When we talk about giving back to the community, there’s an inevitable element of self-interest layered on as well. Sure your blog provides information to others, but it also raises your profile. It’s a mutually acceptable practice. I provide value for the community free of charge, but I still get something in return.

This week’s episode is hosted by me, David Spark (@dspark), producer of CISO Series and Andy Ellis (@csoandy), operating partner, YL Ventures. Joining us is Jana Moore, CISO, Belron.

Got feedback? Join the conversation on LinkedIn.

Huge thanks to our sponsor, Vanta

Full Transcript

Intro

0:00.000

[Voiceover] What I love about cybersecurity. Go!

[Jana Moore] What I love about cybersecurity is changing landscapes. So, whether that’s the threat landscape, whether that’s the regulatory landscape, the business landscape, our risk profile, all of those things are changing frequently. That’s also why I hate cybersecurity.

[Voiceover] It’s time to begin the CISO Series Podcast.

[David Spark] Welcome to the CISO Series Podcast. My name is David Spark. I’m the producer of the CISO Series. And joining me as my co-host, it’s Andy Ellis. He’s the operating partner of YL Ventures. And you’re not the only operating partner, as I just discovered. You have now a colleague that’s joined you.

But say hello to the audience, Andy.

[Andy Ellis] Good morning, folks. Or depending on when you are in the world, good afternoon, good evening, or good night.

[David Spark] Or if you’re sleeping…

[Andy Ellis] I’m not going to encourage the people to listen.

[David Spark] To us? Sleeping?

[Andy Ellis] Yeah.

[David Spark] Look, if they have to listen to us at any time, maybe that’s the best time.

[Andy Ellis] Well, no, no. I’m okay with them falling asleep while they listen to us but setting us to start playing while you’re already asleep, that’s where I’m going to draw the line. You don’t get a greeting.

[David Spark] So, my wife, this is why I don’t want it either because my wife says this, that she will sometimes listen to podcasts as she’s sleeping. And she got… By the way, there’s like a headband you can get that has earphones in it so you can sort of sleep with those on.

[Andy Ellis] Yes. I meant to get one before I got on my flight tonight, but I unfortunately failed.

[David Spark] She says I purposely listened to a boring podcast. So, I don’t want our listeners to think the same thing too. [Laughter]

[Andy Ellis] There you go.

[David Spark] I would not like that. And also, I think it would probably be bad for our sponsors because they’d fall asleep before I mentioned the sponsor.

[Andy Ellis] Yeah.

[David Spark] And read the sponsors’ great ad copy. I’m sure nobody who listens to this skips through our ads. They listen to them heartily. My guess is you often play them three to four times through to make sure you hear every juicy word that’s spoken in our sponsor reads.

[Andy Ellis] Absolutely. I know that people really relisten to this podcast.

[David Spark] I get lots of calls saying, “Could you do an episode of just sponsor reads?”

[Andy Ellis] Oh, yes. Fantastic.

[David Spark] It happens not ever, but I would like someone to say that.

[Andy Ellis] Actually, you know what I would actually pay money to see? And maybe we should do this at RSA. You should get a bunch of random companies and be like, “We’re going to cold read your sponsor text. David will not have seen it before, and he’s going to attempt to read what you wrote.”

[David Spark] I do that plenty. Well, I’ve had to coach a few sponsor reads down, like from the ledge. I’ve had to do a few of those.

[Andy Ellis] I think people should get to see the actual cold reads because there are times where you’re like, “Yeah, let me go edit this on the fly and then we’ll redo it.”

[David Spark] Well, the big one is the complete security, we’ll do it fully for you, you don’t have to worry. I’m like let’s dial that one back a little bit. All right. But one sponsor that does not have this problem, and they’re a phenomenal sponsor of the CISO Series. Let me mention how awesome they are.

That is Vanta, vanta.com, that’s them. Your security and compliance verified. I will talk about them. It will be very compelling what I have to say later in the show. All right. Andy, just before we went to record, you were mentioning something that happens in Israel just before July 4th. Now, this episode is going to be dropping just after July 4th.

And I had never heard of this. What is this?

[Andy Ellis] Yeah, it’s in Israel and it’s like Jewish day camps in America. It’s called Yom America on July 3rd. And my daughter works at a day camp and was mentioning this to me that they got to prep the kids for Yom America. And I’m like, “Don’t you mean Yom Ha’atzmaut America?” which would be Independence Day in America.

