Retaining cyber talent isn’t easy. Organizations often don’t know what keeps an employee from going elsewhere. Compensation is always important but often not the only factor in retention. So why do organizations often not prioritize what matters most to key employees?

This week’s episode is hosted by me, David Spark (@dspark), producer of CISO Series and Andy Ellis (@csoandy), operating partner, YL Ventures. Joining us is our guest, Joshua Brown, vp and global CISO, H&R Block.

Got feedback? Join the conversation on LinkedIn.

Huge thanks to our sponsor, CyberMaxx

Full Transcript

[Voiceover] What I hate about cybersecurity. Go!

[Joshua Brown] Yeah, I think the thing I hate the most is the gatekeeping. We are in an industry that has had a perennial shortage of talent. The numbers vary wildly, but you hear just constantly people applying for these roles. “I’ve applied for 100 jobs. I’ve applied for 200 jobs. I haven’t got a single callback.” And we, as an industry, are complaining that we can’t find the right people, and yet we’re not willing to open the door for people that are kind of nontraditional to come in.

And that’s something I’ve done in my department, and it’s made a huge world of difference.

[Voiceover] It’s time to begin the CISO Series Podcast.

[David Spark] Welcome to the CISO Series Podcast. My name is David Spark. I am the producer of the CISO Series. And joining me as my cohost, guess who it could be. It’s usually one of two, although we have guest cohosts every now and then. It’s one of your favorites. Yes, it’s Andy Ellis. He’s the operating managing partner of YL Ventures.

Actually, he’s just a managing partner.

[Andy Ellis] No, operating partner. I love the promotion I’m getting though. I should make Yoav listen.

[David Spark] You’re the VP, CEO, kind of the castle over there. But he’s also cohosting this episode. Say hello to the audience, Andy.

[Andy Ellis] Hello to the audience.

[David Spark] We are available at ciso-dev.davidspark.dcgws.com, if you weren’t aware. For our audience, this is one of multiple programs and multiple things that we have on our show. And, by the way, if you’ve never come to our live shows on Fridays, please come. We’re doing gameshows. We’re doing just… It’s called Super Cyber Friday.

It’s a ton of fun. Great chance to connect with the community. Our sponsor for today’s episode is CyberMaxx, managed detection and response combined with the offensive capabilities you need for stronger security. And guess what? We’ll be talking about just that a little bit later in the show. So, Andy, here’s my question for you, and this has to do with people offering something that they think is of great value to the person they’re giving it to.

But the person who’s receiving it is like, “Oh my God, no. I don’t want this.” And here’s the perfect example, and I heard this… When an institution of some sort gets a collection from somebody. Like, “Here, have my 1,000 VHS videotapes.”

[Andy Ellis] Do you want mine? Because I got a stack.

[David Spark] [Laughs] No. But you know what I’m talking about?

[Andy Ellis] Yeah.

[David Spark] And so I get this… Like let me point out, I absolutely love our community. Absolutely love them.

[Andy Ellis] Almost all of them.

[David Spark] Almost all of them. [Laughs] Exactly. They provide great, great feedback, great contributions. This show thrives on them. But every now and then, somebody gives us something in a format we can’t manage. And this was the situation with a person who I am so appreciative. But they were saying, “Here is a 90-minute program I did about risk management.

Here, it’s for you, and you can use it in your show.” And I go, “Do you have something written up, or do you put it in a post? I can’t…” “Well, I’m just trying to help here.” And I go, “I got that, but it doesn’t work…” And so we had this endless back and forth of me trying to explain, “You handing me a 90-minute program or me to figure out how to shoehorn it into my programming does not work for me.” I want to know, do you deal with this?

Sort of like people thinking they’re giving you something of great value, and you realize, “No, this is creating problems for me.”

[Andy Ellis] I’m very fortunate, I don’t get a lot of it, but I do get it especially with some organization that I work with, and I’ve seen… I actually have gifts that I’ve been given that it’s like, “Oh, here’s a copy of a Toma [Phonetic 00:03:40] that my great uncle was putting together all in English, and it’s only half done.

Do you want it?” And I’m like, “I don’t want to say no because I want you to feel valued but recognize it’s just going to shit on a shelf. And at one point, one of my kids will have to dispose of it.” Although maybe not… My daughter is going to the Jewish Theological Seminary. Maybe she’ll want that gift that we got.

But what I find… Let me give practical advice out to the person who suggested this.

So, this topic is very relevant. I’m actually speaking at RSA next month on this exact topic. Literally the talk is you can’t measure risk. And to do that talk for the 50-minute timeslot, I will have written an eBook on this. It’ll probably be about 15,000 words that will get published. There will be a blog post series.

There will be a set of mini talks, a whole Twitter series, to make that content consumable on the other side. If you’re a content creator, you don’t get to just do one pass and throw it over a wall. You have to recognize that for every person who’s going to consume the content, they’re spending however long the content is in time to consume it.

So, if you want a thousand people to read your content, and it takes 90 minutes, you’re asking for 1,500 hours from the community. Maybe you should be willing to put a couple hundred hours into making that good content.

[David Spark] But more of the situation is I’m sure this content is great. It’s good. And this was the situation when I was first writing for magazines. If you don’t give it to them in the format that they can use…

[Andy Ellis] Right.

