Do cybersecurity budgets suffer from recency bias? It seems organizations are most likely to significantly raise budgets after a cybersecurity incident. Meaning if you’ve ran an effective program, your budget could be a victim of your success. How can we change this mindset?

This week’s episode is hosted by me, David Spark (@dspark), producer of CISO Series and Andy Ellis (@csoandy), operating partner, YL Ventures. Joining me is my guest, Aamir Niazi, executive director and CISO, SMBC Capital Markets.

Got feedback? Join the conversation on LinkedIn.

Huge thanks to our sponsor, Cyera

Full Transcript

Intro

0:00.000

[Voiceover] Best advice for a CISO. Go!

[Aamir Niazi] Be a humble and empathetic leader. Hire the right people, build a strong team, and then empower them to make the decisions. What I really mean by that is just being able to connect to your teammates at a personal level and being able to understand what is going on, on their day to day lives to be able to connect.

That will help your team connect with you as a leader at a personal level. And at the same time, they’ll bring their best self while working on projects and day to day initiatives.

[Voiceover] It’s time to begin the CISO Series Podcast.

[David Spark] Welcome to the CISO Series Podcast. My name is David Spark. I am the producer of the CISO Series. And joining me, one of your absolute favorite cohosts of the CISO Series. That would be Andy Ellis, the operating partner over at YL Ventures. Say hello to the nice audience, Andy.

[Andy Ellis] Hello to the nice audience. But if I have to ask, if you’re an absolute favorite, does that imply that you could be a very negative favorite? But when it’s absolute, now you’re positive, and it’s a favorite?

[David Spark] I think it’s being redundant. I think you’re right, yes. So, we’ll just say favorite.

[Andy Ellis] Yeah, as a former math geek or still math geek, it gives me a little more confidence.

[David Spark] But that lets the audience choose, are you the least favorite or their favorite.

[Andy Ellis] Right.

[David Spark] There you go. We’re available at ciso-dev.davidspark.dcgws.com where you can find many more episodes of this show and our other shows. We have lots of wonderful shows. And in fact, I think I believe this week is when our show, Capture the CISO, season two is coming out. So, please go to Capture the CISO on ciso-dev.davidspark.dcgws.com and listen to that.

Our sponsor for today’s episode is Cyera, holistic data security in one cloud platform. And we’re going to talk about just that, data security in the cloud, a little bit later in the show. All right, Andy, this is really day one that we’re dropping this of RSA.

[Andy Ellis] Yep.

[David Spark] I will be there. I will have just recorded an episode of BSides two days before.

[Andy Ellis] And I’m speaking tomorrow morning.

[David Spark] And you’re speaking tomorrow morning, which will be the Wednesday. Let me ask, are you going to do anything differently at this RSA than you have done at any previous RSA?

[Andy Ellis] So, I’m probably actually leaving… I haven’t booked my flights yet. Our listeners know we record these well in advance. I’m probably actually leaving either Wednesday night or Thursday morning. I’m not sticking around until Friday. I just don’t know that I can justify staying at RSA for as long as I have in the past.

[David Spark] There’s just so many people I run into. And I’ve had a situation where… And it’s just kind of a wonderful situation where I have to book more time between meetings because of the sheer number of people I run into as I walk from one to the next.

[Andy Ellis] Right.

[David Spark] Which is awesome. Because you go to this event enough, you run into enough people. And it’s… And if this is your first one, going to, start making a lot of friends so you have this wonderful experience as well.

[Andy Ellis] Yeah. And if you want a great place to run into people and have fantastic food… And they’re closed tomorrow, so you can’t go on Wednesday. At least I believe they’re closed tomorrow. Is Wise Son’s Deli that’s part of the Contemporary Jewish Museum. Fantastic pastrami. You can sit outdoors, especially if the weather is nice.

And you’ll run into a lot of folks there. Highly recommend it.

[David Spark] You’ll be jealous of this. So, years ago when I was living in San Francisco, a few of the delis that are very Jewish style delis that sell pastrami and corn beef, they had the owners of the deli…they had a panel of deli owners in San Francisco, and they had tons of samples out. I know.

[Andy Ellis] [Sighs]

[David Spark] It was as awesome… And they talked about the business of owning a deli, running a deli, the difficulty. Because here’s somethings… Take a turkey sandwich. A turkey sandwich has like lettuce, and tomato, and stuff. It fills out the sandwich. But when you’re dealing with corn beef and pastrami, it’s pretty much all meat.

