 

[David Spark] Yes. I agree. 

[Mike Johnson] And so I think with that in mind, we should be having those conversations with our marketing teams. We should be sitting down with them, explaining to them the risks of over-collection, especially as there’s more and more regulation about that collection. Understand what they’re trying to do and maybe help explain to them, “Well, hey, you can still accomplish what you’re after if you do it in a different way.” And ultimately, this is what’s best for the business all around.

They want what’s best for the business. We should want what’s best for the business. So, I really encourage to have that conversation with your marketing team, and I think you’ll be able to land in a good place. 

[David Spark] And also, you make a good point. The marketing team can also tell you what data works the best and for how long it works the best. 

[Mike Johnson] Exactly. And I think, again, that is an area where they are experts. We might go in and say, “Oh, gosh, you can’t keep this data for 12 months.” And they’re like, “I only want it for a week. I don’t even want it that long.” And then you have that moment, that “Aha!” moment. 

[David Spark] Right, because they can tell you after a week, where you walked on Monday really is only valuable for the past week. And after that, I don’t need it. 

[Mike Johnson] And then again, it’s usually all aggregated together anyway, and so the individual data doesn’t matter. 

[David Spark] All right. Let’s go to George on this one. What is your tactic here to emphasize privacy as being just as important to business and the customers? 

[George Finney] I love this study because it means that we as consumers expect that that culture of privacy and security has to permeate the whole organization, right? 

[David Spark] Right, good point. 

[George Finney] You can’t just have a great security program. You can’t just have a company that cares about privacy on the backend without that being integrated into your marketing program. So, I think if you’re in marketing, you should listen and collaborate with your CISO and your chief privacy officer.

And I mean, just like Mike was saying, focusing on data minimization, limiting data retention periods, and making sure that’s in alignment with your company’s values, that is what privacy and security are all about. 

Unexpected outcomes, or failures? 

8:04.989

[David Spark] We have limited visibility into what’s going on. The systems they operate on are so old, they’re probably dripping oil, and if/when they fail, the result impacts human lives. Operational technology or OT has historically been difficult to secure because of a mismatch between modern security tools trying to communicate with antiquated physical systems.

Traditional security tools can’t handle the unique protocols used throughout OT. Legacy systems are using dated operating systems and no longer offer support, said Abhishek Kumar Singh of ETEK International Corporation. We’ve heard the story before, but unfortunately, complaining doesn’t improve the issue.

George, I’ll start with you. Where are you actually seeing success managing what seemed to be a perennial mismatch between aging physical devices and the tools we’re using to secure them? 

[George Finney] Well, I’d like to introduce you to this thing, it’s called zero trust.

[David Spark] Ah, this is a man who believes in this. He wrote the book on it. 

[George Finney] I mean, I know a lot of folks that are using zero trust in operational technology environments, right? And it’s super successful in those areas.

[David Spark] Is it like just completely sidestepping this problem? 

[George Finney] When I think of OT, I think of micro-segmentation. I mean, I don’t know if you would describe that as sidestepping the problem or just focusing on the outcomes that you need to be successful. But we had a case several years ago, just segmentation alone isn’t zero trust, right? That’s one tactic within your overall zero trust strategy.

We had an issue where we had an unrouted network that someone fat-fingered a config, and we discovered later that that network was accessible everywhere. So, including in your zero trust program, right, there’s a five-step design methodology that John Kindervag created, including in that visibility and monitoring and testing is also a huge component of that, right?

So, I think you’ve got to have a comprehensive approach when it comes to your zero trust strategy. But I do think it applies whether we’re talking about a regular internet commodity connection and operational technology or even AI. 

[David Spark] Mike, I’m tossing this to you. Is the answer a new zero trust model that kind of doesn’t deal with these classic issues of the mismatch between the antiquated technology and the new tools? 

[Mike Johnson] One thing I’ll start with is OT isn’t as bad as everyone thinks it is all of the time. There are very modern OT environments. George was talking about micro-segmentation, which is a very viable approach. There are, of course, old OT environments as well. And what that means is there’s no one-size-fits-all approach.

There are some times that you can add agents if you need to. There are some times that you can’t go anywhere near it because the network protocol is so fragile that even looking at it funny might cause the thing to fall over. So, it really does come back to what is appropriate for your particular environment.

