As security professionals, we like to think we understand the risk to our organizations. But this conflicts with clear signs of cybersecurity hubris, whether it’s with cloud security audits or confidence in spotting deepfakes. When does confidence in your team turn into a willful blindspot?

This week’s episode is hosted by me, David Spark (@dspark), producer of CISO Series and Eduardo Ortiz, vp, global head of cybersecurity, Techtronic Industries. Joining us is Adam Fletcher, CSO, Blackstone.

Got feedback? Join the conversation on LinkedIn.

Huge thanks to our sponsors, Fortra, Quadrant Information Security, and Savvy Security

Full Transcript

Intro 

0:00.000

[Voiceover] Biggest mistake I ever made in security. Go!

[Adam Fletcher] The biggest mistake I ever made was thinking that a departing employee was the end of our program, and I realized that no matter how integral he was to the program, his replacement turned out to be a lot better. 

[Voiceover] You’re listening to CISO Series Podcast, recorded in front of a live audience in Florida. 

[Applause]

[David Spark] Welcome, everybody, to the CISO Series Podcast. My name is David Spark. We are recording live in Boca Raton at the Boca Raton Innovation Campus. 

[Applause]

[David Spark] All right, I’m very, very excited about the show. Let me first, though, mention my co-host, my co-host who has jumped in at the last minute because our previous co-host, unfortunately, caught COVID, could not be here, but this gentleman swooped in. It is none other than the global head of cybersecurity for the TTI Group.

Big round of applause for Eduardo Ortiz right here.

[Applause]

[Eduardo Ortiz] Hello, hello. Hola, hola, hola, South Florida. So, thank you very much. 

[David Spark] I am David Spark, the producer of the CISO Series, and let me mention our spectacular sponsors for the CISO Series. That would be Savvy Security, Quadrant Information Security, and Fortra, all sponsors of this very episode. And we are at the South Florida ISSA Hack the Flag Conference, and there’s a competition going on in the other room.

We’re doing the show in here. We’re very excited to be here, and it’s just been a blast to be here. Now, here’s the coolest thing, and I posted this on LinkedIn, and it got a lot of cred. And these are these awesome badges, which are five-and-a-half floppy disks. And there is actually something on some of these.

Does yours say anything on the other side? What does yours say? It says verbatim, but on the other side… 

[Eduardo Ortiz] Verbatim. 

[David Spark] No, but on the other side, does it say anything? Oh, no, those are just stickers you put on.

[Eduardo Ortiz] Empty one. 

[David Spark] All right, I’m going to bring in our guest here. I’m going to ask if he has anything. It’s Adam Fletcher, CISO of Blackstone. Let’s hear it for Adam. 

[Applause]

[David Spark] Adam, is there anything, any sort of software identification on your floppy, did you see? 

[Adam Fletcher] I got here too late. No badges left.

[David Spark] Oh, none left. Oh, so he doesn’t get one. Well, now the story I heard is they bought 300 of these online for about 200 bucks. So, I feel that the $200 was to pay someone to hoard these for three decades, pretty much. 

[Laughter] 

[David Spark] Because what else would you do with these things? No, these have got to be more than three decades old. I mean, these are old, very, very old. All right. What do you say, guys, we start a show here, huh? We’re going to do this?

[Adam Fletcher] Yeah.

[Eduardo Ortiz] Let’s go. 

It’s time to measure the risk. 

2:57.469

[David Spark] Where is our biggest risk blind spot as an industry in cybersecurity? Is it cloud security? Now, according to a Bitdefender survey, only 45% conduct regular cloud security audits. Another stat I found quite shocking was that, get ready for this, 85% of security professionals believed their colleagues, they mean other people in the security department, could spot deep fakes.

Yet, get ready for this, at the same time, nearly 97% said new GenAI tools pose a threat to the organization. So, how do we bridge the hubris of thinking our security department can spot faked videos with the universal realization AI tools represent a significant risk? I’m going to start with you, Eduardo.

I mean, I guess it’s good that people have confidence in their teams, but that seems like a massive blind spot. 

[Eduardo Ortiz] Yes, but for example, in our case, we are focusing on education and awareness, but also mostly for these specific cases on internal processes, right? If the process can be broken by a threat actor that managed to deep fake one of our employees to make a payment or make a different move, then the problem isn’t us, right?

It’s not about how much… I’m not pretending to have employees that are experts spotting this because I cannot pretend an accountant or a finance director to be an expert spotting deep fakes, but it’s more about our internal processes. We were victim already, pretending to be our CEO in one of our subsidiaries in Mexico, and the internal processes actually catch up the threat actor.

It was a deep fake that came through WhatsApp. So, it’s… 

[David Spark] I’ve heard, by the way, I spoke to someone who’s a CISO at a big pharmaceutical. They said they were getting 10 deep fakes a month through WhatsApp. I’m amazed that that much is happening. 

[Eduardo Ortiz] We were getting probably four a month, like one per week. 

