Remember when single sign-on was supposed to cure all for everything that ailed us in security? With so many stories of SSO failures, the security panacea doesn’t seem all powerful anymore. Is it just growing pains or are we seeing more structural issues?
This week’s episode is hosted by me, David Spark (@dspark), producer of CISO Series and my guest co-host Billy Norwood, CISO, FFF Enterprises. Joining us is our guest, Joshua Barons, head of information security at San Diego Zoo Wildlife Alliance.
We recorded the show in front of a live audience at the Planet Cyber Sec conference in La Jolla, CA.
Got feedback? Join the conversation on LinkedIn.
Huge thanks to our sponsor, Praetorian
Full Transcript
Intro
0:00.000
[Voiceover] Best advice I ever got in security. Go!
[Joshua Barons] Always question the status quo. Don’t be afraid to ask why are we still doing something in a particular way. One of the scariest things to hear in security is, “That’s the way we’ve always done it.”
[Voiceover] You’re listening to CISO Series Podcast, recorded in front of a live audience.
[Applause]
[David Spark] Welcome, everybody, to the CISO Series Podcast. We are recording live in front of an audience in La Jolla, California, a beautiful place. It was just a hop, skip, and a jump for me to get down here. This was kind of great. I want all shows to be this close to where I live.
It’s fantastic. My name is David Spark. I am the producer of the CISO Series. You can find us available at ciso-dev.davidspark.dcgws.com. Sitting directly to my left is my guest cohost for today. It is Billy Norwood, the CISO of FF Enterprises. Let’s hear it for Billy.
[Applause]
[David Spark] Excited to be here, Billy?
[Billy Norwood] I am. I’m excited. It’s nice to be here in La Jolla, California, having 70 degree weather in the middle of December. It’s almost Christmas now.
[David Spark] Yes. Yes. All listeners on the east coast, suck on it. That’s what I have to say.
[Laughter]
[David Spark] Hey, our sponsor for today is Praetorian. They are your offensive security partner. When I say offensive security, I don’t mean that their body odor smells or anything like that. I mean it’s offensive as in they are working with you as an offensive security partner to improve your system so you don’t get nailed by a really obvious or not so obvious critical attack.
More about Praetorian later in the show. All right. So, we’re recording this episode at the Planet Cyber Sec Conference in La Jolla, California. Huge thanks to Planet Cyber Sec. Let’s hear it for them.
[Applause]
[David Spark] And before I jump into this, this was something I was kind of concerned about. One of the things we talk about a lot in cyber security, Billy, is diversity and trying to get people on board into cyber security. And I think a lot of signals push people away.
I’m going to give you a perfect example. This young woman I met last night, very eager to get into cyber security, okay? She’s got nine years of product management experience. She works in strategy, lifecycle management for products. Everything she’s done isn’t directly in cyber but all touch cyber, so she’s been in ecommerce, and health, and HR.
And she’s got an electrical and computer engineering background. But every time she goes to look for jobs in cyber, they go, “Oh, well, you need X number of years of cyber security experience.” What would be your recommendation to her on how to present herself of, “No, you really do want me.”
[Billy Norwood] Well, first I’d explain to her that she might be a little intimidated by how technical cyber security is. But as we’ve heard here today, and if you think about it, a lot of it is based on business goals. She has that business knowledge and experience.
She can really take that and go with some basic courses.
[David Spark] Yeah. But how would she sell it to a company? Before… If she wants to sell it… She goes, “Well, they want cyber security experience.” I kept saying, “Yeah, but you need diversification.” And I’m not.
[Billy Norwood] Right. And I agree with that. My first hire at my current company wasn’t as strong technically, but he had a strong background of working with other people in the business and working on risk. And I needed someone to really talk towards that.
[David Spark] Okay. So, if you lean into that, that would be helpful. I’m actually going to bring in our guest right now actually to give an answer to this. This is our guest on the far left, is the head of information security at the San Diego Zoo Wildlife Alliance.
That includes the San Diego Zoo, among many other things. Anyways, big round of applause for Joshua Barrons.
[Applause]
[David Spark] All right, Joshua, or do you prefer Josh?
[Joshua Barons] Josh is fine.
[David Spark] Josh is fine. All right. Josh, what would your advice be for this young woman, beyond what we have advised so far?
[Joshua Barons] Yeah, I think, again, it comes down to it’s a people business. And being able to talk to the business and work within the business, I think that’s really key. So, I’d really sell that when I’m talking about working to get into security.
I’d say, “These are all of the things I’ve done. These are the parts of the business I’ve worked with. This is my background.” I think we have the room for that within cyber security, absolutely. We don’t need 20 years of coding experience.
[David Spark] I agree.
Is this the best use of my money?
4:32.464
[David Spark] All right, we all like to do more with less. We hear this all the time. So, we’re going to start free to low cost. I’m going to ask both of you, and I’ll start with you, Billy, here, what are some free to low cost things organizations with small security teams can do that will have a big impact?
