We know insider risks represent a major attack surface for any organization, but who should own insider risk management? HR, security, legal?

This week’s episode is hosted by me, David Spark (@dspark), producer of CISO Series and Andy Ellis (@csoandy), operating partner, YL Ventures. Joining us is our sponsored guest, Abhishek Agrawal, CEO and co-founder, Material Security.

Got feedback? Join the conversation on LinkedIn.

Huge thanks to our sponsor, Material Security

Full Transcript

Intro

0:00.000

[Voiceover] What I love about cybersecurity. Go!

[Abhishek Agrawal] One thing I love about cybersecurity is that usually, at least, we’re not solving made-up problems. These are very real problems. I think I have some scar tissue from my past where I was in the productivity space and we were often talking about problems that seemed kind of almost made up, like, oh, could file sharing be even more seamless? Like, it actually works just fine. It’s probably fine. But in security these are really real problems that we get to tackle every day.

[Voiceover] It’s time to begin the CISO Series Podcast.

[David Spark] Welcome to the CISO Series Podcast. My name is David Spark. I’m the producer of the CISO Series. I don’t know if you’ve ever been to the website, but we have a website. It’s CISOseries.com. If you go there, you’ll see this show plus lots of other shows. Why not check the other shows out? But still, enjoy the show. Don’t leave your program and go check the website.

[Andy Ellis] Pause right now and go check it out.

[David Spark] No, first of all, 99% of the people are not sitting at their desk listening. They are out gardening. They’re working out. They’re commuting. They’re not looking at their phone. They are, hopefully, we don’t want you doing this while you’re driving, especially. And not gardening, too because you could clip a finger that way. We don’t need that. By the way, the voice you just heard, you’ve probably heard before. He’s my co-host for today’s episode. It’s Andy Ellis, the operating partner at YL Ventures. Say hello yet again, Andy.

[Andy Ellis] Good morning, folks, or depending on when you’re listening to this, good afternoon, good evening, or good night.

[David Spark] Our sponsor for today’s episode is Material Security. Secure your email productivity suite with Material Security. And actually, they’re responsible for our guest today. But before we jump into that, Andy, do you know that the reason I created this show was in a response to a series of my pet peeves on how others do podcasting?

[Andy Ellis] I could totally believe that, knowing you as I do, that you’re ornery enough that you’re just like, “You’re all doing it wrong. I will do it right.”

[David Spark] Well, I didn’t say it like that, [Laughter] Andy.

[Andy Ellis] You wouldn’t have said that. But yeah, deep in your soul, there’s your motivation.

[David Spark] But I’ll tell you, here’s my number one pet peeve, and I’m sure I’ve mentioned this on the show before. And by the way, I have a whole litany of them. But my absolute number one that drives me crazy is when they introduce the guests and they say, “Tell us about yourself.” Andy, and our guest today is Andy Ellis. Andy, why don’t you just tell us about yourself?

[Andy Ellis] And for those of you who don’t believe this, I had a two-season long podcast of my own called Cloud Security Reinvented. I did the first episode. In fact, I had the guests introduce themselves that way. And I said, “Why don’t you tell me a little bit about your history?” I had their whole bio in front of me. And David listened to it, and he sent me this very strongly worded, but lovely critical note that’s like, “Don’t ever do that. You have their bio. It’s your voice at that point. Like, don’t give it up.”

[David Spark] Yeah. Well, first of all, there’s nothing… People love to be introduced. And by the way, we give very brief introductions, I’m warning our guests on that right now. You’ll see, it’s very brief. But the joke I made about this, and I posted about this on LinkedIn, I said, do you remember when Johnny Carson used to have Burt Reynolds on? He’d say, “Burt, introduce yourself.” No, he never did that because it’s completely unprofessional to do that.

[Andy Ellis] I’m with you. In fact, I now have a slide though because I sort of get enough people who are like, “What bio do you want?” I’m like, “I don’t know.” I’ve got like 75 bios. So, I just have a slide that they can use if they want to. And most people look at the slide and they’re like, “Have you really done that many things in your life?” I’m like, “Yeah, you don’t have to put the slide up if you don’t want to.” But it’s amazing. This is not just podcasts. Conferences have the same problem.