[Andy Ellis] Right.

[David Spark] So, those sandwiches are just way more expensive than like a turkey sandwich.

[Andy Ellis] Yes, they are. And the meat takes a lot longer to prepare.

[David Spark] Yeah.

[Andy Ellis] Getting a really good pastrami is way harder than getting a roast turkey breast.

[David Spark] And they were also complaining about the distributors and dealing with the distributors, and that sometimes they would send them white fish that half of it is just bad.

[Andy Ellis] Man.

[David Spark] And they can’t complain, and so it just gets not easy to run a deli.

[Andy Ellis] Yeah.

[David Spark] Let’s get into our show. Less talk about delis, more talk about cyber.

[Andy Ellis] I’m hungry now.

[David Spark] Yes, I’m thinking about that night. It was pretty awesome. Just eating corn beef and pastrami samples. It was great. Our guest for today’s show, very excited to have him on – a fan of the show. And I’m thrilled that we can now have him on the show. He’s the executive director and CISO over at SMBC Capital Markets, none other than Aamir Niazi.

Aamir, thank you so much for joining us.

[Aamir Niazi] Thank you so much, David, for having me on the show. I’m excited and thrilled to be here.

Where can we cut costs?

5:08.217

[David Spark] No one wants to experience budget cuts, but you’ve got to be prepared and have a plan for what can get cut. This topic came up on the cybersecurity subreddit, and people noticed a bit of recency bias, with organizations cutting budgets when they go years without a major incident only to throw money at cyber security after a major breach.

So, how do we connect with the business to try to prevent that practice? And when budgets do get reduced, what framework do you use to make those cuts? I will start with you, Andy.

[Andy Ellis] So, I think it’s really good that this is two questions because they’re very different questions. The first one is you should actually recognize is a natural and reasonable thing. Security in most companies is a luxury. Compliance is the must have. The security above and beyond it, that’s a luxury.

So, when you have good security often means that you’re living in rich times. Like your company has a lot of money to throw around. Security is getting hit with that budget. It’s fantastic. You reduce the breach count. But guess what? Then lean times show up, and the company is cutting everywhere. It’s not that they’re saying, “Oh, we haven’t had any security breaches.

Let’s cut the security team.” It’s that they’re like, “We have to cut everywhere.”

[David Spark] Right.

[Andy Ellis] Now, there is a piece of this which is, “Look, if you are spending a lot of money and your only demonstrated value is that nobody knows you exist because nothing bad is happening, you’re doing a really bad job of marketing. So, you should always be marketing what you’re doing. So, “Oh, there’s a near miss that was saved by an engineering team’s work on a project you asked them to do two years ago?” You should be celebrating that engineering team very loud and publicly going, “Oh my God, so and so other company just got breached, and we didn’t because my buddy, Aamir, invested in this two years ago.”

[David Spark] Yes.

[Andy Ellis] Everybody will remember that you asked Aamir. You don’t have to say I did. And Aamir is going to be like, “Thank you for defending my budget when it comes around because people see that I saved the company.” So, celebrate victories.

[David Spark] Money is being well spent.

[Andy Ellis] Money is being well spent.

[David Spark] All right, let me pause you on this, and then I’ll get into the second question because I want to go to Aamir now. So, Aamir, we’re going to do the two questions separately. Aamir, the first question – how do you connect with the business to try to prevent that practice? Andy gave a great answer.

What would you add to that?

[Aamir Niazi] Basically we want to make sure that when we set our budget at the beginning of the year, we want to make sure that our priorities are laid out based on some sort of a framework, as you requested at the end of the question. Some sort of a risk assessment that kind of focuses you to think where you will be spending that kind of money.

And when the time comes for cutting budgets or costs, you need to be able to very clearly demonstrate to the business that you’ve done your risk assessment. “Here are your key areas where you want to focus on investing, and this is where you’re going to get the highest return on investment.” So, I think you want to continue to focus on your critical assets, your crown jewels.

Those are the things that you will need to continue to protect no matter how bad or good the time is in terms of economy. I think business or the board at the very least will expect you to be able to do that at the minimum.

[David Spark] All right. Aamir actually gave a nice combination of the two questions. Andy, I come back to you for the second question regarding when budgets get reduced, what framework do you use to make the cuts.

