CISOs never come into the role as experts in everything. But when the get the job, there’s the temptation to try to become a Swiss Army knife. Why do we try to marginally improve our weaknesses when we could be fully exploiting our strengths?

This week’s episode is hosted by me, David Spark, producer of CISO Series and Jeff Steadman, deputy CISO, Corning Incorporated. Joining us is Quincey Collins, CSO, Sheppard Mullin. This episode was recorded live at the ISSA LA Summit.

Huge thanks to our sponsors, Adaptive Security and Dropzone AI

This week’s security tip

Jump to the full tip here.

To learn more about saving costs and optimizing analysts’ capacity with a hybrid SIEM and data lake, go to anvilogic.com.

Full Transcript

Intro 

0:00.000

[Voiceover] Biggest mistake I ever made in security. Go! 

[Quincey Collins] Not firing a managed security services provider fast enough. 

[Laughter] 

[Quincey Collins] We all know how long it takes to onboard providers, whether they’re vendors or doing something else for us, but MSSPs are crucial to security operations, and lobbing alerts over the fence just does not work. 

[Voiceover] It’s time to begin the CISO Series Podcast, recorded in front of a live audience, in Los Angeles. 

[Applause]

[David Spark] All right! That I like to hear! Awesome! We are in Los Angeles. We are here at the ISSA LA Summit, our fourth year doing the show here.

[Audience members] Whoo!

[David Spark] We are thrilled…

[Audience members] Whoo!

[David Spark] …to be back again. They invite us back again and again. We are still trying to figure out why, given all the problems. We’re thrilled to be here. I want everyone to meet my guest co-host, sitting in place of where usually Mike Johnson or Andy Ellis sit.

It is the deputy CISO for Corning Incorporated, Jeff Steadman. Let’s hear it for Jeff!

[Audience member] Whoo!

[Applause]

[Jeff Steadman] Hello, audience. 

[David Spark] Say hello to our audience. 

[Jeff Steadman] Hello. 

[David Spark] All right. That’s his voice. You’re going to hear a lot more of him. By the way, we’re available at CISOseries.com, where you can find all of our wonderful programming, but don’t go there now. Those of you in the audience, if you’re listening, if you’re driving, don’t go there right now, but you can go eventually.

Let me tell you about our wonderful sponsors. We have Adaptive Security, next-generation security awareness. Let’s hear it for Adaptive. 

[Applause]

[David Spark] And Dropzone AI, AI SOC analysts that never sleep. You’re going to hear more about them later in the day. Now, you and I were chatting, Jeff, just earlier. You were given some – when you were, I don’t know if you were starting out, if you were well into it – but you were given some really, really good advice of dealing with an incident.

What was that? 

[Jeff Steadman] So, it was early on in my career, David. 

[David Spark] So it was, okay. 

[Jeff Steadman] Yes. Yeah, absolutely. And I was in a training course, hadn’t had the opportunity to handle an incident yet, and the instructor says, “You can’t outrun a packet.” And sitting back, it really, you know, reflecting on that, it’s the adrenaline’s going to overtake you.

You’re going to throw your incident response playbook out the window. Don’t do those things. If you’re working too fast to take notes, you’re just working too fast. 

[David Spark] That is a really good point. In fact, actually, I don’t know if you saw it. We shot a video at Black Hat where I asked people, what do they not teach you about dealing with incident response? And you kind of hit the nail on the head. The big thing that we got from a lot of people was they don’t teach you about the stress at all.

That’s something you have to experience on site. All right, I want to introduce our guests and get into the show. To my far left here, he is the CSO for Sheppard Mullin, none other than Quincey Collins. Let’s hear it for Quincey!

[Applause]

[David Spark] Say hello to the audience. 

[Quincey Collins] Hey, everybody. Such a warm welcome. I’m really appreciative to be in front of you all today. 

How is AI going to solve this problem? 

3:09.317

[David Spark] All right. Since modern LLM tools came onto the scene, how will the next generation learn cybersecurity when AI takes over entry level work? So, Helen Patton of Cisco asks this very question and she’s struggling to find satisfying answers beyond theoretical suggestions such as AI-led coaching.

So, this reminds me of learning long division in school. We all know how to do it, and it helped us learn mathematical concepts, and that’s about it. I mean, nobody uses it. I mean, is there a long division of cyber that’s still necessary, or can we skip straight to the conceptual understanding of cybersecurity?

Is there some grunt work that’s just a must-do in cybersecurity? So, I’m going to ask you first, Jeff, where are we overthinking this transition? It is happening. Or is there real risk if we lose grasp of these foundations? 

[Jeff Steadman] That’s a great question. I think that for me, I’ll talk about the long division aspect of this and then the overthinking aspect of it. So, the long division component is really looking at that foundational level of work. We’ll never really get rid of that.

The understanding of confidentiality, integrity, and availability and how that applies into the environment to protect that business, that’s very important. So, the other aspect is the overthinking. Certainly not overthinking how AI impacts the business and how your roles are going to be impacted.

So, you have to plan for those entry-level workers to shift, learn how to do the new tools, use the new tools, and use the new skill sets along the way, but it’s not just for those entry-level workers. It’s for everybody on your team. 

