In the past year, the landscape for CISOs seems particularly perilous. There are more responsibilities with very real legal consequences attached to the role. At the same time, the position often doesn’t see the same kind of corporate safety nets enjoyed by other members of the C-suite. There is a lot of guidance out there for CISO candidates negotiating for a new position, but what can a current CISO do once they are already in the role?

This week’s episode is hosted by me, David Spark (@dspark), producer of CISO Series and Andy Ellis (@csoandy), operating partner, YL Ventures. Joining us is our guest, Trina Ford, CISO, iHeartMedia.

Got feedback? Join the conversation on LinkedIn.

Huge thanks to our sponsor, Thoropass

Full Transcript

[Voiceover] Best advice I ever got in security. Go!

[Trina Ford] As a security leader, I was told to stop trying to prove that you belong in the role and start doing the job. And I was told that because I was being distracted trying to prove that I was still technical and that I could do all aspects of the job, whereas I was hired based on my leadership style, based on my strengths and my knowledge.

So, I was told, “Do the job, period, and stop letting distractions deter you.” So, that was the best security advice I can say I ever had.

[Voiceover] It’s time to begin the CISO Series Podcast.

[David Spark] Welcome to the CISO Series Podcast. My name is David Spark. I’m the producer of said CISO Series. And joining me for this very episode, you know him, you love him, you can’t do without him, and how you did without him beforehand, I will never know. It’s Andy Ellis. He’s the operating partner over at YL Ventures.

Say hello to the audience, Andy.

[Andy Ellis] Hello to the audience, Andy.

[David Spark] That is the most classic dumb joke ever.

[Andy Ellis] It really is. But I never come up with something original to say. I should probably have like a calling sign that I use.

[David Spark] Here’s my favorite dumb joke that has been repeated on sitcoms over and over and over again, and I remember seeing this on Welcome Back, Kotter once. You see somebody on the phone, and you only hear their side of the phone call – they’re listening – and you hear the person say, “You don’t say, you don’t say, you don’t say.” And then everybody else, when they hang up, they go, “So, what did he say?” “He didn’t say.” [Laughter]

Our sponsor for today’s episode is Thoropass, helping you wherever you are on your compliance journey. Yes, they are a brand-new sponsor with the CISO Series. And if you’re listening to the show, either yourself or someone at your organization is on a compliance journey, so you’re going to be excited what I have to say about them later in the show.

Andy, before we begin our show, I want to mention, I went to SeaWorld yesterday, and one of my favorite things about SeaWorld, I know this is of great debate though, is I do enjoy watching the shows. They have an orca show, they have a dolphin show and whatnot. But the thing that always fascinates me is that the performers are fed in fish, and that is how they are paid.

They are paid by fish. So, question to you, Andy, A, have you ever successfully motivated a single employee by throwing them a herring? But if not…

[Andy Ellis] Oh! A red herring, absolutely.

[David Spark] A red herring, [Laughter] okay. But here’s my question. When has food become a very good motivator?

[Andy Ellis] So, it is first of all worth noting that the word for pay – salary – comes from the root for salt because people were paid in salt originally. That was actually a medium of currency many, many, many moons ago. But people are totally motivated by food. Best way to motivate people is when they get security work done, take and go to the CEO and say, “Hey, we’re reporting out on this project.

I brought the whole team that did it. Here’s some cake. We’re going to tell you the amazing things that they did. We’re all going to eat cake together.” Let me tell you, do that a couple of times and all of a sudden you’ll have people showing up wanting to do security work so they can get recognized in front of the CEO with cake.

[David Spark] Cake’s not always my favorite motivator, but I think you need to vary up the food.

[Andy Ellis] No, no, because it’s a different group each time. You’re not taking the one group and saying, “I’m going to give you cake every day.” No, no, no. Once a quarter, some part of the organization gets cake with the CEO. You figure out what their dietary restrictions are, that was actually always the hardest part.

[David Spark] That field keeps growing and growing.

[Andy Ellis] Yeah, we had the people who had to eat vegan, but then we had the person who hated vegan who was one of the executive vice presidents.

[David Spark] Well, then you have people who are gluten-free too on top of this, yeah.

[Andy Ellis] And his attitude was, “Stop bringing me these fake cakes.”

[David Spark] I know, it’s tough, it’s very tough. Anyways, I will be brutally honest and say I have been motivated by food in the past myself, but I just like the fact that you could actually have performers that you could literally feed through the performance and that is their payment.

[Andy Ellis] Absolutely.

[David Spark] I was just thinking that would be great to see a Broadway show and see actors, as they deliver each line, they’re thrown food.

[Andy Ellis] They might eat better than they do without that.

[David Spark] That’s the show I want to see. All right, let’s get to our guest at hand. I am thrilled. By the way, our guest actually just took a new CISO gig. When we booked her, she had one CISO gig, and now that we’re recording, she has a different CISO gig. But it’s fine by us, very excited. In fact, we had her predecessor on the show, the former CISO at her current gig.

[Andy Ellis] I was even the host for that one.

