Getting buy-in to your security awareness program is critical. So why do so many organizations get it so wrong? Phishing tests seem most successful at getting your staff not to trust you, rather than discouraging the behavior. So what framework can we apply to actually build trust with security awareness?

This week’s episode is hosted by me, David Spark (@dspark), producer of CISO Series and Andy Ellis (@csoandy), operating partner, YL Ventures. Joining me is our guest, Grant Anthony, CISO, Orion Health.

Got feedback? Join the conversation on LinkedIn.

Huge thanks to our sponsor, Varonis

Full Transcript

[Voiceover] 10-second security tip. Go!

[Grant Anthony] Referring to security controls such as patch and vulnerability management as the basics does our industry a disservice. These are foundational but complex domains and when described as such, garner more support, funding, and ultimately reduce risk.

[Voiceover] It’s time to begin the CISO Series Podcast.

[David Spark] Welcome to the CISO Series Podcast. My name is David Spark, I’m the producer of the CISO Series. We’re available at CISOseries.com, and for this very episode, you will not only get to hear my voice, but you will also get the great opportunity to hear Andy Ellis’s voice.

Why don’t we hear that right now? Andy?

[Andy Ellis] Good morning, sweet listeners or depending on where you are in the world, good afternoon, good evening, or good night.

[David Spark] This is his new sign-on. By the way, Andy is the operating partner over at YL Ventures. Our sponsor for today’s episode is Varonis. Ah, we love Varonis! A longtime sponsor of the CISO Series, and not only that, they’re also the leader in data security.

And that is something we’re going to be talking about a little bit later in the show, so stick around for exactly that. Now, Andy, I have said this many times in the show.

[Andy Ellis] That you love pinball.

[David Spark] That I love pinball too, and I have a high tolerance for compliments as well.

[Andy Ellis] Yep.

[David Spark] By the way, I do want to mention that while I do enjoy compliments and I have a very high tolerance for them, that I can take them, I’ve referred to myself as the Floyd Mayweather of compliments, you can keep whacking me with them, and I will withstand the punishment of it.

[Andy Ellis] That’s actually a really hard trait to develop. Many people are not comfortable receiving compliments.

[David Spark] Well, I just want people to know that I have yet to find my limit and I can handle it. Now, with that being said, I do want to read a couple of quotes of what people have said about my… This is not cybersecurity related, I do these workshops called Business Networking Pickup Lines, and I did it just a couple of nights ago here in San Diego.

And here’s what a couple of people said. And when I, by the way, say the word presenter or speaker, they’re referring to me.

[Andy Ellis] Okay.

[David Spark] Just so you know. “The presenter was great. I loved that the format was structured yet dynamic. As a first-timer and an introvert, I appreciated that there was a host to keep things moving and encourage lots of opportunities to change partners and topics.” And then second, “Our speaker was practical, sincere, and just great.” Someone called me sincere, Andy.

[Andy Ellis] Yeah. Like the practical and just great, I’m totally fine with. The sincere? You must have done a really nice acting job.

[David Spark] Exactly. [Laughter] By the way, nobody gives me credit for handling all these compliments. I don’t get compliments for my ability to handle compliments.

[Andy Ellis] But then you would need to get compliments on your ability to handle the compliments about your compliments, and at some point we’re just too meta.

[David Spark] That is true. But I’d like to just at least go one more level.

[Andy Ellis] So, listeners, when this episode drops, you’ve listened to it, put in some compliments for David and some compliments about his ability to handle compliments.

[David Spark] By the way, Business Networking Pickup Lines, if you haven’t already had your sales kickoff meeting, I’ve done this for many sales kickoff meetings, and it’s a lot of fun too. I can tell you more about it later if you’re interested, just ping me.

But let’s get into the darn show, which is about cybersecurity, and I’m very excited to have our guest on who has actually been a longtime listener. I believe. He’ll clarify that. He is connecting with us from New Zealand right now, so we got three time zones going on.

