A lot of conversations around burnout focus on the impact to individuals or larger macro trends about the cybersecurity job market. But what about its direct impact on your security team? Surveys suggest that burnout plays a role in how organizations can respond to security incidents. All jobs involve dealing with stress, but what should we consider normal in cybersecurity? And when does that stress endanger your security mission?

This week’s episode is hosted by me, David Spark (@dspark), producer of CISO Series and Mike Johnson, CISO, Rivian. Joining us is our guest, Shyama Rose, CISO and head of IT, Affirm.

Got feedback? Join the conversation on LinkedIn.

Huge thanks to our sponsor, Panoptica, Cisco’s Cloud Application Security Platform

Full Transcript

[Voiceover] Best advice for a CISO. Go!

[Shyama Rose] I think the best advice for a CISO is to get out of the CISO echo chamber that we all love to gather around in circles for and get some advice from some other business leaders that have nothing to do with security whatsoever and get their insights on leadership.

Highly recommend attending conferences like World Business Forum and things like that.

[Voiceover] It’s time to begin the CISO Series Podcast.

[David Spark] Welcome to the CISO Series Podcast. My name is David Spark. I am the producer of the CISO Series. And joining me, my co-host from day one – that’s June 1st, 2018 – it’s Mike Johnson. Mike, introduce yourself.

[Mike Johnson] Hi, I’m Mike Johnson. Nice to meet you, David.

[David Spark] No, we know each other.

[Mike Johnson] [Laughter]

[David Spark] By the way, actually I just said something that I hate other podcasters do that say, “Introduce yourself.” I don’t usually say that, I just say, “Let’s hear the sound of your voice,” because I don’t want you to introduce yourself, and I will not make our guests introduce themselves either.

I will introduce them. So, we’re available, by the way, at CISOseries.com. For those of you who don’t know, by the way, we’ve been having wonderful issues with that too. That was a lot of fun. I, by the way, had a horrible tech support issue this morning, but we’re not going to get into that because it would bore everyone to death.

[Mike Johnson] It bored me, David.

[David Spark] Let me, though, mention our sponsor, far more interesting, our sponsor, thrilled to have them on board. It is Panoptica. That is Cisco’s cloud application security solution. It provides end-to-end lifecycle protection for cloud native application environments.

And guess what? I’m going to be telling you more about that a little bit later in the show. But first, Mike.

[Mike Johnson] David.

[David Spark] I recently did Leo Laporte’s show, This Week in Tech. You have seen that show before; you have listened to it.

[Mike Johnson] For quite some time.

[David Spark] In fact, you just did DTNS, which is Daily Tech News Show, which is with Tom Merritt, who also, I know both Leo and Tom from my days at TechTV, formerly known as ZDTV.

[Mike Johnson] Mm-hmm.

[David Spark] Anyways, you’ll be amused by this. You know how I bring up the subject of pinball every now and then on this show?

[Mike Johnson] Oh, yes.

[David Spark] I am a fan of it. So, it just so happens that I did an episode of TWiT with Brianna Wu, who is a bigger pinball fan than me, has more pinball machines than I have, and we just took over the beginning of the show talking about pinball the whole time.

And heck, I would have loved to make the whole show that, but we did have to get to a discussion about technology for the week’s news.

[Mike Johnson] So, it was mostly This Week in Pinball with a little bit of tech news on the side?

[David Spark] That’s what I liked it would have been. And by the way, it’s interesting you mention that, because there is a podcast called This Week in Pinball with the acronym TWIP.

[Mike Johnson] I have learned something today.

[David Spark] By the way, I will just let you know, and I’ve been listening to pinball podcasts, even for someone who’s really into pinball like me, they’re not the most interesting podcasts.

[Laughter]

[Mike Johnson] Is there a lot that changes week to week? Is there a whole lot of pinball news that goes on out there?

[David Spark] Really, you’re just talking about the new machines on the market, the new manufacturers on the market. That’s a lot of it.

[Mike Johnson] Got it.