[David Spark] Were you? Oh, yeah, yeah. So, you’re doubling it up. So, it’s same host for the [Inaudible 00:05:05]. Anyways, the CISO for iHeartMedia is now Trina Ford and we’ve got her. Trina, thank you so much for joining us.

[Trina Ford] Thank you for having me.

If you’re not paranoid yet, here’s your chance.

5:14.764

[David Spark] With the recent SEC charges against SolarWinds CISO, Tim Brown, a lot of CISOs have felt the ground shifting beneath their feet. We’ve seen a number of calls from the CISO community about the need to take proactive steps to protect yourself. Contrast Security CISO, David Lindner, laid out four steps in a recent piece for Dark Reading.

These include requiring CISOs to be included in the organization’s D&O insurance policy – that’s directors and officers – getting a seat on the executive table, direct board access and having a severance safety net. Now, these sound like great demands for those security professionals applying to be a CISO, but how would someone who’s currently a CISO negotiate any of this?

And, this is going to you first, Andy, and when internal communications does not match what’s being communicated to investors, what’s a CISO’s recourse? Andy, can you handle both of those questions?

[Andy Ellis] So, this one is really interesting, and it’s worth noting that Tim Brown was not a CISO at the time he did the actions that he is being prosecuted for.

[David Spark] And by the way, we’ve had Tim Brown on our show on Defense in Depth, and it was quite excellent. He talked about dealing with intense stress.

[Andy Ellis] Yes. And in fact, arguably he’s not a CISO today, and I’m going to ask Trina if she’s a CISO. And I’m not doing that flippantly. Most CISOs are not C-level executives.

[David Spark] This is a chronic complaint, yes.

[Andy Ellis] They do not sit in the CEO’s weekly staff meeting. To me, that’s the definition of a C-level executive is the strategy staff meeting that the CEO has. Are you in it or not? If you’re not in it, you’re not a CISO. Trina’s not in it. Almost every CISO that I know, that’s the case, and they’re not C-level executives.

In fact, I would actually argue the better thing for the CISO community to do – give up the title. And that’s easy for me to say, I’m a retired CISO, now I go do investing. But I think the world’s expectations of you are, “Oh, you’re one of these C-level executives,” but you’re not in the room where the conversation happens.

If you report truth to the board, you will get fired. Like, what are you expected to do here? Now, yes, the statements that they have evidence of Tim Brown making and his organization making demonstrates that SolarWinds was saying things that were of questionable truth. Now, the real question is, if we’re going to hold Tim to that standard, are we going to go and sue every product marketer ever?

Because let’s just be very honest, he was acting as a product marketer when he went out and talked about security.

[David Spark] All right, Trina, we’re throwing this to you. That’s a doozy. So, what do you do when what’s happening is not connecting to what you’re telling your investors, and is there any level to essentially negotiate this now that you have the job? Now that all the CISOs out there saw what’s happening, they’re like, “Eww, I don’t have these kind of protections.”

[Trina Ford] Because most of us don’t, to Andy’s point, we’re not true C-levels. And I think it’s going to come down to security finally has a “chief” title. The CIO, now you have a CISO, right? But in more cases than not, the CIO is a true chief. They report to the CEO, whereas the CISOs don’t. And I think it’s really going to come down to the CISOs deciding to stand firm.

What are we going to do? Do we have the conversation with our immediate manager? Sometimes we’re so far down, that immediate manager may be the CIO or even a senior director in some cases or a VP. So, the thought is that we stand firm. It really is nowadays, do you want to go to jail, or do you want to keep your job?

We’ve never had to feel that way or make a decision based on that. Now we have to. And looking at it through the lenses that I’m looking at it through, I’m not going to jail for anyone. So, the recourse is to have that conversation with your immediate manager, gain their sponsorship, and then go to general counsel because general counsel usually has the ear of the CEO.

I found that severance isn’t hard to get. Also reporting to the board, but not that direct reporting where you have someone on the board that is your confidante or that you can go to. You don’t have that. What you have is the board seeing you because you’re presenting. So, from that perspective, you have board access, the severance is pretty easy.

Getting a stake at the table, sitting at the strategic table with your business partners, I think that has to do more with the CISO versus anything else. I’m one of those, I’m a business partner, and I’m going to keep pushing. You don’t have to invite me; I’m going to invite myself. A lot of CISOs aren’t like that.

And I have very good rapport. I establish a great relationship with my business. So, as it relates to understand their strategy, their imperatives, I’m pretty good there. But I do know that a lot of CISOs are not.

And I also know that even in my case, the business doesn’t look for my approval. They’re not waiting for me to acknowledge or say, “Yep, go forward.” It’s a courtesy. It’s a formality, “Hey, we’re going to do this, and with your few employees get on board.” Now they don’t say it like that, but at the end of the day, that’s what they’re saying, “We’re going to do this.” CISOs need to be in a position to have the authority to make sure that the business understands what the CISO’s position is, and if they choose to move forward after that, move forward.

