When operating a security program in an existing deployment, it can be tempting to romanticize an opportunity like a greenfield deployment. But starting from square one doesn’t mean you’ll be able to get closer to perfection. Although it sounds ideal, there are challenges trying to build a security program from scratch.

This week’s episode is hosted by me, David Spark (@dspark), producer of CISO Series and Andy Ellis (@csoandy), partner, YL Ventures. Joining us is Kush Sharma, Director Municipal Modernization & Partnerships, Municipal Information Systems Association, Ontario (MISA Ontario).

Got feedback? Join the conversation on LinkedIn.

Huge thanks to our sponsor, Material Security

Full Transcript

Intro

0:00.000

[Voiceover] Best advice for a CISO, go!

[Kush Sharma] I think you need to look at the political environment and you need to really understand what that is. You need to do the analysis of external factors, internal factors, and then you need to manage that specific environment and customize your security program to that. With various leaders comes various ideologies and various objectives, and you need to maneuver through those.

And if you do that, you’ll be a successful CISO.

[Voiceover] It’s time to begin the CISO Series Podcast.

[David Spark] Welcome to the CISO Series Podcast. My name is David Spark. I am the producer of the CISO Series and actually the founder too as well. In fact, actually, as we’re doing this recording, Andy, it’s been over six years that we’ve been recording this show.

[Andy Ellis] Wow, we’re past toddlerhood.

[David Spark] We are definitely past toddlerhood. That voice that you heard, that is Andy Ellis. He’s the operating partner over at YL Ventures. Say hello, Andy, yet again.

[Andy Ellis] Good morning, good afternoon, good evening, or maybe it’s even good night if you’re listening to this late at night.

[David Spark] So, I wonder if people listen to this podcast to help them fall asleep because my wife does that, listens to podcasts.

[Andy Ellis] If you listen to this to help you fall asleep, let us know, and we’ll try to put in some subtle, gentle harmonies of, “It is time to sleep now.”

[David Spark] We could also just run white noise all throughout.

[Andy Ellis] That’s true, have a background low level of white noise. Maybe we play…

[David Spark] Just the sound of waves crashing all the time.

[Andy Ellis] …some lullabies.

[David Spark] We’re available at CISOseries.com where we have many other shows on our wonderful network. So, go check them out, they’re pretty awesome. Our sponsor for today’s episode is Material Security. Secure email from every angle. And trust me when I say you’ve heard about email security programs before, but you haven’t heard about one like Material Security before.

You’re going to want to hear what we have to say a little bit later in the show. Andy, we are recording this just literally days before we are all heading on to RSA.

[Andy Ellis] Yep.

[David Spark] RSA is always overwhelming for me, but here’s the big thing that I always sort of address, especially when I start doing reports about RSA. People do, “Here’s my RSA report.” There’s no way you could actually do a full report of that conference because it is so big. So, I always clarify it as, “This is my report of RSA, just what I saw,” and leave it at that.

Because really, how much of that show do you actually see?

[Andy Ellis] Oh, I see almost none of it. That’s what I find is fascinating is people are like, “Well, can you plan on writing up your RSA report of what you saw?” And I’m like, “I’m going to speak, I’m doing three different vendor events, everything I’m doing is focused on the companies that I work with and that I support.

My vision of RSA is going to be heavily biased to that. I will happily give you a report that’s basically a portfolio pitch, but that’s not the theme of RSA.” Yeah, I see that and then I go hang out with a handful of CISOs.

[David Spark] I will say this, that what I do is my report is usually a summary of the conversations that I have. And my feeling, whatever everyone’s talking about, that’s what’s top of mind. I do remember last year, a very hot conversation with AI. My guess is that will continue this year as well.

[Andy Ellis] Oh, absolutely. It’s going to be massive this year.

[David Spark] All right, well, it is July when everybody’s hearing this episode. So, my other guess is everyone already knows the answer to that question too.

[Andy Ellis] Oh, yeah.

[David Spark] By the time they’re listening to this. Let’s bring on our guest. What do you say? Thrilled to have this person on board. This person actually helped build a lot of programs out in Canada. He is the Director of Municipal Modernization and Partnerships for the Municipal Information Systems Association of Ontario, better known as MISA Ontario.

He was also the former CISO of the City of Toronto, none other than Kush Sharma. Kush, thank you so much for joining us.

[Kush Sharma] Yeah, glad to be here. Thank you.