[David Spark] All right, Quincey, I throw it to you. By the way, have you thought about this? If AI is going to take this, how are we going to groom the next crowd? Aren’t there some basic concepts? Like, I had to learn this. They should too. 

[Quincey Collins] So, conceptually, I think it’s really important to note that cybersecurity starts with information technology. So, it’s really, at its core, it’s an information technology problem. You have to understand information technology if you are to actually secure a system.

And in order to investigate, you need to understand how computers work, networking, cloud and whatever it is that you’re trying to secure. So, looking at how these young folks and other individuals who are transferring into cyber are supposed to learn, they’re going to have to do it the old-fashioned way if they really want to have that deep, deep foundation on which they can build.

Because I think today, there’s a little bit of a problem in cybersecurity, and that everyone’s looking, not everyone, but many folks are looking for a shortcut. And I’m here to tell you… 

[David Spark] Well, AI is kind of providing some shortcuts, don’t you think? 

[Quincey Collins] I’m here to say that there are no shortcuts. AI is a tool that we can utilize, but you have to have the wherewithal to understand if the AI is potentially giving you some incorrect information, or it’s missing valuable contextual information about your organization, or whatever it is that you’re trying to secure.

[David Spark] Jeff, the two of you think of this way of like you got to learn it even though AI is there, kind of like we had to learn it even though we had calculators. Is there going to be this potential backlash of, no, I can just do it because I know how to ask the question?

[Jeff Steadman] I’m sure there will be, but from an understanding perspective, that means your workforce is going to be a little weaker, right? So, that context, as Quincey was referring to, it’s key. It’s the key to the success and understanding what’s actually happening.

[David Spark] You won’t know if AI is telling you the right answer.

[Jeff Steadman] Exactly. 

Where does a CISO begin? 

6:54.778

[David Spark] “Your fully exploited strengths provide far more credibility than your marginally improved weaknesses,” Jerich Beason, who’s the CISO at WM, argues at the myth that a security leader needs to be good at everything. Unless it’s a very small company, rarely will you need to be a cyber Swiss Army knife.

Build credibility by making your strengths your signature, while hiring for your weaknesses, said Beason. Now, leaders don’t need to be experts in everything. Knowing that and being open about that speaks volumes. Even if you don’t know it all, always be prepared to ask intelligent questions to any audience.

If you can’t, your credibility can take a hit. So, I’m going to start with you, Quincey. How can you be, I mean, this really seems critical for a CISO or CSO, how can you be omnipotent without being an omni expert? 

[Quincey Collins] I think the focus for CISOs and CSOs out there is to be able to ask the right questions of the executives that they’re working alongside, their security team that’s working with them, and the right questions of the business. So, you don’t necessarily need to be an expert in every single area and every facet of cybersecurity, but I think you do need to tread water in order to be able to make it to shore, if that makes sense.

You’ve got to know about encryption. You’ve got to know about what it is that your business is doing. You’ve got to know about cloud, if that’s where you are. So, it’s very contextual what it is that you need to know, but from a foundational aspect, you have to be strong enough to be able to ask the right questions and lead your organization in the right direction with minimal risk or minimizing the risk that is associated with bringing in technology and other associated business processes in your business.

[David Spark] Jeff, let me ask you, have you ever had a situation where you actually did not know the right question, and you said, “What question should I be asking?”

[Jeff Steadman] Regularly. 

[Laughter] 

[David Spark] All right, good. 

[Jeff Steadman] And it’s important because, your perspective, you’re bringing one lens. It’s important to ask your team, your stakeholders, what is it from their perspective that they see is the challenge or the issue. So, to Quincey’s point, asking those questions is important, digging down deeper, whether it’s business, your team, understanding your gaps, and making sure you’re hiring for those gaps so that you have the right people surrounding you to get to that right answer, making sure you’re providing value back to the business.

[David Spark] I’m sure the two of you had maybe, for your time, higher technical capabilities, and once you moved into the managerial role, that slid. I mean, did that totally happen for both of you? 

[Quincey Collins] Unfortunately, yes. My technical capabilities have diminished. They haven’t perished, but they have diminished. 

[David Spark] Right. And I will say I always hear this, I hear it all the time, and there’s a little loss for the enjoyment of that, but you realize, it seems this is the right sacrifice I have to make, yes? 

[Quincey Collins] I think it’s kind of twofold. One, from a practicality standpoint, you want to be able to do everything, right? But at the same time, you shouldn’t. As an executive, that’s not your role to tighten down the bolts, right? Your role is to lead the strategy of an organization and figure out the best path forward, even if you don’t have all of the information.

A lot of CISOs out there are doing their best with what they have, and unfortunately, you can’t always hire for the most technical folks or the most expensive folks or the folks with X amount of experience. So, you have to do the best you can with what you have.

[David Spark] Similar experience for you, Jeff, in terms of living sort of that technical expertise slide? 

[Jeff Steadman] I think I’m still not acknowledging that point yet. 

[David Spark] Okay. [Laughter] 

[Jeff Steadman] I do enjoy getting my hands down into logs and reviewing the work that the team does to the point that they ask me to let them do their job, but it also gives me that opportunity to ask those questions to make sure that we’re covering our bases.

