Most organizations have a basic understanding of their crown jewels. Dig a level deeper, and it becomes a different story. Where are they? What’s their value? Where are they traveling? Who has access to them? Who shouldn’t have access to them? How will the cybersecurity team partner with the business to protect those assets?

This week’s episode is hosted by me, David Spark (@dspark), producer of CISO Series and Andy Ellis (@csoandy), partner, YL Ventures. Joining us is Tim Jacobs, vp, CISO, Commonwealth Care Alliance.

Got feedback? Join the conversation on LinkedIn.

Huge thanks to our sponsor, ThreatLocker

Full Transcript

Intro

0:00.000

[Voiceover] Best advice for a CISO, go!

[Tim Jacobs] Find out what matters to the business. Make that your priority. Deliver that to support the business, and your program will flourish.

[Voiceover] It’s time to begin the CISO Series Podcast.

[David Spark] Welcome to the CISO Series Podcast. My name is David Spark. I am the producer of the CISO Series. My guest for this episode, you know him, it’s none other than Andy Ellis. He’s the partner over at YL Ventures. Say hello, Andy, to our audience.

[Andy Ellis] Good morning, folks. Or depending on when you are in the world, good afternoon, good evening, or good night.

[David Spark] I’m going to ask our audience, does anyone care about Andy’s opening?

[Andy Ellis] And if nobody cares, I’m going to keep doing it this way. You have to care if you want me to change. David clearly cares.

[David Spark] I don’t know, Andy. You’re pushing it. Our sponsor for today’s episode is ThreatLocker. Zero trust environment for you. We’ll be talking a lot more about that later in the show. But, Andy, the day this drops may be the day that you’re moving. I just want to ask, what have you learned from all your previous moves of what to do and what not to do?

[Andy Ellis] So, here’s what’s not to do, and I’m discovering it now. Because we have to prep our current house to be shown. It’s going on the market two days after we record this. And we are finding things that we moved here, stuffed them into a corner like inside a shelf with other things…

[David Spark] And never touched it.

[Andy Ellis] And never touched it. And in fact, I just found a thing that we’ve been doing that for 30 years.

[David Spark] Time to get rid of it.

[Andy Ellis] Time to get rid of it. But here’s what we’re doing in the new house. We are going to have zone that we are calling purge, and we’re putting a date on it, one year after we move in. If anything is still there, it goes.

[David Spark] We have stuff in our garage from a box that has not been open from a move we did close to four years ago.

[Andy Ellis] There’s memorabilia and things that you will keep for a long time. Like we have pictures and art our kids did when they were kids. And like once a decade, we’ll open that.

[David Spark] Hold on, why are you holding onto that?

[Andy Ellis] Because once a decade it’s fun to open it up, look through it, and then pack it back up again. It’s memories.

[David Spark] Eh, that’s true. All right. Well, the purge… By the way, I usually…around December time, we do heavy purges.

[Andy Ellis] Right. But I have an X10 control system. Like literally, my family owned an inn 30 odd years ago. We have the X10 control system for controlling all of the candles that we put into lights in the windows.

[David Spark] I found out through Ancestry.com because my sister did research that I have ancestors who owned two hotels in Harlem actually.

[Andy Ellis] Wow.

[David Spark] Yeah, pretty cool. And we say if you have not delved into Ancestry.com or a member of your family does…you really only need one family member.

[Andy Ellis] Well, I have the book.

[David Spark] You made the book?

[Andy Ellis] On my father’s side of the house, we’ve traced lineage over a thousand years.

[David Spark] Holy moly.

[Andy Ellis] And so we have a book. There’s three different stages of the book. There’s the one in England. There’s the one for Canada. And then there’s the one for the US folks since coming here from Canada.

[David Spark] And you don’t quote that one nearly as your “1% Leadership” book.

[Andy Ellis] It’s kind of boring. It’s just literally a list of names and a lot of list of deaths.

[David Spark] Well, yeah, that’s usually what it is. [Laughs]

[Andy Ellis] A lot of kids died very, very young not that long ago.

