CISOs tend to be cool customers. But even in a role that requires nerves, there are still things that can scare a CISO. Some of these don’t have anything to do with threat actors. Organizational issues can often be the stuff of a CISO’s nightmares. So what qualifies as a pants-changing event for a CISO?

This week’s episode is hosted by me, David Spark (@dspark), producer of CISO Series and Mike Johnson, CISO, Rivian. Joining us is Steve Zalewski, co-host, Defense in Depth.

Got feedback? Join the conversation on LinkedIn.

This episode was recorded live at BSidesSF 2024. You can see all the great photos here, but here are a few samples.

Huge thanks to our sponsors, Devo, NetSPI, and Eclypsium

Full Transcript

Intro

0:00.000

[Voiceover] Biggest mistake I ever made in security. Go!

[Steve Zalewski] Many may relate to this, which is naively trusting a strategic vendor to put the best interest of me as their client in front of their own revenue targets.

[Voiceover] It’s time to begin the CISO Series Podcast, recorded in front of a live audience in San Francisco.

[Applause]

[David Spark] Welcome to the CISO Series Podcast. My name is David Spark. I am the host and the producer of the CISO Series. Joining me here on stage is my co-host who’s been with me, it’s almost been exactly six years. June 1st, 2018…

[Mike Johnson] Wow.

[David Spark] …was when we started this, and we are less than a month away from that.

[Mike Johnson] Wow.

[David Spark] The gentleman to my left, that is Mike Johnson, who is also the CISO of Rivian. Let’s hear it for Mike Johnson.

[Applause]

[Mike Johnson] Hi, thank you everyone.

[David Spark] By the way, for those of you, you heard at the very beginning, we are at the BSides San Francisco event. We are in Theater 13. It is a huge theater. It’s beautiful. What is most spectacular, and now the people in the room can see it, and we’ll put photos of this up. When you go to listen to this episode, go to the podcast.

But our logo is physically the largest I’ve ever seen it in my life, and it’s on this giant movie screen. It looks spectacular. The other logos that are up there are our sponsors, and I do want to mention them. Let’s hear it for our sponsors, Devo, NetSPI, and Eclypsium. Let’s hear it for them. .

[Applause]

[David Spark] Thank you very much. We will be hearing from all of them later in the show. So, I’m going to bring in also our guest now, who is the host of our other show, Defense in Depth. That is Steve Zalewski. Let’s hear it for him, Steve.

[Applause]

[David Spark] All right. The question I have for both of you gentlemen is, we’re at BSides, it is sort of the precursor to the RSA Conference. I’m actually shocked at the number of people I ran into here that are only sticking around for BSides and not sticking around for RSA, which was shocking. That’s actually a first for me in terms of experience.

I’m sure people have done it before. But what’s your experience of the big difference between this conference and the other conference?

[Mike Johnson] BSides is very community driven. This is really an event that’s for the people who are actually attending it, rather than people who are just showing up to get swag off of a vendor. This is really the context, the content here, so much better than RSA because it’s by the community.

[David Spark] And do you feel the conversations are stronger here than at RSA?

[Mike Johnson] Oh, I think so. They’re also more real. These are real conversations here. And RSA, frankly, it’s a sales conference.

[David Spark] So, let me ask you, I’m going to be attending both conferences. I’ve had good conversations here. Should I worsen my discussion when I go over to RSA?

[Laughter]

[Mike Johnson] Tone it down a little bit, Dave, yes, yes.

[David Spark] Tone it down. All right. Steve, your take?

[Steve Zalewski] Oh, this is my best conference. The way I look at this, these are my peers. This is t-shirts and no socks folks, okay? When I go to RSA, that’s t-shirts and socks.

[Applause]

[David Spark] I can’t believe you got applause for that.

[Laughter]

[Mike Johnson] For socks.

Can’t we all just get along?

3:25.370

[David Spark] So, are companies taking the air out of the open source balloon? Now, sure, open source code is used by the vast majority of all code bases. But recently, Redis sparked some controversy by changing their in-memory database licensing to no longer let developers use the code, noted Steven Vaughan-Nichols in a piece in Computerworld.

They, being the developers, can still audit it, the code, but they can’t build off it or modify it, which is kind of the thing you do with open source. So, I’m going to start with you, Mike, on this. Does this risk killing the golden goose of what open source offers to big companies if more organizations follow this practice?

And I should note that Redis is not the first to do this. So, Mike, what do you think is the argument for this type of licensing change other than, well, because money?

[Mike Johnson] I think your first question of, are they risking killing the golden goose? I think we’ve seen this happen time and time again. And your point about big companies, big companies really are going to be fine with this. If they see value, they’ll license it. If they don’t see value, they’ll fork it.

We saw this happen with ElastiCache, which was mentioned in the article. That was a fork of Elasticsearch way back when. But the company Elastic is still around today, they’re still very successful, and I imagine we’ll see the same thing that Redis is doing. You can argue the reason behind it is they need the revenue to pay for the support services that’s required for the people who want to use it.

It’s not free. So, there’s certainly some value. There will be some people who will move away. And that’s what we’ve seen before, and we’ll see it again.

