A lot of security professionals can feel like Cassandras in their organizations. These are people trying to get attention to significant security issues, often feeling unheard. This leads to some turning into scolds during a security incident, quick to say “I told you so.” So how do you manage these security pros when they don’t feel heard, both before and during a crisis?

This week’s episode is hosted by me, David Spark (@dspark), producer of CISO Series and Andy Ellis (@csoandy), operating partner, YL Ventures.  Joining me is our guest this week, Mike Kelley, CISO, EW Scrips.

Got feedback? Join the conversation on LinkedIn.

Huge thanks to our sponsor, Praetorian

Full Transcript

Intro

0:00.000

[Voiceover] Biggest mistake I ever made in security. Go!

[Mike Kelley] That would be taking on the responsibility for security and not asking for any additional resources or a pay increase. This happened back when I was working at Dana Holding Corporation. I was asked if I could take security on top of my existing responsibility as a head of governance risk compliance.

I’ve always wanted to get in this field, so I didn’t hesitate. I said yes immediately. Don’t regret the decision. But when I look back on it, I did miss an opportunity there for sure. So, don’t regret it, but that was my biggest mistake probably, not asking for additional resources or the pay increase.

[Voiceover] It’s time to begin the CISO Series Podcast.

[David Spark] Welcome to the CISO Series Podcast. My name is David Spark. I am the producer of the CISO Series. And my cohost for this very episode, you know him, you love him. You have to. It’s required to listen to this show. His name is Andy Ellis. He’s the operating partner over at YL Ventures. Andy, say hello to the audience.

[Andy Ellis] Good morning, audience. Or depending on when you’re listening to this, good afternoon, good evening, or goodnight.

[David Spark] There you go. You covered all bases because we are a worldwide program. We do not yet have anybody off the planet currently listening to us.

[Andy Ellis] We need to solve that. Let’s go talk to some astronauts.

[David Spark] Astronauts or some extraterrestrials. Either/or.

[Andy Ellis] Could be. We might have listeners off planet, we just don’t know about you.

[David Spark] It’s possible, yes. Send us a message. [Laughs] Send us an email.

[Andy Ellis] So, maybe I should say good, long night in the void.

[David Spark] Yes, send us a, “What’s Worse,” scenario from an extraterrestrial. We would like that. Our sponsor for today’s episode is Praetorian. They keep you several steps ahead of attackers. More about Praetorian… And they’re a great sponsor. They were early with us. They’ve come back again. Loved having them back again.

Thank you very much, Praetorian. And also, I did not mention this earlier, but we’re available at ciso-dev.davidspark.dcgws.com, where you can find all of our wonderful programming. Now, Andy, I am remiss… It is the beginning of 2024, and it’s time to plug your book yet again.

[Andy Ellis] Excellent.

[David Spark] That would be “1% Leadership.” Now, Andy, it’s weird… I purchased Andy’s book. I read Andy’s book. But yet, he still gives me crap about my… And I’ve promoted his book on this, yet still gives me crap. So, Andy, the bottom line is you’re never happy, are you?

[Andy Ellis] No. Just to be clear, when I’m gently teasing you, I am teasing you about the fact that I overpromote the book, and you occasionally call me out.

[David Spark] Yeah.

[Andy Ellis] On the fact that I’m continuously promoting. But I appreciate that, audience, I did not initiate this promotion. David did, because he is a lovely soul and a fantastic friend.

[David Spark] Yes.

[Andy Ellis] And you could do far worse than to be part of David’s circle.

[David Spark] By the way, this is something I tell people when you start your own business – whether you like it or not, you are going to be the number one cheerleader for your business.

[Andy Ellis] Absolutely.

[David Spark] You’re going to overpromote it yourself. So, I totally recognize… And I’ve published books myself. And yes, I have overpromoted myself. I have a book on video marketing, and I also have a book on engaging with people at tradeshows. The second one is the earlier book. It’s called “Three Feet From Seven figures,” all about those one on one engagement techniques.

And actually, later today, I’m doing something that came out of it. It’s something I do called Business Networking Pickup Lines where it’s a series of workshops that people do where they can figure out different ways to engage with people. I base it all on this concept of business flirting.

[Andy Ellis] Yeah, in fact when this episode airs, you will have just done a session on that at Cyber Marketing Con, and I’ll be able to give people feedback on what that’s like, because I signed up for it.

[David Spark] Thank you very much for signing up for it, and I’m looking forward… I’m going to be doing a run today. And I would say if you’re in San Diego, come. But it’ll be like a month and a half later. [Laughs]

[Andy Ellis] Hop in your time machine.

[David Spark] Yesh, hop in a time machine and go back a month and a half.

[Andy Ellis] And come.

[David Spark] And join us. All right, let’s bring on our guest. This has actually been a long time coming. I’m very, very happy to get our guest on. We’ve had to reschedule multiple times, but it’s happened. He’s prepared. You’re prepared. I’m prepared. We’re ready. Just correct me if I’m wrong, Mike, this is going to be an awesome episode.

Yes? I haven’t officially introduced you yet.

