Being a CISO can feel like a no-win situation. While the role is now common in organizations, they often face an imbalance of responsibility and authority. How did the situation get so bad, and what can be done to empower CISOs?
This week’s episode is hosted by me, David Spark, producer of CISO Series and Steve Zalewski. Joining us is Tammy Klotz, CISO, Trinseo.
Got feedback? Join the conversation on LinkedIn.
Huge thanks to our sponsor, ThreatLocker
Full Transcript
Intro
0:00.000
[Voiceover] Best advice for a CISO, go!
[Tammy Klotz] My best advice for a CISO is to never let a good crisis go to waste and to ensure that you’re using any learning opportunities from those crises to improve your incident response and recovery procedures.
[Voiceover] It’s time to begin the CISO Series Podcast.
[David Spark] Welcome to the CISO Series Podcast. My name is David Spark, I’m the producer of the CISO Series. And joining me as actually a guest co-host, but he’s normally not a guest co-host. He’s a regular co-host of a show called Defense in Depth that’s also on our network.
It’s none other than Steve Zalewski. Steve, say hello to the audience.
[Steve Zalewski] Hello, audience.
[David Spark] That is Steve Zalewski who has been greeted in person with, “Hello, Steve,” from hearing that very specific greeting. We are available over at CISOseries.com where you can hear Steve’s other show that he’s on and that would be Defense in Depth, and I strongly recommend you check out that show and all our other programs on the CISO Series.
I do want to mention our sponsor and that would be ThreatLocker – allow what you need, block everything else by default, including ransomware and rogue code. That’s ThreatLocker. They have a zero trust solution. And in fact, they are going to be hosting Zero Trust World in Orlando this year.
I’m going to be talking more about that later in the show. But first, Steve, here’s my story of the week, and that is I had to donate my fish.
[Steve Zalewski] Not to dinner, I hope.
[David Spark] No.
[Steve Zalewski] Okay. [Laughter]
[David Spark] They are not anybody’s dinner. They are hopefully swimming and still alive. So, here’s the thing. I discovered a leak in my fish tank in, luckily, the top third of the tank, not the bottom of the tank, the top third. So, it was a tiny leak.
It was right by the seam. It was like all of a sudden, we saw a pool of water. It was like four feet in diameter on our floor, and I’m like, “What the heck?” And noticed that the tank had been leaking. And so, I had to drain water out of the tank. So, there’s only about two thirds left.
And I tried to repair the tank with some like Gorilla Glue that works on glass. That does not work. Just so you know, anyone who wants [Laughter] to repair their tank, it doesn’t work. But the reason I’m telling this story is there’s got to be things that are akin to this in cyber where the process of fixing this in the way that would be sort of ideal for the fish and for me just isn’t worth it.
And that was the process of trying to get another tank, moving them to another tank, draining the other tank. Because once you fill a tank with water, you don’t move the thing. It weighs a ton, you know? And so, good news is the are not dead, anybody.
Anyone thinking that I flushed them, I did not. And if anyone else has this problem, I put all the fish into a bucket and I drove to the local aquarium store and I donated my fish. And now I have to figure out a new solution and get essentially a new tank.
So, that’s my story, Steve.
[Steve Zalewski] So, is the takeaway from there if I have employees that are really difficult around security awareness training, that what I do is I give them away rather than try to…
[Laughter]
[David Spark] Donate them to the local aquarium. Yes, exactly.
[Laughter]
[David Spark] We’re on exactly the same page.
[Laughter]
[Tammy Klotz] Oh, been there, been there.
[Steve Zalewski] Just say it, okay? All right? Just, I don’t know.
[Laughter]
[David Spark] With that said, I think you read my analogy perfectly there, Steve.
[Laughter]
[David Spark] Let’s bring in our guest, I’m thrilled. I think you just heard her at the beginning of the show, and you just heard her laughing. It is the CISO over at Trinseo, thrilled she’s joining us, none other than Tammy Klotz. Tammy, thank you so much for being here.
[Tammy Klotz] Thank you for the opportunity, and I’m very much looking forward to our conversation today.
I tell ya, CISOs get no respect!
4:07.489
[David Spark] “CISOs own business risk without equivalent authority. This is the most common and most dangerous tension I see.” That’s Sanjiv Cherian of Microminder Cyber Security’s view of where the CISO role has landed. We have heard this story before, by the way.