This question came up in our recent AMA, ask me anything, we hosted on the cyber security subreddit, for which you, Billy, you were a part of this. I’m going to just quote a couple of people, not you because we’re going to hear from you now. But Jeff Moss, senior director of InfoSec at Incode, who works with a small team, suggested adopting a cyber security framework like NIST CSF, and starting a risk register.
Jacob Jasser, security architect at Cisco, and several others suggested doing a business impact analysis. So, if you’ve got a small team, Billy, and you need to make a big impact without a lot of spend, what’s your recommendation?
[Billy Norwood] All right, disclaimer, I was one of the business impact analysis pushers.
[David Spark] Okay, good.
[Billy Norwood] My thoughts are, I mean, you need to know where the crown jewels are, what kind of controls are around them, and how to protect them. One thing that I think is special about working at a small…with a small team at a small company is you do have a little bit more time to spend with the executive team.
So, set up regular meetings with them so that you can understand where the business is going, where the crown jewels are, and then work as… I don’t disagree with Jeff. I mean, work on your risk register and align the controls with CSF as you go.
[David Spark] All right. We’re going to come back with more. Josh, I want your answer to this. Low cost, big impact. And even free. I’m eager to hear.
[Joshua Barons] Yeah, so I’m going to take a slightly different approach. There’s so many different things we could do, but I really think cyber security awareness is key. Right? So, working with awareness first. Much of the material is available for free.
The only cost regarding that is really the time and effort it is to put that together and reach out to your colleagues, reach out to the rest of the business. Make sure as you build that brand of cyber security, that is key. Really focus on security awareness.
[David Spark] So, let me ask this question a different way. What money have you spent that has had the biggest impact for you in cyber, Billy?
[Billy Norwood] That’s a tough one. I actually bought a fairly cheap external surface management tool, and that helped me a lot to kind of understand what is exposed out on the internet and allowed me to find things that I didn’t know that we had, that IT wasn’t sure of, but marketing knew that we had out there.
That helped me kind of sure up those attack vectors into my environment.
[David Spark] By the way, I will speak… Everyone who does one of these, uses any kind of awareness tool whatsoever, always a surprise. I am surprised at what’s in my own house, let alone in a corporation. All right, Josh, what has been the best use of your money?
In cyber, that is.
[Joshua Barons] So, best use of my money in cyber, I’m going to actually go with EDR. The reason why I’m going to go with EDR is because that gives me the most amount of protection for the last amount of cost out of the gate. It gives me more visibility into my environment and enables protection on all the end points.
With a small team, I can leverage that to enhance and augment my team.
[David Spark] All right, now I’m going to go to the flipside, and hopefully you’re not going to be ID’ing any of our vendors here or sponsors. What do you think is a giant waste of money? Okay, let me say it this way – when you’re starting out… Let me just clarify.
[Laughter]
[David Spark] When you’re starting out. You’re green. You got a sub three-person team. What’s a waste of money?
[Billy Norwood] GRC tools. They’re a little bit much for kind of just starting off. It takes someone to manage it. I’d almost even include PAM in that, even if cyber insurance requires it. We bought it. We don’t have enough people to manage it.
[David Spark] What about you, Josh?
[Joshua Barons] Yeah, I’m going to second that and kind of say any tool that you can do in a spreadsheet… Like when you’re a very small company without a lot of money… Like if you can do it in a spreadsheet, don’t buy the tool for it yet. Wait until later on when you’ve got a bigger budget.
[David Spark] Yeah, but so many of these tools claim, “Are you working in spreadsheets?” Like they’re mocking your spreadsheet use.
[Joshua Barons] They absolutely are, but I would say without naming a vendor, like what’s the difference with having a risk register and a spreadsheet versus having it in a massive tool that requires 15 people to support it.
If you’re not paranoid yet, here’s your chance.
9:01.885
[David Spark] All right, wasn’t single sign on supposed to solve all of our security woes? Right? You remember this? You know, you force strong MFA. You force logouts, dictating session length, all the great security hits. We love it. Yet we’re still seeing everything from phishing to session high jacking with SSO, that being single sign on.
So, a lot of these issues come down to the failures in the hand off from SSO platforms and application providers. Now, according to a recent piece by Joe Sullivan… Yes, that Joe Sullivan, formerly of Uber, and Atul Tulshiibagwale for CISO Online. So, applications often don’t enforce SSO restrictions.
I’m going to start with you, Josh. Is this just growing pains for SSO, or does this hint at a persistent problem we’re seeing?
[Joshua Barons] Yes, I’m going to say growing pains for sure, but SSO has always been a balance of convenience and security. SSO at its best can simplify the user experience. It can add security that may have been lacking in an application or maybe even a platform or environment.
However, I think we’ve all seen firsthand with a token that did not expire or maybe it should have required MFA or maybe even a user risk might have been heightened where some issue where it wasn’t revoked, and the user still had access to something they shouldn’t have had.
