Many businesses realize that cyberattacks are inevitable and a sound business policy, led by the security department, is one of resiliency. Business continuity planning and disaster recovery are understood goals, but getting started and getting all parties coordinated is where the difficulty lies. Where should a resiliency plan begin to deliver the most immediate impact?

This week’s episode is hosted by me, David Spark (@dspark), producer of CISO Series and Andy Ellis (@csoandy), operating partner, YL Ventures. Joining us is Patti Titus, CISO, Booking Holdings.

Got feedback? Join the conversation on LinkedIn.

Huge thanks to our sponsor, Cyera

Full Transcript

Intro

0:00.00

[Voiceover] Best advice I ever got in security. Go.

[Patti Titus] Never walk into an executive’s office and tell them they’re violating a policy like your password policy. It’s the fastest way to get shown the door.

[Voiceover] It’s time to begin the CISO Series Podcast.

[David Spark] Welcome to the CISO Series Podcast. My name is David Spark. I am the producer of the CISO Series, and joining me as my guest for this very episode, it’s my cohost and your favorite as well. It’s Andy Ellis, the operating partner over at Weill Ventures. Andy, say hello to the audience.

[Andy Ellis] Good morning folks. Or, depending on when you’re listening, good afternoon, good evening, or maybe even good night.

[David Spark] Now there is a possibility that people are listening to us as they’re sleeping and they fall asleep even before the very beginning. I have fallen asleep during a podcast.

[Andy Ellis] I should add “sweet dreams” to the end of that.

[David Spark] Sweet dreams. Maybe add that too. It’s possible. Hey, our sponsor for today’s episode is Cyera: holistic data security, all in one cloud platform. Pretty darn cool stuff. They have empowered AI to greatly improve the ability to categorize and then manage your data. More about that a little bit later in the show.

Now, Andy, are you on the Facebook platform?

[Andy Ellis] Yes, I am.

[David Spark] So you are subject to a lot of photos of your friends’ kids and babies maybe as well, yes?

[Andy Ellis] “Subject to” isn’t quite the right word. I actually enjoy that more than most of the other Facebook content.

[David Spark] Okay, no, but here’s my—I say “subject to” because what is the limit of the number of baby photos you can handle? Because our photos of kids—I’ve determined that the number is three. After that, I got it. Your kid’s cute. We’re all on board. I don’t need to see more than three.

[Andy Ellis] So when you say three, is that three in one post or is it three posts in a row?

[David Spark] In one post.

[Andy Ellis] Oh, but Facebook collapses them down for me. I don’t have to open it up if I’m not feeling into looking at 50 pictures from your kid’s recital. But if I am, I’ll click on it and go do it. I actually like this feature of Facebook that it’s four pictures is the most it will show on scrolling.

Now, what I dislike is when somebody is going to post the same picture of their kid over and over again or just slightly different ones in different posts. So it’s, “We went to the farm and here’s a picture on the tractor. Here’s a picture on this,” where it just becomes a wall of photos that takes over Facebook.

But that’s just really about social media timeline management.

[David Spark] But I’m more talking about, say, you open—let’s say you open up the photos of…

[Andy Ellis] Okay, I’m going to do that right now.

[David Spark] And they’ve got more than three photos of their kid. Do you stop after three photos?

[Andy Ellis] Probably most days, but it’s not that I run out of my tolerance. I’m like, “Oh, I got it. Cute. This is great.” But sometimes I’ll scroll through. Like, I just had a friend come with me a couple nights ago. We went to Gillette Stadium to watch Tom Brady get inducted into the Hall of Fame and brought their very cute sub-one-year-old.

Actually, we were sitting next to us. I cannot get enough pictures of this baby in Patriots gear.

[David Spark] All right. That’s a unique thing, but I’m talking about other people. Here it is. As a parent, you could handle 1,000 photos of your own child, right?

[Andy Ellis] Actually, I think I might be able to handle fewer photos of my own child than somebody else’s child.