[David Spark] That’s amazing that much this early. Adam, what do you think of this sort of split between, “Oh, we can spot deep fakes,” to “We know this is a massive problem.” 

[Adam Fletcher] Well, I think I’ll challenge the premise here and say that deep fakes are only one of several potential threats that GenAI presents. 

[David Spark] Yes, I agree. I agree. 

[Adam Fletcher] Right? So, maybe you need to separate the two because you would need to ask what percentage of security professionals believe that their colleagues could spot an AI-generated phishing email? What percent could prevent data loss due to the use of GenAI websites, right? There are a lot of risks out there, so I think both of these could be true.

[David Spark] Good point. So, actually, interesting thing. We brought this up on an earlier episode that we did at the Convene conference almost a year ago, and that is, and something I realized is that a lot of us have a lot of audio and video of us on the internet, and some businesses and families recommend having a password.

So, if you see a fake video or fake audio, make sure there’s some verbal password that never is communicated digitally, but just personally. Have you guys done something like that? 

[Adam Fletcher] I haven’t personally. I mean, my children are eight and six. I’m not sure they’d remember the password to tell it to the alleged kidnapper. However, I am aware of an executive who had this happen to his college-age daughter, and that was the advice that I gave him. 

[David Spark] But this is, I mean, just for families and also businesses. I mean, it’s a way to break the digital chain, essentially. Any experience with this? 

[Eduardo Ortiz] Yeah, we do have a code in our family. I’m not going to say which one it is. 

[David Spark] Yes, obviously.

[Eduardo Ortiz] But we do…are actually thinking about doing it with our executives in terms of a code word to validate specific high-level transactions or cases like this. 

What’s broken about cybersecurity hiring? 

7:04.533

[David Spark] All right, there are a lot of people at this event that are looking for a job in cybersecurity, and I want everybody to strap in for this quote. Get ready for it. It’s by Mic Merritt of an organization called Merritt Based, “There is no talent shortage. Never was. You can check to see the first place that rumor started, and it was industry certifications, vendors, and schools.

But companies don’t want skilled candidates either because they don’t want to pay for them. What we’re seeing in the industry today are companies pretending their security focus and advertising roles they never planned to fill. So they can convince their current overworked employees that they’re trying while telling their board they can’t find the right skills.

Any company that is actually interested in addressing their risk in securing their company is having no difficulty at all finding the people to do it.” Now I want to thank Rachel Bicknell of Dell for posting this and Brian Thompson of PNC for recommending it. All right, I’m going to start with you, Adam, on this.

Simple question. Do you agree or disagree with Mic Merritt’s statement about the cyber talent shortage? 

[Adam Fletcher] Disagree. 

[David Spark] Disagree. All right, walk me through. Because there’s some interesting arguments made here. 

[Adam Fletcher] Well, first of all, I don’t think that there’s anybody out there posting jobs that they’re never going to fill to try to present an image that they’re security focused. I don’t see how that would really benefit anybody. Second, there…

[David Spark] Hold it, no. And again, I’m only playing devil’s advocate here.

[Adam Fletcher] Sure.

[David Spark] Well, maybe a CISO trying to prove I’m trying to do my job here, I’m trying to get these positions filled, but hey, nobody’s applying, we haven’t found somebody qualified. What would you say to that? 

[Adam Fletcher] Still disagree. I think that, number one, most CISOs have to go through really hard processes just to get a job posted in the first place. I mean, the position has to be open, HR has to sign off on the job posting, it’s got to be put in a whole bunch of different places. I just don’t think that that’s really the case.

Now, if the CISO has decided that the requirements for the role are really narrow, then sure, it might be hard to find the right person. If you’re talking about skill set, location, years of experience, all of those things, maybe you need to be more open-minded to find the right people, but I think there are people to be found.

[David Spark] I mean, this person’s definitely jaded about the hiring system, and if you believe this sort of conspiracy theory that they’re all sort of in cahoots to sort of suppress the hiring of security professionals, maybe. I don’t know. What do you think here, Eduardo? 

[Eduardo Ortiz] So, I agree with Adam 100%. I haven’t met a single company that will post a position just to post it. I mean, you have to go through, first of all, the approval of the position, the finance aspect of the position, if you’re doing it the right way for travel and expenses, certifications, and education.

So, it’s a long process just to get one position open and post it, and it has to be approved by the executive team. So, I disagree. I don’t think there’s a talent shortage either. I agree on that. But the rest of it, I haven’t met a single company that does it that way. It would be counterproductive.

[David Spark] Let me ask you, are the two of you struggling to find talent? No, you’re not?

[Eduardo Ortiz] Not in our case. 

[Adam Fletcher] We have struggled in some cases due to location preference and the amount of time that we ask people to be in the office. I think that’s a trend that specifically in cyber, specifically with technical talent, has started to reduce the available pool of people in different localities, but it doesn’t mean that we were unable to hire.

It just means it took longer. 