[David Spark] All right. Let’s jump into this. I want to bring our guest on. He’s been very, very patient. I’m so, so thrilled that he’s on board. It is the CISO for the Commonwealth Care Alliance, none other than Tim Jacobs. Tim, thank you so much for joining us.

[Tim Jacobs] Hi. Good to be here. Thanks for having me.

There’s got to be a better way to handle this.

3:35.419

[David Spark] How do you start having a conversation about security when your organization is starting from rock bottom? That came up in a recent cyber security subreddit thread where someone working in a large dental service organization asked, “How screwed is my company when all they use is Windows Defender and a shared login for everyone to access cloud based system records.” Now, commenters suggested showing leadership a list of HIPAA fines. I thought this was wise. And that the largest fines are reserved for authorized users abusing access. Others suggested appealing to the legal team, which there may not be one, and offering to assist in putting controls in place to support policy. So, Andy, answer this poster’s question. How screwed is his company, and where would you start to improve a situation like this?

[Andy Ellis] So, one of the things that I do like about this scenario is there is nothing wrong to undo. Except potentially that shared password. But even that is better than what a lot of companies have with there’s a bazillion different passwords, and they’re all written down, and they’re hard coded in a lot of places. You actually have a fertile field. I would say trying to bring up HIPAA fines and put that in front of your business is probably not gonna make you any friends. It’s sort of the classic career limiting move.

[David Spark] Well, but, no, hold on. But just saying, “Look, you guys don’t want this. Nobody wants this.” It’s not to…

[Andy Ellis] It comes across as a threat.

[David Spark] Well, I think you could do it in a way that’s not a threat.

[Andy Ellis] If you’re a security person, and you walk in, and you said, “If HHS found out what we were doing, this would be our fines,” what every executive will hear is, “And I am going to go blow the whistle if you don’t do what I say.”

[David Spark] I think there’s a way… This is actually a question I have for the audience. What’s the way to bring up something scary that doesn’t come off as a threat or FUD?

[Andy Ellis] So, what I would do is… First of all, it depends what your role is in the company. I don’t know if this is the CISO, if this is some random IT person, who this is. But obviously you have to sort of figure out who you’re going to appeal to. And honestly, bringing in an outside authority is often much better. So, I would look at engaging with a managed service provider, probably somebody who focuses in the Microsoft world because it sounds like you’re an entirely Microsoft shop. And basically you can get some pretty quick and dirty services that are just, “Hey, let’s assume we had a breach. What would you recommend? I just want the template so we’ve got something to start from so that I can go and take that to my organization.” Especially because they’ll probably need an MSP to go implement all of the security and architectural changes you’re going to need. So, they might just look at it as a way to sort of get in good with you.

[David Spark] All right, I’m throwing this to you, Tim. Tim, you work in healthcare. And I’m sure you’ve seen small medical offices, hospitals that are just a little behind and not up to par. What do you do to not scare the bejeezus out of them for something that could be as egregious as this?

[Tim Jacobs] Well, I think the HIPAA fines are interesting, but… And this would scare the bejeezus out of them. But just going and unplugging the computer and saying, “Okay, do your job.” You’re basically operating in an environment where the likelihood of a ransomware attack to completely cripple your ability to do business is very high. You need to take actions to defend against that because that breaks your business. The fine aspect of it is part of it, but people always assume that’s for the really bad, egregious actors and don’t really think about what happens if I can’t do work.

[David Spark] But isn’t the whole point of the HIPAA thing is to show even before… The ransomware is an if. The HIPAA thing could be, “Oh, this is definitely happening.”

[Tim Jacobs] Correct. But the HIPAA thing is you’re operating in an environment that’s… You’re not doing due care to make sure those sort of things happen. And likely in that environment, you haven’t thought of you don’t have cyber liability insurance. You don’t have that sort of get out of jail, “Somebody is going to come and help me out,” switch either. You’re operating in an environment where if something breaks, it’s going to be very detrimental to the business.