[Andy Ellis] So, I think first you should probably recognize that as a security team, a lot of what you’re doing is product support. Why do we do compliance? We do compliance so that we can sell a product. As a result, when you have to make cuts, you’re just going back to a product team and saying, “Here’s what we’re doing.” I have done this before where I walk back and I say, “Oh, you wanted FedRAMP High.

You want us to investigate FedRAMP High. Based on these cuts, that’s going to be one of the things I’m dealing with. Is that okay that we’re putting that on the table?” And when the head of products says, “No, I need you to keep investigating that,” I’m like, “Okay, here’s your other choices.” So, as much as possible, a framework that lets your customers pick what you cut.

So, it’s not that I’m hiding and trying to figure out what I’m doing. I’m going to come back and say, “Here’s the 20 products I support for you, head of products. I’ve got to do a 10% head count cut, so you’re going to lose some product support. Which products do you want me to not support?” Sometimes you will find you have more money as a result of this, or you’re now first at the table when in six months they’re like, “Okay, we found some more money.

We’re going to go spend it. I would really like you to pick this product.”

[David Spark] So, let me push back with you just a little bit on this.

[Andy Ellis] Yep.

[David Spark] Is a little bit of that of like saying, “Well, what do you want to put at risk?” It becomes a little bit threatening.

[Andy Ellis] No, it’s not putting things at risk. It’s the same thing the engineering teams do. If an engineering team gets told, “Cut 20% of your head count,” they’re going back to the product team and saying, “This is what was on the roadmap. Here’s what the roadmap is going to look like. I’m just making sure you know what that looks like.” And I’m not walking in, saying, “Here are 20 things.

Pick which one.” I’m going to tell you which one I think you should cut because I don’t think it provides as much value. But if you want me to keep investing in that, you’ve got to make an argument of what are the things you’re giving up. The thing that I think too many CISOs do is they play this game of chicken, where they say, “I don’t want to cut anything, and I’m going to pretend the whole world is going to fall.

And then at the last minute I’ll cut some stuff, but I have no partners who agree with me that I’m doing less.” Because that’s what you have to have, that agreement.

[David Spark] All right. Aamir, I want you to make a quick comment to close this out because you were nodding your head all the way through this.

[Aamir Niazi] I am actually in full agreement with what Andy just said. You have to be able to look very closely at your tech stack and say, “Look, what is providing me value the most, and where I can just cut and that doesn’t have any ROI in my tech stack?” I think that answer can only come from the people who have the technology implemented and are managing it and operationalizing it from a day to day basis.

So, that would be security team. I absolutely agree with what Andy said.

Would this person be a good fit for the job?

11:06.645

[David Spark] What are some red flags in a cyber security job interview? Now, one example that came up on the cybersecurity subreddit, an interview for a senior position where the interviewer spent most of the time asking cloud certification questions rather than focusing on practicality. Now, what does an interviewer only focused on textbook answers tell you?

And I’ll ask, what other types of interview questions tell you about the role and/or company that say, “Eh, maybe this is not for me.” Aamir?

[Aamir Niazi] Yeah, so that’s a really good question, and I’ve seen interviewers where they just follow one question after the other, focus on the technical question and answer, and not really get to the essence of an interview and interviewee process.

[David Spark] Not active listening, which is key.

[Aamir Niazi] Exactly. Not active listening, and the interview has to be a two-way street. It should not just be the interviewer asking questions. It needs to be more of a conversation. And it is your job and responsibility as an interviewer to make the candidate comfortable during the interview process.

So, focusing on certification based questions will get you some level of understanding of what the technical competency of the candidate is. But at the end of the day, it has to be a fit both ways. So, you must make sure that the candidate you’re interviewing is the right fit culturally, skill wise, and has the capability and the strength to carry on whatever initiatives you have planned for that candidate when he joins the team.

[David Spark] Andy, I throw this to you. What is a clueless interviewer doing, I guess is really what we’re looking at?

[Andy Ellis] Oh, so I actually must agree, I think the interviewer probably didn’t know enough about what they were interviewing on, and I agree with everything Aamir just said. But I’m going to take it a completely different direction, which is I think the interviewee screwed this one up royally. I went and I read the Reddit post, and everybody should go read this post, and you should see the massive opportunity this person missed.