But at the end of the day, we’ve made our position clear. The D&O insurance, I think that one’s going to be a hard sell internally and externally coming in because we’re not seen as officers of the company. We need to be.

If you haven’t made this mistake, you’re not in security.

11:27.084

[David Spark] Almost every security professional has felt imposter syndrome. Now we have video evidence of this with an informal poll we conducted at Black Hat earlier this year. The video presents very intelligent security professionals admitting with broad smiles that they often deal with imposter syndrome every single day.

In some of the comments, it appeared that those around them both assumed and bestowed a lot of capabilities on them. Now I got the sense that people didn’t want to disappoint what others thought of them, so they went along with whatever they said, like, “You’re so brilliant and you can do this all,” and it caused them to have a really bad case of the imposter syndrome blues.

So, on the other side, cybersecurity is all about learning, and Steve Zalewski, one of our hosts over in Defense in Depth, he said that if you’re a lifetime learner, you’re going to suffer from imposter syndrome. So, I’m going to come back to you, Andy, on this and say, if imposter syndrome is inevitable for a security professional, what are the ways you identify it and then acknowledge this is what you’re going through, and in the past, how have you pushed past imposter syndrome and gotten the job done?

[Andy Ellis] So, I think the important thing to do is to retain the confidence of the new learner but temper it with the caution of an old hand. And the reason it’s important is imposter syndrome is that moment when you’re like, “I’m still a new learner, but people think I’m the old hand,” right? That I’m not here, but somebody else believes in me.

So, first of all, I don’t really have that imposter syndrome as much anymore, so more of you should call in and tell me how awesome I am until I get imposter syndrome again.

But that’s really all it is. Imposter syndrome is when the world has more confidence in you than you have in yourself. And maybe you should listen to them from time to time, while at the same time being cautious that, “Oh, hey, maybe I’m not as good at this as I think I am.” But it’s in riding that line that you learn the most – when you’re willing to try something new because you’re going to be overconfident because you’re new at it, while still being concerned that maybe you’re going to fail in a big epic way that will be disastrous.

And I think the further you get along in your career, the more likely your imposter syndrome is oriented not around little things, but around very big things. It’s like, “Oh, if I’m not truly a CISO because I’m not in the boardroom, am I going to make a mistake that’s so massive I’ll never get hired again?” Which I think is very different than the imposter syndrome that people might feel at different stages.

[David Spark] So, Trina, in your opening tease, which I loved, you kind of alluded to imposter syndrome right there, didn’t you?

[Trina Ford] Yes, I did. Because in my eyes, looking through the lenses that I look through, there’s varying degrees of imposter syndrome. And I watched your video. I think it’s great because in any role, especially if you’re new in it, there’s always going to be some uncertainty and doubt. Imposter syndrome for me though, the lenses that I look through is when others make you feel like a fraud and you start to believe that you are a fraud, so some of that confidence goes away.

[David Spark] By the way, that can definitely make you feel bad. That’s a rough one.

[Trina Ford] Yes, it does. And alluding to my opening, you start to try to prove that you should be, and you’re wasting time because either you are supposed to be in the role and you go forward and get the job done, you position yourself so that those naysayers’ voices are not as loud in your ear as those who believe in you, sponsor and support you.

You have to surround yourself with those who will help you rise, bring you up, sponsor and support and promote you. And I’m not talking about in rank, I’m talking about in visibility. And that in itself will help you kind of navigate the waters of imposter syndrome because it is real. I wish it were that someone were to say, “Hey, you can do this,” because that means they believe in me.

But the imposter syndrome that I’ve felt has been more along the lines of, “Do you really belong here? No, no, you’re diversity, let’s just check a box.” That’s not a good feeling, and that does promote imposter syndrome within people.

[Andy Ellis] Yeah, when you’re not getting that inclusion, so you’re spending the energy just existing in a space, absolutely.

[Trina Ford] Exactly, trying to survive. You’re not thriving. But when you get to that point of surviving and thriving, then that imposter syndrome, you’re squashing it.

[David Spark] We had a guest off microphone, and I won’t say who it was, but mentioned that this guest had someone under that person come to them because they had just been promoted to CISO, come to them and say, “Why do you have the job that I should have?” That’s a dude, that’s a take.

[Andy Ellis] At least that’s somebody who’s got a lot of confidence.

[David Spark] Right, right. And the way this CISO managed this quite challenging question right there was, “Let’s talk about how you’re going to ultimately take over my position.”

[Trina Ford] Yeah.

[David Spark] Which I thought was a very powerful move, and the conversation ended very, very well.

[Trina Ford] Yeah.

[Andy Ellis] But for those of you who want to manage your imposter syndrome and want some more detailed advice, I did write a book on leadership, chapter 14.

[David Spark] 1% Leadership, there you go.

[Andy Ellis] 1% Leadership, and chapter 14 is actually all about imposter syndrome, very fast to read. If you want to think about the inclusion issues Trina just brought up, that’s chapter 20.

