The rush of new GenAI tools opens the doors to even more low-code and no-code apps in businesses. But just as we’ve struggled with shadow IT, are we prepared for the shadow engineering these apps will bring? What controls can we put in place to stop them from getting out of hand?

This week’s episode is hosted by me, David Spark (@dspark), producer of CISO Series and Sasha Pereira, CISO, WASH. Joining us is Cyrus Tibbs, CISO, Pennymac. This episode was recorded live at ISSA-LA Summit.

Got feedback? Join the conversation on LinkedIn.

Huge thanks to our sponsor, Nudge Security

Full Transcript

Intro 

0:00.000

[Voiceover] Biggest mistake I ever made in security. Go!

[Cyrus Tibbs] The biggest mistake I ever made was back in the day when we all started realizing that signature-based AV wasn’t working, that I quickly adopted and quickly deployed an early AI AV and learned the lesson the hard way through many outages and many lost nights of sleep and lost reputation.

[Voiceover] It’s time to begin the CISO Series Podcast, recorded in front of a live audience in Los Angeles. 

[Applause]

[David Spark] Welcome to the CISO Series Podcast. Guys, do you not know how to applaud? Like, some of you wooed, two or three of you applauded. Trust me, there are actually a lot of people in this room. You wouldn’t know it, listener. This audience needs some basic audience training on how to applaud.

They don’t quite get it. Anyways, we are here at the ISSA LA Summit. This is the third time the CISO Series has come here. We are thrilled to be here. Let’s hear it for the ISSA, let’s hear it for them, for putting on this great show. 

[Applause]

[David Spark] All right, that’s evidence there are people in the room. All right, there you go. Thank you very, very much. My name is David Spark. I’m the producer of the CISO Series. And joining me on stage as my guest co-host is the woman to my left. It is Sasha Pereira, the CISO for WASH. Let’s hear it for Sasha.

[Applause]

[David Spark] Welcome, Sasha. 

[Sasha Pereira] Thank you, it’s great to be here. 

[David Spark] Our sponsor for today’s episode is Nudge Security. Let’s hear it for Nudge, our sponsor.

[Applause]

[David Spark] We’re going to be hearing about them more later in the show, SaaS security, if you need it, who doesn’t? You’ll hear more about that later. All right, so Sasha, just today, I want to bring up just a quick point. Just today, I received a series of sales emails, and they were emails that I think they wanted to try to close the sale in the first introduction.

You know what I’m talking about. The one that gives you everything, let’s set up a demo, when are we going to close the sale? Like, it’s all in the first message. You’ve received these, yes? 

[Sasha Pereira] Oh, yeah. Oh, yeah. I mean, I think they’re getting more, like some of them are like, “Well, tell me if I should go away,” and I’m like, “Sure, go away.”

[David Spark] [Laughter] If you have to ask a question, I think you know the answer at that point. 

[Sasha Pereira] Yeah. Usually they give you multiple choice, like one, I’m not interested, two, something, and three, they try to make it funny. 

[David Spark] Right, they think it’s funny, but when you’ve seen the joke a hundred times, it’s not funny, it’s irritating. I know. It’s also, it’s hard to pull sarcasm when you don’t know the person. 

[Sasha Pereira] I mean, especially if it’s like something that’s mail merge, right, and you can tell.

[David Spark] Yes.

[Sasha Pereira] Like when they put your last name as your first name and it’s like, “Dear Pereira,” I’m like, “Okay.” 

[David Spark] Well, I get sort of the vague compliments, “I love the CISO Series and how you talk to the people about cybersecurity.” That is a pretty obvious tell. 

[Sasha Pereira] Well, also now with GenAI, it’s like the emails are getting better. There’s less spelling mistakes. 

[David Spark] I just, I think it’s called NotebookLM from Google, which I just saw, a friend showed it to me, literally just pointed it to one of our past episodes and it generated an entire podcast episode of two people conversing with each other about our episode and it sounded like an actual podcast.

[Sasha Pereira] It’s pretty neat. Yeah, I’ve seen a doctoral candidate who put all his research papers into NotebookLM and basically it created a podcast. 

[David Spark] Talking about his research. 

[Sasha Pereira] Yes, about his research. 

[David Spark] It’s astonishing. Very, very impressive. All right, enough of this nonsense. We’re going to get this show going. We have a guest who’s been sitting very quietly on the far end of the stage. Let’s introduce him. It is the CISO for PennyMac, Cyrus Tibbs. Let’s hear it for Cyrus.