Would this person be a good fit for the job?

4:17.446

[David Spark] For startups looking to hire their first security engineer, what skills should you focus on to make the most immediate impact? Now that question came up recently on the cybersecurity subreddit, and some commenters recommended focusing on soft skills, like the ability to prioritize and collaborate, rather than criticize the rest of the organization.

Others recommended using the NICE framework from CISA as a good baseline for hiring. And another common theme was the ability to build process around cybersecurity. So, Andy, I start with you. If you’re looking for that very first security engineer hire, what are you prioritizing?

[Andy Ellis] So, I think there’s two different hires you might make as your first security hire, maybe three different ones. So, let’s treat each of those differently because you want something different out of each of them. So, the one you most likely end up getting first is your compliance hire because almost every startup these days, right out of the bat, they’re like, “Oh, we have to go do SAS 70 Type 2,” or “We have to do NIST CSF.” And so you’re probably hiring somebody who is going to be really good at documenting what the company sort of does, just so you can go get compliance.

And you should just recognize, okay, compliance hire, and they’re going to do sales support. So, you want somebody who’s really good at writing, communicating, talking about what’s going on. But they’re probably not driving your cybersecurity program.

The second hire you might make is what I think of as your IT security person, right? This is going to be the person who needs to have skills in SaaS vendor management, in endpoint security because they’re going to basically be corporate security, and that’s what they’re going to tend to focus on. So, you want somebody who can basically be your blended IT help desk, and your cybersecurity engineer.

And if they’re fortunate, they will grow into being the director of cybersecurity, and maybe someday they’ll be your CISO.

The third hire, which almost nobody actually makes, but is, in my opinion, the most critical one, is the platform safety engineer. The person whose job is to help make sure that whatever product you are building meets the actual security requirements of the markets you want to head into, that you’re building technology that works.

And that’s the person who really has to be focused on how do we quickly get something out that doesn’t create such unsafety in the future that it’s going to cripple us years down the road, while not crippling us right now.

[David Spark] I would argue that is a great person, but probably not the first hire, and that’s why you don’t see that one too often.

[Andy Ellis] So, oftentimes, that rolls into your CTO. Is what I do see is I see companies that are forward-looking, say explicitly to the CTO, like, “This is your job,” and now the CTO has to figure out how to deal with that inside the engineering program. This could be somebody who’s also a developer.

It doesn’t have to be all I do is security because you’re a startup, you need to build stuff.

[David Spark] All right, Kush, I take this question to you. You have actually started up many groups from just one person, or zero to one. Specifically for that first security engineer, what do you look for?

[Kush Sharma] So, for the security engineer in today’s world, compared to yesterday’s, AI is kind of like the big topic of the day. I know that in Canada, we’re one of the leaders in AI academically. We have many, many programs in Canada. So, for example, there’s AI computer science programs, quantum computing coding programs.

So, there’s bright kids coming out of these schools. And if we look at a startup, right, in this specific example, then you may want to pick up some of those freshly minted developers that have the experience with AI because they’re teaching this in the school systems, at least in higher education in Canada.

And so I would look for someone, obviously they have some sort of technical background or skillset, but someone that can learn, someone that is willing to work the hours that we need them to work when it comes to cybersecurity at that level, right? It’s not an easy role, it’s quite demanding. Someone who could troubleshoot.

So, usually what I do is I give them questions in the interview, and I want them to do live troubleshooting with me. And if they can get through, and I can understand their logic of the problem that I’ve given them, then they’re good candidates for hire. If someone can’t get through basic, simple problems from an interview perspective, then I would look for probably someone else, but someone also that can do research because it’s vitally important to make business cases from a CISO perspective.

And you need those new recruits to be able to do research and find data for you, and then put that data together in a pervasive document, and then you could take that and tell your story. So, that’s what I look for typically from a new engineer, from a startup perspective, and from an AI perspective.

Protecting critical infrastructure from attackers – where to start?

9:06.506

[David Spark] Whether it’s Colonial Pipeline, Volt Typhoon, or continued attacks on water utilities, securing critical infrastructure seems to continually be in the news. While these attacks can inspire doom and gloom, Sean Tufts points out critical infrastructure providers are learning from these attacks, with SOC teams focusing on threat detection from malware that often has year-long dwell times.

