The hype around generative AI tools makes it seem like these are a totally new technological challenge for cybersecurity. But in reality, many of the challenges with securing them are the same that we’ve seen from the rise of SaaS and proliferation of shadow IT. So what lessons from that transition can we apply to AI?

This week’s episode is hosted by me, David Spark (@dspark), producer of CISO Series and Brett Conlon, CISO, American Century Investments. Joining me is our guest, Mical Solomon, CISO, Port Authority of NY and NJ.

Got feedback? Join the conversation on LinkedIn.

Huge thanks to our sponsor, Living Security

And another huge thanks to our sponsor, KnowBe4

Full Transcript

[Voiceover] Biggest mistake I ever made in security. Go!

[Mical Solomon] The biggest mistake I ever made as a newly minted CISO was setting up a phishing campaign at this company I just started with, and it was around payroll changes and to click the link to change your payroll, but I forgot to call payroll, and I forgot to call the help desk to let them know I was doing it.

[Voiceover] You’re listening to CISO Series Podcast, recorded in front of a live audience.

[Applause]

[David Spark] Welcome to the CISO Series Podcast. My name is David Spark. I am the producer of the CISO Series and joining me on my left is my guest co-host for this episode, who’s been a guest on previous CISO Series show. Big warm round of applause for the CISO for American Century Investments, Brett Conlon.

Let’s hear it for him.

[Applause]

[David Spark] Say hello to the nice audience, Brett.

[Brett Conlon] How is everyone doing today? Thank you for having us out here, even though the weather is not what I was hoping for, but we’ll hope it warms up later.

[David Spark] By the way, we’re in Florida. Do not complain because there are people listening further north who are not experiencing the warmer weather that we’re having down here.

[Brett Conlon] No, no, those were all choices. I chose to live in Florida for exactly a different reason.

[Laughter]

[David Spark] So, they deserve it? Is that what you’re saying?

[Brett Conlon] No, they chose to live there. I chose to live here.

[David Spark] Okay. We’re available on CISOseries.com. If you’ve never been there, this would be a good time to go. Go right ahead. Go check it out. By the way, our sponsors for today’s episode, you can see right there on the screen, it’s KnowBe4 and Living Security.

We are thrilled they’re sponsoring this episode, this live version of the podcast, which I should mention, we are at the Convene Conference in Clearwater, Florida. Let’s hear it for all the people who attended here.

[Applause]

[David Spark] This is an awesome crowd. This is a conference all about security awareness, and I’m just always amused that this is a conference about things that most people pretty much hate to do, and [Laughter] trying to figure out ways to make it more enjoyable, not painful.

But I want to talk about something we discussed over dinner last night that I thought was fascinating and addresses, I think, many issues that came up in today’s conference. And Mical, I’m going to introduce our guest today, He’s the CISO for the Port Authority of New York and New Jersey.

A big, warm round of applause for Mical Solomon.

[Applause]

[Mical Solomon] Thank you. Great to be here.

[David Spark] So, the advice you came up with, which I thought was great, and it had to do with families, but I thought, wait, why couldn’t this translate over to the business? Explain.

[Mical Solomon] So, I’ve worked out something, and this is something we talk about at work a little bit with the senior leadership. We worked out a password, and I do it with the family. We’ve each done it with our family. With the prevalence of AI and the ability to clone a voice these days, the older scam of somebody calling grandma up or mom up and saying, “Hey, I’ve just been in a car accident, I need money,” or “I’ve been arrested, I need money,” or “I’m stranded in a foreign country, I need money,” common theme, is that now those calls come in the voices of the child or grandchild, and it’s a lot harder to tell that there would be something wrong.

You assume, you panic, I’m in trouble, send money. So, we’ve set up a password so that if that’s the case, we’ll use our password, and if you don’t get the password, you’re not getting money.

[David Spark] Right. So, you know whether it’s real or not. And so, how could this translate to business, Brett?

[Brett Conlon] So, I think for businesses, right, I mean, you were starting to see prevalence, especially around, like, call centers and so forth, around how they can use AI and use voices to fool people into authenticating their accounts. And so, how do you create these safe words or passwords or verbal things that can be passed along, and you’re not just looking for voice recognition, but you have to keep this word in a safety area where only you would know it, right, only your loved ones would actually know that word.

So, I think if we…

[David Spark] Or your business partners or your colleagues.

[Brett Conlon] Or the business partner, colleagues, the call center would have that on record and only that name.

Why has this topic suddenly become the center of attention?

4:07.452

[David Spark] Any new technology has the power to be transformative for the business, but at the same time, any new tech presents a new risk. Okay, what technology am I talking about? Is it AI or is it SaaS? Because while the impact and capabilities of both might be different, it seems like they present similar security challenges, both from a policy and an implementation level.