[David Spark] …it’s useless.

[Andy Ellis] Yeah. And so if you want content for the CISO Series, it’s got to be written content that we can link to, that we can pull a question and a topic out of that we will then discuss here and provide an overview. And when we get to our first segment, you’ll see that. Like that’s exactly what it is.

And it’s content that there is nothing controversial in it. It’s been said 85 times, but this is in a clean format that we could use.

[David Spark] Good point. Let’s get to our guest, which we, by the way…

[Andy Ellis] Also, it’s tax season.

[David Spark] It is tax season, so this is dropping on April 9th. Which, by the way, this is just a fortuitous book. I didn’t even realize I had done this. But our guest lives for tax season. I’m interested to know… Actually, I’ll ask you, Joshua, as we bring you on. He is the VP and global CISO over at H&R Block.

They have something to do with tax season. It is none other than Joshua Brown. I want to know from you, Joshua, is your tax season as difficult as it is for accountants, or is it easier or harder? What do you think?

[Joshua Brown] Yeah. I mean, I don’t want to diminish the incredible amount of work that our tax pros do every day.

[David Spark] But this crunch time is insane.

[Joshua Brown] It is bananas. This is the most bananas industry that I’ve ever worked in. And it’s the amount of pressure and the fact that we’re making just a huge percentage of our annual revenue in about a three-week period every year. It’s just ridiculous.

[David Spark] By the way, is May the slowest month? I got to assume this is the craziest month. Is the next month like everyone takes a nap? What happens?

[Joshua Brown] Yeah, that would be lovely.

[David Spark] [Laughs]

[Joshua Brown] And we always say that. Right? Internally, we’re like, “Oh, man, if we can just get through… We just got to get through tax season.” It never stops really. I mean, the pressure is different at different times of the year, obviously.

[David Spark] Right.

[Joshua Brown] But as soon as close the books, we’re off to the races on the next thing. And you know, what’s really funny…

[David Spark] Well, because October, people file late, and then you got to worry about that.

[Joshua Brown] That’s right. Some of the states have different extensions and different deadlines. And, of course, COVID threw all the schedules out the window. Our fiscal year used to end the end of April. Then with COVID, they were like, “Nope, tax season just goes on interminably now.” And so we actually changed our fiscal to give us a little more breathing room in case we needed… Because if you’re trying to report numbers to the [Inaudible 00:07:17] across multiple fiscal years, the analysts had no idea what to do with it, and it was just a mess.

So, yeah, we actually close the whole company down for the first week of July. We call it reboot. And literally everybody goes home. Our SOC is still working.

[Laughter]

[Andy Ellis] Yeah, all the hackers are like, “All right, I know when I’m going…”

[Crosstalk 00:07:37]

[David Spark] “I know the week.”

[Joshua Brown] And that is our chance to take a break, and recharge, and come at it strong starting the second week of July.

[David Spark] Very good.

[Andy Ellis] And so I want to give advice to anybody who’s founding a company who’s thinking about, “Oh, I should do something clever with my fiscal year.” Please don’t. Speaking as somebody who has to deal with this… I’ve got a company that’s got an off quarter. They don’t even end on a quarter break.

They end like one month into each quarter.

[Joshua Brown] Oh, yikes.

[Andy Ellis] It’s when their quarters shift, and it’s not the normal thing. Please just don’t do this to yourself.

[David Spark] Why can’t people stay to calendar years? It drives me crazy.

[Andy Ellis] There are good reasons. Like if you’re a school, it makes a lot of sense to have your fiscal year break in the middle of summer because your revenue is tied to the academic year. There are lots of great reasons. But unless you know exactly what the consequences are, don’t do it.

[Joshua Brown] Yeah. And hopefully your reasons are things that you can control. Not be at the mercy of market forces, for example.

[Andy Ellis] Yeah. And the problem schools have is then they run summer camps, and now that revenue is split across multiple years.

[Joshua Brown] Yeah, bananas.

[Andy Ellis] We’re the tax series now.

[Joshua Brown] [Laughs]

What works? What’s not working?

8:38.854

[David Spark] When you lose cyber talent on your team, you aren’t just losing out on productivity. Institutional knowledge that walks out the door is hard to replace. So, how do you retain talent? The Crux Cybersecurity Talent Market Report recently found that for many employees, it’s not just about compensation.

Oh, I’ve done tons of interviews on this, and I couldn’t agree more here on this. The report found employers succeeding with retention by building explicit career paths. We’ve got plenty of evidence on this, too. Having a department culture open to feedback with clear expectations, maintaining a strong department identity around development and growth, and cultivating trust.

Now, Andy, you have literally written a book called “1% Leadership” that speaks to much of this. These all sound like good ideas, but I’m interested to know as a manager which one is the hardest for management to actually offer. Like of all these things that you should do retain, what do you struggle with the most?

[Andy Ellis] Actually, the thing that everybody struggles with the most isn’t quite on that list but underlies the whole thing, which is having an open door for people to walk out. If you want to retain people, you open the door and push them out the door, they’re not going to want to go. But if you say, “I’m going to develop you to your next job, and it’s not going to be here.