I do think the micro-segmentation approach is a really sound one because that then does allow you to deal with any number of protocols. The classic approach to OT is, well, you just build a big wall around it and then everything’s fine. And that might’ve worked way back in the day, but you’ve got two problems.

I guess three with George’s example of it should be unroutable, and then all of a sudden it isn’t. You’ve got the problem that these systems, once you’re in that environment, they can’t protect themselves. And so if it’s one big environment, crunchy on the outside generally means chewy on the inside.

Another problem that you have is in modern OT, data needs to come in and out of those environments. They can’t actually be the islands that they used to be. And quite often that data needs to flow in real time. It can’t be the batch uploads that we used to do. And that does mean you need to come up with a segmentation approach that works, that is manageable, that is scalable, that is agile because factories change over time.

That’s my experience with OT is, in a factory environment, that there are changes. There’s new systems coming in, there’s new lines being built, and that does mean you need to have some agility as well with all this. 

Sponsor – Vanta 

12:54.584

[David Spark] Before we go on any further, I do want to talk about our absolutely spectacular sponsor and that would be Vanta. So, let me ask you a question. Do you know the status of your compliance controls right now? I mean like right now, this very moment. We know that real-time visibility is critical for security, but when it comes to our GRC programs, the traditional thing is we just rely on point in time checks and geez, that could be once a year.

But get this. More than 8,000 companies like Atlassian and Quora have continuous visibility into their controls with Vanta. Here’s the gist. Vanta brings automation to evidence collection across 30 frameworks like SOC 2 and ISO 27001. They also centralize key workflows like policies, access reviews, and reporting, and helps you get security questionnaires done five times faster with AI.

Now that’s a new way to GRC. You can learn more if you go to the website over at Vanta. And actually, go to our little custom page there. That’s vanta.com/CISO. Go check it out and see how you can be more efficient with your GRC. 

It’s time to play “What’s Worse?” 

14:13.528

[David Spark] All right. It is time to play “What’s Worse?” I know you know how to play this, George, because you’ve played it before. Just reminding you, Mike will answer first, and then you will then answer. And Mike, this comes from a person who I’m saying is Anonymous. I know who it is, but to you and George and to the rest of the audience, this person is Anonymous, all right?

[Mike Johnson] Okay.

[David Spark] Here’s your situation. You’ve fully implemented RBAC, role-based access control mechanisms across all core platforms in your organization. You just discovered though, however, that two months ago, a massive breach resulted in the theft of valid log-in credentials for 50 random users across the organization.

Okay? Now, the other option is you’ve fully implemented MFA, multi-factor authentication, across all your core platforms in your organization. However, you just discovered that two months ago, a massive but honest misconfiguration granted 50 random users admin privileges across all your systems. So, what has happened is you had a massive breach resulted in 50 valid log-ins of random users, or the MFA resulted in 50 random users having admin privileges.

What’s worse? 

[Mike Johnson] So, what we’ve got here is an authentication versus authorization challenge, right? So, in the first case, your authorization is in good place, but your authentication has challenges. And I’m going to assume that this is single factor, otherwise…

[David Spark] In the first one, yes, because then it wouldn’t make any sense. Yes.

[Mike Johnson] Otherwise it’d be very easy. The second one, what you’ve got is your authentication is strong, but your authorization has issues. Granted, you essentially gave some number of people access to everything. And that’s how I’m reading it. 

[David Spark] Mm-hmm.

[Mike Johnson] And what I would say, again, as usual, both suck. In the first case, you have this potential of outsiders getting access, that they can get into the environment. Maybe they have limited access, but you don’t know because you don’t know which accounts that they got access to. So, there could be some roles associated with some of those 50 people that have deep access just because that’s what their role is.

[David Spark] So, it’s possible, here’s the thing, it’s possible one of the 50 has admin access. It’s also possible none of them do. 

[Mike Johnson] Yeah, it’s possible that all of them…

[David Spark] But it was clearly a theft. 

[Mike Johnson] Yes. And in the second case, what you have is only internal people have access. 

[David Spark] Right. There’s no visible theft, but people who shouldn’t have admin privileges, a lot of them now have it. 

[Mike Johnson] Yep.

[David Spark] Which makes things very scary. 

[Mike Johnson] Oh. Both of these are scary. 