So, employees want to realize the business benefits of AI now and expect security to just catch up. It’s not like we’ve completely figured out shadow IT either. So, listen to this. CSO Online’s Michael Hill pointed to a recent Capterra survey and found that half of SMBs still significantly suffer from trying to manage shadow IT.

I’m going to start with you, Brett, on this one. Have we learned any lessons from shadow IT and can any of them actually apply to AI or LLMs, large language models?

[Brett Conlon] I think we have learned lessons. That doesn’t mean that we’ve implemented those lessons learned. So, I think with the AI revolution coming out and all of this information out there, I think what we are seeing is a strong push to get governance around it quicker.

So, shadow IT sort of got out there. There was a lot of sitting around, waiting, watching, and then it became too big. Companies are still dealing with shadow IT. But now you are seeing with the AI models, there’s a strong push for governance, getting that committee around it, understanding how you’re going to be ethical with AI, and understanding that they want transparency around the models.

So, those are all positive things. But as we are seeing also, is the consumer and the businesses want to adopt this a lot faster than the security teams are ready for.

[David Spark] Good answer. All right, Mical, I’ll throw this same question to you.

[Mical Solomon] Yeah, so I think as an industry, we’re really good at being reactive to things – shadow IT, SaaS security. I think with AI, I’m starting to see a little bit of a difference. We’re trying to get out in front of it. I’ve talked to several organizations that have task forces they’re putting together around it and creating some guide rails.

We know it’s here. We know it’s going to stay. We’ve been through this before with other things, the internet. And so, I think finally we’re getting to the point where maybe not completely, we’re always going to be playing catch up a little bit, but I think we’re doing better now than we had been before.

[David Spark] But is there anything specific that you did implement when you saw shadow IT take off that you’re like, okay, and you succeeded with that, this we can use in AI as well? Anything?

[Brett Conlon] I think for us specifically, we really looked at bringing the AI in-house, shutting down the open-source pieces that were just going out to the public internet. We’re limiting the amount of company data getting out there. So, if you translate that into shadow IT, instead of waiting and finding out that everybody was using the consumer-grade version of Box, and now how do we claw all that data back, we were able to provide them a company version of OpenAI or ChatGPT so that we were beating them to the punch of what they were going to do naturally.

[David Spark] Okay. And what about you? Have you had any success with any specific implementations?

[Mical Solomon] We’re still in the early phases of trying to figure out how to go about it.

[David Spark] It seems like it is. Here’s the thing. Every single conference I go to, so much of the content is on AI. And there’s this theory, oh, well, this will be the conference where the one person stands up and has all the answers. And no insult to Perry, who did give a great presentation, but nobody has all the answers yet.

Like, nobody does. And also, can I also qualify something here for a second? What is this talk about where do you see AI in 5 to 10 years? Really? How about next week? Like, seriously? Did we have a clue what was going on last year?

[Mical Solomon] The question keeps changing. We can’t get the answers because they keep changing.

[David Spark] Yeah. But first of all, have you seen how AI is being successfully implemented as a business tool within your organization, either of you?

[Mical Solomon] Yes. In small bits, we’ve set up a bot for HR so that people can go and look to see how much vacation time. It’s a public organization, and accounting is complicated about vacation days and how many you can group. And if you’ve been hired from a certain date to a certain date, you have this many, and later hires have less.

And so now there’s an AI bot that will do that for us.

[David Spark] You know, that’s not the first time I’ve seen, like, you find sort of the low-level thing you can test it out with. Like I remember with collaborative tools, it was first used for party planning. What about you? Have you seen the business succeed with anything yet?

[Brett Conlon] No. I mean, we’re still very early on in it. We’re trying to make sure, you know, the SEC is coming out with their regulations. We want to make sure that we’re listening to that. But I will say it’s probably one of the first technologies where everyone is cognizant of not putting the wrong data in there and making sure right now that it’s very vanilla data, which is promising for us.

Pay attention. It’s security awareness training time.

9:17.870

[David Spark] Are security teams suffering from understanding the long game with security awareness training? Aggressive efforts to improve user behavior can go sideways really fast, as pointed out by Joan Goodchild in Dark Reading. Now, we’ve seen debatable techniques such as – and you’re going to be all aware of these – phishing tests that promise employee bonuses, generic annual click-through style training, and locking in security awareness around fixed targets rather than adapting to the current landscape.

I’ll start with you, Mical, on this. What are some other ways you’ve seen security awareness go wrong, and where have you been able to improve the model?

[Mical Solomon] I think the big one is using security awareness training as a punitive way. If somebody clicks on a link and then they get in trouble and they do it another time, they get fired, or if they’re late in taking their annual training, and there’s a punitive measure.

That’s the wrong way to handle security awareness training.