[David Spark] All right, Steve, what do you think on this one?

[Steve Zalewski] So, I applied a little creative thinking, and I said, is there another reason that they might be taking this position? So, bear with me on this. And I go, I blame the lawyers, which is it’s a third-party and fourth-party risk management exercise, right? If you look at the legal concerns with liability and with some of the new policies that are coming down with regards to both compliance and risk, that there’s an opportunity that the lawyers are looking at some of this language and they’re the ones saying, “Whoa, whoa, whoa, whoa, whoa.

There’s a liability issue here that we don’t want to take on.” That’s my creative thinking as to why there might be something else going on.

[David Spark] And I feel that that very well…be the case, but could there be a situation here where they’re changing the licensing because of the lawyers or could be it like a ruling with no teeth, like, “Ah, they’ll let people change the code. They’ll let people modify it. They’re not going to get that upset about it,” or is this me just sort of guessing this might be the case, what do you think?

[Mike Johnson] I mean, Steve has a point about the lawyers. The lawyers of the companies who might want to wing it are not going to let that happen. When you’ve got a large company, they’re looking at the code, they’re looking at the licenses for everything that goes in there. And if the expectations of the use doesn’t meet the letter of the license, then the lawyers will actually not let the company go through.

[David Spark] Could this also be…

[Mike Johnson] You can’t wing it.

[David Spark] Could it also be a third-party risk, a regulatory issue that’s forcing this to happen as well?

[Steve Zalewski] Well, and that’s just it, which was the lawyers are there to protect the company, right? They’re there to look at any kind of obtuse ways that they could be held liable. And so what they’re doing is they’re covering their tracks, right? If you ask a lawyer a yes/no question, what’s the answer?

No. Okay? So, they’re basically saying, no, they’re protected. Now we’re going to figure out what’s reasonable.

[David Spark] Again, we’ve seen this happen a few times, if they’re successful with it. I mean, do you just think this is going to be a nonstop trend?

[Steve Zalewski] I think this is a bump in the road and we’re just going to continue to do what we do.

[Mike Johnson] Yeah. I think this is something that’s been happening for quite a long time with open source and we’ll continue to see it happening.

[Steve Zalewski] Yep.

Confessions of a CISO

7:31.641

[David Spark] Now CISOs, the gentlemen to my left, they stay cool under pressure. Would you say you do that, Mike?

[Mike Johnson] Yes, absolutely.

[David Spark] So far, so good. But not always, right? Have you always been cool under pressure?

[Mike Johnson] I have, I don’t know about Steve.

[David Spark] Let me ask you, have you ever lost it? Have you just screamed holy crap?

[Mike Johnson] Not in front of anyone.

[Laughter]

[David Spark] Do you have a closet where you just go in, and you scream?

[Mike Johnson] Yes, it’s a padded closet that I can go in and just scream when I need to.

[David Spark] You take a pillow and shove it in your face?

[Mike Johnson] Yes. Exactly.

[David Spark] [Laughter] All right. So, there’s always something that can make a CISO poop their pants. Now using a more colorful term for poop, a Redditor on the cybersecurity subreddit asked, what really scares a CISO? And it was quite humorous, but real. The most popular response was emergency board meeting in 10 minutes.

Another popular one was management decisions made without being consulted, such as an acquisition without a risk assessment or changing cloud providers on a whim. And another was new regulations that could put a CISO in court. So, I’ll start with you, Steve. Have you heard of any of these or any others that come up with your own list?

And when you actually heard these, like in a real working environment, did you wish you packed Depends?

[Steve Zalewski] Oh. In my experience, CISO at Levi’s and in prior, the one that got me for this is, “We’re going to do an M&A and you’re not involved,” okay? There’s nothing like being…

[David Spark] Did they say it in a way making it clear, “We’re doing this, you’re not involved, stay out, don’t bug us.” Was it at that level?

[Steve Zalewski] Yep. They, basically, we knew there was an M&A going on, we weren’t brought to the table. So, there’s nothing like being disrespected to make you feel like you’re a viable and important part of the company, right? Because then you’re like, “All right, then go buy them.” But now I’m going to be defensive.

And the second one that got me was board meeting in 10 minutes. That wasn’t so bad. It was when I had an incident that was going to have to go up to the board, okay? Because in that case, the poop storm starts coming downhill because now I’m preparing myself to go, it’s got to go to the board. That’s going to create an awful lot of work.

That was of my doing because when you communicate to the board, it’s a whole different set of people now that are trying to protect their butts.

[David Spark] Hold it. I want to dig a level deeper on that one. What happens when you go to the board that becomes like, “You’re just making my life more difficult. I know you need this information,” but what is happening in that moment that’s really making your life more difficult?

[Steve Zalewski] Well, in an incident, if it stops at the CEO, we have good relationship. They know what we do. They understand, right? Once it goes to the board, now you get the board secretaries. You get all the other PR people that manage the board relationships and communications. And so now the CEO doesn’t own it anymore, right?

The board does. And so now he’s in line. So, I got to make him happy for how he’s going to message it up to the board. That’s the hard part. I got twice as much work.