[David Spark] So, do they respond well to the unplug the computers., “Now run a business,” kind of response.

[Tim Jacobs] It depends on who you’re talking to.

[David Spark] My feeling is this is two crappy ways to deal with it on two different sides of the coin. Unplugging the computer, “Run your business,” versus… Which sounds like it’s a metaphorical thing you do. Or scaring them about HIPAA things. You’ve got to start with one. Which one do you start with, Andy?

[Andy Ellis] Go get advice from a peer executive in the company. Go find somebody who is successful and respected in the business and ask them this question. Say, “Look, I think what we’re doing is unconscionable. Maybe I’m wrong. Convince me I might be wrong. Or give me some advice on how we should broach this topic because I don’t want to walk in and say we have to spend a billion dollars fixing security, because nobody will want to do it. What’s the way in this organization that successfully gets things done?” And honestly, ask every peer executive who gets to weigh in on the decision so that each of them feels like your trusted confidant who’s going to support the proposal that ends up coming forward.

[David Spark] All right, close this one out, Tim. Agree with this?

[Tim Jacobs] I think that makes sense. You’re crowdsourcing to get disparate views, gain consensus, and ultimately force a business decision in terms of in this case, “This is the options that we have available to us. Let’s make a decision, and we can manage risk based off of that.”

Attention CISOs! Your expert opinion is needed.

9:02.879

[David Spark] “Successful crisis management does not begin when the crises hits.” Yes. “It begins well before any incident occurs.” I think we can all agree with that. So, planning a robust policy framework and security culture built on readiness are key to crises management. But as Andrew Aken of DocDrew pointed out, “Leaders need to have some key traits to take advantage of all these tools when the crises is happening. These include a proactive vision, adaptability, empathy, and accountability.” But the one that stood out to me is decisiveness. This is just what I want to focus on right here, Tim. That one seems the hardest to define as a timely decision by one CISO can be seen as rash or arbitrary. So, I’m interested to know… And hopefully we can kind of walk through this. In the heat of the moment, what questions do you ask yourself before making a critical decision? Because you have to make series of them. What do you ask yourself?

[Tim Jacobs] I first start by asking myself, “What is known versus unknown? Do we have the right people working on the right issue?” And then, “Are the right people communicating with each other as information unfolds so that we can have an affective response and not just end up all sitting on a conference call trying to figure out what’s going on while the situation is getting worse?” So, what practical information do I have, and you would have had to have practiced that in advance, have prepared for this in advance. That helps to make it easier for other people to be decisive, to know what their roles are, and to help recover.

[David Spark] And what I’m hearing here… And correct me if I’m wrong. You’re very focused on the continuous communications and the people working on it and also information known and unknown that even if you do make a decision and all of a sudden information comes in and points out, “Oh, no, that’s a wrong decision,” the fact that the communication channels were open, you could potentially shift. I’m assuming that’s the point of this. Yes?

[Tim Jacobs] Correct. And it’s also defining in advance ideally, “This is when we’re going to give you the updates,” so that the teams who can help respond from a technical perspective, a communications perspective, a legal perspective have time to go and do work as opposed to everybody just getting in and trying to figure out on the fly. So, being able to make good decisions as the information comes in and changes.

[David Spark] That’s a really good setup. All right, Andy, what would you add to that? Because I very much like Tim’s answer here.

[Andy Ellis] Yeah. No, I love the answer. A key piece I’d add is that you have to understand the cost of your decisions. When I was at Akamai, we often discussed this as like what size credit card do you have, and your credit card is measured in incidents. So, if you’re in a severity one incident, the highest level, your credit card has severity two incidents on it. You can go create severity two incidents to fix the severity one incident. That’s okay. You can’t go create another severity one incident willy nilly because you’re just moving laterally. So, once you start understanding the cost… Like, “Yeah, I’m going to go create a severity three incident. I’m getting out of a severity one incident. And if it costs me 37 sev threes, that’s okay. We’ll go clean that up later.” But by examining the cost, it also lets you say what are the bad outcomes that could happen. Because what you do want to look for is not just the good… Like, “Oh, yes, we fixed this.” “Oh, we broke something. We didn’t make anything better. Let’s fix what we broke.” When Tim talked about the communications, that’s important. But you have to sort of say… It’s like taking a medicine. Some medicines have bad side effects. You want to know what the bad side effects might be so that you can look for them. Because remember, you’re not in a static system. You might have other bad side effects showing up from other incidents, so you need to know which ones to pay attention to and which ones don’t really matter.