[Audience Member] Yeah, Cyrus. 

[Applause]

[Audience Member] Whoo!

[Cyrus Tibbs] Happy to be here, really honored to be here. 

What’s the starting point for a CISO? 

3:54.531

[David Spark] So, you don’t actually need to listen to many episodes of Cyber Security Headlines to understand how rampant data exposure is across industries. Combined with regulatory pressures, there’s a real move towards data minimization. Now, tips from Forbes Technology Council members include using edge devices to minimize what you send to the cloud, setting defined purposes for data collection, thinking of data as a toxic asset, and using tokens as a substitute for sensitive elements within your data.

So, I’m going to start with you, Sasha. What are the data minimization steps organizations can do right away, and which ones take more planning? And then let me add this – and would the effort really pay off with decreased exposure, or do you think is data just growing at such a rapid rate, there’s no way to get it under control?

[Sasha Pereira] So, there’s some things that are what I would call low-hanging fruit in immediate steps, and then there’s also things that are, again, long-term planning. So, from an immediate perspective, I would say data retention policies, right? Many people, that’s one of the things that not many people like to do, but it is probably one of the first steppingstones that you can kind of hit pretty quick.

Another one you covered is tokenization or data masking. That’s also a really quick strategy you can employ, and to tear it apart a little bit. It’s just replacing things like Social Security numbers or PINs and using certain tools to kind of mask those. Those are, in my opinion, the fast sort of things that you could do.

You mentioned edge devices. Those things are, I would say, long-term planning, only because if those are not correctly set up, edge computing to do some of the processing before you take it to the cloud. Those, in my opinion, would be more long-term sort of plans that you could put in place. 

[David Spark] All right, excellent tips. Cyrus, I throw this to you. 

[Cyrus Tibbs] This is definitely a passion of mine because PennyMac is a national mortgage company, so we regularly collect a lot of sensitive data on people. For me, it really comes down to, you have to be able to answer three main questions and then have actions that drive from those. So, one is, where is all your data, right?

So, you have to have classification across all your structured, unstructured, file share, SaaS, everything. And that’s not just one tool, it’s a whole set of different tools. Then you need to take that information, and you need to match it up against your access information to say, okay, who has access to these different places?

And then match that against your activity data to say, well, who’s actually using this access to that data? 

So, I think that’s your bare minimum for any organization is just, if you don’t know where it is, who has access to it, and who’s using it, you’re not really in a defensible position, right? To kind of answer the question about is it worth it, it’s definitely worth it because you need to demonstrate to your customers that you want to treat their data the way you’d want your own data to be treated.

And really going that extra mile where you build routines, and you can show regular routines and demonstration that we do everything we can to protect our customer data really goes a long way. And when you have a breach, usually your breaches start in places in the organization where you don’t have your crown jewels.

So, the further you keep your high sensitive data away from your crown jewels, the better. And going even further to talking about tokenization, when you force people to decrypt data before they get access to it, you kind of force an attacker to have compromised multiple people or force collusion between insiders to get access to those kind of things.

Because really what you’re worried about as a company is that breach of really high volumes of high-harm data. That’s where you can get in a lot of trouble. So, my North Star on this is always make sure that it takes two people to get access to any kind of large volume data breach. 

Unexpected outcomes or failures? 

7:38.362

[David Spark] Since SaaS started eating the enterprise, we all became increasingly aware of the dangers of shadow IT. But are we missing the risks of the increasingly popular low-code/no-code apps or shadow engineering? Now with the advent of GenAI, it’s easier than ever for an employee with no coding experience to quickly get something up and running with your company data.

Now, this is what was noted by Yair Finzi on Dark Reading. A Gartner survey of CIOs found two-thirds either plan to deploy these tools with staff or have already done so. So, I’m going to start with you Cyrus on this one. Have you seen any real-world risk from shadow engineering so far? And how do we get ready for a potential app proliferation from these platforms?

[Cyrus Tibbs] I feel like we need to get rid of the term shadow IT or shadow in general. I feel like you want to empower people with these tools. So, when GenAI came out, there was a lot of use cases for us around process automation, text extraction, data protection. So, I think we need to really take security awareness more beyond just security awareness for how you protect yourself to, hey, we know you’re going to start operating these things.