Because from the sounds of it, they went through the interviewing insisting on not giving textbook answers. When they were asked a textbook question, they were like, “Well, I’m going to give the practical answer.” And then they get corrected about what the textbook answer is.

Now, what they should have been doing is said, “Well, the textbook answer is that you would do something like this. But in my experience, you have to be aware of all of the nuances.” Like demonstrate that you know what the book says. You know when to use the book, when not to use the book. When I read their post, I read this as you walked in, and you were basically like, “I’m smarter than you.

You only have a certification, and I’m going to insist on pointing out that your certification is worthless.” Well, I don’t want you working for me, even if you are smarter than the people I’ve got. That attitude, especially given that the title of it was “Cert Bros and Definition Bros are Ruining the Cyber Security Industry.” If that’s your language, have a nice day.

[David Spark] Well, this goes into what our other cohost, Mike Johnson, says, this is also the sign of the brilliant jerk, too.

[Andy Ellis] Absolutely. And we often talk about the brilliant jerk, and how do you invest the energy to redeem the brilliant jerk that you rely on. You don’t work for me. I don’t want to invest any energy in redeeming you. But as a listener, here’s what I’m going to tell you. If you’re a brilliant jerk, stop being a jerk and use this as an opportunity to be like, “How do I take somebody who believes they have all the knowledge because they’ve got a certification, show them that their knowledge is valuable, and also show them that there is more knowledge beyond that that I would be a helpful mentor to them or a partner to them.” Because that’s what you’re interviewing for.

You’re interviewing for the job to come in and up level your entire organization, and you just said, “Your organization has no value.”

[David Spark] All right, Aamir, I’m going to let you close this out. I’m going to ask you the question of have you ever hired a brilliant jerk? Have you interviewed brilliant jerks? Can you manage a brilliant jerk? The person that Andy just described, have you dealt with that before?

[Aamir Niazi] I have dealt with brilliant jerks in an interview process. I’m lucky enough to not have hired a brilliant jerk so far.

[David Spark] When you’ve interviewed them and it’s clear… Like maybe they’re trying to prove that they’re smarter than you, and maybe they think that’s a tactic to get them hired. Like, “Oh my God, this guy is so talented. I must have them on my team.” Is there a way that you coach them? Like, “This is not the way to be approaching me.”

[Aamir Niazi] I have. Sometimes the candidates will basically ramble on with confidence, might I say. They will continue to ramble on in order for them to prove to me, as a hiring manager, that they know it all. My honest feedback towards the end of…and my transparent feedback towards the end of any interview is if I feel that you’re not the right candidate for the job, I will honestly give you that feedback right there and then so you’re not waiting weeks, months for somebody to call you and say, “Look, I’m not qualified.” And when I give that feedback, it’s coming from the heart.

And I’m giving that feedback as a mentor to that person, not as a condescending… I don’t want to say the word.

[Laughter]

[David Spark] Condescending jerk.

[Andy Ellis] We’ve actually walked people out of interviews.

[David Spark] Whoa.

[Andy Ellis] Everybody an interview panel was actually allowed to veto a person. And if we vetoed them, we would walk them out. Like they’d get one more interview while we’d go get whoever the HR recruiter was or the hiring manager, and then we’d just be like, “Yeah, we’re done. We’ve already made our decision that you’re not the right fit for us.

We’re not going to waste your time by having you sit through two more interviews when we’ve already decided, and we’re not going to waste the time of our people either.”

[Aamir Niazi] I think that’s the best thing you can do for a candidate.

[Andy Ellis] And it gives them real time feedback that what they did in that interview is what gets them not the job. It’s not that there’s a better candidate.

Sponsor – Cyera

16:48.357

[David Spark] Before I go on any further, I do want to tell you about our absolutely spectacular sponsor, and that is Cyera. Now, we all know that data is the largest and fastest growing security attack surface in the world. Every business is using data to collect insights and create new products, but they have to do so without placing the business at risk.

Solving data security starts with knowing your data. This is where Cyera’s data security platform can help. By the way, we’ve talked about this a lot. Once you categorize it, now you can manage it. So, here’s what Cyera does. Discovers your data attack surface, monitors, detects, and responds to data risk, and helps govern data use.

Imagine if your organization’s OneDrive was compromised by ransomware. Yikes.

Would you know what data was in your OneDrive? Would this trigger a compliance issue? How much would it cost you to outside counsel determine the materiality of this? Oh my God, and this is, by the way, a major legal issue if you’re not already aware of this. So, Cyera delivers the insights you need.