[Mike Kelley] Oh, yes, absolutely.

[David Spark] Okay. Now let me officially introduce you. It is the CISO for EW Scripps, Mike Kelley. Mike, thank you so much for joining us.

[Mike Kelley] Thank you. I’ve really been looking forward to joining here, and I’m glad we finally got a chance to get on here. So, appreciate it.

Have you actually pulled this off?

4:38.179

[David Spark] Now, in light of the recent vishing attack against MGM Resorts, many have been focusing on the need to improve identity verification, but focusing just on identity ignores the need for proper authentication and access controls, argues Paul Martini in a recent piece for Dark Reading. He argues, “Organizations should approach cyber security access controls like airport security, which verifies identity, scans what you’re bring into their transportation network, and then reauthenticates at boarding.” Does this seem like a realistic model for cyber security, and how do I get more SkyMiles out of this, Andy?

[Andy Ellis] So, unless you’re traveling internationally, I’m not actually convinced that’s a good way to think about air travel. Because really what air travel is is they authenticate you a little bit at the moment of purchase. They authenticate you as you walk into the airport. At boarding, they verify your token, which is the boarding pass.

They’re not authenticating who you are. They’re verifying that you have a token to be on the plane. That’s actually the old model. That’s how we’ve been doing authentication for so long, which is like, oh, just get a token, show up, and you’re good. I do think that people sometimes overfocus on one aspect of authentication and don’t think about that authentication and authorization needs to be integral to every business flow.

That it’s not okay to just say, “Is this person an employee?” It’s, “Who is this person? Do I really know who they are?” And that is the basic fundamental model of zero trust, which is to come in and say, “Look, I can’t trust who you are until you reverify who you are to me. I don’t care that the network thinks you’re David Spark.

I need to know that you’re David Spark.”

[David Spark] That’s a good point. So, the model of the airport security isn’t going to work for cyber security. It’s not enough, especially essentially just the token, because that token could be handed off to anybody, right?

[Andy Ellis] Right. The model of airport security is basically what we were doing in the enterprise 20 years ago. If we want to go back 20 years, fine. But that doesn’t seem like the right approach.

[David Spark] Mike, your take?

[Mike Kelley] Yeah, I mean, I get the idea. We’re looking for a zero trust strategy. Sorry I can’t help you with the SkyMiles, by the way. With Paul’s train of thought, if you were looking at it from a zero trust perspective, like the idea. To Andy’s point, the actual issues that dealt with the recent problems with Okta was related to token theft.

Right? It was taking an existing token, which was exactly the problem that caused all these things downstream. But if you were just looking at it from a zero trust strategy, I like the idea of zero trust. I think the complications, especially when you’re at a 140-year-old organization like we are, is we have legacy environment, and we have new environment with a Cloud.

That’s a big challenge, especially when you start looking at zero trust as in policy enforcement points, and you got your policy decision points. Some of these technologies don’t speak the same language. So, in theory, I think I know what Paul was shooting for. It is a zero trust strategy. But I think in reality, we have to understand that some of these companies, they’re working with legacy tech debt, and it just takes longer to get there.

We have to pick and choose where we want to take that approach.

[Andy Ellis] I think the challenge that most people run into… And both of us went to zero trust.

[David Spark] Which is, by the way, what this seems like it’s leaning towards.

[Andy Ellis] It is. But when you think about business email compromise and vishing attacks, there’s a whole set of attacks that are actually about attacking the command and control perimeter that sits in email, and Slack, and all of these messaging systems that functionally are awful at communication.

Like here’s my question – if you call in to customer support, and you have to authenticate who you are, at what point do they call you back? If they don’t call you back then they’re vulnerable to vishing. End of story right there. They’re going to trust you based on that call. Look, I literally had this last night.

I needed to rest my password for a bank. I called in, and now they at least did a push authenticate to my phone. Texted me a phone that I at least had to give back to them, so I had to demonstrate at least control of something that could get SMS messages sent to my phone. I recognize that doesn’t necessarily mean my phone.

But so often, the challenge is people haven’t thought through what do you do when you get that email from your CEO that says to do something? Or that phone call from your CEO, or that text message from your CEO. And if you don’t have a protocol for that then all the zero trust in the world isn’t going to save you.

What annoys a security professional?

9:13.019

[David Spark] “The days when people take cyber security seriously is the day 10% of the population lose jobs, the economy crashes into recession or depression, no one has power for days, food and other supplies don’t get delivered to stores, and it’s all traced back to multiple hacks and breaches due to bad cyber posture,” commented an obviously frustrated redditor and former Marine on the cybersecurity subreddit.

Now, not all cyber security professionals are like this, but we still have the ones who are eager to throw out the, “I told you so,” when something bad happens, and nobody listened to them when things were calm. Mike, this is a people management issue. How do you manage this type of cyber security professional…which I know you know this person…who doesn’t feel heard, and they just get aggravated?

[Mike Kelley] Not on my team.

[David Spark] Not on your team. You’ve heard of it.