It’s going to be somewhere else,” guess what? They don’t leave because you’re the only person who’s developing them. They’re going to stall as long as they possibly can going out that door. But that’s the mindset that you have to have is you have to say, “I am just the steward of this person’s career for the 1 year, 2 year, 3 year, 20 years, whatever it’s going to be that I get of them.

And my job is to maximize how much value I invest in them so that every day they’re one percent better for me.”

[David Spark] It’s reverse psychology is what you’re using here, Andy.

[Andy Ellis] It’s not even reverse psychology. You’re not trying to do that. You’re just basically being this island of sanity in a crazy world. And they will look around, and they’re like “Oh, nobody else is going to invest in my career. Nobody else is going to develop me. Nobody else is going to give me these opportunities, so maybe I’m willing to wait an extra year for a promotion here because nobody else is leaving either.”

[David Spark] Again, the best example we have seen of this is Jesse Whaley, CISO over at Amtrak. He has 100 employees, and he’s got this from intern to employee, whole process of how they train people, on, and on, and on. So, Joshua, you’re nodding your head all the way through this.

[Joshua Brown] Yeah. So, when I took the CISO seat at Block, it happened to be just before the great resignation started. And within about a 90-day period, I lost about 80% of my managers.

[David Spark] Holy moly.

[Joshua Brown] Walked out the door. It was that crazy time, just to refresh the audience. You could jump and get 30, 40, 50% more money immediately just by jumping. And it wasn’t just InfoSec. It was kind of across the board. And it was pretty demoralizing for me. [Laughs] You know, stepping into this role and seeing people walk.

But what I was able to do was rebuild and really refresh the talent on my team. My boss likes to say change is a good thing. He’s not wrong. But I wanted people who were aligned with what I was putting down, with what my philosophy was on how to run an InfoSec department. I want people to be there because they want to be there.

And the big thing for me… I mean, everything you touched on I think is critical, but we really leaned into this concept of junior talent and career pathing. And so I was fortunate that I had enough senior talent that remained that could act as mentors and stewards of the historical knowledge about how things worked.

Block is a very complicated company, especially from a technology perspective. And we just opened the doors to these junior talent pipelines, so we set up relationships with local schools, community colleges, universities. We also really went hard after second career folks.

So, I would say a third to half of my team is probably ex-military, ex-law enforcement, ex-healthcare, ex-teachers, moms reentering the workforces. And ultimately, it comes down to two facets for me. This is kind of a laugh line that I’ve used in the past, but I hire for people that are smarter than me and that aren’t sociopaths.

I can’t teach you not to be a garbage human, but anything like technology wise, we can teach you that. That’s not the hard part. I need people that are invested in learning. And I think we started off with what I hate about cyber security. What I love about cyber security is everyday is different. It’s always a new challenge, and I’m always learning.

And so really leaning into this…

I believe it’s incumbent on the leaders in cyber security to train the next generation of talent, and so we’re very intentional about career pathing, about succession planning, about making paths available for people to move and try different aspects within a department. You start as a SOC analyst, and you want to go work on AppSec for a while because you’ve got a development background?

Awesome, let’s do that. You want to switch over and do some cyber threat intelligence, or you want to clerk under the red team? Absolutely. Let’s make that happen. What we’ve seen as a result of this, as I’ve built the team up, we have some SOC analysts now that are going on three and a half years. It’s unheard of.

You usually see 8 to 12 months, and they’re out the door. So, yeah, it’s been very successful for us.

What we’ve got here is failure to communicate.

14:03.029

[David Spark] While work from home doesn’t work for every industry, those organizations that have adopted it don’t seem to be able to put the genie back in the bottle. Mark Dobson on LinkedIn highlighted Expensify’s experiment to see what perks could make employees happy returning to the office. None of their carrots worked to keep people consistently there if they had another option.

So, what are you gaining from work from home versus in office, and what are you losing? Is there any way to get some of the benefits of an office centric approach back, and how does this change security considerations if we now take work from home as a given? Which that last line, I’m assuming it’s a given now, yes, Andy?

[Andy Ellis] It pretty much is. Do you know that carnival game that you roll a bowling ball, and it’s on two steel bars, and you have to get up over the first hump and then not…

[David Spark] Ball into the little area, yeah.

[Andy Ellis] That first hump is going into the office. The cost of getting into the office and showing up to work is so massively high that nobody wants to pay it. Why would you commute if you don’t have to? I’ve got like a 30-second commute to get to my desk. I don’t want to get in a car and go anywhere.

Offices suck. Let’s just be really honest. People built these giant…

[David Spark] I take that back. I think when you’re out of college and you’re getting your first jobs…

[Andy Ellis] Right, yeah, I totally agree with you. Or you want to get away from your kids. Like, “Oh…” Your husband works from home, but your kids don’t care because you’re mom. I’ve known women who are like, “No, no, I want to get into the office so that my kids don’t see me in the house because otherwise they bring all the problems to me.” There is lots of reasons.

So, there’s an individual value of, “Hey, can I help an individual have a decent workspace?” So, you have to say, “Is your workspace better than what they can get at home?” And for some people it is, and for some people it isn’t. I know folks in Tel Aviv that are all happy to go into the office. Why?