He is in the future. He’s at tomorrow. Andy, we’re still in today. He’s in tomorrow.

[Andy Ellis] So, it’s his fault if tomorrow is really ugly because he didn’t tell us.

[David Spark] Exactly. It is the CISO for Orion Health, Grant Anthony. Grant, thank you so much for joining us.

[Grant Anthony] Thanks for having me.

Pay attention! It’s security awareness training time.

4:08.263

[David Spark] Are we coming to a breaking point for security awareness training? More training doesn’t necessarily mean that it’s making us safer. One commenter on the cybersecurity subreddit said, it’s not a matter of fixing security awareness, but getting users to care about it, saying, “Until we make cybersecurity something they want to do instead of something they should be afraid of, we’ll never get where we need to be.” So, Andy, is the biggest challenge to security awareness right now just buy-in?

[Andy Ellis] So, I actually think the biggest challenge is compliance. And when I put it that way, what I really mean is we have basically mandated that everybody goes through the same security awareness training, but “everybody” is what’s key. That you have to document that every single employee gets trained on security awareness every single year.

And so at scale, that’s expensive. Imagine that you are a 2,000-person company and you want everybody to go through this one-hour training. That’s one full FTE just consuming the training. And what happens is it’s usually these awful computer-based trainings that don’t let you click away, they stop playing the video, they’re not very friendly for those of us who are deaf and hard of hearing that want to be able to watch captions.

They’re really awful, actually. And as a result, people are disengaged, but then you’re not hitting people with the awareness they need.

Because the benefit of true awareness is it changes the risk behaviors that people do. Like I want to talk to developers not about phishing, honestly. I don’t care nearly as much for phishing on developers as I care about code practices. But when I’m talking to the executive assistants, I want that to all be about business email compromise and phishing, all the attacks they’re going to face, but I’m trapped by having to do compliance first.

And then everybody is tired of compliance, and so they’re tired of security awareness because they see it as being useless.

[David Spark] Yeah, so essentially you waste time and money on compliance, and then what money/time do you have left to actually do the security awareness you need?

[Andy Ellis] And you waste political capital on doing the compliance.

[David Spark] Yeah. All right. So, we’re going to complain the regulations. Grant, where do you stand on this? Do you agree with them, or do you believe just good old-fashioned buy-in is what we need?

[Grant Anthony] Yeah, I agree with what you’re saying there, Andy. So, when it comes to compliance, the standards are black and white. What is the percentage of cybersecurity training across your organization? The insurance companies are asking for it, our customers are asking for it, and so that drives this approach that we’ve got ourselves into, and it’s a $6 billion industry now, security training awareness.

And that’s a huge amount of spend that we’re actually not spending where it matters most. I studied marketing among other things at university, and one of the main things I remember from one of my lecturers was, if you’re everything to everyone, you’re nothing to anyone.

[David Spark] Yes.

[Grant Anthony] And so that is the mass market approach that we apply to cybersecurity training, and it’s simply not working.

[David Spark] That’s exactly what Andy described right there. So, you’re trying to create this unified training for all employees. Honestly, it’s a really good point, Andy, in the sense that you hire a staff of people who have different skills.

[Andy Ellis] Right.

[David Spark] Yet you have to train them on this one thing equally across the board.

[Andy Ellis] Everybody gets the same training, and it’s crazy. And even when you do narrow trainings, like we would go buy training for developers, say, “Oh, here’s your security engineering training,” and the developers all hated it. And one of the guys who worked for me, Eric Kobrin, one day just sat down and said, “Here’s what I’m going to do.

I’m going to go find all of the security bugs in their code, and I will teach a class using their code as an example.” And like, boom, instantly everybody in the room got it. They were very excited because he only taught them about bugs that they were impacted by, so it wasn’t theoretical.