[David Spark] Now, my next question for you, Tim, is… And this is something that wouldn’t wait until the actual incident, but how do you make it clear to your team that you have thought it out in the way you’ve described it to me here?

[Tim Jacobs] Sure. So, first thing is to have a breach response plan defined with the right people, decision making authority, responsibilities in advance. Practice it routinely at an executive level. At minimum once a year. Your IT teams practice it more frequently from a technical perspective. But a key part of that is also asking the question, “If what we identify to be the risk is so significant that we need to sever connectivity from the company to the internet, does the leadership understand what that will mean if we need to take those actions to save the business?” So, instead… You could run into a situation where the livelihood of the company is at stake if you fail to make a good decision quickly or to make the right decision quickly. People are often a little bit more risk averse if it says, “Well, wait, we can’t ship to customers. We can’t service patients.” This is where business continuity comes into it. And making sure that the key decision makers understand that in advance and can account for that if we do have to go offline gives you license to say, “Listen, trust me. I’ll let you know when it’s time to break glass, and I’ll give you the information to make that decision, but we can’t sit there and debate it for six hours.”

Sponsor – ThreatLocker

14:33.860

[David Spark] I’ve got big news in cyber security. ThreatLocker just dropped a powerhouse of new solutions and enhancements, making their zero trust endpoint protection even more seamless, even easier to manage, and even faster to deploy. First, the new ThreatLocker insights taps into millions of data points globally, giving you real time intel to make smart security decisions fast. And let’s talk patching. Instead of spending time researching and deciding on every pending patch, ThreatLocker Patch Management handles the what, when, and how for you. Cloud control shields your Windows 365 tenant from phishing attacks and token theft. Two of the biggest Microsoft 365 security gaps. Then there is the new user store. Users get instant access to preapproved applications. No waiting for approvals, easy for IT, seamless for users. And those pesky websites no one should access through your business network, ThreatLocker Web Control lets you block them with an agile pre-categorized database. No extra integrations, just seamless protection. Now, what hasn’t changed? Well, the gold standard US based cyber hero support team answering calls in about 60 seconds, 24/7 with unlimited support. That’s service you can count on. Over 50,000 companies worldwide choose ThreatLocker. For more, visit their website. It’s threatlocker.com. Go there to learn more about their suite of zero trust solutions.

It’s time to play, “What’s worse?”

16:12.547

[David Spark] All right, Tim, are you familiar with this game?

[Tim Jacobs] I am.

[David Spark] All right. Two crappy scenarios. You got to pick one that you think… I think this one is balanced, Andy. This is what I say. I think it is.

[Andy Ellis] That’s like a red flag. That’s like the death flag in an MMO when you’re like, “I think we’re prepared.”

[David Spark] All right. Well, these are both bad. It comes from Neil Saltman of AHEAD. He’s given us…

[Andy Ellis] Okay, it came from Neil, then it’s going to be at least entertaining.

[David Spark] Well, this one is kind of straight up.

[Andy Ellis] Okay.

[David Spark] All right? He’s always given us lots of good, “What’s worse,” scenarios. Here we go. By the way, Tim, I always make Andy answer first, and you can agree or disagree with him. My hope is you’ll disagree.

[Andy Ellis] You should always agree with me.

[David Spark] Don’t listen to him. All right. Which one is worse for a zero trust architecture? This is what Neil asks. Which one is worse, is it weak authentication methods or a poorly deployed segmentation with way too many policy exceptions being allowed? Andy?