Now, in this piece on Dark Reading, he recommended providers focus on network segmentation, implement intrusion detection systems, and invest in identity security as their fundamentals going forward. Kush, I’m going to start with you. Given critical infrastructure is often targeted by advanced persistent threats, or APTs, will those fundamentals that I just listed off be enough?

[Kush Sharma] I think we can add to it a little bit. I think the fundamentals are good. But in today’s world, in addition, we need to do the segregation, so not just the segmentation. Segregation is separating two things into different complete units or areas. So, you have one network and another network.

And segmentation is taking the one network and then cutting it up into pieces so that, let’s say there’s various fences, right? And so you can’t jump over that fence and get to the next yard, let’s say. So, what we have to do is keep it, in addition to segmentation, which is fundamental core network kind of architecture for zero trust, we need to have that segregation between the OT and IoT systems and environments or networks versus IT.

That is critical. So, even if they get… And many times they get into the IT side first, and then they laterally move into the OT. So, those specific controls in the data flow and the networks need to be highly, highly secured and protected. So, you need to make it very robust, like another DMZ type, pretend it’s the internet, right?

And put all of the controls there.

The second thing is, so we talked about IDS and that is the detection. But what we need to do is add to the response side of it, so we have detection and response. We just can’t look at something and kind of be on the blind side, right? So, “Oh, something came up, let me try to do something.” We have to be proactive.

So, we need that automated response in today’s world because human beings cannot keep up with all of the attacks and all of the information coming in. It’s just too much. So, you need that specific automation there. And then you also need to look at the zero trust philosophy and how to implement that.

It is not a technology. People think it’s a technology. It’s just a mindset and a philosophy. So, the way I phrase it is, don’t trust, always verify.

[David Spark] We’ve heard that one.

[Kush Sharma] If you keep that in your mind as a CISO, you will never fail, right? And just keep that one principle in your mind. And so you need to protect the internet-facing apps, any SaaS apps, right, the guest networks from an OT perspective because these are many times it’s plant based. So, you’re going into some kind of location, right, where there’s critical infrastructure and they give guests access actually many times, right?

There’s a lot of vendors coming in, a lot of people coming in to produce. There’s things that get connected in directly to air gap systems, etc. And then the last thing is remote access into those OT networks. So, that’s what I would add to the existing list.

[David Spark] All right. Very, very good list there. So, I’m going to go to you, Andy. Anything to add, augment to what Kush said, or you think, hey, you’ll be fine with just the fundamentals, get that done.

[Andy Ellis] Yeah, so I really like when Kush talked about the philosophy and the mindset versus like, oh, just here’s like three basics. Because the reality is if you say, “I’m going to go focus on network segmentation,” what you’re going to run into in critical infrastructure is you can’t do network segmentation because the whole point of modernization is to remove the segmentation so that you have access, internet enables so much of what’s going on.

And so you’ll be fighting an uphill battle. It’s a great battle to fight, but you have to think philosophy. You have to think about scale and say, “What are my unacceptable losses? And how do I stop those from happening?”

Because your unacceptable loss is not that I can send an IP packet from one control server over to a SCADA system. Your unacceptable loss is the SCADA system doing things it’s not supposed to do. So, how do you prevent the power from going out or the sewers from backing up or whatever it is you’re trying to prevent, that’s what you need to focus on.

These three steps, these fundamentals, these are fine things to do. I’m not saying don’t do them at all, but if all you did was spent all your energy just trying to say, “I need to do these three things,” what you’re going to discover is that you missed the barn door that is wide open on the other side through which the adversaries are going to show up.

Sponsor – Material Security

14:02.757

[David Spark] Before I go on any further, I do want to tell you about our absolutely spectacular sponsor, and that is Material Security. Secure your cloud email and productivity suite with Material Security. So, we all know that Microsoft 365 and Google Workspace aren’t just applications, they’re actually critical infrastructure.

These environments are home to all your people, content, and communications. Securing these today actually requires a very heavy set of disjointed tasks that leave blind spots and coverage gaps.

Material is the only solution purpose-built to address risk across the whole environment with the focus and depth required to make a difference. Material’s cloud office security suite unifies cloud email security, user behavior analytics, and data loss prevention across the full threat lifecycle. Material integrates in minutes via Microsoft 365 and Google Workspace APIs with zero downtime.

That’s pretty darn nice. Customers get a single tenant, isolated instance, and complete control over the underlying infrastructure. Material works with organizations of all shapes and sizes. You can learn more about their advanced email security at material.security. Go there and check them out.