Sponsor – Thoropass

17:13.841

[David Spark] Before I go on any further, I do want to mention our absolutely spectacular sponsor, that would be Thoropass. So, let’s go over the basics here. Maintaining compliance is never complete, right? Which is why most security and IT teams feel like they’re always in audit purgatory. But there is a solution.

And guess what? It’s easier than you think. You can actually escape the infinite loop of this audit purgatory by using Thoropass’s compliance and audit solution. Thoropass is the only solution using AI-infused technology and in-house auditors to take your team from start to the stamp without leaving the platform.

Now, as a winner of multiple G2 awards, including top awards for usability and service, your team is in good hands with Thoropass. From onboarding with dedicated experts to audits from in-house auditors who know every aspect of your framework needs. You can have complete confidence in your Thoropass compliance journey.

Thoropass is the only solution to offer audits for your most needed security frameworks from HIPAA to HITRUST to SOC 2 to ISO 27001, if you need PCI DSS pentests or any other major compliance framework, guess what? Thoropass can help. With Thoropass, you never need to worry again. Relax. They fix audits.

That’s what they do. Find out more at thoropass.com. Check them out. And thank you for sponsoring the CISO Series.

It’s time to play “What’s Worse?”

19:03.007

[David Spark] It’s time to play “What’s Worse?” Trina, I know you’re familiar with this game. Two horrible scenarios, but you get to select which one is worse. This one comes in from probably our greatest submitter of all time. That would be Dustin Sachs of World Kinect Corporation. And here you go, Andy always answers first, so you will either agree or disagree with Andy.

So, there’s two scenarios here, very quick and simple here. Scenario number one, employees are completely unaware of cybersecurity threats. Bad. Okay. Scenario B, employees are aware of the risks, but they’re completely complacent because they believe IT will handle everything. So, Andy, which one’s worse?

[Andy Ellis] I have to think through this one. So, they’re completely unaware, or they’re aware but like, “I don’t have to worry about this.”

[David Spark] “Oh, whatever. Who cares?”

[Andy Ellis] And I guess I have to assume that IT isn’t actually taking care of things. Because if IT was actually taking care of the things, that would be an amazing situation and Dustin wouldn’t give it to us. So, I think we have to go with IT is not protecting them from cybersecurity risks.

[David Spark] No, they’re under the false belief that IT is.

[Andy Ellis] They’re under the false belief that they are. Given those two scenarios, and I know we don’t usually get to do the, “Well, here’s how I’m going to change the world,” but in fact, I am going to play a little bit of the change of the world here.

[David Spark] Let’s see how this one works now.

[Andy Ellis] The second one is worse. Because if you have people who are aware of the risk, but they do not believe the risk is real because it’s being taken care of, so there’s this mismatch between their perception of risk and the actual risk. But their perception is based on information rather than a lack of information.

They know what’s out there, like, “Well, yeah, but we’re totally good because Tim Brown’s got it all taken care of and we’re SolarWinds and we’re amazing.” That’s a worse situation to be in because you have this long-term liability, like you knew and you didn’t do anything, and you don’t really have a way to educate them, come in and say, “Hey, we have this risk.” They’re like, “Yeah, I know about it.” And if you try to say, “Oh, IT sucks,” they’re going to be like, “Why are you bad-mouthing IT?” For a situation where they’re naive and clueless, I at least have opportunities to improve that world.

The second one, I’m not sure how to dig my way out of it.

[David Spark] No, no, there’s no improving. You understand how the game’s played. There’s no improving.

[Andy Ellis] I know, but the second one itself prevents the world from getting better and has a bunch of downsides. The first one doesn’t prevent the world from getting better and doesn’t contain the reckless downsides that the second one does.

[David Spark] I’m going to spin that – you’ve got a glass half empty there – I’m going to spin it a glass half full.

[Andy Ellis] Yeah, because I’ve already drunk half of it. That’s an optimist’s take.

[David Spark] No, no. The employees, they’re aware of the risks, but they have such pride in their IT department. They love, they have so much corporate spirit. They’re like, “IT can do it. They can do it.”

[Andy Ellis] But IT isn’t doing it.

[David Spark] Right, but it doesn’t matter. But the value of the company pride, there’s serious value in that.

[Andy Ellis] Oh, come on, we just talked about SolarWinds.

[Laughter]

[Andy Ellis] Not clear there’s value in that.

[David Spark] I didn’t use the SolarWinds example, you used it!

[Andy Ellis] Exactly. No, but we talked about SolarWinds earlier in the show.

[David Spark] It’s not in this “What’s Worse?” scenario.

[Andy Ellis] But this “What’s Worse?” is almost like SolarWinds. They knew about the problems. Some people at the company apparently believed it was being dealt with, even though IT totally said it wasn’t being dealt with. And it’s kind of hard to be worse off than SolarWinds. So, I’m going with that as the worst situation.

[David Spark] You know what? By the way, I think scenario B happens a lot. Like when you see an accident and you say, “Oh, I assume somebody called 911,” and nobody calls 911.

[Andy Ellis] Yeah, classic.

[David Spark] All right, where do you stand, Trina? Do you agree or disagree?

[Trina Ford] I disagree.