It starts with their agentless approach to data discovery, which occurs across any environment – cloud, SAS, even on premises. Making deployment fast and simple. Cyera’s classification is based on their own LLM and has an accuracy of 95%. Companies like Paramount Pictures trust Cyera to discover their data, its sensitivity, and who has access to it.

To learn more, just go to their website. I’m going to spell it for you. It’s cyera.io. Go check it out.

It’s time to play, “What’s worse?”

18:43.651

[David Spark] It’s time to play, “What’s worse?” All right, Aamir, I know you know how to play this game. Two awful scenarios. These are two kind of more annoying scenarios, not necessarily horrible. I mean because technically at the moment they’re not horrible, but they could be horrible.

[Andy Ellis] Oh, I like these. These are more fun than the horrible sometimes.

[David Spark] I mean they are horrible. They’re both horrible, but they’re not immediately bad.

[Andy Ellis] Yeah, but the immediate horrible, it’s like sometimes you’re just like, “Okay, fine. I could die in a fire or die in a flood, which do I want to do.” That’s less exciting than sometimes the annoyingly horrible stuff.

[David Spark] So, this comes from someone anonymous. I know who it is, but I don’t… I can’t say who it is.

[Andy Ellis] Do they have a pseudonym yet? We should give them a pseudonym?

[David Spark] No. No, but maybe we can work on that.

[Andy Ellis] We’ll give them the pseudonym after we hear their scenario.

[David Spark] Maybe you could do that. All right. I always make Andy answer first. All right, so a SOC leader, Security Operations Center leader, who does not think to do third party do diligence on a vendor they are sharing data with during a proof of concept. Okay? Just a proof of concept. Or…

[Andy Ellis] Happens all the time.

[David Spark] Or a CEO who says security is a priority but is repeatedly failing phishing simulations. Which one is worse here, Andy?

[Aamir Niazi] [Laughs] That is amazing. I love the scenario.

[David Spark] [Laughs]

[Andy Ellis] The nuance of what does it mean to be repeatedly failing a phishing simulation… Because the reality is if I crank up the complexity on the phish, everybody is repeatedly failing them. Let’s just be very clear.

[David Spark] Yeah, I know. You can always find something. But it’s a CEO that’s doing it a lot. And, again, this is just a proof of concept where they’re not doing the due diligence with the third party. So, which one is worse here?

[Andy Ellis] So, what’s annoying about this one is both of these are real. Neither one are you actually going to deal with in your organization. Like yes, you have people who do proofs of concept all the time, and they don’t actually do full due diligence on it, whatever. We wish they would get better at it.

This one is… So, I’m going to call this one the SOC darner. That’s my nickname for the person.

[David Spark] Okay.

[Andy Ellis] You’re now the SOC darner, because darn it, I don’t like either of these, and one of them is about a SOC. God, these are mediocrely bad. This makes it really hard. Because usually I don’t… I’m like how do I convince Aamir to convince with me.

[David Spark] Oh, you don’t have to agree with him, Aamir.

[Andy Ellis] I know, but I want him to. I don’t have a compelling argument for either one is my problem.

[David Spark] By the way, kudos to the person who sent this in.

[Andy Ellis] Yeah. I’ve never been stumped like this.

[David Spark] I’ve never seen you stumped like this before, Andy. This is a new one for you.

[Andy Ellis] So, for listeners, when you’re submitting one, notice how these are two very different problems, but they’re at a comparable level. What often makes it easy is you take two very similar problems, and you think they’re comparable, but they’re not. It’s, “Oh, it’s A or B,” and I’m like, “Oh, I have to pick one.” This is like, “A or 75.” I have no idea how to pick between these.

So, I’m going to actually say the first one is the worst. The SOC leader who’s not following the process, because they’re a security person. And if they’re not willing to follow the process, I’m never going to get anybody else to follow the process. My CEO who falls for phishing scams, if I absolutely need to, I’m going to reroute all their email through their chief of staff and say, “You can approve mail to go to the CEO.”

[David Spark] [Laughs]

[Andy Ellis] “But nothing goes to the CEO unless you have seen it, and this is your problem to deal with.” I recognize it’s totally unpalatable, but I just get to joke about it. So, I think the first one is absolutely the worst.

[David Spark] All right.