And she’s like, “No, no, no. Yom America.” And it took me a while to figure this out. It’s on July 3rd. The idea is, is that because the kids won’t be in the camps on July 4th because they’re off celebrating the 4th of July, you have this sort of unobserved or reverse observation of the 4th of July by letting kids come in and everybody wears their patriotic vest in celebration of America the day before.

So, it’s Yom America, which I jokingly called Independence Day reverse observation, right? Because normally you observe a holiday on a weekday, which means you don’t do it. So.

[David Spark] Well, I hope everyone enjoyed their 4th of July and their Yom America. Gives you a chance to wear your red, white, and blue for multiple days. And for those of our listeners who do not live in the United States, we welcome you to celebrate either day with red, white, and blue as well. Yeah, like British could do it.

That’s the color of their flag.

[Andy Ellis] If you’re in Britain, you should celebrate the 4th of July because it celebrates the greatest export that Britain has produced for the world, which is freedom, mostly from Britain.

[David Spark] Not that bad a place to go to.

[Andy Ellis] No, it’s not.

[David Spark] By the way, our greatest listenership city-wise is London. They’re one of our top five cities.

[Andy Ellis] Wow.

[David Spark] Yeah, huge. Actually, I’ve seen it on Apple Podcasts as number two on certain times. So, we have a huge listenership in London. Let’s get to our guest at hand. I have eagerly wanted to get this woman on the show, and it’s finally happening, and she’s also a big fan of the show. So, I’m assuming both thrilled on both sides.

So, let me introduce her. It is the CISO over at Belron, none other than Jana Moore. Jana, thank you so much for joining us.

[Jana Moore] Aw, thanks for having me. I’m so glad this finally happened.

Why has this topic suddenly become the center of attention?

5:28.415

[David Spark] With the new SEC rules on incident disclosure coming into effect, it’s put cyber readiness a concern for other executives, not just the CISO. Chris Crummey at Dark Reading highlighted some essential steps executives should take for cyber readiness, such as actually implementing a cyber readiness program, stress testing, and iterating on incident response plans.

I’m interested in the trickle-down benefits of cyber readiness because if you actually do this, other things benefit as well. So, I’ll start with you, Andy. What have you seen both for security teams and the overall organization when you actually have a really good cyber readiness program? So, that means just you’ve done your tabletop exercises and you’ve gotten all your ducks in a row.

What has been the sort of trickle-down effect?

[Andy Ellis] So, I think the really important key here is you often have two different incident response plans. Actually, you have three in most companies, which is you have the marketing and communications plan, you have a technical incident response program, and you have a security incident response program.

That is broken, that’s what you need to fix here, and I really wish this article had dug into that. The most important thing for your executives, they’re used to the communications incident response plan. You have to make sure that that one is actually integrated with what you’re doing from a cyber perspective, which you should really hope is also integrated with what you do on the technical side.

And so make sure that you only have one incident response program across the company, everybody follows the same thing, you use the same language, and most especially that you know who is driving communications. Because often what happens is is somebody in marketing builds an incident response plan communications template, and then they try to drive the incident response program out of that.

And they work for the incident response team, but that takes a little while for everybody to sort of build that together.

[David Spark] All right. Let me throw this to you, Jana. What have you seen as the effects? And you want to build upon what Andy just said, or you have your own take on that?

[Jana Moore] Yeah, I completely agree. And I think that depending on the maturity of the company, and if they’ve gone through any sort of incident training or actual incidents to learn from kind of what you just said, I think what’s interesting is the benefits. I think from what we’re seeing with mainstream media and cybersecurity now being represented a lot more consistently in the media, I mean, I’m seeing commercials now for cybersecurity vendors.

It’s crazy to me. Every time I see a commercial come on TV for cyber, I’m always like, “Did that just happen?”

[David Spark] CrowdStrike was on the Super Bowl.

[Jana Moore] Yeah, it’s crazy. So, it’s all good. But I think it’s now more kind of in their face, and so they’re hearing about it more in their living rooms. And so coming into the office, I think they’re asking more questions these days, and I think the SEC rules that came out definitely do have an impact on the conversation.

But I think it’s also that in combination with it being more mainstream. But the benefits of this, what I’m seeing, is the past year I’ve been spending with our businesses across Belron and going in and talking to them about what do you have in place today, let’s start to put together a cohesive playbook.

And it’s exactly what you said, that I don’t want them to create a separate incident response plan for cyber. This needs to just be another chapter in your incident response planning that you already have in your company.