[David Spark] Let me ask about the discussion of number of days in the office. How often did you have that conversation prior to the pandemic? 

[Adam Fletcher] Zero. 

[Eduardo Ortiz] Zero. 

[David Spark] Zero. And now is it every discussion? 

[Adam Fletcher] I don’t think it’s every discussion. There are some people who feel like they should be able to work remote all of the time. There are some people who really like the idea of being in the office and learning from their colleagues and being, let’s say, in a SOC where there’s a dozen people and they’re all back-to-back and they can talk about things just in real time by turning their chairs around.

But there are also people in certain roles like, let’s say, pentesters, who just want to sit at home and do as much work as they possibly can and don’t want to be bothered by coming into the office. 

[David Spark] So, here’s my argument. I was just thinking, like, I have a friend’s son who’s in his early 20s, and he’s working from home, and he hates it. And I think about myself when I was in my early 20s, and I worked in an office. And that was key for socialization and also for education. My feeling is if the 20-somethings don’t have seasoned professionals in the office educating them, we’re all going to be in trouble in about 10 years.

Eduardo? 

[Eduardo Ortiz] Yes, in our case, we’re very flexible about it. But surprisingly enough, most of our teams want to be in the office at least two or three days a week. We don’t force it. We offer a really good culture, a really good office environment. People, I mean, it’s really very inclusive, very open.

So, we kind of got ahead of the problem and said, “We’re going to be flexible.” It goes by department, but we feel for our security teams, it’s important, that integration of the team. We have our biggest team, which is in Milwaukee. Every other Wednesday, they play Backdoors and Breaches, and they have lunch together.

So, they discover situations about our own infrastructure that, “Oh, we never thought about that one.” So, it has become a really good social event for them, and now they’re super integrated on it. 

[David Spark] What about are you forcing a number of days in the office? Because also my fear is only the two or three days, like there are going to be a lot of days, it’s going to be sort of empty, and people being like, “Oh, why the heck did I come in today?”

[Adam Fletcher] It’s true. We have a minimum requirement. It’s based on your function in the organization, your level in the organization. I’m in the office. If I’m in town, I’m in the office five days a week. And I would just add that when we were all growing up, people of a certain age and seniority were all growing up, one of the things that always got talked about was water cooler talk, right?

Water cooler talk helps you develop as a professional, and if you’re not in person and you don’t figure out a way to force that over Zoom, it never happens. 

Sponsor – Quadrant 

14:04.150

[David Spark] We have three phenomenal sponsors on today’s show, and I’m going to tell you about one of them each at a time. And first is Quadrant Security. They are bad news for bad dudes. Quadrant’s XDR and advisory solutions combine the best people, the processes, and the technology managing your security so you can manage business operations, providing continuous detection and response from their 24 by 7 by 365 US-based security operation center.

Now Quadrant fortifies your front line to prevent, detect, and respond to real threats in real time. 

Now for a limited time, Quadrant is offering organizations a free dark web report, detailing available data on the dark web that is leaving you vulnerable. I’ve actually had one of these done before. You should definitely check these out if you haven’t seen what they know about you on the dark web. So, to learn more and receive your free dark web report for your organization, visit quadrantsec.com/darkweb.

It’s time to play “What’s Worse?” 

15:21.274

[David Spark] All right, it’s time for “What’s Worse?” This is hands down the favorite game from our audience. We have been playing this game really since the beginning we launched this show. Here it is. It’s essentially a risk management exercise. There’s two horrible scenarios. You won’t like either one of them, Adam and Eduardo, but you have to pick which one.

And we get these sent in from our audience. So, I say to you, audience, send me some more. A good “What’s Worse?” scenario are equally crappy. So, here we go. Let’s see. Sometimes our guests say, “This one’s easy to pick,” but we’ll see if this one’s easy or equally crappy. 

It comes from John Helt of Accenture Federal Services, and here is his scenario. The first, your IT staff are sick to death of receiving phishing awareness emails. So, what’s worse, two scenarios? And by the way, Eduardo, since you are my co-host, you get to answer first here. All right. Scenario number one, all IT staff use email rules to automatically identify, report, and delete your company’s phishing awareness emails on arrival.

All right? So, you have paid for some phishing awareness tool, and it’s all getting deleted immediately. Got it? 

[Eduardo Ortiz] Yep. 

[David Spark] Scenario number two, your entire IT staff report every single external email they receive as phishing. Which scenario is worse? 

[Eduardo Ortiz] I will have to go with number one. Okay. 

[David Spark] Why is that one worse?

[Eduardo Ortiz] Because it’s breaking the rules for the organization, right? Like, hey, you have to go through it. You’re part of our core IT group, so you’re part of the population. So, if we allow them to break the rules, then every other department is going to say, hey, I want those same rules applied to me.

[David Spark] Well, it sounds like they do this for every email in the whole organization. So, it’s not just their department. They’re doing the whole organization. 

[Eduardo Ortiz] Well, then that’s worse. 

[David Spark] Yeah.

