CISOs don’t own cyber risk. Until they do. Haven’t we moved beyond the CISO being the scapegoat in waiting?

Check out this post by Nick Nolen of Redpoint Cyber for the discussion that is the basis of our conversation on this week’s episode co-hosted by me, David Spark, the producer of CISO Series, and Geoff Belknap. Joining us is Erika Dean, former CSO, Robinhood.

Join the conversation on LinkedIn

Huge thanks to our sponsor, ThreatLocker

Full Transcript

Intro

0:00.000

[David Spark] CISOs do not own cyber risk. Well, until they actually do. Haven’t we moved beyond the CISO being the scapegoat in waiting?

[Voiceover] You’re listening to Defense In-Depth.

[David Spark] Welcome to Defense In-Depth. My name is David Spark. I am the producer of the CISO Series. And joining me as my co-host, you know him, you love him, it’s none other than Geoff Belknap. Geoff, say hello to the audience.

[Geoff Belknap] Hey, everybody. I love you too.

[David Spark] That is very sweet of you to say, Geoff.

[Geoff Belknap] Yeah, I didn’t know how to tell everybody, but I feel like I think I can just be open about it now.

[David Spark] Finally opening up. He loves it. Did you ever see… There’s a great video on YouTube of Yoko Ono and John Lennon calling people randomly through the phone book on the Mike Douglas show, purely calling them just to say they love them. Have you ever seen this?

[Geoff Belknap] I have not seen this.

[David Spark] Look it up on YouTube. It is phenomenal.

[Geoff Belknap] Now I know what to do after lunch.

[David Spark] [Laughs] It is a slew of phone books out on the Mike Douglas show. And by the way, Yoko Ono and John Lennon were on all that week on Mike Douglas. And they just randomly started calling people. [Laughs] That was television back then.

[Geoff Belknap] I mean, that could be a podcast now. I wonder how many people listening to this show have a phone book within arm’s reach of them.

[David Spark] Arms… Let’s start with “have a phone book.”

[Geoff Belknap] Have a phone book. I don’t think I do.

[David Spark] I’m trying to remember the last time I had a phone book. It’s been many, many years.

[Geoff Belknap] I think we’re really hitting our core demographic here with this.

[David Spark] Well, they don’t deliver them anymore, do they?

[Geoff Belknap] [Laughs] No.

[David Spark] Yeah, they’re long gone. Anyway, so I guess the days of doing the Mike Douglas show and calling people up to say you love them. But now we can do it in mass via the phenomenon of podcasting. So thank you, Geoff. And thank you to Mike Douglas, John Lennon, and Yoko Ono as well.

Our sponsor for today’s episode is ThreatLocker. ThreatLocker, a phenomenal sponsor of the CISO Series. We’re going to be talking about pretty much their core principle, which is deny by default, which is kind of fed very well into the zero trust architecture.

You’re going to want to hear what I have to say a little bit later in the show. Stay tuned for that.

All right, let’s get to today’s topic at hand. We know CISOs need to understand risk in their organization. That is critical. But how much ownership do they have over it? And how much should they? Nick Nolan of RedPoint Cyber argued that risk lives with, quote, “executives accountable for financial outcomes.”

That sounds good. But why does a cyber incident still feel like a resume-generating event for many CISOs? Or have we moved beyond that? What do you think? I kind of feel we’ve moved beyond that. What do you think, Geoff? Yes?

[Geoff Belknap] I definitely feel we’re beyond this.

[David Spark] We did have it at a time though. Would you agree that?

[Geoff Belknap] Absolutely. I do think people are still worried about this. And I think some of that is valid. There is regulatory change happening all across the world. And so there are things where your civil liability has definitely increased. I think there’s very few opportunities for criminal liability.

And I just don’t see the marketplace showing that CISOs are being scapegoated for everything. Now, there’s different ways of interpreting that. And I really want to get into that today. But I don’t think as a premise, this is a thing anymore.

[David Spark] Right, it’s not a thing. But definitely, it used to be very publicly profiled like, “Breach happens, CISO out, next move.” That was the pattern we used to see. I don’t see that pattern today. All right. Let’s bring on our guest who is going to help us with this very discussion, which is far more nuanced, and it is not as sort of simple, dry, and cut.