[David Spark] I know, but I’m just saying the other one, where the no theft, at least there’s no theft in the other one, but it is a very, very scary situation. 

[Mike Johnson] What I like is you try and guide me down a path, David.

[David Spark] I’m not guiding. I’m just saying because if I see you go in one direction, I’m trying to push you in the other. [Laughter] 

[Mike Johnson] I know. You always try and pull me back in the other direction, and so I try to make it very clear what direction I’m not going. So, the way that I think about this is that external access, that is the worst. Where you have that potential that somebody outside of your organization, you don’t know who, is going to have access to some amount of data.

[David Spark] You always go more with the known. 

[Mike Johnson] I think that’s probably what we should be doing in our careers. 

[David Spark] Right, but the thing is it’s known hack 50 random, where unknown, who knows? But 50 people randomly have admin. Yikes! Am I now really exposed, but maybe not? They’re both maybe not. These both could be a big nothing too. 

[Mike Johnson] They could be, in which case they’re not bad. 

[David Spark] [Laughter] Exactly. 

[Mike Johnson] And this whole game doesn’t really go anywhere. 

[David Spark] Exactly.

[Mike Johnson] But no, comparing these two, that potential and likelihood of external access, that one feels like the worst between the two for me. 

[David Spark] Okay. I am throwing this. You heard our endless debate here, George. Where do you land? Do you think the first one with the RBAC situation with it was breached, but 50 random users, we don’t know what access they have, or the MFA situation where that’s in place, but misconfiguration gave 50 random users admin access, which makes you very, very vulnerable?

Hold on, I’m going to also push here. Mr. Zero Trust here that we have on isn’t going to like that second one. 

[George Finney] I don’t like either of them. And the reality is, I mean, it’s like straight off the headlines. I mean, both of these options are a reality at all organizations, like all the time. And I know you hate it when we agree with Mike. 

[David Spark] I don’t hate it, I just like to create controversy. 

[Laughter] 

[George Finney] No, I mean, again, I think you can do something about cleaning up an internal admin, right? That is something that people are going through in their zero trust journeys because you give away too many admin rights, and you shouldn’t have that many. I mean, but also, yeah, we’re fighting the same credential-stuffing attacks every day.

So, I’m going to go with the external access. That really is something that I would prioritize in my zero trust. 

[David Spark] Well, you mean the fact that you’ve already had the breach in the 50 or… Yeah. 

[George Finney] Yeah, exactly. If I’m doing zero trust, I want to focus on the highest priority risks and that definitely is top of mind. 

[David Spark] All right, so we have agreement here. As much as I tried to push one of you the other way. 

[Mike Johnson] Yeah. You tried. And I appreciate that you always give it that solid effort. 

[David Spark] I do. I do give a solid effort. I want our audience to argue why you’re both wrong. 

[Mike Johnson] Great, let’s hear it. 

[David Spark] [Laughter] 

I tell ya, CISOs get no respect. 

20:30.533

[David Spark] “Backups are worthless. Restores are priceless,” said Leon Adato on his blog, quoting his friend Tom LaRock of Blackline. Organizations don’t want cybersecurity. They want what it enables – resilience and loss prevention. He also makes the case that cybersecurity isn’t the only way to get those two outcomes, pointing to things like built-in redundancy to cyber liability insurance.

This also gets compounded by the complexity of showing cybersecurity ROI to the rest of the business. It makes it hard to speak the language of the business when you can’t show what people are getting with your budget. So, Mike, do you agree with this? Where do we need to have a more restore rather than backup discussion?

It would get really old having to restore every day. 

[Mike Johnson] It would get really old having to restore every day. 

[David Spark] Well, I don’t think we’re arguing that for that.

[Mike Johnson] We’re not, but again, it’s a provocative statement intentionally, and the reason why I say that is ultimately, security is about risk management. It’s just like disaster recovery, availability, resilience. Building a system that is all the way up, 100% uptime, is extremely expensive. So, businesses are making decisions along the way to say, “You know what?

Five nines is good enough, four nines is good enough, two nines is good enough.” All of those are risk management, just like making the discussions around what are we doing for our cybersecurity controls. 

And so where I really think we have the problem in talking with the business is there are people within our industry who are absolutists. This idea that security must be perfect or it’s crap. And that’s where we have the challenge of actually having the nuanced discussion around what we should be doing.