[David Spark] Have you become in any way disillusioned by SSO, Billy? Because most people… Let me just throw this out before you jump in. We ask like, “What’s the one thing you can do that will have the biggest impact on your security?” By the way, one of the thing we hear often is EDR, but the other one is like MFA, password management, SSO.” Those are kind of the big hits that we hear.
But have you been disillusioned at all by SSO?
[Billy Norwood] I wouldn’t say I’ve been disillusioned by it. I just think it shows that we can’t just play set it and forget it, check a compliance box because it’s going to… Things are going to evolve. We’re seeing all these attacks evolve where people are taking tokens in the middle of it, so we have to set shorter and shorter session limits.
Very similar to encryption, right? Over the past few years, NIST has shortened and shortened the time you should be keeping those keys around because it’s easier for people to get access to them now than it used to be.
[David Spark] So, actually, that’s an interesting point. I think you might be right. I think a lot of people have a set it and forget it attitude towards SSO. Do you think that’s why these are failing, Josh?
[Joshua Barons] So, I think that could absolutely be a major part of it. I think the other part though is the SSO tax, right? And also changes for those applications.
[David Spark] Explain the SSO tax.
[Joshua Barons] So, there is a fee with many applications that you have to pay in order to actually implement any kind of SSO. Like they say, you have to spend this amount of money to get these services where they check the box.
[David Spark] By the way, there is a website. I don’t know how updated it is because I knew it was [Inaudible 00:11:58] But there is… I think it’s sso.tax, which sorts of outs the companies that do this.
[Joshua Barons] Exactly. And that’s a huge barrier to entry. Then I think one of the things that we’re kind of seeing is once you’re tracking these applications is that you may have integrated at one point, and now they’ve changed their model, and now they’re going to start charging a fee.
If the teams aren’t aware of it, suddenly your SSO is broken.
[David Spark] By the way, all this negative news on SSO does not dissuade you from using SSO, right?
[Joshua Barons] Yeah, absolutely not. I want to use SSO. I mean, again, there’s a value there. We’re making it easier for the end user. We’re trying to make a good experience for them.
[David Spark] So, what is the management, Billy…? And I know you alluded to this earlier. So, you don’t have the set it and forget it attitude towards SSO. What is the management you should do, and how regularly should you be doing it?
[Billy Norwood] Right. I think this is one of the parts that can cause some disillusionment is to audit of all the things that are connected. We’ve heard here today and you hear from a lot of people that they have 150, 450, 1,000 SAS applications. So, let’s say they all have SSO.
Where are you going to look for where is MFA? Do you have to buy a tool to audit it? Do you have to go work with the group that owns that tool that’s sewed in to figure out do you have the right settings? I would love to do this regularly, but I have a small team, as I mentioned earlier.
But I think that’s what we have to kind of figure out.
[David Spark] All right. Actually, I’m going to close, because you referenced it. This was a question I asked a while ago. I asked the security community, “Is there truly anything in security that is set it and forget it?” The answer was no, but I’m interested to know what’s the closest thing that comes to set it and forget it in security.
What do you think?
[Billy Norwood] Yeah, this is a tough one. I’d say that maybe since we talked about passwords, usually that’s gone a little bit longer because it kind of lasts as far as how fast we can crack them. But sometimes I think that eight-password being okay lasted for about a decade.
[Laughs]
[David Spark] Okay. What do you think the closest to set it and forget it? Assuming we know it’s not. What’s the closest?
[Joshua Barons] Yeah, I like the password policy one. I mean because you’re basing it on standards. The standards don’t change that often.
Sponsor – Praetorian
14:13.983
[David Spark] Our awesome sponsor is Praetorian. You remember, I told you they were your offensive security partner. So, let me tell you before anyone goes any further. We’re going to talk about Praetorian. So, they help security teams go back on the offense and shift cyber programs from a reactive, assumed breach mentality, which I know many have gone that route, to a prevention first strategy.
Praetorian’s adversarial experts protect your business from evolving cyber threats by continuously emulating attackers to help you identify and mitigate your material risks before attackers have the opportunity to exploit them. So, let Praetorian do it first so you know.
So, with Praetorian as your offensive security partner, you can actually stay several steps ahead of attackers and avoid the high cost of breaches. The best defense is a good offense. For more, you got to go to their site. I’m going to spell it to you.
You’re going to go to praetorian.com. Check it out.
It’s time to play, “What’s worse?”
15:32.002
[David Spark] All right, we’re going to, “What’s Worse,” now. So, for those of you who are not familiar with, “What’s Worse,” this is a risk management exercise, okay. I’m going to provide two awful scenarios. You will not like either one of them. No, you won’t like them at all.
But you got to pick one, and that’s the way it works. You got to pick one to tell me which one is worse. Not the one that’s better, hence the name is…the game is called, “What’s Worse.” I’m going to make you answer first, Billy, for the first one. Here we go.
This comes from Tim, information security director in Arizona. So, that’s as much as he’s willing to reveal at this point. By the way, I want you all to listen along because I’m going to want your opinion after this. Okay, so it’s an audit scenario. You have a large audit that could have serious consequences if you fail.