[David Spark] All right. I throw this one to you, Mike. Again, you can answer same stuff as Steve or just whatever scared the crap out of you.

[Mike Johnson] I think one of the things that really is most important is to actually not get flustered. Everything that you laid out there, Steve.

[David Spark] We know that, but you do have that pillow in the scream room, right?

[Mike Johnson] I do.

[David Spark] Okay.

[Mike Johnson] But at the same time, you have to manage all of those situations. Like things are just changing all the time. This is normal. Incidents happen. You have M&As. You have to pivot with these. And it really is important to actually stay cool the entire time, even if you’re screaming in that pillow when you go home.

[David Spark] All right. But I want to know of all these things, which are the ones. I know on outward face, you have to be Mr. Cool and Collected, and we all see that, Mike, but which is the one that makes you really want to do that?

[Mike Johnson] Well, so one of the reasons why we’re able to stay cool is because we don’t tell secrets.

[David Spark] What? No!

[Mike Johnson] We do not tell secrets.

[David Spark] No! That is the wrong answer.

[Mike Johnson] I am not going to share any of those with you or our audience because our role is really we’re quite often a therapist. We’re a lawyer. We have to have folks trust us. And that’s both for they’re going to give us some bad news and we don’t panic, and they’re going to give us some bad news and we’re going to manage that and keep that in confidence.

[David Spark] So, there’s nothing you can reveal?

[Mike Johnson] Not a one. Nope. Keep trying.

[David Spark] But your least favorite.

[Mike Johnson] Nope.

[David Spark] Your least favorite.

[Mike Johnson] Nope.

[David Spark] You got to have a least favorite.

[Mike Johnson] Nope. It’s all good.

[Steve Zalewski] See, this shows how good Mike is with crisis management. Put in a crisis…

[David Spark] Even when I’m pushing him.

[Steve Zalewski] …look how he manages through the crisis.

[Mike Johnson] I can manage David Spark.

[Crosstalk 00:12:28]

[Applause]

[Steve Zalewski] And doesn’t communicate anything that doesn’t need to be said. Well done, Mike. Well done.

[Mike Johnson] Thank you, Steve.

[David Spark] I’m easy.

Sponsor – Eclypsium

12:37.563

[David Spark] We have three phenomenal sponsors and let me tell you about one of them. It is Eclypsium, the leader in supply chain security for critical software, firmware, and hardware in enterprise infrastructure. Now CISO Series listeners can learn more about Eclypsium by visiting their site, eclypsium.com/spark.

That’s my last name. Now there you will find the Ultimate Guide to Supply Chain Security, an on-demand webinar presented by Paul Asadorian called Unraveling Digital Supply Chain Threats and Risk, a paper on the relationship between ransomware and the supply chain, and a customer case study with DigitalOcean.

If you are interested in seeing their product in action, you can also sign up for a demo and you get that all at the site I was telling you before, eclypsium.com/spark.

It’s time to play “What’s Worse?!”

13:44.027

[David Spark] All right. We have a “What’s Worse?!” scenario, and this is a silly one. Comes from one of our favorite “What’s Worse?!” submitters, Dustin Sachs of World Kinect Fuel Services. Here we go. I make you answer first, Mike. For those of you not familiar with “What’s Worse?!” – two horrible scenarios, neither one you like, but you have to determine by risk management which one is worse.

All right, here we go.

[Mike Johnson] Okay.

[David Spark] These aren’t horrible. They’re more embarrassing.

[Mike Johnson] Okay, so much better.

[Laughter]

[David Spark] Scenario number one, a smartwatch that sends your heartbeat data to advertisers; or a fitness app that posts your failed workout attempts on social media without your permission.

[Mike Johnson] [Laughter] Yeah, the second one is peer pressure. So, the first one is your data is going off to a company somewhere.

[David Spark] A version of your health data is going out.

[Mike Johnson] Yes. And who knows what they’re doing with it. Odds are they’re selling it to somebody else and they’re making money off of it. The second one is really just enforced peer pressure.

[David Spark] Forced peer, but in flat out embarrassment.

[Mike Johnson] Right, right.

[David Spark] And specifically, they’re posting your failed workout attempt and making clear Mike Johnson was supposed to run today and he didn’t, and he ate a bag of Cheetos.

[Mike Johnson] Yeah. They were good Cheetos.

[Steve Zalewski] Small bag of Cheetos.

[Laughter]

[Mike Johnson] Medium. So, the first one, you have someone who’s basically profiting off of your health data, and who knows what’s going on? The second one is just some embarrassment. Like the first one is a privacy invasion.

[David Spark] Second one’s a privacy invasion too.

[Mike Johnson] Well, but you also lose track of it. You don’t know what’s happening after that. The second one, like, “Hey, I didn’t run. I ate a bag of Cheetos.” Whatever. I really do think…

[David Spark] But you’re kind of being mocked by your community.

[Mike Johnson] But that’s why I’m using the thing in the first place. You buy both of these things going in what they’re doing. I’m not surprised, and I’m not being forced to go around with this watch on. I’m making the choice.