[David Spark] Yeah. The worst is when you’re in a panel session and they ask all the people to introduce. I want to shoot myself at that point because nobody wants it. Literally no one in the room wants to hear it.

[Andy Ellis] Especially if you’re not the first person or the last person, nobody will remember anything about you anyway.

[David Spark] It doesn’t matter. Yeah. All right. What this audience wants to hear is our guest and our discussion today. So, let’s introduce our guest. He is the CEO and co-founder of our fantastic sponsor, Material Security. It’s none other than Abhishek Agrawal. Abhishek, thank you so much for joining us today.

[Abhishek Agrawal] I’m super excited to be here. Thanks for having me.

There’s got to be a better way to handle this.

4:26.748

[David Spark] We all have some understanding of defense in depth, but do we understand what that actually means for public cloud environments? So, Anton Chuvakin, who’s the host of Google’s Cloud Security podcast, looked into how and if defense in depth in the cloud is all that different from on-premise. Now, he argues that cloud-native defense in depth is still fundamentally about layers of controls and interlocking controls with layers. But that must exist within the shared responsibility model of a cloud provider who controls some of those layers. Now, he found this changes the importance of some layers, particularly identity access management, or IAM, and requires layers be as “code friendly as possible” since you’re replacing so much infrastructure as code. So, I’ll start with you, Andy. What are your experiences building defense in depth with cloud infrastructure being that you used to work for a very large cloud company?

[Andy Ellis] Yeah. So, here’s my take on it, which is stop using the phrase “defense in depth.” Just get over it, people.

[David Spark] We have a whole other show that’s called that.

[Abhishek Agrawal] And zero trust.

[Andy Ellis] I prefer zero trust to defense in depth. Here’s why. Defense in depth as a strategy ceased being interesting after World War I ended. Since then, the basic concept of defense in depth, which is about being able to trade space for time. Like your adversary attacks you, they begin conquering your land, but that’s okay because your defense is not just out at the perimeter. It’s also in the core and you are trading how long it takes them to move across your territory to be able to build the response capability. It is not about having I have seven controls in a row and look, you beat the first control and a millisecond later you beat the second control. There is no depth there. That’s height, maybe they’re stacked up, they’re harder, but defense in depth very rarely exists in modern information ecosystems. People should stop using this as a concept. If you want to talk about defense in height, which is interlocking controls, like Anton is talking about, where you stack things up.

Like here’s a defense in depth example for identity, which is two-factor authentication. If you have defense in depth, that means that somebody types in a username, then they type in a password and then they get to type in multi-factor authentication. That is three layers sequentially. Now, what if instead you have to do all three of them basically at once, so that just passing two of them is insufficient, that’s height. You want to stack these because otherwise you get SMS phishing attacks, how much can I just get you exhausted with how many times I can shoot your MFA token at you because I know your password? Like once I have your password, you’re screwed. Unless you actually have a good response system, it’s like, oh, the moment I get two SMS pushes that get declined, I assume the user’s password is compromised, I do something about it. That might actually be defense in depth, but I pretty much never see people do that.

[Abhishek Agrawal] Yeah, I actually totally agree. I think that phrase is completely overused. My sort of favorite example of good defense in depth is when things are kind of agnostic to the attack. And that’s one kind of interpretation that I like, which is it doesn’t matter what type of attack it is, you have a control that still works. And the reason that that’s kind of related to defense in depth is you’re sort of assuming that you haven’t built a control with a very specific attack in mind. You’ve just kind of added, like Andy was saying, interlocking layers. So, it’s not like they’re designed for one specific attack in mind. They’re kind of just saying, yeah, even if that attack succeeds or it doesn’t succeed, I have this control that is compensating. So, that’s kind of one interpretation of defense in depth that I prefer because I think it’s a little bit more pragmatic and tactical in what you can actually do, like create controls that aren’t specific to one type of attack. They kind of assume a variance of attacks and assume different types of success rates and still work.

[David Spark] But digging down into this concept that we’re talking about with Anton, which is whatever you want to call it, if not defense in depth, control layers, whatever it is, he says also that it needs to be, “code friendly,” meaning that you should be able to manage this manipulated on code. What has been your experience with a cloud security environment for building, I guess, these control layers that are attack agnostic?