Because their apartments are tiny. They don’t actually have workspaces in their apartment. So, office is great for them. Other people are like, “No, no, no, I’m totally happy. I’m a developer. I’ll sit at my dining room table and work.”

[David Spark] But if I was out of college and had to work from home, I would be depressed because…

[Andy Ellis] Right.

[David Spark] The work environment was very key to your social existence when you first come out of college.

[Andy Ellis] Right. So, there you just caught it, which is… Well, but you haven’t been in a workplace in a while, David.

[David Spark] [Laughs]

[Andy Ellis] It’s dangerous to be social now in a workplace. Like boom… You don’t date in your workplace anymore because there is harassment coming down the pike for you. You don’t make friends with your colleagues because they’re going to get fired and laid off next week, so why bother. And the companies aren’t investing in that socialization.

[David Spark] I don’t know about that last one. That one is a little pessimistic. [Laughs]

[Andy Ellis] I know. I know people who are like, “Look, I’m just here for two years. I’m not investing to build a life with this company the way some people used to.” So, if you’re a company, you have got to make it valuable for someone to come into the office. How can you use automation in the building to make it a friendlier building, to give them the climate control they want?

[David Spark] Well, this is the whole point of Expensify. They tried to… You see all these incentives that people… And it just… It’s not enough.

[Andy Ellis] Yeah.

[David Spark] But you look at campuses like Google and Apple where literally everything you can need, like laundry service, is on campus, and gyms, and, “We’ll wash your car.” I mean everything is there.

[Andy Ellis] Did you have privacy? Did you have four walls around you, or were you sitting in a giant, open plan?

[Joshua Brown] Did you have to put on pants?

[Andy Ellis] Did you have to put on pants?

[David Spark] [Laughs]

[Andy Ellis] I’ll be very honest, I’m wearing pajama pants right now.

[David Spark] Hang on, I want to just say I’ve got pants on. Let’s do a quick pants check. Pants?

[Joshua Brown] I’m wearing pants.

[Andy Ellis] Pajama pants.

[David Spark] Everyone is wearing pants now. Okay. I just want to put our listeners at ease right now that…

[Andy Ellis] Why should they care?

[David Spark] Well, because you just put the picture that we’re all pant less right now, and I just…

[Andy Ellis] No, you’re the one who said pant less. [Laughs]

[David Spark] All right.

[Andy Ellis] Notice that David didn’t say whether he’s wearing a shirt.

[David Spark] I am wearing… You can see that. [Laughs]

[Andy Ellis] But our listeners can’t.

[David Spark] Joshua, I’m taking this to you. The thing is what are we gaining, what are we losing here? How are you managing this?

[Joshua Brown] So, Block was very much a local market company for corporate. I mean, we have 10,000 retail locations, so that’s a different story. But for the corporate employees, we largely recruited from the Kansas City Metropolitan area, which is a mid-market city in terms of size. And there aren’t a bunch of Fortune 500 companies in Kansas City.

There is a handful, and they would kind of pass the talent around. You would jump from company to company. With COVID, we were able to take those constraints off and start hiring. So, actually most of my management team is remote. I’m old enough where I miss having people in the office around me. Going in the office is actually a little bit depressing.

We’ve got this amazing building, amazing facilities right in the Power and Light District in downtown Kansas City. It’s awesome.

And I only live six minutes from the office, so it’s not a big deal to go in for me. After living in DC for ten years, I was like, “I’m never going to commute again. That is not something I’m willing to do.” But I do, it’s just a short commute. And I bring my whole management team in quarterly to meet, and we bring the entire team in once a year for InfoSec palooza, so people get some face time.

Block has taken a flex approach, which I think most companies have. We encourage people to come in, we don’t require it. So, I would say I have a handful of people that come in weekly. I’m generally in the office three days a week. Can I do what I do remotely? Most of it. Can my people do what they do remotely?

Almost all of it. And so I don’t remember which one of you said it, but you absolutely hit it… You have to give people a reason to come in. It has to be a reasons that means something to them, and that’s going to be different for everybody, which I think is why companies are struggling coming up with like a thing that resonates for everyone.

[David Spark] There are companies that flex doesn’t work because let’s say the days you do go in, it’s an empty office, and it’s like, “Why the heck am I here?”

[Joshua Brown] Right, it’s super… Like I’m going to take Zoom calls from my desk, or I’m going to take Zoom calls from my desk at home.

[Andy Ellis] Right, that’s the other thing. So, first of all, if you’re doing flex, you pick the days so that you don’t have an empty office. You’re not trying to gain efficiencies of space. You’re not one of the big four. But in addition to it being valuable for the employee to come in, you have to find that value, you have to find value for the company as to why is the employee in the building.

Because it can’t just be, “Oh, you’re in the building so that I know you’re working.” It has to be like, “Yeah, if you come in and you’re just doing Zoom calls, what’s going on with that?” No. Like, I’m going to Tel Aviv next week and in fact next month. So, either next week from recording date, next month from launch date.

And I’m going, and it’s like I’m doing dinner every night with colleagues because we’re going to get work done, and we’re going to eat. And that’s really valuable because it’s unstructured time. We’re not trapped by a meeting agenda, which… If there’s an agenda, do it over Zoom. If there’s no agenda, do it in person.