[Andy Ellis] Oh, this one is easy. Sorry. First one.

[David Spark] I thought you would lean on that one.

[Andy Ellis] Root of zero trust is identity.

[David Spark] Yes.

[Andy Ellis] If you don’t have identity, you don’t have zero trust. I know everyone wants to put micro segmentation into the zero trust framework. I will say that there are basically three different parents of zero trust. There’s the one everybody knows, which is, David, tell me.

[David Spark] The parents of zero trust?

[Andy Ellis] Who gets called the father of zero trust?

[David Spark] Are we talking about Chase Cunningham.

[Andy Ellis] Yeah, Chase.

[David Spark] Chase Cunningham. Who I ran into at ThreatLocker’s Zero Trust World Conference. He was there.

[Andy Ellis] Right. Right. So, you’ve got that.

[David Spark] He gave a great presentation, by the way.

[Andy Ellis] But you also… Most importantly, the true parent of zero trust is Heather Atkins at Google. It’s Heather who broke the Operation Aurora and who basically is the architect behind Google Beyond Corp. And it’s me, who’s the architect of Akamai’s Zero Trust, which actually came to market as the first commercial one. And I will tell you micro segmentation is the least important thing in zero trust. Identity over everything. Because you don’t need micro segmentation if you actually do identity based verification of every single connection. You functionally get at level micro segmentation. You don’t need to do it in the network. So, not having a micro segmentation that works… It’s okay as long as you can connect the things, which it sounds like you can. Great if you have identity. If you don’t have identity, I don’t care how good you’ve done your micro segmentation.

[David Spark] It’s not no identity, it’s just weak identity and weak authentication.

[Andy Ellis] Weak identity is functionally no identity.

[David Spark] Okay.[Laughs] All right. Andy thinks this is easy, and he’s leaning on the weak authentication model.

[Andy Ellis] I’m leaning on my own expertise. I’m literally giving a talk on where zero trust went wrong.

[David Spark] Yeah, well…

[Andy Ellis] Or I already did [Inaudible 00:19:04] I just did one a month ago.

[David Spark] Tim, as I understand, is going the rebuttal to your talk. Correct, Tim?

[Tim Jacobs] I would love to do point, counter point, and rebut this just viciously. I can’t. I got to agree with Andy on this one. I’m sorry.

[Andy Ellis] My favorite thing is how many of our guests say, “I would love to disagree with Andy, but I just can’t.”

[David Spark] They want to. Well, the thing is I had the feeling that you would go with the weak authentication models, but I was hoping this poorly deployed segmentation with too many policy exceptions could kind of lean itself too much. But it’s not leaning enough.

[Andy Ellis] No. I don’t need segmentation at all in my zero trust planning.

[David Spark] So, okay, Tim, you agree. Why do you agree with Andy here?

[Tim Jacobs] Authentication is key. We’re talking zero trust. If you don’t have that… If it’s just a matter of poorly designed segmentation then certainly people can go into…can traverse in areas that they shouldn’t. But if they shouldn’t have access in the first place… The blast radius is more contained there. But if you don’t authenticate properly up front, you’ve sort of missed the whole point.

[Andy Ellis] And just to be clear, if I’ve got a micro segmentation advocate or vendor listing, this is not me saying micro segmentation isn’t important, but it is not part of zero trust. It’s also a different problem, which is you have environments that cannot do zero trust because they cannot do identity based authentication. Think like hospitals, since we have Tim here. I suspect he doesn’t want to talk about the fact that he’s got a lot of equipment that is basically limping around on ancient versions of Microsoft that we won’t even mention what they’re running because that’s all that is supported by the vendor of some healthcare IOT that is making a fortune for a hospital. And all you can do is micro segment that to keep everything else away from it.

[Tim Jacobs] As long as we feed the gerbil that’s running in the back of the computer to keep the operating system going, everything is good.

[Andy Ellis] Yeah.

