Every CISO will tell you that resilience is the goal of any security program. But how can we be resilient when every organizations is beholden to a bevy of third-party providers, each with their own degrees of resilience?
This week’s episode is hosted by me, David Spark, producer of CISO Series and Mike Johnson, CISO, Rivian. Joining us is Johann Balaguer, Global CISO, Hard Rock Hotels and Casinos.
Got feedback? Join the conversation on LinkedIn.
Huge thanks to our sponsor, Guardsquare
Guardsquare delivers mobile app security without compromise, providing advanced protections for both Android and iOS apps. From app security testing to code hardening to real-time visibility into the threat landscape, Guardsquare solutions provide enhanced mobile application security from early in the development process through publication. Learn more about how to protect your app at Guardsquare.com.
Security tip of the week – Tenable
Jump to the full tip here.
To learn more about exposure management, go to tenable.com.
Full Transcript
Intro
0:00.000
[Voiceover] Ten-second security tip, go!
[Johann Balaguer] Think of your entire cybersecurity program as the foundation of your house. A poor foundation makes your whole house susceptible to breaking and falling apart. Always ensure your cybersecurity program is built with a strong foundation that bakes in effective basic cybersecurity controls. I always say go back to the basics.
[Voiceover] It’s time to begin the CISO Series Podcast.
[David Spark] Welcome to the CISO Series Podcast. My name is David Spark. I’m the producer of said CISO Series. Joining me as my co-host, it’s none other than Mike Johnson, now the CISO of Rivian. Mike, say hello to the audience.
[Mike Johnson] Hello, audience. It is great to be heard again, I guess?
[David Spark] Yes.
[Mike Johnson] I would like to see you but… You know?
[David Spark] I just want to mention that you’ve been on one podcast in the seven-plus years, seven and a half years, but you’ve been CISO three times [Laughter] during this time.
[Mike Johnson] I like to say that it’s experience, opportunities, changes of scenery.
[David Spark] I’m glad you haven’t jumped to three different podcasts.
[Mike Johnson] Yes!
[David Spark] You stay with one podcast.
[Mike Johnson] Stay with one podcast.
[David Spark] I appreciate it. We’re available at CISOseries.com. If you haven’t checked out all of our other wonderful programming, please do. Our sponsor for today’s episode, brand-new sponsor, it’s Guardsquare, mobile application protection, multilayered protection, unified with automated security testing. Detect threats in real time and trust that it’s your app interacting with your APIs. More about just that later in the show. Mike, this episode is going to be dropping the end of January, and that is usually the time that companies have sales kickoff meetings. I have attended a few of these because I do a fun workshop called Business Networking Pickup Lines, where I actually train people to do different in-person networking activities. It’s kind of fun. I should be pitching this earlier, not at the time that everyone’s doing it because it’s useless now that you’re hearing it.
[Mike Johnson] [Laughter] Might want to work on that timing, David.
[David Spark] I know. The timing’s off. You know with the Steve Martin joke, you know what the most important part of comedy is? Timing. No, timing. It’s timing.
[Mike Johnson] [Laughter]
[David Spark] Have you actually witnessed a sales kickoff meeting yourself?
[Mike Johnson] Oh, sure. I’ve been part of them before myself, and I think they’re an interesting opportunity for a CISO to actually talk to your own sales team, to kind of be able to share, “Here’s what you would expect your customers to be thinking about,” and it’s also an opportunity for you as a CISO to hear what is going to be important and what are going to be the themes that the sales organization’s going to have in the year coming forward. So, it really is a great opportunity.
[David Spark] What I was impressed, because I’ve been witness to a bunch of them, and there’s two major things come together. One is the whole sales staff comes together, and they get to see each other, and they all have sort of boots on the ground experience. So, they all trade boots on the ground experience, like, “What are you hearing? What are you hearing?” kind of stuff. And they talk about how do you deal with this common either rejection or question or, “Oh, well, I don’t know about you because these competitors, like, this…” and they trade that kind of information, and I think that’s what it’s sort of monstrously valuable for.
[Mike Johnson] Yeah, that opportunity to say, “Hey, this message is resonating. This message is not.”
[David Spark] Right.
[Mike Johnson] And to share amongst each other because they might not have had that opportunity. They might not have had that situation that resulted in them needing to have that interaction.
