We’re coming to understand generative AI as a platform shift in technology, which has many cybersecurity implications. But as exciting as this new technology can be, we’ve been through this before in recent memory. What did we learn from the emergence of smartphones that we can apply to GenAI? 

This week’s episode is hosted by me, David Spark (@dspark), producer of CISO Series and Andy Ellis (@csoandy), partner, YL Ventures. Joining us is our sponsored guest Jadee Hanson, CISO, Vanta.

Got feedback? Join the conversation on LinkedIn.

Huge thanks to our sponsor, Vanta

Full Transcript

Intro

0:00.000

[Voiceover] Best advice for a CISO. Go!

[Jadee Hanson] Whenever possible, communicate your cybersecurity program tied to return on investment, paying special attention to communicate the decisions made in business terms. Terms such as cost of breaches, potential savings from avoiding downtime, and reputation management are great places to start.

[Voiceover] It’s time to begin the CISO Series Podcast.

[David Spark] Welcome to the CISO Series Podcast. My name is David Spark, I am the producer of the CISO Series. And joining me on this very episode, you’ve heard many times before, he is the author of 1% Leadership, and that’s all he’s ever done and nothing else ever. He’s frowning. [Laughter] His name is Andy Ellis.

He’s the partner for YL Ventures. Andy, say hello to the audience.

[Andy Ellis] Good morning, folks, or depending on when you are in the world, good afternoon, good evening, or good night. I meant to have another language prepped and just totally forgot to.

[David Spark] I know. Someone, was it from Sweden?

[Andy Ellis] No, it was Finland.

[David Spark] Finland, and they complained, and so you learned your entire little opening and finish, which I thought was great. Our sponsor for today’s episode is Vanta. If you’re not familiar with Vanta, get on board, people. Get on board for all your compliance GRC needs. Vanta can help you out there, and we’ll be talking about that a little bit more later in the show, and in fact, our guest is from Vanta.

We’re excited to have her on again. We’ve had her on before. All right, but before we jump into that, Andy, it is today, the day this episode drops, is election day.

[Andy Ellis] Yep.

[David Spark] I am actually receiving my mail-in ballot. I live in California, and I don’t know if you’ve seen the length of the California ballot, but it is very, very long.

[Andy Ellis] I first voted in California. I do recall how long they were.

[David Spark] Yeah, it’s very long, and there’s a lot of time spent going, “What is ballot number 12Q? I have no idea.” And then you got to research that thing. So, I’ll be spending a lot of time in front of my computer looking up everything that’s on my ballot to do my voting, but my hope is people will turn their head away from the televisions on Election Day, and hopefully everyone who’s listening has voted, and will consume some cybersecurity content, like our program.

[Andy Ellis] Maybe they’re going to run away from election coverage because no matter how you’re voting, you’re probably going to be disappointed.

[David Spark] How is that possible? One side’s not going to be disappointed.

[Andy Ellis] Oh, no, I’m pretty sure you’ll be disappointed about something.

[David Spark] Do you think everyone’s going to be disappointed?

[Andy Ellis] Yep, I mean, you’ll be happy about something, but you’ll be disappointed about something else. It’s just human nature.

[David Spark] Well, I don’t know. It’s like with anything, one side wins, one side loses. We’ll see about that. [Laughter]

[Andy Ellis] We’ll see about that. Maybe everybody loses.

[David Spark] Not trying to turn this into a political show by any stretch of the imagination. Let’s get to our guest, all right? We’ve had our guest on before at previous incarnations. Unlike you, Andy, she’s done something more with her life than you have. [Laughter] She’s currently the CISO over at Vanta, our sponsor guest, none other than Jadee Hanson.

Jadee, welcome back to CISO Series.

[Jadee Hanson] Thank you so much for having me.

What about this AI security challenge?

3:32.964

[David Spark] Can we learn any lessons about AI adoption from how cybersecurity responded to the rise of smartphones? Just like everyone had to figure out BYOD, bring your own device, Jim Spignardo on LinkedIn pointed out that BYOAI, which is bring your own AI, is getting a little traction in the workplace.

He suggested organizations have a fast-track AI adoption program now, develop a quick way to certify the tools employees want to, and probably actually already are, using. So, he also suggested creating a culture where employees feel comfortable sharing what they are doing with AI, which will also help educate other employees.

Is there a way to allow fast adoption of AI tools securely? These applications are coming quickly, and the business wants to use them, or are they simply too dangerous to let the business run free in AI? What do you say?