[Andy Ellis] Because my CEO has no access to anything. Like compromise their machine? What do they have it? Budgets that nobody follows?

[Laughter]

[David Spark] Aamir, I throw this to you.

[Aamir Niazi] I mean, that’s one way to think of this. I definitely agree with you. I think the SOC scenario is the worse one. On the flipside, I think I want to kind of disagree with you respectfully that compromising a CEO through a phishing campaign could…especially somebody who’s been repeatedly failing the phishing campaigns.

And if he was to click on an actual phishing scenario…

[David Spark] Yeah. I mean this is a sign it’s going to happen. If you’re batting 1,000 on you training day, chances are… [Laughs]

[Andy Ellis] As I always say, human error is a symptom of a system in need of redesign. This is the mail server’s fault, not the CEO’s fault.

[Aamir Niazi] That’s true. The gateways…the email gateways let that phishing through, yes. But that’s why we have defense in depth. But short answer is I think I would go with the CEO scenario because that could result…

[David Spark] That being worse? The CEO scenario is worse?

[Aamir Niazi] That being worse because that could potentially result in compromise of your entire network if you don’t have the right controls in place.

[David Spark] Andy, Aamir is correct, by the way.

[Andy Ellis] I don’t think Aamir is correct on this one, but that’s okay.

[David Spark] [Laughs]

Why is everyone talking about this now?

23:34.437

[David Spark] What do we mean when we say offensive security today? And by the way, can I just say I get the idea, but, man, has the branding really been screwed up on that term. Royally.

[Andy Ellis] I find this whole conversation pretty offensive.

[David Spark] There you go. That, too. Okay.

[Aamir Niazi] [Laughs]

[David Spark] So, what does the heck does offensive security mean? Does it mean aggressively hacking back? Does it mean red teaming? So, Tom Eston at Security Week might have hit the nail on the head by saying the term is, “in danger of becoming one of those overused terms that means everything and nothing.” So, Eston makes the argument, “Offensive security should mean shifting from an ‘attack of the month’ mindset and looking at the organizational ecosystem as a whole with the goal of outpacing attackers preemptively.” If that’s the case… Aamir, I throw it to you first.

How far outside of traditional red teaming does this take offensive security? So, is offensive security, let me just ask, different than red teaming?

[Aamir Niazi] I think the term has evolved over time for sure. Knowing red teaming in a traditional sense is you’re basically trying to break into your own network or have a separate red team internally versus a blue team trying to just test your controls on a day in and day out basis. Or you have a red teaming engagement by an external party to come in and do a scope testing.

The term offensive security, I think, has evolved to include everything in terms of protecting and defending your network. Basically from the bad actor’s point of view, you want to make sure that you’re constantly testing your controls.

And if you find any holes, gaping holes, there, you’re notifying purple team or the blue team to make sure that they put the proper detective measures in place. I think in today’s and in my opinion…and people I’ve talked to in the industry I think often see security as a blanket term for anything similar to red teaming exercise.

So, it has taken a life of its own, which essentially means you’re going to continuously test your controls. And if you’re looking at it from the federal government agency’s perspective, I think offensive security has…they have the ability to fight nation state actors, like you said, attacking back and compromising them.

I don’t know of any enterprise that actually do that or have the capability and the resources to do that.

[David Spark] All right. Andy, I take this to you. Your take on offensive security, and is it evolving red teaming?

[Andy Ellis] Well, I think people are trying to evolve the term because they like it. It’s so sexy. It’s like, “Oh, we’re offensive security.” But I’m with Aamir on this one, which is, look…

[Aamir Niazi] Yeah.

[David Spark] I think it has to just do with body odor, doesn’t it?

[Andy Ellis] [Laughs] Could be. I started my career in an organization that did offensive and defensive security. Let’s be very clear, that’s where I started my career. Our offensive program was go break into other people’s stuff. I didn’t work on that side of the house. We learned from them. Like our defense was informed by our offensive capabilities.

But offense meant leave our place and go into somebody else’s place, and make bad things happen to them. This was the US military. We had legal authority to do that because we were the military.

As Aamir knows, if you’re an enterprise, you probably don’t have the capability, but you absolutely have zero authority to do this. There is no self defense argument for hack back or offensive security. You should not be engaged in this unless you are a nation state. Period. But what’s happened is all these people who want to be sort of associated with the cool hackers, it’s like, “Oh, we can do offensive things, but let’s do it legitimately.” They want to keep that name.