[Laughter] 

[David Spark] That’s definitely even worse. 

[Eduardo Ortiz] And I’m doubling on one. 

[David Spark] But hold on. I’m just going to argue the second scenario. The all-IT staff report every single external email. So, that’s all emails for the whole organization are being reported as phishing. That’s going to drown the security department. 

[Eduardo Ortiz] Ah, if we automate it with something called AI or something like that, we can get by. 

[David Spark] Is that how you’re doing it right now? 

[Eduardo Ortiz] Well, we do have a lot of automation and can eliminate a lot of the noise. 

[David Spark] All right. I’m throwing this one to you, Adam. Do you agree or disagree? Which one’s worse here? 

[Adam Fletcher] When you clarified that the IT department was implementing those rules for everybody, then yeah, I think that’s worse. Then nobody gets any type of training. And although I don’t put a lot of stock in awareness training for phishing, I mean, phishing click rates can vacillate from less than a quarter of a percent to 10 percent, and training is important.

I think the pendulum swings back and forth and you still have to have good, layered defense and good technical controls to prevent an incident. 

[Eduardo Ortiz] I have to say the same. We don’t put a lot of emphasis on phishing tests. 

[David Spark] Okay, but now I just want to point that, I mean, the idea is that the IT staff reports every single email. Like you can do some automation, but you still have to review some of these emails. 

[Eduardo Ortiz] Ah, we’ll sit down with the CIO and kind of like, hey, your people are doing this. 

[Laughter] 

[Eduardo Ortiz] They’re creating a lot of work for us. So, you want us to be bad? 

[David Spark] You think you can still function, Adam, in a scenario like that? 

[Adam Fletcher] I think you can still function. I think you would find it easier for the SOC to figure out how to filter through every external email gets reported and figure out where the ones that are malicious are. Then nobody ever gets training. 

[David Spark] So, here’s my question to the audience. They think the first scenario of all IT staff use email rules to automatically identify, report, and delete your company’s phishing awareness emails on arrival is the worst. And the second being that every single email gets reported as a phishing email.

So, by applause, all deleted is worse. How many people think that’s worse? 

[Applause]

[David Spark] All right. That’s a good that’s a good amount. And then by applause, how many people think that reporting every single email is worse? 

[Applause]

[David Spark] A little bit lighter, but in general, the audience agrees with you. 

[Adam Fletcher] Thank you. 

What is Dave’s Mom talking about? 

20:02.029

[David Spark] All right. This is this is a new favorite game we’ve been playing lately, and it has to do with my mom, who is not a security expert. I know that comes as a shock to many of you, but my mother, an elderly woman who loves her son and is a good sport, really is what it is. So, I interviewed my mother on different terms in cybersecurity, and you are going to try to guess what the heck she’s talking about.

Now, if they fail, I throw it to the audience. All right? So, I’m going to play. I interviewed my mom about these terms. Some of them she kind of kind of figures out. Most of them she does not. But understand, if you were seeing this term for the first time, how would you try to describe it as best?

So, let’s play the first one. See if you can guess what this is. 

[Dave’s Mom] Someone’s going into your information or they’re trying to get you to sign up so they can get your information. 

[David Spark] Eduardo, what is my mother talking about? 

[Eduardo Ortiz] I think she’s talking about a scammer and somebody trying to get to her either via… Knowing that it’s your mom, it’d probably be a phone call. 

[David Spark] My mother does use a computer, Eduardo. 

[Laughter] 

[Eduardo Ortiz] Okay. So, let’s say she’s using Windows 98 or Windows XP on her computer.

[Laughter] 

[David Spark] No, she’s…

[Eduardo Ortiz] There’s going to be a factor. I thought it was a phone. So, let’s move to the computer. Still thinking that she’s probably trying to get scammed…

[David Spark] You’re getting close.

[Eduardo Ortiz] …or get phished by somebody. 

[David Spark] Phished, there you go. Correct answer. It is phishing. 

[Audience] Hooray! 

[David Spark] Good job. All right. We’re going to go to you. All right, you’re going to get this second one. That was the easy one; I just want to point out that was the easy one. 

[Eduardo Ortiz] Thank you.

[David Spark] Here we go. Adam, you’re going to try to guess this one. 

[Dave’s Mom] You have to have a plan to avoid people messing up your system in the future. 

[David Spark] What is my mother talking about? And it’s not as easy as Eduardo’s. 

[Adam Fletcher] Business continuity?

[David Spark] No, but avoid people, that’s a good guess. But no, you want to take a guess at this one? Not business continuity. 

[Eduardo Ortiz] I thought about more of disaster recovery and somebody just making sure that you’re testing your systems before they get messed up. 

[David Spark] You’re getting closer. I’m going to play this again for the audience and see if an audience member can get this. 

[Dave’s Mom] You have to have a plan to avoid people messing up your system in the future. 

[David Spark] All right. This woman over here thinks she knows the answer. Yell it out really loud. What do you think? 