[Andy Ellis] So, this is one that I think is fascinating because I think when people start thinking about AI, they immediately jump to like ChatGPT and its competitors. And the reality is almost every SaaS platform out there is adding AI in.

[David Spark] Yes.

[Andy Ellis] Whether it’s your video platform, which we often don’t even think about as SaaS, they’re all adding in AI transcription services.

[David Spark] This very platform itself that we’re recording with.

[Andy Ellis] Right, this platform we’re using has a bunch of AI built in. So, I think this isn’t about like, will the employees come tell you what your AI is, it’s will the employees even come tell you what their tools are. Because we’ve been hearing for so long, CIOs reviling shadow IT. They’re like, “Oh, shadow IT, these evil people who are doing things that are unsupported.” No, these amazing people who are using tools you can’t get around to support so that they can make money for your business.

Like we need to figure out how to embrace all SaaS that happens to include AI and then understand like which SaaS is using what AI and where we want to use AI directly, we want to talk to a GenAI to do something, how are we doing that safely? But we need to understand the entire AI ecosystem, which is just a subset of the SaaS ecosystem.

[David Spark] A subset of the SaaS ecosystem. So, how dangerous is this subset? I saw you nodding your head a lot there, Jadee.

[Jadee Hanson] Yeah, I agree with Andy. I mean, I think the CISOs, CIOs, we need to figure out how to embrace this. Very much agree that almost every SaaS solution that we use today have aspects of AI embedded in it, AI features kind of throughout the products that we use. And so one of the most important things I think that we need to understand is how our data is being used within the product itself and is our data being used to train models?

This to me is like the most critical question that we need to be asking. If you’re using software that has AI features and you’ve confirmed through contracts, discussions, that the software is not using your data to train their model, I think the risk is certainly a lot lower. Training on company data certainly introduces a lot of risk that your data can be leaked or ultimately displayed to others sort of beyond your control.

And so that’s ultimately the key question that we should all be asking. I really like the section in the article, they call out this need to establish clear AI policies. I think this is important as a user of technology and as a supplier of technology, that it’s really clear how we plan to use AI within the products that we…

[David Spark] Can I stop you right there?

[Jadee Hanson] Yeah.

[David Spark] Can you boil down, just give me one example of one AI policy that sort of can right the ship because employees may run amok in a certain area?

[Jadee Hanson] Yeah, I mean, I think one of the policies that we said early on is that we will not allow the vendors that we select to train on our data. And so… Without our consent. And that goes back to the earlier point. I mean, that’s a very clear policy decision. We’re sort of saying that you will not use a product that trains on our data without our consent.

And so that is written in contract language that needs to be escalated and discussed if we do have a vendor that wants to train on our data. And then subsequently on the product side, we as Vanta have made public commitments to our customers that we will not train on their data without prior consent.

And also created kind of special opt-out features within the Vanta product if they want to use AI capabilities or not. I think that is a really important thing that we’re seeing in software.

[David Spark] That is actually very nice – vendors letting you opt in or out of the AI features.

[Jadee Hanson] Absolutely.

[David Spark] Andy, did you have a quick follow-up?

[Andy Ellis] So, I think one thing you have to make sure you’re doing when you’re writing that into contracts, anybody who’s like, “Oh, I’ll just write that into the contract,” is make sure you put in a poison clause that prevents a click-through license or later usage update from overriding that. You have to explicitly say, “And even if you change your terms of use, it does not override this contract.”

[Jadee Hanson] I love that – poison clause. [Laughter]

[Andy Ellis] Yeah. Go get your lawyers involved.

We’ve got both types of issues – compliance and regulation.

9:00.367

[David Spark] If you blinked, you might’ve missed the DoD’s rulemaking procedure for the Cybersecurity Maturity Model Certification or CMMC 2.0 framework. It’s sped through 55% faster than average DOD rules. Now there are some significant changes in the new framework, noted Steve Lieberman. Now, the big change comes with compliance.

Contractors can’t coast on certification and must now report any cybersecurity lapses within 72 hours. Wow. And the CMMC 2.0 looks to shore up third-party risk, holding contractors directly responsible for compliance by any some contractors. Now, Jadee, are these the changes in CMMC that are making contractors sweat?

What are the challenges with these compliance changes and is there anything else they should be worried about in the new framework? I mean, do you see this as a massive change?

[Jadee Hanson] I do. And so I’m really glad that we’re talking about this because for those that are doing business with the DoD or are a vendor or a company that’s doing business with the DoD or in any way, shape, or form, touching CUI, so Controlled Unclassified Information, you need to pay special attention to this.