You know when you try to teach somebody about SQL injection, but they have no database and no front-end users? They’re going to tune out. But teach them about things that they have done, help them fix their code, and now they know what to do. Very personalized.

But let me tell you, we did not tell our auditors about that because if I had, they’d have said, “Well, did you do this for every developer?” I’d be like, “No, it’s very expensive to do.”

[David Spark] So, this is a frustration for everybody. Let’s close with one tip, it doesn’t have to be the grand one, and actually it’s something we do on Super Cyber Friday, we call this the 10% Better Tip. What is your 10% better advice to improve this?

I’ll start with you, Grant.

[Grant Anthony] Segment your market. Take a marketer’s approach to this. Look at the specific threats and needs of the different parts of your business, chop it up, and give targeted training or targeted education where it matters.

[David Spark] Now, can you just, I don’t even know, but for compliance reasons, can you get away with doing that, Andy?

[Andy Ellis] So, you can do what I did, which is replace your compliance-based security awareness training program with a lightweight cron job. Literally had a database sitting behind a web app. Every year it would send people emails saying, “Hey, you need to do your security awareness training.

Come to this webpage, read this one page, click the link.” Boom, you’re done.

[David Spark] Really? [Laughter]

[Andy Ellis] Really. So, every person is 4 or 5 minutes a year rather than 60 minutes, and people nagging them.

[David Spark] So, that essentially clears that extremely low bar.

[Andy Ellis] Clears the low bar at almost no cost. Nobody on my team’s administering this program, and we had like 96-97% compliance without anybody having to do anything. Like I could drive that number up with a couple phone calls.

[David Spark] Then you can actually layer, like what Grant just said, the segmented training, which it sounds like you’re on board as well.

[Andy Ellis] Absolutely. No, that’s fantastic. Do that, but don’t tell your auditors you’re doing it.

How have you actually pulled this off?

10:01.345

[David Spark] Patching all of your known vulnerabilities might sound like common sense, but only in a platonic ideal world where security teams have infinite time to do so. Now in the real world, security teams need to prioritize patching based on risk and potential impact to the business.

Security researcher Wade Baker recently got hard data on what this looks like in practice. In a post on LinkedIn, he shared consistent findings from two different data sets that organizations on average can remediate about 10% of known vulnerabilities.

Now we know from other data that you can pretty much ignore 60 to 70% of known vulnerabilities, but remediating only 10% puts you, at best, managing about a third of your relevant problems. I’ll start with you, Grant. How does patch management change once that is known?

That the best you’re going to do is fix a third of your problems?

[Grant Anthony] Well, I think it’s nice that we’re actually having this discussion because for so long as an industry, we’ve had a target to patch everything all the time, and that’s simply an oasis. If any organization claims to patch all the vulnerabilities, all the things, they clearly don’t have adequate coverage in their vulnerability scanning.

Right? So, you got to start there, and the challenge is enormous. If you look at how you get adequate coverage, you got to start with your traditional vulnerability scanners. And then you’re bringing in telemetry from your pipeline scanners, so your SaaS and your DAST.

Then you lay it on as CSPM and EDR tooling, which now commonly has vulnerability management data, and then you’ve got your critical vendor alerts, pentest vulnerabilities. So, all of a sudden, you’ve got this enormous data set with lots of duplication.

That’s a fantastic achievement on its own, getting that visibility, but the next step is to consolidate and normalize and put a risk assessment layer to that so you can start tackling the areas which matter.

[David Spark] Right. But let me skip to this. You now have to communicate to either whoever you report to – the CEO, the board, whomever – and say, “We have done all this work. We know what our relevant vulnerabilities are, we can prioritize them. But just so you know, the absolute best we’re going to do is get a third of them.” I mean, is that how you’d say it?

Or I mean, is there a better way than what I just said? Because I don’t think anyone’s going to be happy with that answer.

[Grant Anthony] Simply saying you’re going to nail a third of your vulnerabilities, you’re going to clear a third off your bench, you’re going to get walked out of the room. What third are you going to do? Are you going to go for the lows and mediums or the automatic updates?