CISOs don’t own the risk, business owns the risk. There’s a lot of gray area, I believe, in between. It is the former CSO over at Robinhood, none other than Erika Dean. Erika, thank you so much for joining us.

[Erika Dean] Well, thank you for the invite. I’m very excited. I can’t say that we’re at the love stage yet because we just met.

[Geoff Belknap] It’s okay. We’ll get you there.

[David Spark] You know what? John Lennon, Yoko Ono, they could love anyone.

[Geoff Belknap] You don’t have to love us back. We accept that.

What’s the CISO’s role?

4:14.116

[David Spark] Brian Wrozek of University of Texas at Dallas said, quote, “CISOs need to own something and be responsible for making final decisions, and their area of expertise is cybersecurity risk, plus all that contributes to it, like threats, vulnerabilities, controls, etc.

You can argue at the end of the day, everything is owned by the CEO, but they delegate (finance to the CFO), and it is responsible to delegate cyber risk to the CISO. The CISO needs to have, quote, ‘skin in the game,’ so to speak.”

And Simon Goldsmith, who’s a CISO over at OVO said, quote, “Most CISOs aren’t responsible for the resources, the systems, the data, the strategy, or the risk appetite of a company.” Now, per labeling CISO as, quote, “risk advisors,” Goldsmith goes on to say, quote, “Detecting, responding to, learning from, and anticipating attacks and weaknesses should be a first-class citizen in a company’s technology architecture and roadmapping, not an advisory function.”

So the CISOs are not an advisor, Geoff. They are critical to the core infrastructure. And we’ve heard this before, that they are just advising on risk. Yes? What do you think?

[Geoff Belknap] I guess it really depends on how your organization is structured. I will say I disagree with the premise that the CISO or the CSO, whoever your senior-most security executive is, doesn’t own the risk. A lot of this, and I’ll forgive us as we’re security people, and a lot of us are engineers, we get hung up on language sometimes.

All risk at a business, with a capital R, is not owned by the same person. Yes, the board and the CEO are ultimately where the buck stops, but the CISO in a high-performing organization is the owner of cybersecurity risk at very least, and sometimes is the owner of other things.

But they’re not the owners of business risk. They’re not the owners of brand risk or legal risk. And I’d say similarly, if you’re the chief legal officer or the general counsel, you’re not responsible for all of the business decisions people make, but you’re certainly accountable for legal risk in the organization.

And you’re not really a CISO or a CSO if you’re not acting at least as if you’re the owner of those cybersecurity risks in terms of how you execute your role. And even if you’re not the person who owns the buttons being clicked and the configs being deployed, you can still and, I would argue, are, the owner of the cybersecurity risk.

It’s a matter of how you approach the job and how you assert the scope of your role.

[David Spark] I think that’s a key line, “how you assert the scope of your role.”

[Geoff Belknap] Absolutely. And so I think what is helpful is to remember that while it may not feel like you’re in charge, and certainly that can make the job very difficult on a day-to-day basis, you do own that risk. And I think it does not help if you think you don’t.

I think you might have a problem there.

[Erika Dean] I definitely agree that every CISO owns the risk for cybersecurity. Whether or not they can effectively feel like they’re able to manage that risk, if they’re buried in an organization three levels below, four levels below a CEO, and rarely talks to the board, can’t even get FaceTime with the rest of the C-suite, that’s a problem.

And that is going to hinder their ability to truly manage the risk. Not that they don’t own it. Because at the end of the day, if something happens, they’re still going to knock on that CISO’s door and say, “What did you not do?” or, Could we have prevented this?”

Can there ever be agreement on this?

7:45.033

[David Spark] Mark Weatherford of NVIDIA said, quote, “I couldn’t disagree more. Sure, ultimate responsibility for everything that happens in an organization always lies with the CEO, but Spencer is correct that making risk decisions is exactly why companies choose to invest in a CISO.

Dozens of risk decisions are made by the CISO every day that the exec team never even knows about, and they, quote, ‘own those risk decisions.'” Really good point. “If a CISO ever told their CEO that, quote, ‘they didn’t own cyber risk,’ I’m thinking that would be a resume-generating event.”

And Niel Harper, CSO for JetBrains said, quote, “No single person or department owns cyber risk. It’s a shared responsibility that begins with the board of directors and senior executives, and extends to asset owners, department heads, the CISO, and individual employees across the entire organization.