Sponsor – Adaptive Security 

11:06.930

[Voiceover] Who’s our sponsor this week?

[David Spark] We have two phenomenal sponsors, and I’m going to tell you about both of them, but first, we’ll just talk about Adaptive Security. So, they’re actually OpenAI’s first cybersecurity investment. So, AI-powered social engineering threats like deepfake voice calls, GenAI phishing, and vishing attacks are all evolving fast.

We know this. Adaptive helps security leaders get ahead with an AI-native platform that simulates realistic GenAI attacks and delivers expert-vetted security awareness training all in one unified solution. 

And now, with Adaptive’s new AI content creator, security teams can instantly transform breaking threat intel or updated policy docs into interactive multilingual training. No instructional design is needed. That means faster compliance, better engagement, and less risk.

Trusted by Fortune 500s and backed by Andreessen Horowitz and the OpenAI Startup Fund, Adaptive is helping security teams prepare for the next generation of cyber threats, and you can actually learn more by going to AdaptiveSecurity.com. It is spelled exactly the way it sounds, AdaptiveSecurity.com.

And when you go there, let them know that you heard about them from the CISO Series. 

It’s time to play “What’s Worse?” 

12:37.654

[David Spark] All right. We have been doing this game since the very beginning of the CISO Series, and I have a very creative scenario here, and it comes from Erkan Sertoğlu of sahibinden.com, and here we go. It’s got a Marvel theme to it. You’ll like this.

Now, I’m going to make you answer first, by the way, Jeff, and you will agree or disagree, Quincey. All right? And you have to give a good argument for which one is worse.

[Laughter] 

[Quincey Collins] You’re going to turn us into enemies here. 

[David Spark] Yeah, here we go. You can agree or disagree, whichever way you want to go. All right. During the age of Ultron Era, Captain America was presented with a disturbing cyber intelligence report from the Avengers. The team had detected two separate threats, each alarming in its own way.

So, I’m going to describe each threat. You’re going to tell me essentially which one is worse. So, the first report warned that Ultron had developed a swarm of nanobots capable of bypassing any physical security mechanism without triggering alarms.

These nanobots could physically access the Avengers’ backbone switch or any other system and manipulate hardware components undetected. Pretty darn bad, yes? 

[Jeff Steadman] Yeah, it’s no good. 

[David Spark] Yeah, no good. All right. The second one’s pretty bad too. Second report warned that Ultron had managed to break message encryption keys based on 128-bit TLS cipher suites. He achieved this by leveraging a multidimensional quantum algorithm combined with brute force attacks, provided he captured enough data packets.

Now, the captain does not know which report is more possible. So, really the question I have with you is, which threat should he prioritize? Which one is worse? So, is it the physical nanobots or is it the fact that the encryption keys have been completely bypassed?

[Jeff Steadman] I just want to say both of these are terrible, but I’m going to go with the nanobots. The nanobots themselves… Actually, can I change that?

[David Spark] Hold it. Now you want to go to encryption?

[Jeff Steadman] Yeah, I want to go to the encryption is worse because, you know… 

[David Spark] Hold it. Wait. You started with the nanobots. 

[Jeff Steadman] I know. 

[Laughter] 

[David Spark] You lasted like… By the way, I don’t think we’ve had anyone last that short on a decision before. [Laughter] All right. So, you have switched from nanobots to encryption. So, you think encryption is worse. Why?

[Jeff Steadman] The encryption is worse because if the nanobots get in and I’m using encrypted traffic, then I’m not really worried about the nanobots, right? So, if they’re coming across my switch and they want to look at it, great. Have a field day.

As soon as you can break that encryption, they just need access to the data and enough data, and then you’re done. 

[David Spark] All right. Good point. But I got to point out that there’s a lot of damage that can be done without accessing data. Yes, Quincey? 

[Quincey Collins] Yes. 

[David Spark] Okay. So, which is worse? 

[Quincey Collins] So, they’re both very bad. 

[Laughter] 

[David Spark] Yes.

[Quincey Collins] I got to say… 

[David Spark] There’s no doubt on that. 

[Jeff Steadman] So we agree, Quincey.

[Quincey Collins] We absolutely agree. 

[David Spark] You have agreement on that. 

[Jeff Steadman] We’re good, we’re good.

[Quincey Collins] I’ll just add that if the nanobots had access to the switch, they can then likely penetrate the network. So, it’s actually a confidentiality, integrity, and availability risk compared to the confidentiality risk of breaking the encryption.

So, I would go with the nanobots. 

[David Spark] Are far, far worse? 

[Jeff Steadman] Yes! 

[David Spark] I want you to know that Erkan, who sent this in, he considered the physical breach worse because he feels like, well, you could just upgrade to stronger encryption, 256-bit keys, if you wanted to. 

[Jeff Steadman] Well, maybe, but if I’m operating in the cloud, what are you going to go get on my switch, I’m not going to have a switch. 

[David Spark] Good point. I want to know from the audience, how many people think the nanobots is the worst scenario? By applause, how many people? 

[Applause]

[David Spark] Okay, who raises their hands for a podcast?!