Ever since the initial CMMC rule has been out, the DoD has been working on this very revision. Draft is out right now. I believe comments are due mid-October, and they want to have the final rule out by the end of the year. So, in this rule, there’s actually a lot to worry about. I’ll call out three things.

First of all, David, as you mentioned, it’s a lot more stringent, a lot less wiggle room. Second, there are enhanced reporting requirements.

So, in the Vanta world, we like to call these things like continuous compliance. Basically, CMMC is saying, “It’s not enough to tell us if you have a breach. We want to know when you have aspects of your program that fall out of compliance.” Personally, this is something we’re really familiar with at Vanta in the way we believe security controls should actually be monitored, no longer once-a-year check, but instead this continuous compliance check.

So, this is a big change in CMMC. And then the third really big change is the requirement flow down from CMMC-certified vendors to all of their suppliers. Now, all suppliers that have CMMC certifications will need to then focus and force these same requirements on all of their vendors. This is really big and will impact a lot of different companies that didn’t have to deal with this before.

[David Spark] This seems like something a lot of people would like, especially this third-party verifications. Andy, there’s a lot of demand for this, but the question is, does this have enough teeth on it?

[Andy Ellis] I think this one’s either toothless or it’s going to be a huge Charlie Foxtrot. Like people don’t really know how painful this is going to be to actually collect data at the level required by the text. I suspect people just aren’t going to do it. Like they’re not going to say, “Oh, no,” they’re just going to generate lots of paperwork.

Because honestly, that’s the secret for dealing with a lot of government is you can’t launch a battleship until you’ve printed as many pages as the weight of the battleship. Same thing goes here is can you just bury your auditor in paperwork? If you can do that, then you’re going to win. And I think that’s what you’re going to see a lot of folks doing.

Because this 72-hour rule on cybersecurity lapses, the reality is you have cybersecurity lapses all the time, right? Technically, somebody clicking a phishing link is a cybersecurity lapse. Do you think those are actually going to get reported? I don’t.

[Jadee Hanson] Yeah, that’s a really good call out. The other thing that I guess maybe I’m thinking a little bit more about too is the CMMC requirement for vendors. They, in large part, said like, “Okay, maybe you don’t need to be CMMC certified as a vendor of a CMMC-certified company, but you do have to have FedRAMP authorization moderate level.” And so this does increase kind of that like flow down of all these different compliance requirements and can get out of control pretty quickly.

[Andy Ellis] And functionally, they’re creating a segregated ecosystem because we’ve all moved. We just talked about how everybody’s built on top of SaaS. Most SaaS companies are not FedRAMP authorized or CMMC. And so they’re basically saying like, “Oh, if you want to be a federal contractor, you have to live in the dark ages and in-source everything or only use very specific narrow vendors for a while.”

Sponsor – Vanta

13:55.557

[David Spark] Before I go on any further, I do want to tell you about our absolutely awesome sponsor and that would be Vanta. Do you know the status of your compliance controls right now? And I mean like right now. We know that real-time visibility is critical for security, but when it comes to our GRC programs, we rely on point-in-time checks.

But get this – more than 8,000 companies like Atlassian and Quora have continuous visibility into the controls with Vanta. Here’s the gist. Vanta brings automation to evidence collection across 30 frameworks like SOC 2 and ISO 27001. They also centralize key workflows like policies, access reviews, and reporting, and helps you get security questionnaires done five times faster with AI.

Now that’s a new way to GRC. Learn more about Vanta at vanta.com/ciso.

It’s time to play “What’s Worse?”

14:58.140

[David Spark] All right, it’s time to play “What’s Worse?” Jadee, I know you are familiar with this game. You have played it before. I will have Andy answer first, and then you will tell me if you agree or disagree with Andy, and it is a risk management exercise.

[Andy Ellis] And apparently we are not allowed to tweak at all the scenarios.

[David Spark] You’re not, you have to just go with it.

[Jadee Hanson] Okay.

[David Spark] Although I can tweak them. So, this came in from Connor Biolsi of Lewis County, and I tweaked a couple of things to make it a little bit more tough, I think.

[Andy Ellis] Okay.

[David Spark] What I created.

[Jadee Hanson] Great, these aren’t tough enough.

[David Spark] We’re going to find out, we will find out. You are a financial institution.

[Andy Ellis] Which kind of a financial institution? This might matter.