And for him, the job has fundamentally transformed. You’re now judged on recovery speed, financial exposure, and operational continuity, often with personal liability. There’s a structural problem. Boards assign CISOs accountability for business outcomes while their actual decision-making power hasn’t caught up.
Steve, I’m going to start with you on this. Do you find your colleagues are suffering from this accountability/authority gap? Is this unique to just the CISO? Because we’ve brought this up before and we say, well, other C-level people deal with this nonsense as well.
[Steve Zalewski] Yeah, I’ve often said a CISO is either anointed or appointed, and there’s actually no test to validate that you are legitimate.
[David Spark] Mm-hmm.
[Steve Zalewski] Well, I say in the same vein, okay, the accountability comes when you actually have to sign something, put your name on it, that actually has a material impact on your liability. I say the same thing. There’s a lot of CISOs that think that they own it and want to sign a document, okay?
And then there’s a set of CISOs that don’t want to own it and are being given the document to sign. So, I say be honest with yourself and appreciate where you are in that journey and realize that sometimes wanting to put yourself in that position, run away.
And that I think that’s going to help a lot of us. And the other thing is the board doesn’t necessarily know. I have seen is when you get a piece of paper that you have to sign, that’s when reality strikes.
[David Spark] Can you give me the specifics? What does this piece of paper say?
[Steve Zalewski] Oh, you’re signing off on a SOX audit.
[David Spark] Mm-hmm.
[Steve Zalewski] The CISO is the designated accountable executive that’s signing off that says that this audit is legitimate, the equivalent to the CFO signing off on a SOX, S-O-X, audit.
[David Spark] Mm-hmm.
[Steve Zalewski] Same thing. Is that for the first time you are in what I’ll call a named executive, that the accountability resides with you explicitly. There you go.
[David Spark] And by the way, this, like you said with the CFO, any time you have an audit or anything that has to be “approved,” someone somewhere has to sign it. Yes?
[Steve Zalewski] Yes. Right? You may want to sign it. You may say, “That’s mine to sign.” Well, that’s on you then that you’re accepting that accountability, you’re demanding it, and they may be able to go, “Well, fine. Go ahead, sign it,” because you don’t actually understand what you just did.
I’m more of the line is don’t sign anything. Okay? Like a marriage certificate. Don’t just sign the paperwork, read the fine print. Okay? And understand that in signing that, what is it that you want in return? Okay? It’s a relationship you’re establishing.
It’s not a problem that you’re owning.
[David Spark] All right, Tammy, I’m throwing this to you. Have you ever been fearful signing a document yourself?
[Tammy Klotz] So, I would say there’s definitely, I don’t know if fear is the right word, but there’s definitely like a reality check that comes into play when you are putting your pen to paper, right? And putting your name behind an official document.
But I think a couple of things that I would comment on with regards to kind of the intro is that I believe that the CISO takes on the role of risk advisor as opposed to risk owner in a lot of cases.
[David Spark] Yes.
[Tammy Klotz] And it’s really that partnership with the business that becomes part of your capability and your influence within the organization to make sure the risks are understood by the appropriate business owners within the organization.
[David Spark] Now, let me throw this out. We had an argument about this very issue of risk ownership and risk advisement. And Steve is nodding his head because he remembers this. By the way, we have echoed very much what you’ve said, and many have agreed.
And then there was the thing of, yeah, but cybersecurity’s your thing. You got to own some of it. Like you got to own your responsibility of your advice. Yes, Steve?
[Steve Zalewski] [Laughter] All right. So, is a CISO more like a emergency room doctor or is it more like a lawyer? The problem is we have both responsibilities because when the company is attacked, we’re like a trauma room doctor, right? Trying to make sure the patient stays alive.
And yet on the other hand, we’re like a lawyer where our obligation is to keep the company legal. Okay? We got to practice cybersecurity in a way that documents can be signed because there’s an accountability. But like in the legal profession, keeping you legal is a very different conversation around understanding where that line is and where your tolerance is to stay above the legality line.
And cybersecurity practice has also got that.
So, part of it is which situation am I in? Okay? And appreciating the fact that like a lawyer, I will often say, “I will keep you legal. That doesn’t mean I will make you the best security team, but I will keep you legal to sign the documents, and then you have to decide how much risk you’re willing to accept.” That’s a very different conversation that for many CISOs is one they don’t want to go towards because they believe their obligation is to build a great firefighting organization, not be able to put out the right fires.
[David Spark] Tammy, I’ll let you have the last word on this.