[Laughter] 

[David Spark] All right. A lot of people. So, a lot of people are agreeing with you, Quincey. All right. By applause, how many people think that the encryption is far, far worse? By applause. 

[Applause]

[David Spark] You switched so quickly. 

[Quincey Collins] I did. I did. Yeah.

[David Spark] I think the audience was on your side at the beginning. Did someone dissuade you from the audience? Did you get like an evil stare? 

[Quincey Collins] The sun got in my eyes because we’re near the beach, David. 

[David Spark] There’s barely [Laughter] any sun out. There’s a lot of cloud cover.

[Jeff Steadman] It’s cloudy. 

What is Dave’s mom talking about? 

17:12.066

[David Spark] All right. My mom is not a cybersecurity expert. She’s an elderly woman who is very kind to her son, and when her son comes up with a really stupid idea for a game, she plays along. So, here’s how this works. I asked my mom to describe different terms in cybersecurity.

I will tell you, these are all different variations of wrong. Okay? You know what these terms mean. You definitely know what these terms mean. You have to try to determine from her, just hearing these words, not knowing anything about cybersecurity, try to figure out what the heck she’s talking about.

All right? I’m going to play each clip. Just jump in when you know it. If you guys can’t figure it out, we throw this to the audience. All right, here we go. Here’s the first one. 

[Dave’s mom] Stand up straight to stop someone from breaking in. 

[Jeff Steadman] Firewall. 

[David Spark] I’m going to tell you that that first line, stand up straight, is critical. 

[Jeff Steadman] It’s tough. 

[Quincey Collins] Yeah. I got nothing. 

[David Spark] Oh, God. 

[Infrasound]

[David Spark] All right. Hold it. Somebody could yell it really loud. What do you think? 

[Audience member] Security posture. 

[David Spark] Security posture!!

[Background voices] Sir! Yes, sir!

[Laughter] 

[David Spark] Very good. Very, very good. Excellent. All right. One for the audience. Zero for the two of you. 

[Laughter] 

[Audience member] Audience is rocking.

[David Spark] Yes. Audience is kicking ass. All right. Here we go. 

[Dave’s mom] Someone cheating and looking into your data. 

[David Spark] There’s a semblance of correctness here, there’s a little bit here. Come on, jump in. I’m going to buzz you out on it.

[Jeff Steadman] Buzz us out. Buzz us out. 

[Quincey Collins] Oh, this is tough.

[Jeff Steadman] That’s a tough one. 

[Quincey Collins] This is the hardest test that I’ve taken. 

[Laughter] 

[Background voices] Oh, no!

[David Spark] All right. And we’re going to the audience. The audience is going to crush you. All right. Anyone know this one? I’ll play it again. 

[Dave’s mom] Someone cheating and looking into your data. 

[Audience member] Attacker?

[David Spark] Not lateral movement, not pentesting. 

[Audience member] SSL script?

[David Spark] No.

[Audience member] Hacker?

[Audience member] Hacker?

[David Spark] No, not hacker. 

[Audience member] AI?

[David Spark] This one may be too tough. This is spyware. All right?

[Audience] Aww.

[Audience member] [Inaudible 00:19:26].

[Dave’s mom] Someone cheating and looking into your data. 

[David Spark] You see they’re spying into your data?

[Jeff Steadman] It’s kind of right. 

[David Spark] She’s kind of got it right. 

[Quincey Collins] Yeah.

[Jeff Steadman] All right.

[David Spark] Here we go. Here we go. So, one for the audience, zero for everybody. Here we go. 

[Dave’s mom] It’s hard to believe, but some people will be good when they get into your information. 

[David Spark] I think you can get this one. Want to take a guess on this? 

[Jeff Steadman] Ethical hackers. 

[David Spark] So close, so close. Extremely close. Quincey, you can take this. Very close. 

[Quincey Collins] A black hat. 

[Jeff Steadman] White hat. 

[David Spark] White hat is correct! 

[Winning bell]

[Audience member] White hat!

[David Spark] Good job! Very, very good. All right. 

[Jeff Steadman] That was a combo win. We should each get a point, David. 

[David Spark] No, no, no. 

[Jeff Steadman] Everybody gets a point. 

[David Spark] No, he said black hat. He was completely off. He was completely off. 

[Laughter] 

[Quincey Collins] I was like, what? 

[David Spark] In terms of brainstorming, we would consider that a win because good ideas come from bad ideas, but since you’re playing a game and you’re not brainstorming, Quincey loses, you win.

[Laughter] 

[David Spark] All right. 

[Jeff Steadman] There we go. There we go. 

[David Spark] So, one for the audience, one for Jeff, Quincey’s got zero. You can redeem yourself. It could be a three-way tie here. Quincey, last one. 

[Quincey Collins] All righty. 

[David Spark] Here we go. Okay, I just want to stress, everyone in this room knows it. My mother does not. 

[Dave’s mom] An online streaming service that is so unusual, few people know about it. 

[David Spark] Okay. It’s so not right. 

[Laughter] 

[David Spark] But again, if you had heard it for the first time, this is probably how you’d describe it and you didn’t work in cybersecurity. I’ll play it one more time for you. 