So, I think it really is start with don’t be a blocker, we always talk about that on the show, but have these conversations about trade-offs. Just like your company’s lawyers are having, just like finance people are having, just like any other G&A function is having. And that’s how you talk with the business.

All of these teams have that similar struggle, and if the business is used to having those discussions with their lawyers, with their finance team, they’re going to really be open to having the conversation with the security team, if you’re approaching it with that mindset. 

[David Spark] All right, good answer. All right. Now I just want to go back to the “backups are worthless, restores are priceless.” We just recorded an episode about just the history of backups. It’s sad how they never sort of work out the way you hope them to work out. So, I think that’s where we’re leaning into right now.

How does a discussion though become more about restores and not backups, if that’s what should happen, George? 

[George Finney] I think, like Mike said, there needs to be a nuanced conversation. And I think when people think about IT and backups, right, they just assume, “Oh, the backup’s going to work, it’s great.” They don’t realize backups get corrupted. They don’t think about, hey, we got ransomware, and we’re backed up to the cloud, but we only have a 64K connection to download, and we’re trying to restore a thousand computers and it’s going to take a month.

So, I think it’s really about that education component that IT isn’t just always going to work and that there is still nuance to that. 

But the difference is what we’re talking about in security, it’s a misnomer. When I see return on investment, when the business thinks about risk, they think about risk versus reward, right? You can’t make money without taking risks. With cyber, we’re not talking about risk, we’re talking about danger, right?

With ransomware, we’re talking about an existential threat to your organization, that you could be down for months potentially. And I think having that conversation outside of ROI, look, there are some things we have to do as table stakes. It is really important to emphasize because we’re breaking out of that, we’re having this nuanced conversation, but also we’re recognizing we have to stay in business.

It’s time to measure the risk. 

25:02.636

[David Spark] When we think about the third-party services our organization depends on, and then all the vendors and services those third parties depend on, it can seem like proverbial turtles all the way down. But Philip Addison of The Hershey Company wondered how far down the stack of turtles do you need to go when thinking about triggering your own incident response plan.

Increasingly common third-party breaches certainly qualify, but what about fourth-party breaches? Is there any amount of due diligence that can give you visibility that far down and also make you feel okay? So, how do you keep tabs on fourth parties, if you can at all? And I’ll start with you, George, on this.

And how do you know if a random incident that just happened that you read about in the news could actually affect you? 

[George Finney] We subscribe to some of those third-party cybersecurity scoring companies, and they have implemented some limited ability to kind of see into your third party’s fourth-party risk. But again, is it something that every organization can chase? I don’t think so. It comes back down to systemic risk.

And going back to the earlier conversation, there is a nuanced conversation that you have to have with your business partners to, I think, provide those insights back to them to help enable them to make better decisions and talk about… There was the Change Healthcare breach that happened. It was a single point of failure, really, for most of the industry.

And nobody recognized that systemic risk that, hey, what’s it going to take for us to fail over? And we’re still seeing the impact almost a year later. So, I think we have to do better with our partners and bring them into the conversation, as well as help educating our business partners about how we see those partners and who they’re relying on.

So, software bill of materials, all of those things are going to, I think, help us continue to improve, but we’ve got a long way to go. 

[David Spark] All right, Mike, I throw this to you. What’s your take on this? In that this seems like such an endless problem. So, do you ever foresee a point where you can say, “All right, I got my arms around this”? 

[Mike Johnson] So, I want to start with contrasting it with the previous topic. We were discussing how we’re enabling the business and adding value. This one is about things outside of our control. Fourth-party risk, there’s nothing I can really do about that. What I need to do is control what I can.

I go to my vendors, my partners, and understand if they have a third-party risk management program. And if they don’t, they don’t get any of my sensitive data. And if they do, I kind of have to trust that they’re operating it well. 

At least for my team, I can’t spare the resources to roll incident response whenever there’s some breach out there that I have no idea if any of my vendors are involved in that. That’s very difficult for me to do something with, but also all of the time that I would spend on it. And so for me, I want to make sure I’ve got good contacts with my suppliers.

I want to make sure they know who to reach out to if they have a breach at one of their suppliers. So that they know, A, we care, and B, if something does go wrong with one of their suppliers that impacts us, it’s entirely likely they have a breach doesn’t even matter to us. But if it is something that impacts us, how to get in contact with us and how to work with us on scoping that to understand how it really impacts us or our customers.