Cyber risk is a core business risk. Risk owners are the individuals ultimately accountable for managing a specific risk within their area of responsibility.”

So I’m going to toss to you, Erika, on this. Some interesting takes here. I think what Mark said is really important is there’s a lot of risk decisions that definitely do not bubble up to the CEO or the board. And then Niel says it’s kind of everyone’s responsible for risk, which is true, but there does have to be kind of a lead owner, kind of like there is a boss.

Yes, Erika? I mean, how did you feel this as your role as CSO?

[Erika Dean] Absolutely. It’s still your responsibility to be able to articulate what that risk is and why it’s going to impact the business. You as a CSO or CISO, is it always your decision that gets to be made? Like, if you say, “This is a bad idea, you should not do this,” can you be overridden?

Yes, that is true.

Even if you report to the CEO, your choice can be overridden. And not everything’s going to go to the CEO. I completely agree with that. That doesn’t even make sense. He would not have the time of day to filter every single decision that is having to be made.

[David Spark] It would be such levels of cyber minutia that would not make sense to the CEO.

[Erika Dean] Exactly. I would say CISOs generally make a ton of decisions every day, how they organize, whether or not they have an incident response team, what that incident response team looks like. So there’s a lot of control that the CISO has, and they should have, because, again, they’re ultimately accountable for that risk.

[David Spark] So Geoff, I think this is why a CISO gets paid more, is that, like any kind of C-level, you take on risk yourself with the role. Isn’t that kind of part of the job?

[Geoff Belknap] Yeah, absolutely. A little bit of this argument is born out of exactly what Erika was talking about. It’s like maybe you feel buried in the organization because the organization hasn’t matured to the point where they understand where the CISO needs to be.

Sometimes people aren’t good at articulating risk or cybersecurity issues in a business context. That can be difficult. And there are some companies that also need to just elevate those roles to manage them properly. But at the end of the day, some of those are a decision you as a security leader in that role need to make about whether that role’s appropriate for you based on where it is and how you think you can execute it.

And some of that the business needs to help with as well.

But at the end of the day, your job, if you’re the CSO or the CISO or any kind of security leader, security lead, head of security, whatever fancy title you’ve given yourself, your job is to advance progress on security. You can’t do that if you don’t feel like an owner of the problem.

And you need to learn how, from your peers, from your colleagues, and other departments that also handle risk to comport yourself like an executive. And anybody who’s an executive function, the job comes with some risk. It might be personal, criminal, professional liability of some kind.

That is the game. That’s the job.

[David Spark] Now, I want to get back to something you said earlier about you have to sort of position yourself as owning the risk, leading the risk, things like that. Give me just one example. And I also want to hear from you, Erika, of how you make that clear to your team, to the C-suite, to the board.

Is it as simple as, “I’m responsible for X, just letting you know,” kind of a thing?

[Geoff Belknap] Yeah, I really do think it is that easy. Now, there’s lots of rhetorical devices that are 100% literal or maybe more figurative you can use. I know there are people that like to talk about, “I’m not going to jail for this.” I have a device I like to use that is slightly more tongue-in-cheek that just reminds people, “I’m not going to jail for you.

And if it does seem like I might, I’ll take as many of you with me as possible.” Which is not literal.

Although to be very clear, I’m very high integrity. It’s not my intent to ever go to jail. But it’s a reminder that, “Hey, I’m executing this job, not for a position of whether or not our business is going to grow or our brand might be impacted. I’m executing for a position of, I’m trying to keep us out of trouble.”

I’m not trying to slow your business line down or stop you from rolling out a feature. I have a responsibility. You have a job to do too. And now it is our turn as executives to engage on how do we balance those two things and make a reasonable choice.

But if you show up and just tell people, “Hey, I found a bunch of scans and you got to fix stuff, I guess,” that’s not a very compelling engagement.

[David Spark] [Laughs] “You got to fix stuff, I guess.” Definitely words you don’t want to hear from a CISO.

[Erika Dean] Especially the “I guess” part.

[Laughter]

[Geoff Belknap] Confidence.

[David Spark] Erika, I want your take on this of how do you make clear your role of what you do, your ownership of the risk? How is that communicated? Is it simple as just saying, “Hey, everyone, this is what I own”?