[Tammy Klotz] So, I think it’s an element of preparedness as well that comes into play. Like I will never sit there and say that we are 100% protected.
[David Spark] And no CISO would. Yeah, nobody would.
[Tammy Klotz] Right? If they do, they’re not just for the job. But in that conversation then is I will keep us secure enough for what the organization’s tolerance actually is. Right? And then that is a conversation and discussion that needs to be had with legal at the table, right?
And risk because as you think about it in the terms of cybersecurity liability insurance, those are things that also need to be addressed to ensure the proper or the right level of controls are in place for the organization that you are protecting.
Why is everyone talking about this now?
10:51.735
[David Spark] “We used to wear amulets to keep ourselves safe.” Now, for former CISA advisor, Bob Lord, cybersecurity advice like ‘always change your password every 90 days’ or ‘never use public Wi-Fi’ is basically the same kind of hokum. It persists despite most experts knowing it’s outdated or just wrong.
Lord just launched hacklore.org with an open letter from over 80 security professionals to call out these stubborn myths. So, Tammy, I’ll start with you. Why do these myths persist in security programs? Does it veer on security theater? And what’s the one piece of so-called hacklore you’d like to see disappear?
What’s your take here?
[Tammy Klotz] So, I may have a little bit of a different opinion on this, but…
[David Spark] No, please. This is all about opinion. So go.
[Tammy Klotz] Yeah. So, the one piece of hacklore, and maybe it’s not really defined as that, but so many times in security programs, people will start on the supposition that your employees or your people or your workers are your weakest link…
[David Spark] Yes, yes.
[Tammy Klotz] …in your security program, right?
[David Spark] Yes, yes.
[Tammy Klotz] And that in itself is just a demoralizing statement. So, how do you get people to work with you by telling them that you’re my weakest link in protecting the organization?
[David Spark] Well, you don’t say that.
[Tammy Klotz] You don’t. You don’t say that. So, we turn it on its head, I turn it on its head, and we talk about how do you make your people your strongest link in protecting your organization?
[David Spark] By the way, Mike Johnson, the other host of the show, he says this all the time too. Go ahead, Tammy.
[Tammy Klotz] Yeah. So, that is one of my mantras, but it resonates so well within the organization, and it does boil down to the basics. And Steve and I have done a podcast on this with regards to going back to the basics. And it is those fundamental things that people oftentimes just become complacent around.
So, how do you reinforce? How do you keep them educated? How do you make it personal for them, right? So many times, if you can take it out of the context of what the business is asking you to do and put it in the context of, “Well, is that what you would want your bank to be doing?” Or “How do you want your information to be protected?” and then have a very different conversation.
I think that turns things on its heads because people, it becomes more relatable to them than talking about things from a technical control perspective or talk about it, “Well, if you’re on public Wi-Fi, this is what could happen. Is that what you want to have happen to your personal data?” And then it starts to resonate a little bit better.
[David Spark] So, less than orders and commands and more of explaining why we say these things.
[Tammy Klotz] What’s your why? Honestly, that just came up in an earlier call. Don’t just say no but tell me why. Right? And that is a game changer.
[David Spark] All right. I go to you, Steve. The wonders of hacklore. Let’s hear it. What are the terms that you wish would go away? Or how better should we be explaining what’s important and those things that are useless in cyber?
[Steve Zalewski] Hacklore, like everything else, it’s about the good old days. Remember when, right, changing the password every 90 days actually was effective? Remember when I used to do that and it was a good thing? And I don’t know what to do, so therefore, I’m just going to fall back on what I know how to do.
[David Spark] Which, by the way, and that’s a really, really good point is, and that’s true kind of in our lives in general, that there’s a time things do work and there’s a time things no longer work.
[Steve Zalewski] And it’s not that they don’t work. Okay? One of the things…
[David Spark] Don’t have the same impact maybe.
[Steve Zalewski] Don’t have the… And I go, let’s look at automobile engines and cars. Way back when it used to be when you turned on the car, right, for the first 2000 miles, you didn’t go above 40 miles an hour because you had to give it a chance to break in.
Okay? Or you had a turbocharger on there and you therefore had to let it run for five minutes before and after so the turbocharger didn’t burn out. There was a time when that was true, but we’ve gotten better. Okay? Which is, it’s changed, and we don’t have to follow those practices anymore, but folklore says we continue to do that because it used to be good so it probably still is.
[David Spark] It’s hard to stop things on a dime.