[George Finney] I want to jump in here and just say the reason that we’ve been sending out those victim notifications is because our third parties haven’t been doing that for whatever reason – they’re inundated, they’re overwhelmed, they don’t know who is impacted. And so we’ve been proactive about saying, “Hey, we’re impacted.

We don’t have a complete list yet, but we just wanted to pass this information along to our customers, our students.” I think being proactive means you’ve got to have that relationship with your customers. It’s not your third or fourth or fifth parties that are doing that. That’s how you build trust with your community.

[David Spark] Mike, you mentioned something that has come up in a recent show is having essentially a chain of communications is really critical. It’s not who to blame, but who you can talk to who knows more than you do, essentially.

[Mike Johnson] Yeah, yes. 

[David Spark] And that can actually know the path, has their communications channel from there to go from there. 

[Mike Johnson] There is an infinite number of things that can go wrong, and there’s an infinite number of things that will go wrong. So, you can’t build everything in advance with foreknowledge. So, if you know who to talk to, and if they know who to talk to, then you can work through issues as they come up.

So, yes, that chain of communication is critical. And as George mentioned, that trust for communication is also really important in this. That if you are a vendor, or generally all of us are vendors of something, that your customers know that you’re going to reach out to them when something goes wrong, that they can trust that you’re going to do that.

It’s a chain of communication at that point. 

[David Spark] And correct me if I’m wrong, isn’t this truly the point of all tabletop exercises, figuring out what the chain of command is or chain of communications? 

[Mike Johnson] Yes. I mean, for a true tabletop exercise, you’re going to find a lot of problems that are probably in your communications, not really in your technical controls. 

Closing 

31:07.393

[David Spark] Well, that brings us to the very end of this episode. So, our closing advice – talk to your third-party vendors, talk to your staff, just good old-fashioned have a conversation. I want to thank our guest, George Finney, who I’ll let you have the very last word on this. But first, I want to mention our sponsor, and that would be Vanta – automate compliance, manage risk, improve trust continuously.

Remember, go to their website, vanta.com/CISO. It’s important you throw the /CISO so they know you came from us. Go to vanta.com/CISO. You can probably have a better GRC solution than you have right now. Check them out. All right. Mike, any last words? 

[Mike Johnson] Well, I do want to call back, George opened us with the advice of the security team was a black box. 

[David Spark] Ah.

[Mike Johnson] Communication and transparency is important. 

[David Spark] We have come full circle. 

[Mike Johnson] We’ve come full circle. George set it all up for us in the first place. So, George, thank you for opening on that. 

[David Spark] And making us look really good. 

[Mike Johnson] Yeah. Well, always appreciate that. 

[David Spark] Yes. 

[Mike Johnson] But thank you, George, for coming on. I really appreciate your approach to transparency and communication. And one of the things that you said that I really want folks to remember is the risk-versus-reward conversation, and that businesses make money by taking risks. And if we’re going in and just saying, “Hey, you can’t take any risks,” you’re not going to make any money.

So, I do think folks need to remember that that’s a trade-off. So, thank you specifically for that. 

[David Spark] We hammer on that as much in that often, many cybersecurity professionals think they’re the only ones dealing with risk. I’m like, “No, everybody is.” They’re all doing this kind of thing. All right. I do want to mention, and I want you to bring up the details, the sequel to Project Zero Trust.

That’s George Finney’s book. If you have not already received it, read it, dog-eared it many times, posted about it endlessly, then really what the heck is wrong with you? But there’s a chance to redeem yourself. There is a sequel. As I understand, it is not Electric Boogaloo. 

[Mike Johnson] It’s a shame. 

[David Spark] Which is a giant disappointment, George. But it is going to be Project Zero Trust 2, correct? Am I right on the title? 

[George Finney] Exactly, yep, yep. And again, thank you all. I’m so honored that you’re willing to. The first couple of times worked out so well, you wanted to have me back. 

[David Spark] We love having you. 

[George Finney] [Laughter] So, Project Zero Trust is essentially a story about a fictional company that implements zero trust. It’s a case study, but there are characters in it. And that’s one of the things that really resonated with people is that they can see themselves, whatever their role is in the organization.