It’s time to play “What’s Worse?”

15:33.130

[David Spark] All right, it’s time to play “What’s Worse?” Kush, I’m assuming you’re familiar with how this game is played, yes?

[Kush Sharma] Yes, yes, let’s go. Let’s do it.

[David Spark] All right, he’s ready for it. All right, as you know, Andy answers first, you agree or disagree with Andy. I’m suggesting you disagree with Andy.

[Andy Ellis] I’m suggesting you agree.

[David Spark] Before you even hear it, I’m just suggesting it. All right, this comes in from someone who has not submitted before. It’s Ymir Vigfusson from Keystrike, and here are your two scenarios, Andy. What’s worse for a CISO? One, managing a patchwork of countless security solutions, each from a different minor security company, and at any given time, one of those solutions is failing.

[Andy Ellis] Only one, awesome.

[David Spark] Only one at any given time, but it’s all the time at least one is failing.

[Andy Ellis] Are they failing loudly or silently? This is really important to the scenario.

[David Spark] Just that’s all you know, that one is failing. One is failing. Or you’re relying on a single vendor for all things security, so they are the platform play, if you will, and then guaranteed once a year that one vendor will fail spectacularly and publicly. Which one’s worse?

[Andy Ellis] Oh, this is easy. The second one’s worse. I always love when I get easy ones.

[David Spark] Okay. Well, I amended this, thinking of making it harder, but I didn’t make it harder.

[Andy Ellis] But it has nothing to do with the failure rate. Although the failure rate is really important here to think about, which is would you rather have minor failures continuously or one big major failure? The answer for most…

[David Spark] Who knows if they’re minor? It’s just one of your tools is constantly failing. It could be major.

[Andy Ellis] Sure, but that’s like a 5%, like whatever percentage. If I got hundreds of tools, fine, I got a 1% issue continuously, or I’ve got 100% issue two days out of the year. But here’s actually the real problem, has nothing to do with the failure rate, that’s just noise. Although it’s also favorable, I don’t have to count against it, which is there does not exist a single vendor who can solve all of my security problems.

So, if my choice is putting together and building a quilt to protect me, or I’ve just got my little security blanket that doesn’t cover me, but it’s all from one vendor, I’m taking the quilt that I’ve got to manage myself.

[David Spark] Okay. Even though the patches in that quilt are constantly coming undone.

[Andy Ellis] Sure, or the whole security blanket gets burned up a couple days out of the year.

[David Spark] All right, I take this to you, Kush. Do you agree or disagree?

[Kush Sharma] I would agree, and I would say the reason why I agree is one is very public. It’s political. It will likely lead to someone suing the company and suing the CISO, as opposed to the first option, which is operational problems and disruptions and some internal issues that you have to deal with with your stakeholders.

But I would take that over exposed in the public environment, and I got regulators coming to me, I got people suing me. So, I would agree, yes.

[Andy Ellis] Yeah, you don’t want to hear the phrase consolidation risk showing up from your regulator. Kush has been there. Anybody in a regulated environment just was like, “Oh, God, no.” When the OCC shows up and says consolidation risk, you’re going to have a bad couple years.

[Kush Sharma] Yeah, exactly. When in a regulated environment and industry, I’ve been in many, it’s completely different than kind of a startup or other areas which are kind of more free. Actually, you’re spending your time as a CISO just doing compliance and just kind of fighting fires when stuff hits the fan there.

So, I’ll deal with the monthly disruptions for some software.

They didn’t think that through all the way, did they?

19:24.230

[David Spark] How can municipalities improve their cybersecurity? It can be tough for municipalities to even get a scope of discovering the scope of security incidents, much less becoming resilient to them. Now, Graham Cluley recently cited the example of the UK’s Leicester City Council recently, said a cyber-attack back in March saw attackers access about 25 documents.

Well, the word “about” did some heavy lifting because the council later updated the figure to 1.3 terabytes of data. I’ll just say maybe 25 very large documents. Now we’ve spoken about the cybersecurity poverty line with regard to municipalities. It’s a lot about cyber hygiene and covering the fundamentals.

But as security has shifted its focus from prevention to resilience, shouldn’t we be doing the same for these government organizations and build toward a resilience poverty line? I ask you, Kush.