[David Spark] Wow. You’re an anomaly on this one. Indeed.

[Andy Ellis] If my kid’s annoying me, I don’t want to see more pictures of them.

[David Spark] Yeah. I can handle endless photos of my own kids. Three is the maximum of anybody else. After that, I’m done.

[Andy Ellis] Okay. That sounds like a David problem. Let’s ask our listeners. Tell us after you listen to this episode what your tolerance level is for pictures of other people’s kids. People, just to be very clear, like random strangers showing you pictures of their kids. My tolerance level is basically zero.

[David Spark] I agree. It has to be people—random strangers, not even one. Can’t even handle it. I don’t want to see it. All right, let’s get to our guest who we both know. And we had her on in a previous incarnation. It took a while to get her on in this incarnation. And we’re thrilled that she’s back on.

She’s now the CISO over at Booking Holdings. None other than Patti Titus. Patti, thank you so much for joining us.

[Patti Titus] Oh David, it is so great to be back here and listen to the two of you banter. Thanks for asking me back.

[David Spark] What’s your status on photos of other people’s kids that you know?

[Patti Titus] Bring them on.

What’s the best way to handle this?

4:41.054

[David Spark] What are the key components to this? Philippe Cornette outlined his thoughts on this on LinkedIn, breaking down the piece as frequent risk assessments, multi-layered security, continuous monitoring, awareness training, IR planning, backup and recovery planning, and business continuity planning.

Okay. These are all useful. I am not questioning the value of any of them, but I’m going to start with you, Andy. Which is the key one to focus on with regards to this issue of resilience, of surviving a cyber incident?

[Andy Ellis] So, first of all, I have to point out I read this article, and I am pretty sure this is written by AI.

[David Spark] Okay.

[Andy Ellis] Like maybe it’s not, maybe he just has a style that looks exactly like AI.

[David Spark] I never saw anyone summarize the resilience thing, and I’m like, “I guess it’s a good question for AI,” but I liked it that he did this.

[Andy Ellis] What I didn’t like is he’s combining defense and resilience into one sort of area and mixing things up. Like, there is defense: how do I make sure that I don’t have a bad day? And there’s resilience: how do I cope with bad days? And when I think about resilience, the biggest thing is to think about it as an economy.

How can you cope after the fact with a bad day hitting you in the same way? Let’s take the United States as an example. Like, we have catastrophes hit this country on a very regular basis. And we define resilience as like, “Oh, how much economic weight can we throw into the problem to deal with the people who are in the middle of crisis and then to restore and recover and get back on track?” And there are countries where there are still ruins from 50 years ago from wars that they fought in because there’s zero resilience in that architecture to recover and restore; like, they don’t have the economic weight, and that’s not their focus.

So, in the cyber world, that’s the way I look at it. It’s entirely about how do you deal with the incident as it’s happening? So, it’s incident response. And how do you deal with cleanup after the fact? Do you just put a band-aid over it or do you actually fix the problems underneath it so you don’t keep getting beat up by the same problem?

[David Spark] So you’re defining cyber resilience as a sort of a greater understanding at what level you are dealing with the damage. All right, I’m throwing this to you, Patti. Do you attack it the way Andy described it? Or do you want to pinpoint one of these examples that Philip or AI outlined for us?

[Patti Titus] Yeah, I think incident response is pinnacle. If you don’t have a solid plan and you’re not testing it and you’re not updating it, you won’t survive. So I think that’s number one. Do you have the muscle memory? Are you sharing it with executives? Does everybody know what to do when it’s hitting the fan?

I think that’s probably the biggest thing. Subsequent to that, there are some things that are missing in cyber resilience. Like, I would broaden that to say, what about your staff? So, if all of a sudden everybody leaves and goes to work at a competing company to make 5% more, how are you going to handle an incident?

So people are really the centrifuge of any incident response plan, that they’re there, you can reach them, and they’re going to know what to do when there’s an incident. I loved Andy’s point, but I also think if you’re not doing IR, the other things don’t really matter.