[Joshua Brown] Yeah, I think that’s right. I mean, we’ve done some things as a department to encourage interactivity with people in meet space rather than in cyber space. We had a very successful like, “Come and eat baked potatoes… We’ll set up a baked potato bar. We’ll have lunch for you guys. Come in, and we’re going to talk about how to stay secure at home and when you’re on the road.” And we had 200 people show up at the office for it.

200 non-InfoSec people show up. So, I think finding things that resonate with people. Food is always great. Break bread together. Have some chats. Have it be, “We’re going to present to you. We’re going to have a discussion.” And people found that valuable. But I think when you start requiring it, it starts smacking of the butts in seats mentality.

Like, “I need you to be here so I can observe that you’re doing the work I’m paying you for and that I can control.” Like we’re all trying to be outcome focused, right? Am I getting the outcome I want? Then why should I care how I’m getting the outcome I want?

[Andy Ellis] Yeah. I like to say that if you need your employees to be physically present so that you can manage them then you’re admitting you don’t know how to manage employees.

[Joshua Brown] Yeah, for sure.

Sponsor – Cybermaxx

22:07.270

[David Spark] Before I go on any further, I do want to tell you about our absolutely spectacular sponsor, and that is CyberMaxx. Remember I told you about them? Managed detection and response. Well, they help companies assess, monitor, and manage their cyber risk. If you’re listening to this show then you care about all of those things, and you’re trying to do that as best as you can.

Well, the CyberMaxx people can help, because they believe that offense fuels defense. Their next-generation of managed detection and response solution, that would be MaxxMDR, it strengthens your defensive capabilities with insights from offensive security, digital forensics and incident response, that would be DFIR, and threat hunting.

You want to learn more, you got to go to their site. Visit cybermaxx.com. CyberMaxx, think like an adversary but defend like a guardian.

It’s time to play, “What’s worse?”

23:08.590

[David Spark] Joshua, are you familiar with how this game is played?

[Joshua Brown] I’m not, but I’m excited to play.

[David Spark] Okay, Joshua, it’s pretty simple. I will give you two horrible scenarios. They come from our great listeners. And both of the scenarios are going to stink. You won’t like either one of them. But one of them will be worse than the other, but that is for you to decide. Now, I always ask Andy to answer first, and then you can agree or disagree with Andy’s answer.

So, Andy, here we go. Here it is. It comes from Elliot Lewis, a good friend of the show. And he has submitted many, “What’s worse,” scenarios. Here we go. All on incident reporting. So, contract a known and successful ransomware group to attack your company and see how well your employees report the incident.

Sounds awful. Hold on.

[Andy Ellis] Sounds stupid. [Laughs]

[David Spark] Sounds stupid. Hold on. This one is equally stupid. Deliberately provoke the ransomware group by taunting them with a, “Bring it on,” in a public forum to test your incident response operation’s effectiveness. Both two levels of stupid.

[Andy Ellis] Yes, these are in fact… These are both career limiting moves. Let’s just start with that.

[David Spark] [Laughs]

[Joshua Brown] Yeah, they say you can do whatever you want on your last day on the job, right?

 [Laughter]

[Andy Ellis] Yeah. Like usually, Elliot, these are about like what’s worse about the situation you are in, not the situation you are voluntarily going into. You should have given us a third choice of, “Just play Russian roulette,” because that would have been the better choice of all three of these.

[David Spark] Yes.

[Andy Ellis] That said, I think I’m going to go with the first one is worse, which is contracting with them to attack you. Because, okay, they’re going to attack you. They’re going to breach your systems.

[David Spark] You got their W-9, and you’re going to be sending them a 1099. [Laughs]

[Andy Ellis] Yeah, you have a real W-9. You’ve probably committed multiple felonies here, because odds are the group has terrorist ties or something. They’re a known bad actor. The DOJ is coming after you for number one. You do number two, and you’re just going to get fired and never be employable again.

But at least you’re not spending the rest of your time in the cyber max prison for bad cyber actors.

[David Spark] All right, good answer. Joshua, do you agree or disagree with what Andy just said?

[Joshua Brown] Yeah, I agree. Although they’re both colossally stupid.

[Andy Ellis] Yes.

[Laughter]

[Joshua Brown] A couple of years ago, there was sort of a push towards live fire exercises, right? Which I get the spirit of it. A lot of the tabletop exercises are just too academic. They don’t actually map onto what an actual incident would go down as. And those of us that have been through actual incidents, you don’t ever want to actually have that sort of thing.

You do want to practice. But, yeah, contracting with someone to actually try and ransom your environment is…

[David Spark] But hold on. But I think the whole thing is… Because you do contract with companies to pen test you.

[Andy Ellis] Yes, but you don’t contract with the mob.

[Joshua Brown] Right.

[David Spark] And hold on. I’m just going to make an argument. There are criminals who have “gone good,” the Kevin Mitnicks of the worlds. So, this could ride the line a little bit here?

[Andy Ellis] The scenario was not that they have gone legitimate and created a legitimate business…

[Joshua Brown] Right.

[Andy Ellis] …doing this. This is… They are currently a criminal element.