[Erika Dean] I think it is actually that simple. But in addition to that, it’s about making sure you have the conversations with the other leaders in the company and being visible to the rest of the company. So I think that going to all hands or going to company-wide meetings and talking about cybersecurity is part of that.

It’s helping them to understand that you own that messaging.

It doesn’t mean that everyone doesn’t have a part in cybersecurity. Most certainly everyone has a part in it. It is a piece that you can’t do alone as a CISO, right? You have to have the rest of the company kind of on board, wanting an understanding.

But the only way you get there is the communication and your ability to influence others to do the work that needs to be done. But having that conversation and sharing it, that’s the first step.

Sponsor – ThreatLocker

14:11.532

Our sponsor for today’s episode is ThreatLocker. Let’s be real. Most cybersecurity tools only act after the damage is done. Detection is reactive. Prevention is what actually changes the game. And that is where ThreatLocker comes in. Instead of chasing threats, ThreatLocker helps organizations stop them at the source before they ever run.

Only approved applications, scripts, and executables are allowed. Everything else, denied by default.

It’s a control CISOs have been asking for. Protection enforced right at the execution layer. And even trusted tools stay in their lane. Ring fencing keeps PowerShell and browsers from being misused. While storage control and elevation control tighten how data and privileges are handled across the enterprise.

It’s zero trust made practical and scalable for modern enterprises.

Now, if you’re tired of alert fatigue, who isn’t? And endless detection noise? Again, who isn’t? It’s time to shift the model. From detect and respond to deny and verify. Learn more at their website, threatlocker.com/CISO. Now do me a favor, go to threatlocker.com/CISO.

It’s the easiest way to let them know that you heard about them from the CISO Series. Go to that website and see how default deny can finally give you real control over your environment.

What do most people think it is, and what’s the reality?

15:43.501

[David Spark] Spencer Mott of KSAP Solutions said, quote, “Risk ownership gets thrown around like a hot potato.” I like that visual. “While I agree that technically and in the ideal setting, the CISO shouldn’t, quote, ‘own the risk,’ but the reality is the CISO is hired specifically for that reason.

And that’s why being a, quote, ‘fall guy/girl’ should demand the big bucks. It’s like a, quote, ‘delegation of accountability,’ end quote, situation. And it happens all the time in business, not just pertaining to security. I guess I am saying there’s what should be and then what actually is.”

And Mohammed S. of Federal Courts said, quote, “Cyber risk isn’t just about money. It’s operational, reputational, and sometimes even existential. The CISO’s job is to surface the risk clearly, quantify the exposure, and recommend actions.

But the final call on what level of risk the company can live with, that sits with the CEO and the board, not one executive. So yes, the CISO doesn’t own the risk, but neither does the CFO alone. Risk appetite is a leadership decision, not just a finance one.”

I’m going to go to you, Geoff, on this one. I think Mohammed makes a really nice division here in that making it clear what part of the risk equation the CISO does own, but the taking it on, that’s the business’s decision, right?

[Geoff Belknap] Well, yes and no. I think every job is different about what your organization expects you to own. And let’s be clear, own in that context is be the primary or the first line of defense. No matter what, whether you own a product feature or some services you deliver as an organization, if another peer executive disagrees, you’re going to the leader of the organization to resolve that in whatever route it takes to get there.

So even if the CEO of my organization is very clear that, “Geoff owns this risk for this part of the organization,” sometimes things have to bubble up because there are other contexts that are important about business objectives, regulatory needs, etc.

The helpful thing here is nobody owns all the risk. No one person owns all the risk. Lots of different risk decisions get made at different levels. And the most important thing is that, yes, I am accountable for the cybersecurity decisions within my scope.

I am not the final say. And that doesn’t stop me from asserting it as if I am. It’s just I know in the back of my mind, ultimately, the CEO or the board or somebody else can overrule that decision based on how we need to operate.

But really risk appetite does come from you. It comes from you as a leader to understand and to calibrate what is the business doing. Like, risk appetite, you can think of it as a CISO, is like, “At what level does the CEO want me to bring them stuff?” It’s definitely not basic things.

[David Spark] You make a good point. You said part of the… We always talk about needing to know the business and understand the business. You should already know as a CISO what the risk appetite of the business is in general. There may be some last-minute decisions like, “Well, this is a close call.