[David Spark] And how do you communicate that to your team, saying we need to be very efficient, we need to do more tabletop exercises, or is there something else you’re doing beyond tabletop exercises to build up your IR plan?

[Patti Titus] Yeah, I think that continuous testing now that’s available where you can set up these little gamifications and have your team constantly going through the motions. So, there are a lot of great AI platforms out there where you can feed a scenario into it and say, “Hey, today we’re going to take an hour, and we’re going to focus on an incident, and let’s go and do it.” And then the teams can set up their own.

So I think giving the team the tools and I think the other part that’s really important is planned for the unplanned, which means bringing other parts of your organization, your GRC team, and letting them also experience incident response so you’ve got some continuity if some of your team happens to be on vacation.

So, I think that’s another part of it. And a lot of times you’ll find people in IT also want to participate. So, if you’ve got these platforms you can use, do that continuous testing and make it a little bit fun. So, gamifying it’s always funner than, “Hey, we’re going to do a tabletop on the latest greatest incident that happened down the street.”

Can this be measured?

9:36.024

[David Spark] Joe Sullivan, former CISO of Uber, said, “A security crisis will be judged by how well communications was handled rather than how substantively the security issue was mitigated.” Do you agree with this statement? I’m going to start with you, Andy. Is it all about the public and private communications and not the actual control of the security threat?

That’s not saying one goes well and the other goes badly, but he has a point that communication is what people actually remember. No one sees the reports of your security mitigation efforts.

[Andy Ellis] No, absolutely. So Joe said he’s spot on. Now note that he doesn’t say you don’t have to fix the problem as long as you can mess it up. And if somebody walks away with this, then they don’t actually understand what’s important here. You do have to fix the problem, but fix the problem is this very large scale between, “Oh, we did basic remediation,” to, “Oh my God, we were perfect, we were amazing,” but it does become all in how you communicate.

And what’s fascinating is how quickly the listeners adapt to language people use. Like, I remember at Akamai, we were one of the first companies to use the phrase “out of an abundance of caution” in our communications. We had to stop doing that within two years because everybody copied that phrase. And maybe we weren’t the first, but it became a trigger that when someone said “out of an abundance of caution,” you’re like, “No, it’s not out of an abundance of caution because if you’d had caution you wouldn’t have been in this world to begin with.”

[David Spark] But that’s a really interesting point about overused phrases because they start to lose their meaning. Like the most classic and which I don’t believe and we all hear it is “security and privacy is very important to us.”

[Andy Ellis] No, it’s— and the answer is, “Yes, it is important to us, but now is not the time to do it.” So, the communications is critical. And my biggest advice for people who are communicating during an incident with the public is you have an incident commander or an incident executive. And if it’s a security thing, that’s your CISO.

They need to be involved in the communications from start to finish. You do not hand over, “Oh, we have written up the technical details, and we’re going to hand it to the lawyers, to hand to marketing, to hand to PR, and they will go public with it,” because you will end up with awful. Because you do not have an integrated team that understands what happened, the law, and how to talk to people.

Like, you need all three groups at the same table. And so, if you are the incident executive or whatever you’re calling it in your organization, you are the final approval of every message that goes out. Whether your organization technically has somebody else approve it, if you don’t agree with that message when it goes out and you find out after it went out, you have a problem.

[David Spark] By the way, I saw Joe Sullivan say this very line at an event, and his presentation was amazing. So, if anyone listening has an opportunity to see Joe Sullivan speak, I highly recommend it. Patti, do you agree with this? It’s all about what you say and not necessarily what you do, even though they don’t have to be out of line here.

What do you say?

[Patti Titus] Yeah, I think it’s what you say and the frequency that you say it. So people want to have updated communications. And unfortunately or fortunately today, I think the SEC is forcing more companies to communicate more frequently, but I think the message—yeah, you have a crisis communications team.

I agree with Andy. Yes, you do need to have a technical person or a person that understands the incident sitting at the table. What concerns me a little bit, though, is some of my peers are stuck in techno-babble language. That’s what your comms people have to smooth out is what should that message be to the public?