[Andy Ellis] Yeah, so I think there’s an important piece of doing that, which is you have to think about the process of maintenance. I think that’s what code friendly really means, which is in the cloud, you’re going to have more systems than you had before you had the cloud. And therefore, it must be much easier. Because it used to be really impossibly hard to maintain your systems in the legacy on-prem world. In the cloud world, you’ve got to be rapid and fast and able to make changes that are maintenance and security.

[David Spark] Abhishek, give the closing button on this.

[Abhishek Agrawal] Yeah, I think that it’s a kind of interesting trade-off that I’m seeing in many realms of security play out right now, where what Anton’s talking about is exactly what Andy just summarized. You have to be able to deploy quickly, you have to be able to manage these detection layers, especially if you have multiple of them in a defense in depth. On the other hand though, that takes a lot of maintenance, takes a lot of ongoing kind of work. I think it steals a lot of time from your detection engineering org. And also, one of my favorite concepts here is that detections and kind of defense in depth, they’re not free, they do have a cost associated with them as well. So, you have to kind of think about the marginal cost versus the marginal benefit. So, I don’t know if I would say it’s as simple as just making sure they’re code friendly because that might sort of facilitate getting into a place that you don’t want to be in if you’re just maintaining a ton of different layers of code all the time.

What are the evolving challenges in managing identity and access?

10:16.788

[David Spark] We know insider risks represent a major attack surface for any organization, but who actually owns insider risk management? This doesn’t seem to be a settling issue. Christopher Burgess at CSO Online pointed to a MITRE study that found responsibility ranging from the general counsel or human resources to InfoSec. He argued that having legal own ultimate responsibility for insider risk management solves a lot of issues for an organization. I’ll start with you, Andy, on this one. Does that hold water in your experience?

[Andy Ellis] So, I think it’s a complex problem, and I actually hate most insider risk management programs because you should start from the technology, and then you should also think about the people separately and orthogonally. And the reason that matters is most people, when they say, “Oh, there was an insider component, I read so many vendor reports that include that.” It’ll be something like an insider clicked a link that was sent to them in email, we’ll talk a little more about email security later, and that’s an insider component. Okay, it is. That’s actually a fair point. It is, but that’s not an insider risk. That’s a bad technology problem. And so from a technology perspective, we should say how do we secure ourselves against the possibility that the devices used by an insider become compromised, either by the insider being malicious or somebody getting control of them or able to run code on them, whatever that looks like. That should be the technology component. The CISO absolutely owns that. There’s nobody better to own that. There’s a complete and separate program about how do you keep your insiders from becoming hostile. I would love to see HR departments own this because the number one way is treat them like sane human beings. How often do we sabotage our employee relationships by treating our employees really badly and we create insider risks? That’s not on us to do, not as CISOs. That’s an HR problem. I would love to see HR teams step up to deal with that a little better.

[David Spark] All right, I’ll throw this to you, Abhishek.

[Abhishek Agrawal] Yeah, I would actually largely agree with Andy. I don’t think that it can be solely owned by HR or legal. HR and legal, to your point, they’re kind of the bookends, right? Like they can set constraints around that sort of insider threat problem. For example, like you said, you have a genuine cultural issue, which is leading to insider threat, then yes, it’s almost too late by the time the CISO is trying to address it. HR should have thought about it or recognized it earlier. And then on the other extreme, if you’re kind of well past an insider threat incident, and now you’re kind of thinking about how best to mitigate it, how to respond, of course, legal and things like that need to be involved. But the core kind of identification of the risk and also having mitigating controls to make sure that it’s harder for an insider to kind of accomplish their objectives, that absolutely is a technology issue that should fall squarely on the CISO’s shoulders.

I think at Dropbox, where I was before this company, not everything was figured out, but this was actually something that I think was done fairly well, where the three kind of teams – HR, legal and security – did work pretty well in lockstep. But again, the actual management and detection of the insider threat was definitely owned by the security team. They were just really good at involving their counterparts early in the process and then also late in the process once they actually needed to go do something about the risk that they had identified.

[David Spark] I would just think that discipline probably comes down to legal and human resources. I mean, right, Andy?

[Andy Ellis] So, the discipline action absolutely does, right? CISOs do not get to fire people. But the choices about how you’re going to deal with people in general, also not something the CISO gets to deal with.