[Steve Zalewski] Right? Because it used to be. “Well, that’s what my dad did. Okay? So, I’m going to do the same thing.” That’s where I’m getting to how we as professionals, right? How does the profession of a CISO move from being a tool jockey, right, and just changing passwords as a tool process was good to being a risk manager, like Tammy said, which is to be able to say the goal is to go 150 miles an hour in 7.2 seconds.
Let the automotive mechanics handle the engine. Your job is to drive that car to get to 130 miles an hour. Okay? That’s the transition. And then the practice of doing it.
Cybersecurity is a set of tools. And what we used to do, it’s so different in these 30 years. That again, it’s our ability to transition, right? To what I say is like, Tammy, look, humans are the weakest link. And it’s like, well, that’s a terrible say.
It’s like, how do I encourage humans to be part of the solution? And what I often say is, look, human nature is what it is. So, let’s acknowledge the good parts of human nature, and the parts that we just have to accommodate, okay, like raising your kids.
And so, again, what we’re seeing in those kind of three phrases is appreciating how we move the conversation to risk, and what we have control over and what we don’t.
[Tammy Klotz] Yeah, I think one of the things that came into my mind when you all were talking was really around the people side of it, right? And how things change and things that used to be good are no longer good. So, again, taking it out of the cyber context.
But rules change all the time. How do you put the car seat in the car to keep the child the most safe? How do you put the baby to bed so that there’s less likelihood of any sort of breathing disorder that’s going to happen? And that has changed decade by decade based upon research, based upon experience, based upon fact.
It’s no different in this world, right? There are things that just don’t work as well anymore, and we need to course correct as we go and implement new technologies, new ways, new capabilities to get the better level or the best level of protection.
And it just doesn’t resonate the same way.
So, that’s where you have to be creative in how you deliver the messages. This is, again, back to the why. This is why we’re doing it different. Talk about passwordless instead of having to change your password every 90 days, talking about conditional access.
Well, maybe I don’t have to do multi-factor if I’m coming from a trusted device and they know that it’s me, right? So, using the right set of logic to get folks to behave in the way that we want them to I think becomes extremely beneficial in helping our own cause in those situations.
Sponsor – Threatlocker
18:09.382
[David Spark] CISOs hear the term zero trust everywhere, but very few conferences actually teach you how to implement it, and Zero Trust World 2026 does exactly that. I know. I was there last year, in fact. Join us, and I say “us” because CISO Series will be there, March 4th to the 6th, 2026, in Orlando, for a fully immersive experience with hands-on hacking labs, ransomware analysis sessions, and practical workshops that show you how to roll out zero trust in the environments you actually manage – hybrid, remote, and when they’re just good old-fashioned messy.
Now, you’ll leave with practical playbooks for reducing the attack surface, locking down privileges, and maintaining zero trust without overwhelming your team.
And if that wasn’t enough, here’s the kicker. I, David Spark, will also be there doing a live episode of the CISO Series Podcast at Zero Trust World. Again, we did it last year. We had a blast. We’re going to do it the morning of Friday, March 6th, right there on the main stage.
We want you to be there. And here’s even more enticement – if you’re a CISO Series listener, you will get $200 off the registration for the event.
And by the way, they do a massive blowout. This is at a ludicrously beautiful resort in Orlando, and who doesn’t want to be in Orlando? Especially in March, where it might be very cold where you are. You get $200 off if you use the code ZTWCISO26. Again, that’s ZTW – Zero Trust World – CISO26.
If you forget that, don’t worry about that. Just go to the blog post for this very episode, and you’ll see it right there and you can go ahead and register and use the code. I hope to see you there. And if you go there, please introduce yourself. I would like to meet you.
It’s time to play “What’s Worse?”
20:03.383
[David Spark] All right, Tammy, this game is very simple. If you’ve never played it before, we provide two horrible scenarios. They are provided from our audience. And then I make you decide of these two crappy scenarios which one is worse. It’s a risk management exercise, but this is the way I’m going to make it “easy” for you.
I’m going to make Steve answer first, and you will either agree or disagree.
[Steve Zalewski] [Laughter]
[David Spark] I do not make it easy on Steve.
[Laughter]
[David Spark] I will make it easier on you. All right, here we go. Here are the two scenarios brought from one of our fantastic listeners who’s given us lots of great scenarios, and that’s Jay Dance over at StubHub, and here you go. These are a little involved.