[Audience member] I was going to go with maybe policies? 

[David Spark] Policies? No. Anyone else? You can just shout them out. Just shout them… 

[Crosstalk 00:22:38] 

[David Spark] Hold it. Not everybody at once. Okay. What’d you say? 

[Audience member] Contingency plans?

[David Spark] No, not contingency. What’d you say? 

[Audience member] Security plan. 

[David Spark] Security plan, no.

[Audience member] Resiliency.

[David Spark] No.

[Crosstalk 00:22:47] 

[Audience member] …response plan.

[David Spark] You are extremely close. You are extremely close. Anyone else want to guess? 

[Audience member] [Inaudible 00:22:55].

[David Spark] No, not that. 

[Audience member] [Inaudible 00:22:57].

[Audience member] Countermeasure.

[David Spark] Hold it, wait. What’d you say? 

[Audience member] Intrusion detection.

[David Spark] I’m going to give it to you. Intrusion prevention system. All right. Let’s hear it for you. 

[Applause]

[Eduardo Ortiz] Wow. 

[David Spark] Very good. Very good. All right, here we go. We have two more to play. Let’s see. And by the way, everyone knows these terms. I can’t stress that enough. 

[Dave’s Mom] Avoiding the things that your mother told you not to do. 

[Laughter] 

[David Spark] What is she talking about, Eduardo? 

[Eduardo Ortiz] Ah, whoa. [Laughter] I don’t…

[David Spark] And again, she heard this term for the very first time and this is what she thinks it is. 

[Eduardo Ortiz] I don’t think this is even cyber related, right? 

[David Spark] No, no, no. She doesn’t know what she’s talking about. Come on. 

[Eduardo Ortiz] So, whoa, okay. So, just following instructions and talking about processes and making sure you’re doing the right things at work. 

[David Spark] Yeah. Well, it’s a term in the industry. That’s not a term. 

[Laughter] 

[Adam Fletcher] I would say that’s her definition for security policy. 

[David Spark] No. All right, I’m throwing this to the audience. Okay, what do you think it is?

[Audience member] [Inaudible 00:23:57].

[David Spark] No. It’s a term everybody here knows. That’s your huge giveaway. 

[Audience member] [Inaudible 00:24:03] 

[David Spark] What? 

[Audience member] Compliance.

[David Spark] No. Security compliance, no. 

[Audience member] Cyber hygiene. 

[David Spark] Cyber hygiene, no, but a good guess. 

[Audience member] Governance.

[David Spark] No, not governance. Guys, it’s zero trust. Come on. 

[Audience] [Groans]

[Laughter] 

[Adam Fletcher] Nobody knows what that means. 

[Laughter] 

[Eduardo Ortiz] There’s like 20 definitions of zero trust. 

[David Spark] I know. We’re all confused by this. All right. The very last one. Here we go. 

[Dave’s Mom] A nickname that you wouldn’t be embarrassed to tell anybody. 

[David Spark] A nickname you wouldn’t be… Now, I’ll give you a hint. Somebody yelled out not exactly, but an answer very similar. Nickname you wouldn’t be embarrassed to tell anybody. 

[Eduardo Ortiz] So, are we talking about what we were saying before about security codes or having like a valid code to identify yourself? 

[David Spark] Double down on the nickname part is kind of a little part of the answer there. What do you think? 

[Adam Fletcher] Alias.

[David Spark] What? 

[Adam Fletcher] An alias. 

[David Spark] No, not alias. That’s a little bit… It’s only a little bit of a hint. Anyone want to take a guess at this? 

[Audience member] [Inaudible 00:25:06].

[David Spark] No.

[Laughter] 

[David Spark] What do you think? 

[Audience member] Superuser.

[David Spark] Not superuser. No, you wouldn’t be embarrassed to have a superuser. 

[Laughter] 

[David Spark] Here, I’ll play it again.

[Dave’s Mom] A nickname that you wouldn’t be embarrassed to tell anybody. 

[David Spark] Anyone want to try this one? It’s tough. This one’s the hardest one, I’ll be [Inaudible 00:25:23].

[Eduardo Ortiz] CISO? 

[David Spark] CISO.

[Laughter] 

[David Spark] Very good.

[Eduardo Ortiz] I was going to say CIO, but…

[Laughter] 

[Audience member] Token? 

[David Spark] Token? No.

[Audience member] [Inaudible 00:25:36].

[David Spark] No. All right. Well, you’re all going to… It’s password hygiene, everybody. 

[Laughter] 

[David Spark] Oh, could have gotten that. All right. We landed on such a down note. I didn’t want to land like that. 

[Laughter] 

[Eduardo Ortiz] I know. That’s a hard one. 

[David Spark] All right. Well, again, obviously, you don’t know my mother that well. All right. 

Sponsor – Savvy Security 

25:57.084

[David Spark] So, I have a question for all of you. Are you trying to complete your identity access management, or IAM strategy, but feel like you’re working on a puzzle with missing pieces? You’re not alone, and that is exactly where Savvy Security steps in. Their zero-touch integrations fill those critical gaps, providing a complete view of your SaaS landscape.