Scenario number one. The IT leaders tell auditors what the auditors want to hear, even if it’s entirely different from what the engineers state as configured. The engineers are told they are not allowed to talk to auditors without a leader present. Not good, right, Billy?
[Crosstalk 00:16:45]
[Billy Norwood] I would agree.
[David Spark] Okay. Well, wait for number two. Senior IT leaders notice the auditor is very young and make ageism jokes. They then encourage you to withhold information as the auditors are, “too young and dumb to know any better. They’re just following a checklist.” All right, let’s hear it.
Which one is worse?
[Billy Norwood] I would definitely say number two. I mean, you really can’t make ageist jokes, especially in California or anywhere in this day and age.
[David Spark] Oh, people get away with ageism. Although on the flipside, actually, of that… But okay, so this is your argument is the ageism jokes? I think there’s worse to this.
[Billy Norwood] Because either way, you’re lying.
[David Spark] Well, either way you’re lying. But which one is worse here? So, it’s number two. Because of the ageism stuff?
[Billy Norwood] Right. Insult to injury, you’re lying to them, and you’re being ageist.
[David Spark] Okay. Oh, yeah, that’s good. It’s a double whammy here. All right. Do you agree or disagree here, Josh?
[Joshua Barons] Yeah, they’re both horrible, but I agree. I think having the ageism jokes and stuff, that’s not going to work.
[David Spark] It’s not going to work. It’s simply not going to work. Okay. Let me ask the audience now. I’m going to go turn to the audience. By applause, the first situation is to just tell the auditors what they want to hear, and it’s completely different from what they’ve got going on.
Now, I should point out that the second scenario, they’re not lying, they’re just withholding information. So, it’s not a flat out lie. It’s just not… I know. There’s a fine line between the two. So, how many people think the first scenario where they really are flat out lying?
By applause, how many people think that one is worse?
[Applause]
[David Spark] All right, number one. Number two? How many think it’s the ageism jokes and they’re just withholding information from the auditors who wouldn’t know better?
[Applause]
[David Spark] Did you applaud for both of them? I think Ed of… No, no, oh, it was you. Okay. You didn’t applaud. Oh, wait. So, Ed, hold it. Applaud again. Give me one more.
[Applause]
[David Spark] So, it’s just you… Everyone is against you guys. Yeah, but everyone here wants to make…
[Billy Norwood] But he’s clapping the loudest.
[David Spark] No, Ed is clapping the loudest. Everyone is all fine with making ageism jokes, I think, in this room. No. It is… Again, it’s a, “What’s Worse,” scenario. All right, here we go. Second scenario. Thank you very much, Tim, from Arizona. This one comes from one of our most prolific, “What’s Worse,” scenario submitters, and it’s Dustin Sachs.
This one is quite humorous, all right? So, here we go. “What’s worse?” Dustin comes from the World Connect Corporation. “Having your smart home device malfunction and play loud music in the middle of the night, waking up the entire neighborhood, or having it misinterpret your voice commands and start ordering random items online, leaving your house full of rubber ducks and disco balls?” Which one is worse?
Actually, I’m going to start with you, Josh. You got to answer this one first.
[Joshua Barons] I think the one with all the junk.
[David Spark] That’s worse than waking up the neighbors?
[Joshua Barons] I can explain.
[Laughter]
[David Spark] This I want to know. Okay, I’m your neighbor. I’ve been woken up. “What’s this racket, Josh? What are you doing?”
[Joshua Barons] My smart home malfunctioned. I have no control over it.
[David Spark] You have no control. That’s your weak excuse? Don’t you work in security? Aren’t you a tech guy?
[Joshua Barons] It’s just my smart home. It’s not… I didn’t manage it.
[David Spark] It’s not that smart. I’ll tell you that much. The HOA is going to vote you out is what’s going to happen. All right. Billy, which one is worse of the two?
[Billy Norwood] I will agree with him. I’d rather not have to deal with trying to get refunds of everything online through that. That would just be more of a pain to me than dealing with my neighbors.
[David Spark] Yeah, customer service…Amazon is phenomenal. They’d be happy to refund.
[Billy Norwood] Both of my neighbors have been remodeling their houses for the past six months to a year, so I’m fine with it. I might just do this for fun and blame it on my smart home.
[David Spark] Oh, that’s a good idea. All right.
[Applause]
[David Spark] [Laughs] All right, I’m going to throw it to the audience. All right, which one…? By applause, how many people think waking up your neighbors in the middle of the night with your smart home malfunctioning is worse? By applause.
[Applause]
[David Spark] What? Two, three? Three people. All right. By applause, over ordering on Amazon and getting all the stuff you don’t want. By applause.
[Applause]
[David Spark] All right. All right. You guys finally redeemed yourself. Good job.
Should you ignore this security advice?