And I think the other thing is you better pull your 10-K down and take a look at what you said so that you’re mirroring some of the same language. What you don’t want to do is say something drastically different than what is in your 10-K or if you filed an 8-K. You want to be consistent in all your communications.

This is where you CISOs don’t always get involved in the crafting of those communications. That’s really your first communication out to the public and your shareholders. So, messaging needs to be consistent. Your communications team is going to help you do that. Yes, you do definitely need to be sitting at the table.

[Andy Ellis] And if you’re not a great communicator, you will get a masterclass in communication if you do the, “Let’s open up a Google doc. We’ll start writing,” or SharePoint or whatever you’re on. We’ll start writing it collaboratively, you and somebody from the comms team and a lawyer. After you’ve done this for three or four incidents, you won’t be making the mistakes that most technical executives make.

[Patti Titus] And I’d suggest that you do that before you get into an incident situation. That should be part of your tabletop exercise with your executives. Let’s craft that message right now while we’re in the heat of battle, even though it’s a test, let’s craft it right now.

[Andy Ellis] Best time to practice. Other best thing to do: if you have a separate security incident response program from a technical incident response program, quit that. Merge them together and have your security staff work technical incidents. First of all, they will learn all the architectures in your company by doing that.

But more importantly, you can practice on other incidents as well that are more frequent than security incidents.

Sponsor – Cyera

15:10.901

[David Spark] Who’s our sponsor this week? Why, it’s none other than Cyera. Let me tell you about this. Data is the largest and fastest growing security attack surface in the world. Every business is using data to collect insights and create new products, but they have to do so without placing the business at risk.

So solving data security starts with knowing your data. I can’t stress this enough: knowing what you have and categorizing it. And this is where Cyera’s data security platform can help. Discover your data attack surface, monitor, detect and respond to data risk, and help govern data use. Imagine the following: your organization’s OneDrive was compromised by ransomware.

Would you know what data was actually in the OneDrive? Would this trigger a compliance issue? And how much would it cost you to use outside counsel to determine materiality? Cyera delivers the insights you need. It all starts with their agentless approach to data discovery, which occurs across any environment, cloud, SaaS, even on premises, making deployment fast and simple.

Cyera’s classification is based on their own LLM and has an accuracy of 95%. Companies like Paramount Pictures trust Cyera to discover their data, its sensitivity, and who has access to it. To learn more, visit cyera.io. That’s C-Y-E-R-A dot I-O. Check it out.

It’s time to play, “What’s Worse?”

16:41.496

[David Spark] Patti, I know you’re aware of this, and we were actually in a previous episode with Andy. One of our listeners actually found out how many people agree with him and disagree with him. And it’s a whopping 74 percent were agreeing with him. Now I must say that he does get to answer…

[Andy Ellis] Because Andy is brilliant.

[David Spark] No, that has nothing to do with brilliance. He does get to answer first. And sometimes these choices are easy to make, sometimes not so easy. But as everyone knows, I like it when everybody disagrees with Andy. No pressure, Patti. But I will make Andy answer first here. This comes from Jonathan Waldrop, who’s given us lots of wonderful “What’s Worse?” scenarios.

He’s the CISO over at The Weather Company. All right, Andy, here you go. What’s worse for a security leader’s career?

[Andy Ellis] Okay. For your career.

[David Spark] There you go. Scenario number one: you stay too long in a role that you’re overqualified for and become stagnant, not keeping up with developments in tech, the industry, whatever. That’s bad. Scenario number two: moving too fast and getting hired into a role you’re not ready for and then failing, and everyone sees you failing.

Which one’s worse?

[Andy Ellis] So, this one’s fascinating because it seems like the first person probably isn’t interested in a career. And the second one was too interested in a career. And so we’re at opposite ends of the spectrum because you’d like to balance both of these. You’d like to move. You’d like to maintain currency.