[David Spark] That’s it. But that’s enough for our pinball talk today. Unless the two of you want to bring it up, I’ll be happy to answer. But otherwise, we don’t need to discuss it anymore. Let’s get our guest in, why don’t we? Thrilled to have her on.

We were going to record with her before, and she had laryngitis, sadly. Her voice sounds fantastic now. She sounds great now. It is the CISO and Head of IT over at Affirm, Shyama Rose. Shyama, thank you so much for joining us.

[Shyama Rose] Hello and thank you for having me. This is my first podcast. Long-time listener, first-time joiner, so stoked to be here.

Maybe you shouldn’t have done that?

3:47.051

[David Spark] Phishing tests can often challenge the trust employees have with the security team. Now Joan Goodchild at Dark Reading pointed to a company a few years ago sending out phishing simulation emails, promising bonuses for filling out forms.

Maybe some employees learned a lesson, but most probably took away that they can’t trust their security team. Now we know that building trust is a key for changing behavior and making staff feel comfortable reporting issues. Mike, I know you don’t like doing phishing training.

Is it for this reason? Now many argue that issuing these types of phishing tests is tough love because if we don’t do it, the criminals will, and we’d rather it be from us first. So, what do you say to that? And by the way, is that the reason you don’t do phishing tests yourself?

[Mike Johnson] This is really the first time that I’ve been able to put the word on it, and it really is the harm to trust. That is really a good way of putting it. If you’ve got someone who you feel like they’re constantly trying to trick you, like every interaction you have, they’re trying to trick you, how do you feel about that?

That’s not a great interaction. And I think it’s easy to forget for most employees, the only time they engage with the security team is to report a phish. That’s the first time that they’re coming to you, and for most employees, that’s what their interactions are.

So, if that interaction is finding out, “Hey, you’ve been tricked,” what’s their likelihood they’re going to engage again? It’s not great. They’re likely to really shut down and feel a loss of trust.

[David Spark] But what do you think about the tough love thing, better from us than the bad guys?

[Mike Johnson] But the flip side is we have all of this data today. The phishing is happening. It’s already going on in our environments. We have that data that we can look at and review that. We can see if people are interacting with phishes. We should look at the real world, what’s already going on.

It’s not like we have to wait for a phish to show up. The data is there. The real thing and the real concern that I have about this whole thing is if your company is compromised because an employee clicks on a phish, it’s not because they did the wrong thing, it’s because your controls have failed.

Your security program is at fault, not your employee.

[David Spark] And hence the classic line of the users are at fault here.

[Mike Johnson] Mm-hmm. And that’s not the case.

[David Spark] No, not the case. All right, I’m throwing this over to you, Shyama. By the way, Mike is an anomaly here in that he does not phish. Even people who don’t like to do it, do it for compliance and regulatory reasons. Where is your feeling on the whole phishing and building and losing trust with your staff?

[Shyama Rose] Yeah. I have to be honest, when I read this article, I was just flabbergasted at what happened, I think it’s insane, and it took me a couple of days to actually process what I was reading. After a while, I started to think that this has actually nothing to do with phishing whatsoever.

This, to me, is an example of bad program management, bad gamification, and also really low or bad EQ, right? I just feel like the people that are executing on this exercise are not taking into consideration how humans behave and how security represents themselves.

So, to me, you could take the exercise out and you can see examples of this across various different types of programs within security and it doesn’t have anything to do with phishing. And I think that Mike is extremely right about maintaining and establishing trust across the various pieces of the organization and actually really don’t think that the…

I think the phishing concept in this is actually misaligned. I think we need to have better EQ about how we deal with individuals in our organization and that’s how we establish trust. And then if you really have to layer on top phishing exercises or tests of some nature to show some kind of compliance or education and awareness, then you can do it with a more compassionate lens as opposed to this really horrible, quite frankly, horrible way of doing it.

I feel a tremendous amount of concern for the employees that were impacted by something like that. It’s really sad.