We have 18, 19 different business units at Belron. So, I’m doing this multiple times, and I’m seeing the same things at each business I go to. And it’s the appetite is definitely there. The willingness is absolutely there. We’re in a safe space where they can ask their questions. But that’s the message that I give them is this should not be treated as anything different than any of your other crisis planning that you have in place.

Let’s leverage those communication plans that you have. Maybe let’s just add a couple of more holding statements in there that might have some language that’s relevant to cyber. That way, you don’t have to create it on the fly. But it’s really just getting them to build the muscle around this practice as a whole.

And then it also ties nicely into… We talk about the IT side, obviously, from a cyber perspective, we interact mostly with our IT partners, right? But the business continuity lens on this is something that I’m noticing the business doesn’t necessarily stitch together, where they associate business continuity in the relationship it has to IT DR.

They just see those as two totally different things, that the IT team will fix it, and we have this BC, business continuity, thing lingering over here that we never update. But it’s really that end-to-end program where the two do feed into each other, and it’s important to understand what those connections are.

So, what I’m seeing the benefits in the company, the business, is that the willingness is there a lot more now than what I’ve seen in the past. And that the associations, once you’re in the room, and you’re discussing it, and they’re able to ask the dumb question right in the room, they’re starting to connect the dots, and it starts to make more sense.

And now they feel like they have more of a business understanding of cyber, and how that applies to their role as a business leader, what their responsibilities are as a business leader. On the day that the event happens, now they understand what they should and shouldn’t be doing. So, it’s a journey, right?

It doesn’t happen just in one tabletop simulation exercise that you do for them, but I just see the light bulbs going off a lot faster now, and so the conversations have been really positive.

What’s a CISO to do?

11:10.048

[David Spark] How do we break up the boys’ club mentality in cybersecurity? Recent survey data from the nonprofit WiCyS, the Women in CyberSecurity, showed that almost half of women in cybersecurity experience issues with career growth, hitting a glass ceiling with 6 to 10 years of their career, and are five times more likely to report exclusion from direct managers.

We’ve talked about men being allies for women in the workplace, but as Meredith Harper, who is the SVPC CISO for Synchrony, said on this very podcast a few years ago, she said, “I don’t want an ally, I want an accomplice.” She meant I want someone actually active participating, not just saying, “I support you.” I’m going to start with you on this, Jana.

What does that accomplice participation look like? How do you get to move from passive to an active participant in supporting women in cyber? And honestly, where does it begin?

[Jana Moore] Yeah, I mean, this is a great topic, and we could go on and on about this one. I think that what I would say for men who are looking to be more of just a partner or someone who supports the women in the workplace or women advancing in their careers, I think for men, it’s hard for them to identify what are the actions that they can take.

So, I think for me, it’s about that active sponsorship in bringing up those women or underrepresented groups, bringing up their names in rooms that that they’re not in. And being there to say, “Look, I’m going to use my reputation or my credibility or my kind of clout in the company. I’m going to use that to get this person more recognized or have more opportunities put in front of them.” So, I think that’s one thing that they can do is if they are in those rooms, be a sponsor, an active sponsor of bringing up the names so that people start hearing those names.

I think the boys’ club thing I get what that means, and I understand it. But I don’t want that to be a negative. Some of my best partners are men. I mean, clearly. Because I’ve been in cyber for so long.

[David Spark] I mean, you’re a minority, honestly.

[Jana Moore] Yeah.

[David Spark] Yeah.

[Jana Moore] I mean, I was the only woman for so many years. And it hasn’t happened in these past few years that I am finally on calls where I’m not in the minority now. It’s more 50-50. And so I’m noticing that.

[David Spark] That’s amazing.

[Jana Moore] Oh, it’s amazing. And I always have to kind of laugh to myself. I’m like, “Gosh, look how far we’ve come.” But that just means I’m old. I’ve been here a while. I’ve seen the change, right?

[David Spark] But the fact that that’s happening within a generation.

[Jana Moore] Right.

[David Spark] That’s pretty amazing.

[Jana Moore] It is. And we have to at least recognize that and celebrate that. So, where men can help is that if they don’t see women having the opportunities to socialize the way that they might be socializing with others, then use that as your opportunity to sponsor and bring up those women’s names or minorities’ names in those circles.

Again, now on the other side of it though, I think it goes bidirectionally. I think that women and other minorities, they also have a role to play in this too. So, you can’t have this self-fulfilling, “It’s the old boys’ club and that’s what’s holding me back.” That’s not acceptable either. It’s you’ve got to take responsibility and accountability and own your career as well and get yourself in those places.