[Kush Sharma] Yeah, I think we need to really educate the leaders in Canada’s provincial or territorial – in the US, it’s state – on cybersecurity and what the impacts are to citizens. And I think that’s the message that I took when I was at the City of Toronto that resulted in substantial investment and the resourcing coming during that first year.

So, if we look at the infrastructure, right, when we talk about critical infrastructure, so what is housed on the local level? So, we have water systems, right, critical. If those are breached and the taps are not running, you could almost guarantee riots within two or three days when there’s no more water in the grocery stores.

You’re talking about fire, you’re talking about police systems, you’re talking about paramedic systems, solid waste systems, elections. At least in Canada, many of the elections are local and based on how much funding they have, right, that’s how good the security is.

And then you have the connected fleets, which people forget that can be weaponized. So, I have autonomous buses, I have cars, I have diesel trucks, but they’re connected to the internet. So, now there’s a mechanism to get into those. Then there’s public health and health records that are kept locally also, not just with other levels of government.

And then it’s other things like dispatch systems, call centers, right? So, we have 311, for example, in Toronto, which is a general number that anyone could call for free and you can ask the city or log a ticket or what have you. And so we have to understand that framework first and bridges also. Once people understand that, then we can have a conversation and raise that bar.

So, what we are seeing is municipalities coming together because they’re in a crunch for resources and funding. And so they’re coming together and just going out to the market, four, five, six of them together, maybe a county, and just doing RFPs for cybersecurity. And they’re pooling their resources and their money to get the job done.

So, we’re seeing a shift. They’re not waiting for funding from the feds and provincial stream. And so this is a positive because now they’re taking action and matters into their own hands, right, and going forward with that. Now, in terms of getting to a baseline, many of the municipalities or local government around the world even, not only in Canada, they can’t be implementing ISOs or NIST.

They don’t have that capability and the resources. So, what I always tell them is start with the CIS 18, start with two or three controls, very simple stuff. And then once you’re ready in the future, you go to NIST and then you could add on some of the other ones.

So, that is kind of the high-level advice that we give. And we ask them to be very pragmatic when we give advice. So, simple things that a non-IT person in most of these places could do is increase the password length. So, if you go to 14 characters, special characters, upper, lowercase, etc., we know that it’s harder for them to use the password crackers.

If you use a passphrase, which is kind of built into Microsoft, for example, anyone could do, then that’s even a harder level of control that’d be very difficult. And the goal is really, okay, we have 5, 6, 10, 20 controls, then maybe the actor is going to go somewhere else, right, to another target that’s a lot easier.

[David Spark] But that’s a really good point. Just saying there are simple things that can build greater resilience as well to your security program. And like you say, looking at like what is the catastrophic result of lack of water? Andy, we have seen the whole security industry moving towards the resilience model.

Most municipalities understand the concept of resilience before the whole concept of cyber comes around. So, I think it’s kind of built into their DNA, isn’t it?

[Andy Ellis] I don’t know that it actually is. I think at the municipal level, it’s a small business when you actually think about it. If you’re going to use the mental model of corporations, municipalities don’t really think 24/7, even though they have 24/7 services. When you go look into a city hall, they’re like, “Oh, we do services Monday to Friday, 9:00 to 5:00.” These are not organizations that built into their mindset is 24/7 resiliency.

Some of them are, great when they’re forward thinking, but that’s what we really need to be focused on is shifting the mindset to being government isn’t always on service. You don’t work banking hours anymore. That was the old school. But from my experience, most municipalities have not actually made that shift.

So, I don’t think that trying to say, “Oh, instead of security, we’ll just roll in under resilience.” They’re not there yet. They’re more ahead on security, I think, than they are on resilience.

[David Spark] No, but I’ll go back to what Kush said at the beginning of his answer there. The water company knows what happens when there’s no water. I mean, don’t they?

[Andy Ellis] The water company, so there’s specific services, right? Yes, water, power, etc. But there’s a lot of municipalities that are not those services. And that the people who are in charge don’t think of themselves as being 24/7. And that’s what’s really critical is when you have a business that has always been 24/7, then you think in 24/7.

But just because you’re a municipality that has some 24/7 services doesn’t mean you’re thinking that way. And that’s a shift that they need to make. I don’t think we should say, “Well, let’s not solve your cyber problems until you solve your resilience problems.”