[David Spark] And just to remind everybody, it was an email that said, “Oh, fill out this form, you’ll get a bonus.”

[Shyama Rose] Yeah. And then to come and not only learn that you’re not getting the bonus, but you’re also getting reprimanded is quite frankly, $600 can be a lot of money to people sometimes, so it’s quite cruel actually. And I think that whoever was overseeing that program really should take some education on how to really deal with people.

The Great CISO Challenge

8:40.902

[David Spark] Over the last year, the US Securities and Exchange Commission, AKA SEC here in the US, has increasingly been scrutinizing the actions of CISOs, one of the more notable being the charges leveled again SolarWinds CISO, Tim Brown, who, by the way, has been a guest on our show, Defense in Depth.

Of all the numerous opinions, Mike Lockhart, CISO at EagleView, stood out saying, “The SEC is clueless as to how hobbled some CISOs’ organizations are to materially fix systematic issues within an organization.” So, I’ll start with you Shyama. Is this simply a misalignment in what regulations are putting on CISOs versus what they can actually do in their roles?

[Shyama Rose] Yeah. [Laughter] As a CISO, and I’m sure all CISOs at this point are laying awake at night thinking about this when we get that question, what keeps us up at night. And it’s shifting, and this I feel like, to me, there’s been the writing on the wall for a long time.

And something like this coming up, I think the first red flags or warning signs that we got were last year with [Inaudible 00:09:51], we were seeing it then. I was at a conference speaking on a panel and trying to talk about it and throw up this as a symptom of what is to come with this.

And I find it actually really, really fascinating because we as security practitioners love attribution, and we love to assign responsibility, and these are things that we obsess over. So, the concept of who is responsible for this breach, what happened, and how did they deal with it, is something that we have all been musing about for decades now.

It’s just what’s new here is that it’s external entities that are now turning the mirror back on us and having us be the subject of that scrutiny as CISOs. So, I think that’s where the cognitive dissonance and discomfort is coming from, from the CISO community.

It takes two seconds to search in LinkedIn, “CISO and SEC ruling,” and see all of the commentary about the different potential impacts that this ruling might have. So, there’s a piece of me, of course, that is like, “Great, we love oversight, we love scrutiny, we actually, [Laughter] for better or for worse, love to have some kind of hammer or bar to measure ourselves with and report against.” However, I think that where we’re finding the discomfort is really in the unknown here, there’s a lot of back and forth about various pieces of the ruling, what it means, and how do we process it.

And I think most CISOs in their right minds generally want to do the right thing. And to the quote about, “Well…”

[David Spark] The SEC’s clueless.

[Shyama Rose] Right.

[David Spark] As to how hobbled the CISOs are.

[Shyama Rose] Yeah. I think it’s true in the fact that – and this is where we start getting down to the onus of responsibility of the CISO – I think if CISOs truly had the power that the SEC thought that we had, we would have a lot more buy-in and resources and change and all the things that we like to complain about in our op-eds [Laughter] that would prevent a lot of these breaches.

But the truth is, and we all know this, that we come up a lot of speed bumps and a lot of hills and sometimes we can’t get things done. And it is not all on the CISO’s shoulders. Sometimes it’s just to do with external pressures, outside of the company even, internal, resources and all that, and just getting security done in general.

So, I think that there does need to be some acknowledgement of that fact.

[David Spark] The CISO is far from all-knowing and all-capable.

[Shyama Rose] Right. [Laughter] I love that people give us so much credit in thinking that we’re omnipotent and all-knowing and all-doing and all-seeing, which is great. But at the same time, we’re so far from that. [Laughter]

[David Spark] Mike? All right, I’m throwing this to you, Mike. Mike, I’ve always felt that you were all-knowing and omnipotent. Have I been wrong all this time?

[Mike Johnson] Well, if you actually were omnipotent yourself, you would know my answer to that.

[Shyama Rose] [Laughter]

[David Spark] I’m not. I thought you were. I’m definitely not.

[Mike Johnson] Yeah, sorry to let you down, David.