[David Spark] By the way, I know of one case where, and we’ve talked about this on the show before, where it was a woman in HR who told me they had a mechanic, so not a knowledge worker, was just repeatedly failing phishing tests, just over and over.

And, again, he was a mechanic, and they fired him because of the failing of the phishing tests. By applause, I’m just wondering, has anyone fired purely on failing phishing tests at all? Has that ever happened to anyone? So, no one in this room that’s happened to.

[Mical Solomon] Good answer.

[David Spark] Yes, good answer.

[Brett Conlon] Well, they said they haven’t. They didn’t say they didn’t want to.

[David Spark] [Laughter]

[Brett Conlon] Does anybody want to do that?

[David Spark] Okay, by applause, how many people wanted to?

[Applause]

[David Spark] Okay, they can’t hear you when you raise your hand. One person is honest in this room.

[Laughter]

[David Spark] All right. All right. So, good example, Mical, and also like the woman who was talking about accounting before of when you screw something up and a payment goes out to a fraudster, they’re like, “That’s one strike, two strikes you’re out,” kind of attitude, and everyone’s in panic mode every time they’re dealing with another issue.

It’s got to be handled better than that. Brett?

[Brett Conlon] I think to add on to that, metrics became a problem. We looked at the wrong metrics, right? We are really looking at the who failed. We don’t look so much at who’s reporting. We’re not looking at the numbers that are representative of is the culture that you want trending in the right way.

We’re just looking at are we still getting negative numbers. And so anyone who’s been in this industry for a long time, I can get anyone to fail a phishing test. That is not that difficult. What I want to do is make sure that I can get that culture going in the right direction, that it’s aligned with the business, and it’s aligned with the behaviors that we want to see.

I’m not a strong person in the punitive pieces, but I think there’s ways that we can reward and engage them to make it a positive experience, and that’s what we usually focus on. I think the punitive and when the metrics are all designed around the fail, that’s where I’ve seen it go wrong.

[David Spark] Mike Johnson, one of my regular co-hosts of this show, I’m going to say something that is heresy for this room but get ready. He does not do phishing tests. He does not like them at all. All right. So, many of you, don’t think about selling to him.

He doesn’t like them at all, and he thinks there’s a better way about it. So, again, I know this is heresy, what I’m saying here. Mical, if you were not to do any phishing tests, how would you increase security awareness?

[Mical Solomon] I think you have to go back to what people are susceptible to. We may not be able to phish them, but the threat actors are phishing them every day, all day long. So, what’s causing them to click? You have to do some more analysis at that point and figure out what the motivation is, what particular email got to them.

And we do that. When we phish now, we phish with actual emails that got through that people clicked on. And so we’re not using templates. We’re not using standards. It’s the stuff that works.

[Brett Conlon] I think, again, I’m going to go back to how do we make it where we engage with them, and they feel that they’re learning something in the process. So, phishing doesn’t really necessarily meet that, but I do think you can make it a fun, engaging, cultural thing that they actually enjoy going to.

So, I’ll give an example. Every year we do a Jeopardy game show. The first year I came to American Century, we had 50 people sign up, and that’s because we capped it at 50, but another 100 people watched. Now, if you look at it in terms of the overall organization, you’re still saying, well, that’s still a small amount.

Yeah, but we were only there for a few months, and 100 people chose to watch a cybersecurity game show. So, how do you keep doing that where they learn things along the way? And then we just consistently reinforce things throughout the year, and I think that that makes it a little bit more engaging, and we have an open-door area for them to come and talk to us about any issues that they’re seeing.

Not even work-related. They’ve run into something on a personal level, they reach out, and we walk them through it, and that does a long way of creating that culture and positivity.

Sponsor – Living Security

14:31.593

[David Spark] We have a couple of great sponsors for today’s episode and let me tell you about one of them. That would be Living Security. Living Security is the global leader in human risk management. Their HRM platform, human risk management, HRM, play along.

Their HRM platform, Unify, transforms human risk into proactive defense by quantifying human risk and engaging the workforce with relevant content and communications proven to change human behavior. Living Security solves the challenges of human risk through risk identification, awareness and training, and risk reduction.

All through their integrated platform. Very cool. Living Security is trusted by security-minded organizations, including Mastercard, Verizon, Biogen, AmerisourceBergen, and Hewlett-Packard. Learn more by just going to their website, pretty easy, livingsecurity.com.

It’s time to play “What’s Worse?”

15:38.744

[David Spark] All right. Now, for those of you who are familiar with the CISO Series, you know we play this game on every episode. And during live shows, we play it twice. All right. So, here’s how the game is played. I’m going to present two horrible scenarios to my guests.

They have to pick which one of the two is worse. Okay? You’re not going to like either, but one of them is a worse scenario. So, I’m going to start with you. This comes from Olivia Phillips, who is a security professional over at Amtrak, and here it is.