[David Spark] It’s a bank, let’s say it’s a bank.

[Andy Ellis] Retail banking, private venture?

[David Spark] I don’t know. It’s a bank that requires constant uptime. That’s it, okay?

[Andy Ellis] Bank with constant uptime, we’re good. So, it’s apparently not located on the West Coast of Florida today.

[Jadee Hanson] [Laughter] Exactly.

[David Spark] No.

[Andy Ellis] For those of you who don’t know, we are recording right as Milton is headed Jadee’s way. As soon as we’re done, Jadee is fleeing.

[David Spark] Fleeing, yes.

[Jadee Hanson] Yes. I’m outta here.

[David Spark] This is how dedicated she is to CISO Series. She’s sticking around, even though a hurricane is heading her way.

[Jadee Hanson] Absolutely, dedication.

[David Spark] You’re a financial institution, and your MFA solution, that would be multi-factor authentication, is experiencing critical failures, forcing you to turn off MFA for a month. I’m also going to say all other second-factor verifications. So, if you can identify the computer they’re using, that verifies all second-factor authentication.

[Andy Ellis] But no ability to do MFA for a month, okay.

[David Spark] No MFA, but no other second factors. There’s some subtle ones you can do. Those are all off.

[Andy Ellis] Password only.

[David Spark] Yes, password only. Or your backup and recovery solution has critical failures, rendering it useless for a month. So, you either have to be a month without MFA, or any second factor, or a month without backup. You’re a financial institution, which one is worse?

[Andy Ellis] A month without MFA, this one’s easy.

[Jadee Hanson] 100%.

[Andy Ellis] It’s slam dunk, like, boom.

[David Spark] But hold on, I knew you were going to go this way but let me stress.

[Andy Ellis] I love when David’s like he doesn’t like that we so agree with each other so quickly.

[David Spark] No, no, I knew you were going to jump on this one quick. But password only means you are now as susceptible for attacks as possible. The thing is, with a situation with your backup failing, but your MFA working, you’re not as susceptible to attacks. But now with your MFA failing…

[Andy Ellis] Having no MFA is worse because I will take the risk.

[David Spark] Oh, it’s worse. I’m sorry, you said worse, I’m sorry. I thought you were saying it the other way around. I’m sorry, my apology.

[Andy Ellis] No, no, no, no, no, no, no. No, we’re in the… Look, our job is to interact with our customers. That is job number one. Like, boom, we’re going to interact with our customers. We cannot turn MFA once it’s been on. Like, that’s a non-starter. So, if you say we’re turning off MFA, you’re really saying we’re turning off electronic banking, which is not acceptable.

Or we’re running without backups for a month. Like, I guess we’re rolling the dice and hoping that Milton doesn’t hit us.

[David Spark] You are rolling the dice.

[Jadee Hanson] Yeah.

[David Spark] Like hope you don’t get hit by a hurricane, essentially.

[Andy Ellis] Basically.

[David Spark] [Laughter]

[Jadee Hanson] I 100% agree. Would love to disagree with Andy, but no, 100% agree. I think you could almost think of it in like the MITRE ATT&CK path, and this is going to be hit immediately, immediately. And so backups, yes, that might come into play, but certainly this is on the front line and needs to be prioritized first.

[Andy Ellis] Like one of these is a 100% failure, and the other is we’re rolling dice on a failure. Let’s just put it for everybody who’s listening. If you are ever presented with the scenario of we are going to downgrade authentication security for our customers, then you should just hand in your resume.

There is no situation in which that is going to be acceptable. You’re done. Everything is better than that.

[David Spark] Everything is better.

[Andy Ellis] Pretty much. Off the top of my head, there are very few categories of things. Like I sell all my customer data to the Russians, probably slightly worse, but only slightly.

[David Spark] [Laughter] Well, you could end up having the Russians take it from you anyway, right?

[Jadee Hanson] The minute you pull MFA controls, you should expect to be attacked within seconds.

[Andy Ellis] Right.

[Jadee Hanson] And so, if you don’t have the right follow-up on credential stuffing, if you don’t have the right protections in place, I mean, all of your customers will be owned. And so, I completely agree. This is very much like table stakes. It has to be in place.

[Andy Ellis] Yep. I would take my entire security team. If this was me, so I’m the CISO of a bank, and I have a large security team, whatever it is, and somebody came to me from engineering, and they said, “The MFA system that we use is broken. There’s absolutely no possible way we can keep this up or any other MFA solution.” My answer is, “Horse puckies,” a little more colorfully than that, but we don’t want to get an explicit rating.