[David Spark] Way to go! All right, let’s hear it.

[Andy Ellis] Dustin, you win. Congratulations. Now I want to hear Trina’s justification for it.

[David Spark] Walk us through this, Trina.

[Trina Ford] Real life current state, most business partners, most do assume that IT and security are handling it today. That’s just how they operate.

[David Spark] Yes.

[Trina Ford] I feel like the first is the worst because given that most rely on IT and security to handle it because they’re focused on their jobs as a business partner or whatever they’re doing.

[David Spark] It’s not my job, it’s IT’s job to do that.

[Trina Ford] Right. But for them not to be educated and/or informed or understand what a threat is, in my opinion, introduces more threat and risk to a company. Because they do have a role that they need to play, and education is key, awareness is key. And they do, we would hope, watch the news. They do look at the internet.

[Andy Ellis] They’re unaware. You can’t hope that they’re getting random awareness somewhere else.

[Trina Ford] Okay, so that’s even worse. That we’re not, that they’re…

[David Spark] You’re great [Phonetic 00:24:03] supporting her theory, by the way.

[Andy Ellis] No, no, I’m not yet. Trust me.

[Trina Ford] Well, they’re so unaware, right?

[Andy Ellis] So, what you’re relying on is their awareness of risk to change their behaviors, which is well understood, that’s the Peltzman effect. Risk homeostasis, that as they become aware of risk, they’re going to do things to minimize risk. But in our first scenario, they’re not aware of the risk at all.

In the second one, they’re aware, but they believe it is being well handled by IT, which means that they believe they actually have less risk because there’s an organization capable of absorbing it. And so they’re going to take more risk in the second scenario than in the first one.

[David Spark] But the thing is, in the second scenario, everybody knows there are threats going on. The first scenario, all your staff doesn’t have a clue.

[Trina Ford] They’re clueless.

[Andy Ellis] Right, but they think they have this super competent IT organization that protects them from all threats. So, go do crazy things, it’s okay, IT’ll catch you. Look, I just don’t want to lose to Dustin here.

[David Spark] No, we don’t say that. Just say, “Oh, look, I got phished, I clicked on this. Well, no big deal, IT’ll take care of it.”

[Andy Ellis] That seems like a really bad [Inaudible 00:25:10]. I clicked on this link and gave away my credentials, but IT will take care of it, and I won’t do anything about it?

[David Spark] But with the first scenario, I clicked on it, and I don’t [Laughter] know if I did anything wrong. Trina?

[Trina Ford] But see, again, if they’re unaware, they will introduce and allow threats and risks, right? They will allow bad actors. They’re unaware.

[David Spark] That’s a good point because sometimes you’re aware and your behavior will change ever so slightly. It’s like, “Well, I’m not going to walk down the dark alley, even though there technically is not a threat there, but in general, I’ll avoid dark alleys.”

[Andy Ellis] But what if you’re willing to walk down every dark alley just because you think the cops will protect you?

[Trina Ford] No, you can’t use that one.

[David Spark] Cops aren’t hanging out.

[Andy Ellis] That’s IT’s doing its job. That dark alley’s not so bad. IT’s got my back.

[Trina Ford] No, no, no, because we know better. You know not to walk down a dark alley.

[Andy Ellis] I do because I don’t trust the cops to protect every dark alley. They don’t do that.

[Trina Ford] I don’t trust the cops. [Laughter] I still think that it’s worse for them not to be aware whatsoever because they will allow and be more receptive to bad actors, bad acts, than they would if they think that IT is handling it.

[David Spark] It’s like they’re walking down every dark alley in the first scenario.

[Trina Ford] Yeah, yeah, yeah.

[Andy Ellis] I want to give credit to Dustin for coming up with actually a really good one.

[Trina Ford] That was a good one. [Laughter]

[David Spark] They’re both awful and crazy hypotheticals at the same time, but they’re things we have to think about, is what is the actual role, the true role of security awareness, not the joke that most of us do of, “Oh, let’s just make sure people go to computer-based training once a year.” But how does understanding risks change human behavior is actually really key to what our job is.

How can we secure new technology without creating new risks?

27:04.291

[David Spark] Does the emergence of LLMs – large language models – and generative AI systems create an asymmetric advantage for threat actors? Now, on the face of it, it seems like the scale and versatility of these tools will present new challenges. But Cynthia Brumfield of CSO Online argues the security practitioners are used to this kind of challenge with different technologies over the years.

After all, while consumer-facing LLMs aren’t new, AI-enabled products have been around for years, and they can easily be applied to help automate day-to-day security tasks. So, generative AI is definitely an important new technology. But Andy, in your experience, does it represent something that our existing security frameworks around new technologies will actually struggle with?

And I’ve heard both sides of this one. Where do you stand?

[Andy Ellis] I just want to nitpick one thing around usability, which is the AI-enabled products we’ve had accessible to us for the last decade have not been easy to implement in ways that would streamline your process.

[David Spark] I will agree with that, but I will also say the past year has been a hockey stick curve.