[David Spark] Right. And we hear the same thing about CISOs listening to our shows. We have such a variety of CISOs listen and a variety that are on the show, and they have just sort of their limited experience, and by listening to the show, they get to hear experiences of other CISOs. And that’s a perfect segue to our guest, who I got a chance to meet over in Florida because he lives in Miami. He is the global CISO for the Hard Rock Hotels and Casinos, none other than Johann Balaguer. Johann, thank you so much for joining us.
[Johann Balaguer] Thank you for having me.
As a CISO, what do you think about this?
4:26.785
[David Spark] “The real pivot is learning to speak risk, not ransomware. Once you can tie patch delay to revenue risk, execs actually listen.” Now, that was one nugget of wisdom dropped in a cybersecurity subreddit post, where an experienced technical security professional asked for advice on becoming a CISO. Multiple commenters hammered home that being a CISO isn’t about being the most technical person in the room. It’s about GRC, budgets, board presentations, and enabling the business rather than being the person of “no.” One commenter even put it in Star Trek terms, “I’d rather be Riker than Picard. The pay is almost as good, and the work/life balance is so much better.” So, I’ll start with you, Mike. When someone comes to you and says they want to be a CISO, which I’m sure you’ve heard this before, what is your advice? And should you ask them why they want the role before telling them how to get there?
[Mike Johnson] I love the Riker and Picard comment because that really is where I start with, not so much Riker and Picard, but why? Why do you want to be a CISO? Sometimes it’s just I want to make more money. Like, okay. But is that really a good reason? That’s not necessarily going to go well for you if that is the main reason. You’re going to end up in situations that aren’t going to work out well for you.
[David Spark] And saying that there are other positions that are very similarly paid, too.
[Mike Johnson] Absolutely. There are senior individual contributor roles that pay as well or better. That really comes down to what is the impact that the person is having. And a CISO role at one company might actually pay less than a distinguished engineer role at another company. In fact, it probably does. So, it really does start with why do you want to do this? And then we can get into the what are your strengths? What are your weaknesses? Once we understand where you want to go and why you want to do that, that’s when we can start laying out what is the groundwork, what is the path, the map, as it were, to get there. But you have to start with the why.
[David Spark] Let me ask you the question. Why did you want to become a CISO, Mike?
[Mike Johnson] For me, it was an opportunity to really lead the full breadth of a program. My focus had been detection and response my entire career. I wanted to bring what I had learned doing that to a whole program and figure out how I can leverage those capabilities, those skills into areas like product security or application security where I had been previously so focused on detection and response.
[David Spark] All right. I take this to you, Johann. Same questions. Do people come up to you and ask about how to become a CISO, and do you give them advice? Or do you go down the road of, “Well, why the heck do you want this job?”
[Johann Balaguer] I ask them why, and it’s because you have to understand where they’re coming from, as Mike said. You have to understand, are they just trying to become an authority figure or are they trying to do something that’s good? And this to me is a passion. I think this is a very exciting and fulfilling position, but it comes with a lot of stress, a lot of anxiety. And I think at the end of the day, what you’re trying to do is really defend not only the organization, but protect intellectual property of that organization and the customer’s data. So, you have to come at it from a perspective where you really understand the business and you’re coming from a business enablement perspective versus an authority figure. So, understanding why they want to be in this position, I think it’s going to help them for me to provide them with the information that could really help them on the career path.
[David Spark] I’ll ask the same question I asked Mike, why did you want to become a CISO?
[Johann Balaguer] So, for me, I started off at the help desk, worked my way up. I started off in my career when cybersecurity really wasn’t a thing. It was more of IT and becoming a system administrator, trying to obtain those Microsoft certifications. And then I had the opportunity to join one of the initial IT security teams where I really started to be in a defender’s seat. And it was kind of exciting because you’re after the bad guys, you’re protecting the organization, you’re really trying to stop them. It’s kind of a cat-and-mouse game. But at the end of the day, it’s very fulfilling. It’s very rewarding to understand that you’re really trying to help not only an organization, but you’re becoming that enabler for them. You’re allowing them to safely run the business and operationalize it in a safe and a secure manner. So, it’s instead of just a mundane task that’s traditionally in IT, it’s one that’s very rewarding because every day’s different. Every single day, there’s a different threat, there’s a different risk that we’re up against, and you’re continuously learning. So, this is something where you’re just not doing repetitive tasks every day. You’re learning every single day on how to protect that organization and enable it.
What about this AI security challenge?