[David Spark] But you could be the one that pushes them over, “Oh, I could do this legitimately.”

[Andy Ellis] No. No, you’re rewriting the scenario.

[Joshua Brown] Yeah.

[Andy Ellis] Now, that said, we both said these are both colossally stupid.

[David Spark] They are.

[Andy Ellis] The number of times when I was working for a company that had the best DDASS defense platform on the platform on the planet that our customers that we had protected then went and taunted the adversaries I lost track of. Stop taunting the adversaries. Living well is your revenge. If they attack you, and they don’t affect you, you just ignore them at that point, and they go away.

Don’t troll the adversary.

[Joshua Brown] Yeah. I mean, anybody who has got the opinion…any cyber professional has the opinion that like, “Bring it on,” that is a terrible, terrible attitude to have. I think we’re all acutely aware of our shortcomings, or we should be. It’s the old, “First know thyself.”

[Andy Ellis] Yeah.

[Joshua Brown] And yeah, that is not a great position to be working from if you really think like, “Yeah, we’re invulnerable.” That is not the case. Everybody is vulnerable. Anybody can and will be hacked, right?

[David Spark] This was actually a video I shot at BSides a number of years ago. I asked to a bunch of very, very smart security professionals, “Could you be hacked? Could you be compromised?” And some people said, “No, I couldn’t,” but a lot…and I will say the majority…said, “Yes.” And many of them said, “Oh, you’ll get to me through my family and my friends.” That was the tactic.

[Andy Ellis] Yeah. I’d like to apply to the taunting, I had a friend who had a thing called the obituary test. He said before you do something stupid, like in life, go bungee jumping, cliff diving, whatever, think about how this is going to look on your obituary. Like if you die doing this, would you be embarrassed that that was your obituary?

“Oh, he died sticking his finger into a socket after licking it.”

[Laughter]

[Crosstalk 00:28:22]

[Andy Ellis] Same thing, corporate obituary test. Like you taunted the adversaries, and then they breached you fails the corporate obituary test, so don’t do it.

[David Spark] By the way, rarely do people listen to the, “What’s worse,” scenarios as tips on what to do.

[Laughter]

[Andy Ellis] This one contains some serious anti-tips.

[Laughter]

[Joshua Brown] Yeah, please don’t do either of these things.

[David Spark] Yes, don’t.

How would you handle the situation?

28:46.615

[David Spark] When we hear about a breach, coverage largely focuses on the data and the financial loss. Those are hard metrics that are easy to understand, but what about the human impact? New research from Royal United Services Institute found that security professionals at an organization hit with ransomware suffered an array of impacts from an attack.

From anxiety and blame, leading to burnout, to in rare instances suicidal thoughts. So, I would assume failure in business success is different than getting money stolen from you. So, I’m going to start with you, Joshua. Have you seen this kind of behavior like from your team or any time you’ve worked?

Like when something happens, there’s sort of a failure of controls or failure in an environment. Is there something unique about stress from ransomware?

[Joshua Brown] I have not personally seen a ransomware attack succeed. Not that I’m taunting the adversaries, please.

[Laughter]

[Joshua Brown] Very cognizant of that anyone can be breached regardless. But, no, I think the burnout and the stress is a very real thing. I think that’s part of the reason why SOC analysts tend to not have a particularly long tenure is you’re dealing with alerts constantly. And when you look at some of the big breaches, like Target being a great example, of alerts that were not answered and not recognized because it was just too much noise, and people just can’t react.

InfoSec has had this big data problem for a long time, and there is only so much people can take in and process. But I think if you’re in an environment where people get blamed for making legitimate mistakes, you’ve got a cultural problem that you need to deal with, not a technical problem. We know that the carbon layer is the weakest layer.

This is where most of the bad guys are pointing their efforts. 

[David Spark] But also people are human. People don’t like to fail. Even if you create the warmest environment, if someone gets compromised, and it could be a simple mistake, a human mistake, they’re going to feel awful about it.

[Joshua Brown] Sure. I mean, they should if they’re not a sociopath, right? But I think that most of the stuff comes in through phishing. I think it’d be interesting to do a psychological assessment on the people that were actually the ones who opened the attachment. But we learn… Brene Brown says, “Growth comes at the point of struggle.” You learn by making mistakes.

The phrase I like to use is we create a safe space for people to try dangerous things. I want people to fail in ways that are the right way of failing, not the stupid ways like taunting your adversaries.

[Laughter]

[Joshua Brown] And so I think it’s important to celebrate failures the way we should celebrate successes, as opportunities to get better, to learn, to grow. I’m wrong multiple times a day, and I assume people on my team are. And the trick is that you want to design your systems and your processes so none of those failures is damaging.

That they’re caught, and you move on to the next thing, and you learn. You don’t make that mistake again.

[David Spark] Excellent points. All right, Andy, I throw this to you. Have you seen sort of staff members emotionally get distraught over failures from ransomware or anything else?

[Andy Ellis] Absolutely. But like Joshua says, it comes down to organizational culture. What they’re actually distraught about is not the direct harm. It’s the second order of harm of, “I’m going to get blamed for this.”