[Kush Sharma] Yeah, so I would just add to that – that’s excellent, Andy – is that we’re seeing, at least from the cyber function, so the cybersecurity folks themselves, the IT folks, where there’s no cyber. Or even some municipalities, it’s like the fire chief is doubling as the IT person. So, that’s the reality of the situation.

It is not what people think – there’s a bureaucratic function, there’s a hundred people. Most municipalities around the world are under that 20,000 population, right? And they’re not capable and they don’t have the resources, right? It’s either I get equipment for the firefighters, or do I put cybersecurity tools in?

Well, you’re going to pick equipment for the firefighters because it’s a life safety issue. And what we need to understand is we need to offer them pragmatic, very, very simple, pragmatic solutions.

And what I hear in the market all the time is, “Oh, buy this tool. Oh, put in ISO standards. Oh, let’s talk about NIST.” No, they’re doing the regular job. A lot of these folks are volunteering to be on the council. And so we have to think about that specific environment and the location of these specific municipalities.

They’re not in any kind of friendly location. Outside of the larger cities – okay, if we take those aside – the municipalities are actually across North America in more isolated locations. You have to physically drive there. The road infrastructure is not so good in many places. And in the North, oh, my God, in the North, I mean, you can’t even get there without a plane for many of these places, right?

And there’s barely any internet there.

So, how do you solve cybersecurity problems for military infrastructure, for other utility infrastructure out in those regions? And that’s what we have to really focus on is if I were to attack, how would I attack, right? Would I come through Toronto with a huge security team, and we have the cyber center, we have the provincial cybersecurity, we have OPP, we have RCMP, we’ve got all these cyber people there.

No, I’m going to be coming through a small town in the middle of nowhere, right, to try to get into the network, so to speak, or to the grid.

What’s the starting point for a CISO?

27:54.878

[David Spark] How do you start a security environment with a team of one? We’re so used to dealing with existing deployments that having a greenfield is often an unconsidered challenge. One key is realizing that greenfield does not mean you’re ever going to create a perfect solution since it ultimately needs to serve the needs of the business rather than security as a platonic ideal, argued Roger Grimes in a piece on CSO Online.

You can also take hard earned lessons from other deployments into the greenfield, like clearly define an actionable patching policies and implementing objection lifecycle management from the start. Kush, you know this problem very well. Where do you start with a greenfield deployment? And kind of explain sort of your history in this and what your organization does because it is essentially does this, it helps startups, but you’re often doing greenfield deployments for people with nothing, yes?

[Kush Sharma] That’s correct. So, if we look at the municipal sector, many of them are greenfield, they don’t have cybersecurity resources nor do they have IT resources in many cases. So, it’s a dual duty done by a local individual in the community. And so when we go to these specific communities, we’re actually greenfield over and over and over again.

And even in the corporate environment I’ve done, I’ve been the team of one where I walk in and you get the fancy title, but when you walk in, you’re like, “Oh, who else is here?” And it’s like, “Well, it’s just you. So, let’s get going.”

So, I think what we always look at is aligning everything to the business objectives or to the objectives or prioritization of the government. And if you don’t do that as a first step and you start getting into the technical weeds of, oh, my God, this firewall’s not configured properly. Oh, my God, I don’t have endpoint protection.

It’s a zero-sum game. You’re not going to win because you need to convince people. And so what we do is from a government perspective, we run every CISO office like I’m running for the prime minister of Canada, right? So, it’s a campaign, and that’s how I think about things. So, as soon as I get in, I try to find some comms people, procurement people, finance people, as opposed to technical security folks.

I once hired a political scientist that was running campaigns for various politicians in Canada, and I hired him on my team. And then we ran literally electoral campaign, and we were trying to be the king of the city. And then we were going to the council, the mayor’s office, all of the executives, right, in every division.

We were going to all of the agencies, corporations, and bodies, the CEOs there, that anything to deal with the municipality, we went there. And then what we did is we looked at all of the priorities, all of the issues, and then we said, what are the top three, right? What are the things that we need to focus on?

And then we got some consensus. So, now you have consensus.

Now the second step, at least in my mind, you’ve got to review any of the IT contracts, right? Or the OT contracts. Because what’s likely happening is that we’re being overcharged. So, the second step from a strategy perspective is to review all of the procurements. So, go to your procurement, get all the contracts, start reading them, understand what’s in there, what’s not, understand if they’re complying or not because usually there’s a penalty fee you can get because they’re likely not complying.