[Dave’s mom] An online streaming service that is so unusual, few people know about it. 

[Quincey Collins] Wow. Yeah.

[David Spark] Nothing?

[Quincey Collins] Nothing. Nothing intelligent to say. So, I’ll just come with the first thing that I think she might have thought about was security certificate, maybe?

[David Spark] Oh, God, no. 

[Laughter] 

[Quincey Collins] I don’t know.

[David Spark] No. By the way, your intelligence is what’s hurting you here. 

[Laughter] 

[Quincey Collins] Hmm. Yeah. 

[David Spark] You don’t…

[Quincey Collins] Give me the buzz. 

[David Spark] Yeah. Well, all right. We’re taking this to the audience. I’m going to play it again for you. 

[Dave’s mom] An online streaming service that is so unusual, few people know about it. 

[David Spark] Anyone want to take a stab at that one? What do you got? 

[Audience member] Zero day.

[David Spark] No, not zero day. 

[Audience member] Roku? 

[David Spark] No. 

[Audience member] Netflix?

[David Spark] No. It’s a security term. 

[Audience member] Oh, security term. 

[David Spark] Anyone want to guess this? Come on. You’re going to hate yourself when you hear the answer. 

[Audience member] I love your mom though. 

[David Spark] Yeah. Well, we all love my mom.

[Laughter] 

[David Spark] Anyone? It’s a virtual private network. 

[Groans]

[David Spark] There we go. 

[Quincey Collins] Oh. Wow. Wow.

[Audience member] Mom. 

[David Spark] [Laughter] 

[Audience member] Your mom crushed it. 

[David Spark] My mom won is who won. 

[Laughter] 

Is this really the right strategy? 

22:25.515

[David Spark] This is a really fun creative discussion. Should your next strategic hire be an artist instead of another analyst? Now, that’s a question raised by Annalise Lewis and Laura Melissa Williams of Manifesto, who argue that businesses have sidelined the artist’s mind in favor of data obsession and engineering solutions.

Their case for strategic artists includes roles like director of strategic imagination and narrative systems architect, arguing that artists thrive in volatile spaces. Now, there’s a precedent for creative minds in security. After 9/11, the CIA reached out to screenwriters like Lawrence Wright to help imagine terrorist scenarios.

So, I’m going to start with you, Jeff. Do you actually see value, and maybe you’ve already done this, in bringing artistic thinking into cybersecurity strategy? And have you chosen that over a qualified traditional candidate and define that the way you want?

Or does it sound like a nice to have, but not top of the list? 

[Jeff Steadman] For me, I think it’s a nice to have, not at the top of the list, but I’m going to qualify that a little bit with it’s important to bring in differing perspectives, right? So, when you have somebody that maybe is not that traditional candidate, creative or otherwise, they’re going to provide that angle or lens that you may not think about into your processes and hopefully update those to make them a little more modern.

I think it’s more important that we consider hiring for what I call the three A’s, which is attitude, aptitude, and appetite. So, if you have those three great qualities in any teammate, then they’re going to bring value back to the business. But I think the real winner here is if you have somebody that’s working in your business that wants to get into cybersecurity, they’re bringing that business value to the team.

[David Spark] By the way, I couldn’t agree with that one more. All right. Same question to you regarding bringing in the creative minds. Is it a nice to have, or this is kind of we can move this to the top of the list? 

[Quincey Collins] I’m a fan of the whole person concept. I wouldn’t set aside one quality for another. I look at the entire person whenever it is that I’m hiring for a security operations job or auditor job. A lot of people want to look at, hey, how many certifications do they have?

Where did they go to school, or what was their experience? But you got to kind of package all of those things and then ask yourself, is this the right culture fit? How’s this person going to fit in the team? And then how does their mind work, right?

Give them some situational problems. And not necessarily looking for the right answer but understanding their thought process because that could be indicative of how they’re going to attempt to solve problems. 

[David Spark] So, I’m interested in how you do that. We’ve heard a lot from our audience. They’ve taken our “What’s Worse?” scenarios and asked them to, like for job interviews with candidates. Have you done that, like either through a job interview or just sort of challenging the team in general?

Like, “What would you do in this scenario?” Or another classic case is when a big hack happens, you sort of study it from your angle, like had this happened to us, how would we handle it? Have you sort of done challenges like that? 

[Quincey Collins] So, the way we internalize and kind of work through problems that we’ve seen out in the real world is we don’t necessarily game plan and say, hey, what would you have done? We just kind of look at, hey, does this problem potentially exist in our environment, and what does that remediation strategy look like?

So, a few years ago, we had a situation where there were lots of remote management tools out in the real world that were being exploited. Large companies, small companies, medium-sized companies were actually being exploited via remote management tools.

So, we decided, hey, we’re going to look at our firewall, block it from an application perspective, look at the endpoint, and then create alarms in our SIEM. So, are you able to detect it? Are you able to prevent it? And then what are you able to do moving forward?

And then we actually update that list every six months or so or when something interesting happens. So, we don’t necessarily game play and say, “Hey, what would you do?” We kind of look at, hey, what’s the threat? What’s the risk to our environment?