And I’m going to just warn you, these are pretty awful. All right? Here we go. And by the way, I’m going to want you to vote as well along. So, after they enter, through your applause. Don’t, by the way, I always have to point this out at live shows, my microphones cannot record your raising of the hands.

So, make sure you applaud, not raise your hand at that point. All right. Here we go. Are you ready, Brett? Brett’s going to answer first.

[Brett Conlon] I’m sweating. Go ahead.

[David Spark] Here we go. Scenario number one. A disgruntled employee steals badge information and sells the data on the dark web, which compromises everyone’s badges. You have no badge access monitoring, no alerting, no cameras showing access to the server room, and no information was identified until after a major incident of a fake employee entering a server room and plugging in a laptop installing viruses on your internal network.

Pretty awful, yeah?

[Brett Conlon] Mm-hmm.

[David Spark] All right. It’s possible option two is going to be worse. It’s bad. Get ready. The FBI contacts you, the CISO, stating they have identified a server that is hosting pornography to the extent of holding 3,000 videos that are part of an investigation on a major court case that is being televised.

The owner of the server is the president of the company and is paying an engineer to hide and keep the server up and running. This is, I guess, a side hustle for him. All right. After investigating, you identify that the SOC was aware, and they said nothing.

All right. Let’s hear it. Which one’s worse?

[Brett Conlon] I’m going to go with the second one, the porn one.

[David Spark] Okay. Just because of the…

[Brett Conlon] The CEO’s tied to it and knew about it, and the SOC knew about it, so we’ve got a whole bunch of problems there.

[David Spark] Yeah, because it’s essentially you’re very clearly at fault.

[Brett Conlon] Correct, and very clearly aware.

[David Spark] Yes. [Laughter]

[Brett Conlon] Yeah, “What? Who? What?” Do we name these people so we just know who to steer clear from in social events? This is very deranged.

[David Spark] It’s Olivia Phillips from Amtrak.

[Brett Conlon] Okay, all right, all right.

[David Spark] She is not a deranged woman. I’ve met her.

[Brett Conlon] This is a great one.

[David Spark] In fact, let me also point out that I kept pushing Olivia to give me a better answer. She actually didn’t give me a good answer the first time, and then this one, she knocked it out of the park.

[Brett Conlon] She did. This is great. I’m still choosing the second one, though.

[David Spark] Okay. Because, again, why is it worse?

[Brett Conlon] The CEO was aware, and obviously partaking in it. Security was aware and did nothing about it. And therefore both the company, the CEO, and the team is all in trouble.

[David Spark] Right, but what’s going to do more damage to the business? It’s possible scenario one’s going to do more damage. Think about overall the… Like, for your reputation, second one’s bad, but the first one, installing viruses on your internal network could literally be stealing money from you, and the business could be a situation.

You’re still going with two?

[Brett Conlon] I still go with two. I think that that’s still going to hurt your company inside and out.

[David Spark] All right. I’m throwing this one to you. Again, the first one, I think, could be more damaging financially to the business.

[Mical Solomon] I agree. I think from an external perspective, there’s more harm done to the business with the first scenario. Although in the second scenario, if the FBI decides that there’s something criminal and they take away the CEO, the business is done anyway.

[David Spark] Right.

[Mical Solomon] But I think the first scenario is worse.

[David Spark] Okay, all right. We got a split decision. All right, now this is where I come to you. So, the first scenario, remember, it’s the badges are gone, someone comes in, installs malware, and who knows what happened to your network. By applause, how many people think that’s the worse scenario?

[Applause]

[David Spark] I’m going to give that about a 15% to 20% of our audience. Okay, by applause, how many think the hosting the pornography is worse?

[Applause]

[David Spark] All right. Okay, so…

[Mical Solomon] 1-0, Brett.

[David Spark] All right. So, okay, here we go. Let’s go to the second scenario here. This one’s a little shorter. This one I like though. This one’s more entertaining. This comes from Elliot Lewis, who’s actually been a frequent guest on the CISO Series.

All right, and actually I’ll have you, Mical, you’re going to answer this one first. What’s worse? You filter all users email to junk by default and have the users pick and choose what’s not dangerous. All right? Or you set up a program for all users to practice social engineering on each other so they can learn from experience, and whoever gets the most passwords wins the corporate bonus.

Which one’s worse?

[Mical Solomon] I kind of like the second one, so I think the first one is worse.

[David Spark] Yeah?

[Mical Solomon] [Laughter]

[David Spark] You think that? So, they all have to figure it out by junk email? But then again, the animosity that’s created by the second one, it’s actually going to be two because you’re going to actually find the people who are the best at this.

[Mical Solomon] Yes.

[David Spark] But you’re going to create animosity with the rest of the company.