[Abhishek Agrawal] Yeah, the other thing that I think HR and legal do have to help the security team with is helping them understand what is even in scope for their insider risk programs. Because obviously, in different countries, different regions, there’s lots of different legal regulations around what companies can and can’t monitor, what types of data they have access to, what are the rights of their employees. And those are very tricky gray areas, where I think a security team needs very specific constraints and guidelines from those other functions, so that they can interpret them and implement the insider threat programs within the bounds of those constraints.

Sponsor – Material Security

14:42.163

[David Spark] Before we go on any further, let me tell you a little bit about Material Security. Material is a refreshing approach to email security. Everyone’s looking for a new way to deal with this. Well, Material’s got one. They offer a multi-layered email threat detection and response toolkit designed to stop attacks and reduce the threat surface across all of Microsoft 365 and Google Workspace. Chances are many of you listening are in one of those environments. Your email productivity suite isn’t just another application, it’s critical infrastructure to your business. I don’t need to be telling you that, but you know it. I’m just reminding you. But securing it today typically involves a heavy set of disjointed tasks that leaves risky coverage gaps and blind spots. You may not be aware of it, but it’s happening.

So, Material is the only solution purpose-built to address risk across the whole environment with the focus and depth required to make a difference. Call it defense in depth if you want, call it layer security, whatever the heck you want to call it, they’re doing it. So, you can learn more about the total email security over at Material Security. Just go to their website. It’s material.security, the whole word security, material.security, that’s how you get there.

It’s time to play “What’s Worse?!”

16:06.020

[David Spark] Now, Andy, every now and then I do not take a submission from the audience. Mostly because I’m looking at some submissions, I’m not so thrilled with them. But there’s this great Twitter stream, or X stream if you would like to call it, called Bad Things Daily. I don’t know if you’ve ever seen it.

[Andy Ellis] I have seen it.

[David Spark] Yes, it’s a series of tabletop scenarios. It’s great. And I sometimes delve into it, take a couple of them, marry them together, and we got a couple of “What’s Worse?!” scenarios. So, kudos to Bad Things Daily for unknowingly submitting today’s “What’s Worse?!” scenarios.

[Andy Ellis] So, apparently I should start following them, so I’m prepared for the future.

[David Spark] Well, I actually dug pretty deep in the archives to get this one. All right. Over the weekend, a malicious update has been delivered to your password manager your employees use. You do not find out about it until Monday. Okay? So, it proliferated over the weekend. Or the administrative account for your hosted email delivery provider has been compromised. Which one’s worse?

[Andy Ellis] How long is that, the second one? Like what’s my time window between compromise and when I find out about it?

[David Spark] Well, you know what? We didn’t specify it, but let’s say the same time frame.

[Andy Ellis] Sure. I’m going to go with what may surprise people, but the password manager compromise is worse.

[David Spark] Mm-hmm.

[Andy Ellis] And the reason for that is the cleanup is going to take way longer because rotating passwords is not something anybody wants to do, especially if they’re group passwords or system passwords for systems that don’t actually support sort of staggered rollout for changes. I’ve had to deal with key databases and password databases being compromised. And sometimes it is years later, you’re still discovering systems that were not updated. And it pains me to say this, just to be clear, the second option of your hosted email compromise, like, oh man, that sucks. I don’t want that incident at all, but I do not think it is nearly as bad as the password manager one.

[David Spark] Well, and in both cases, it’s unclear what damage is going to be done.

[Andy Ellis] Yeah.

[David Spark] It could be equal or…

[Andy Ellis] I’m going to assume the adversary has taken every piece of email out of the archive. This is as bad. I’m not going to downplay it. Every piece of email is taken out of the archive. I have to go look and see what email got sent because quite likely, they did some executive spoofing. We’re going to have to clean up some vendor relationships after this one. This is an ugly, nasty incident. And even so, password manager worse, not because the live incident is worse, but because the drag-out of the cleanup. And people will downplay it.

[David Spark] But actually the vendor situation, you actually brought up a good issue. That it kind of makes that second one, the email…

[Andy Ellis] Oh, yeah. I have to reach out to all my vendors and make sure that nobody got emails saying, “Hey, we want to change our payment details.”

[David Spark] Well, yes. All right. But good over the weekend, not many people are sending payments over the weekends.

[Andy Ellis] Yep.