[David Spark] But no, I just want to double down on something that Shyama said. SEC I think is giving too much credit or has way too high expectations for what the CISO knows and what the CISO’s capable of doing. I think that’s what kind of it boils down to.

[Mike Johnson] Shyama said it very well of the discomfort of unknown, and a lot of what we have right now is unknown.

[David Spark] Like is this material and do we know this?

[Mike Johnson] Exactly.

[David Spark] To “know” something and report within X number of days, what do you know, really?

[Mike Johnson] At the same time, we’re in a state where we don’t have, or we’ve basically operated up until now with no regulation whatsoever, except for certain industries. The vast majority of CISOs, of security leaders, haven’t been regulated in any way, shape, or form.

And that’s where we’re trying to kind of figure out and do the best we can with what we’ve got and read between the lines. I would suggest that people spend more time with the materiality questions than with the particulars of Tim’s case. Tim’s case is a very specific one, very specific set of situations, much like the Joe Sullivan case was very specific.

And a lot of people looked at that and said, “Oh, my gosh. CISOing is over, and the world is coming to an end,” but failed to look at the specificity of that case. And so I think right now where we’re operating in this unknown, and there’s something that Alex Stamos said years ago about being a CISO now is like being a CFO before accounting was invented.

We’re trying to figure out as we go and…

[David Spark] That’s a funny analogy right there. The SEC, they’ve advanced some rules now, and they’re going to be refined, and we’re going to need to work amongst ourselves and also try and work with the SEC on that. But it’s a start, and we have to recognize it for what is – a start.

[Shyama Rose] I think what we’re seeing with these two cases, and they’re wildly different from each other, and you’re right in that paying attention to the specificity is important, I do think what these two cases are teaching us is the precedent for what is to come or what we might be hinging on.

And what we’re seeing is a large range of what is considered to be materially in this sense. And if you actually look at the ruling itself, the definition of material is really listed underneath how we manage risk and how we actually process risk internally.

So, not only is it just that definition of material, they even go so far as to say, “reasonably material,” which opens up the range even broader for what we can constitute as material. So, my takeaway is that it they want to hammer on you they will. They’re using that lack of specificity as the platform to do that, and they’re showing us through these different cases that there’s a wide range of things that they can come down on.

So, I think that that lack of example, and that lack of way forward for things that we can bank on for what is the right thing to do, is really difficult to interpret, and I think that’s why we’re seeing so much dialogue around it.

Sponsor – Panoptica

16:28.230

[David Spark] Before I go on any further, I do want to mention Panoptica, that’s Cisco’s cloud application security solution. It provides end-to-end lifecycle protection for cloud native application environments. So, let me explain. Panoptica empowers organizations to safeguard their APIs, server list functions, containers, and Kubernetes environments.

Panoptica ensures comprehensive cloud security compliance and monitoring at scale, offering deep visibility, contextual risk assessments, and actionable remediation insights for all your cloud assets. Sounds pretty darn good. So, powered by graph-based technology, Panoptica’s attack path engine prioritizes and offers dynamic remediation for vulnerable attack vectors, helping security teams quickly identify and remediate potential risks across cloud infrastructures.

A unified cloud native security platform minimizes gaps from multiple solutions, providing centralized management and reducing non-critical vulnerabilities from fragmented systems. Panoptica utilizes advanced attack path analysis, root cause analysis, and dynamic remediation techniques to reveal potential risks from an attacker’s viewpoint.

This approach identifies new and known risks, emphasizing critical attack paths and their potential impact. This insight is unique and difficult to glean from other sources of security telemetry, such as network firewalls. So, this is why you want to take a look at what Panoptica is doing, so go to their website, it’s Panoptica.app.

Go check it out.

It’s time to play “What’s Worse?”

18:17.083

[David Spark] All right, Shyama, you ready for “What’s Worse?” This comes from one of our greatest submitters. I’m going to say I think he has the most submissions of anybody and that is Dustin Sachs over at World Kinect Corporation. Just hang tight.