[Mical Solomon] The first one’s worse because what’s going to happen is nobody’s going to go into the junk mail, no email’s going to get read, and no business is going to get done.

[David Spark] Okay. Oh, that’s a good point right there. All right. Agree or disagree with that one?

[Brett Conlon] I’m going to disagree. I’m going to say the second one is worse. The second one is causing a behavioral change where people are not going to trust anything they’re receiving at all, where the first one is going to be more tedious and annoying, but they’re still going to go into that email box to try to figure out what they need to see.

The second one is really just creating a atmosphere where they’re not going to trust anything, and they are just going to send it all to security. So, I’m going number two.

[David Spark] All right. Let’s throw this to the audience. By applause, how many people think the first scenario, that being filter all the user’s email into junk and let them figure it out, how many people think that’s far worse? By applause.

[Applause]

[David Spark] All right. This is a little bit more on the first one, and by applause, how many people think the second one, where it’s essentially a battle royale and having everyone at it, is worse? Second one?

[Applause]

[David Spark] Second one wins again here.

[Mical Solomon] Two-O.

[David Spark] All right. Excellent job, everybody.

Does shaming improve security?

21:58.374

[David Spark] I think this is a very important question, and that is, at what point can we blame the user? There’s got to be a point we can truly blame the user. Right? So, this is my grand philosophical question here. So, “When they’re doing their job, never,” said my other co-hosts on this very podcast, they can’t blame the user.

They argue that if a human is doing their job and there’s a security breach, that’s a failure of the company’s security architecture. The organization didn’t design security to be resilient in the first place, and this all comes back to combating unintended behavior, said Kelly Shortridge of Fastly in a recent blog post.

Let’s boil this down from an architecture level. What aspects – I’m going to start with you, Brett, here – need to be addressed by the security program? The tools, the fail safes we have in place, and where do we have no choice but to rely on the employees?

[Brett Conlon] Okay. So, I think that when it comes to the security program itself, having that awareness program and having least privileged in place are probably the two biggest things that I would expect the security program to have. At that point, it is on the user, so I can’t say that you don’t get these privileges to do your job, and if they fall for something or their account is compromised or for whatever reason, I don’t think that comes back on the program.

Now, if the least privileged is not there and that culture and awareness is not there, then I think it comes back to the security program. I will say I still don’t want to go the shaming route, but I do think there’s an accountability piece that has to be on the user.

[David Spark] All right. We’ll delve into that in a second. All right. So, let’s talk about just security architecture here, Mical. What needs to be in place?

[Mical Solomon] Brett’s right. I agree with most of that. Also, the monitoring piece, and we’re very strong in our monitoring. So, if somebody does click on a link and does download some malware or gets compromised in some way, our CSOC, which is 24-7 security operations center, gets an alert right away, and they catch it before anything bad happens.

And that may happen maybe once every couple months we see something, and it doesn’t ever go anywhere. So, I think the monitoring is as critical as everything else.

[David Spark] All right. So, let’s get back to what you were saying. I mean, I guess this dividing line between blaming and accountability, let’s walk through that. Where can we sort of ride that line?

[Brett Conlon] Gosh, that’s a great question, Mical.

[David Spark] [Laughter]

[Mical Solomon] I don’t think that we should be blaming the employees unless there’s a malicious act.

[David Spark] Yeah, okay. We’re going to take malicious act off the table. We all assume malicious act, yes.

[Mical Solomon] I think that it’s really the responsibility of the cyber team, cyber awareness, having the controls in place, the technical controls, having governance in place, and having training in place. And after that, we can’t blame the employees.

[Brett Conlon] Yeah, so I’ll give you some accountability examples.

[David Spark] Okay.

[Brett Conlon] Where I feel that these are things where everything was in place, and we still took an extra step. So, I’ve run into, in the workplace, where someone came in, and so our monitoring caught it. I think that’s a great addition, monitoring should be there.

And the person deployed malware, and thankfully we caught it and stopped it. And when talking to them, it was, “Yeah, you know, I was at home. It kept doing this weird thing. I know it didn’t seem right. I didn’t even expect an email. I don’t even know this person.

I don’t know why I would have a bill. But I went ahead and then sent it to my work email so that I could click it here to see if the Adobe PDF would work.” There has to be a level of accountability. And so when you’re sitting here going, “But we trained on this.

We talked about this. We’re doing this. You’re seeing that it’s not behaving properly on your home computer. So, you sent it to work to click on?” Like, that’s that accountability piece of that.

[David Spark] I can see for a second why someone would do that. I’m not saying it was smart, but people think, well, my work has better security setup than my home, so it would probably be handled better there. Don’t you think that’s kind of going through their head?

[Brett Conlon] No. I think it’s they have more tools on their work computer to get the file to open. I do.

[David Spark] Okay.