[Andy Ellis] Yes, the past year is completely different because what’s all of a sudden happened is… And for those of you who aren’t in the content generation world, if you want to generate content as a company, and I’ve done a lot of this, I’ve done keynote talks where it’s like, “Okay, I need a slide designer,” and literally, we hire a designer because there’s not enough capacity in the company, and I got to sit down and talk to this human.

And it’s 40 hours of my time to tell this person what I want my slides to look like, and they’re going to go create them. It’s a lot of work. It’s a real pain in the neck. And now I can just be like, “Oh, hey, I need some slides, here’s my talk track,” and boom, I get a set of slides from an AI. Or I need to write a blog post about X, so instead of hiring David Spark to go write a blog post for me, I just say, “Hey, I need a blog post about X,” and ChatGPT gives it to me.

It’s 50% of the quality of David, but it takes about 30 seconds instead of everything else. No offense, David.

[David Spark] Well, I must say with artwork, it’s incredible too.

[Andy Ellis] Right. And it’s gotten so much better. A year ago, poor quality. And now I’m like, “Oof, oof. Am I out of a job as somebody who’s a content creator? This is getting really challenging.” Is at some point, somebody is going to create a clone of the CISO Series Podcast. They’ll take a voice like David’s, a voice like mine, and have pretend fictional guests and AI will write and produce.

[David Spark] It won’t be nearly as entertaining as us.

[Andy Ellis] The whole thing. Oh, probably more entertaining, let’s be honest.

[David Spark] Not possible.

[Andy Ellis] So, the world has changed a little bit in that [Inaudible 00:29:44] of it is so much easier to get content generated than it has ever been. But every security risk we ever faced around content generation is still there; it’s just now happening at scale. How often do you share internal private documents with third parties without thinking about like, oh, you’re doing a team all hands or a management offsite, do you actually make sure that the hotel employees aren’t listening and walking away with stuff they’re not supposed to know?

No, you’re not.

[David Spark] But that’s a good point. Like the vector of how many employees are listening, it’s a very small vector versus if this was being put online.

[Andy Ellis] Right. Except the difference is that once it’s being put online, you have an opportunity to take your existing controls around outsourcing and APIs and DLP and apply them because it’s no longer a human-to-human interface. It’s now an interface that crosses a digital threshold, which means we have ways to attack it as defenders to protect ourselves.

It’s not just about humans.

[David Spark] All right, Trina, I’m going to ask you the same question. Do you see all of this AI just more magnifying of previous problems that you just have to deal with in scale, or is it a whole new thing that you have to deal with and build a security program differently specifically for that?

[Trina Ford] I see it magnifying it because we’ve always kind of been behind the game, the ballgame as security practitioners. We’ve been relegated and kind of confined to what we can do, whereas bad actors, threat actors, they’re allowed to be focused, right? So, I do see it as being more magnified, and I also see it as being an opportunity for some of the frameworks that are changing like OWASP and NIST.

But at the end of the day, we still have to remember the practical aspects of being a part of a business and our business operations and those constraints that we still have as security practitioners as we try to, and I hate to use this word, but combat AI and/or utilize AI while mitigating the risk of.

Because our businesses are focused on the innovation aspect of it, the transformation aspect of it, being a market leader, and here we are with security trying to simply keep up. So, we’re trying to play keep up, catch up, and defend ourselves against bad actors. That’s a tough role for us to be in.

So, it’s really just magnified the opportunity that has always been there for us.

[David Spark] I mean, this is the story I pretty much hear from everybody is, it’s just a magnification of the previous problem. So, if that’s the case, A, why is everyone crazy scared of it, and is it just a scare because of the volume? And if so, how do we deal with volume, I guess, that we couldn’t do before?

[Andy Ellis] And I think this is one of the places. I just did a panel at a CIO summit here with a bunch of CISOs, and our whole panel was trying to tell the CIOs why CISOs existed. And I think the same advice applies to AI, which is we said the reason that CISOs exist in the first place is because CIOs stopped doing their job.

They did not think of themselves as responsible for all IT. And so somebody goes and does shadow IT, it’s sitting out there, and the only person who cared was the security team. And so all of a sudden you have the CISOs who basically were the shadow CIO support organization for the company.

And I think AI’s got everybody freaked out, but the reason it’s got everybody freaked out is who’s using AI in your company? Your marketing team. Who’s your team who is least supported by the CIO or the CISO? Your marketing team. So, maybe instead of freaking out about LLMs, you should worry about the fact that you have a marketing team that changes the CMO every two to three years, and the CMO completely fires all of the leadership, replaces it with new folks, rips out all the old tools and puts in new tools.

Hopefully, they rip out the old tools, often they just put in new tools, and you accumulate like a bazillion SaaS tools that aren’t used but have access to everything and nobody knows about it. And some of those SaaS tools are going to be LLMs.

[David Spark] Trina.

[Trina Ford] I think that it has to do with control and visibility, and the finish line keeps moving on us.

[Andy Ellis] Yeah.