[Laughter]

[Mike Kelley] Heard of them, yeah. Look, our profession, it’s not for the faint of heart. At the highest level, CISOs, we’ve been trying to get a seat at the table for years. We’re starting to get there, I feel. But our frontlines, they’re working day to day, the operations. They’re just trying to keep our company safe, and it’s not easy.

Security is always seen… No matter what we try to do, we’re seen as a speed bump. Hopefully it’s a speed bump, and it’s not brakes. That’s at least a better path forward. But I think there are days where we’re feeling like we’re just Horton yelling in the wind, no one hears. But the reality is we can’t have that defeatist attitude, and that’s something that I instill with my team, is that the reality is our role, it’s really advising and reasonable risk taking.

That’s what we should be thinking, and that’s how we should manage and build our teams, to build that trust. So, of course I encourage my team to speak up when they come across situations where there is unwarranted risk taking. I want to give them air cover when they are in disagreements. But at the end of the day, we got to understand that cyber security is just another risk that the company has got to manage.

And at the speed at which these companies are evolving, it’s going so quickly that we have to be seen as a partner and not a stage gate that’s just a part of the decision making. Because otherwise you’re going to be left in the dust.

[David Spark] But then do you have…? And you could just be the sort of like, “Come yell at me,” situation. Do you ever have situations where an employee comes to you and goes, “I’ve just got to yell at someone. Can I yell at you,” kind of a thing. “It’s driving me crazy.” Do you ever have those situations?

[Mike Kelley] Oh, absolutely. You know, I think one of the things that I…when we deal with these friction situations, it’s do you want advice, or do you just want to vent, right? Sometimes it’s just venting. Sometimes it’s advice.

[David Spark] But are you sympathetic to them?

[Mike Kelley] Absolutely. I think you have to be.

[David Spark] Well, because you’ve probably ben in the same situation.

[Mike Kelley] Absolutely. I mean, it’s not easy. Again, business is transforming so rapidly, you just can’t stay up with everything. So, what I will say… There are these cases where there is a disaster, and you can never let a disaster go to waste. You don’t say, “I told you so,” but you certainly use that to reinforce your agenda.

The important part is you focus on how to move forward as an organization and not the, “I told you so,” side. Because that’s never going to get you anywhere in life.

[David Spark] Yeah, nobody goes, “I guess you did. Oops.”

[Laughter]

[David Spark] Andy, how do you manage…? Because I know you have a formula for dealing with this.

[Andy Ellis] Yeah. So, let’s focus not on our relationship with the business but our relationship with this person who wrote the initial post.

[David Spark] Yes.

[Andy Ellis] Because that’s what’s  really important. My first question would be what are you trying to achieve when you just opened your mouth. Because I’m reading this… I’ve read this like five times while we were talking here. I just want to quote it back. I’m going to stop halfway through. The day when people take cyber security seriously is the day 10% of the population lose jobs.

Let me just stop right there. First of all, as a communicator, you just told me that if we ever take cyber security seriously, people will become unemployed. I recognize you actually meant the opposite. But you’re like, “Oh my God, it would take people losing jobs for folks to take cyber security seriously.” But that’s not how I heard it and certainly not how a lay person will hear it.

But you’ve gone so over the top that your claim is that no one takes cyber security seriously, which means that anybody who thinks they do is not going to listen to you.

So, if you use this argument to somebody who thinks they’re taking cyber security seriously, they’re jut going to blow you off. It doesn’t matter if they’re not as serious as they ought to be, you have not left any room for disagreement and for mutual learning and understanding. And so that’s what you have to focus on.

Because cyber security is not a discipline about getting things perfect. It’s about risk management and risk tradeoffs, and hopefully getting better. And there will be disagreement. I’m going to disagree with Mike. He said we should be speed bumps and not brakes, and I’m going to say we’re the opposite.

We should be brakes and not speed bumps and that we could have a conversation about why brakes are a better technology than speedbumps and why I’d rather be like them. But if I just said, “Oh my God, you’re an idiot because you don’t take this seriously because you think we should be speedbumps, because speedbumps kill people.”

[David Spark] By the way, you know, we all complain in cyber security… You know doctors deal with this same nonsense.

[Andy Ellis] Yeah.

[David Spark] Doctors advise their patients, “Don’t smoke. Don’t drink. Don’t eat fatty foods.” And people don’t listen to them, and it’s their own personal hell.

[Andy Ellis] Yeah, I hope my doctor is not listening to this right now.

[Laughter]

[Andy Ellis] Because she’ll be like, “Andy…” She’s got a whole list of things I’m supposed to be doing, and I’m getting a little bit better at it. But if she ever said to me, “You’re not taking your health seriously,” do you actually think that’s going to work? It might be like… My doctor did once say like, “My job is to be your coach, to put you in the position to succeed.

I can only tell you where to go. You’re the athlete that has to get there.” That was very inspiring. Like great. But if she said, “You’re awful, and you can’t do this job,” pretty sure I’d have a different doctor by now.