[David Spark] I think… Doesn’t a gerbil have a longer life spans than a Microsoft operating system?

[Andy Ellis] You would be really surprised at how ancient some of the early Microsoft operating systems now are, and they’re still running.

[David Spark] Oh, I know. I’ve talked to a lot of people in healthcare. It’s creepy, scary.

[Andy Ellis] Yeah.

[David Spark] Yeah.

[Andy Ellis] I think I will…after this move, I will not have any boxes older than some of Tim’s Microsoft deployments. But I cannot say that is true right now.

[Tim Jacobs] That’s an admirable goal.

[David Spark] By the way, Tim is wisely staying silent here.

Let’s look under the hood.

21:32.066

[David Spark] Affective threat modeling requires an accurate understanding of asset value. That seems obvious. But what framework are organizations using to value their assets? This might be easier for your most valuable assets. We call them crown jewels for a reason. But outside of that, how much clarity do we actually have into asset value within our threat surface. So, Derek Fisher, who’s the director of cyber defense and information assurance program at Temple University, pointed to various asset valuation approaches. Current market value, replacement costs, or by the revenue generated over time. And I’m going to start with you, Tim, but are we missing an opportunity with our security controls if we don’t have a clear idea of asset value? Because this goes into the whole crown jewels thing. But just saying, I guess we’re defining the value in different ways here. And, Tim, do you go this far to determine it?

[Tim Jacobs] Again, I wouldn’t focus too much of the value of the physical asset itself. It’s more the role of the asset in processing critical data that supports the company. That’s key in how it’s configured, how it’s connected. But the relative cost of the asset itself is important but not as key.

[David Spark] Okay. So, where does that importance lie? I mean my feeling is… First, let’s start with this. How difficult is it just to find the crown jewels? Let’s start with that.

[Tim Jacobs] It’s difficult. It’s iterative based on talking to your business stakeholders. It is just as difficult to be able to do a good updated mapping of where the data flows throughout your environment. There’s a new proposal for a revision to the HIPAA rule if it goes into effect this month that’s going to require that organizations have a clear understanding of where data flows throughout their environment. That they did a risk assessment and valuation based off of that. That’s a lot easier said than done.

[David Spark] But it’s also very hard for people to describe what they are. Andy, I’m going to throw this to you. You don’t just say, “Hey, what are your crown jewels?” And they go, “Oh, here they are,” and hand you a spreadsheet. It never works like that.

[Andy Ellis] Asset valuation is an output of risk modeling, not an input. This is where I think almost everybody gets it wrong.

[David Spark] Okay.

[Andy Ellis] You don’t know what your assets are actually worth until you have done risk modeling. And great risk modeling does not talk about asset value except in the case of liquid assets. Yes, if you’re a bank and you have a stockpile of money or you’re Fort Knox and maybe you do or don’t have gold, that’s an asset that you can easily say, “Oh, well, it has a fixed value irrespective of me.” It’s sort of intrinsic from an economic perspective. That, you can value. Everything else has no value, and so you do risk modeling. I’m a huge fan of Levinson’s work. Everybody who listens has heard me mention Nancy’s name at least a dozen times by now. You do not talk about asset value. You talk about unacceptable losses to the business. And I’m going to put Tim on the spot here. Sorry, Tim. But I’ve done this to the airline folks. What is the worst thing that can happen to your business? What’s the worst incident you’ve got?

[Tim Jacobs] The worst incident is that we can’t deliver care to our patients, and people could die or suffer very serious health outcomes. Yes.

[Andy Ellis] Right? Right there. He’s got human life. Someone dying is the worst thing. Tim, what is the value of a patient’s life to you?

[Tim Jacobs] [Laughs]

[Andy Ellis] Right. The laugh is the right answer. It has no value. You don’t value it. You don’t put a price tag on it. You just say, “This is the unacceptable loss, if someone dies on my watch.” They’re not an asset. I don’t put them on my balance sheet. That’s my unacceptable loss, and I work backwards from it. Now, out of that, you’ll discover that you have critical systems that if this system is not available I can’t deliver care to a patient, and I increase the possibility of someone dying. Now you understand that that’s a valuable asset. That’s why I say asset valuation is an output of the risk model, not an input to it.