I’m going to give you two bad scenarios. I’m going to give it actually to Mike first. He’s going to answer which one is worse. Remember, don’t choose the better one, which one is the worst, and we will see if you agree or disagree with what Mike says, and please give your rationale, as Mike will as well.

Just before we were recording, I was taunting Mike though, I should mention to our audience, that Mike, as simple and as clean as this is, I believe, I still believe you’re going to over explain this one.

[Mike Johnson] Perfect.

[David Spark] All right, here we go. Here’s the two “What’s Worse?” scenarios, it’s quick and simple and easy. Hopefully, you’ll get it on the first explanation or the first reading. Scenario number one – identifying a breach quickly but having no incident response plan, none whatsoever; or you got a plan, but you fail to detect the breach for several weeks.

[Mike Johnson] So, this is actually easy.

[David Spark] Okay.

[Mike Johnson] Don’t need to repeat it, but I will explain my rationale. So, the worst one is not having a plan because what happens is you then fumble the plan. Again, these both suck. It would suck to take a very long time to detect the incident. But if you handle it well, that’s what really matters.

[David Spark] Even if it’s weeks late, like say three, four weeks late.

[Mike Johnson] It’s not unusual, and we see this.

[David Spark] But that’s actually probably situation normal then.

[Mike Johnson] That it could actually take that long to recognize that there was something wrong in the environment. But it’s what you do at that point that matters. And if you absolutely fumble it, if you take forever to notify your regulatory authorities.

All of those timers, by the way, start from when you know. It’s not from when the thing happened. It’s from when you know. And if it takes you more than four days to report a material incident to the SEC, or if it takes you more than 72 hours to report it to your DPA in Europe, that’s when the fines really start showing up.

So, it’s really all about the response here. So, as much as it would suck to take a very long time to detect it, I would much rather have a plan and be able to handle appropriately an incident once it happens.

[David Spark] Okay. So, the first scenario, identifying breach quickly but having no incidence response plan is far worse. Through this entire time, Shyama has been nodding her head in agreement, so I’m assuming you’re agreeing that you believe it is the worse scenario, the first one.

Is it the same rationale as Mike, or something different?

[Shyama Rose] Yeah, yeah. I think if a CISO didn’t have that answer, we should probably review their job.

[Laughter]

[Shyama Rose] That is the correct answer all the way around. There’s no way that it could be just not detecting the breach. Because I think the majority of breaches, for the most part, take a long time to detect or longer than we would like. They’re generally never instantaneous, so we’d love to get our time to detection that low, but that’s never the case.

So, I think the response piece is where we all get judged in the public court. And that is where the reputation of the company and even on a regulatory perspective, if you have a horrible breach and it’s the worst ever, if you handle it the best way possible, then it’s likely that you’ll be forgiven even on the regulatory perspective too.

So, it’s about doing the most reasonably good thing possible.

How can we align different departments’ objectives?

22:04.219

[David Spark] If your company has a CISO, they’re tasked with information security. If you have a data protection officer or DPO, they’re tasked with protecting data. But as Fabian Weber of PCG Germany pointed out in a post on LinkedIn, integrating information protection and data protection sounds like a good idea, given that they often work with similar controls.

But the DPO is usually a lawyer, often with different goals than the CISO. Given that the CISO is usually technical, this may result in professional distance, and often the two are trying to achieve similar goals in parallel. So, Mike, I know that you used to respond to the legal team.

In fact, that’s who you reported to directly. Were you tasked with data protection? Have you seen failures to connect, or do they see eye to eye? Where are the synergies? Where do things fall apart?

[Mike Johnson] So, I reported to our general counsel. There was a separate team, a peer team of mine, that was the law team, the legal team. And there was another one that was data governance. We had multiple teams that had these responsibilities. But what we did was we worked very closely together through that partnership.

We recognized what each of us had from a priorities perspective, what we were doing in the coming year, if there was something going on in the environment, be it an incident or a business direction change, we would get together and have those conversations.