And I will take my entire team and go solve the MFA problem because nothing we are working on is more important than that at that moment. Because I am not going to a CEO and say, “Oh, I signed off on us turning off MFA.”

[David Spark] What if the CEO signed off on that?

[Andy Ellis] Then I’m quitting.

[Jadee Hanson] Yeah.

[Laughter]

[Andy Ellis] I’m going to be fired soon anyway. I might as well quit ahead of it and at least have my dignity intact.

[Jadee Hanson] Yeah, if the CEO signed off of it, I mean, you’re just signing up for a world of problems that you’re never going to be able to dig yourself out of. And so time to do something different.

[David Spark] That is what I thought you could add. My apology at the beginning, I thought you were saying that that was the better at the very beginning.

[Andy Ellis] Oh, no, no. But by the way, thank you, David. Because there’s a handful of guests and Jadee is among them who I’m always afraid are just going to be, like, who are very skilled and are very happy to disagree with me. And so I know that if it was, like, even if Jadee agreed like 60% with me, Jadee’s going the opposite direction.

So, thanks for giving me a layup.

[Jadee Hanson] Super easy one.

[Andy Ellis] Super easy.

[David Spark] Don’t mean to make them that easy, but we still discussed it plenty.

[Andy Ellis] But sometimes I think it’s really important for people who are listening to understand that while we talk through these scenarios and they’re completely hypothetical, that some of these you should recognize that these are bright lines. Like you are not going to cross this one. There’s no scenario in which you’re going to say, “I can tolerate that.” I can tolerate no backups.

I cannot tolerate downgrading MFA.

[David Spark] I will tell you, not all of these are hypothetical.

[Andy Ellis] Oh, yes.

[David Spark] We have had some real-world ones.

[Andy Ellis] Sorry, we phrase them as hypotheticals, but.

[David Spark] We had actually – I will throw this out, the challenge out to the listener as well – we had a case, this goes back many years, where it was a real case scenario. And it was kind of something similar to something you had, Andy, where it was they saw somebody infiltrating the system. They could have shut it down to stop the bleeding, but the Feds say, “No, keep it open because we need to track them.

We need more evidence.” And so it was a “What’s Worse?” scenario.

[Andy Ellis] Yep.

[David Spark] There was a real answer to it of what they did, which was they left it open to help the Feds, although it was painful. And you had a similar situation, right?

[Andy Ellis] Yeah, that used to be the norm, and I think a lot of us have been burned by that. I once had an insider. And in fact, it’s one of the very small handful of cases that have been prosecuted for economic espionage was one of our employees. And the Feds told us it was happening but wouldn’t tell us who because they knew we would fire them.

And the case ended up dragging out for four years until the US Attorney decided to prosecute. And our execs were livid by the end of it. And it basically burned a lot of bridges to the point that we had another case and sort of in a hypothetical, let’s suppose, where you get a wiretap order and you’re told, “Oh, and as part of this wiretap, if you decide to turn off these systems, you have to notify us in advance,” right?

They phrase it that way because they didn’t want to fight with the judge about getting a, “You must leave them on,” but they want you to tell them so they can go fight with the judge.

And so because of the way it was phrased and what they obviously were going to do, somebody basically typed in the command to shut down all the systems, picked up the phone, called the agent and said, “Pursuant to the requirement to notify you in advance of turning off these systems, we’re notifying you of our intent to turn off these systems,” and they pressed Enter.

And the moment they did so, the agent said, “Do not turn them off, I will get paperwork that says you can’t do it.” And it’s like, “Too late, they’re already off.” Like you create very hostile…

[David Spark] They got a two-second warning is what they got.

[Andy Ellis] Basically because we know if we gave them any longer of a warning, wasn’t a warning, they would come back and force you to keep up systems that were inimical to your business.

[David Spark] So, I make a request to the audience, please send us real world scenarios.

[Andy Ellis] Yeah.

[Jadee Hanson] To that point, I think one of the things that I’ve experienced as well is when the Fed comes in to do their research, in large part, they’re doing a lot of the work to protect people outside of your particular case because they know these attackers are not just targeting one particular company.

And so they’re gathering as much research as they can to understand impacts across many, many companies. And so acting specifically, making decisions for your company is really the most important thing that you can do as a leader in security. And the Fed is going to act on behalf of a large group of companies, and so just kind of keeping that in mind as you’re working with them.