That’s probably the easiest one to nail. You really need a risk-based approach, and I think in this room and most of our listeners will agree with that, but that’s not an easy solution.

[David Spark] I mean, so Andy, let me ask you, can you say we’re going to get one third of our riskiest vulnerabilities?

[Andy Ellis] So, the thing I found interesting just about the whole way this question is structured is, it is not the security team’s job to patch vulnerabilities.

[David Spark] Right. Actually, that’s a very good point.

[Andy Ellis] It’s an ops team and an engineering team. And I think we as the security professionals, part of our job is governance, and we have to be able to say, “Here’s where the org is good and here’s where it’s bad.” And I’m a huge fan of basically saying we’ve established SLAs based on criticality and whether we’re using CVSS or EPSS or some blend of them, and something out of our attack chains, however you want to do that risk scoring.

You get some risk score for vulnerability, that sets an SLA. Your job is to report patch compliance to the SLA and do that by organization. Because there are vulnerabilities you can’t patch because people aren’t maintaining systems. And they’re so far out of date, they work, but they can’t take patches because it would require them to bring 12 libraries forward, which would break some application sitting on top of them.

That is not your problem if you’re the security person. Right? The problem is when you refuse to report that because you think it’s your job to patch and you haven’t patched and therefore you don’t want to make yourself look bad. And if you’re in an organization that has put the operational responsibility for patching and the governance responsibility for vulnerability management into the same place, that is dysfunctional, but a lot of you are in that boat.

You have to remember that the governance is more important. That if you’re not doing governance, you will stop doing the operational patching. So, you have to hold governance first and foremost and say, “Yeah, we’re only doing 30%.” That’s what we are, like, we’ve figured out which things we ought to fix.

That’s 30% of them. We’re only getting 10% of that. Like if you want to argue about the 30%, you can, but let’s not argue about that until we deal with the fact that we’re not even at 30%.

[David Spark] Grant, what’s your biggest struggle with either communicating the vulnerability situation or managing the vulnerability situation?

[Grant Anthony] The toughest part about vulnerability management is the communication element because there are so many different ways of describing risk. And as you’ve mentioned, Andy, the CVSS scores, we’ve got the EPSS score, we’ve got other internal risk assessment processes of determining which of those 30% or which of those 10% we actually care about.

And given the wide number of sources that we’ve got, it’s really difficult to invest the time to consistently apply the same risk methodology, the same scoring system. And to complicate that more, vendors have their own risk-based scoring system, their proprietary frameworks.

We have to blend that with other vendors that have a slightly different one, we then have to blend that with our internal risk framework, and then communicate that succinctly to a management team who don’t understand what a vulnerability actually is, and nor should they.

So, that’s the biggest struggle. How do we actually get our point across consistently in a way that is understandable?

Sponsor – Varonis

16:07.142

[David Spark] Before we go on any further, I do want to mention our spectacular sponsor, Varonis. Now go from data darkness to automated data protection with Varonis, as I mentioned earlier in the show, the leader in data security. Now, it’s a dozen security products in one.

Varonis tackles hundreds of use cases, making it the ultimate platform to stop data breaches without, you’re going to like this, adding more work onto your team. Ah, now you’re listening, right? So, within minutes, you’ll be equipped to detect anomalous behavior, ensure compliance, and remediate risks to your sensitive data in the cloud and on-prem.

You can reduce your risk without taking on any and see Varonis in action today at, get ready for the website, it’s Varonis.com/CISOseries. Go check it out.

It’s time to play “What’s Worse?”

17:12.876

[David Spark] All right, Grant, you’re familiar with how this game is played, right?

[Grant Anthony] Yep.

[David Spark] Two bad scenarios, and yet it’s a risk management exercise, so you have to select which one is the worst by purely which one has the uglier risk profile. Now, I always have Andy answer first, and you can agree or disagree with him. This is a first, Andy.