And then use our auditors to make sure and audit that process, make sure that it’s buttoned up nicely. 

[Jeff Steadman] So, it’s really like if the assessing that incident in the public that happened to somebody else to see if that risk applies to you and how you need to go address that risk in your environment. So, it really boils down to assessing your environment to know if that risk applies and then taking the appropriate action.

[Quincey Collins] Oh, absolutely. We love to learn from others so that we don’t have issues internally or at least try to prevent them. 

Sponsor – Dropzone 

27:04.308

[Voiceover] Who’s our sponsor this week?

[David Spark] Picture this. Your SOC gets a suspicious login alert at 3:00 in the morning. It sits in the queue for six hours because your night shift is overwhelmed. By morning, if it’s real, the attacker has moved laterally through your network. Here’s what changes everything.

Dropzone AI doesn’t just enrich alerts, it actually investigates them like your best analysts would. It pulls logs, checks user behavior patterns, correlates with threat intel, and builds a complete evidence chain, all in under 10 minutes autonomously.

No playbooks to maintain, no code to write. It learns your environment and gets smarter with every investigation. Now, while other tools generate more alerts, Dropzone eliminates the backlog. Your analysts get detailed investigation reports, not just enriched data.

Stop letting real threats hide in your alert queue. Visit their site, it’s dropzone.ai, to see autonomous investigation in action. That’s dropzone.ai, and when you go there, let them know you heard about them from the CISO Series. 

Surprising research just in! 

28:24.881

[David Spark] “When we zoom out and look at the last 100 years of business history, it becomes painfully clear that cybersecurity risk is important, but rarely truly existential,” and that’s what Ross Haleliuk of Venture in Security said. And he noted this on LinkedIn, that market risk, execution failures, and strategy mishaps close doors a lot more often than cybersecurity issues.

And in fact, security researcher Adrian Sanabria has taken this further, maintaining a spreadsheet tracking companies that actually went out of business due to cyber attacks, and the list is remarkably short, 17 over the last 10 years. So, this challenges cybersecurity’s sense of self-importance.

We often act like we’re the only ones keeping the barbarians at the gates. So, I’m going to start with you, Quincey. How do you balance the still very real threats of cyber attacks with the industry’s tendency towards dramatic overstatement? We’ve heard of FUD.

And does acknowledging this diminish cybersecurity’s importance? What do you think? 

[Quincey Collins] My first question is who is shooting out all the FUD, right? I think if we look at the marketing behind a lot of the new security tools that are out there, many of them are unproven, right? So, especially the new things that are leading edge.

So, we have to just be careful not to purchase expensive paperweights, but to really kind of be right behind that leading edge just to keep pace with the attacks that are out there. The most important part for me regarding information security and keeping a tight grip on my network is training my team, making sure that they’re available, making sure that they stay on the team.

There are a lot of things associated with keeping pace with the current landscape of information security that’s going beyond fear, uncertainty, and doubt. You’ve got to stay behind the eight ball and keep your foundation with regard to information security and just keeping your head in the game.

[David Spark] All right. Now, do you feel, maybe your own team feels this way, or you feel this way, but the business may not acknowledge cybersecurity as being that important, like it’s going to crush the business. Like, where do you say it’s important, but we’re not going to wreck you?

Or like how does it play? I mean, but I’m sure you kind of have these discussions, yes? What’s like, “This could wreck us, this couldn’t”? 

[Quincey Collins] So, every business unit is important. The role for information security and myself is to mitigate risk for the business. So, with that in mind, there are other factors at hand when you’re thinking about cost, when you’re thinking about allocation of resources, and when you’re thinking about security controls.

So, information security is important, but there are other more important, many times, factors which may play into your decisions. Now, I think it’s also important to note that there’s a risk appetite associated with the decisions that you make, and it’s our role to make sure that everyone involved and the decision makers that are involved are aware of the risks and sign off on those risks associated with whatever it is that you’re doing.

I think it’s just vitally important that you have the business lens in front of you, rather than just a purely information security lens because that’s kind of self-serving. 

[David Spark] And by the way, that’s very much staying within the theme of the CISO Series. Jeff, what can you add to this? 

[Jeff Steadman] Well, first thing, I want to go back and challenge the numbers on the 17. 

[David Spark] Just so you know, you can look this up, Adrian Sanabria, it’s an open list. I mean, I don’t know if you can edit it directly, but you can contact him and he updates it. He’s always looking for information. 

[Jeff Steadman] Well, let me explain why I want to challenge it, right? 

[David Spark] Okay.

[Jeff Steadman] So, it’s not just those 17. That impact to those 17 has a ripple effect into a supply chain that causes an impact there, and I would hazard to guess that there are more than 17 that were impacted because of a single cybersecurity event.

[David Spark] I’m not arguing. This is literally doors closed because of a cybersecurity incident. No question that companies get impacted, yes. 

[Jeff Steadman] Right, right, right, right. Yeah. So, I completely agree with Quincey that you need to communicate candidly to the business about risk. That’s more important. And there are times that the business is going to look over and say, “All right, we’ll accept this particular risk,” and you need to understand that risk and where you should be allocating your funding to then secure the environment.