[Andy Ellis] Right, and they’re also sometimes recognize that you might be working with the FBI, but the US Attorney is the one who’s actually calling the shots. And they might just get distracted and they’re working on some other high-profile case. I’m in Boston, sometimes they work on mafia cases here and they get distracted on these little boring cybersecurity cases.

And it’s not even that they’re working to do something else. They just forgot about you.

[David Spark] Who could forget about you, Andy?

[Andy Ellis] Somebody working on a Whitey Bulger case.

[David Spark] That’s true, far more interesting.

Please, enough! No, more!

25:22.715

[David Spark] Today’s topic is questionnaires. Everyone’s getting excited, I can tell. It’s something we’re all familiar with if you’ve spent a minute working on compliance or third-party management. Now, questionnaires remind me a lot of Winston Churchill’s quote on democracy saying, “It’s the worst form of government except for all those that have been tried.” So, no one thinks they are perfect questionnaires, but it seems like nothing else works well enough to displace them across the business.

So, Andy, what have you heard enough about with questionnaires, of which this is an easy one? What would you like to hear a lot more?

[Andy Ellis] So, I’m tired of hearing them compared to democracy, [Laughter] even if it’s only happened once. I have got to say…

[David Spark] [Laughter]

[Andy Ellis] Democracy has a lot going for it. I love Churchill’s quote, by the way. Questionnaires have basically nothing going for them. At the end of the day, this is mostly a make-work exercise in most companies. So, I’m sort of tired of hearing about people thinking that there’s an end of the road of, “Oh, we’ll get better data, more accurate, more timely data, and do something with it.” The reality is that your vendor does not want to give you timely data, nor should they.

I’ve had people demand real-time, we want real-time updates. Excuse me, till I get a chance as a vendor to review what I would give you, you’re not going to get to see it because I don’t want to have that conversation. So, let’s stop hearing about how better, more granular questionnaires are going to solve the problem, and let’s start talking about what the real problem is you’re trying to solve and what are you going to do about it?

[David Spark] Good point. Jadee, I throw this to you. What have you heard enough about questionnaires and what would you like to hear a lot more?

[Jadee Hanson] So, I’m with Andy. I would love to hear more of how we can get rid of questionnaires altogether.

[David Spark] I think everyone hearing this is all on board.

[Jadee Hanson] Yes, I would love to see a world where we could do the continuous monitoring of key controls. So, not necessarily in antiquated, like let me report to you all my things on a regular basis. But if there’s a way to do a more systematic, continuous monitoring of key controls and less point in time, to me, I think that would be valuable, and we move away from this non-valuable paper pushing back and forth model.

I would also like to see more transparency. So, Andy, I don’t know if we disagree on this, but I would love to see more transparency from vendors as to what’s in place, what isn’t, being able to have an honest conversation. I think we all know none of our security programs are 100% perfect. And so let’s just have an honest conversation around what is in place and what isn’t.

And I can tell you the key controls that I care the most about, and I want a system way to be alerted if they start to fail, that would be lovely.

I also would like to see a bit more focus on security of the product that I’m buying versus my entire security program overall. I feel like we’re getting this wrong when we do assessments, where we are assessing the entire company, and we want to know about things that have nothing to do with the product that the company is buying or how ultimately we would be using that company’s data within the product.

And so I think we all need to get a bit better at addressing the key risks and not necessarily throwing this wide net and trying to address every security question for the entire company.

[Andy Ellis] I want to actually take that one step further. I wish that every vendor would publish a set of key controls that’s basically the shared responsibility controls. Not the way they’re protecting themselves, but the way you need to protect yourself when you’re using this product. I want it to be that this is a norm, that if you’re a vendor, you say, “Here’s the 12 things that must be configured and here’s how to monitor for them.” So, you get automatic, like boom.

Oh, you have open S3 buckets. Let’s just use Amazon as the example. Like if you’ve got open S3 buckets, you should not have to pay a third-party service to tell you. That should come baked in. If you’re using a SaaS service, it’s like, “Oh, I don’t want my data exported.” Like there’s a little button to check on that.

Show me if that button ever gets unchecked. What is the list of things, TLS enforcement, two-factor auth for all my users, all of the SaaS security posture management things, I want you to bake that into your product, so I don’t have to get a third party to build custom integrations for you. I’m okay with a third party to aggregate for me.

Like, okay.

[David Spark] Is this what the Trust Center can do, Jadee? What he’s asking right there?