[David Spark] Well, let me go back to the, like if you did something, say something because that is a tough thing to really make people believe because they just want to bury it, and hide it, and make sure it never happened, that kind of thing. Like, “If I don’t say anything…” But they don’t realize like, “No, the faster you tell us the quicker that we can deal with it.”

[Andy Ellis] Right. Your CEO should at least once a year during an all hands make some comment about that they got phished and that they reported it, got their laptop cleaned, brand new machine, and that it’s okay. “And the important thing is if you think that you have been part of that attack chain, tell us so we can do something about it.

It’s not your fault.”

[Joshua Brown] For sure. We do phishing simulations like most big companies do. And, sure, it’s important to track the click rate, but what’s way more important for us is we’re tracking the reporting rate.

[Andy Ellis] Exactly.

[Joshua Brown] What percentage of our people are reporting that? That is the growth in the organizational culture of recognizing and reporting.

[Andy Ellis] Yeah. Click rate is actually the most useless metric, in my opinion, because what everybody knows who is in charge of contracting and configuring these phishing tests, you get to pick the click rate in advance. You basically get to say, “How good do you actually want to have this test be?

How much do you want to piss of your employees by making it really realistic?” Because you can get easily up into the 30% of click rate if you’re like, “Oh, by the way, you’ve just been laid off. Here’s your compensation package.” You’re going to have a pretty massive click rate, and you probably won’t have a job the next day.

[Joshua Brown] “You’re due for a new laptop. Click here to…”

[Andy Ellis] “You’re due for a new laptop. Click here.” There is so many ways that work that we don’t do because they break down trust.

[Joshua Brown] And if the click rate is anything other than zero… Like it only takes one click.

[Andy Ellis] Right.

[Joshua Brown] So, why are we celebrating five percent click rate, eight percent click rate? One. One is all it takes. So, are people learning? Do they know what to do?

[David Spark] Let me ask you, is part of these phishing tests…? I don’t know. Because we talk about the speed of response. Do you know that kind of information, too? Like…

[Andy Ellis] Yeah.

[David Spark] Like maybe something got clicked, and people waited an hour or two to tell you versus right away?

[Andy Ellis] Yeah, you want to check that. You want to check how quickly they tell other people. So, one of my favorite things when I was at Akamai was I actually hated people telling me, “Oh, I just got this email. I just got this phone call, whatever.” I was like, “Why do I have to be the proxy?” So, we actually created an internally public mailing list to discuss these.

We called it social engineering alert, because the big attack we got when we were just launching this was people calling up, pretending to be a fellow employee. They needed somebody’s phone number. And so we were like, “You get attacked, just report it right here and cc both the person the adversary was pretending to be and the person’s whose phone number they were asking for.” And what we discovered was this became one of the most popular lists.

People loved being on it. And whenever our phishing simulations would go out, employees would reverse engineer them and share that there was a phishing simulation going on. They’d tell you who the vendor was. They would show you all of the forensics. And the phishing team was getting angry. They were like, “No, our test isn’t working.” And I’m like, “Are you kidding?

This is exactly the defense that we want.”

[Joshua Brown] That’s right.

[Andy Ellis] Like, “Don’t just tell me. Tell the whole company that this is going on and not to click that link.”

Could this possibly work?

35:19.805

[David Spark] Are metrics the key for CISOs to better connect with the board? We talk about the importance of forming a partnership with the board. And Sravish Sridhar at Dark Reading makes the case that this can start with hard numbers that the business can understand. He suggests risk, growth, expenses, and people as the basis for these metrics.

For revenue, this could be showing reductions in time spent to complete security reviews for vendors and customers or productivity gains through automation. Does this sound like a reasonable approach, and have you ever had success connecting the board on similar metrics? I mean, essentially talking about how security is a revenue group.

I’m interested in if you’ve played this angle at all, Joshua.

[Joshua Brown] Yeah, the classic view is that the board cares about risk. And so if you are going to go the metrics route, you have to come up with metrics that are actually meaningful to them. Like the metrics that we measure, the operational metrics, are not interesting to the board at all. They care about completely different things.

But I’m not sure that’s the best approach. I mean, it’s like the damn lies and statistics, old saw, right? Numbers can say different things depending on how you look at them. I think that the skill that a lot of CISOs lack is being a good storyteller. And I think engaging with the board and getting the board engaged with what you’re doing involves telling a story, and it has to be a story that’s compelling to them.

And so part of that is figuring out who the personalities are on the board, what they care about, deeply understanding your business. I mean, this is another place where I think a lot of security practitioners fall down. And speaking that language – meeting them where they are instead of trying to drag them to where you are.

[David Spark] How do you learn the board? I mean, is it just taking them out to lunch, asking them lots of questions? I got to assume that could be the only way, yes?

[Joshua Brown] No, I think some of it comes over time. I mean, your first interaction with the board is probably not going to be your best one. Talk to your peers, the rest of the C-suite, and get a sense, because I think the things that matter to your peers are going to be things that matter to the board, particularly chief legal, chief financial, and your CEO.

Of course this varies company to company, whatever industry you’re in. But ultimately… Like I don’t talk to the board about tax. We talk to the board about risk, global risk, and what we’re seeing, and the trends, and how we’re combating those things.