This is something that came in from a listener. Actually, it’s someone who’s also been a past guest, that’s Jared Mendenhall of Impossible Foods, but Jared queried ChatGPT for “What’s Worse?” scenarios.

[Andy Ellis] Oh, that’s fascinating.

[David Spark] So, this is a combination of Jared and ChatGPT, mostly ChatGPT. It’s “International Cyberwarfare or Synthetic Identity Infiltration.” All right. That’s the title of it. What’s worse, being caught in the crossfire of an international cyberwarfare, you’re in the crossfire, where nation-states launch cyberattacks with geopolitical consequences, and you’re in the middle of this somehow, or dealing with a sophisticated infiltration of your organization by attackers using synthetic identities that are nearly impossible to detect.

They both sound pretty bad.

[Andy Ellis] “Using synthetic identities,” I’m trying to decide what these words mean.

[David Spark] I don’t know. That’s what ChatGPT… Let’s take the word “synthetic” out. Let’s just say identities that are almost impossible to detect.

[Andy Ellis] So, my problem on this one is they’re actually both really vague.

[David Spark] It’s really, do you want to be in a cyberwarfare, or do you want someone infiltrating your network that you can’t detect?

[Andy Ellis] So, I think that I’m going to have to go with the context of where I’ve been, which was at a security company that we defended people in the middle of cyberwarfare. So, I’m totally happy to be in that first situation. So, the second one is totally worse because it sounds like I’m being infiltrated by adversaries, and I have no idea they exist or how to ever go find them.

So, I’m going to take number two as the worst option for me. And ChatGPT, I hate you.

[David Spark] Yeah, yeah. So, we’ll get on ChatGPT’s case about being more clear next time.

[Andy Ellis] Maybe I should have typed that into ChatGPT and asked it to give me an answer.

[David Spark] [Laughter] Which situation is…?” Right, hey, let’s see if I can do that during this, I’ll find out. All right. Let’s get your answer, Grant.

[Grant Anthony] Well, the cyberwarfare scenario, the first one, that’s taking me back to NotPetya. When I was working in the UK at the time, the NHS was caught up in that, a lot of hospitals impacted, it was pretty significant collateral damage from that.

That scares me, working in healthcare, obviously. Cyber warfare is also an interesting one because sometimes that’s an exclusion from cyber insurance policies. So, you might not have cover if it’s a result of war. Something else to consider. But the synthetic IDs being nearly impossible to detect, I’m going to say that one’s worse because I’m going to go towards the far line.

They’re impossible to detect. How do you know you’ve been compromised? They could be there for years. Game over.

[David Spark] Yeah. So, I think you’re in agreement. And by the way, the other co-host, Mike Johnson, he pretty much… He always leans to the known versus the unknown. If you have a choice of what’s worse, even if the known is really awful, at least you know it.

Not knowing…

[Andy Ellis] Oh, so much worse than knowing.

[David Spark] Hence why the unknown unknowns is the thing that freaks out every cyber professional. Yes?

[Andy Ellis] Yep. So, hey, I beat ChatGPT. So, Grant, if you don’t know, I get a point if I can get the guest to agree with me, and whoever writes in the question gets the point if they disagree with me. So, ChatGPT zero, Andy one.

[Grant Anthony] Congrats.

[David Spark] All right. With that said, we’re going to ask ChatGPT to give us an answer.

[Andy Ellis] Okay. What does it say?

[David Spark] In summary, being caught in international cyberwarfare involves broader geopolitical risks and potentially widespread disruption, while sophisticated infiltration with synthetic identities poses severe threats to individual organizations, challenging their security and operational integrity.

Duh. All right, I think we all know this.

[Andy Ellis] Okay.

[David Spark] So, their answer, the determination of which is worse would depend on the specific context and perspective of the entity involved. Well, you gave us this context! For a nation-state, cyberwarfare might pose a greater threat, while for a private organization, infiltration using synthetic identities could be more concerning.