[Jadee Hanson] Yeah, Trust Center can monitor all of your kind of key controls and display to all of the users of the product kind of what’s in place and what isn’t. The thing that Andy’s talking about is really interesting. It’s almost like, I go back to the SOC 2 days where they have a section within the report called user control considerations.

[Andy Ellis] Yes.

[Jadee Hanson] And ultimately it’s like, “Hey, all of these things are in place, but user of the product, you must have these things in place.” And so they’re going to say things like enable two-factor on all user access. They’re going to say things like these are the places where you need to flip encryption on or whatever it might be.

And I love that. I think that is a really great call-out because in so many different cases, it very much is like the vendor that is providing the software, but it is very much how the customer is using the software as well.

[Andy Ellis] And the vendor knows all the risks there, but they don’t tell them. I had a whiteboard full of them, which our marketing team said I wasn’t allowed to just publish a white paper to give to customers. So, every time I talked to a CISO, I’m like, “Oh, hey, by the way, here’s 10 things you need to go look at.” And they’re like, “Where is this published?” I’m like, “Well, it’s not unfortunately, but I will email you a screenshot of my whiteboard and you now have your list of things to go check.”

[David Spark] Would you be happy, both of you, if you could limit what you know about a vendor to just 10 controls?

[Jadee Hanson] Mmm. That’s a great question. I think for me, it’s a depends. I don’t know if 10 is the right number, kind of depends on risk and what the vendor is doing.

[David Spark] We could flex a couple here and there.

[Andy Ellis] I’m going to say 9 because 10 is arbitrary, but 9 isn’t.

[David Spark] Essentially, I want to come down from 200 questions.

[Andy Ellis] Yeah. No, no. So…

[Jadee Hanson] Nine is definitely the right number.

[Andy Ellis] First question is can you fill out the bit SIG and answer yes to everything in it? Or whichever standard you want. And if the answer is yes, great, I don’t need to read your questionnaire. You have figured out how to lie in a way I’ll never catch it, great. Now my other eight are, how am I going to shoot myself in the foot and what do I need to do to have that not happen?

[David Spark] We were having another discussion about this in another recording about looking at third-party security in an out-of-the-box way. And Mike Johnson said look at what the worst-case scenario for the vendor is and have that conversation with the vendor. What is your worst-case scenario that’s going to make my life miserable?

[Andy Ellis] Yep.

[Jadee Hanson] Yeah, I think that’s a really good call-out because a lot of what we’re doing with vendor management is really managing the incidents and understanding when there’s an incident, how likely am I going to get the right information, how likely am I to get transparent information from the vendor?

Am I going to know exactly what I need to do on my side? And so I think that’s really good advice from Mike in terms of preparing for something to go wrong and making sure you understand these are the things that will happen right after that.

[Andy Ellis] Yeah, like are you in the critical path for my production systems? Because if so, I care about your uptime. If you’re not, I probably care a lot less.

Managing security changes for business optimization.

33:25.440

[David Spark] “While technical controls are extremely important, another important way to enhance your security is to be sure that no gaps or unnecessary exposure exists in your contractual agreements with your vendors.” Now that’s Robert Reynolds, CISO of Orange County, North Carolina, talking about how to improve supply chain security in a recent Forbes article.

Now, another suggestion was simply making a list of fundamental questions about your supply chain you don’t have answers to. Just referencing our just previous segment here. Now, I’ll start with you, Jadee. What are some other moves we can make to improve third-party security gaps? I’m just looking for small improvement tips here, but easy to accomplish now.

I fear the reason there’s been a lot of failure with third-party security is we’re looking at the big problem and that seems daunting and impossible to fix. So, let’s just talk about small tweaks or what we call 5% or 10% better tips. What do you suggest?

[Jadee Hanson] I really liked the article. Honestly, there was some great tips in it. There’s a few that I guess I would say are a little bit theoretical. The one tip, the 5% that I think is really important is the tip around automating compliance monitoring. So, again, moving away from this point in time, “Let me send you a giant list of questions,” to a spot where you can do continuous monitoring of controls.

I very much believe this is the future of a great security optimization. So, this can show up specifically in configuration settings, so monitoring controls on configuration settings, but it also can be monitoring of contractual agreements with vendors as well. And so we talked about AI earlier, but a great application of AI is to pull these contractual controls out of these crazy lengthy contracts, get them to a point where we can pull the control out.

And then we can continuously monitoring that that control is in place and subsequently display that for the person, the customer that essentially just bought the solution that is really keen on making sure that that control that they put in the contract is continuously monitored, and then they ultimately can see whether or not it’s in place or not.