9:39.589
[David Spark] It’s one thing to understand the risks of deep fakes. It’s another to experience them. Now, Howard Holton, who’s the CEO of GigaOm and a good friend of the show, got a wakeup call after creating an AI voice clone so convincing it fooled his own family, and we’ve all heard these are incredible. His message to employees, “Demand in writing that your company will not create, maintain, or use your AI identity after your employment ends. “If they won’t put it in writing, you have your answer about what they plan to do with your digital self.” Now, for security leaders, you need explicit policies yesterday stating employee AI identities are personal IP non-transferable to the organization ever. As a security leader, how are you treating the Pandora’s box of digital twins? I’ll start with you, Johann. Is Howard right that we should already have policies for this? I didn’t even think about that, but I think he’s right. What do you think?
[Johann Balaguer] It’s very interesting. I kind of put myself in a musician’s position. They record music, their voice is out there continuously being replayed, and I feel like I need to start collecting royalties if this is the case.
[Laughter]
[Johann Balaguer] But definitely, I think there should be policies in place, governance over this, because at the end of the day, while anything you produce for an organization will always live with that organization…
[David Spark] That’s fine, but it’s the creation of something new with your likeness.
[Johann Balaguer] Correct, and that’s the thing is, is they’re reusing you, right? Even if you leave that organization, it’s kind of saying that they still have the right to your intellectual self.
[David Spark] Mm-hmm.
[Johann Balaguer] So, going back to maybe I should be getting royalties for it and getting paid for it, even after I left that organization.
[David Spark] Well, you should have negotiated that up front.
[Laughter]
[Johann Balaguer] Now we need to start to think about that, right? In our employment agreements. But this is an interesting case. Organizations continuously have to battle with AI and the deep fakes. At the end of the day, it’s very difficult to protect against because it’s so much better each and every day.
[David Spark] No, but this is not so much about the protection issue, but it’s just your identity, your voice, your likeness. Will they use that after you leave? And I didn’t even think about it, but it’s something, yeah, you should actually consider because usually the situation is when you work at a company, the material you create while working there is ownership of the company. That’s pretty standard, but it should be clear that that ends when you leave too.
[Johann Balaguer] One hundred percent agree.
[David Spark] Like there’s no more that you can create with my likeness, voice, and all that.
[Johann Balaguer] I 100% agree, and if you write that into an employment contract, [Laughter] I will expect royalties.
[David Spark] Well, there you go. But yes, if they start doing it. Or you can sue them, for that matter. All right.
[Johann Balaguer] Correct.
[David Spark] Mike, I throw this to you. By the way, has this ever come up? Because Howard’s mentioning is the first I’ve heard of it.
[Mike Johnson] I don’t think I’ve seen it come up for companies. As Johann was mentioning, it’s something that is very common amongst artists.
[David Spark] Yes.
[Mike Johnson] Voice artists is a big one. I don’t disagree with Howard’s points that such a policy is necessary. I don’t see this as a security problem, though. Like the ownership of intellectual property.
[David Spark] Well, a personal employment problem, not a security problem, but a personal employment problem.
[Mike Johnson] Exactly. And so, this is not something I’m putting a whole lot of effort into.
[David Spark] But if you were hiring someone and they requested this, would you put it in the agreement?
[Mike Johnson] I would defer to company policies. This is not something that for me as a CISO that I’m going to decide.
[David Spark] Yeah, it falls under HR in the business.
[Mike Johnson] It falls under HR, it also falls under intellectual property, that legal aspect. They’re the ones who should be weighing in. But one of the things I’ll point out is we already have this happening pretty regularly. If you join a company, you’re going to go through all sorts of new hire orientation, and there’s going to be recordings of like, “I’m so-and-so and I think this policy is very important.” I challenge you to look at how many people are still with the company when you’re watching those videos. Like, that is already a thing where an employee’s likeness is continuing to be used after they’ve left a company. So, I think it is novel that it’s something new, but at the same time, I really do think that it’s something that companies should be thinking about it, but this isn’t a security issue, no.
[David Spark] And not so much CISOs.
[Mike Johnson] No.
[David Spark] We shouldn’t have never brought this subject up is what you’re saying.
[Mike Johnson] I have better things to do, David.
[David Spark] [Laughter]
[Mike Johnson] So, yes, yes, indeed.
[David Spark] Moving on. This is a warning, though, to the listeners. This is something to concern yourself, make sure it’s in your agreement.