So, let’s not use that as the excuse either.

[David Spark] All right, Andy, you were pointing on the point that Janet just mentioned – you can’t blame the old boys’ club. But I also want to reference something that’s in your book, One Percent Leadership, where you talk about don’t fall into the trap of the collective way of how you engage with your colleagues in the more social aspect, like saying, “What did you think of the game last night?” Because not everybody cares about the game last night.

So…

[Andy Ellis] Oh, come on, but the Celtics just won a championship.

[David Spark] By the way, this is being recorded just after the Celtics won. And I’m very thrilled about it because I’m a Bostonian. You live there, but you’re sadly a Lakers fan.

[Andy Ellis] Well, I’m not a Lakers fan anymore. I’m just not a Celtics fan. Boston just got another championship banner, so I’m happy.

[David Spark] There you go. Good. So hold it. Address those two issues. You’re cheering the “don’t blame the old boys’ club,” but also the need to not fall into the trap where people think it’s an old boys’ club because you’re always mentioning the game last night kind of a thing.

[Andy Ellis] Right. So, wow. I’ve got like eight things I want to mention here. I could talk about this topic for three days.

[Jana Moore] Yeah, for sure.

[David Spark] Throw them all out.

[Andy Ellis] So, first of all, if you have not read the WiCyS report, you need to go read it. This is one of the best sourced, best written…

[David Spark] We will have a link to the article.

[Andy Ellis] …best summarized reports on a topic like this. I don’t agree with everything in the report. I think there’s some qualitative stuff that they overweight, but this is way better than everything. And at the very end in page five, it says inclusion is what you do, diversity is what you get.

And if you walk away with nothing but that phrase. The thing I see too many people try to do is say, “I will only hire a woman for this role because I need to improve my gender balance.” Don’t ever do that. You do not get diversity…

[Crosstalk 00:16:19]

[Jana Moore] Please don’t do that.

[Andy Ellis] …papering over inclusion. And in fact, you harm everyone when you do that because everyone knows you did it. You’ve just sabotaged the woman you hired. Even if she’s the best candidate that you’d have had if you’d made it open, you’ve just told everybody you don’t think she’s qualified.

So, please don’t do that. Now, let’s come back to this concept of allies. I’ve always hated the language of allies. And it shows up here. In fact, when you did the read, you said “men being allies to women.” Allyship is a two-way street, and when we talk about stuff like this, we aren’t talking about two ways, so let’s just throw out the ally language.

You should be doing this not because you’re an ally to women, but because it’s the right thing to do.

Just to be very clear, build an inclusive environment because it’s the right thing to do. I don’t care whether you’re a man, a woman, you’re non-binary. I don’t care if you’re white, you’re Black, you’re Jewish, you’re Asian, you just want to do the right thing, and the right thing is to build an inclusive environment.

So, let’s come to ways that you have to think about this. Now, it does happen that there are things that tend to be gender affiliated in an environment, right? If you care about taking care of the parents in your environment, you’re more likely going to be benefiting more women than more men in your organization because that’s just the way American culture is.

Women are more likely to be the parent, even in the workforce, who’s taking care of the kids, getting them to school, etc. Let’s talk about sports, I’ll tell you all the best sports fans I know are women. So, while people do think of it as a boys’ club, here in Boston, nope. You go to a Patriots game, it is probably close to 40% women in the stands now, which is amazing.

But it doesn’t matter.

[David Spark] By the way, this all speaks to not just women and men, but it’s just you’re excluding sports fans via non-sports fans.

[Andy Ellis] Sports fans versus non-sports fans.

[Jana Moore] Yeah.

[Andy Ellis] So, here’s the thing you can walk away with and do. Take a list of all of the co-workers you have. And if you’re a leader, all the ones that you see. Like you walk into the office and there’s 20 people, make a list of the 20 people. Every time you get back to your desk, anybody you talk to, move their name to the bottom of the list, right?

And all of a sudden, you’ll notice there’s people you don’t talk to. And here’s what’s happening. Every time you talk to somebody else, that person feels what gets called a microaggression. It’s not, but they feel that way. It’s a micro exclusion. They didn’t get included, and so they felt excluded.

That’s on them. That’s their perception.