Now, by leveraging existing client-side sessions, Savvy automatically discovers, manages, and integrates all of your apps, sanctioned or unsanctioned, with no manual server-side work needed. So, you can quickly address issues like SSO bypass, unmanaged privilege access, dormant accounts, rogue tenants, and more.

With Savvy Security, say goodbye to missing puzzle pieces, and hello to a seamless identity-first security strategy. Take control of your SaaS environment today. We’ve all got one. And you will be surprised at how run amok it is, for that matter. So, you can learn more about this. Just go to their website, Savvy Security’s website.

Easy to find, savvy.security. Go there and learn more. 

Surprising research just in! 

27:26.325

[David Spark] So, a high-profile cyber attack can result in financial loss, reputational damage, and loss of customers. Those are the classic things. But there’s another point of suffering. Yay! And that’s the psychological harm to your own team that’s underreported, according to the recent research from the University of Kent and the UK’s Royal United Services Institute.

There is a psychological impact of a ransomware attack, and that needs to form part of an incident response plan. This could be budgeting for mental health support, creating a rotation schedule to avoid any burnout during an incident. We’ve actually talked a lot about this, and avoiding over-reliance on individual staff members.

Doing so will improve overall resilience and long-term staff retention. All right. I’ll start with you, Eduardo. Have you ever managed this with your incident response plans? Because it seems like a doozy. I mean, first of all, before you say, yes, we have, or I’m going to assume you have, but what is the psychological effects you’ve seen in your staff?

[Eduardo Ortiz] So, we do address this. In my previous company, we were the victim of ransomware in 2019. We had three people in the hospital within a few days, and it was mostly…

[David Spark] Oh, my God.

[Eduardo Ortiz] Yeah, it was panic attacks, right? And it was people that were not even in our security team, but they were IT support people. Because they thought, based on the incident that happened – and we recovered, we did everything right, and we were actually pretty good – but they felt like this happened because it was their fault.

Because they felt like, “Oh, I didn’t do this thing,” or whatever it was, and it was really not their fault, right? But they felt so guilty about it that they went into panic attacks. We have two hospitals, one that took leave. They were not related to the security team. But after that, in my current role, we do implement that even in our tabletop exercises, just to make sure that we review those steps.

We do it in our incident response plans. 

We actually have rotations, and we don’t go the full eight hours. We try to go six hours and then take a break. And we do have the mental side of it in terms of, if we need support, we have talked to HR, “We’re going to need these services just in case.” We actually take that very seriously now, after what happened from a personal experience.

I agree with that. I heard from other teams that have been involved in these cases. There’s always a victim, and it’s a silent problem that nobody really wants to talk about. 

[David Spark] And it can have physical, like the panic attack. We’ve actually interviewed Tim Brown of SolarWinds before, and he lost 30 pounds in 30 days, 100% from stress after that SolarWinds incident. 

[Eduardo Ortiz] I gained 30 pounds in two days. 

[Laughter] 

[David Spark] All right, Adam, I throw this to you. How have you seen this manifest itself? 

[Adam Fletcher] I haven’t seen it manifest in an incident response plan per se. I don’t think we or anyone that I know has really written down, “These are how shifts are going to work. These are the pizza places you should be ordering from every six hours. This is where people are going to sleep, when people are going to sleep, exercise, do whatever, shower for that matter.” But I do think that in CISO circles, there’s pretty significant awareness.

There are a lot of people who have been out there talking about their experience in a severe incident. And I think there’s pretty good awareness with many of the people that I would call peers and friends nowadays, that this is one of the first things that has to get set up if you actually do go into full kind of wartime incident response mode, figuring out what those shifts are, when people are going to sleep, when people are going to eat, making sure that people are taking care of themselves during that incident response.

I think there’s a hero mentality when that switch gets turned on and everybody wants to work 24 hours, including the CISO, by the way. Everybody wants to be present, working 24 hours a day, but it’s just not rational or possible. 

Unexpected outcomes or failures 

31:58.816

[David Spark] So, now that we’ve got some distance from the CrowdStrike outage, what lessons have we learned from it? If nothing else, the incident showed that far too many organizations made the company a single point of failure, whether they knew it or not, argued Christopher Burgess in a CSO online piece.

So, is the key to shore up our disaster recovery and business continuity plans? Because that’s kind of like the last sort of wall of defense, if you will. But what about if you’re in CrowdStrike’s position? How do you do DR and BC planning for your customers and partners? I’m going to throw this first to you, Adam.

There’s kind of two ways of looking at it. Like, how do you predict all these possible scenarios that could happen with your partners? Wouldn’t it be better just to have the most amazing DR and BC plan? 

[Adam Fletcher] Yes, it would be, but I think in this case, that’s a very difficult thing to do. Even if you had a disaster recovery business continuity plan for all of your endpoints, in this case, most likely those endpoints come right back up and download the latest files from CrowdStrike and just blue screen right away.