[David Spark] All right. Abhishek, do you agree or disagree with Andy here?

[Abhishek Agrawal] Hard disagree. I’m super biased obviously, but I think the, oh God, email account of the administrator, it’s game over. You can create transport rules to redirect email. You can provision new accounts and hide them. You can go change mailing list settings. And not to mention all the content, like you said, it’s just like a treasure trove of stuff you can go through for years and years. Everything that is wrong about the password manager attack also applies here. There’s credentials and emails, so all the same cleanup. I would say that it’s strictly a subset, the password stuff, of the email one. For the password manager though, to Andy’s point, the live incident just doesn’t bother me as much because hopefully, with MFA and things like that, just losing credentials isn’t too bad. I agree the cleanup and the password rotation is annoying, but oh man, as someone who’s seen people have to deal manually with data dumps of email, have to manually comb through them. That’s something I wish upon no one.

[Andy Ellis] And we just hope that your email administrator password was not in the password manager.

[Abhishek Agrawal] Yes, that’s true.

[David Spark] [Laughter]

[Abhishek Agrawal] Or at least…

[David Spark] Maybe he got both of them.

[Andy Ellis] Yeah, I think the challenge of both of these is they do. In fact, each one implicates the other one as potentially being part of it.

[Abhishek Agrawal] Yeah. If your email administrator account did not have MFA, you may have deserved this. [Laughter] Just I don’t know, it’s pretty bad.

[David Spark] All right. What I like, by the way, Abhishek, is a hard disagree, which I don’t know if we’ve ever gotten a hard disagree [Inaudible 00:20:48].

[Andy Ellis] We’ve never gotten a hard disagree. That was a layup. There was no way, even if these were not both really bad, there was no way Abhishek was disagreeing with me that when I said email is not the worst one, like…

[Abhishek Agrawal] Yeah. There’s a limit that even I will not cross like this. [Laughter] I’ve got to represent a little bigger.

Please, enough! No, more!

21:07.979

[David Spark] No surprise today’s topic, given our wonderful guest today, is email security. So, Andy, I will start with you. What have you heard enough about with regards to email security? And what would you like to hear a lot more?

[Andy Ellis] So, I’m going to slightly be explicit, but it’s a term of art, which is I would like to never, ever, ever hear again the phrase, “Don’t click [Beep].” I’ve heard that too much. Stop blaming the users, period, for what is an awful, awful platform, which is email. And so what I want to hear about is we use email, which is the least trustworthy communication platform ever created by mankind, to run our core business functions on. And maybe we should just think about, should we trust email from the CEO ever, in any circumstance, email from the CEO? Why would you ever trust that that’s actually from your CEO? That’s what I want to hear us talk about is why do we believe that this is even better than passenger pigeons. I prefer passenger pigeons. They’re more reliable than email from a trustworthiness perspective.

[David Spark] Have you ever sent or received a message from a passenger pigeon, Andy?

[Andy Ellis] I will decline to comment on the grounds that it might incriminate me for my age.

[Laughter]

[David Spark] You’re that old?

[Andy Ellis] Well, might say I’m not that old. Maybe that’s what I’m saying. People assume I’m some old gray-haired person and I’m certainly not gray haired only because the gray hairs fall out before anything else does.

[David Spark] As I understand it, Abhishek started his business because the passenger pigeon business wasn’t going well. Am I right, Abhishek?

[Abhishek Agrawal] That’s right.

[David Spark] That’s right. All right. Abhishek, I’m going to ask you the same question I asked Andy. What have you heard enough about in email security, and it may be why you started this company, and what would you like to hear a lot more? And a lot more, it might be what you’re doing at Material Security. So, let’s hear it.

[Abhishek Agrawal] Yeah, I would love for people to stop talking about how email is the number one way that companies get attacked. I think every CISO understands this at this point. To Andy’s point, it is literally this open protocol designed to let anyone on the internet send someone else on the internet whatever they want. So, yeah, no surprise. It’s a very good way to attack people. I think people understand that. I don’t think that they need to hear more about that. I think the thing I would like to shift the conversation to is it’s not just a great way to send some things bad to someone. It is actually the thing that I am also after. It’s a target because it has all this content inside it. There’s all these things I can do from it.