Sponsor – Guardsquare
14:44.565
[David Spark] Before I go on any further, I do want to tell you about our spectacular sponsor, and that would be Guardsquare. Now, mobile apps today have become, as we know, an inescapable part of life, ranging from financial services to healthcare, retail, and entertainment. Users trust mobile apps with their sensitive personal data. But a recent survey showed that 72% of organizations experienced a mobile application security incident last year, and 92% of the respondents report rising threat levels over the last two years. Meanwhile, attackers who want your users’ personal data are constantly finding new ways to attack your mobile app. They reverse-engineer it. They repackage it and distribute this modified app via phishing campaigns, sideloading, and third-party app stores. By taking a proactive approach to mobile app security, you can stay one step ahead of these attacks and maintain the trust of your users.
That is where Guardsquare comes in. Guardsquare delivers mobile app security without compromise, providing advanced protections for both Android and iOS apps, combined with a mobile application security testing to find vulnerabilities and real-time threat monitoring to gain insight into attacks. You can actually discover more about how Guardsquare provides industry-leading security for your mobile apps at their website, and it’s easy to find, it’s guardsquare.com. And when you go, let them know you heard about them from this CISO Series.
It’s time to play “What’s Worse?”
16:25.640
[David Spark] Johann, you know how this game is played, right?
[Johann Balaguer] Yes, I do.
[David Spark] All right. I’m going to make Mike answer first, but then you will answer as well. This comes from Louis Zhang of AIA Australia and we have two scenarios. And I’ll just sort of briefly say the first is on the cloud, the second is on-prem. All right? Here you go. Scenario number one, on cloud, good logs, no budget. You’re the CISO of a small to medium enterprise. A ransomware attack hits. You have no choice but to pay the ransom to survive. Good news. Your cloud logs tell the full story, how the attackers got in and what they took. Thanks to your past self for configuring them correctly. Pat yourself on the back. Here’s the bad news. After paying the ransom, the legal fees, the cloud bills, you’ve got zero budget left to improve security. Now you must rebuild your defenses using only your existing tools and team. So, you are spent, okay? No more money.
[Mike Johnson] Okay.
[David Spark] Scenario number two, it’s an on-prem. You got bad logs and very little budget, but you have budget. Same company, same ransomware hit, and yes, you’re the CISO again. This time you’re on-prem with no usable logs. You pay the ransom, but you have no clue how they got in. The board gives you a small budget, enough for one new tool, one extra full-time employee, one project or limit consultancy with one clear message, “Make sure it never happens again!” You’re unsure where to start, you’re completely blind, but at least you’ve got some money, a couple of vendors to lean on, and the freedom, also the pressure, to decide and act. Will the attackers come back and when? Only luck will tell. Mike, which one’s worse?
[Mike Johnson] So, I’m trying to remember with the first one, did you actually make changes after the…as part of your cleanup?
[David Spark] No. No changes have been made, but you have really good logs, and you know the full story of what happened.
[Mike Johnson] Okay. For me, from my experience, I always want to know what happened. I always want to have that visibility into, “Here’s exactly what happened,” because even if I can’t go and spend new money, I can move existing money around. And if I know exactly what didn’t work as expected, I can now go fix that. I can concentrate on that area without necessarily bringing in new resources to do this. The solution for ransomware isn’t buying a new tool. Like, that’s never the answer. The answer’s always understanding what happened.
[David Spark] I think many vendors might want to argue with you on that. [Laughter]
[Mike Johnson] I would be happy to have that conversation with them. The real issue is knowing what happened and being able to effectively change your controls to prevent that from happening again. If you don’t know what happened and all you do is go and bolt on another tool, it’s going to happen again, and you’re going to have egg on your face at best that you were given money and that you didn’t stop it from happening again.
[David Spark] Mm-hmm. Well, you didn’t know what the heck was going on. All right. Johann, do you agree or disagree with Mike, with these two scenarios?
[Johann Balaguer] I think I agree. It’s like what they say, you can’t protect what you don’t know. Right? So, having the logs, fully understanding what happened, and having that staff that you currently have helps you rebuild, right? Helps you enhance the defenses, enhance all those controls. I’d rather know what happened, how they got in, so I can plug those gaps in, secure and protect that house better than I did before. because at the end of the day, if you don’t know exactly what happened, you may be protecting the wrong thing, or you might be trying to close a door that didn’t really need extra protecting.
[David Spark] That’s a good point. Yeah. So, it’s wonderful the second scenario, you got more budget, but you may be just spending it blindly.