[David Spark] Are these characters amalgamations of people you’ve worked with? 

[George Finney] Perhaps, or maybe just aspects of my own personality. 

[David Spark] Oh, so you have multiple personalities yourself that can make multiple characters. 

[Mike Johnson] His aspects, his aspects. 

[George Finney] Maybe in therapy, but no. 

[David Spark] My sister who’s a fiction writer, I will read her books, and I go, “Oh, that’s my Aunt Ethel. Oh, that’s my dad. Oh, that’s my sister.”

[Laughter] 

[David Spark] There you go. 

[George Finney] So, there were some things that we didn’t get to cover in the first Zero Trust book, and you know, AI obviously was one big thing.

[David Spark] Mm-hmm.

[George Finney] So, that is really the focus. The company comes back, they’re dealing with AI. AI isn’t just one thing, it’s a lot of different things. And how do you secure it? The answer, it’s in the name Zero Trust. So, I don’t know if officially the publisher’s going to let us call it that, but in my head I’ve been calling it Project Zero Trust Volume 2: Rise of the Machines.

[Mike Johnson] Nice. 

[David Spark] I don’t see any problem with that. 

[George Finney] Yeah, exactly. So, it should hit bookstores in May of 2025. 

[David Spark] We recommend, back me up on this, George and Mike, we recommend our audience camp out at their local Barnes & Noble right now, yes? 

[Mike Johnson] Go ahead and get out there, start now. The lines are going to be huge. 

[David Spark] Yeah, just no different than when the fourth Star Wars movie came out. Now, the difference is not everybody’s going to be disappointed like they were with that one. 

[Laughter] 

[David Spark] People will be thoroughly enjoying it. 

[George Finney] There is an amazing shout out to Star Wars in the book. No spoilers, but that’s the other thing I get to do with these books, and I don’t know why Wiley lets me get away with it, but just the pop culture references, it’s nonstop. 

[David Spark] I’m assuming you’re a fan of the Ready Player One books? 

[George Finney] Oh, yeah, there is. 

[David Spark] A lot of pop culture reference in that. 

[George Finney] Yeah. Yeah. I reference Ready Player One.

[David Spark] Oh, there you go. It’s meta. There you go, very good. By the way, I will say, we play a game in our game shows called “Star Wars Character or Cybersecurity Company?” and we put up a name. You have to determine, is it a Star Wars character or a cybersecurity company? I’m going to tell you, this game ain’t easy, and last night we played it with our San Diego meetup group.

And we did it as kind of a singled-out thing because we had nine answers, and the idea was whoever was left standing would be the winner. We had a raffle prize to give out. And so I said, “Everyone who believes it’s a Star Wars character, you’re on this side. Everybody who thinks it’s a cybersecurity company, on this side.” Everyone got out by the second one.

[Laughter] 

[David Spark] Except one guy. 

[Mike Johnson] Nice. 

[David Spark] I don’t know if he was even playing. He was just like, when I said, “You won,” he had this look on his face like, “What? I won?”

[Mike Johnson] “Why am I even here? What day is it?”

[David Spark] Everyone thought it was a cybersecurity company, and it was a Star Wars character. 

[Mike Johnson] What was it? 

[David Spark] Well, I can’t reveal that now.

[Mike Johnson] Okay, fair enough. 

[David Spark] Because people are going to play it. But I will just tell you. Oh, and someone pointed out that there was one company that we said was a, or one of the names was a cybersecurity company, and he pointed out, he goes, “Oh, it’s also a Star Wars character.”

[George Finney] Ah.

[Mike Johnson] Ah.

[George Finney] I know which one you’re talking about. Yeah. 

[David Spark] [Laughter] All right. Thank you, everybody. We greatly appreciate you listening and contributing to the CISO Series Podcast. 

[Voiceover] That wraps up another episode. If you haven’t subscribed to the podcast, please do. We have lots more shows on our website, CISOseries.com. Please join us on Fridays for our live shows – Super Cyber Friday, our virtual meetup, and Cyber Security Headlines Week in Review. This show thrives on your input.

Go to the Participate menu on our site for plenty of ways to get involved, including recording a question or a comment for the show. If you’re interested in sponsoring the podcast, contact David Spark directly at David@CISOseries.com. Thank you for listening to the CISO Series Podcast.