Sponsor – Praetorian

15:12.435

[David Spark] Before I go on any further, I do want to mention our awesome sponsor, Praetorian. So, Praetorian helps security teams go back on the offensive and shift cyber programs from a reactive “assumed breach” mentality to a prevention first strategy. Praetorian’s adversarial experts protect your business from evolving cyber threats by continuously emulating attackers to help you identify and mitigate your material risks before the real attackers have the opportunity to exploit them.

Now, with Praetorian as your offensive security partner, you can actually stay several steps ahead of the attackers and avoid the high costs of a breach. We’re all aware of that. The best defense is a good offense. Go to their website, praetorian.com.

It’s time to play, “What’s worse?”

16:12.945

[David Spark] Mike, you know how this game is played. We give you two awful scenarios. You have to tell me which one is the worse of the two. You ready for this?

[Mike Kelley] Yeah, fire away.

[David Spark] All right. Well, I make Andy answer first. You can agree or disagree with him. And, Andy, once again our… Now, again, this is not a real person…or a real name. It is a real person using a pseudonym. The pseudonym is Osman Young, working for SETECH Astronomy, for those of you fans of the movie “Sneakers.”

[Andy Ellis] Not Osman again. Man.

[David Spark] Yes, another one from Osman Young.

[Andy Ellis] Osman’s are brutal.

[David Spark] They’re tough. They’re long, too, so hang tight as I get through this, okay? So, listen to the whole thing. All right. You are the CIO, the CISO, or the DPO, data protection officer, who has been called in to help fix problems of a budding Italian medical data company who heretofore has already done…

[Andy Ellis] Okay, that’s already the worse scenario.

[Laughter]

[Andy Ellis] I’m done. I win.

[David Spark] Oh, wait. We’re going to get some calls. All right. Hereto has done nothing right. They haven’t done anything… You’re going to soon regret your decision, but it’s too late to back up now. The annual revenue… These are key numbers to remember. Just two of them. The annual revenue is 500 million euros, though the company has yet to turn a profit.

You have been given a budget of 20 million euros to fix the biggest risks you can. Okay. Two problems. All right? Number one, the data center is on the bottom floor of their headquarters, which is built in a flood plain, has frequent earthquakes, and sits close to an active volcano. This is why they put this in Italy.

The building was constructed by shady contractors and has major structural and electrical problems.

For these reasons, the data center cannot relocate upstairs. At least it has a sprinkler system for fires, but it’s also in the ceiling of the data center. Okay? They have no Cloud presence and no fail [Phonetic 00:18:07] oversight. You capture offsite backups of the data. But if the building is lost, estimates put the out of pocket costs to rebuild and restore operations at 20 million euros.

Remember, that’s your budget. Not counting lost revenue from the business being shut down. However, it will cost you 20 million euros to relocate the data center offsite and/or implement a new business continuity or disaster recovery strategy involving the Cloud or [Inaudible 00:18:37]. Okay, that’s scenario number one.

Not good.

[Andy Ellis] That’s all scenario one.

[Mike Kelley] Good Lord.

[David Spark] I know. Scenario number two is shorter. Hold on.

[Andy Ellis] Okay.

[David Spark] Problem number two. Privacy? Security? What’s that. The company has made no attempts to comply with GDPR and houses exabytes of private medical data about Europeans. It will cost at least two million euros to greenfield a privacy/security program to clean up the mess. But when you ultimately get breached, the fines will be four percent of your annual revenue, 20 million euros, each time it happens.

Okay. Which one is worse? Essentially it’s the situation of you got availability or protecting the confidentiality and integrity and meeting your regulatory requirements of the two scenarios. Andy?

[Andy Ellis] So, Osman, we need you to simplify.

[Laughter]

[Andy Ellis] Let’s start simplifying these.

[David Spark] I mean, I think he did it to really sort of make the gears in your head go.

[Andy Ellis] I know.

[Mike Kelley] That’s mental gymnastics.

[Laughter]

[Andy Ellis] Okay, so we’re clearly near Naples, Italy on the Phlegraean Fields is what we figured out here. I have no idea why we built a data center there, but apparently we did. So, just to restate… So, option one is I have an…no real security issue. I’ve got an availability issue.

[David Spark] You’ve got an availability issue in number one.

[Andy Ellis] Which will cost me my annual security budget.

[David Spark] Yes.

[Andy Ellis] To basically neutralize that issue entirely.

[David Spark] Yes.

[Andy Ellis] Or suck it up and go spend the money on something else, and then the company has to spend it when they have a [Inaudible 00:20:12]. Alternately, my entire security budget for the year to implement… Wait. Like, first of all, I can’t think of anybody… I’m trying to think. You’re an active CISO right now, so I’m going to ask this question.

[Mike Kelley] Yeah.

[Andy Ellis] Just to get a feel on it. Which is if you took your entire annual security budget, one year of the budget… You could potentially spread it out over two or three years to solve the privacy problem for you, to protect all data. That’s a reasonable cost. That’s not outrageous, is it?

[Mike Kelley] It depends on the size of the company. But yeah. If we’re talking about the…

[Andy Ellis] 500 million in revenue, and you’re…

[Mike Kelley] Yeah.