What’s worse? Scenario number one – a major shipping and freight company is responsible for moving food, medicine, and manufacturing parts across the country. A threat actor infiltrates its routing optimization system and quietly manipulates it. Trucks and cargo containers aren’t stopped, but instead, key deliveries are subtly delayed, rerouted, or flagged as “in transit” even when they’re sitting idle in remote depots.
By the time the intrusion is discovered, hospitals, grocery distributors, and factories are all reporting shortages, but no one can tell which delays are sabotaged and which ones are real. Okay, that’s scenario number one. Not good.
Number two – a relatively unfunded but large city’s public utility network is infiltrated through an unmaintained and forgotten remote vendor account. Threat actors intermittently manipulate water quality and pressure settings and recordings forcing the city to issue emergency boil water advisories and shut off sections of the system to avoid contamination.
Public confidence erodes as officials admit they can’t confirm how long the monitoring data has been unreliable or whether other essential city services were tampered with. All right. This one’s tough, Steve. Which one is worse?
[Steve Zalewski] Oh, so maybe it’s because of my background in utilities and everything else, okay?
[David Spark] You’re immediately jumping to that is worse.
[Steve Zalewski] So, the potential compromise of the water systems? Ten times worse. Absolutely, without a doubt, 10 times worse.
[David Spark] And that’s just because it’s water and it’s a public utility. Yes?
[Steve Zalewski] Yeah. Well, so, if I don’t know when packages are going to arrive, I have no issue with the integrity of the content of the package. It’s just when is it going to arrive. And I can do compensating controls – putting my security hat on.
No big deal. Okay? Packages don’t arrive, I don’t have it to sell, I’m upset. Okay? If I don’t know that the quality of the water is acceptable and I have to go to boiled water, the impact the health and safety is immediate.
[David Spark] Mm-hmm.
[Steve Zalewski] Okay? That, by far, is way worse because now I’m impacting everybody with an unknown unknown. Okay? I don’t know if you can trust that water. Whoof.
[David Spark] And then you got hysteria.
[Steve Zalewski] That’s why I immediately went there. Yeah, right? That’s hysteria. You’re disrupting the social fabric of the country as opposed to just the expectation of the delivery of a product.
[David Spark] Mm-hmm.
[Steve Zalewski] And that in my mind is why I go impact on the water systems by far is dramatically worse as far as brand management.
[David Spark] Good point. All right, Tammy, do you agree or disagree? And sometimes you can agree for different reasons. What’s your take?
[Tammy Klotz] So, I actually do agree with Steve that the “worser” situation is the infiltration of the water supply. But it’s also backed by there was definitely an incident in May of 2021 in Florida of the Oldsmar water treatment facility where in fact somebody did get in, adjusted controls, and the operator was fortunate enough to discover that, right?
Had he not in that particular situation, the water would have been contaminated. It would have been poisonous because of the amount of lime that was actually in the water, and it was Super Bowl weekend when that actually happened. So, the possibility for that to spread much broader and impact a much bigger population was significant.
So, the risk is high. The reason I teetered a little bit because you also said on the shipping one there was hospital supplies…
[David Spark] Yes.
[Tammy Klotz] …which may be life-threatening in some cases – if the surgery couldn’t be performed and life was definitely at risk, as well. But I think the pervasiveness of the water and the consumption of the water definitely puts me into that utilities example being the more worse of the two.
[David Spark] Well, you bring up an interesting point here, and so I’m going to throw this back to you, Steve, is there could be life-threatening situations in scenario number one. Scenario number two sounds like level of hysteria. We may or may not have life-threatening, probably not I’m guessing, but their fear of there might be more life-threatening, so it’s one of those is the greater common good in the second scenario or the first?
I don’t know, Steve, what do you think?
[Steve Zalewski] That’s where when I said there’s the unknowns…
[David Spark] Right.
[Steve Zalewski] …known unknowns and unknown unknowns, okay? And a known unknown, to Tammy’s point, is look, let’s assume that a hospital is counting on getting medical gloves and they don’t arrive, okay? Well, they can go old school with soap and water and everything else.
They can call another hospital, okay, compensating controls and get supplies over. They’re in control of the situation. It’s a known issue, right? The integrity isn’t in doubt.
[David Spark] Ah.
[Steve Zalewski] Okay? Whereas with the water supply, what we’re saying is it’s an unknown unknown. We cannot guarantee the integrity of the product that you’re using; therefore, what do you do? Okay? This is like, “I don’t know that the water is good, I can’t guarantee,” as opposed to “I can only give you 100 gallons of water, that’s all I have.” Well, that’s fine, okay, because we know that that’s good supply.