Personally, this isn’t a CrowdStrike problem. This is a concentration problem across a lot of the people that we call our core vendors, and whether that’s Microsoft Office365, a CRM tool, an HR tool, a lot of these things – AWS for that matter, what happened to everybody when US East 1 went down a couple of years ago.

We have to have better expectations from our vendors about their resilience plans. And to the point that was made in the panel prior to this podcast, we need to have strong strategies for rolling out the latest versions of software. 

I was talking to someone who is at a pretty significant enterprise, I won’t say which, but they said we’re damned if you do, damned if you don’t. If we don’t take the latest version of CrowdStrike all the time, then we’re creating a window for attackers to get into our environment. And if we do take the latest version of CrowdStrike all the time, then this is what can happen.

So, which one do you choose, right? And it’s a calculated risk, hoping that a vendor like CrowdStrike is going to test very, very thoroughly and not have something like this happen. 

[David Spark] Well, and I think that my guess would be not so much a 50/50 choice because CrowdStrike is trying to do the right thing, unlike the criminals who are trying to take advantage of the window. Eduardo? 

[Eduardo Ortiz] Yeah, and I agree with Adam here. In our case, we don’t use CrowdStrike, but we took the time to, “How can we learn from this,” right? One of the things that really resonated with us was the BitLocker keys issues, right? We never thought about that. So, what we’re doing now, we’re removing that to a non-Windows environment, have it locked up.

Just in case we have to recover, we don’t rely on the same environment, right? We took some lessons learned from that one – make sure we’re logging down our domain controllers the right way. Actually engaging with some of our vendors as it goes to change management, and how do we schedule those changes?

As Adam said, are we willing to wait two weeks, one week? Do we want to be on the second series of changes? Those are conversations that we need to have with our vendors and be sure that we communicate that to the business as well, just to make clear that, “Hey, we’re taking this risk, but it’s because there’s a bigger risk.” My CFO called me next morning, “Hey, are we safe?” I said, “Yeah, we don’t use CrowdStrike.” And that’s how much they care about what we use.

Okay, so what are we going to do about it? Okay, we don’t have to do anything about it, but we’re going to learn from it. And that’s how we are approaching this case. 

Sponsor – Fortra 

36:07.929

[David Spark] We have one more phenomenal sponsor, and that is Fortra. So, let me introduce you to Fortra Data Protection Security Solutions, an industry standard in safeguarding your data. Fortra’s advanced solutions are engineered to not only protect your data, but also to empower your security teams with intelligent, efficient tools.

These interwoven tools, such as industry-recognized names like Digital Guardian DLP are proactive, predictive, and designed to enhance your security landscape. Consider a security system that integrates effortlessly with your current infrastructure, offering real-time threat detection, and automated response capabilities.

From preventing data leaks to managing insider threats and ensuring compliance across various platforms, Fortra provides robust defense mechanisms. Over 30,000 organizations worldwide rely on Fortra for their critical data protection. It’s time for your organization to transform security challenges into opportunities.

Visit Fortra.com to discover how Fortra can help you secure your data with unmatched precision and expertise. 

It’s time for the audience question speed round! 

37:28.598

[David Spark] I hold in my hand here a series of questions that [Inaudible 00:37:38] many of you who are actually in this room right now, and many who are not in this room, questions for both you, Eduardo, and Adam. And with the little time that we have left today, I’m going to ask you as many as we can get through, so don’t spend too much time on this.

But this one refers to the question we were doing about the psychology, and I’ll start with you, Eduardo. Just as quick as you can answer because I know we could do a whole segment on each one of these. Does the buck always stop with the CISO? If you educated your staff about shadow IT or phishing, whatever, and they still made the mistake, does the problem always bubble up to you and you still have to manage it?

Or is it a hey, one person can’t do all the security, can’t always blame the CISO. And by the way, I want to quote, this is Stephen Dye from Uplift Cyber. 

[Eduardo Ortiz] So, it does stop with the CISO if the CISO has communicated risk and has assumed the risk the right way. We have a process of who’s owning that risk. If I don’t have controls or I don’t have the server shadow IT or anything, a new application that got developed, we didn’t know about it, it got hacked, there’s a big breach.

Okay, do I own the risk? No, but if I own the risk and that’s something that we’re constantly doing, yeah, it’s going to stop with me because I need to put the right controls in place. It depends on who owns the risk at that point. 

[David Spark] All right, do you want to answer this or we go to the next one? You tell me. 

[Adam Fletcher] Same question, sure. I think yes and no. I think security is everybody’s responsibility in the organization, but it’s ultimately the CISO’s accountability to make sure that everybody in the organization understands their part. 

[David Spark] All right, next question. What in anyone’s security program – where all cybersecurity professionals, CISOs are building out a security program – is there an element of it though you’re concerned about with regard to that a cyber insurance policy won’t pay out? And this comes from Daniel Polimeni of GuidePoint Security.