20:49.781
[David Spark] Would cyber security benefit from a little behavioral economics? Now, we talk all the time about now forgetting the human element in cyber security, but it’s easy to forget that there’s an entire discipline that studies why humans make irrational decisions, noted Keavy Murphy on Dark Reading.
Now, for example, how often have we seen the sunken cost fallacy see decision makers cling to a security roadmap that’s no longer relevant because of a prior investment? So, I will start with you, Billy. Can you give some other common irrational behavior in cyber security, and how do you make yourself aware of it and others, and combat it?
[Billy Norwood] I think I’ll start with I feel like an easy one first, is phishing for instance. Users are used to having… They see an email come in quick. It looks like it’s coming from the same address. They’re kind of thinking, “Okay, this is fine.” I don’t know if it’s irrational.
You could call it lazy. You could call it they’re very, very busy, and their mind is not on top of things. But they end up clicking on that, and that causes a big issue.
[David Spark] All right, that’s a big one. What do you think, irrational behavior, Josh?
[Joshua Barons] Yeah, so I’m really interested in the human dynamic and the way these decisions are being made. But I think the key thing is to be cognizant of behaviors and put processes in place to avoid those downsides of maybe something that was done that way.
So, a good example would be with roadmaps or a tendency to stay with a certain legacy solution because it’s easy. Maybe it’s easy, because you have a vendor relationship. Or it’s easy because that’s the way procurement works. That can really lead to a huge problem.
Also, I think one more way to kind of avoid that is periodically doing some sort of exercise where you’re doing a stoplight exercise, like what’s working, what’s not working, what do we need to stop doing.
[David Spark] All right, let me ask actually the reference that came up…the security roadmap that’s no longer relevant because of some prior investment. Have you suffered or watched others suffer from the prior…the sunken cost fallacy and think, “Oh, because we spent this, we have to go down this road.” I mean, I kind of feel everyone has felt that kind of pain.
Have you been subject to it? Have you fallen prey to it? How did you manage it?
[Billy Norwood] Well, I mean, I think one of the other aspects of that that a lot of security leaders can be accused of is chasing the next best tool. Sometimes when you’re…
[David Spark] Oh, so that’s the other side of that coin, yeah.
[Billy Norwood] Right. Right. So, I think to tie both those things together, you’ve got to keep your roadmap let’s say five years out. You keep the high goals, what are we doing for the business, there. When you start getting into the ground level work and tooling, maybe you need to keep that around two years out and continuously do tool rationalization projects, tool authentication projects.
If you have that tool, are you maturing it? Or is it the wrong tool completely, and we need to get something new for a newer threat?
[David Spark] You know what’s interesting? Another… Adam Glick, actually, was a CISO who mentioned what he’d love to know is, “How far am I off? Like, I set my tools like this today. Six months from now, how far am I off the optimum? Because it was optimum today, but six months from now it’s not.” So, I’m assuming you run into this, Josh.
Yes?
[Joshua Barons] Yeah. Well, I’ve definitely see that. I think the way that I’ve approached that is like working with vendors and treating them like they’re an advisor, and doing health checks and doing things like that to make sure that we always are doing the right things or that maybe a config hasn’t changed in a way that it shouldn’t, or that it does change in the way it should because things have changed.
[David Spark] Actually, that’s really, really good advice. I mean, it sounds like even when you’re setting up a purchase with a vendor, like, “Let’s have regular checks to look at our setup,” have you guys done that before?
[Billy Norwood] Definitely do that. I make sure to make it a partnership. We’ve heard people that they talk about…
[David Spark] We hear this all the time, yeah.
[Billy Norwood] …looking at smaller companies sometimes, not just the big players. They will sit down with you, go over the roadmap, and take advice about that roadmap. That’s a great partnership.
[David Spark] Oh, we hear this all the time from CISOs about how much they love to work for startups because those startups are looking for early wins, and they will flip to make those sort of early wins happen. Josh, you’re nodding your head.
[Joshua Barons] Yeah, absolutely. Earlier today, there was a company that was mentioned where I said, “Hey, could you just add some tags to that?” And within seven days, the tags were there. I think working with a startup gives you a great opportunity to sort of adjust your plans and make sure that the solution works best for you, and most of your colleagues as well.
Because you’ll find that the things you’re asking for are probably things your colleagues are asking for as well at other companies.
What’s it going to take to get them motivated?
[Billy Norwood] There are a lot of similarities between traditional first responders and cyber security incident response. Now, readiness is key for both. But Mark Stone with IBM Security Intelligence wondered if cyber security can truly operate at that first responder level.
We know what we’re talking about. We’ve seen first responders react. First responders need to adapt to changing conditions, just ask a firefighter about extinguishing an EV fire. Now, does the pace of cyber security threats allow room to create that discipline?
Can you be truly a first responder in cyber? And if so, is this about doing better red teaming, or is there a bigger mindset challenge? What do you think, Josh?
[Joshua Barons] Yeah, so I think that you can. But I think that there comes with it a downside. I think there is a challenge, and I think we’ve all seen it, is like making time for yourself and self-care. I think burnout, mental health, those are all real.