[Brett Conlon] I think that this particular person, they wanted that PDF to open. They didn’t have Adobe on their home PCs. They’re like, “Well, I’ll just bring it into work.” I think we see examples where, despite being told how many times, don’t enter your password, nobody will ever ask for your password, right away, Microsoft, “Hey, just give me your password,” right there.

And so those little things, I think there has to be an accountability for. We have to find a way to hold them responsible.

[David Spark] I’ll tell you a quick story. I’ve mentioned this on the show before. I went to go to a Boost Mobile store to essentially open up an old phone I have to give it to my son. And the woman who was working at the store, these are the kind of pay-as-you-go type phones, and she said, “Oh, what’s your PIN number?” And I said, “Well, I’m not giving it to you.” And I go, “Give me my phone back.” And I entered it in, I handed it back to her.

And then I said, “How many people just give you their PIN number when you ask for it?” She said, “Everybody. Everyone does.” That’s what you’re dealing with. Literally everybody does that. [Laughter]

[Brett Conlon] That’s true. Good point.

[David Spark] So, you’re fighting that.

[Brett Conlon] Yes. Yes. Yes. I have nothing. I have so many things to say on this, but I’ll tell you, I was telling it last night, I’ll tell this really, really abridged funny story. And if my wife is listening to this, I’m in so much trouble. But I get this call from my son, or a text message from my son because the police are calling him.

He has to show up to court. He’s 15. He doesn’t have to go anywhere. Like, “Well, where’s your mom?” And “No, no, no, she’s the one who’s in trouble.” I said, “Tell your mom to hang up. This is like a scam.” They didn’t listen to me. They stayed with the scammer.

[David Spark] Hold it.

[Brett Conlon] Yeah.

[David Spark] They do understand what you do for a living, right?

[Brett Conlon] Apparently. I mean, my son…

[David Spark] They think the anonymous person on the phone who claims they’re a police officer is a police officer.

[Brett Conlon] Wouldn’t give them their first name, but they chose the scammer over me. Until I could finally get my daughter to take the phone on FaceTime to my wife to say, “Please hang up,” the scammer won. So, that is what I’m dealing with at my house.

[David Spark] All right. Well, so you know what you’re dealing with.

Sponsor – KnowBe4

28:28.193

[David Spark] Did I tell you we have two amazing sponsors? Well, now you’re going to get to learn about the second one. It’s KnowBe4. All right? So, I think we all know KnowBe4. KnowBe4 is local to this area, by the way. We’re in Clearwater, Florida.

So, experts often agree the advantage goes to the attacker when it comes to cybersecurity. And the attacker can keep trying and probing at low risk and low cost, and the attacker only has to be successful once. We all know this. And as our sponsor KnowBe4 points out, email filters designed to keep malicious spam out have a failure rate of 7% to 10%.

Sounds low, but no, that can be business crippling. Because if your technical defenses fail in 1 out of 10 tries, you’re out of luck and you may be out of business. Your best last line of defense is your human firewall. We’ve been talking about it today at the show.

You can test that firewall with KnowBe4’s free phishing test, which you can order up at KnowBe4.com/phishtest.

Attention CISOs. Your expert opinion is needed!

29:55.779

[David Spark] So, we’ve been doing this show for close to six years, and new year predictions in cybersecurity follow the same pattern. Remember last year? Expect the same, but a lot more. So, an article on IT Business Canada asked vendors their take, and actually it wasn’t more of the same.

We got a little bit different here. So, I’m going to go over three of them here. Rubrik CISO Michael Mestrovich thinks we’ll see more emphasis on resilience, and we’re definitely seeing that trend as threat actors continue to abuse valid credentials for access.

ImmuniWeb’s Ilia Kolochenko downplayed fears that generative AI will give threat actors an asymmetric advantage. Instead, fear your own developers leaning on AI to create poor quality code. Very good point. And Etay Maor of Cato Networks sees organizations shifting to robust but simpler management interfaces to ease security responsibilities on rank-and-file employees.

So, I’ll start with you, Mical, on this one. Curious what you think of these, but more importantly, what will you be doing this year that you didn’t do in 2023?

[Mical Solomon] Well, I think first thing, we’re refreshing our policies so that we’re bringing into account certain things that just did not exist prior to last year, AI being a big one. And then on top of that, I think it goes back to simplifying. I like that idea of simplifying management interfaces.

We’re also maturing our metrics program so that not only is the interface simpler, but how we’re reporting and seeing the information is a lot easier. So, I think those are the big differences that we’re doing.

[Brett Conlon] Yeah, actually, two of those are the exact same things we’re focused on – getting the AI policy up and running, looking at all of our policies to see what needs to be modernized or revamped to look at what we have going on this year. And then figuring out how we can better monitor the AI usage, especially around what developers are doing and so forth.