[Andy Ellis] And Osman, you did not say what our annual expenses are. You said we’re not profitable. There’s a difference between we’re spending 510 million a year and like 4 billion a year on these numbers. So, that would actually impact us. So, I actually don’t think either of these scenarios is that bad.

Let me just start from that one. These are actually… I’m okay with either one of these scenarios. I would be happy to have such clear and easy problems.

[David Spark] Right. Right. So, the thing is it’s 20 million to fix up the first scenario, 20 million for the second… 20 million to fix the availability problem or 20 million to fix the integrity problem.

[Andy Ellis] Right. This should almost be posed as you have both problems but can only fix one, which one are you going to go fix.

[David Spark] Yeah, exactly.

[Andy Ellis] And I’ll actually be honest, I would go fix the availability problem first, because that’s a business ender. Like we’re done on that if we don’t solve this problem. We got a flood, the company is out of business.

[David Spark] Well, it doesn’t necessarily… It’s going to cost you 20 million euros. They did say the cost of these problems is also 20 million [Inaudible 00:21:49]

[Andy Ellis] Yeah, but how… They need to talk about the frequency…

[David Spark] It didn’t say a business ender though. It’s not a business ender, the first one.

[Andy Ellis] It’s a business… He claimed it’s not, but that’s a business ender. Like if you got all your data in one data center, and it’s in a flood plain, and you’re on the first floor, that’s like a business ender. That’s like CIO 101. So, if I’m the CIO and CISO, I’m going to go to my board, and I’m going to say, “Look, here’s the other in which I’m solving these problems.

First, I’m building us a new data center. We’re going to move everything out of here. Yes, it’s going to still be in Italy, but we are getting away from Naples, off of the flood plain, nowhere near a volcano. Then next year, we’re implementing this…”

[David Spark] That’d be in Palermo. Palermo has Mount Etna.

[Andy Ellis] Yeah, I don’t know Italian geography really well. It confuses me. I literally had to Google to figure out where the Phlegraean Fields were.

[David Spark] Well, Mount Etna is in Palermo, so it could have been there.

[Andy Ellis] Well, it could have been, but the Phlegraean Fields have the flood plain right there. That’s why I was going with that one. Because CNN just had an article on it four days ago.

[Laughter]

[Andy Ellis] That’s what came up when I did my Duck, Duck, Go. So, I think that’s the order I’m going to prioritize them in, which I guess is me saying that the availability problem is worse.

[David Spark] Availability problem is worse.

[Andy Ellis] That’s the one I’m going to fix first. But I’m happy to have both of these problems.

[David Spark] But you only can fix one of them though. But then again, would you have completely eschewed all of GDPR, or would you have said, “I know where we’ll build this data center, in the basement in a flood plain where there’s going to be a volcano.”

[Mike Kelley] Well, see, you didn’t make that decision though.

[Andy Ellis] I didn’t make the decision. I inherited it.

[David Spark] All right, we got to go to Mike here on this one.

[Andy Ellis] Yeah, go to Mike.

[David Spark] Mike, where are we on this? What’s…?

[Mike Kelley] I think it’s tough. It’s kind of one of those things with… Right now, you got to look at it from my ability as a CISO. I mean, man…

[Andy Ellis] But you’re the CIO also. That was an important piece.

[Mike Kelley] Okay. Well, CIO… Okay, he said DPO, multiple ones. Right? If I’m a DPO, I’m going after the privacy stuff, because that’s right in my wheelhouse.

[David Spark] You’re holding every hat.

[Mike Kelley] Yeah. And it’s tough with where we’re sitting at these days, right? That’s negligence on privacy…the protection of data. It would be negligence as well on the availability issue. But here at least, there’s an act of God, right? And that’s just some bad decisions made before. But if you’re trying to keep the business… That’s what’s kind of tough.

I’m struggling here. I got a bad situation. Over here, it’s negligence. The other one, a company may go under. But obviously, that’s very critical to keep the business up and running.

[Andy Ellis] He’s trying not to answer.

[David Spark] What are you choosing, Mike? Which one? You got to pick one.

[Mike Kelley] [Laughs] I’m going to have to go with the privacy.

[David Spark] Privacy. As in that’s worse?

[Andy Ellis] That’s two disagreements in a row, David.

[David Spark] All right. Good.

[Andy Ellis] I’m losing my touch.

[Mike Kelley] It’s not losing touch. I think it’s a negligence thing.

[Andy Ellis] Yeah. No, no. I had a run where I had like seven podcasts in a row where the guest agreed with me on, “What’s worse,” and it was really starting to frustrate David. So, now I’ve got two in a row… The dynasty has fallen.

[David Spark] It’s always good when it’s a split decision, because this is a tough decision. It was tough.

Close your eyes and visualize the perfect engagement.

24:48.394

[David Spark] Making security a business enabler does not mean security professionals should see their expertise. So, why do so many professionals put the onus on business stakeholders with questions like, “What are your requirements?” As Brad Kirkpatrick pointed out in a recent Medium post, “Imagine if a doctor asked the same question when you’re not feeling well.