[Johann Balaguer] On the wrong things.
Would this person be a good fit for the job?
20:35.747
[David Spark] “Jobs are sport contracts instead of marriages,” said Doug Mayer, CISO at WCG, who shared a post about developing staff, not just for the current role, but to help them grow and eventually make a difference elsewhere. Ooh. He republished a post from Jessica Neal, Netflix’s former chief talent officer, who argued we’ve turned professional transitions into personal betrayals. Doug pointed out that quit and stay employees who mentally check out are far more damaging than someone who honestly says they’re ready to move on. What does good career development actually look like in cybersecurity? How do you create an environment where people can have honest conversations about their future without killing their present? This is a really good sensitive subject because I’m sure, Mike, you have a lot of talented people. You want to keep them. But people’s lives move on. They change. They evolve. And you’ve seen these posts on LinkedIn who go say, “It’s bittersweet that I’m leaving company XYZ. I had such a wonderful time, but now I’m moving on.” It’s not that they don’t like it. It’s just sort of a life change, and we all have them.
[Mike Johnson] There could be any number of reasons why somebody’s leaving a company. Some of them are very personal. Something a manager years ago told me that’s always stuck with me is, “My priority is to try and make you happy and successful in your current role. If that doesn’t work, I’ll go and help you find something else in another team within the cybersecurity work. If that’s not working, I’ll help you find something else within the company. If that doesn’t work, I’ll help you find something outside of the company.” And that’s really stuck with me because it is recognizing that growth means different things for different people, and it is also that you’re investing in a person, and that payoff might not necessarily be in their current role, but it might be. I’ve had boomerangs and those are amazing where you have someone who leaves your team, goes and does something else, adds more skills they didn’t necessarily have the opportunity to gain in their current role or even in their current company, and they come back and they’ve got some amazing new skill that you can now go and apply, and that’s because of the investment in helping that person be successful wherever they are.
[David Spark] That’s a really good point. And yes, that is a strong skill for a manager to have, to be able to support an employee who wants to leave, even though you both very much like each other and you both appreciate your talent. Johann, have you seen this happen? Has it happened to you? Have you done it to somebody else? Like, what’s been your experience?
[Johann Balaguer] I’ve seen it happen not just to me and to others. I fully support it. I think career development is extremely important, especially in our field. I always tell my entire team, I said, “If you feel at any time that you’re bored, look around, go look at the other teams, raise your hand, offer help, or ask if you can work on a special project. I want you to grow. I want you to learn. I want you to continue to develop. If you end up leaving the organization or my team, I welcome that. I hope that our paths would cross again.” Maybe I leave the organization, I join another organization, and I know that this person was a fantastic employee that I can go ahead and recruit myself.
[Laughter]
[Johann Balaguer] So, at the end of the day, I think it’s very rewarding. I think it speaks volumes about the leader that you are and the one that you project yourself, not to your team, but also to your organization that you’re continuously building highly skilled personnel that are regarded very highly, not just in the organization, but across the industry. I think it also goes into that you want to start thinking about succession planning.
[David Spark] Right.
[Johann Balaguer] Because at the end of the day, I want to train up who’s going to replace me eventually. So, I’m all about it, I think it’s great. I think someone who does not allow that is not really being a good leader.
[David Spark] I had a conversation with a young woman who had her boss, the CEO of the company, make her feel guilty about wanting to leave.
[Johann Balaguer] Mmm.
[David Spark] She was telling me the story. It was clear she really liked the CEO. I know, you’re shaking your head, hear me out, hear me out. And I was shaking my head when she was telling the story too. I’m like, “Oh, my God.” It was so clear she really liked this guy who was the CEO of the company. And yet, he was making her feel guilty, and what it sounded like, he was a first-time CEO. He was scared about losing her because she was very talented, and his reaction to it was essentially a very bad one. And instead of realizing that, he made her feel guilty, and she did things she shouldn’t have had to do to appease him, not look out for herself. And when I kept saying, “Oh, my God. He shouldn’t have done that. That was so wrong.” She goes, “Oh, but no, no, he was really, he’s a really…” I go, “I get it. You really like him.” I’m sure he was a really nice guy, but he was scared and he made a mistake. I’m sure you’ve seen this, Mike. Yes?
[Mike Johnson] I have absolutely seen it. And it was something that you mentioned earlier that young managers, they have a fear of losing someone, and the reality is they just need to get used to it. This is something that happens in business. Quite often we talk about insecurity. It’s not that the incident happened, it’s how you handle it.