But I’m just going to go with I think that the second one is probably worse, but we should recognize that “worse” is—there’s a lot of different axes. Like, that person will probably still get jobs. Like, there are enough people who have failed up that you will find another job somewhere. It might not be at the place you wanted to go to.

Like, you might have thought you were on the path for a Fortune 5 CISO gig, and now you’re not. But that first—no, actually, I’m going to change my argument. I’m actually going to say the first one is worse.

[David Spark] Oh, wow.

[Andy Ellis] If you refuse to maintain currency, you’re not developing yourself. It’s not about staying too long in one place. It’s about the not keeping currency. Staying in one place could actually be a really good thing for your career. But I think we have seen a lot of people who are underqualified for the roles they’re in, fail, and then get hired again because it was like, “Oh, hey, this person worked at such and such a company, and they navigated them through the breach that they caused.” So, I’m going to actually say the first one, even though I think the second one should be worse for your career.

I just don’t think it is.

[David Spark] All right. I’ve never seen you argue with yourself. Okay, Patti, I throw this one to you. Which one do you think is worse? Do you agree or disagree with Andy here?

[Patti Titus] David, my goal today was to make you happy. I disagree with Andy.

[David Spark] Ah, thank you so much. And I’m glad that was your goal.

[Andy Ellis] So now my agreement rate is going to go down because David’s trolling everybody with this.

[Patti Titus] No, so I have a little bit of experience, at least in the first one, in staying in a job what appeared to be too long. You don’t have to go stagnant, to be honest with you. To me, what I don’t like to see is somebody who’s job-hopping every 12 to 18 to 24 months. And if they fail, they’re failing for a reason.

They don’t know how to build a program. So I think it’s worse—the second one is worse than the first one. So I’m disagreeing with you. I do think you can stay in a job. It forces you to figure out how to stay relevant.

[Andy Ellis] But you’re changing the dynamic. The question was you’re not staying relevant. Like, we don’t get to say—if it was just staying in one job for too long, I would completely agree with you. But the question was, and you don’t stay relevant.

[Patti Titus] Well, guess what? I still think employers look at it and say, “That person stayed at that company for X number of years. They’re loyal. That’s what I want at my company. I don’t want the job hopper.”

[David Spark] These scenarios are not saying that anybody’s a job hopper here.

[Andy Ellis] That’s right. So the challenge is, especially for Patti and I’m not going to say we’re old, but we grew up in a world where…

[Patti Titus] Thanks, Andy.

[Andy Ellis] But no, like, 20 years ago, if you had your resume sent to me and you only had one to two years at three different jobs, it was just an instant no. Because exactly what Patti just said, you’re clearly a job hopper. You got out ahead of your failure. But when we look at the economic conditions that a lot of people have been dealing with, like two years in a company often just means you got laid off, and it had nothing to do with you, especially in the startup ecosystem.

Like, this is just so often happening that I think people are not looking at two years in companies and saying, “Oh, like, you’re a job hopper,” especially if a couple of those are lateral movements.

[Patti Titus] All right. I’m just going to say that second one said, “and you failed and everyone saw it.” So I still think there’s something to be said for a little bit of loyalty for certain companies. And I think it depends too if you’re in a Fortune 500 or the startup world. I think there are some dynamics there that are different, but I’m just going to disagree.

Sorry, Andy.

[Andy Ellis] It’s okay. You’re welcome to. We’ve disagreed a lot in our career, and we’ve agreed a lot in our careers.

[Patti Titus] That’s true.

What’s the starting point for a CISO?

22:08.099

[David Spark] It seems like we’ve been talking about quantum computing being decades off for a few decades now. But a few recent announcements have made it seem like it might finally be moving out of a lab. Earlier this year, Microsoft and Quantinuum announced a major breakthrough in quantum error correction.

We’ve also seen NIST getting ahead of the curve by releasing quantum-resistant encryption algorithms followed by platforms starting to implement these in products from Apple to Zoom. So companies are already getting their services ready for a post-quantum future. As CISOs, Patti, how do we contextualize this news?