We didn’t always see eye to eye. You bring different perspectives, and that’s a good thing. But because we had the partnership, things worked out. So, I think one of the things that I think is a challenge or concern is what Fabian pointed out about having different goals.

We all have the same goal. The same goal is to make the company successful and to help the company manage its risks. Whatever direction you’re coming from in any of these roles, that’s what you’re trying to do. So, we have that baseline set of expectations upon us and we just need to work together, and it can all work out.

So, I don’t see it as a challenge to have these be different roles, and in fact, I think it’s a good thing because you get different perspectives.

[David Spark] Which is something you’re always looking for as you’re building a security program. So, would you agree, Shyama, that this kind of relationship, a legal and cyber relationship, is the ideal situation here?

[Shyama Rose] Yeah. I think staying close to your legal team is extremely important, especially when we’re talking about incident response or response notifications and whatnot. But that being said, I also at one point used to report into the general counsel as well too.

So, I definitely understand that relationship and the benefits and drawbacks of it. What I thought was kind of interesting at the time was that sometimes, the GC and folks on their team may not have data privacy or the consumer privacy focus in mind, even though they are responsible for it.

It’s fairly new for them. And as you said, the regulatory landscape is evolving across the entire world.

So, there’s pieces of it that I think that we can do as security people to bring our security experience to them and maybe help try to predict some of the pitfalls of doing it wrong and what we’ve seen that help them understand it from a real-world perspective, so we can take that technical piece out of it.

And we say, “These are the types of things, these are the types of scenarios that cause an adverse external reaction, perhaps regulatory fines, and helping to educate them in that way as well too. So, it’s not just about them interpreting the laws and regulations to us, but actually helping them weed through the fine print of those regulations and see what the intent of them are.

Because privacy, of course, and security go hand in hand. A privacy breach isn’t necessarily always a security breach, but generally sometimes the other way around can be true. So, I do think that our slice of that pie is a little bit longer-lived in the world than the privacy angle.

Here’s some surprising research.

26:14.560

[David Spark] We talk about the impacts of burnout all the time, but mostly how it impacts an individual’s career or the cybersecurity job market. But what about the actual security of an organization? AI TechPark recently shared a survey from Devo Technology that found that vast majority of respondents said that burnout with themselves or a peer led to errors that played a part in a security incident.

Most respondents said work-related stress impacted their ability to keep customer data safe. Many respondents said they feel disconnected from leadership and that this type of stress was considered “normal” in their role. You’re supposed to be stressed out, hey.

So, I’m going to start with you, Shyama. What do you consider normal stress in security? Because I guess it is a stressful job, and people need to know what they’re signing up for. Should employees expect it? And if not, this job’s not for you? I mean, do you say that?

Or how have you seen stress impact your security team’s performance? Because I can totally see if people are stressed out, they just cannot focus on doing their job, and then mistakes happen. So, what’s your take on acceptable stress and what people need to know to deal with.

[Shyama Rose] I want to take even a little bit more of a step back than it just being a security or IT stress scenario that we’re kind of under. I think this whole year, past couple of years even, have been stressful for everybody, and it’s not just a security thing.

I think that that stress on top of the COVID thing and the economy thing and all the companies’ layoffs, RIFs, companies just trying to stay above water in some sense, that all of that stress is now compounding the stress that security and IT people have to deal with day to day anyway.

So, everybody’s, I think for the most part, and I’m not just talking about my current space, but from what I’m seeing throughout the entire security sphere, is that everyone’s just a little bit drained. And to me, there’s a piece of that that’s normal.

We know when we get into security that this is a hard job, and everyone tells us this is a hard job. It’s the role and responsibility of the leader running those organizations to be able to throttle and manage and take the temperature of that stress level and figure out when it’s just a little bit too high.

And you see that when folks start dropping off in engagement, or you see that when things tend to go sideways in some kind of a response scenario. So, it’s up to us, really, to be able to figure out what that threshold is and manage it appropriately.