So, they gave me an “it depends” answer.

[Andy Ellis] Well, no, no. No, actually, so it just agreed with us. What it basically just did is said is that if you’re a company, then the synthetic identities is worse. But if you’re a nation-state, you do not care about individual companies, so then being breached like that doesn’t matter, so you only really would worry about cyberwarfare.

So, it agreed with Grant and I.

[David Spark] Yes, of course.

[Andy Ellis] But it just hedged its bets.

[David Spark] Let me just say that ChatGPT is not welcome as a guest on this show.

If you haven’t made this mistake, you’re not in security!

22:15.258

[David Spark] Why aren’t more security programs built around being threat informed? I mean, most security pros would say knowing the threats you face is key to your security program. Yet this often isn’t operationalized. So, Dr. Anton Chuvakin, who is actually the host of the Cloud Security Podcast, he suggested a couple of reasons in a recent Medium piece.

Some organizations don’t have basic security hygiene in place. And again, referencing what Grant said, it’s not basic. It’s foundational, fundamental if you will. Or they don’t have mature IT capabilities. This is what Anton said. Now, others have no bridge from threat intelligence to actual security controls, and others build out from a compliance perspective.

So, I’m actually going to start with you, Andy, here. There’s no arguing threat-informed defense is easy. No, it’s not. But is there another disconnect for why we don’t see more of it?

[Andy Ellis] So, I think almost all defense is threat-informed defense, right? The question is just how customized, how tailored, how deep. If you say, “Look, I’m going to go roll out MFA,” that is threat-informed defense. That’s the ecosystem, we know what adversaries can do, you don’t have to detail it every single time, right?

So, however you’re going to build your security program, you are starting from threat-informed defense, as long as you understand why. Now you don’t have to just check the box and say, “I’ll do whatever is in ISO 27001,” because often these standards are the threat-informed defense, it’s the super set, the union of all threats across all enterprises gets thrown in there, and some of them might not apply to you.

I think my favorite ones are things like your password rotation applied to a company that uses no passwords. Clearly, that’s not threat-informed defense, where you’re just doing a thing to check a box. But then it’s when you get above that, when you start doing complex systems analysis to understand specific threats, how they will interact with the hazards presented by your systems to expose you to unacceptable losses.

That is, I think, probably what Anton is headed towards, and yes, there is not nearly enough of that in the industry.

[David Spark] Grant, what do you think is the reason people aren’t connecting their threat intelligence to their actual security program?

[Grant Anthony] I’m going to have to go with the ChatGPT reference to, it depends. It depends on the size of your organization and the maturity of your organization, whether it actually makes sense to focus on threat. So, if you’re a smaller company, you’ve got a two- or three-person security team, and you put one person in charge of looking at threat indicators, threat intel, and tailoring your program around that, you’re wasting time and money.

You should really pick up a best practice standard like ISO 27001. Apply a little bit of tuning there, like Andy mentioned, if there’s specific controls that don’t really fit the needs of your organization. And by needs is the threats. Deprioritize them and prioritize the ones that do.

But certainly as you move up the ladder in terms of size and complexity, and you get a bit of bandwidth to look at threats, and you’re trying to move from level three to level four, or level four to level five on the maturity scale, then absolutely threat intelligence is critical to level up your program.

[Andy Ellis] I think a really key thing on doing threat-informed defense is your security professionals should have a model of the world that encompasses most of the threats. So, they’re testing their defenses mentally, even just to say, “Oh, does this apply?” And what you really need to be doing is looking for things that are startling and surprising that would change your understanding of the threats.

And as an example, there’s the news that just came out yesterday when recording this, about a ransomware gang that when someone didn’t pay the ransom, filed a complaint with the SEC.

[David Spark] I saw this. Yes, that’s pretty funny, [Laughter] actually.