And second is immediately you can reduce the price of all of that software and services, immediately. Usually I save about anywhere between 10 and 20% right off the bat just by reviewing contracts.

And then the third step is to communicate that you’re efficient to the leadership, right? Look at all of the risk in the organization. So, in this case, the government. So, for example, how many privacy impact assessments are done, right? Because there’s privacy law everywhere in North America. Look at all the audit findings from the last 10 years, let’s say, or whatever you can get.

Look at all the pentest results, all the VM scanning results, any data or logs you can get from any IT tool, right, if you don’t have security yet. So, proxy servers are excellent, for example, right? So, that’ll tell you, for example, what people are searching for on the web, and many people are doing bad things.

So, I ran a forensics team once, and we had to catch a lot of people that were looking at child porn. It was very unfortunate. But those are the quick wins that a CISO can get with literally no money. It’s just a little bit of hard work.

And then you communicate that into a very easily digestible kind of presentation that is a story with pictures. So, I don’t have a lot of words. I have boxes of pictures and just metrics, right? And then I talk through it. And then they understand because I’m not speaking firewall language, I’m just speaking to the risk.

And then I map all of those risks to something in the municipality, like a service or water or elections or whatever it is, or finance or payroll systems or whatever, whatever that’s important for them. And then 9 times out of 10, we receive some funding. So, you always ask for two or three times more than you need because they’re going to likely cut it by 50% in the first round not even blinking.

They don’t even look at it, my experience. So, you add more.

[David Spark] So, have you ever asked for funding, they said yes, and then there was no more discussion ever?

[Laughter]

[Kush Sharma] Yeah, that’s happened to me before.

[David Spark] Hold it. Has it, really?

[Kush Sharma] Yeah, yeah. So, in that case, it was a smaller place, so we asked for a little bit of money, wanted to be reasonable. And then like, okay, no problem, we’re going to get funded. And then some other parties came up, some motions went in, and then it was all of a sudden cybersecurity’s not the top priority.

And then it’s like, “Okay, keep working with what you got.” I was like, “We just went through this exercise.” So, sometimes you win, sometimes you don’t. But the key message is being persistent because if you’re persistent, even if you don’t get it that year, you keep going back at them, you keep showing them the residual debt that they have, and you have to mention to them that they’re responsible.

So, the council and the mayor is directly responsible. They’re the board of directors and the CEO, so if we compare it to private sector. And so that’s what they have to realize, and that’s what you have to hammer into them. Once they understand that the buck falls on them, things will improve dramatically and quickly.

[David Spark] All right, an amazing outline. And by the way, anyone listening right there, save that as your sort of a guide for handling this in the future. Andy, what would you add, amend to Kush’s great sort of digestion of this process?

[Andy Ellis] It’s hard to amend anything on that. That’s a fantastic way to look at it. But I’m just going to object to the phrase greenfield that we started with because I think people have this vision. It’s like, “Oh, I’m going to show up and there is nothing.”

[David Spark] Yes.

[Andy Ellis] “And all I get to do is build from scratch.” No, no, it is a swamp. You are security person number one; you’ve been dropped into the middle of the swamp. You do not get to plan on how you’re going to build the thing. You can have this vision of this amazing fortress and a castle, but step one is you look around, you’re like, what one step can I take to get out of this five feet deep water into four feet deep water?

And this is what you have to recognize is that this is all about cost-benefit trade-offs. Like how much benefit can I get for the absolute lowest cost? That’s the first thing I do. And just keep doing it, you iterate. And the first 50 things you do you will throw away later. That’s totally okay because you put on galoshes to walk in the swamp.

When you finally drain the swamp, you get to take the galoshes off and wear different foot gear. Now you can put on your trainers so you can go run long distances because that’s what you’re going to be doing.

So, recognize that when you’re a security team of one, your goal is zero waste of your time. So, how do you make your time the most effective moving the organization forward and accept incremental progress? Because nothing is going to give you perfect security. So, if you can get a 40% solution with one day of work, go implement it.

You’ll be back six months later to rip out the 40% solution and put in place a 60% solution. That’s okay. But the 60% solution that takes you a week means there’s five 40% solutions you didn’t put in place, you didn’t address a whole host of issues. So, plug all of your leaks as basically as possible, as cheaply as possible, and then worry about building a strong foundation.