I’m bringing it to you,” kind of a thing. Yes?

[Erika Dean] I think that’s part of establishing the right metrics to help you guide that. So if something triggers and you know, “Hey, these are things that we need to be elevating,” even to the board. There’s different thresholds depending on what level we’re talking about.

[David Spark] Can you give me any example of this as, like, what you would bring to the board?

[Erika Dean] Absolutely. So things that are happening from a fundamental, programmatic standpoint, let’s say that you have a vulnerability management program, but things are not getting patched. You would definitely want the board to know about that because it is a high-risk area that you know that if those vulnerabilities are exploited, let’s say that you’re only patching like 20% of your systems, that’s pretty bad.

You’re going to need to let the board know that.

So you have to have thresholds around what you would want to bring to the board versus not. If it is something low level that wouldn’t have a large impact on the company, then that’s different, right? You wouldn’t bring that to the board. You would want them to focus on things that are the highest risk for the company as a whole, not some minute thing that wouldn’t impact the whole company if it was to be exploited.

Individual vulnerabilities would not make sense, right? It’s about the program.

What aspects haven’t been considered?

19:54.252

[David Spark] Jonathan Waldrop, former CISO over at The Weather Company said, quote, “It’s far more nuanced. The CISO does advise, but they also must act. Nobody wants to work with a person who only tells them things they should do. Security is not the IT police.

Security partners with business functions, IT, product engineering, legal, HR, everywhere really, and they ultimately help protect the business. Sometimes the CISO makes risk decisions that reduce risk based on the projects they implement. Only advising about risk makes the CISO look like a tattletale.

Don’t do that. Be a team player.” I like that.

And Mohammed S. Khan of Satellite Ground Station, Pakistan said, quote, “In many organizations, the board and CFO may be accountable on paper, yet they lack the technical depth to truly understand the exposure. That gap leaves the CISO carrying both the advisory and practical exposure.

That gap leaves the CISO carrying both the advisory and practical ownership of risk without the authority to allocate resources. Until boards raise their literacy on cyber risk and treat it as part of the business strategy, accountability will remain blurred, and CISOs will continue to operate as scapegoats rather than trusted advisors.”

All right. So this is a very interesting take. Jonathan said, you can’t just advise, you got to do. And we’ve kind of explained this here. But Mohammed brings up a good point here is that the fact that the board and the CEO just isn’t up to speed on cyber risk, that there’s just so much that they can sort of grok and understand as what is advised by the CISO, that there may always be this sort of a level of blame factor.

I know we’re not at the level of “Breach happens, CISO gets fired,” but do you still think there’s some of that lingering, Geoff?

[Geoff Belknap] I would say if you take the totality of businesses in the entire globe, the dental office, a software company, an oil field, I am sure we are not completely at the average or at the bar, right? Some businesses are going to not be as mature as others.

And I feel for you, and if you are in one of these positions, but I also tell you like, don’t take the job. Don’t accept the responsibility if you’re going to be in a position where you can’t impact that. You do have to sort of vote with your feet if you’re in a terrible situation.

But I do think the reality is the highest risk you can be is if you are accountable for risk at a public company. And in public companies, I think this is not a problem. I think in private organizations, it is highly variable whether the executive leadership and the board really understand cyber in general.

Yes, I think in that situation, this can still be a problem.

[Erika Dean] I would say you still have some public companies that are challenged with having members on the board that actually understand cyber risk enough to challenge. I do think that as a security professional, if you’re the one presenting to the board and you’re accountable for that as a CSO and CISO should, then it’s part of your role to help educate the board, request that they get training, things like that, or even suggest that we look at maybe adding a board member that does have the expertise, or at least some technology background to be able to have the ability to question and ask questions like they should.

Because you can’t just sit back and just hope. But I agree, at the end of the day, when you’re looking at a job, if you feel like it’s not a good fit because you’re not being heard, then not taking that job or leaving is probably your best interest. Because you have to be respected and listened to as an advisor or as a security professional.

If you’re not able to get things done, you’re not going to be able to accomplish your goal.

[Geoff Belknap] And I think this is really important, the point you’re making, Erika, and I just want to draw it out one more step, especially for the security professionals that are listening. There are absolutely, to Erika’s point, companies that will scapegoat you.