[David Spark] Andy, have you been able to have a revenue conversation with the board?

[Andy Ellis] I’ve tried. It can be a disaster. First, I just want to point out that this piece in Dark Reading was a vendor placement piece, so it’s written by the CEO of a company that does stuff like this.

[David Spark] Yes, and in fact they’ve been a sponsor in the past, I should say.

[Andy Ellis] They’ve been a sponsor, so just full disclosure. But that said, I actually disagree with all four of the recommendations that they went for.

[David Spark] Okay.

[Andy Ellis] Some of these are good operational metrics, but they’re not board level. Absolutely I want to talk about how am I reducing sales friction in the security piece of it. That’s a conversation to have with the CRO, not to have with the board. “Am I doing the right thing? Because I’m functionally a sales enablement team.

And if I’m not talking to the CRO about sales enablement then I’m not actually sales enablement. I’m doing something wrong.” So, you should think about like who are your actual stakeholders for these problems. It’s not always just the board. And unless the CRO is willing to attribute revenue to you, you don’t walk into the board and claim revenue because the CRO is basically just going to throw you under the bus.

They’re going to say like, “No, that revenue didn’t come because of them. That revenue came because I have amazing sales reps who are out there, and thank God security didn’t eff up my deal.”

That’s the best thing you’re going to get, is, “Okay, now let’s go talk about all the deals we didn’t get through the security paperwork fast enough, or you didn’t say the right things.” You’re going to open up a whole can of worms. That’s not what the board wants to hear from you. The board wants to hear what are the existential risks that we’re dealing with, what are the unacceptable loss that could happen, what hazards can trigger them, what are you doing to mitigate them, and what things have hit the other companies I’m on the boards of, and how are you not going to fall into the same trap.

The number one thing you should do if you’re about to report to the board, go find out every company that your company is affiliated with and go find every incident those companies have had, especially if they’ve been briefed to the board, and you expect to walk in…

And don’t mention the incidents because the board members will not appreciate that. Let them mention them. But if you walk in… If you know that they got hit by NotPetya and that they spent like six months doing cleanup because they worked for…insert one of the companies with big global impacts…then you should walk in and say, “Here is how we’re dealing with the ransomware threat and why I don’t think ransomware is our single biggest issue, because here’s exactly how we have defended against it.” You’re talking the language that they need to hear.

That is what you need to walk in and do.

[David Spark] That is a spectacular tip right there.

Closing

40:18.854

[David Spark] And that brings us to the very end of our show. I have to thank both of you. You both knocked it out of the park. Thank you very much. By the way, we are literally just do days before the Super Bowl, so I’m assuming you are rooting…being Kansas City centric, Joshua, you are rooting for the Chiefs, yes?

[Joshua Brown] Absolutely.

[David Spark] Being that I lived for more than a couple of decades in San Francisco, I am routing for the 49ers.

[Andy Ellis] I’m rooting for the meteor strike. I’m mildly rooting for the 49ers because I’m friends with the wife of one of the players there.

[David Spark] Okay.

[Andy Ellis] But I don’t want the 49ers to win because I don’t want them to have a sixth ring, because the Patriots have six rings. But no way in hell I’m rooting for the Kansas City Chiefs because they’re on their way towards six rings. I recognize they are the new dynasty. They’re great. I’m rooting against them solely because they’re great.

[David Spark] All right. So, it’s out of spite, correct?

[Joshua Brown] Fair enough.

[Andy Ellis] It’s out of protecting the legacy of my team.

[Laughter]

[Andy Ellis] I’m a Patriots fan.

[David Spark] You got a lose/lose situation right now.

[Andy Ellis] Yeah, this is not a great situation. So, I’ll root mildly for the 49ers.

[David Spark] With that said, gentlemen, let’s end this show. What do you think? I want to thank our guest. By the way, let me ask you a quick question, Joshua. Are you hiring over at H&R Block?

[Joshua Brown] We’re pretty much always hiring.

[David Spark] Always hiring. So, if you want to work with someone awesome like Joshua, contact him. I’m assuming LinkedIn is a good place to reach out to you?

[Joshua Brown] LinkedIn is a great place to reach me.

[David Spark] Awesome. I also want to thank our awesome sponsor, CyberMaxx. CyberMaxx, think like an adversary but defend like a guardian. They are the managed detection and response solution you should be looking at. Check them out at cybermaxx.com. I want to thank you, Andy. I want to thank you, Joshua.

I want to thank our audience, as always. We appreciate your contributions when they come to us in a form we can manage. Thank you. Thank you so much for your contributions. And we also love it when you listen and tell all your friends about the CISO Series Podcast.

[Voiceover] That wraps up another episode. If you haven’t subscribed to the podcast, please do. We have lots more shows on our website, ciso-dev.davidspark.dcgws.com. Please join us on Fridays for our live shows – Super Cyber Friday, our Virtual Meetup, and Cyber Security Headlines Week In Review. This show thrives on your input.

Go to the participate menu on our site for plenty of ways to get involved including recording a question or a comment for the show. If you’re interested in sponsoring the podcast, contact David Spark directly at david@ciso-dev.davidspark.dcgws.com. Thank you for listening to the CISO Series Podcast.