[David Spark] Let me ask you, to both of you, and I want to just close this out. Because I remember I had a situation and it didn’t have to do with security, but we took something that was horrible, and we made it crappy. And I just always have that vision of there was no way to make this great. There was just no way.

So, tell me, how do you feel good about walking away from taking a situation that was horrible and you made it crappy? And I’ll ask you, Kush.

[Kush Sharma] So, many times you’re correct. Many times you’re faced with impossible decision-making. And the way I handle that is I’m a negotiator. So, I understand that it’s going to be a little bit of back and forth with the other leader, whether it’s infrastructure or whether it’s the business or apps or whatever it is.

And you need to have that relationship built. And then you need to understand what the risk is, the actual risk. So, if this gets compromised, what would happen? And that’s the question to ask those leaders. And they’ll tell you, “Well, nothing really.” And then there’s a disconnect I find from the technical cyber people and the business people many times.

So, the cyber person thinks that, “Oh, we need to secure this. This is so critical to the business.” And then you actually ask the application owner, the application sits on the server that you’re trying to protect, for example, and they say, “Well, yeah, we don’t care about this if it gets breached.”

And then all you do is have them sign a risk disclosure form and away you go. You don’t think about it again, right? They’ve signed off on the risk. It’s their business. And you’ve advised them that this needs to be fixed and this is how much it’s going to cost. However, you’re working with them to say as an organization and you being the leader of this specific process and the technology is the enabler of that process, right, I don’t own the technology.

You own the process that’s important, and you’re saying yes? Okay, we’re moving forward. Next problem, right? Let’s look at something else now.

[David Spark] All right, Andy, I know you eagerly want to close this out. Let’s hear it.

[Andy Ellis] I think the important thing is you ask the question, how does it feel to take something that was it horrible and you make it crap?

[David Spark] Horrible to crappy. Yeah.

[Andy Ellis] That’s not the right phrasing. You took something horrible, and you made it less horrible.

[David Spark] Okay.

[Andy Ellis] Sometimes it is just the marketing of recognizing that yup, this was at 100% bad and now it’s at 80% bad. That’s 20% improvement. Awesome. I’ll be back in a month after I’ve moved another 29 things from -100.

[David Spark] But I’m sure even when you see 100% and you brought it to 80, it’s like you still look at it and your head spins.

[Andy Ellis] Yeah. But don’t let your head spin. It’s like I’m fighting fires, and my job sometimes is just put out all of the big fires, but I’m not dealing with the underbrush yet. I’ll be back. There’s going to be more fires later.

Closing

39:06.858

[David Spark] All right. Well, that brings us to the very end of the show. That was fantastic, guys. That was really, really good. And Kush, thank you. That, I think we have all been very schooled on really getting a security program up and running when it’s quite, quite difficult to do so. I’m going to let you have the very last word, but I want to thank our sponsor, Material Security.

They secure email from every angle, especially if you’re operating the Microsoft 365 and Google Workspace environments. You’re going to want to take a look at how they protect that data in those spaces. They can do it for you. Check them out at material.security. Andy, thank you as always. Kush, any last words, any last advice for our organization?

And I’m assuming with your work at MISA that you’re always looking for talent. Yes, are you?

[Kush Sharma] Yes, we’re always looking for talent. There’s many municipalities across Canada hiring specifically for cybersecurity roles. As we do our awareness campaigns, we’re seeing more and more jobs come up. So, if you’re interested in working, defending the country, helping citizens, then it’s definitely an avenue for the newer generation or folks that have experience to get involved with.

So, I would say, yeah, it’s a great opportunity, and to all my CISOs out there, keep your head up and keep the diplomacy up.

[David Spark] All right, thank you very much. We will have a link to both Kush’s LinkedIn profile and also the MISA site as well, so you can contact Kush directly. Thank you, everybody. We greatly appreciate you contributing and listening to the CISO Series Podcast.

[Voiceover] That wraps up another episode. If you haven’t subscribed to the podcast, please do. We have lots more shows on our website, CISOseries.com. Please join us on Fridays for our live shows – Super Cyber Friday, our virtual meetup, and Cybersecurity Headlines Week in Review. This show thrives on your input.

Go to the Participate menu on our site for plenty of ways to get involved, including recording a question or a comment for the show. If you’re interested in sponsoring the podcast, contact David Spark directly at David@CISOseries.com. Thank you for listening to the CISO Series Podcast.