[David Spark] I like that idea, pulling out the control from the contract. Andy, what are your small tips here?

[Andy Ellis] Yeah, so I love the whole list, although I’ve got to say it’s a very long list. So, like 5% because each one, there’s like 20 things. I’m a big fan of 1% improvements. I’m not sure where I get that number from.

[David Spark] For some reason.

[Andy Ellis] For some reason. The one that I actually liked on here and it was actually on here, usually lists like this don’t have it, they didn’t call it out the right way though is make a list of who actually is in your supply chain. And I’m going to go one step further and say that needs to be a process because that list is always changing.

If you build a process as if… If somebody’s in my supply chain, I do X, Y, and Z, what you actually have created is a disincentive for people to tell you they’re in the supply chain. Because they’re like, “Oh, there’s so much work when I tell security that I exist, and so I don’t want to tell them about this vendor I signed up with.” Get a process that focuses on finding everything you’re using, whether it’s an SSPM that’s going to detect, or a shadow SaaS system that’s going to look for it, or whatever it is.

You know what we had at Akamai that made this really easy was we had no passwords on logins. We were two-factor auth, there was a key on your computer and push to your phone and every SaaS app was integrated in. And so when somebody went and got a SaaS app that they did not integrate into our single sign-on, employees reported it to me.

They’d be like, “Andy, why do I have to type in a password for this system? What did you do?” And I’m like, “Ooh, thanks for telling me this existed. Let’s go deal with it.”

[David Spark] Look, there you go.

[Andy Ellis] Probably not as scalable, but it was a great little control. Make it that you will [Inaudible 00:37:33].

[David Spark] But that’s a small little tip that fixed a problem.

[Andy Ellis] Fixed the problem. Make login easy with two-factor auth integrated into your single sign-on, and your employees will report to you when apps show up that are not integrated to single sign-on.

[David Spark] That’s a very good point.

Closing

37:50.322

[David Spark] And that brings us to the very tail end of this show. Jadee, thank you so much. I’m going to let you have the very last word here, but first I want to talk about your company, Vanta. Remember, vanta.com for all your compliance needs. Actually, many of the things we were just talking about at the end here of the show, Vanta speaks to it.

Actually, a bunch of things. What am I saying? We were talking about the CMMC. I’m sure you guys are addressing this very issue at Vanta, yes?

[Jadee Hanson] Yeah, absolutely.

[David Spark] Well, if you go to vanta.com/ciso, you get $1,000 off of Vanta if you go there. So, make sure you do just that. Jadee, are you hiring over there at Vanta?

[Jadee Hanson] We are. I have a number of roles open on my team. And as you all know, we’re a security solution, and so the need for security subject matter expertise is sort of throughout our company. And so please check out our Careers page. We have a number of roles open, and we’d love to talk to you.

[David Spark] And would it be okay if someone reached out too, we’ll have a link to your LinkedIn profile, that they heard you on the show?

[Jadee Hanson] Yeah, that’d be lovely.

[David Spark] Please reach out to Jadee and let her know.

[Andy Ellis] And Jadee is awesome. So, if you get a chance to work for Jadee, you should take it.

[David Spark] We’ve had Jadee on before and we’re thrilled to have her back on again. Well, thank you very much, Jadee. Thank you, Andy, as well. And thank you to our audience as well. We want you to send in “What’s Worse?” scenarios that are closer than the one I gave today, but it’d be awesome if they’re ones that you had to face in the real world.

And if you want to anonymize it, we can totally do it anonymously as well. And we want to know what the net choice was because it’s always kind of fun to add that story in at the end as well.

[Andy Ellis] Yeah.

[David Spark] So, please, if you can, send us real world where you had kind of a Sophie’s Choice situation and you had to pick which one of your children you were going to let go. No, we don’t need to know that. We just want a tough situation you had and what was the outcome. All right, thank you very much.

Thank you for your contributions and thank you for listening to CISO Series Podcast.

[Voiceover] That wraps up another episode. If you haven’t subscribed to the podcast, please do. We have lots more shows on our website, CISOseries.com. Please join us on Fridays for our live shows – Super Cyber Friday, our virtual meetup, and Cyber Security Headlines Week in Review. This show thrives on your input.

Go to the Participate menu on our site for plenty of ways to get involved, including recording a question or a comment for the show. If you’re interested in sponsoring the podcast, contact David Spark directly at David@CISOseries.com. Thank you for listening to the CISO Series Podcast.