We’ll be looking at that closely. But I do think still the threats are really going to remain the same, which is most of it’s going to be low-hanging fruit. What’s there, what’s obvious, what makes it very easy for them to successfully carry out their attack.

[David Spark] I’m going to quote, and again, I don’t know who said this, so my apologies, but I’ve said this before. One great quote I heard someone saying about the Black Hat Conference, which is often to learn about new threats out there, their comment was, whatever you were worried about before Black Hat is the same thing you’re going to be worried about after Black Hat as well.

I’m interested to know, have you ever gone to an event like this or a Black Hat or RSA and said, “Oh, I learned about something new,” and you do learn about something new, “But I’m shifting our security program because of that,” and if so, what was it?

[Mical Solomon] Yeah, I don’t think I’ve shifted strategy, but I did come away with some tactical. For instance, certain indicators of compromise that we were not looking at before that we started looking at as a result of a presentation.

[Brett Conlon] I will say I got the opportunity to be in Switzerland with Tim Brown, who’s the CISO at SolarWinds.

[David Spark] We have had him on before. He is awesome.

[Brett Conlon] He is a great guy. If you haven’t had a chance to meet him, he’s phenomenal.

[David Spark] And we had an episode, well, actually, we did it twice with him, but we have an episode of Defense in Depth where we talked about dealing with intense CISO stress. It’s an unbelievable episode. I highly recommend listening.

[Brett Conlon] Yes. Please, if you haven’t, please take the time to listen to that one. But I think he had a really good point of, we do a lot of these kind of conversations, but very rarely do they talk about what are you actually doing in the moment of a breach that actually could pay off and help to be more fortifying in the future?

And we still don’t do that. So, we think even while we were there, MGM got hacked, and we sit there and sort of say, “I can’t believe they did this,” or “Oh, it was through this,” or “You didn’t have segmented networks,” but we don’t really talk about what did they learn during that breach that will help us actually better fortify.

It’s sort of kept very quiet, or we just don’t want to talk about it because we’re ashamed, but a lot of it comes back to the same stuff. So, I think that is one thing where I had a really good talk with him, and there’s a few things that we altered based on that, but I do think that those are the areas that I would like to see the conversations increase on.

[Mical Solomon] I think you’re right about the shame, but it’s worse than that. It’s really about liability, admitting liability publicly, and you have to be careful, you don’t want to get in trouble with the attorneys or the regulators. But I agree.

We have to change the paradigm in security. A lot of us came up through IT, where it was job security if you didn’t talk about what you did. So, it’s a big shift for a lot of us to be more open, especially around something around security.

It’s time for the audience question speed round.

34:49.517

[David Spark] All right, I have in my hand a whole mess of index cards of questions from you, the audience, right here. And with the little time we’ve got left here in the show, we’re going to go through as many questions as possible. So, here we go.

Just I want quick answers, as quickly as you can to these so we can get through some more questions with the time we’ve got left. All right. This one comes from Demi Cordon from CybeReady, and this is extremely relevant for this audience. If there’s one answer you’re eager to hear, especially the sponsors, this is the one you want to hear.

When there are so many security awareness vendors, Brett and Mical, what are your key decision points for deciding who to go with?

[Brett Conlon] I really like it where they’re very clear on what their product pitch is. So, sometimes I can see during the product pitch we expand what our feature sets are, and we sort of drift away, just because you’re trying to get me to come into and talk and get that 10 to 15 minutes.

But if you’re just very specific and you’ve mastered that elevator pitch about, “Here’s what we’re really good at, here’s where we’re going, but this is our bread and butter,” I really think that that helps me to figure out if I need it or not. And if I don’t, the people who sit there and say, “Okay, well, thank you, and if you ever need us or anything,” that sort of resonates a little bit more than the person who then tries to refine the pitch and change what the product does, and then I usually sort of write it off.

[David Spark] But you’re not going to say specifically the variables that you look for because you dodged a little bit the question there. Mical’s going to be up front.

[Mical Solomon] Two things I look for, integration with my existing tool set.

[David Spark] That’s a big one we always hear, yes.

[Mical Solomon] And the second one is, what separates you from the competition? What do you do better? What am I going to get with you if I go with you that I’m not going to get somewhere else?

[David Spark] All right, quick question here. What is the one thing, if you could just pick one thing your employees do, if you could just get them to do this one thing differently – by the way, this comes from John Checco of ISSA – you can get your employees to do one thing differently, what would you like them to do?

[Brett Conlon] All right, go for it.

[David Spark] Just quick, quick answer. You want them to do one thing, and that is?

[Mical Solomon] There’s so many things.

[David Spark] Got to pick one. But think of one, one that’ll have the biggest impact.

[Mical Solomon] Show up to work, we’re doing still remote. And so, I think that’s okay for 60% of the time, but there’s certainly advantages in our business to be on site, talking with each other throughout the day, not on Teams.