Is there anything we need to be implementing and setting up today?

[Patti Titus] Yes, we need to be thinking about our post-quantum strategies. What does that mean to your company? Have you gone out and looked at how you’re doing digital certs? Do you understand how you’re doing encryption? Do you even understand where you have encryption? As you’re looking at applying a new technology, have you asked the vendor, “Hey, what’s your post-quantum strategy?” What you don’t want to do is buy something that doesn’t have an ability to update encryption when the new encryption algorithm is available.

And I would say quantum’s here. It’s been here. It’s been used in labs for a while. You’re absolutely correct, David. But I do think we’ve got to get ahead of the curve instead of doing the Y2K thing and waiting until it’s out of the gate and then trying to figure out what your strategy is. That’s setting up your company for possible disaster.

I’ll say possible because we don’t really know what the implications of the post-quantum world are, but let’s not have another Y2K issue. For those of us like Andy and I who are old enough to remember Y2K.

[Andy Ellis] Oh my God, Y2K, which was a non-issue because we prepared for it.

[Patti Titus] Sorry.

[Andy Ellis] Some of us didn’t have to work for the government at the time, Patti. All the rest of us prepared for it. But I think the key—there’s a key difference.

[David Spark] Quantum computing is a tad more complicated than Y2K.

[Andy Ellis] It is, and that’s really important for us to draw the distinction. With Y2K, we knew what we had to do. Even if we didn’t know where we had to do it, at the end of the day, like, if you have a two-digit calendar field for a year, you’re screwed. Fix it. We don’t have the same thing for quantum computing.

But we should bring back the topic of resilience, because realistically what you should be preparing for right now is crypto resilience, because that’s the most impacted place that quantum computing is going to hit. That’s going to be a surprise. And so the question is, are you going to be able to change your roots of trust, which is your algorithms, the code that enforces them, and however you’re doing key distribution for a post-quantum world?

And you don’t know when that’s actually going to hit us. That’s actually the big key. And you should be comfortable with that uncertainty. If I’m a CISO, it is possible that tomorrow somebody’s going to announce a functional quantum computer that can break the keys that are used in every TLS transaction and the whole world has to pivot.

That is a reality. That conversation could also be in another 40 years. And you should be comfortable saying that.

[Patti Titus] I also think, aside from that, I met with some PhDs in Israel to talk about this during Cybertech one year. And they assured me that worrying about your encryption algorithms being broken on data that’s already been stolen—there’s nothing you can do about that. It’s already too late. So focus on what you can do in the post-quantum world.

It was very good advice because I was concerned about breaking our encryption algorithms, and they said the data they want, they already have. And they’re going to break it when they want it and use it. So the question is, looking back at any data that might have been stolen, what are your plans to do that?

There is intrinsic value in data that is 6 to 10 years old. Still, you need to be paying attention to that as well.

[Andy Ellis] The key piece here is recognizing that functionally, the world has two different classes of crypto that are in use, right? Often we talk about symmetric key versus public key, and mostly it’s the public key that is at risk. And so the data you’re most trying to protect is your symmetric keys that are encoded using public key cryptography.

Because if you’re encrypting data at rest and it’s encrypted with symmetric keys, it’s probably got enough protection for a while. You hope. What you’re trying to actually protect is the key you use to protect it. And if that’s been stolen, even encrypted with public key crypto, you should recognize that the day quantum decryption becomes a reality, you’re going to have an awful historical day as well as now trying to deal with changing your world for the future.

What’s broken about cybersecurity hiring?

27:16.736

[David Spark] If you ask cyber professionals, most will say that a diverse workforce is important in cybersecurity. Now, a 2023 ISC2 study found that 69 percent of pros say an inclusive environment is essential for a team to succeed. As noted by Aimee Chanthadavong for CSO Online and as Silje Hansen pointed out on LinkedIn, diversity offers strategic advantages to all teams, enhancing innovation, productivity, and resilience.