[David Spark] Right.
[Mike Johnson] This is the same thing. How you handle an employee departure says potentially a lot more than the work that you do to try and keep someone because they could have any number of reasons that they do need to leave. We’ve had people relocate. We’ve had people who’ve had changes in their family. Those things, you just can’t change or help as a business.
[David Spark] You got to support as much as possible.
[Mike Johnson] You have to support it, and you have to have the mechanisms to support it.
Security tip of the week – Tenable
27:05.389
[David Spark] Just because you got visibility in your exposure management program doesn’t necessarily mean you understand how attackers can exploit your environment. We got that coming up next.
[Voiceover] This week’s security tip is brought to you by Tenable, the exposure management company.
[David Spark] Visibility alone does not equal security. Dashboards can tell you what’s exposed, but they can’t always tell you what will actually be exploited. To understand the real maturity of an exposure management program, security teams need to go one step further and simulate attacks, not just detect vulnerabilities. Breach and attack simulation as a tactical component of a continuous threat exposure management, that’d be CTEM, lets teams safely test how an attacker would move through their environment using known exposures. These simulations are commonly mapped to the MITRE ATT&CK framework, the industry standard for modeling real adversary techniques, so teams are validating defenses against how attacks actually happen. Now this creates closed loop validation, confirming that prioritization reflects real-world attack behavior, not just theoretical severity, like a numeric – this is a 10, that’s a 2, whatever. Without simulation, teams risk fixing what looks severe on paper while missing exposures that are quietly exploitable. And while breach and attack simulation isn’t a complete solution on its own, it helps answer the harder question. If an attacker got in today, where could they actually go? By integrating breach and attack simulation into a continuous threat exposure management program, CISOs gain confidence that remediation is reducing real risk and not just improving metrics.
[Voiceover] This has been your weekly security tip. To learn more about exposure management, go to tenable.com.
Protecting critical infrastructure from attackers – where to start?
29:13.042
[David Spark] “Critical infrastructure isn’t just the power grid and water supply anymore.” That’s how Ross Haleliuk of Venture in Security framed a recent public cloud outage. When AWS, Google, Microsoft, Stripe, Cloudflare, Okta, or any number of other platforms go down, hospitals, banks, logistical networks, and national services can be disrupted often more severely than if a local utility failed. We’re still looking at the world like it’s 1990, but these cloud providers and SaaS platforms have become a backbone on which modern businesses and governments depend. So, I’m going to start with you, Johann, on this. As a CISO, how do you build resilience when your critical infrastructure is a stack of third-party apps you don’t control? Should we be treating these vendors with the same scrutiny we give to traditional critical infrastructure? If so, it’s going to take a lot more work and money, as you know. Johann, I mean, do you accept and recognize these tools as kind of critical infrastructure?
[Johann Balaguer] We do, but unfortunately our hands are kind of tied when it comes to some of these big names out there. So, I think you have to go, like I said, you have to go back to the basics. You have to really understand what are your critical applications, some of the infrastructure, and you have to bake in those resiliency controls. Sometimes it’s just going back and pulling out that pen and paper and writing things down. We’ve seen a lot of these outages where it’s brought down major organizations, a lot of third parties, fourth parties. So, at the end of the day, if you understand those dependencies, you understand kind of the infrastructure and the architectures that are running behind them, you can start to really, as part of your resiliency program and your plan, to start to bake in what happens if they go down, right? What are the processes that we’re going to follow? How do we kind of fail over and still allow our business to continue to function and run without the dependency of these major critical infrastructure components?
[David Spark] Yeah. I mean, you have to play worst-case scenarios, don’t you?
[Johann Balaguer] All the time.
[David Spark] All right, Mike, it just sounds like what Johann said – well, we don’t have control over AWS. They deliver, that’s one of our suppliers, so we just have to build redundancy should something happen that’s out of our control, yes?
[Mike Johnson] I’ve worked for cloud providers in the past. A couple of them fit the definition of critical infrastructure. In Europe, they actually have definitions of critical infrastructure that include internet services. We don’t have that in the US, but that does exist elsewhere. And these companies do take that responsibility seriously, but there is a shared responsibility. They can only do so much. They can heavily invest, build in redundancy, resiliency, rapid failover, but sometimes your application needs to be architected to take advantage of it. US East One going down, if your application can’t fail over to US West, you’re kind of stuck.