And, look, if you want to say, “Look, we’re threat informed. We’re adversary informed,” whatever, great. But I’ll tell you, when I hear offensive security, instant turn off. Because what I hear is you would like to be a hacker, red team, like doing bad stuff to people, but you also want to get paid legitimately, so you’re trying to do a thing.

If what you are is a red teamer or pen tester, that’s what you do.

[David Spark] Are you completely against this term, offensive security?

[Andy Ellis] I am absolutely against this term because I think it confuses things, and what you’re actually trying to do is carry the cache of a nation state offensive team into some other capability.

[David Spark] I’ll be honest, I didn’t see it as the term offensive is offensive, which I’m getting from you.

[Andy Ellis] Yep.

[David Spark] I just felt it’s way too confusing is more my concern, but that’s a good point.

[Andy Ellis] Because part of the reason that it’s confusing is because a lot of folks… And I know I’ve been one of them. Anytime somebody said, “How do you feel about hack back?” I’m like, “It’s illegal. Stop doing it.” This is a very clear robust line, is this is the place where the physical world doesn’t translate to cyber.

In the physical world, there are offensive actions you can take as part of defense. Right? Somebody breaks into your home and pulls a gun on you, and you can shoot them in most states in the United States. There’s a lot of stuff you can. Your security guards can shoot, detain, and do things that is okay.

You can’t do that in the cyber realm. Because the moment that you reach out past your perimeter, you are no longer engaging in self-defense. I don’t care if somebody is launching a DDoS attack against you, and you know the machine that is their command and control. The moment you take an action to disable the command and control, that is an offensive action that you do not have any legal justification.

I’ve never found a lawyer who says, “I can argue self defense on that action.” It doesn’t exist.

[David Spark] That is a really good point about physical world and digital world.

[Andy Ellis] Right. There’s a ton of things in physical world that count as self-defense. But, look, if somebody is trying to hurt you in the physical world, like they’re just an adversary. If a computer is trying to hurt you in the cyber world, it might also be an iron lung machine keeping somebody alive.

You break it, you kill someone. Nobody is going to sign off on that. That’s what we have nation states for.

Where does the CISO begin?

29:41.751

[David Spark] We’re well into the first wave of LLMs hitting the market and still trying to figure out their implications. While a lot of the primary LLMs from Open AI, Google, and Anthropic have gotten a lot of coverage, we’re also seeing startups offering more focused services on top of them. It’s early days, so we’re seeing a lot of variety from chat bots to help handle risk assessments, to filling out compliance surveys.

“Slap some AI on it,” is de rigueur these days. How do you go about evaluating these products? I don’t even know if you are, but I’m going to ask you, Aamir, first. Where do you think we’ll see the most value? And, again, we’re talking about these smaller startups. I mean there is so much investment going on in AI and security.

And are these startup products eventually just going to be features to other things right now, or are they going to be standalones? I’m asking a lot here, but I think really the bottom line, what I’m asking here is are you looking at these startup AI tools out there, and are you seeing value, Aamir?

[Aamir Niazi] Yeah, so I can speak from financial services perspective. There are definitely a lot of R&D happening and innovation happening in terms of assessing the tools to understand what financial use cases they can provide the most value for us. Specifically in cyber security, we’re starting to look at Microsoft Copilot like a lot of other organizations, but even that is still being assessed in terms of what the risks associated with that may be.

Like does it have the ability to take our internal data and somehow make it available to bad actors out there in the Microsoft Copilot ecosystem? Right? But one of the most, I think, interesting areas that AI is making it available to the practitioners and users is the increased efficiency it gains in terms of national language processing techniques.

You can use NLP to extract insights from one structure’s security data sources such as security reports, incident tickets, threat intelligence fees, and so on.

So, if you have the right product implemented, it can really empower your SOC, your security analyst, to free up a lot of their time and automate and provide a lot of true value. But, again, there’s a lot of advancements happening there, and by no means… I am not an expert in AI by myself. But in order for us to understand what the capabilities, and features, and tools like this are, it is fundamentally important for us to understand the components of what AI is built on.

So, the things like transformers, the taxonomy, the tokenization, things like that, you should be able to understand as a security practitioner in order to make informed decisions about any of those tools.

[David Spark] Understand what’s under the hood. Andy, how are you looking at these tools? Working at YL Ventures, I’m assuming you are looking at them.