In both cases, the experts should take the stakeholder through a process in nontechnical language to craft a solution rather than ask them to operate in their framework of expertise.” All right, Mike, I’m starting with you. What else can a security professional do to meet stakeholders where they are?

[Mike Kelley] Yeah. I mean, look, I think Brad’s points, they have merits. You know, if you want to be seen as a business enabler, first you have to have business acumen. You have to understand how the operations work so that you can speak in the language with our stakeholders. So, from a requirements gathering… That’s important.

That’s kind of 101, but that’s not our opening salvo. We should be talking about what are we trying to solve for the business. So, ideally, and CISOs especially, you have to have a fundamental understanding of how the business operates so that we can focus on outcomes rather than tactical things like requirements.

So, ultimately if you understand the end game, what we’re trying to accomplish, you can kind of navigate that conversation towards where you want them to go.

[David Spark] Like what a magician does. A magician makes you believe that you’re picking your own card when the reality is they’re forcing a card on you.

[Mike Kelley] That’s right.

[Andy Ellis] Right, the magician’s force is one of my favorite things to watch happen. I watch AGT at all the time, and you’re like, “I saw that.”

[Laughter]

[Mike Kelley] So, I mean, just like an example… For me, at least as a CISO, I try to find where I spend my time that’s going to drive the most value for the company. So, any time I see opportunities where we are doing something innovative, we’re trying to do something strategic, I’m making sure I’m latching onto that.

And just an example, recently we’re actually going to be entering a new market for the company – something we haven’t done. We’re taking advantage of a new technology standard within our industry. It’s actually called ATSC3.L. And if you imagine… In the past, you watched TV over the air. It was just television signals.

You were watching video. We now have the ability to deliver data packets over the air just like the internet, which is pretty fundamental and groundbreaking for our organization and our industry in general.

So, for me, I look for ways to latch onto those opportunities, because that builds trust. I’m now seen as a business enabler. I’m now seen as not just protecting the bottom line and protecting value but actually driving value for the company. For me, I always look for those opportunities to seize those moments, because to me, that is where you can really drive value and be seen as beyond a one-trick pony from a cyber security perspective.

That you’re actually adding value to the organization. So, anyways, that’s one of the things that we’re working on right now.

I’ve actually helped build this out from the foundation up, this new business model that we’re working on. So, it’s been interesting. For me, it’s exciting times, because I’m doing things beyond cyber security. I’m getting involved in business development, flexing different mental muscles, learning things about market strategies, building the skillset that extends well beyond cyber security.

Again, that’s kind of strengthening my position at the company to then be seen as a business enabler, and people will come to me before they think about what’s next, so we can build security in, the ground up.

[David Spark] So, it’s more than just learning the language. It’s being essentially embedded, if you will.

[Mike Kelley] Right. And for me, I’m always looking for the disruptors. In the organization, you have creatives that have great ideas. Those are the people you want to stay close to, because they’re breaking things, and they’re breaking things for good reason. But you want to be very close and understand what they’re trying to focus on, and understand what the operations are, and what they’re trying to accomplish.

Again, the outcome. Not these tactical things like requirements but focus on what’s the end game. I think that’s how security can really be a business enabler.

[David Spark] Andy, one of the ways I like to look at this is like a geometric proof. The whole thing with a geometric proof is you sort of walk through, and at each stage you get acceptance, if you will. Like, “We agree that a square has four equal sides,” something like that. Are we on agreement of that?

And so the idea is that you can kind of walk them through that. Is that an appropriate approach or no? Am I not heading down the right way?

[Andy Ellis] So, I think the challenge here is that we’re dealing with complex systems, and complex system safety requirements are very hard to decompose. Let me decompose that statement to make it clear, which is the scenario that happened that Brad was talking about… Everybody should go read it when this episode drops.

There will be a link on the page, I assume, for it. It talks about how they were setting up for students who were learning how to do work in the call center accounts. They set up the accounts when the students started training, but the students weren’t actually handed the accounts until they finished training.

42 days later, the accounts had expired or the passwords had expired. Nobody could log in. So, think about this as two or three different systems that are subsystems of the entire IAM system.

Every system operated as it was supposed to. You had an account idle for 30 days. You expire the password, force reauthentication. Right? People do that all the time. Now, they don’t think about things like, “Oh, what about our students in training? What about people who are pregnant and then take parental leave or are on a disability?” You don’t think about all these little complex things that make your system stop working when multiple things come together.

That’s the challenge. And so I don’t know if this is really about sort of ceding the requirements, but it is about changing the conversation. What I think security professionals need to do is you need to be complex systems architects. You need to understand how the system works. And then the conversation to have with your business partner, “What are your requirements,” is actually really confrontational language.

Like, “What are you really trying to do here?” They’re now primed for an argument.

[David Spark] Right. And by the way, I’m going to throw this comment out. If I were to say to you, “What are your requirements?” And you don’t really know the answer, because you don’t know how to go through this. And you don’t tell me, and I build something, and then you complain like, “Hey, well, the pregnant woman went on leave.

She got locked out.” And me as the system architect… “Well, you didn’t tell me about that,” kind of a thing.