[Andy Ellis] Right? And so think about this. This has to change how you think about ransomware adversaries, that they’ve looped in the SEC. And remember, once you pay the Dane-geld, you’re never rid of the Dane. So, even if you pay the ransom, what’s to prevent them from going to the SEC and nagging on you?

So, you might as well go to the SEC right up front because you just know that you’re screwed, and that changes from where we were yesterday.

[David Spark] I’m always amazed that the ransomware always finds another vector to get you to pay up.

[Andy Ellis] Yep.

[David Spark] I’m going to steal your data. That’s not enough. I’m going to tell on you. I’m going to release your customer data. I’m going to then put it on the black market, I’m going to use it to actually run a botnet. I mean, there’s a whole slew of different things they could do, but they’ve always changed.

And this new one about the SEC was hysterical to me.

[Andy Ellis] Except for the company involved.

[David Spark] Yeah, nobody wants to be targeted. It always seems insane. But let me throw this out at you, Grant. Let’s say you do have this incredibly small team, and there’s no way I can staff someone to look at threats. But is it enough? And I’m thinking this might be a good solution.

That I’m part of like an Osaka group, I’m in a retail space, and I just talk to my fellow retailers and go, “Hey, could you generally tell me what kind of attacks you’re getting?” and then just focus on that? And that could be the level of my “threat intelligence.”

[Grant Anthony] I mean, that’s a starting point. I wouldn’t say that’s the finish, though. But certainly engaging with…

[David Spark] But again, talking about that slim team, I can’t afford to put one person on threats.

[Grant Anthony] Yeah, I’d go one step further and engage with other organizations, get into a community with IC-squared [Phonetic 00:27:53] or ISACA, go to presentations, conferences, and things, and glean information from those channels. You might not necessarily be getting attacked with QR code phishing emails that week, but someone else in a similar industry in their country might be.

And so you can glean that information and build that into your program and continuously update it.

How would you handle this situation?

28:14.969

[David Spark] We know security metrics are of primary importance for a CISO. It’s the basis of how you make security decisions. But Michael Hill at CSO Online also argues they hold some other benefits. The one that stood out to me was building trust within an organization.

We often talk about the CISO, the important role in connecting security to the rest of the business, getting buy-in. So, can you actually use metrics to create outreach to the greater business organization, and have you done this? And if so, give us an example, please.

[Grant Anthony] Yeah, absolutely. Metrics are a great tool that have multiple uses within an organization. Simply using them to facilitate a session with a counterpart, with another leader in your company, they become a great talking point. They allow you to share information about your security program, what risks you’re tracking, what KPIs you’re tracking.

And it gives you an opportunity to ask questions and learn a little bit more around what that business unit is doing and then feed that into your overall strategy.

[David Spark] Actually, that’s a really good point. Andy, have you ever sent an email that says, “Hey, we just discovered 30% of this department is XYZ. Let’s have a conversation about that.” Have you used a metric to initiate a conversation?

[Andy Ellis] Oh, absolutely. I think my favorite one is I’ve used, “You’re the largest organization rating this low.” Like, boom. Like, “I can find an organization with a worse rating if I narrow it down, but at the size of the company, there’s nobody your size or bigger that is worse than you are.” And that’s like, “Oh, hey, let’s have a conversation.” But what’s really important is while you’re going to have that negative conversation, they also have to see the positive.

That you’re going to come in and say, “Hey, this organization just improved in this way.” Like, they don’t trust you when all you do is use metrics to beat them up. They’re like, “How do I not have a conversation with you?” But if you walk into the room and say, “We have three organizations that are doing something amazing here,” and you pause, and then everybody looks over at the other organization, they’re like, “Okay, what’s going on here?” First of all, you have made three friends, and you’ve got the entire companies’ buy-in to help that fourth one fix whatever’s going on in their organization.

Whereas if you just walk in and try to throw the fourth one under the bus, they don’t like you, and the other three are all worried that they’re next.