I’ll stretch the 100. If it’s the “I don’t know if you can trust this water,” there’s the problem, right? Then you have to revert to no integrity in the system, we’re in big trouble. That’s kind of the way I think about it.
[David Spark] All right.
[Tammy Klotz] Yeah, and you may not even have enough information to put in the boil water requirement, as well. Which again, to the not knowing situation, that becomes even more concerning.
What about this AI security challenge?
26:44.943
[David Spark] “If I don’t see you in person, you’re not getting a reset.” Now, that’s one comment on the cybersecurity subreddit from a security professional on voice-based authentication after a convincing voice impersonation attempt at their help desk.
The attacker sounded just like a real employee, same cadence, same phrasing. Enough to almost fool a newer analyst. And this is actually how the MGM hotels got breached and it’s why those “my voice is my password” systems you know banks loved suddenly now look questionable.
The Reddit thread surfaced some practical defenses, callback procedures/unknown numbers, manager verification, MFA pushes to registered devices, or just removing human factors from password resets altogether. But help desks exist to help people, especially when they’re locked out traveling or claim their phone has died.
Voice cloning now costs a few bucks in 20 seconds of audio. So, Tammy, the voice thing seems a little scary here. How are you handling authentication on voice-only channels?
[Tammy Klotz] So, from an AI perspective, yep, the threat is real. It’s here. We need to figure out how we’re going to go after and protect the organizations, right?
[David Spark] And I just want to point out – you have heard voice fakes. There are voice fakes that can fool all of us with just very little audio. They could fool our own mothers, so yes.
[Tammy Klotz] Yes, that happened. That probably happens more often than not, right?
[David Spark] Yes.
[Tammy Klotz] That’s actually happened to my mother.
[David Spark] [Laughter]
[Tammy Klotz] But very similarly, I mean, to do a deepfake of a CEO who’s trying to deliver a message is very easy. And scary, right? Especially when you put it in front of folks and they’re like, “Oh! That wasn’t me.” Right? So, how do you overcome that, right, and I think it again comes down to the basics of authentication.
And two-factor takes on just a couple of different dimensions, right? So, your voice may not be the only thing, but what are the other components that you need to know about yourself when you’re being challenged to prove you are who you say you are?
And again, if the health desk is getting resistance by the person calling because they’re traveling and they’re frustrated and they just want to get on their system, tell them your “why” I’m protecting you, and I need to make sure it’s you so that I do not accidentally give somebody else access.
And that’s where human logic should prevail in those situations, too, as long as you’re explaining that. So, two-factor, what do you know, what do you have, something that only you’re going to uniquely know about yourself is what something.
[David Spark] And it could be things that happened recently, like you may have information about the person, something they did the past week or something like that. When’s the last time you logged on to XYZ, kind of a thing like that.
[Tammy Klotz] Right. And if somebody says that they’re traveling for work on company business, you have the opportunity to verify that travel was booked through the travel system, right? Now help desk folks may not have all of the rights to that information, but that’s where manager approval may have to come in in those situations right?
Or if somebody is saying, “I need to change my password and my authentication phone number,” these are the things that we need to think about, that yes, a help desk analyst is going to want to help, I agree 100%, but that’s why security has to be top of mind for everybody in the organization so that when questioned, there is a general acceptance of why I’m being asked those questions.
[David Spark] Steve, when you have those kinds of things in those extreme single cases where someone needs their password reset and they’re asking for like, “I need to change my phone and my password,” like two massive things like that, and you do go through all the verification steps.
Because that is conceivably a scenario that could happen. It’s rare, but it can. Do you then say all right, this person, we did do the change, we did all the verification steps, but we still want to keep an eye on this account? I mean, do you do that after the fact, yes?
[Steve Zalewski] So, yes, but here’s what it comes back to. Remember the good old days when driving a car and all you needed was spark plugs, fuel, right, and a battery, and there was no systems to be able to make sure combustion was good, right, and all of the vacuum tubes, okay?
This is the problem we got, which was we’re now doing this. Boy, remember when, when MFA was easy? Okay? Well, what’s happened is MFA is no longer easy because our voice component is shot so we’re screwed. So now what we have to do is we’re going to have to make it more complex.
We’re going to have to put more friction into the process because the easy way we used to be able to do it doesn’t work anymore.