And managing it can be really tricky because it’s not just about throwing people at the problem. It’s really about dissecting the problem itself and determining whether or not it’s a resource issue, a process issue, or it’s just a general morale or focus issue.

So, that’s how I like to break it down, personally. I do think that there’s a piece of this job, and I would never tell anyone, “Go take up bowling instead of security because you can’t cut the stress level.” I’ll say, “Let’s figure out how to manage this, but please stay in it.

We need you to stay.” But I think there’s a piece of it that is implied, as you said, that this is hard and this is stressful, but some of us love that and thrive on it too, and those are the people that really get far.

[David Spark] By the way, I’m bringing it back, Mike. I’m going to make a reference to pinball. I often get up and play a game of pinball to release a moment of stress because it’s a very physical game. All right.

[Mike Johnson] Awesome.

[David Spark] It’s not bowling though. All right, Mike, I think I love Shyama’s response of like, it’s kind of the CISO’s job to manage it and to essentially work the throttle of when they’re seeing the stress affecting the team. I mean, is that a key part of your job, managing the team’s stress and watching it?

[Mike Johnson] I think that should be expected of any manager, people manager, any leader. That is absolutely part of the job is to help manage the stress levels of your team. One of those areas where things can get out of hand is when the stress just keeps coming in waves, it just feels like you’re not going to get a break.

It’s one thing when you’re saying, “Okay, I just need to get through this, and then it’ll be better, and I can relax.”

[David Spark] Oh, by the way, we’ve all fallen into that trap.

[Mike Johnson] Exactly.

[David Spark] I’m a sucker for that trap. [Laughter]

[Mike Johnson] But frankly, it’s a coping mechanism, right? And if you don’t see that there’s an end in sight, if it feels like it’s just going to be there forever, that’s when things really spiral downward, that’s where people make mistakes, is it just becomes too much at that point.

We throttle as best as we can, sometimes, and again, you hope these are rare, there’s situations where we just don’t have control over it. It could be an incident. It could be a change in the business. There’s any number of ways that situations that are not necessarily within our control, which makes it all the more important to manage those that are in our control.

Closing

31:34.283

[David Spark] Well, that is a good point to wrap up this episode. I want to thank you, Mike. I want to thank you as well, Shyama. And I want to thank our awesome sponsor, that’s Panoptica. Remember, you’re supposed to go to their website, Panoptica.app.

That’s Cisco’s cloud application security solution, provides end-to-end lifecycle protection for cloud native application environments. I know many of our listeners are in that space or have cloud native application environments, so why not have a better protection around it?

Panoptica.app, check it out. Shyama, I’m going to let you have the very last word here. But first, Mike, any last thoughts on today’s episode?

[Mike Johnson] Shyama, thank you so much for joining us. I know you said it was your first podcast. You feel like a veteran. You did great.

[David Spark] No one would believe you! No one would believe you!

[Mike Johnson] No one would know. No one would know. So, thank you so much for joining us. One of the things I really liked that you said, I really want to call out was in our “What’s Worse?” scenario. You’d pointed out that response is where we are judged, and you are so right.

I think so many people lose track of that, and so thank you for calling that out specifically. But thank you for joining us. It was wonderful having you on the show.

[Shyama Rose] Thank you so much for having me. I had so much fun, and you guys are wonderful. So, thank you for having this platform for CISOs and everyone else to listen.

[David Spark] Excellent. Well, thanks again to Shyama. Thank you again to Mike. Thank you to our audience. We greatly appreciate your contributions and for listening to the CISO Series Podcast.

[Voiceover] That wraps up another episode. If you haven’t subscribed to the podcast, please do. We have lots more shows on our website, CISOseries.com. Please join us on Fridays for our live shows – Super Cyber Friday, our virtual meetup, and Cybersecurity Headlines Week in Review.

This show thrives on your input. Go to the Participate menu on our site for plenty of ways to get involved, including recording a question or a comment for the show. If you’re interested in sponsoring the podcast, contact David Spark directly at David@CISOseries.com.

Thank you for listening to the CISO Series Podcast.