I think we see that with first responders, too. So, I’m kind of taking that tie in of saying as a first responder, we’ve seen that. In many cases when we moved into this industry, we said, “All right, we’re paid to be paranoid.” That’s a huge shift. You take that home with you.
[David Spark] What do you think, Billy?
[Billy Norwood] I definitely agree with that. Again, small business ideas and having a small team. It would be great if we could go out there and create a IR playbook for every one of these new threats that are coming out. They’re coming out so fast.
It’s really hard to do. We really need to change our mindset that we have to work in cooperation with everyone else. I know a lot of us are doing this, but not everyone is. But you need to… Not everyone might be able to have the money or the industry to join a local ISAC, but we have a lot of pure networks out there, a lot of things we can join for free, see what we can take from others to help us create these… You know, CISA is coming back with vulnerabilities remediation, but I mean if we have more playbooks for some of these threats, that’s something we could put together as a community to help some of the smaller businesses that don’t have the time, because so much is coming out so fast.
[David Spark] So, often sort of this being readiness takes the form of tabletop exercises. And two things I hear about tabletop is, one, it’s hard to get…just to do one because you need so many leaders in a room, which just that task alone… Forget about everything else.
That task alone is difficult. The number of times you can do it in a year once even is tough enough. Is there something else outside of tabletop exercises or mini tabletop… I don’t know. But that can sort of improve this process if you can’t do the grand version of it?
What do you think, Billy?
[Billy Norwood] I think there is. We’re looking at this year doing technical tabletops with just my team and the infrastructure team rather than pulling in the execs for everything. I mean, full ransomware blowout, right? The entire executive team needs to know how we’re doing communication strategies, what are the legal ramifications.
There is a lot there. But for something like initial containing the threat, I think we [Inaudible 00:28:45] able to do something just with our teams that’s a little bit smaller.
[David Spark] What about you, Josh? What can you do to sort of I guess iterate more often so you don’t have to rely on this one giant tabletop with all the execs?
[Joshua Barons] Yeah, so I agree with breaking them out and doing smaller ones with different teams. I think especially as you’re going throughout the business and looking at maybe even different operating companies, or business units, or just areas of the business, doing separate ones and really focusing on their business needs, too.
So, don’t come to the business with, “Here’s sort of my exercise we want to do, focusing on security.” Let’s look at what’s key to them, and let’s walk through that.
[David Spark] I mean, I got to imagine that just doing everything you’re talking about requires prioritization over the daily firefighting that you’re doing. Or can the daily firefighting play into all this as well?
[Billy Norwood] Definitely daily firefighting can be… It’s lessons learned. It’s making sure that we share that information from…whomever was tackling that incident shares it across the teams. That can be done with a weekly team standup and just, “What did we learn this week?” Or it could be done something more specific around just holding a whole talk focused specifically on response.
[David Spark] So, let me close this out and ask, what in all the things we talked about, either tabletops, the little, mini things, working with other teams…what have you in this sort of effort to be a better first responder for your cyber team has been most affective for you?
Josh?
[Joshua Barons] I think the most affective thing for me has really been having those relationships established with the business. So, as the small tabletops are working with those business units, it’s having those relationships, knowing who the people are, and understanding that.
That’s really the most benefit that I get from the tabletops – knowing who to talk to, and when, and how to talk in their language.
[David Spark] Billy?
[Billy Norwood] I agree with that, and I’m going to reiterate understanding where those threats are coming from, listening to people across that board so you know what to look for sooner than later, so you’re not exposed… Shorten that time.
It’s time for the audience question speed round.
30:53.797
[David Spark] All right, I’ve got a bunch of questions in my hand, and actually we got a good amount of time. So, questions from our audience, and let’s get through as many of these as possible. Answer whatever you think you can answer. I like this one from Chris Ancharski of Blue Lava Community.
That’s part of Zyston. “What’s the worst cyber security advice you’ve received or heard?” Either one of you jump in on this.
[Joshua Barons] The worst advice I’ve actually heard has been to say no.
[David Spark] To say no to…?
[Joshua Barons] To the business. Say, “No, don’t do that.”
[Crosstalk 00:31:33]
[Joshua Barons] “Don’t use that thing.”
[David Spark] So, being the department of no.
[Joshua Barons] Being the department of no. I’ve heard that advice.
[David Spark] You’ve heard, “Just tell them no, we can’t do that.”
[Joshua Barons] Absolutely. That’s the worst.
[David Spark] Who was it that told you to do that? And you don’t have to ID them.
[Crosstalk 00:31:45]
[David Spark] Just simply the position they were at.
[Crosstalk 00:31:47]
[Joshua Barons] The answer is no.
[David Spark] No. Oh.
[Laughter]
[David Spark] All right. Billy, worst advice?