We were literally having this conversation last week with the Bay Area CISO Council which was, “Hey, folks. What do we do now?” Because the way we do it doesn’t work anymore. Do we have to go back to shared secrets? Do we have to look at other technologies?
Because fundamentally, we lost this as a trusted authentication path, okay? And that’s what we’re all talking about now, which is from a compensating controls perspective, we have to do it different, and it’s going to be more complex, unfortunately.
Which for five years now, you’ve heard us say make security simple so people will follow it. Make it business centric. We got to go back to the drawing board right now.
[David Spark] And play out these scenarios, it sounds like, yes.
[Steve Zalewski] Play out the scenarios, and that’s just it. That’s what I said is we’re screwed, okay? Because we all know now that the way we’re doing it, because voice recognition can’t be trusted, we have to take that out of the MFA equation. We got a problem.
Okay? We fundamentally got a problem now. We got to look at other ways of doing this. One of the conversations was the aura rings. Do we now have people wear a ring with biometrics on it, okay, to know it’s you that you can assert that it’s correct at this point on a phone call or on whatever we’re doing, right?
It’s no longer good enough to be able to have a certificate on a phone or a traditional RSA token. That’s inconvenient. That’s an example of we got a problem right now, and we’re really struggling to understand how much more friction and how to put into the system.
How CISOs are digesting the latest security news.
33:25.818
[David Spark] “Only 27% of companies give CISOs budget control over OT security, and nearly half spend just a quarter of their security budget on critical infrastructure protection.” That’s from a recent Opswat study, and if your reaction is, “Well, duh,” you’re getting the point.
This is a vendor-funded research that tells us exactly what we already know – security needs more budget, threats are rising, and our organizations are underprepared. Oh. And security professionals are concerned about cyber attacks. It’s FUD – fear, uncertainty, and doubt – dressed up as insights designed to drive sales, not inform the industry.
It’s a cycle. PR teams pitch it. Lazy journalists write it up. And the whole thing gets treated like news. It is not news. As someone receives this kind of stuff, I reject it, and I tell them, “This is not news.” This is my editorial comment here.
Now compare this to something like the Verizon DBIR, which is also from a vendor but uncovers valuable intelligence about attacker behavior and trends. So, here’s the question, Steve. Do these quote “we need more budget studies from vendors” actually help you make the case internally, or are they just noise?
Have you ever cited one of these in a board presentation and gotten traction, or are they a waste of everyone’s time? And money, for that matter?
[Steve Zalewski] So, the way I characterize it is figures don’t lie but liars figure.
[David Spark] Mm-hmm.
[Steve Zalewski] Okay? If it’s to my advantage to me wanting to make a point, then these are fine, I’ll pull them out, okay? But if I’m having a hard enough time as a CISO raising my own kids, right, do I want to go try to help my brother and sister raise theirs?
OT, okay, is an example of a different problem. It’s somebody else’s problem. Do I the CISO want to now make it part of my realm of responsibility? If I do, then those reports are valuable. Otherwise…
[David Spark] But the thing is, but let me also point out, my point here is you don’t have enough money. Forget it’s OT or not. You don’t have enough money and you’re worried about cybersecurity. How many reports have you read that give you that information again and again and again and again?
You’ve seen a number of them, yes?
[Steve Zalewski] So, they don’t provide facts, right? That’s the point.
[David Spark] Right.
[Steve Zalewski] They’re just figures. If they’re to my advantage, that’s fine. The vendors are going to do that because they got to sell.
[David Spark] Right, because they’re hoping to sell their product.
[Steve Zalewski] Right. They’re hoping to sell more. That’s what I said which was great. I can go to the library, and I can pull out a bunch of facts. We can argue about whether they’re facts or opinion.
[David Spark] Mm-hmm.
[Steve Zalewski] That’s kind of irrelevant. I just go, so you get all this noise. I will even say DBIR more and more is simply the same thing every year. It’s not uncovering new, it’s just simply adjusting the percentages of the standard ways that the attacks work.
[David Spark] Right. And by the way, that’s actually a pretty good point right there, but that also points to the fact that our world does not turn upside down year over year. It moves in different directions, right?
[Steve Zalewski] Yes, the universe is not expanding at this point.
[David Spark] Right.
[Steve Zalewski] We just don’t as CISOs necessarily all agree as to how much of the universe we want to have accountability for.
[David Spark] Right.
[Steve Zalewski] That’s it.