All right, we’re all on board with the diverse concept, but actualizing it is difficult. We have to admit this. We tend to gravitate towards people similar to ourselves. But, and this is what I believe, it takes a very secure leader to feel comfortable picking people who are at odds with them. Like, maybe people disagree with your “What’s Worse?” scenario, Andy.

But how does—and I’ll start with you, Patti—how does a leader proactively pull that off? People who don’t think like you and challenge your assumptions but at the same time you can work together and create greater value? Patti?

[Patti Titus] Yeah. So, first of all, a leader has to recognize that you need to fill your gaps. So, no person can be all things to everything. So, what are your gaps in your hiring? Are you looking for people with a certain type of MO? Or not, right? So that’s number one. Number two, you have to talk to your HR group to make sure that you’re getting a diverse pool of candidates to look at.

So, if they’re always going to a single source, you’re not going to get a diverse pool. I do think COVID gave us the opportunity to start looking across geographies for the type of people to fill those gaps. And somebody that proactively is trying to pull this off is actually looking for a lot of different terms in diversity.

What I didn’t see is narrow diversity. And I think that’s another key is that people that have diverse thoughts, different socioeconomic upbringings, all of that plays into it. So, there are a lot of questions you can’t ask during the interview process, but you get a good feel for people when you’re interviewing them.

And I always, I hate to say this, want to interview people for every job across my organization because I’m looking at more of the cultural fit versus the hard skills that maybe my security engineering team is looking for.

[David Spark] And Andy, I know you’re going to be pulling out your book, and you’re going to be quoting something from your book. But I also—I want to double down on this whole thing of you want to work together with people who disagree with you, and you purposely want them to challenge you.

[Andy Ellis] I’m going to say some really controversial things for a moment here. First of all, everybody, if you want to approach this, I really do mean go read my book, “1% Leadership.” I’m not going to quote a chapter because I literally have 25 chapters on this topic in all the different ways. But here’s my controversial thing.

All the things people say about diversity, mostly they’re talking about the trappings. You have an inclusive organization that supports people challenging you. Diversity is a trapping. Build the inclusive organization. Diversity is the thing you should be looking at to say, “Do I have discrimination in my pipeline?” If you’re not hiring any women, you don’t go hire women for the sake of hiring women.

You go fix your pipeline. You go fix the reasons you don’t have women in your organization. You don’t just bring in women to a non-inclusive organization and be like, “Oh, everything’s hunky-dory. Now I hired five women,” and the five women are like, “Except, like, you hate us. You don’t like listening to us.

There’s no inclusion here, and we’re going to leave and go somewhere else.” And now we’ll tell everybody what an awful organization you are. And there went your ability to hire the next group of women. Let’s focus on inclusion. Let’s talk about the place that diversity really does matter, which is diversity of experience.

So, if you have software in the hands of end-users and you have no women on your design team, your product team, etc., you will almost certainly have a bunch of guys who are very surprised when somebody says, “And here’s how this will be used for stalking.” And that’s not because women understand stalking; it’s women are more likely to have had experience with stalking.

[David Spark] I’m going to be brutally honest about this. We ran into this very problem, my very small team. We only have men on it. And we literally—we come up with these silly titles for this very show. And we did an insensitive title a while ago. Again, when we write these, we purely are going for the joke.

We’re trying to do something, and we didn’t realize that we did an insensitive title towards women. And there was another one where we had an image that had this sort of—had a kind of a feeling of stalking. Again, because it was all guys looking at it. And in both cases, we had a woman point it out to us who was a listener, and immediately we changed it.

And it was one of the things like, had we someone on staff do it? I thank our community for doing this for us, but we recognize that was our limitation.

[Andy Ellis] But you don’t hire a woman to solve that problem. You hire women because women are qualified. And the question you should ask yourself is, why is it that somehow we only keep hiring men? Like, how many women are we seeing as candidates for these positions? What is it about our job descriptions?