[Andy Ellis] Right. And I’m thinking, “Why did you not know about that? That’s a normal employment thing.” And so I think as an architect in the security side, and on the identity side, and on the IT side, you’ve got to understand all the complexities here because your business stakeholder doesn’t. You can’t ask them to, but you can say things like, “Hey, what are your unacceptable losses?” And they might say, “Somebody not being able to login is an unacceptable loss to me.” And now you have to do the hard work of saying, “What are all the hazards that might lead to that?

Oh, they can’t login if they haven’t logged in for 30 days. What are all the things that caused them to have not logged in for 30 days and then show up needing to login? Then what’s the reboot start flow?”

My big question is like, “Wait, you have an IAM system that can expire people’s password. And when they try to login, they do not get any feedback that tells them how to recover.” There’s a critical failure rate here. There is so many problems here that Brad sort of glossed over, which I hope were just glossed over because he was writing a post for Medium, and so he didn’t walk through the, “Here’s the 70 hazards that contributed.” But when you have a critical failure like this, if you think there was one root cause, you have done yourself a disservice.

There are usually 17 things that went wrong for you to have a critical outage.

[David Spark] I remember when I was in my early 20’s, just met some guy at a party who was an accountant. And he just started asking me questions. He says, “Oh, have you thought about this? Have you thought about this?” And I realized, “No, I haven’t thought about any of this stuff.” You realize the success comes in the question asking, not the what are your requirements, which is the grand question of, “Tell me everything you would need an accountant for.”

[Andy Ellis] Right.

[David Spark] The accountant telling you all the little details. And after…the end of there, I was like, “Oh my God, I need to hire you,” kind of a thing. It was a great sales pitch, to tell you the honest truth, is what it was.

[Andy Ellis] Right. So, if you’re an IAM architect, and you’re listening to this, and you want those questions, here’s some questions you should ask – how do you want to deal with idle users who have not logged in in a long time, how do you want to deal with people who have to do name changes. Like this one gets everybody.

Like your username is a derivative of your name, and functionally you can’t change it. The only way you’re allowed to change your username is to quit and get rehired.

[Mike Kelley] Someone gets married. That happens quite a bit, too, right? You want to change that.

[Andy Ellis] Gets married, transitions, gets divorced. People who get married will often tolerate being forced to keep their old name. People who get divorced will not.

[David Spark] They want to get rid of that.

[Andy Ellis] Right. People who transition will not.

[Mike Kelley] This applies to asset management, too. Device connections.

[Andy Ellis] Yeah.

[David Spark] Devices that have been [Inaudible 00:33:41] forever, and then all of a sudden you don’t see them for 30 days.

[Andy Ellis] Right. So, if you’re in the IAM space, you should write down every possible thing that will make an IAM system not work, and you should ask the questions of your business stakeholder, how do they want to deal with those.

How can we align different departments objectives?

33:55.603

[David Spark] The lack of cyber expertise on corporate boards is sorely lacking. Only 12% of the S&P 500 have directors with cyber security expertise on the board, according to a NightDragon and Diligent survey. But board composition can be like turning a battleship – it takes time. We might know what we need boards to look like, but how do we get there in practice?

“There is a danger in essentially appointing a single cyber security oversight director,” said Ericka Chickowski in a recent piece for CSO Online and said, “Boards can bring on directors with cyber expertise that overlaps with risk management, IT, and digital business expertise. These directors can show the rest of the boards how to look at a security program.” So, I’ll start with you, Andy.

Are there actually structural steps to take to make this happen? Like sort of this overlap of cyber expertise. And what would ideal coverage look like for you on a board?

[Andy Ellis] So, this is a really hard question, because I’ve seen companies do a bunch of different things. Look, I sit on a couple of boards of nonpublic companies, and I’ll tell you, the cyber expertise I bring is very minimal. Mostly we’re focused on execution, on go to market. The cyber conversation is mostly not even happening in the boardroom.

Now, it’s going to be different then for publicly traded companies, but I’ve reported in publicly traded companies to the board. I’ll tell you, I don’t think people know what conversation they want to have in the boardroom, so it’s not clear that you can solve this problem by declaring who ought to be in the conversation.

Because here’s the reality – a board’s job is twofold. They have exactly two jobs that they should be doing at a publicly traded company. Job one is ensure that there is a CEO succession plan.

This is the most important job a board has. And if you look at a company, and there’s no CEO succession plan then anything else the board is doing doesn’t really matter, because they’re clearly failing at job number one. So, that’s job one. Job two… And this is the really widespread one, which is their job is to make sure the company has affective governance in all areas of risk that the company is managing.

That’s it. And so the real cyber security question is what does good governance look like in a company. I don’t think we have an answer to that one yet, so we’re sort of trying to kick the can up because we’re implicitly saying we actually think our companies do not have good cyber security governance, and we want to get the board involved so that they would point something out.

But that’s not how you do it. First, you have to say, “What is affective governance? What does good governance look like?” And let’s take Solar Winds as an example, since, gee, lawsuits are in the news about it.

[David Spark] Mm-hmm. 