[David Spark] It’s like the people get the internet connected scales and they post their weight, which that is brave.

[Mike Johnson] Yeah. I don’t understand that either. So again, the first one, I don’t have as much control with what happens with that. The second one, I bought it because I want to be shamed into working out. So, the first one’s worse.

[David Spark] All right, Steve, I take it to you.

[Steve Zalewski] All right. I would say it’s going to depend upon which one of those apps my wife…

[Mike Johnson] Can’t be on depends.

[David Spark] No, you know how…

[Crosstalk 00:16:20]

[Mike Johnson] There’s no depends. You can’t change it.

[David Spark] You know how that works.

[Mike Johnson] Nice try.

[Steve Zalewski] Then I would say the worst one is the one that my wife also has my app and can see that data.

[Laughter]

[David Spark] So, you think the second one’s worse?

[Steve Zalewski] So, I would say the second one is definitely worse. Absolutely.

[David Spark] All right. I’m going to throw this one to the audience. By applause, how many think the first scenario is worse? And that’s the one where the smartwatch sends your heart data to advertisers. By applause. How many people think that’s worse?

[Applause]

[David Spark] Good amount. All right, that’s a good amount. Now the second scenario, the one where you’re embarrassed, the fitness app posts your failed workout attempts on social media without permission. By applause. How many people?

[Faint applause]

[Steve Zalewski] Ooh.

[David Spark] A few. A few people. Well, it looks like Mike has won that one.

[Mike Johnson] All that matters is I won.

[David Spark] There you go.

What is Dave’s Mom talking about?

17:11.073

[David Spark] All right. So, this is a new game and we’ve played it a few times. And Mike, actually, if you listen to Tuesday’s episode, you’ll hear the first round of it. I have interviewed my mom about cybersecurity, and she doesn’t know a lot about cybersecurity. I’m going to say very, very little, in fact.

So, I said just take your best guess effort on what these terms mean. So, they could be a cybersecurity threat, or it could be a category, it could be an acronym, although I spelled out what the acronym is, or it could be some kind of a technology, all right? So, I’ll play the first one. I will give you a big hint.

The first one’s easy, all right?

[Mike Johnson] Yeah. [Laughter]

[Steve Zalewski] I heard that before, yeah.

[David Spark] No, because she does actually know what this thing is. All right? The first one’s a softball, all right? Here we go. Here’s the first one.

[Dave’s Mom] As a cybersecurity person, I’d be worried that somebody in my organization is a troublemaker.

[David Spark] All right, Steve, what is that?

[Steve Zalewski] Insider threat?

[David Spark] That is correct, insider threat. All right, good job.

[Applause]

[Steve Zalewski] I like your mom. She’s my favorite mom.

[David Spark] Now it gets tough, and I’m going to tell you that all these answers are incorrect. They are not correct. She is not explaining what the thing is correctly. But again, you have to use reverse logic. You know what these things are, but if you were hearing these terms for the very first time and you were not in cybersecurity, what would your best guess effort be?

Okay?

[Mike Johnson] Sure.

[David Spark] Here we go. And then if they don’t get it right, I’ll throw it to the audience and see if you can figure it out. Here we go.

[Dave’s Mom] In some medium, like kids would get together and push each other.

[Mike Johnson] That sounds terrifying.

[David Spark] What do you think that is? Kids getting together.

[Mike Johnson] Sounds like TikTok to me.

[David Spark] No. Remember, don’t think security. She’s just heard this term for the first time.

[Mike Johnson] Kick each other? Push each other?

[Steve Zalewski] Push each other.

[David Spark] No. Anyone want to take a guess at this one? What do you think?

[Audience member] Cyber bullying.

[David Spark] No.

[Steve Zalewski] Ooh, that was good.

[David Spark] Anyone? Yes?

[Audience member] King of the hill.

[David Spark] No.

[Audience member] Hacking.

[David Spark] No, you’re all wrong.

[Mike Johnson] Mosh pit, yes, mosh pit to…

[David Spark] Someone back there? What?

[Audience member] Games.

[David Spark] No.

[Audience member] Testing?

[Mike Johnson] Pentesting?

[David Spark] No, but that’s a good guess. All right. You’re all going to be surprised. You ready? It is sandboxing. Okay? All right. We see how this game works. Got it? Got it?

[Mike Johnson] Sandboxing.

[David Spark] All right, here we go. Here we go. Next one, everybody.

[Steve Zalewski] That’s a cool mom.

[David Spark] Here we go.

[Dave’s Mom] It’s from a large organization trying to go through you to another organization, trying to work their way through, get your list of people somehow, or get something from you.

[David Spark] What do you think that is, Mike?

[Mike Johnson] Social engineering is what I go to.

[David Spark] No. That’s if she was explaining it correctly.

[Mike Johnson] Yeah, okay. [Laughter]

[Steve Zalewski] I’m speechless.

[Mike Johnson] LinkedIn? Is it LinkedIn?

[David Spark] Okay, what do we get from the audience?

[Audience member] Man in the middle.

[David Spark] Man in the middle is correct!