But on you is to create a micro inclusion moment that says, “Oh, I see you. I want to talk to you.” So, if you have somebody who’s like they say the sports ball every time you bring up whatever your thing is, what they’re trying to tell you is, “I would like to have a conversation about something else.” So, figure out what they’re passionate about.

Have those conversations, have those moments, see them as human beings. Because once you see them as human beings, you’ll start to get a lot of emergent behaviors like you’ll respect them as a professional colleague too.

[Jana Moore] Hey, one thing I want to add here that I think is important also as an action for men is that be aware of any of your unconscious bias. And what I mean by that, I know we’ve talked about that term a lot, but what I specifically mean about that is just make sure you’re always challenging yourself to if there’s an opportunity that’s open and someone brings a woman or a minority or someone forward to say, “Hey, this person would be great in there.” Think about what your first reaction is to that.

And if your first reaction is that “Oh, but gosh, they’re too aggressive,” or “Oh, they’re too emotional,” or, oh, they’re too this or, oh, they’re too that. Just really think about that as your first reaction to someone bringing that forward. Because I think that too can be a limiter in terms of inclusion and that men can start to maybe be more aware of.

Because I think we all do it. But since we’re specifically talking about what men can do to further this along, that could be one thing is always pay attention to your initial reaction and then try to check yourself on that. Because women are constantly being told, “You’re too aggressive,” you’re too this, you’re too that.

And that somehow in other people’s minds, that it relates to whether or not they can perform well in the job. And so that’s just what I want to at least mention here as we’re on the topic.

Sponsor – Vanta

20:27.520

[David Spark] Hey, you remember I mentioned Vanta at the beginning of the show? Well, they are a spectacular sponsor of the CISO Series and listen to this. Whether you’re starting or scaling your security program, Vanta helps you automate compliance across frameworks like SOC 2, ISO 27001, and more.

We know those aren’t the only two, there are plenty more. But with Vanta, you can streamline security reviews by automating questionnaires and demonstrating your security posture with a customer-facing trust center. If you don’t have one of those, they’re darn popular, look into it. So, over 7,000 global companies like Atlassian, Flo Health, and Quora, they use Vanta to manage risk and prove their security platform.

Remember I mentioned the trust center? That’s what that darn thing does. So, our listeners get $1,000 off of Vanta at vanta.com/CISO. Now, you just go to vanta.com/CISO, and you’ll be eligible for that discount when you sign up for Vanta. Check them out.

It’s time to play “What’s Worse?”

21:30.674

[David Spark] All right, Jana, I know you know how this game is played.

[Jana Moore] Mm-hmm.

[David Spark] Two horrible scenarios. I make Andy answer first. I always like it when people disagree with Andy.

[Andy Ellis] I don’t.

[David Spark] We will see how that goes. This comes again, because the last show we recorded, we did it from this gentleman, Nir Rothenberg, who’s the CISO over at Rapyd. Here are your two scenarios, Andy. Your boss won’t stop rambling about how AI is so wonderful and sure it’s the silver bullet. All right?

[Andy Ellis] Which is my boss. Will everybody else stop rambling about it? Because this might be a great scenario.

[David Spark] Okay. Or it’s the opposite. Your boss is really cynical and thinks everything about AI is all over hype lies. Which one’s worse?

[Andy Ellis] Oh, the first one. I mean, they’re both wrong. There are strong benefits to AI, but I think that AI… First of all, my biggest annoyance is most people who are hyping up AI are only talking about GenAI, and they are not talking about all the cool things around NLP and machine learning and neural networks and all of the stuff that has been slowly taking root all across our businesses for very long.

[David Spark] Yeah, it’s been percolating for quite some time.

[Andy Ellis] So, the hype is like, “Oh, GenAI will solve everything for us.” And what we basically have learned for most practices to get the benefit of GenAI, it’s a force multiplier on the smart person you already had doing the task. You give them GenAI, and they are better at their task now. But GenAI is not actually replacing.

Like I use GenAI when I’m doing content writing, and I will tell you, I am not worried about my job because I spend a lot of time tuning my prompts, and then doing editing after the fact. But I can produce more content than I could before, especially when I do need to produce things that are a little bit formulaic.

[David Spark] Why they thinking that it’s the silver bullet is worse than them thinking it’s overhyped lies?

[Andy Ellis] Because the people who think it’s overhyped lies are going to be skeptical and are going to push back a bit, and they’re going to say, “Well, maybe…” We’re not going to dive all in and just say, “Oh, everything is AI, fire my whole marketing team because AI will do my marketing.”