[David Spark] All right. Tammy, I throw this to you, and again, this is not a discussion about OT or not OT, but it’s just more of these studies that tell us what we already know. Like I looked at this study, I’m like, “Yeah, I get it, I know this already.” It’s nothing here is a surprise.
You’re selling this to try to scare people to, like you said, have a data point to show to your board to say we need to spend more money on this. What are your thoughts?
[Tammy Klotz] So, first and foremost, the points around taking care of your sister and brother’s children, right?
[David Spark] [Laughter]
[Tammy Klotz] So, if there is an issue in my organization, it doesn’t matter, one, if it’s OT or IT. If I’m the CISO, it needs to be clearly understood and documented where that accountability lies. And that, in essence, I’ve grown up in manufacturing, 30 years of my career has been spent in manufacturing, right?
So, talking about it in the context of business risk and where the lines of accountability actually are drawn becomes extremely important. So, that’s kind of my take on the OT space, right? The reports and the numbers, honestly, I don’t think they hold a lot of weight with the folks at the manufacturing facilities, right?
Because it feels like it’s just a “ploy” to get us to spend money.
But if you back the truck up and you start talking about it in the context of if we found ourselves in the middle of a cyber attack, we are going to have operational risk. We are not going to be able to produce product, we are not going to be able to ship product, we are not going to be able to fulfill our order obligations.
Therein lies the conversation around where the risk is and how it impacts the company. So if you talk about, “I need this much money to protect us from not being able to deliver a product,” and you do that on how much money do I lose on a daily basis by not being able to ship product that’s how you gain support for the tools that you need to invest in to protect the organization.
Not a vendor report that’s going to say you should be spending this much money. That’s my opinion.
Closing
39:14.190
[David Spark] Well, that brings us to the very end of this show. Tammy, thank you so, so much. I’m going to come back to you in just a moment, but first, I want to thank our sponsor and that would be ThreatLocker. Remember, ThreatLocker – allow what you need, block everything else by default including ransomware and rogue code.
And more importantly, I want to see you in Orlando in March, and we’re going to be doing a live show there and you can learn a ton at Zero Trust World. Remember, it’s March 4th through the 6th, 2026. If you use the code ZTWCISO26 – and if you’re forgetting again, go find the blog post for this episode, we’ll have it there – you will get $200 off on your registration.
So, go there, ZTWCISO26, let’s see each other over at Zero Trust World. Steve, thank you for coming in and jumping in here and bringing your good friend, Tammy, for the recording.
[Steve Zalewski] Hey, nothing but the best, okay? And I’ll say I’ll see you all on the lazy river where you’re doing your podcast is what I heard.
[Laughter]
[David Spark] I will not be doing a podcast on a lazy river, but I do want to plug Tammy’s book, Leading with Empathy and Grace. We’ll have a link to it on the blog post for this episode to buy it over on Amazon, but Tammy, please explain what this book is about.
[Tammy Klotz] Yeah. So, thanks for that opportunity. Yes, Leading with Empathy and Grace was published in April of 2024. It is a book based upon my leadership journey and to embrace both empathy and grace as critical skills as opposed to the normal classification of soft skills filled with life experiences, personal journeys, and tools and techniques to help you become a better leader in your space.
So, thanks for the plug. I appreciate that.
[David Spark] Of course.
[Steve Zalewski] It’s an awesome book, highly recommend it.
[David Spark] There you go. Did you actually write a review on Amazon for Tammy?
[Steve Zalewski] I did not.
[David Spark] Get on that, now.
[Tammy Klotz] God, yes.
[David Spark] Immediately after this recording, that’s what you’re doing?
[Steve Zalewski] Yes. Yes, sir. Yes, ma’am. I promise. But I’ve got the book, it’s in my library right there.
[Tammy Klotz] [Laughter]
[David Spark] Thank you very much, audience. We greatly appreciate your contributions. Send me more “What’s Worse?” scenarios, I need more “What’s Worse?” scenarios. We greatly appreciate your contributions and for listening to the CISO Series Podcast.
[Voiceover] That wraps up another episode. If you haven’t subscribed to the podcast, please do. We have lots more shows on our website, CISOseries.com. Please join us on Fridays for our live shows – Super Cyber Friday, our virtual meetup, and Cyber Security Headlines Week in Review.
This show thrives on your input. Go to the Participate menu on our site for plenty of ways to get involved, including recording a question or a comment for the show. If you’re interested in sponsoring the podcast, contact David Spark directly at David@CISOseries.com.
Thank you for listening to the CISO Series Podcast.