[Grant Anthony] Hmm. And on that, Andy, you can take the three that are doing really well and use their strategies, share their strategies with the other departments that aren’t doing well. So, you gamify it. You don’t make it a blame game, you make it about, “Let’s share what’s working well,” and they might even be sharing resources and tools that are already created that other teams are using.

You’re facilitating those types of discussions and allowing teams to get more value from each other rather than simply showing them their dirty laundry.

[Andy Ellis] Yeah, and the “facilitating” is a key word because if you walk in as a security professional and say, “You need to change your practices in this way,” they’re going to be like, “Well, you don’t know what I do.” But if you say, “Oh, let me bring in your peer organization, and I’ll facilitate that conversation, and you can figure out how to bring those over into your slightly different environment.” But now I’m not the security person telling you how to do it.

You’ve got a peer developer or marketer, whomever it is.

[David Spark] And just to sort of summarize and to couch what you’re saying, when you send that email saying, “You’re the worst,” but say like, “You’re the worst, but I have some suggestions given what others like you have done to improve this.”

[Andy Ellis] No, no, no, no, no.

[David Spark] No? Don’t say it like that?

[Andy Ellis] No, no, no. Don’t tell someone what to do until they accept there’s a problem.

[David Spark] Oh, good point.

[Andy Ellis] That initial outreach is to get their attention to say, “Hey, we have a problem. This is why it’s a problem.” And then when they say, “What can I do?” “Oh, I’ve got a bunch of things.” But if you jump to the bunch of things, if they don’t perfectly solve the problem, they will argue with that and ignore the fact that they were the worst, and now they’re not bought in to make a change at all.

[David Spark] Do you also send the email letting someone know, “You’re killing it, keep doing what you’re doing”?

[Andy Ellis] Yes, absolutely. And in fact, we’re talking about sending the email. The, “Somebody who’s killing it,” you should do that publicly in front of as many people as possible so that you’re celebrating. And the person that you’re talking to to say, “Hey, you’ve got a problem,” preferably in person.

If you can’t do that over voice, and only if you can’t do that, should you go to email.

[David Spark] Excellent point.

Closing

32:38.714

[David Spark] Well, that brings us to the very end of this show. I want to thank our guest here, that’s Grant Anthony, who is the CISO over at Orion Health. I’m going to let you have the last word on this. But I want to thank our sponsor. That would be Varonis.

Yes, the leader in data security. Remember, I told you a web address and I’m going to remind you again of it. It’s Varonis.com/CISOseries. Go check it out. Look how they can help you reduce risk and see them in action. It’s pretty darn cool. Thank you very much, Andy, as always, we greatly appreciate it.

Grant, any final words on this? Anything? Plug for Orion Health, how awesome it is?

[Grant Anthony] Orion Health is reimagining healthcare around the world. So, we’re doing what internet banking did for finance, putting your healthcare in your hands. So, help us reimagine it. Let’s make it better.

[Andy Ellis] Happy hunting.

[David Spark] That sounds excellent. Thank you very much, audience. We greatly appreciate your contributions. By the way, if you want to send us a “What’s Worse?” scenario, and Coach ChatGPT may be a little bit better, we are all ears on that as well.

So, we’re always looking for more contributions of any sort, but definitely always want more “What’s Worse?” scenarios. Send them in! Thank you for listening to the CISO Series Podcast.

[Voiceover] That wraps up another episode. If you haven’t subscribed to the podcast, please do. We have lots more shows on our website, CISOseries.com. Please join us on Fridays for our live shows – Super Cyber Friday, our virtual meetup, and Cybersecurity Headlines Week in Review.

This show thrives on your input. Go to the Participate menu on our site for plenty of ways to get involved, including recording a question or a comment for the show. If you’re interested in sponsoring the podcast, contact David Spark directly at David@CISOseries.com.

Thank you for listening to the CISO Series Podcast.