You’re going to start building new functionality. You want to encourage that because there’s huge productivity benefits your company can get from it. And at the same time, from a protection perspective, you want to make sure you’re using AI to detect bad things because I think trying to whitelist all the different things people might build is going to become an exercise in futility.

We originally had started trying to catalog all the GenAI tools. And then after a certain while, we said, “Okay, there’s fewer things now that don’t have this in it.” So, I think it’s really, we should just get rid of the term shadow IT and really embrace this and enable people to do more with it. And as a security team, it’s really our job to enable that in a safe way.

[David Spark] Excellent point because I hear most people go, “No, it’s not shadow IT. It’s actually how people do business right now.” All right, Sasha, I throw it to you. 

[Sasha Pereira] So, this kind of topic hits home pretty hard. So, my background is actually a software developer. And going back to what I would say is low code was back in the days of when you could just go to Stack Overflow and copy a bunch of code and stick it into what you’re developing. But again, wearing multiple hats through my career, I wasn’t always in security, I was a CIO at the previous position I was at, and there was shadow IT there, right?

And so people came in, you would have marketing that would sign up for a new SaaS service, right? Now you look at it and with Code Whisperer or Salesforce Lightning or any of the tons of tools out there, you’re having full-blown applications being built by different departments. 

And I have learned more through experience rather than [Inaudible 00:10:21] today, but I am taking the same sort of approach that Cyrus has as well. Where when Code Whisperer came out, we had a complete training session with all our developers to explain to them, “This is what’s available, and here’s how you can possibly use it.” And we’re trying to incorporate that with every other tool.

And we’re trying to do it also because we’re also a 365 shop. And so as any of you who are on 365 know, Microsoft loves to turn things on and not tell you about it, right? Or they’ll push ads out and then half your employees are going to be using things and then you find out about it through them. So, I think taking that approach, educating amongst all the different approaches, has been one of the things that I am pushing for rather than try to be the heavy hand of IT and try to stop it.

[David Spark] So, but now you mentioned developers here. Have either of you seen someone who is not a developer, someone actually in marketing, actually creating apps and putting them out there? Yes? 

[Sasha Pereira] Yes, I’ve seen that happen in operations specifically, and that’s more on the no-code. So, that’s, I won’t say low-code. Low-code’s more… I would say some of the developers I’ve seen that, but on the no-code perspective, yes, we have seen literally a meeting last week where someone in operations was showing me how easy it was using a tool.

I won’t mention exactly which tool it is, but they used a tool available to them and were able to make things a little faster. 

[David Spark] Mm-hmm.

[Cyrus Tibbs] Yeah, I think in our organization, right, so it’s a mortgage company, we have like an assembly line to create mortgages. And people are coming up with all sorts of really interesting inventive ways to automate different parts of their jobs that are kind of on process automation and text extraction and things, and it’s really…

It’s impressive, and so we want to definitely continue to embrace that. I think this is going to end up being kind of like how we all used to put Microsoft Office on our resumes, and now it’s kind of just like assumed you know it. I think that this is going to end up being kind of the same thing. That you’re just going to be assumed that this is a tool that you’re able to use to solve complex problems.

Sponsor – Nudge 

12:12.931

[Voiceover] Who’s our sponsor this week? 

[David Spark] Our awesome sponsor is Nudge Security. So, let me ask you a question. How big is your SaaS attack surface? Well, you can actually find out with Nudge Security. Their patented approach to SaaS discovery finds all SaaS accounts ever created by anyone in your organization and alerts you as new apps are introduced.

The best part? You’ll have a full SaaS inventory in minutes. No agents, browser plug-ins, or network proxies required. For each SaaS app discovered, you’ll see the list of all users, MFA coverage, SSO enrollment status, breach history, and more. You’ll also have a full inventory of app-to-app OAuth connections, scopes, and risk scores with the ability to revoke risky grants with just two clicks.

Now, Nudge Security also includes playbooks to automate the tedious, time-consuming tasks like user access reviews, employee off-boarding, and more. You can take control of your SaaS security posture with Nudge Security, and you can actually start a free 14-day trial if you go to their site and actually use our specific code for it.

So, you go to nudgesecurity.com, and it’s actually spelled the way it sounds, so nudgesecurity.com/cisoseries. If you go there, you’ll get yourself a 14-day trial. 

It’s time to play “What’s Worse?” 

13:41.615

[David Spark] All right, so the way this game works is, for those of you not familiar, it’s a risk management exercise. Both of the scenarios are crappy. You have to decide from a risk perspective which one is the more crappy one. All right, so this comes from Jonathan Waldrop, who’s the CISO over at The Weather Company, and here we go.