[Adam Fletcher] I don’t love the active war clauses in cyber insurance policies. I mean, I think that that can be stretched a long way given what nation-state actors are doing and can do that can have a huge impact worldwide, and enterprises can be collateral damage as a result of that. And if insurance companies won’t pay out based on that clause, that could be an issue.

[David Spark] And also hard to identify if it is. 

[Adam Fletcher] For sure. 

[Eduardo Ortiz] Yeah, and that leads yourself to interpretation at that point. That’s one of the ones that we’ve been fighting for a while. In the other one, it’s kind of like the selection. If I have an incident and I need an incident response provider or a forensics, sometimes you get forced to do the services with specific provider.

We’ve been fighting that one because we have our providers, and they work fine. It’s a point of contention at that point. 

[David Spark] All right. I like this question from Tim Krabec of Scripps Research. You hear the classic line of, “What’s keeping you up at night?” So, my question for you is, is there stuff keeping your staff up at night? And if so, how do you prevent that? You don’t want them stressing out, I hope not.

Do you do anything? I mean, is there something specific? I mean, there’s tons of problems, but what do you do to prevent them stressing out? 

[Adam Fletcher] I think we focus on reminding them that we’ve got great people, great process. We test continuously. We’re doing everything that we can to stay ahead of attackers. But at the end of the day, it is a 24/7 job. They don’t have to stay awake at night thinking about it because we’ve done everything that we could do, but there’s still risk there.

[Eduardo Ortiz] It’s a communication problem, right? Like if we don’t communicate, be totally transparent with our teams, they become stressed about issues that might not be even issues or they might not exist, right? 

[David Spark] That’s a good point. I have found out that something was just poor communication, they got stressed about it, and my attitude, “Oh, that’s no big deal.” 

[Eduardo Ortiz] Exactly, and it happens. Listen, in our case, I have six different business units. One of them, it’s in the Hong Kong PRC area, and the communication, it’s not always…it’s a video call, right? So, there’s a lot of communication barriers, but I was stressing out about myself issues and they were fine.

[David Spark] We’re running just a hair over, but I want to get through these two quick ones. Let’s see what we can get through. I love this question from Troiano Frank of DarkTrace. When evaluating a tool, how do you want the vendor’s tool to best support your team? So, you’re evaluating the tool and one of the parts of evaluation is, I want my team to experience this, be able to do this, it works this way.

What is it that the team needs that support from the tool? 

[Adam Fletcher] I think one of the most underrated elements of conducting a proof of concept or proof of value with new technology is thinking about how it’s going to be operationalized long term, right? So, I think what could be done better by vendors during POCs is to not think, “Okay, does the product do what it’s supposed to do in this very controlled environment with the help of a solutions architect or a sales engineer working side by side with my team?” But think about, okay, once this is fully deployed, what is the operational impact and how much overhead is there going to be?

And can we show the team that this is actually going to make their lives incrementally better? It’s going to reduce the amount of work ultimately that they have to do, prevent them from staying awake at night, and other things. 

[Eduardo Ortiz] I 100% agree. We have the same issue. If we communicate with the vendor and give them the right requirements, our team evaluates. Listen, for IAM, we evaluated over 25 vendors to pick one, but the whole team picked it and the whole business picked it. So, it was a long process, but now everyone loves it.

Closing 

43:59.963

[David Spark] Well, that brings us to the end of the show. 

[Applause]

[David Spark] I want to thank our sponsors. That would be Savvy Security, Quadrant Information Security, and Fortra. Please go visit our sponsors. I want to let you guys have the very last word here. Anything last you’d like to say and are either of you hiring? 

[Eduardo Ortiz] So, I want to thank you for having us here and I want to thank all the live audience here as well. This is a bucket list item for me. So, thank you very much, David.

[Applause]

[David Spark] Eduardo stepping in – that was awesome. 

[Applause]

[Eduardo Ortiz] Yeah, I’ve been a longtime listener of the podcast. We are hiring, but only in two of our six business units, which is EMEA and the Hong Kong PRC area. 

[David Spark] And you have to be there, but we have listeners in those areas. All right, Adam. 

[Adam Fletcher] Thank you for having me once again. We will have intern positions for next summer opening up. 

[David Spark] Oh, excellent. That very much speaks to this audience that’s right here. Well, thank you very much, audience. We greatly appreciate you supporting and listening to the CISO Series Podcast. 

[Applause]

[Voiceover] That wraps up another episode. If you haven’t subscribed to the podcast, please do. We have lots more shows on our website, CISOseries.com. Please join us on Fridays for our live shows – Super Cyber Friday, our virtual meetup, and Cybersecurity Headlines Week in Review. This show thrives on your input.

Go to the Participate menu on our site for plenty of ways to get involved, including recording a question or a comment for the show. If you’re interested in sponsoring the podcast, contact David Spark directly at David@CISOseries.com. Thank you for listening to the CISO Series Podcast.