[David Spark] No, no, but they’re on the extreme opposite. They are probably staying far away from AI.

[Andy Ellis] Yeah, great.

[David Spark] And then that might turn them into a competitive disadvantage.

[Andy Ellis] Well, you said my boss, you didn’t say the whole company. So, the rest…

[David Spark] No, just saying the boss. The boss is leading the company.

[Andy Ellis] Depends on who you are. I know a lot of bosses whose stuff happens in the shadows, and so that person like.. Let’s say you have a CEO who’s like, “Oh, my God, I hate AI. We should not go all in on AI.” Well, everybody’s going to still use AI, but now they’re going to be very careful about using it safely because nobody wants to be the poster child for, “We used AI and we ended up on the front page of the Wall Street Journal for a bad disclosure,” because the CEO will be like, “Look, I told you so.” So, I can actually use the person who’s negative on this as a way to get better outputs.

The person who’s gung-ho and all in, all safeties will be off.

[David Spark] But again, you know this whole thing, you don’t change their mind.

[Andy Ellis] You’re not supposed to argue with me. Stop trying to convince Jana.

[David Spark] No, you don’t change their mind. All right, Jana, I’m throwing this to you. He thinks the boss who thinks AI is the silver bullet is the worst scenario versus the one that doesn’t. Where do you stand on this one?

[Jana Moore] Yeah, I have to agree. I mean, I would love to disagree because that would be more interesting conversation, for sure.

[David Spark] But do you agree for the same reasons? Sometimes we have people agreeing for completely different reasons.

[Jana Moore] So, I agree because I think that the one who’s just all in on AI all the time, they’re not actually using any sort of critical thinking to understand what is the real business value in doing it. And that my immediate fear goes to, “Okay, this is going to completely distract our organization.

It’s going to completely put my team on its heels. We are not prepared for this. There is no strategy whatsoever going into this.” It’s just whatever they just read in the… It’s the hype cycle, right? They see their peers doing it, so they don’t want to be left behind by their peers. It’s peer pressure is what it is in that scenario.

So for me, that’s worse. It is.

[David Spark] Hold it. I’m getting with both of you. I’m weighing the one who’s so cynical because my feeling is if they’re so cynical and think it’s all lies, they don’t want to touch it with a 10-foot pole. And doesn’t that put them in a competitive advantage in the business of the competitive advantage, Jana?

[Jana Moore] No, no. The cynical one to me, that’s just that to me is a challenge. That’s the person I need to influence, I mean, and actually have it work in a…

[David Spark] But that doesn’t change. Just in this game, they’re always going to think that. There’s nothing you can do.

[Jana Moore] Yeah. There’s nothing I can do.

[Andy Ellis] The real answer is there is no first mover advantage. There’s second mover advantage. And so if it’s so bad it’s harming us, we can be second movers when we fire the boss later.

[Jana Moore] Right.

[David Spark] Well, again, that changes the scenario. All right. You’re both in agreement, but I don’t agree with the way you want to change the scenarios here.

[Andy Ellis] You’re just mad because one more episode on the Andy side of the thing.

[David Spark] No, I’m going to call this one a challenge.

[Jana Moore] Throw a flag.

[David Spark] You’re trying to mess with the scenario too much, is what I think it is. Not accepting the fact that you’ve got the world’s most rigid boss that’s going one way or the other.

[Andy Ellis] No, no because the scenario was not, “And therefore nobody in the company will ever use AI.” Nir did not specify that, nor did he specify on the other hand that… Because the flip side of that would be they’re so gung-ho, every project has to be AI.

[David Spark] So, we’re going to blame Nir now? No, I think Nir’s doing a great job.

[Andy Ellis] Nir does a great job, but he made… This one I think was balanced.

[David Spark] Nir did a great job, period. Don’t add all the “but” because A, he’s not going to send us more scenarios, we won’t like his scenarios, and this one was good. You’re the ones who didn’t adhere to it. I’m castigating the two of you.

[Jana Moore] Rulebreakers. [Laughter]

You couldn’t have done better than that?

27:36.058

[David Spark] What’s the current state of cyber intelligence programs? In a LinkedIn post, Michael Way of Casey’s General Stores created a very nice outline from understanding your environment, to setting it up, to implementing. We’ve asked this question before about what’s most difficult with a cyber intelligence program.

We found that there’s pretty much equal weight on everything. So, that means it’s all difficult, or it’s all easy. I’m guessing it’s not all easy. It’s not all easy. But what’s getting easier? That’s my question. And I’ll start with you, Jana, and what’s getting more difficult for a cyber threat intelligence program?