There are red flags and warning signs you will see ahead of time, and your challenge is to decide what are you going to do about it? If you think the company is going to scapegoat you, you need to leave. You need to not put yourself in that position.

Not every company is upright and moral, and not every leadership team is. Most of them are.

[David Spark] This is something we’ve discussed on other episodes. This is actually worth having a conversation about during the first interviews. Yes, Geoff?

[Geoff Belknap] Absolutely.

[David Spark] What happens when we have an awful event? How are we handling that?

[Geoff Belknap] And what is your liability? Is the company going to indemnify you from some of these decisions you’re making?

[David Spark] Yes. Am I under D&O insurance?

[Geoff Belknap] Yeah. What is going to happen if you do get terminated? What’s that look like? Are you being given a severance? Are you going to have to defend yourself? I think these are all really important questions that are… Especially if you’re taking a public company CISO role and it’s a regulated entity, you’re working in a regulated space, or a country that has very tight cybersecurity regulations, if the board is not educated on those, or you haven’t been able to lean into that, your job as a person is to make sure that you’re not the one going down for those missteps.

It’s the same as CFO. The regulatory bodies expect the CFO to resign or be a whistleblower if there are irregularities, not to just be the scapegoat. The hard truth is these jobs are getting really important. They are high visibility. They are high risk in some ways, and you have to make holistic decisions about yourself.

[David Spark] I think it’s very important to have that early discussion, Erika, and I want your final thoughts on this. Because if you ask the question when you’re going into the interview for a CISO role, and they are not comfortable with having that discussion and can’t be straight up with you with having that discussion, that’s a red, red, red flag, yes?

[Erika Dean] Yes, it’s a red flag. I would say before I accepted any of my roles from a leadership standpoint, the questions I asked were, “Well, what happens if we have a breach? How does that interaction look?” And I think that when I took my most recent role, it was at a time right after Uber and things like that happened.

And so of course there was a whole bunch of conversation around whether or not CISOs can now be liable from a criminal standpoint. And so it most certainly is something you should be asking, and if they back away from the conversation, that’s a red flag.

That means that they’re not willing to talk to you about something that could be real.

And you want to understand do you actually have the right protections in place? Because while you want to do what’s right for the company, you also are a human and a person, and you want to make sure that you’re looking at yourself as well, not just the company.

Closing

26:37.533

[David Spark] Very good point. Well, that brings us to the tail end of the show where I ask both of you which quote was your favorite and why? And I am going to begin with you, Erika. Of all these wonderful quotes that I read out, which one was your favorite and why?

[Erika Dean] I think it’s actually The Weather Company.

[David Spark] That would be Jonathan Waldrop, formerly of The Weather Company.

[Erika Dean] I think it’s true, right? It is not good for us to be sounding like we’re the police of IT because that’s not really our job. But at the same time, being a team player is what it’s about. It’s that collaboration is really key in the company to be successful as a CSO or a CISO.

[David Spark] All right, very good. And Geoff, your favorite quote and why?

[Geoff Belknap] A lot of good ones here. And I want to stress, just because your quote may not agree with me doesn’t make it a bad quote. Many of the people I work with and live with me remind me I am wrong many times and they love me anyway.

[David Spark] I have that as well.

[Geoff Belknap] Theoretically. [Laughs] I’m going to go with our first quote from Brian from the University of Texas at Dallas, which just said, “CISOs need to own something and be responsible for making final decisions in their area of expertise to cybersecurity risk.” He goes on to sort of talk about, at the end of the day, the CEO and the executive management of your organization delegate everything.

They’re not managing these things directly, even though they may be ultimately accountable. And it is up to you as somebody who’s stepping into a security leadership or a CISO role, whether it be a public or private company, to sort of set with them, where’s the boundary?

What do you want me to be making you aware of?

And a good CISO has a good internal calibration for what that is. You don’t literally own all the cybersecurity risk. Nobody does. But it’s your job to drive it and to take action and to make people aware if they’re not taking action that that’s not happening.

So that is the hardest part of the job, is to take action and to make people aware of when that’s not happening.

[David Spark] Very good point. Well, now this brings us to the very end of the show. Huge thanks to our sponsor, and that would be ThreatLocker. We appreciate it, ThreatLocker. Sponsoring the CISO Series, you’ve been doing it for a long time, and we recognize it.