[Brett Conlon] Yeah, use a strong password, a real one.

[David Spark] A real password, not your pet.

[Brett Conlon] Right.

[David Spark] Okay. All right, from Oz Alashe of CybSafe, he asks, this is an interesting one, what constitutes a successful human cyber risk reduction in your world? Either one, jump in.

[Brett Conlon] For me, that they readily reach out to tell us about things that they’re seeing, whether they know if they’re something or not.

[Mical Solomon] Yeah, I agree, and more specifically, report something. If you click a link, call us and let us know.

[David Spark] Meaning that the more of that you get, that is an identification of lower risk reduction.

[Brett Conlon] Yep, I’ll add one other thing to that. When security is actually invited to the different business areas to just be part of, not come in to do a pitch, but just be part of what their goals and objectives are, that’s another area where I know we’re reducing risk.

[David Spark] Oh, very good point. All right, from Rory Harlow of Ally Security, one thing you would like to change about the vendor questionnaire, just pick one, the vendor questionnaire experience, to make it more valuable to you. If you could just change one thing about the experience, what would you like to do?

[Brett Conlon] Reduce the amount of questions.

[Mical Solomon] Absolutely.

[David Spark] How many questions do you think you need to then say, “All right, I got enough information”? Ten questions?

[Mical Solomon] I think we need more than 10, but less than the 100 we ask. [Laughter]

[David Spark] So, pick a number, pick a number.

[Mical Solomon] Oh, 20.

[David Spark] Twenty, all right, so we’ll split it on 15. All right, here we go. Todd Swartzman of RealTime says, are you sharing information with your competitors? If so, how is it being shared more timely so it’s more actionable? And if so, all this, how do you recommend the rest of us share information?

[Brett Conlon] For us, we share through FS-ISAC and any of the other, like the ICI community and so forth.

[David Spark] But how specifically are you doing it so it’s timely, so people can actually… Because the complaint that Todd was saying is, you can have really accurate information that’s a year old, or you can have crappy information right away.

[Brett Conlon] I don’t have a good answer for you on that one.

[David Spark] All right, well, Todd, you’re screwed.

[Mical Solomon] We’re not meeting that speed, yeah.

[David Spark] What do you think?

[Mical Solomon] We have regulatory reporting requirements, so almost instant. We report to CISA and to ISAC, and that happens about the same time I get alerted. So, it’s a runbook in our instant response program, and it happens whether I’m here or not.

They just make the call.

[David Spark] All right, last question. Here we go. I want quick answers to this question. It comes from Deanna Caputo of MITRE. Why are humans not the weakest link?

[Laughter]

[David Spark] Oh, come on! Guys, you’ve got to jump in faster than that.

[Brett Conlon] That’s a good one, right?

[Mical Solomon] I’ll jump. It’s an opportunity for them to be our strongest advocates and evangelists for our organization, for the cyber organization.

[Brett Conlon] The humans are our best defense as well, right? So, they’re not really the weakest link. They’re our first and last line of defense. So, therefore, we need to make sure that they’re ready to go and understand all the differences in what’s going out there.

[David Spark] That’s correct. It was a softball question. There you go!

[Applause]

Closing

40:36.664

[David Spark] All right. Well, let’s hear it for our two guests, Brett Conlon and Mical Solomon!

[Applause]

[David Spark] And let’s also hear it for Cliff and Lisa, who’ve been running this awesome conference, the Convene Conference as well. Come on, let’s hear it for them.

[Applause]

[David Spark] They’ve been doing an awesome, awesome job. And I do want to hear a big, warm round of applause for our two spectacular sponsors. That would be KnowBe4 and Living Security. Let’s hear it for them!

[Applause]

[David Spark] I want to thank everybody for coming on out to supporting us. I greatly appreciate the National Cybersecurity Alliance for bringing us out. They are, if you’re not aware, they are responsible for the site staysafeonline.org. Please check that site out.

Use it as a resource. It is an amazing resource, and they’re constantly updating it as well. Again, warm round of applause for Brett Conlon, Mical Solomon. We are the CISO Series. We greatly appreciate your support, your listening to the show, and your contributions.

Thank you for listening to the CISO Series Podcast.

[Applause]

[Voiceover] That wraps up another episode. If you haven’t subscribed to the podcast, please do. We have lots more shows on our website, CISOseries.com. Please join us on Fridays for our live shows – Super Cyber Friday, our virtual meetup, and Cybersecurity Headlines Week in Review.

This show thrives on your input. Go to the Participate menu on our site for plenty of ways to get involved, including recording a question or a comment for the show. If you’re interested in sponsoring the podcast, contact David Spark directly at David@CISOseries.com.

Thank you for listening to the CISO Series Podcast.