Because for a long time, the way email security has been framed, and still is for most people, is it’s a great way for me to send you an attack. And so I should block those attacks because it’s a vector. It’s the delivery method. But the whole reason we started Material is that we realized after the 2016 election cycle and even now, a few months ago, Midnight Blizzard, that it’s not just a great way to send you a bad thing. It actually is this fantastic target for an adversary because think about the average email account. First of all, many, many years of archived email, which if you take anyone’s email over years and put it on WikiLeaks or something, there’s reputational stuff that’s bad. There’s security risks in there.

[David Spark] We’re all screwed.

[Abhishek Agrawal] There’s sensitive data. It’s just bad. And then the other thing is it acts as identity for so many things still. Like I got into your email account and now I can reset passwords to other services. Even if you have an SSO or an IDP in place, sometimes there’s back doors through email. And so let’s stop talking about just email from the perspective of a bad way to deliver an attack.

[David Spark] That’s a good point. Literally, it’s your whole existence and identity as a digital human being.

[Abhishek Agrawal] Yeah. And Security has a very good concept of this, which is like the difference between NetSec and AppSec. Like network security, if you take that approach to email, you think about the messaging protocol, you’re trying to block bad things from coming in. There’s ML-based detection now, but it’s fundamentally framed as the same problem, which is stop a bad attack from coming into the mailbox.

[David Spark] All right. So, I want to skip ahead to what you’re specifically doing at Material, and how your approach is different. And your focus specifically is on Google Workspace and also Microsoft 365, correct?

[Abhishek Agrawal] Yeah. So, we do a couple of different things related to email. So, the first is that, unfortunately, there are actually attacks that still get through the traditional defenses. So, we figure out those malicious emails, things like BEC, things like invoice fraud, the ones that are trickier to find, and we detect and remediate those. But what we also do is go do things that traditional email security has never really addressed, which is protect sensitive content that’s sitting at rest inside a mailbox, for example. So, in that example from our segment “What’s Worse?!” earlier, what if I could get into an email account? What if I actually had broken in, but the amount of damage I can do is limited because a lot of the sensitive content, a lot of the juicy stuff has a layer of authentication on it? Or what if I can’t reset passwords from this email account as easily because we do another challenge before we allow you to do something like reset a Dropbox password?

So, Material is doing both the sort of proactive traditional email security where we’re trying to detect email-based attacks, but then we also do a lot of data-centric email security where we’re actually looking at the content inside mailboxes, looking historically, and trying to add layers of protection to them, so that in the event of a compromise or in the event of an insider, the blast radius is contained.

[David Spark] So, let’s take a look at the past year. What have you noticed about email behavior that you were able to create protections because you’re seeing the behavior this year, that maybe you couldn’t have done the year prior because it wasn’t sort of as visible?

[Abhishek Agrawal] Yeah, it’s not so much that we couldn’t have done it, but certainly things like Midnight Blizzard, where Microsoft’s executives own email accounts are compromised. Things like Storm, where the Department of Justice had email accounts compromised. Hafnium, [Phonetic 00:27:24] SolarWinds, all these attacks in which email is the thing that someone is actually after. They’re going after the correspondence because they see it as valuable. That has increased a lot of awareness and urgency around this problem of thinking about email as a content repository that I need to secure and not just as a way that attacks get delivered. And so, again, not something we couldn’t do before, but I think it’s starting to really help people realize that there’s kind of these two heads to the email problem. It’s thinking about it as the delivery method, but also thinking about it as the content store that I actually need to protect, just like my file store, just like my chat messages, just like my file server, if you have one still. It’s the same concepts apply.

Why has this topic suddenly become the center of attention?

28:04.992

[David Spark] What are the biggest cybersecurity considerations during an IPO? As the IPO market heats back up, it’s a timely question. Cybersecurity is playing a bigger role during the due diligence period and public companies face increasing reporting requirements, according to Reuven Aronashvili of Forbes. The cybersecurity challenges during IPO don’t just deal with historical performance. A cyber incident during the IPO itself could sabotage the process. As companies release more information ahead of going public, it provides more fodder than had previously been available for cyber attacks. And the process of going public forever changes the risk to your organization, putting executives in a more visible place for potential targeting. So, I’m going to start with you, Abhishek. How does the cyber team prepare differently when you’re going public?