AI-infused security operations tip of the week – Anvilogic 

33:10.796

[Voiceover] It’s time for this week’s security tip. This week’s AI-infused security operations tip is sponsored by Anvilogic. 

[David Spark] A truly mature SOC doesn’t exist solely to react to threat alerts. It must also actively hunt threats down. This is a shift from reactive to proactive, and this is exactly where AI shines. Since it’s capable of analyzing enormous volumes of telemetry, such as logs, endpoints, network data, and cloud events, AI is best suited to uncover weak or hidden links that no analyst could ever find manually, at least in a timely fashion.

AI pieces together relationships across systems, correlating indicators that appear harmless on their own, but which form a pattern when they are seen together. A series of low-level authentication anomalies might go unnoticed by busy humans, but when they are spotted and connected, that’s where they could reveal lateral movement in progress.

AI-fueled hunting transforms seemingly random noise into investigative leads. Human expertise still guides the process. They’re not redundant. Humans are best at deciding which anomalies to pursue and which to dismiss. Your SOC can build hunt libraries, which are informed by AI insights, and which continuously learn from successes and false positives, allowing you to keep your eyes on the horizon, as well as the ground right in front of you.

[Voiceover] To learn more about saving costs and optimizing analysts’ capacity with a hybrid SIEM and data lake, go to anvilogic.com. 

It’s time for the audience question speed round. 

34:57.759

[David Spark] All right, I have here in my hand a series of questions that I’ve gotten from many of you, and we’ve actually got a good amount of time, so I think hopefully we can get through a lot of these, and this first one is quite interesting. I learned this from Richard Rushing, who’s here in the audience right now.

He is the CISO over at Motorola Mobility, and they have Copilot running in their environment, and he just had Copilot volunteer, he didn’t ask for this, volunteer this very information. It said to him, “You’ve been working a lot. You deserve a raise.”

[Laughter] 

[David Spark] My question to you is how dangerous is this? That Copilot volunteered this to him, and I’m sure possibly his team as well, how dangerous is that? 

[Jeff Steadman] I think it’s really dangerous if you’re not classifying your data accordingly and maintaining those controls where Copilot has unfettered access to information like that. 

[David Spark] So, they know his salary, they know how hard he’s working. He knows maybe what his salary may be compared [Laughter] to other CISOs, things like that. 

[Jeff Steadman] Yeah, that’s certainly a challenge. I wonder, did you take more time off? 

[David Spark] [Laughter] 

[Quincey Collins] I think this highlights the fact that the risks don’t just lie with information security departments or information technology departments. It goes to the business units, it goes to HR, it goes to general counsel, your legal department.

So, AI, technology, usage of whatever systems that you’re utilizing, it actually, it encompasses the entire business. So, many more people should be in the conversation about technological risk, whether it’s AI or otherwise, rather than just information security.

So, yes, it is dangerous. AI is watching, right? 

[David Spark] Mm-hmm.

[Jeff Steadman] There’s a level of education that needs to occur with the entire business to ensure that you’re secure. 

[David Spark] Also, these types of questions could be wake-up calls like, “Oh, maybe it should be. We maybe have to tighten this thing a little bit.” All right, here we go. From Matty Keene of KForce asks, are you seeing fraudulent candidates coming through for jobs, and if so, how are you handling it?

[Quincey Collins] Fraudulent candidates. I mean, what’s the definition of a fraudulent candidate, right? So, are they in a location that is unexpected? Are they working multiple jobs at the same time during the same hours? There’s a movement behind that.

[David Spark] Mm-hmm.

[Quincey Collins] Are they in an adversarial nation that is potentially looking to infiltrate your environment? So, there’s a lot of different aspects of a fraudulent worker, and you have to have strong HR controls. 

[David Spark] But are these conversations you’re having with HR? Okay, so that’s good. So, you are, so you can see this kind of stuff if it’s coming in. 

[Quincey Collins] You can only see what you’re aware of.

[David Spark] Mm-hmm.

[Quincey Collins] So, there’s always going to be a residual risk of someone, some candidate or some group slipping through, but I think it’s just important for organizations to have a plan for vetting applicants as they come in, and what does that new hire onboarding process look like, right?

There are currently laptop farms that are in different states and people being paid to wiggle the mouse, so to speak, and log in so that individuals from other countries can actually work in US organizations, and it’s quite scary, actually, and it’s just like having a physical security breach, actually, and maybe even worse, right?

They could exfil your data and then try to sell it back to you. So, you’re only as strong as the controls that you have. So, you have to do the best you can and communicate that risk, and hopefully your process is going to pull up a flag at some point during that process.

[David Spark] All right, let’s go to the next question. For you, Jeff. I like this question from Malka Bondar of FIRA Global. How do you define sensitive data? 

[Jeff Steadman] I actually don’t get to define sensitive data. That’s really up to the business, right? So, from that aspect. 

[David Spark] Have you ever had this, where they go, “All my data is sensitive”? 

[Jeff Steadman] Yeah.

[David Spark] I’m sure you’ve heard that line. 

[Jeff Steadman] I think everyone in the room has heard that particular, right? 