[Billy Norwood] I had a guy that ran a data center, and he helped us out with some of our security. This is back in the day. It was my first PCI audit years and years ago. And he’s like, “Security by obscurity. They’re not going to figure us out. We just hand them back what they need.” That kind of ties into our first audit conversation.
But security by obscurity, it’s too complex for them to figure it out.
[David Spark] There is some element, I think, of truth to that. Hold on, I’m going to double down on that. Because Mike Johnson, one of my other cohosts, he would say, “My goal is to make an attacker’s job more difficult to essentially compromise me.” Now, obscurity is a level of complication, but it is just a level.
And it could be a very weak level. It could be like putting a tablecloth over it. So, yes, it is bad advice. Would you accept there’s a veneer of good advice there?
[Billy Norwood] A light veneer, right? As long as you are really not obscured by the mess that you have created and can chase down troubles pretty easy and identify them.
[David Spark] Have you faced people who were pro security through obscurity, Josh?
[Joshua Barons] Yeah, definitely faced it.
[David Spark] And how do you deal with it?
[Joshua Barons] We move away from that.
[David Spark] All right, there we go. All right, this one comes from Steve Weil of Point B. “What language do you struggle to get into third party contracts?” He was bringing this because he’s a small organization, and he’s dealing with really big organizations.
And he would like, given their situation, certain other language. But these companies have these huge lawyers and these just sort of boiler plate contracts. Like, “It’s either this or nothing,” kind of a thing. Have you, a, dealt with it. I know you both have sort of smaller teams.
Have you dealt with this, and how do you manage it?
[Billy Norwood] I’d say sometimes business continuity pieces for getting…for SAS software. A lot of times that isn’t quite thought through around where our data goes and how our data gets back, kind of the data aspects of business continuity. Moreso it’s like if we see an SLA, people usually check that box and don’t want to actually write a full addendum.
[David Spark] Good point. What about you, Josh?
[Joshua Barons] Yeah, so my experience is we tend to use security riders, and we have those defined based on different types of businesses. But that being said, it’s not always a very complex rider. So, sometimes the rider may only be five things. It’s kind of like what’s key based on that relationship or that type of vendor.
So, maybe I really only care about breach notification, so that’s going to be my clause.
[David Spark] All right. All right, this one comes from Ed Covert over at Bowhead Specialty, and he asks, “Outside of banning AI, how are you ensuring that AI doesn’t introduce unnecessary risk within your organization?” I’ll start with you, Josh.
[Joshua Barons] So, we’re just going to say no. No, of course we’re not going to say no.
[David Spark] [Laughs] He said without outright banning.
[Joshua Barons] Yeah. No, I think we need to embrace it, and I think really a lot of the policies we have in place already address it. I think we already have policies that say things like, “Don’t put sensitive information in certain places. Don’t share private information here.
Don’t put that data there.” We’re already covering that. I think that’s the… It’s the same approach with AI.
[Billy Norwood] Well, shameless plug, I gave a talk on AI privacy and security at IAPP this year, but I kind of turned that presentation more inwards towards our own company. I first presented to the entire IT team, “This is some of the things AI can do for you, and these are a lot of the risks.” And trying to get everyone in the IT team kind of up to speed.
Now I’m actually working with our head of data, who’s kind of interviewing everyone in the company how they may use AI, and we’re going to do a duel presentation for the whole company on uses for AI, how this could help you, and then go onto the risks.
Our goal is, again, not to say no but to get everyone to understand the risks and establish IT as the go to. So, any time you want to use AI, you come through us because we’re obviously knowledgeable about it.
[David Spark] All right, good answer. All right. From Heath Niedu of Ember River, “What’s a type of entry level candidate you want to hire that you haven’t been able to hire?” Has that come up?
[Billy Norwood] This just has to do with budget, but I’m hoping to hire someone next year, and getting someone with AppSec, right? Finding someone who’s a developer, who is moving into cyber security, because those guys can be pretty expensive for a small team.
But getting someone on there and kind of training them up would be great.
[David Spark] That’s a popular category. What about you, Josh?
[Joshua Barons] Yeah, I don’t think it’s really a skillset thing for me. It’s always just been budget. Any company I’ve been in, that’s where it comes down…
[David Spark] But there isn’t like a… But it’s sort of a type of thing, “Oh, if I had someone who had this skill and this skill, it’d be great to round out my team.”
[Joshua Barons] Yeah, I really haven’t had that experience. I would say every time I’ve been hiring, I’ve had a lot of candidates to pick through. There is a lot of people out there who are looking to get into cyber. I don’t think there is any challenge.
[David Spark] All right. Okay. This comes from Mark Coltharp over at Zyston. He’s going to be talking about the vulnerability program management. It’s not vulnerability management but how you’re building out the program to deal with remediation. Okay, so how are you improving IT and cyber relations with the vulnerability program management…the remediation?
So, what have you done to sort of improve that process? Very much focusing on process. Either one of you.
[Joshua Barons] So, earlier I had said that’s the way we’ve always done it. I think vulnerability management is one of those things. I think there’s been a big tradition of, “Here’s the vulnerabilities. Go fix it.” What I’ve been trying to do is partner with IT and say, “Okay.