And I hope you, our audience as well, please go to their website, threatlocker.com/CISO.

Remember, add that /CISO if you don’t mind. Easiest way to let them know you heard about them from the CISO Series. Huge thanks to Erika Dean, former CSO over at Robinhood, and Geoff Belknap, my co-host. And to you, our audience, I think, along with Geoff, and I’m going to say Erika as well.

Erika, do you love our audience as well just like…

[Erika Dean] I do. I really love our audience. And you know, even though we haven’t met, I’ve already grown to love you all.

[David Spark] And can you accept the fact that you’re not getting the return love? Because when you say “I love you” to someone and you don’t hear it back, it kind of can hit kind of hard. You’re okay not hearing it back?

[Erika Dean] Yeah, I’m okay.

[David Spark] [Laughs] All right. Geoff, are you okay with not hearing it back?

[Geoff Belknap] I’m fine with it. In fact, I encourage you not to tell me you love me. Please don’t hug me in public. If you recognize me, a knowing nod is all that’s necessary. Thank you.

[David Spark] Well, people could come up and say, “Hello, love you on the podcast.” Don’t you like hearing that?

[Geoff Belknap] That’d be okay. Yeah, I’d take that.

[David Spark] Do you hear people telling you how much they enjoy you on the podcast?

[Geoff Belknap] I frequently hear people that remind me that I’m on a podcast, and then I have to think about, “Oh no, what did I say?” But you know, the good news is we have fantastic editors, so usually it’s nothing terrible. But if it is, I’m sorry.

[David Spark] You don’t say anything to… Anyways, thank you to our audience. Your homework is to go find that Mike Douglas episode, I believe it’s on YouTube, with John Lennon and Yoko Ono making phone calls to people at random through phone books and telling them that they love them.

Good, good video.

[Geoff Belknap] It is. I feel like you need to relate this just for everybody who’s listening that’s not as old as David or I. Yoko Ono is what Taylor Swift is today, and…

[David Spark] Oh come on. Wait, wait, whoa, whoa. That is a stretch. [Laughter] That is a stretch.

[Geoff Belknap] Just in terms of… Not personality. But it’s like this is Kelce and Swift. It’s a similar popularity.

[David Spark] Mike Douglas was a daytime talk show host. We know John Lennon from the Beatles, his own solo career as well.

[Geoff Belknap] Some of us do.

[David Spark] Yoko Ono was his wife, an artist in her own right as well. Who, by the way, I had celebrity sighting of Yoko Ono when I was in Greenwich Village in New York. She was sitting at the table right next to me. I was having dinner with a friend of mine.

And this is the part that was really strange. She was having dinner with her son, Sean Lennon, who was making out with his girlfriend right in front of mom.

[Erika Dean] Maybe should have gone up to her and told her that you loved her.

[David Spark] I should have.

[Geoff Belknap] The funny thing is I would recognize Alex Stamos out in public, but probably not Yoko Ono.

[David Spark] Oh, come on. You can’t not recognize Yoko Ono.

[Geoff Belknap] There is no way I would recognize Yoko Ono.

[David Spark] Here’s the way I put it. Number one New York city sighting is Woody Allen. That’s a number one [Inaudible 00:31:23]. Number two, I would consider Yoko Ono because she’s so identified with New York. But the bizarreness of making out in front of your mom is what I found so strange.

And I guess if your mom is Yoko Ono that’s what you do.

[Geoff Belknap] And hey, if your mom is Yoko Ono, write to the podcast and let us know what you were doing and why.

[Laughter]

[David Spark] Sean Lennon, send us a note. Because I’m sure Sean listens. Thank you, everybody. We appreciate your contributions. You’re watching the Mike Douglas show, and listening to Defense in Depth.

[Voiceover] We’ve reached the end of Defense in Depth. Make sure to subscribe so you don’t miss yet another hot topic in cybersecurity. This show thrives on your contributions. Please, write a review, leave a comment on LinkedIn or on our site, CISOseries.com, where you’ll also see plenty of ways to participate, including recording a question or a comment for the show.

If you’re interested in sponsoring the podcast, contact David Spark directly at David@CISOseries.com. Thank you for listening to Defense in Depth.