[Crosstalk 00:32:27]
[Mike Johnson] AWS can only do so much to try and prevent US East One from going down. There’s going to be any number of things that can happen, and you have to think about a hurricane or a tornado or something that might actually come through and physically destroy the data center. You have to think about, is that something that you can tolerate? Can you tolerate the time that it takes to fail over? And if you can, then maybe it’s okay that your applications are down for a few hours. The world didn’t end when US East One went down, and I think that’s something that folks really aren’t paying enough attention to here is it certainly was a bad day for a lot of people, but things did go on, and maybe a lot of companies learned their risk tolerance that day.
[David Spark] And I should also mention that this also is very dependent on your business. Like a casino is essentially a financial institution, you have a lot more concerns than other businesses that don’t all the time have to have money flowing, Johann. So, you look at this differently. Like, I don’t even know, where were you before Hard Rock?
[Johann Balaguer] A human capital management organization. And if we think about it, it’s the same thing, but we were the cloud provider.
[David Spark] Okay.
[Johann Balaguer] Right? So, we have to make sure that we are continuously not only maintaining our systems but making sure that we had all the resiliency baked in because if not, people wouldn’t get paid. Right? So, it’s very important to go back to is what’s the worst case scenario? Always thinking about, like you said, I live here in South Florida, we’re very prone to hurricanes.
[David Spark] Mm-hmm.
[Johann Balaguer] And guess what? Some of our data centers were here. So, we always think about, okay, if a hurricane was to pass through the state, where would we fail over to? How would we move not only some of our infrastructure components, but the people that support it, right? We have to get people on planes. And sometimes, especially during a hurricane, that means you’re also taking their families with them because it’s going to be a while until power’s restored and all the critical components are back up and running. So, going back to accounting for all that, making sure that you even have even paper copies of playbooks, right? Because if the systems and the power’s down, you can’t get those digital copies. So, we’re going back to the basics. We joke around and you think about how we used to transact credit card transactions with the little papers and taking imprints of credit cards. Maybe [Laughter] need to start doing that too. So, you have to think of every single which way that you can continue to operate the business and ensure that we can maintain the minimum standards to operate effectively.
[David Spark] And you make a good point because I’ve had conversations and really, it takes individuals, consultants sometimes to just keep asking questions, “What about this? What about this? What about this?” because oftentimes the reason you fail at this is you don’t even know the questions to ask. Yes, Johann?
[Johann Balaguer] Of course. And it’s not only that is it’s asking different people because sometimes you don’t understand the true dependencies or interdependencies between one thing or the other. So, it’s making sure that you’re relying on multiple stakeholders, really digging into how the business operates, those processes, right, those procedures because sometimes someone stood up a system that they integrated and no one knows about it, and it’s a critical application or function that supports the entire organization.
[David Spark] Very good point.
Closing
36:04.518
[David Spark] Well, that brings us to the tail end of our show. Thank you very much, Johann. Thank you very much, Mike. I want to thank our sponsor and that would be Guardsquare. Remember, go to their site, guardsquare.com, for mobile application protection, multi-layered protection, unified with automated security testing, detect threats in real time, and trust that it’s your app interacting with your APIs. That is guardsquare.com. Johann, thank you so much for coming today. Are you hiring at The Hard Rock?
[Johann Balaguer] Thank you for having me, and yes, we are always hiring. Please look at our Careers site and [Inaudible 00:36:39].
[David Spark] And I’m assuming if they have heard this on the show, they can contact you via LinkedIn, yes?
[Johann Balaguer] Yes. Always available on LinkedIn.
[David Spark] All right. So, look at the job site. If there’s something appropriate for you, contact Johann. We will link to his LinkedIn page from the blog post for this very episode. Mike, as always, thank you so much. And thank you to our audience. We greatly appreciate your contributions and for listening to the CISO Series Podcast.
[Voiceover] That wraps up another episode. If you haven’t subscribed to the podcast, please do. We have lots more shows on our website, CISOseries.com. Please join us on Fridays for our live shows – Super Cyber Friday, our virtual meetup, and Cyber Security Headlines Week in Review. This show thrives on your input. Go to the Participate menu on our site for plenty of ways to get involved, including recording a question or a comment for the show. If you’re interested in sponsoring the podcast, contact David Spark directly at David@CISOseries.com. Thank you for listening to the CISO Series Podcast.