[David Spark] So, this can’t be used at all, are you saying?

[Andy Ellis] I have never seen anybody who started from a, “Let me value all of my assets and then do risk modeling,” end up with a usable risk model. I’m sure there’s somebody who’s done it. I’ve just never seen it.

[David Spark] No, but these are reasonable questions, like, “What does this data make for the business?”

[Andy Ellis] But you’re coming at it backwards. What you’re really doing is saying, “What is the unacceptable loss to my business? Oh, I lose a product line. Okay. Well, if I lose the product line that tells me that product was valuable. So, what is involved in doing it?” That’s what I say, you work backwards from the business impact of losses, not forwards from the asset. Because you will also find assets you didn’t know about when you work backwards? You say, “This is what I deliver. I delivered this form of patient care.” And now I start working backwards. “Well, what’s involved in delivering patient care? What systems do we rely on?” At each stage, people who are embedded in that can tell you, “Oh, I need these seven things.” Like a nurse will tell you, “These are the critical systems to me.” But if you started from listing your critical systems, you might only get six of those seven. Work yourself backwards from the business.

[David Spark] All right.

[Tim Jacobs] And those outputs certainly help as you do threat modeling on a continued basis going forward and can be used by the business for other purposes. But agree, it’s not necessarily the start.

Managing security changes for business optimization.

26:59.835

[David Spark] “One of the often overlooked and underappreciated benefits of a security focus within an organization is that because security is by nature an in the weeds discipline, attention paid in this area invariably uncovers other unrelated benefits.” All right. The security vs convenience spectrum is often cited for cybersecurity that its taken as a given. But while security enhancements may add overhead, they can also uncover valuable things you might not otherwise find. This was pointed out by Rob Black of Fractional CISO. He points out internal audits can reduce license fees for departed users, code reviews that can improve functional, not just security problems, and vendor reviews that can show where you can consolidate services between departments. All right, I’ll start with you, Andy. Are there any other outright business improvements you’ve seen from added security measures? Aside from keep the business open in the first place.

[Andy Ellis] Oh, absolutely. And it’s usually getting rid of assets that are unused.

[David Spark] Yeah, well, that’ll lower your risk.

[Andy Ellis] Because most of the business is kind of afraid to. They’re like, “Uh…” And then they just move on. Actually I remember at Akamai, we had networks tied to services. The first time a network was actually deprovisioned completely all the way so it’s no longer referred to in any system was actually done by somebody on my security team, because she just sort of ran into this like, “We have 14 machines left in the network because everybody is afraid to turn them off.” But had mapped the safety of what it took to turn off a network and so just went and did it. That was really cool that I had somebody who actually would engage in doing that. I see places in the cloud where people do cost optimization because they discover there’s a whole bunch of assets that just aren’t in use. “Oh, let’s get rid of those rather than trying to secure them,” is certainly a great approach. So, to me, I see this all the time in just reducing your overhead and your cost by finding things that are easier to deprovision than to secure.

[David Spark] Tim, what have you seen from your security that’s helped in other places?

[Tim Jacobs] So, one area would be business email compromise. So, through shining a light on the way that the company operates through being able to identify potential phishing incidents, you can identify things like do we have employees who are communicating back and forth with an adversary in our accounts payable department. Are they transferring money? The typical wire fraud transfer that you don’t think is ever going to happen, sometimes your security program can identify those communications are happening. And then you realize that the business has no control within their accounts payable department to be able to validate when somebody asks you to change the routing information to actually check and do that. So, it’s a basic control that you would expect to exist in the business that nobody knew was missing until through security you identify different patterns of behavior and then start to shine a light on it and say, “Well, why are we doing this?”