[Trina Ford] We feel like we get to a certain point, we’ve got a little control, we have it. And next thing you know, here’s AI rearing its ugly head, and we can’t get a handle on it because our business, in this case, we can’t control it. Our developers, our business, the market, sales, everyone is jumping on the bandwagon.

[Andy Ellis] Yep. We need to stop telling people how not to use technologies and tell them how to use technologies.

[Trina Ford] I absolutely agree.

[Andy Ellis] Here’s how to use AI. Like, you’re a developer – here’s the ways you should use AI, here’s how it will make you more productive. And if that advice comes from the security team, when we say, “Oh, and by the way, don’t do X.” They’ll be like, “Oh, yeah. Well, you told me to do five great things.

I’ll listen to you on the one thing you told me to not do.”

[Trina Ford] Yeah, I absolutely agree. I’m testing right now with my company for that very reason. I want to be a part of it.

Are we creating more problems?

34:56.468

[David Spark] Have you ever been on vacation and couldn’t resist looking at that Slack or email notification from work? Well, you’re not alone. A new survey from Centripetal found that 90%of cyber professionals polled in the UK and Ireland checked work notification when on holiday. The survey showed the industry continues to struggle with work-life boundaries, with the vast majority of respondents getting off-work hour interrupted at least once a week, and many working at least eight extra hours in a week.

Interestingly, only a quarter said this extra work came as a result of increased cyber threats. About half said they felt obligated to handle these interruptions out of company loyalty. We endlessly talk about work-life balance. The knee-jerk reaction is to say this is awful and people should unplug during vacations.

But the reality is we don’t always segment our lives like this, where we’re 100% work and then 100% on vacation. Very few people do this. I’ll start with you, Trina. Is it okay that there is a fluid dynamic between work and time off, or is this damaging? What do you think?

[Trina Ford] It’s damaging. At the end of the day, we have become so accustomed to having our phones, our laptops beside our pools when we go on vacation that we’ve forgotten how to relax, and there’s burnout. We’re no good to our company, our programs, our teams if we are burning ourselves out because we don’t find the opportunity to just have some downtime.

We need to learn how to separate. And as a leader, it’s up to us to set the stage for the cutoff. This is why we delegate. This is why we cross-train. This is why we have backups. We need to utilize them and allow ourselves some time to rejuvenate.

[David Spark] Andy, what do you think? I mean, I agree, but I’ve seen all these sort of advice things, they’re really obsessed with, “You’ve got to not take your work home with you or when you go on vacation.” That sounds great in theory, but I don’t always think people can do it because I’m sorry, work is part of our lives, and actually a lot of us enjoy our work.

And while we do want to unplug and enjoy our vacation, ah, we still got one ear in thought [Phonetic 00:37:19], we’re still reading the news that’s related to our work. Andy?

[Andy Ellis] Yeah, so I think that the idea of you work 9:00 to 5:00 and nothing outside of it, for IT and information security, that is not ever going to be the reality. I think the way that people should think about it is, you have these sort of micro, “Oh, I’m working right now and I’m not working right now, and then I’m going to be working again.” Like when my kids were little, I didn’t work from 4:00 in the afternoon until 8:00 p.m.

Right? That was my block for being with my family. Right? I got home, I helped deal with the kids, fed them, ate dinner with them, put them to bed, and then I went back to work. Right? But I set that boundary. And I think that’s the challenge, is people don’t have boundaries. And you don’t have to be permanently in a boundary mode of I’m either working or I’m not working.

But you should have protected times where you’re like, “I’m not working at this, absent something crazy.” Like yes, if you call me up because it’s an incident because the company’s burning down, I’ll reprioritize, but I’m not going to go looking for work to do when I’m in my kid time.

And we had incidents that would show up every Friday between like at 7:00 p.m., there’d be an incident, it was always a customer support incident. Like, customer had been complaining all week, and the customer support team’s like, “Well, Engineering hasn’t been responding. We don’t want it to go into the weekend, so we’ll just declare an incident.” And I was the incident responder of last resort, so it would always somehow get to me.

On Shabbat, I’m getting these calls. I’m literally sitting down at Shabbat dinner; I’d get a phone call. Went like four weeks in a row, and I said, “Fine. Customer support, you’re not allowed to declare incidents ever again on a Friday afternoon.” And they’re like, “What are you talking about?” I said, “You’ve known about this was a problem since Monday, right?” And they’re like, “Yeah.” “Then you doing it on a Friday afternoon is not my problem.

You don’t get to do this anymore.”

And we went back and forth. Because I was serious, I’m like, “If you ever do this again, you’ll never get to declare any incidents. You’ll have to beg somebody who has incident declaration privileges.” And they said, “Okay, fine, we’ll stop doing this to you.” But you have to be willing to take that hard line and say, “Here’s when I’m not working.” If I’m on vacation, sometimes, yeah, I want to just keep in touch and know what the flow is.

Because I do a lot of thinking work where somebody says, “Hey, here’s this thing.” I got to think about writing a paper, I’ll do that while I’m on vacation, that’s fine.