[Applause]

[David Spark] That’s better. Man in the middle’s correct!

[Applause]

[Steve Zalewski] Oh, man in the middle.

[David Spark] All right.

[Steve Zalewski] Mike and I gave that one to the audience, okay? We didn’t want to make you feel bad. Way to go, audience.

[David Spark] Very good, all right. This last one is the toughest one.

[Mike Johnson] Oh, great, they get better.

[David Spark] But you’re going to love it.

[Steve Zalewski] Ah.

[Mike Johnson] Okay.

[David Spark] Get ready. Here we go.

[Dave’s Mom] Well, when my subscription to one magazine gets mixed up with another magazine, and I get the wrong thing.

[David Spark] All right. Okay. I can’t stress this enough. Think about the very individual words of what this is, and what could that be?

[Mike Johnson] Subscriptions mixed up. Interception? Come on, Steve, you know this.

[Steve Zalewski] No.

[David Spark] He’s dumbfounded. All right, anyone want to take a guess in the audience?

[Crosstalk 00:21:14]

[David Spark] Hold on, wait, I’m hearing lots. What?

[Audience member] Identity theft.

[David Spark] No.

[Audience member] Cross-site scripting.

[David Spark] Cross-site scripting is correct!

[Mike Johnson] Nice. The audience was amazing on this one.

[David Spark] That was awesome. I didn’t think anyone would get that. That is awesome. That was great.

[Steve Zalewski] You and I, Mike, better find another day job here because this isn’t looking good for us.

[David Spark] Somebody knows my mom very well.

[Mike Johnson] Yeah.

[Laughter]

[Steve Zalewski] I didn’t know your dad was in the audience.

Sponsor – NetSPI

21:43.048

[David Spark] The external attack surface continues to expand as organizations grow along with the number of assets and the perimeter. Now I’m talking about our new sponsor, NetSPI here. For the security teams looking for continuous visibility beyond a pentest, NetSPI can help. Start identifying and reducing risk to known and unknown assets with the help of NetSPI’s attack surface management solution and the expertise of their security consultants.

Reduce the noise, validate and prioritize critical risks, and start protecting what matters most. Visit netspi.com.

What’s broken about cybersecurity hiring?

22:40.018

[David Spark] So, why do some cybersecurity interviews feel like you’re attending trivia night or speed dating? Now over on the cybersecurity subreddit, which by the way, if you don’t read that, there’s lots of great questions and topics that come up there. If you haven’t noticed, we pull a lot of our content for their conversations there for this show.

So, one Redditor on there complained about that for senior positions, interviewers asked trivia questions to challenge their cyber knowledge. But then when asked about their expertise in a certain area, they just wanted a yes or no with no context. Is this just a byproduct of HR requiring hiring managers to ask the same questions to all candidates?

What shouldn’t you be asking senior security professionals? And I’ll ask you, Mike, are open-ended questions a waste of time or a valid chance for the interviewee to brag about their security prowess?

[Mike Johnson] So, first of all, bad interview questions are bad interview questions. It doesn’t matter if you’re asking the same one of multiple people. Conversely, the fact that you’re asking the same question of multiple people doesn’t make it a bad interview question. I personally make sure I’m asking the same questions of every candidate because I want to be able to compare the responses.

[David Spark] But hold it, but we’re talking for junior or senior positions.

[Mike Johnson] Absolutely.

[David Spark] Do you feel the same way all the way through?

[Mike Johnson] Yeah, all the way.

[David Spark] All right.

[Mike Johnson] Because if you’re actually trying to compare multiple candidates and you’re asking them different questions, you’re not comparing them. And you should be making these questions up in advance. You should write them down. It’s reasonable for HR to actually require you to ask the same questions.

And by going through that, you’re doing the candidate a service by yourself being prepared. If you’re making the questions up on the fly, if you’re making them up in the interview itself, that’s not going to give you a good measure, and it’s a terrible interview experience. And that’s where you end up with these trivia questions.

I very much remember being asked while I was interviewing for a security architect role way back in the day was what is the number of TCP ports? Okay, I can answer that question, but it’s not a valuable answer for you. I had someone else ask me what is the number of bricks in Brazil? And that was actually a really difficult question that revealed how I thought.

So, the questions matter, but trivia questions don’t help at all.

[David Spark] And correct me if I’m wrong, you’ve mentioned that you’ve actually asked “What’s Worse?!” scenario questions in interviews before.

[Mike Johnson] Oh, these are great because what you get out of it is on-the-spot critical thinking, but also what is most important is explaining how you got to that answer. Just answering, “A is worse than B,” you want to know more, you want to explain your answer. And so that is your opportunity. If you are being asked what seems like a binary question, recognize that it’s a bad question, but expand upon it.

That is your opportunity to brag about yourself. Your whole interview is your opportunity to brag about yourself. But as an interviewee, you can control the flow. And so if you’re getting bad questions, just turn it around and go from there.

[David Spark] All right, Steve, I throw it to you. What do you think questions should and shouldn’t be asked? And do you think they should all be asked sort of equally from junior to senior? Or there’s certain questions you shouldn’t be asking senior? Which is essentially the complaint that was made in this Reddit post.