[David Spark] Then you kind of don’t you have to act like a Sherpa or a guy going, “All right, what is the concern of this data? What’s the concern…” Like, do you have to kind of work them through it? 

[Jeff Steadman] Yeah, I think it’s a consensus of stakeholders too, right? So, if you look at a particular segment of the business, depending upon who you’re talking to, everyone thinks that their data is special.

[David Spark] Right.

[Jeff Steadman] And a portion of that data is certainly special. You really need to tie it back to the business value. 

[David Spark] All right, quick. How do you define sensitive data? 

[Quincey Collins] It’s defined by the business. It’s defined by the system owner, the data owner, and it’s your job to make sure that it aligns with the data classification policies that you have, and different laws and regulations associated with the data that you’re attempting to protect.

I think that’s the most important part. And then that will flow down to your data loss prevention policies and data tagging, all of that. 

[David Spark] All right. I like this question from Amy Chaney, Citi right here. What security strategies, just pick one, are you abandoning because they do not work anymore? Maybe they worked at one time, but hey, it’s not now. What do you think? Either one of you.

[Quincey Collins] I think the old strategy of defense in depth is going to remain. It keeps getting repackaged over and over again. Now it’s zero trust. 

[David Spark] Right. 

[Quincey Collins] But I think confidentiality, integrity, and availability, defense in depth, those old-school information security definitions and frameworks, if that’s what you want to call them, are going to continue to be repackaged as we move forward.

We’re just going to put different technology, new technology, and new innovative ways of securing our systems and data enclaves moving forward. So, I’m not abandoning anything because I think it’s a lesson that you learn with each thing that you do.

You just keep it in your back pocket. You never know when it might be useful. You got to use that 10-millimeter wrench at some point, you know? 

[Jeff Steadman] Yeah, it’s expanding, I think. So, everything you said, yes. Ditto, right? I think the component is that you’re adding on. You’re taking a different context to talk about data specifically, to protect the data, versus just your perimeter, just a host.

And then you’re moving into that identity space. I need to protect the identities, whether that’s an actual human account or maybe it’s an agent for AI and their identity. 

[David Spark] All right. Very last question from Richard Greenberg, who is running the whole show here with the ISSA. We love Richard. Let’s hear it for Richard. 

[Applause]

[David Spark] There he goes. All right. We’re closing with this question. I love this question. I mean, the discussion of AI is incessant. It’s nonstop. It’s painful. I’m interested to know, what are actually the AI risks you discuss with the C-suite?

[Jeff Steadman] Really, it’s across the business, right? So, if you’re looking at AI, you have to look at it from the user context, how you help the user, how you defend the environment, how you can support the business to grow, all those aspects. There’s not a single technology that I think is coming out today.

Your refrigerator will have AI built in to let you know that you’re not quite out of milk yet, but it’s almost expired, to think about it. So, really, it’s looking at each aspect of that business and how AI can either assist it moving forward or be a detriment if you’re not careful with how it’s implemented.

[Quincey Collins] I agree with Jeff’s sentiments. I would just add that security architecture is really important when it comes to any application, whether it’s AI or otherwise. Where is that data going? How is it stored? What logging is associated with the tools?

Is the data being utilized to train other models? Is it accessible by other entities? Are they sharing that data out with third parties? Are they selling it? There are a lot of questions that you have to ask when implementing AI technologies, but at the same time, you want the implementation and onboarding and procurement of technology to be smooth.

You don’t want to take too long reviewing things. So, you want to make sure that that process is as quick as can be, but also as thorough as necessary to protect your organization. 

Closing 

43:23.472

[David Spark] Well, that brings us to the very end of this episode. Let’s hear it for my guests on stage, Jeff Steadman, deputy CISO over at Corning Incorporated.

[Applause]

[David Spark] Also, Quincey Collins, CSO for Sheppard Mullin. I’m David Spark. Also, let’s hear it for our sponsors, Adaptive Security, next-generation security awareness – remember, AdaptiveSecurity.com; and Dropzone AI, AI SOC analysts that never sleep.

Remember, go to Dropzone.ai. And remember, when you go to either one of their sites, let them know you heard about them from the CISO Series. I want a huge thanks to the ISSA LA chapter for inviting us again for the fourth time. 

[Applause]

[David Spark] Thank you so much for bringing us here. We really appreciate it. We love coming here. This is definitely a great crowd. It’s fantastic. So, kudos to all of you for coming. Kudos to our guests. Kudos to our sponsors. And keep this wonderful cyber community in Los Angeles going.

Let’s hear it for you. Thank you very much!

[Applause]

[David Spark] As always, thank you for listening and contributing to the CISO Series Podcast. 

[Applause]

[Audience members] Whoo! Whoo!

[Voiceover] That wraps up another episode. If you haven’t subscribed to the podcast, please do. We have lots more shows on our website, CISOseries.com. Please join us on Fridays for our live shows – Super Cyber Friday, our virtual meetup, and Cyber Security Headlines Week in Review.

This show thrives on your input. Go to the Participate menu on our site for plenty of ways to get involved, including recording a question or a comment for the show. If you’re interested in sponsoring the podcast, contact David Spark directly at David@CISOseries.com.

Thank you for listening to the CISO Series Podcast.