[Andy Ellis] I am willing to posit that a sizeable proportion of the SMP 500 behaves like Solar Winds behaved pre-breach. I don’t think that’s outlier behavior. I think you have a lot of security teams who make jokes about the poor security that they experience in the company, and they don’t have the context of saying which risks are okay and which ones are not okay and escalate the right ones.

And so the whole world is a disaster, much like our Marine earlier in was complaining about nobody taking security seriously. So, they put that out there. Something bad will happen, and now you have a whole evidence trail of bad governance. But until we say what good governance looks like, what does it mean for a company to take cyber security seriously?

Once we answer that question, then we can answer the question of how should the board make sure that’s happening. But I don’t think we’re having the right conversation yet.

[David Spark] Do you agree with that one, Mike?

[Mike Kelley] Yeah, I do. I think if you look at it, SoK was kind of the initial thing that talks about these things. It really was.

[Andy Ellis] And it was awful… Sorry. I am laughing so hard for those of you who can’t see me. He’s so right. It’s so true and so funny at the same time.

[Mike Kelley] Yeah, right. They need a financial expert on the board, and now they’re starting to call for things like that. But I think it is difficult to equate accounting principles to cyber security principles. There are generally accepted accounting principles. We need a GASP, a generally accepted security principles.

But we all know the reality is that’s almost impossible to do when we all look so different, from an industry perspective, from a company perspective. Are you in growth? Are you public? Are you private? There’s so many different challenges that come along with it. But if I’m thinking from a structural maybe steps to how to make this happen, CISOs… I do think cyber security expertise or somebody with cyber security expertise over time, we really should have somebody on boards is my opinion that has that.

But they can’t be the one-trick pony. That is difficult, because that does take up seats on the board composition, and that would be a tough pill to swallow, [Inaudible 00:38:48] that much more. So, I do think it’s important we get there.

And maybe some of the structural stuff between now and then, it’s maybe just advisors that come in and advise, educate, and update the board or listen in and provide some advice and feedback. That’s probably the closest thing, I think, from a structural step. Other than that, the SEC pulling out the disclosure of cyber security expertise on the board, I think it does inhibit us getting closer to that.

And with this recent Solar Winds charge, that’s going to be interesting. I got to be honest, it was a bit of a punch to the gut in the CISO community because already them not requiring cyber expertise disclosure on a board now puts CISO in a crosshair of… To Andy’s point, if you look at the disclosures, they’ve all been very vague over the years for a reason.

You don’t want to give the playbook to the attackers. So, getting too precise in your disclosure is a danger. And even if we did that, even if we did that, would a reasonable investor understand exactly what you’re saying if you’re giving some technical jargon in there? Probably not. [Laughs]

[David Spark] No, probably not at all. That’s a really, really good point. I mean, maybe there is like a third party that would be grading, which is kind of what the whole security vendor sales community is trying to do. But getting to a point where everyone will agree on that and get it all done. It seems like a tantamount task, for that matter.

And that’s why they’re asking for self-reporting, I guess, in this respect.

[Andy Ellis] Right. But the challenge is… And I’ll try to wrap it up really briefly. Which is until the board, the CEO, and the CISO agree on what the conversation should be happening between the CISO and the board, the push to get CISOs more board exposure is actually throwing CISOs over a cliff.

[Mike Kelley] Yep.

Closing

40:40.810

[David Spark] That is a very good point and a good spot to close. Thank you very much, Andy. Thank you very much, Mike. Mike, I’m going to let you have the very last word in just a moment, but I do want to thank our sponsor, Praetorian. Remember, they keep you several steps ahead of your attackers. Check them out and see how they can do exactly that.

Mike, any last word? We always like to say like if you’re hiring, you can…please call out. Anything else you’d like to say about today’s episode or EW Scripps?

[Mike Kelley] Yes. No, first of all, thank you so much for having me on here. Really appreciate it. One thing I would like to put a plug out there for is, as I mentioned before, going beyond cyber security, I’m actually being a part of this joint venture. I’m helping develop it. And we are open for business.

So, we have combined with another large broadcaster, and our company is called OTA Wireless. That’s otawireless.com. If you want more information of how you can deliver data at massive scale, come check us out. We’re open for business.

[David Spark] Awesome. Good job. Well, thank you very much, Mike. Thank you very much, Andy. And thank you to our audience as well. We greatly appreciate your contributions. Send me more, “What’s Worse,” scenarios, even more creative than what Osman sends me. And we appreciate you listening to the CISO Series Podcast.

[Voiceover] That wraps up another episode. If you haven’t subscribed to the podcast, please do. We have lots more shows on our website, ciso-dev.davidspark.dcgws.com. Please join us on Fridays for our live shows, Super Cyber Friday, our virtual meetup, and Cyber Security Headlines Week In Review. This show thrives on your input.

Go to the participate menu on our site for plenty of ways to get involved including recording a question or a comment for the show. If you’re interested in sponsoring the podcast, contact David Spark directly at david@ciso-dev.davidspark.dcgws.com. Thank you for listening to the CISO Series Podcast.