[Steve Zalewski] Yeah, and I like Mike’s answer, but maybe it’s just because I’ve been in the market a long time like Mike. Political reality entered that question to me. Okay, there’s some political realities that we all understand, which was one, could it be that your reputation and the recommendations that the HR team has already done has made this basically an irrelevant interview?

Which is what they’re doing then is they’re asking you questions because the decision’s already been made. Okay, so now they’re asking you fun questions. Hey, you know how many… Because we’ve got to fill the time, let’s know each other. In essence, the interview is over. What we’re starting to do is build the relationship because we’re going to be working with each other, okay?

And so that’s one.

[David Spark] Hold on, when do you assume that? Like how do you know if you’re going in and already got the job? And so whatever my answer is, it’s just a relationship building effort? Or you should be thinking about it that way?

[Steve Zalewski] So, that’s what I’m saying. Having been on both sides of the camp here, right? That’s what I’m saying is sometimes the questions that are being asked here may be an indicator of decisions being made. So, I’m trying to bring you to the awareness that you can look at, well, the question is stupid, but think about the context of what’s happening here.

Is there a set of questions like this where there’s an indicator? The other one is the decision is made and you’re not it. Okay? And so we’re just going through the motions, which is you’re fodder for the process.

[David Spark] Because you have to interview X number of candidates.

[Steve Zalewski] Interview X number of candidates. Okay. Mike’s answers were absolutely right about how to answer it. That’s why I kind of took it from a different perspective to go think about kind of the political reality of, as these questions are coming out, if there’s a consistency there, realize it may be these circumstances going on so that you’re able to also respond in an appropriate mode, where you may not get upset if they’re easy questions because you may realize, “Oh, wait, kind of like we’re already dialed in and so we’re building relationships.”

Understanding Security Sales

28:23.507

[David Spark] Do we need minimum requirements for cybersecurity knowledge in sales? So, cybersecurity seems fairly unique in that where else do salespeople have little to no underlying knowledge of their product? Of course, as David Colombo noted on LinkedIn, not every role needs this knowledge, thinking marketing managers and other non-technical roles.

But the danger lies in sales evolving to senior positions without a deep understanding across vital security areas. We know salespeople are hustling hard and some are very aggressive, but what knowledge, and I’ll start with you, Steve, do you expect them to have from junior to senior? So, sort of gauge your response here.

And at what level is it cool that they simply don’t know?

[Steve Zalewski] So, I’ll go from junior to senior. So, if you’re an SDR and you’re brand new out and you’re dialing for dollars, so to speak, okay, you’ve been given a script. That’s a get out of jail free card, right? You’ve got a marketing degree or a sales degree and you’re just following through.

So, you read the script, I get it, okay? In which case, it’s just a process and they’re following it, and they don’t know, okay? Once you get beyond the junior level, I personally demand a much higher level of expertise because if you’re a senior guy coming in and doing that, and I’m saying, “So you’re telling me that selling sneakers and selling security is one in the same?” No, enterprise security sales and protecting companies is very different than selling you sneakers and talking about the color of the sneakers or the tread on the bottom.

And I think that’s where historically we’ve been letting the senior sales and marketing teams get away with murder here is because they’ve been selling us sneakers into a security enterprise environment, and we just can’t do that anymore. In which case, don’t let the door hit you in the ass.

[David Spark] All right, what do you expect? And by the way, I mean, have you found yourself to literally write off a company because the sales team was just so unknowledgeable like that? Like they were kind of clueless in the way you just described?

[Steve Zalewski] This is my classic when I was at Levi Strauss, and I’ve done this, and you know it.

[David Spark] We’ve quoted him many times on this one.

[Steve Zalewski] And you’ve quoted me, which was…

[David Spark] Get ready for it. Drum roll.

[Steve Zalewski] …sales team comes in and I watch, and I give them about 12 minutes and then I respectfully say, “I appreciate what you said. I have one question. How does what you do sell more jeans?” If you can’t tell me how it sells more jeans, then it’s not interesting to me.

[David Spark] Does anyone actually have a good answer to that response?

[Steve Zalewski] So, about a third of them have no clue and I say, “Thank you very much for your time, I’m done.” About a third of them actually respectfully say, “We’ve never been asked this before, but will you give me the opportunity to come back in two weeks for 30 minutes and take a shot at it?” Which case I say respectfully, “Yes.” And about a third of them actually say, “I’ve thought about this, but my sales and marketing teams would never let me put that collateral together.

Let me give it a shot.”

[David Spark] All right, well that’s actually an impressive series of responses. All right, Mike, what do you expect in terms of knowledge from sales teams junior to senior?

[Mike Johnson] My expectations are the same. It’s really what am I willing to forgive? To Steve’s point about the junior SDR, maybe I can veer off their script very quickly and they’re not there, they’re not ready for it. They’re in a white space and they’re not quite sure what to do with it. I can forgive that.

But if it’s someone who purportedly understands the product inside and out, I’m not willing to forgive that. I’m not willing to let them make things up or make promises that they can’t possibly deliver on. That’s where we’re just like, “This just isn’t going to work. I don’t believe in your product.