Well, here’s some things that we can help you with.” Not only just, “Here’s the path to do it,” but, “He, how can we help? Let’s do this together, and let’s approach this in a better way so we can actually make progress on it instead of just having tickets passing back and forth between teams.”
[Billy Norwood] I agree with that. One of the ways we’re doing that is through prioritization. “Is this thing exploitable? Is this thing…?” I talked about attack surface management. “Is this stuff touching the external network?” Then when it comes to internal things that aren’t touching the network or anything like that, a lot of times we’ll do some pen testing for them to help them categorize the ones that may be exploitable to see if we can actually exploit them.
So, we’re just trying to lessen the workload because, honestly, there’s a lot out there. They keep coming up.
[David Spark] All right, lastly… Well, second to last. Laz at Zyston wants to know, “You’ve been following the Clorox situation. What the heck happened from what you understand?” What do you understand happened over there at Clorox? Josh?
[Joshua Barons] I wouldn’t say I necessarily understand, but I think there is a lot of risk with being a CISO. What I will say is it’s interesting that the headline from Forbes was “Clorox Scapegoats Cyber Chief.”
[David Spark] Yeah. Well, by the way, we haven’t heard that often. We used to hear it, long period of not hearing it. It’s coming back, like fashion. What do you think?
[Billy Norwood] No, I agree. It’s something that we all really need to think about. There is talks all over the place about the SEC ruling and whether CISOs need DNO insurance and understanding on what level we’re reporting. Where do we land in figuring out materiality?
Obviously, that’s something logistical council can… We aren’t able to necessarily always be…except for advised…on any reporting up to the SEC or an annual filing. So, it’s scary. Maybe sometimes it is better to walk, and maybe that’s… You hear a lot of talk about people like, “Eh, half of us are going to leave our jobs before 2025 as a CISO.” But I don’t think it’s quite that scary, but it’s definitely the next year or two is going to be very interesting.
[David Spark] All right, very, very last question. This comes from Alok Nandan of First Rays. “Would you like a CISO gig at Clorox?”
[Joshua Barons] I think it’s a great opportunity, to be honest. I think we always kind of say if there’s a major incident, that’s an opportunity. And I think that the program is probably going to really change quite a bit.
[David Spark] By the way, usually when something that bad happens, the pay for the next CISO is off the charts. Usually.
[Billy Norwood] Yeah.
[Joshua Barons] That could be a plus as well.
[David Spark] Of course. [Laughs]
[Billy Norwood] I would agree with that. Maybe it’s not everyone, but if you… Experian is one of the best examples. They went from getting hit for several breaches to having one of the most open cyber programs and notifications, “This is kind of where we’re at.” What they put in their 10-K is pretty great to look at.
So, I’m hoping that if I did take a job at Clorox that it would move that way.
Closing
40:21.600
[David Spark] Well, awesome. That brings us to the very end of this very show. Huge round of applause for my guest, Billy Norwood, over at FFF Enterprises.
[Applause]
[David Spark] And also Joshua Barons over at the San Diego Zoo.
[Applause]
[David Spark] I’m going to let you guys have the very last word. Also, huge round of applause for two other organizations. One, Planet Cyber Sec for putting this whole darn thing on.
[Applause]
[David Spark] For those of you listening, Planet Cyber Sec and Richard Greenberg over here, they put on tons of great shows, mostly all in southern California. Yes, Richard? Yes, all in southern California. Just to go their website, planetcybersec.com.
And huge round of applause for our sponsor, your offensive security partner, Praetorian. Let’s hear it for Praetorian.
[Applause]
[David Spark] All right. With the few seconds that we have left, do either of you have any last words? Yes, Billy?
[Billy Norwood] Mentorship is important. At any time in your career, both mentoring others and finding a mentor for yourself.
[David Spark] That is key. Even as a CISO, yes?
[Joshua Barons] Although my team is not hiring, we are always hiring.
[David Spark] Aw, that is good. And it must be fun to work at the zoo, yes?
[Joshua Barons] It is amazing.
[David Spark] It’s got to be. All right. Well, a huge thanks to our sponsor, Praetorian, Planet Cyber Sec, this entire audience. We greatly appreciate it. And we also, for the listening audience…we greatly appreciate you contributing and listening to the CISO Series Podcast.
[Applause]
[Voiceover] That wraps up another episode. If you haven’t subscribed to the podcast, please do. We have lots more shows on our website, ciso-dev.davidspark.dcgws.com. Please join us on Fridays for our live shows, Super Cyber Friday, our virtual meetup, and Cyber Security Headlines Week In Review.
This show thrives on your input. Go to the participate menu on our site for plenty of ways to get involved, including recording a question or a comment for the show. If you’re interested in sponsoring the podcast, contact David Spark directly at david@ciso-dev.davidspark.dcgws.com.
Thank you for listening to the CISO Series Podcast.