[Abhishek Agrawal] When I think about this, the parallel that comes to mind is actually kind of a lot of the work that companies do on the finance and accounting side to get ready for IPO and then also obviously become a public organization. And sort of the golden rule there is avoid surprises, right? It’s okay to not be perfect at all times but avoid surprises. You need to kind of prepare your board, the street, for kind of what they might expect, and that’s sort of the nature of the game. And so I think a lot of the focus goes from just trying to prevent incidents, which obviously every security team is doing all the time, but the CISOs that I’ve seen that do this the best with public boards or leading up to an IPO are the ones that are helping the board and the street understand what types of risks they are, helping them understand that the risks are probably inevitable. But then also helping them understand what the kind of mitigating controls are, how the company recovers from an incident, what types of incidents they consider critical versus nice to have, to fix. So, all in the lines of avoid surprises, spend a lot more time thinking about how do you prepare someone for the eventuality of a cyber incident, and kind of get them to accept that and still think about the mitigating controls that you have as an organization.

[David Spark] So, Andy, you have dealt with this yourself, yes?

[Andy Ellis] I’ve actually never bridged. I’ve been on both sides of it, but I’ve never actually gone through an IPO myself. I’ll say the single biggest difference that you have to think about is that pre-IPO, your board is made up of your owners. Right? Basically shareholders and their direct representatives who are employees of the shareholder. They’re actually less focused on cybersecurity, even in these days, because they’re worried about the survival of the company from a financial footing. The moment you cross that bridge and you become public, now you don’t have any owners on your board. I mean, you might have your CEO might be, if they’re a founder, they’ve got a significant piece, but your board members are all independent, right? They represent realistically the SEC. And so governance is going to change dramatically once you cross that IPO barrier. And that’s the thing I think a lot of CISOs really aren’t prepared for when they’re inside a privately held company to when they go public is how much that shift is going to happen. It’s going to disrupt every piece of the business, not just security, but since security covers every piece of the business, you now get disrupted by every single disruption.

[David Spark] Well, let’s leave that as a button for today’s episode right there. Good advice, if anyone who’s listening is about to IPO. It creates a hornet’s nest of new fun problems as if cybersecurity isn’t tough enough as it is.

Closing

32:00.988

[David Spark] That brings us to the end of our very show. And I want to thank our guest, Abhishek Agrawal, who is the CEO and co-founder for Material Security. I’m going to let you have the very last word here, Abhishek. For those of you who don’t remember their website, it’s material.security. Not much more you need to know. If you’ve got a productivity suite, if you’ve got a friend who’s got a productivity suite, we’re talking about Microsoft 365 or Google Workspace. If you’re in another productivity suite, why? Let’s start with that. Why are you in a different one than those? Because those are kind of the granddaddies of it. If you’re using one of those, chances are you’ve got some email issues. Why not check it out, what they’re doing at Material Security, at material.security? Andy, as always, thank you for being awesome on the microphone. We greatly appreciate it. And Abhishek, do you have any offer that you would like to give to our audience, or are you hiring over at Material Security? Any last words you’d like to say about your company and being on the show?

[Abhishek Agrawal] Yeah, thank you for having me. We are absolutely hiring at Material. So, we’re growing our detection engineering team if anyone is interested in joining them. And yeah, if you have a project where you’re thinking about supplementing or enhancing your existing email security, definitely check us out. We do some things that are pretty different from what you might expect a traditional email security product to do.

[David Spark] Well, I think we’ve definitely learned that today as well. Thank you very much, Abhishek. Thank you very much, Andy. Thank you very much to material.security. Remember, that’s where you’re all going after you listen to this show. Or you can always just start listening to another episode and go to material.security, whichever way you want to do it. We greatly appreciate your contributions and listening to the CISO Series Podcast.

[Voiceover] That wraps up another episode. If you haven’t subscribed to the podcast, please do. We have lots more shows on our website, CISOseries.com. Please join us on Fridays for our live shows – Super Cyber Friday, our virtual meetup, and Cybersecurity Headlines Week in Review. This show thrives on your input. Go to the Participate menu on our site for plenty of ways to get involved, including recording a question or a comment for the show. If you’re interested in sponsoring the podcast, contact David Spark directly at David@CISOseries.com. Thank you for listening to the CISO Series Podcast.