I’m not going to make a purchase. Thanks and have a nice day.”

[David Spark] Do you ever throw challenges like what Steve, you know, how does this help me sell more jeans?

[Mike Johnson] So, I’ve been toying around with asking how it will help me sell more cars. I haven’t quite gotten there yet but I think Steve’s got the trademark. So, I’ve got to figure out a licensing arrangement.

[David Spark] He set that up so you can ask the question. Have you asked, Steve, how does it help me sell more cars? Because you should.

[Mike Johnson] No, no. Because the reality is that is a nuance that people really aren’t going to be able to answer. Selling a car is very different than selling a pair of jeans, by the way.

[Audience member] What answer are you looking for?

[David Spark] Someone’s asking what answer you’re looking for with the, “How does that help me sell more jeans?”

[Steve Zalewski] So, netted out, you’re going to do two things for me. Either you’re going to tell me how this is going to make my security team more efficient, okay, that I’m able to do more with less. Or you’re going to tell me how you’re going to make me more effective at stopping the attacks, which is my ultimate responsibility so that I can triple the revenue of the company without tripling the cost of my security team.

Those are the two answers I’m looking for.

[David Spark] And also call out something that you said once, Mike, on a previous episode of if it’s a vendor like Levi’s and where you can see the online sales process and you can see, “Oh, I can see where this could be a security problem at this step.” [Inaudible 00:33:40] how can somebody say, “Well, I see this step is probably a major security issue, and we can help you with that step.”

[Mike Johnson] Yeah, I do think going and doing some research on the company that you’re talking to, understanding the ways that security could go wrong, an adversary could get in, something bad could happen, and having basically pre-answer that question in your pitch. “I see you have an online shopping cart.

Are you looking for these types of attacks? Based on what I’m seeing in your code, you’re not.” I’m not expecting the SDR to be able to answer that, but that is where they should recognize that they’re going to get over their skis very quickly and they should bring in sales engineers, security architects.

[Steve Zalewski] And I’ll dovetail on that, which was so I talked about efficiency and effectiveness. And I think that’s really important because the difference between doing more with less and doing less with less, right? And ultimately addressing our responsibility to stop the attacks, not just try to eke out every cent out of our resources.

But if you look at it from a business perspective, I’ll go back, and this is what we did to the board is we went up to the board and said, “We have three responsibilities. We have to protect the brand, we have to protect our people, we have to protect our supply chain, and that is how we sell more jeans with security.” So, align to those three responsibilities, and you start to have a really interesting business conversation.

Sponsor – Devo

35:08.789

[David Spark] We have another awesome sponsor and that would be Devo. Let me tell you about them. Devo replaces traditional SIEMs with a real-time security data platform. Powered by HyperStream, Devo’s integrated platform serves as the foundation of your security operations and includes data powered SIEM, SOAR and UEBA.

With AI and intelligent automation, your SOC can work faster and smarter so you can make the right decisions in real-time. Visit devo.com to learn more. It’s a simple site to go to, devo.com. Check it out.

It’s time for the audience question speed round.

35:54.941

[David Spark] All right. We actually have a good amount of time for these questions. So, here we go, gentlemen. I’ve got a bunch of questions in my hand from fine people here at the BSides San Francisco event. And this one comes from Jim McLeod, and Jim McLeod asks – either one of you jump in on this.

Actually, it’s kind of a “What’s Worse?!” scenario situation. Would you rather be attacked by an APT or the NSA?

[Laughter]

[Mike Johnson] Wow, geez. I think I’d rather be attacked by the NSA.

[David Spark] Okay.

[Mike Johnson] Because it’s the what happens next, right? With an APT, who knows what they’re going to do next. You actually kind of know what the NSA is going to do and what they’re going to do with it.

[David Spark] All right.

[Steve Zalewski] Well, I’m going with NSA because I just got a free pentest against a nation-state.

[David Spark] There you go. That’s good. That’s good, okay. This one comes from Yomi Osamiluyi with Wealthsimple, and he asks, “As a CISO,” and again, this could be a very long answer, but just give me one example here, either one of you jump in, “As a CISO, how do you demonstrate value to the business?” I mean, look, you’re getting a big paycheck.

How do you demonstrate you are delivering value to the business?

[Steve Zalewski] Why are you looking at me?

[Mike Johnson] You have the quote. This is the jeans answer.

[Steve Zalewski] So, my suggestion for everybody right now is protect your people, right? Social engineering attacks are the number one way that we consistently get through because people are the weakest link. And so what I would do is focus on the social engineering attack, focus on the fact that that is just getting worse and not better, is the number one way that we’re trying to slow things down.

That’s how I would net it out.

[Mike Johnson] Yeah, and actually what you just said there about slowing things down, that is one of the things that’s key for me is working with the business without slowing things down. This is how we can help the company remain secure, be even more secure without actually being a pain for everyone.

So, it’s really around productivity of the workforce is where we can help.