And is AI, call back to our “What’s Worse?” Is it helping with any of that?

[Jana Moore] Hmm. Yeah, I think over the years, this has always been an area that’s kind of that ambiguous kind of do you outsource it? Do you automate it? How much time do you spend trying to curate your own? What memberships do you have? Communities? And how reliable and how valuable is the intelligence you’re getting from those?

So, for me, it’s kind of this ecosystem that you build around intelligence, and you have to be comfortable with some of it is so commodity based, that it’s just the must-haves that just automatically feed in. And that’s where I think AI can start to help a little bit more with helping you understand your environment a little bit quicker than having to just send your intelligence feed in and pray that it’s alerting you to the proper areas in your network that you have to respond to.

But I think what we have to do a better job of with AI is the way that we interrogate or prompt our GenAI these days, we should be doing more of that interrogation and prompting of our own data, especially in cyber. And so what drives me crazy is that I don’t have an easy way to ask questions to my data.

It’s all based on whatever the vendor language is for that particular platform that I’m using. And so I think that where AI can assist us is giving us the ability to ask those questions of our data in a way that is more conversational and can guide your threat hunting a little bit more interestingly.

I just think that there’s a different way we can be doing it rather than buy a feed, send it in, pray you get your alerts, join your communities, curate your threat intelligence, then you feed it in.

It’s just kind of this clunky way of how we’ve been managing intelligence over all these years. And I don’t want to put all of it onto my vendors or partners, and I don’t want all of it to be on me either. And so I think where we need to do some improvements is around that interrogation of our data and being able to actually understand kind of where the threats lie and kind of mapping that back to attack surfaces and our posture and what’s important, your crown jewels, and all of those things.

[David Spark] All right, Andy, your take. What are we actually doing well at? Jana thinks we unfortunately have a clunky system. And I think you outlined it pretty darn well, Jana.

[Andy Ellis] Yeah, I don’t know how much I could add here, so I’ll take a different angle on this, which is I think this is a product space in search of a market space rather than an actual need most companies understand and have. The way I look at it…

[David Spark] That’s a really good way of putting it too, yeah.

[Andy Ellis] You should start by saying, “I have an environment with a problem that is urgent.” What is the environment that you’re trying to deal with here? Now, when you’re building defensive security technologies, which we did at Akamai, absolutely. We had a cyber threat intelligence program that was out trying to figure out how adversaries were changing so we could develop defenses and resell them.

That was expensive. We would find really niche, weird corner cases, but it might help four customers out of our many thousands of customers, so it was worthwhile for us to do. But if you were one of those customers, that would have been wasted energy for you because 99% of you would have discovered this, done the research and been like, “Oh, nothing I can do with it.” So, you really have to have an agile defensive posture where you can adapt to intelligence that comes in.

And then you can think about how do I get better and faster intelligence and make it more actionable. But if all you’re doing is saying, “Oh, I just need TTPs pushed at me and magically I will do something with it,” I think you’re barking up the wrong tree.

Sit down everybody, it’s cyber security circle time

32:01.681

[David Spark] We often talk about the InfoSec as a community. So, how can you best use it as a resource to advance your career? One of the biggest steps to start with is just showing up to be part of it. Don’t only start going to events and organizations when you want something. We’ve heard the classic line of when you need a network is before you need a network.

So, Phil Venables has a great article on further steps like consciously developing a short list of things to invest time in, such as a specific organization, and then eventually start to lead initiatives. Beyond looking for your next role, Andy, what are the ways you can benefit from being part of a community beyond just showing up?

[Andy Ellis] So, I think that when you look at a community, if it doesn’t have a mission… First of all, error if you run a community and you don’t have a mission for it, you should define what you think the mission of that community is. And then what is your mission in being part of the community?

And if you say, “Well, my mission is to have people want to hire me,” you should say, “Well, what am I doing that causes that to be true?” Like, okay, I’m there. Well, if you’re in a security-focused community and you are a GRC manager who wants to be promoted to CISO, first of all, a huge set of steps there, but you should say like, “What are the next three jobs?

What do I need to be learning? How do I demonstrate that I learn actively? How do I show that I’m training other people?” Because you want to be a GRC manager, so you want to be a director of compliance, you need to start behaving like a director of compliance in that space so that somebody says, “Oh, you’re like 50% of the way to director of compliance.

I’ll take a stab with you because I know you can do the job.”