[Andy Ellis] Absolutely. Looking at a lot of companies that want to be in the space, that are in the space. And I think I sort of partition AI into three different categories here, especially around LLMs. I’m not even talking about other parts of AI. So, one is the companies that are fundamentally outsourced body shops transforming themselves with AI.

I think that’s the place we’re seeing the biggest transformation from AI is just think about like Slide Generation. For those of you who never had to build slides, it’s a pain in the neck. You hire some designer, and now we have a bunch of AI apps that are like, “Oh, I’ll do your initial slide design for you.” I’ll be really honest, I don’t find they work really nicely for me because I have very particular taste.

But for most people, this is a world better than what they are using and way fast. That’s transformative.

It’s going to drive the SaaS native conversion of companies from running as a corporation that owns its apps and people to one that does it all through SaaS. That’s area one. And I think we’ll see pieces of that even in the security space. There is a second space, which is existing vendors using AI to augment.

Where it’s, “Oh, we need to generate remediation instructions because we just had a detection. We’ll ask an LLM to generate the remediation instructions for us. And then hopefully we will validate the answer that it gives to make sure it’s pointing you at an actual package and not just a hallucinated package that an adversary can go squat on.” I think that’s going to be interesting and value…not transformative but very valuable.

I don’t want to have someone say, “Oh, Andy said this is not transformative. It won’t matter.” No. Every vendor who’s out there, if you have humans interacting with your product, that’s an opportunity for AI to create ergonomics for that human. The third area which I’m more skeptical on but I think will be the most transformative in the long run is using AI to sort of completely transform how we’re doing security operations, whether it’s SOC technicians being replaced by AI agents that will then escalate to a human, whether it’s doing vulnerability remediation orchestration entirely by AI.

Here, I see a lot of people saying, “Oh, I’ve got an idea for this.” I think we don’t even know what that transformation is going to look like, and it’s going to surprise us with who actually ends up leading the way there.

Closing

34:56.444

[David Spark] Excellent. Well, that brings us to the very end of our show. I want to thank our guest, Aamir Niazi, who is with SMBC Capital Markets. He’s the CISO over there. I’m going to let you have the very last word in just a second, but I do also want to thank our wonderful sponsor, Cyera. Remember, their website is cyera.io.

Holistic data security in one cloud platform. Please go check out their website and understand what data you have. Once you classify it then you can mange it. Andy, as always, thank you so much. Excellent job. Have a phenomenal week during RSA.

[Andy Ellis] Tomorrow, you can’t measure risk is actually the talk I am giving. So, for those of you who have made it this far and are listening, I know a lot of you are FAIR advocates. I am going to go tell you why you should stop using FAIR.

[David Spark] It’s interesting you say that. There are people who love FAIR, and it sounds like people like you who do not love fair.

[Andy Ellis] I think fair is a very useful gym exercise. You should use it to exercise your brain, but it is not the skills to take out into the world.

[David Spark] Aw, interesting take. Leave it in the gym, if you will.

[Andy Ellis] Yep.

[David Spark] Aamir, any last thoughts? Are you hiring? Give us the lowdown.

[Aamir Niazi] Yeah, definitely. We are definitely posting some roles hopefully in the next couple of months for [Inaudible 00:36:17], and we are looking to bring in some really smart DevSecOps, and AppSec people. There’s all that work happening on the CI/CD pipeline front, and maturing our pipelines, and containerization.

[David Spark] So, I’m assuming reaching out to you via LinkedIn would be a good way if someone falls into that category?

[Aamir Niazi] Absolutely. Yeah, for sure.

[David Spark] Awesome. Well, thank you very much, Aamir. Thank you very much, Andy. And thank you to our audience. We greatly appreciate your contributions and for listening to the CISO Series Podcast.

[Voiceover] That wraps up another episode. If you haven’t subscribed to the podcast, please do. We have lots more shows on our website, ciso-dev.davidspark.dcgws.com. Please join us on Fridays for our live shows – Super Cyber Friday, our Virtual Meetup, and Cyber Security Headlines Week In Review. This show thrives on your input.

Go to the participate menu on our site for plenty of ways to get involved including recording a question or a comment for the show. If you’re interested in sponsoring the podcast, contact David Spark directly at david@ciso-dev.davidspark.dcgws.com. Thank you for listening to the CISO Series Podcast.