[Trina Ford] I agree. So, I still say it sounds like we’re all in agreement. It’s kind of damaging, right? But we also have to think about the different home lives, right? Like you said, you separated. You could do that. Look at you, right? But there are others that can’t separate. You’ve got single parents, moms, dads, whatever.

They’re single. They feel like they have to work that job. They have to be available. Setting those boundaries comes back to your leadership, in my opinion. It shouldn’t be fluid. It should be someone is setting the example. I know this. I used to be one of those who felt like I couldn’t disconnect, that I had to have my laptop, I was still in that proving mode.

This is before I became a leader. If I could have set those boundaries, that would be great.

[David Spark] That’s a good point. One of my employees, upon hiring, made it very clear that he wanted to have this sort of time with family, just the way you exactly described it. And he said also, like, if there’s some errant situation or something like that out there, vignettes where I can plan ahead something, yes.

But I have been as cognizant of this as possible. And I think that’s kind of the critical thing is, if you have a routine that you want to stick to, you got to communicate that to your leadership so they can build a program for you. They need to know this.

[Andy Ellis] I told people, like, “I’m not working Friday afternoon.” Like, “Boom, I’m done, 3:30, I’m checked out. You’re not reaching out to me. “

[Trina Ford] And you can do that.

[Andy Ellis] And I can do that.

[Trina Ford] Mm-hmm.

[Andy Ellis] And then you have to support people who are doing that as well.

[Trina Ford] Exactly.

[Andy Ellis] I was at a keynote, and I wanted to go yell at the speaker because he got up and said, “Look, people have told you not to send email on Sundays, but if you work on Sundays, go ahead and do it.” And I’m like, “No, no, delayed timing, unless you know it’s somebody else who also works on Sunday.” Because if you have the power in a relationship and you’re sending email on Sunday, you are implicitly telling your staff that they should reply to you because the first time they reply to you, you now have a conversation with them.

They get ahead in their job because they’re the ones being responsive. By Monday, you’re the problem solver. Nobody else was because they were protecting their Sunday. You’re part of the problem if you’re doing that.

[Trina Ford] Very true. Very true.

Closing

41:48.210

[David Spark] That brings us to the end of the show. I want you to know that you all have free time after this show to do whatever it is that you want. All right? I’ve given you the right to do that. And I want to say a huge thanks to our sponsor, Thoropass. Remember, it’s thoropass.com. They can help you wherever you are in your compliance journey.

Come on. Compliance is tough. You want to work with people who’ve seen and done it all. Don’t be the one who sees it for the first time and tries to deal with it for the first time. Get some real help. Check out what Thoropass is doing at thoropass.com. Trina, I’m going to let you have the very last word.

Andy, any last words on today’s episode?

[Andy Ellis] Well, it’s going to be my birthday in three days. So, if you’re listening to this show the week that it drops, wish me a happy birthday.

[David Spark] Okay. Trina, now you have a new gig. Should we tell every vendor to reach out to you to set up some time, by the way, with you? How many of those emails have you received so far, by the way?

[Trina Ford] Oh, my gosh. I had to create a vendor folder. So too many.

[David Spark] Did you?

[Trina Ford] Yes.

[Andy Ellis] Have you ever seen my vendor rebuff message, Trina?

[Trina Ford] No.

[David Spark] Oh.

[Andy Ellis] I’ll l send it to you.

[David Spark] Andy has a good one.

[Andy Ellis] If you Google vendor rebuff with one F, it’s the first thing that comes up. It’s a template for just how to respond and tell people to go away.

[David Spark] By the way, that’s always my favorite question, how many messages. I’m assuming you announced this on LinkedIn, and so you just got hammered with messages. Yes?

[Trina Ford] Well, I actually tried to do it silently, and someone must have notifications on because immediately I started receiving, “Congratulations and oh, by the way.”

[David Spark] By the way, I’m assuming you know everything about your new security program.

[Trina Ford] Yes.

[David Spark] Let’s set up a meeting.

[Andy Ellis] Yep. Every vendor who’s got iHeartMedia in their territory, they basically just have LinkedIn searches set up for changes of employment that have security in them.

[Trina Ford] I found that out.

[David Spark] Well, you aren’t required to respond to them all. We have told them many times that that is not the time to reach out, yet they still do it. Nothing we can do about it. Any last words regardless, Trina?

[Trina Ford] No. I just really appreciate being a part of this show and being able to speak my truth. Thank you.

[David Spark] Well, we loved having you on. And I want to thank our audience as well. We greatly appreciate your contributions and for listening to the CISO Series Podcast.

[Voiceover] That wraps up another episode. If you haven’t subscribed to the podcast, please do. We have lots more shows on our website, CISOseries.com. Please join us on Fridays for our live shows – Super Cyber Friday, our virtual meetup, and Cybersecurity Headlines Week in Review. This show thrives on your input.

Go to the Participate menu on our site for plenty of ways to get involved, including recording a question or a comment for the show. If you’re interested in sponsoring the podcast, contact David Spark directly at David@CISOseries.com. Thank you for listening to the CISO Series Podcast.