[David Spark] All right, next one from Ross Haleliuk, who if you haven’t seen, he published the book, Cyber for Builders. Good guy, and I love this question. In an era of consolidation, what are the areas where CISOs are still compelled to look for and purchase point solutions?

[Mike Johnson] Usually where you see these is emerging technologies that your traditional security players haven’t figured out a solution for or isn’t necessarily a skill that you have on your team. If you look at the rise of the cloud back in the day, no one really knew how to secure that. And so there was a lot of point products that came around very quickly.

Now they’ve all become massive companies in their own right, but that was an area where we had to look at point products.

[David Spark] Steve?

[Steve Zalewski] I’m going to take a slightly different tack on that. I’m going to say if you look at the Fortune 500 that are heavy legal and regulatory driven, therefore they have large audit teams, they do lots of audits, and the assessments against HIPAA or PCI or whatever, where the maturity of your security program is what they’re trying to do, then they’re always upping the bar.

So, now I’m having to go find point products to address incremental evidence of compliance as they’re poking holes at small areas now that I’ve got the big ones in pretty good shape.

[David Spark] All right, next question. Quick answer on this from Joe Galuszka of NetRise. In their current state, and I want to stress that, in their current state, what do you believe is the value or efficacy of SBOMs, software bill of materials? What do you think?

[Mike Johnson] I think that SBOMs are something that are very difficult to really operationalize without having it be turtles all the way down. There’s the SBOM of your suppliers, there’s their SBOM, there’s their SBOM, there’s their SBOM. And it really feels like one of those things where unless everybody is doing SBOMs, you’re not going to actually get any…

[Crosstalk 00:40:11]

[David Spark] Well, that’s why I said the current state.

[Mike Johnson] Right. The current state, it’s not good, and at best, I can get some information from my suppliers, but I’ve got 400 or 500 suppliers that are giving us parts that go into our vehicles. I’m not getting SBOMs out of all of them.

[David Spark] All right. Do you have a quick response to this one, Steve?

[Steve Zalewski] That’s an aspirational risk management process, and we’re going to get better over time, and we absolutely have to do it, but it’s going to be a slow journey.

[David Spark] All right, last question, and I cannot stress this enough. You may not dodge this question, all right?

[Mike Johnson] I’m very good at dodging questions. We’ve established this.

[David Spark] You dodged one earlier.

[Steve Zalewski] But there’s 26 seconds left, so if we wait long enough here, let’s keep talking.

[Crosstalk 00:40:54]

[David Spark] That’s not my timing, that’s not my timing. This comes from Misha Sobolev of Aphinia. Okay, either one of you jump in, and you cannot dodge this question! Which CISO are you jealous of and why?

[Laughter]

[Mike Johnson] I’m jealous of Steve because he has retired, and he is living a life that I look forward to leading soon. So, I am jealous of Steve.

[David Spark] Leaving or living soon?

[Mike Johnson] Living.

[David Spark] Living soon. So, you’re telling your current employee that you want to go and live like Steve?

[Mike Johnson] I am telling them that my plan is to retire someday.

[David Spark] So, he is jealous of you, Steve. Who are you jealous of? And you can’t just return the favor.

[Mike Johnson] That’s why I went first.

[Laughter]

[Steve Zalewski] So, I’m going to say Jim Routh, another well-known CISO, major Fortune 500s. Why I call him out is because he is one of my mentors that I aspire to, to say, “How do I pay it forward?” Right? When I get out of the operational role and take all that experience, what’s the right way to pay it forward to make the security community consistently better at stopping the attack?

Closing

42:00.412

[David Spark] And that is the end of the CISO Series Podcast. Let’s hear it for the audience here at BSides San Francisco.

[Applause]

[David Spark] All right, thank you very, very much. I want to thank all the people here at BSides San Francisco. They’ve been phenomenal. Totally professionally run event. This has just been a blast. This is our second time doing it here, and we had a great time. I want to also thank our absolutely fantastic sponsors for making this happen.

That’s Devo, NetSPI, and Eclypsium. Let’s hear it for all of them.

[Applause]

[David Spark] And let’s hear it also for my guests right here. That’s Steve Zalewski on the far left, and Mike Johnson’s been with us…

[Applause]

[David Spark] …since day one, almost a total of six years. I want you to know when I first met Mike, I took him out to lunch. I dropped the bomb on him in that I wanted to do a podcast with him literally first time we met each other. And for some dumb reason, you said yes.

[Mike Johnson] I also had hair.

[David Spark] He had hair. He had more hair than he had…back then. But I appreciate it and I appreciate everyone else here. We greatly appreciate you contributing and listening to the CISO Series Podcast.

[Applause]

[Voiceover] That wraps up another episode. If you haven’t subscribed to the podcast, please do. We have lots more shows on our website, CISOseries.com. Please join us on Fridays for our live shows – Super Cyber Friday, our virtual meetup, and Cybersecurity Headlines Week in Review. This show thrives on your input.

Go to the Participate menu on our site for plenty of ways to get involved, including recording a question or a comment for the show. If you’re interested in sponsoring the podcast, contact David Spark directly at David@CISOseries.com. Thank you for listening to the CISO Series Podcast.