What are we doing wrong that the amazing women who are out there are not applying and getting through our system? And this is where many diversity programs get it wrong, which is they recognize that they have the wrong output. “You’re not hiring enough women.” And so what they do is they say, “We will just hire more women,” instead of fixing all of the systemic problems along the way.

Which is harder work but way more valuable.

[David Spark] But the line that I always hear is they go, “Oh, that’s a pipeline issue.” And I go, “Fix your frigging pipeline.”

[Andy Ellis] Here, I have a simple rule for everybody, and I’ll let Patti speak. She’s letting the guys speak over her. But here’s my simple rule, which is find the university closest to where you are that is graduating people in your discipline and look at what its graduation metrics are by demographics.

And if you’re not matching at least that, you’re going to fail. You are the problem. You can’t blame the pipeline if there are credible people at the entry level, if there’s numbers. Go figure out what you’re doing wrong.

[David Spark] No, but I’ve interviewed some leaders, and they say, “Oh, we get them from the university, and this is what the university gives us.”

[Andy Ellis] “This is what the university gives us” is different than “This is what the university is graduating.” Like, I have never seen an organization that said it’s a pipeline problem where that held up under inspection.

[Patti Titus] Yeah, let me just say, while you gentlemen have been talking, let me just say part of the other problem is equity. So we talk about D, we talk about I. So first of all, you’re never going to get D if you’re not focusing on I. Period.

[Andy Ellis] 100 percent.

[Patti Titus] Equity—we also have to remember that we need to pay equitably. So, if my male managers are making X, what are my female managers making? And you know what? A company has to be willing to really look at it and say, “Hey, I got a problem here.” And then correct it, because women are going to figure it out.

And oftentimes, we’re willing to take jobs for a little bit of a lower—because we look at it as a career move. It is some education I try to give people. Ask for what you want. But I think diversity and inclusion, if we don’t figure out how to get the inclusion component right and really understand what inclusion means, diversity is just a number.

It’s a ratio of number of demographics. That’s not going to drive a healthy organization, and you definitely want people who are going to disagree with you, or it’s not a healthy organization. And sometimes as a leader, you have to ask the provocative questions of your team in order to get those disagreements to come out.

People will be passive-aggressive. That’s not what you want. You want people saying it to your face, not behind your back.

Closing

35:41.461

[David Spark] That is a very good point. And that brings us to the very end of this show. And by the way, thank you for saying it to our face too, as well, Patti. I appreciate that. I want to thank our sponsor for today’s episode, and that is Cyera. Remember, holistic data security, all in one cloud platform.

Have them help you categorize your data so pretty much you can do everything. And it’s now possible. With AI, check them out at cyera.io. That’s spelled C-Y-E-R-A dot I-O. Andy, thank you, as always. Patti, we ask our guests if they’re hiring. Let me ask, are you hiring over at Booking Holdings?

[Patti Titus] So I’m going to say at the holding company, I don’t believe we have any jobs open in cyber. However, Booking Holdings is a whole bunch of other companies, so go look at our portfolio. And I do know that the CISOs in those other brands are actually hiring.

[David Spark] Awesome. And that makes—what? It’s Priceline, Booking.com. What else is part of that?

[Patti Titus] Kayak, Agoda, OpenTable, Fair Harbor, and several other smaller companies.

[David Spark] Excellent. Thank you very much, Patti. Thank you very much, Andy. And thank you to our audience. We greatly appreciate your contributions and for listening to the CISO Series Podcast.

[Voiceover] That wraps up another episode. If you haven’t subscribed to the podcast, please do. We have lots more shows on our website, CISOseries.com. Please join us on Fridays for our live shows: Super Cyber Friday, our virtual meetup, and Cyber Security Headlines Week in Review. This show thrives on your input.

Go to the Participate menu on our site for plenty of ways to get involved, including recording a question or a comment for the show. If you’re interested in sponsoring the podcast, contact David Spark directly at david@ciso-dev.davidspark.dcgws.com. Thank you for listening to the CISO Series Podcast.