All too often what happens is people say, “I’m looking, hire me.” And I’ve had this where I’ve been in communities where I’ll get a recruiter reach out to me for a CISO gig, and I’m not interested in it, but it was an interesting one in one of the Fortune 100s. And I referred it into a group of CISOs with, “Is anybody interested, wants a connection?” And I’ll have some random person who’s never been a CISO and is two steps away saying, “Oh, can you refer me?” And I’m like referrals mean something, so you have to demonstrate that you’re ready for that.

And a Fortune 100 CISO gig, if you’re not already a CISO, you’re probably not getting referred for that.

[David Spark] All right, Jana, close this out for us. What communities have you been a part of and have you sort of made conscious efforts in those and have they paid off?

[Jana Moore] Yeah. I think for me, communities are really important for establishing the relationship first before you need it. So, you don’t just show up when you need it, like you said earlier. So, I think for me, it’s always been, whether it’s IT or security, going to those community events, whether they’re having speakers or panels or whatever the event is, it’s a mixer, it’s a whatever, pizza, I don’t know what it is.

But then you listen to a vendor speak, but you’re going to get to know your peers around the community. You’re also going to get to know some of the leaders who are attending those events. And you can strike up a relationship with them first so that they have you in their mind. They know of you. They know what you’ve been doing, what you’re working on.

And that way, you can start to develop kind of that “in,” if you will, once opportunities come around.

So, for example, I’m an actual co-founder and on the board of an organization called Empower Women of InfoSec, and we serve the Midwest right now. And I can tell you the group of people, the hundreds of people who come together at our… We have an annual event. It’s a gala event every fall. And the hundreds of people who come to this, it’s a big fundraiser.

It’s all levels in cybersecurity. And it’s not just women. And so we have people who bring their families and etc., so it’s a great way to meet others, get to know them on a personal level, and then start to develop kind of what would that look like. Maybe there’s a mentoring opportunity that comes out of that.

And if they do have an opportunity that comes up in the future, they’re going to be more apt to think of you than anyone else. So, I think for me, it’s just about the developing the relationship before you need it, but also participating and being involved in the community and your face is being seen.

[David Spark] Very good point. And by the way, if anyone lives in the San Diego area, I run a community out there called the San Diego Cyber Group. And we love people from all levels, like you described, that do show up, people who haven’t even joined the cybersecurity industry or looking to join, even think just thinking about it.

We welcome them and they show up as well. But we also have plenty of CISOs as well. I’m speaking to potential sponsors of future events as well.

Closing

36:36.604

[David Spark] All right, that brings us to the very end of our discussion. Jana, I’m so glad this happened. You were absolutely awesome. I’m going to let you have the very last word. But first, I do want to mention our spectacular sponsor, and that is Vanta. Your security and compliance verified. Remember, go to their website, vanta.com/CISO, and you’ll be eligible for $1,000 off on your first order with Vanta.

Andy, as always, you were fantastic. I know you were about to jump on a plane and get out of Dodge.

[Andy Ellis] Although I just got notification, my plane’s delayed half an hour, so I’m in slightly less of a rush.

[David Spark] Oh, [Laughter] there you go. Well, you have to show up three hours before the flight. I know that.

[Andy Ellis] Yeah.

[David Spark] The whole security process. Anyways. Jana, any last words?

[Jana Moore] Yeah, thanks for having me on. I was really looking forward to this happening. I mean, the topics for me are relevant. I think there’s so much more we could have said on these topics. But I do appreciate giving me the opportunity to have some time on here and share my thoughts. I do think that we have made some great progress in cybersecurity on many fronts.

And I think it’s important to remember that this is a greater community that you speak to. You’re a podcast series. And so we’re all in this together. So, if anyone wants to connect, happy to, and provide that moral support through our journey of cybersecurity.

[David Spark] Very good. Thank you again. Thank you to our audience. We greatly appreciate your contributions and for listening to the CISO Series Podcast.

[Voiceover] That wraps up another episode. If you haven’t subscribed to the podcast, please do. We have lots more shows on our website, CISOseries.com. Please join us on Fridays for our live shows – Super Cyber Friday, our virtual meetup, and Cybersecurity Headlines Week in Review. This show thrives on your input.

Go to the Participate menu on our site for plenty of ways to get involved, including recording a question or a comment for the show. If you’re interested in sponsoring the podcast, contact David Spark directly at David@CISOseries.com. Thank you for listening to the CISO Series Podcast.