[David Spark] So, let me ask you. This also goes to sort of a greater issue here in that we see this also for let’s say efforts for environmental issues. I’m just throwing something completely out. It’s very hard to get someone to jump on something just because it’ll be environmentally better. And I get the sense that security may have that same problem sometimes, that, “Hey, this will make us more secure.” But yes, it does reduce risk. It makes things wonderful. So, are there cases, Andy, where you have led with the not security reason to do something.

[Andy Ellis] Oh, absolutely. Or actually I’ve done the opposite as well where I’ve used the security reason to give the push to the other thing that was needed. Like how do you get to an agile deployment model? Your engineers all want to be agile. And they really want to have a CICD. But if you’re a legacy company, there’s a good chance you don’t have one. But you can go play the security horn and say, “Oh, I need you to be on agile because it means that we can deploy patches faster.” Right? And the reality is you’re really pushing on, “We need to be able to deploy software faster because you keep not deploying my patches because it’s too expensive for you to do software updates. So, let’s get to fast software updates.” That’s the easiest thing to do is tie yourself to the speed of the business because getting your engineers and your IT organization to be faster always better. So, just push for that one.

[David Spark] What about you, Tim? Have you done something like that, where you push the non-security reason to get something through?

[Tim Jacobs] Somewhat. It would be if we’re talking about code validation checks through an SDLC process, and using the analogy of just product defects. Take security out of it. But if we’re not looking for these checks up front and we’re delivering bad code, bad products, you would never deliver a car through an assembly line that hadn’t had the right checks. Why are we waiting until we’ve already delivered something to fix it after the fact? More costly, more risk. We need to rework the way we work so we can be faster and more efficient.

[David Spark] All right, good point.

Closing

32:06.662

[David Spark] Well, that brings us to the very end of our episode. I want to thank our sponsor. That would be ThreatLocker. Huge thanks to ThreatLocker. Remember, just go to their website, threatlocker.com. Check them out. They’ve got an unbelievable suite of zero trust solutions. Tim Jacobs, who is the CISO over at Commonwealth Care Alliance, thank you so much for joining us. Tim, are you hiring over at Commonwealth Care Alliance?

[Tim Jacobs] Thanks for having me. And not currently hiring but always looking to meet people who are interested in security. Because when there’s a need, you never know… Having that network of people to tap on, it always helps.

[David Spark] And have you tapped on that network in the past?

[Tim Jacobs] I have.

[David Spark] Yeah. So, yeah. I mean we ask if people have positions open, but it’s always a good time to network. There’s never not a good time to network. Andy…

[Tim Jacobs] Absolutely.

[David Spark] …is there ever not a good time to network?

[Andy Ellis] While you’re sleeping.

[David Spark] Sleeping? Yes.

[Laughter]

[David Spark] So, sleeping is a bad time.

[Andy Ellis] Sleeping is a bad time. But in the ways you think about networking…is networking is about just connecting with somebody and giving to them so that when you need from them later there’s a connection. Most people think of networking as, “Oh, I’m looking for a job. Let me go network.”

[David Spark] Oh, I know.

[Andy Ellis] Little too late then. That’s when you want to exploit your network.

[David Spark] I know. The number of times I’ve heard that from people who don’t network go, “Oh, I’ve got to all of a sudden start networking so I can get a job.” And so it’s like… “Aye… Well, good luck,” is what I say. All right. Thank you so much, Tim Jacobs. Thank you so much, Andy Ellis. And thank you to our audience. We greatly appreciate your contributions and for listening to the CISO Series Podcast.

[Voiceover] That wraps up another episode. If you haven’t subscribed to the podcast, please do. We have lots more shows on our website, CISOseries.com. Please join us on Fridays for our live shows, Super Cyber Friday, Our Virtual Meetup, and Cyber Security Headlines Week in Review. This show thrives on your input. Go to the participate menu on our site for plenty of ways to get involved, including recording a question or a comment for the show. If you’re interested in sponsoring the podcast, contact David Spark directly at david@CISOseries.com. Thank you for listening to the CISO Series Podcast.