You’re a new CISO with a very modest budget. Let me lean on that modest budget part. You have an EDR, Endpoint Detection and Response, and a lackluster MDR, Managed Detection and Response. But here’s the big hook. You have no email filters, that’s including spam, and you’ve got no SSE, that’s the Security Service Edge for your cloud platform.

So, you’ve got no email filters, you got no SSE platform. You’re able to secure one of those because you got enough budget for one. Which one do you pick? I start with you, Sasha. 

[Sasha Pereira] No EDR, no MDR.

[David Spark] No, no, you have the EDR with the lackluster MDR. What you don’t have is you got no email filtering and you got no SSE, but you can fund one of them. So, you can have one and not the other. Which one are you funding? 

[Sasha Pereira] I’ll pick email. 

[David Spark] Why is that? 

[Sasha Pereira] A lot of the pretty serious stuff ends up in the end users, and everyone knows end users are the path that things get in, so I would use email. I would spend my money on the email filters. 

[David Spark] So, you think to have that environment is less risky than to spend the money on the SSE and having the email run wild? 

[Sasha Pereira] Well, and also you said there’s a lackluster MDR. 

[David Spark] Yeah.

[Sasha Pereira] So, I would not focus on that right now because that was four years ago was where EDR and MDR was like a big deal. 

[David Spark] Okay, all right. Agree or disagree with that? 

[Cyrus Tibbs] I’m going to have to disagree. 

[David Spark] All right, let’s hear it. 

[Cyrus Tibbs] I think I would pick the secure service edge because I think on the kill chain, even though you have some things will get through your email, I’d be worried about the credential theft or someone getting into my network, period. And then the kind of the spread of SaaS and what everyone’s using, I think just having EDR and email, you’re going to have a lot of uncovered attack surface.

But as the game intends, they’re both pretty bad. 

[David Spark] But explain to me, both of you explain to me why one environment is riskier than the other. What’s going to cause more damage in either environment? 

[Cyrus Tibbs] I feel like email damage is limited to credential theft, malware drop, or business email compromise. 

[David Spark] Okay. 

[Cyrus Tibbs] And I think the email filters kind of do a good job on some of those, but not others. Whereas in SSE, you kind of have more kind of control over your destiny, I feel like. If someone’s trying to connect to your environment and it can only be through your SSE and they’re on an untrusted device, you have some control further down the kill chain.

Where I guess on the email side, you’re trying to stop it earlier, I suppose. 

[David Spark] Good point. All right. You’re defending the emails, why? 

[Sasha Pereira] I think you kind of defend, I think [Inaudible 00:16:43] but I’d rather catch things early on, number one. I think once you’re in my environment, if it hasn’t been segmented, which is another, which you did not give that as a pre-existing condition, but yeah, my network will be extremely segmented.

So, if someone did end up coming from somewhere, they really couldn’t traverse as much as they think they could. 

[David Spark] So, you’re saying, get them earlier, they won’t spread around. Where in his, they’ll be all over the place, so you’ll have more moles to whack. Is that what you’re saying? 

[Sasha Pereira] It’s a lot more, I mean, at that point in time, if they’re in your network and floating around. For me, I’m trying to catch them before they even get there. 

[David Spark] You agree or disagree with that? 

[Cyrus Tibbs] I think for me, it’s a control issue. I feel like with SSE, I would have more control over the outcomes and be able to build more consistent playbooks around it. So, I feel that from like an incident response side of the things, I would have a better time. 

[David Spark] Okay, so just to make this clear, you think it’s worse not having the SSE and that’s Cyrus, and Sasha thinks it’s worse not having the email filtering. I throw this to the crowd. By applause, how many people think it’s worse not having the SSE in place? By applause. Oh, geez. Even the ones who agree with you can’t even put their hands together that quickly.

[Cyrus Tibbs] Yeah, yeah. It’s very lackluster agreement. 

[David Spark] All right, by applause, how many people agree with Sasha that no email is worse? 

[Applause]

[David Spark] All right, Sasha. You are the winner here. 

Oh, no! That totally SOCs! 

18:08.405

[David Spark] All right, this is our new game. This is the first time we’ve played this game in front of a live audience. All right. Turn around, I need you to all turn around. Everyone can see this. All right, what you see behind you is 12 rectangles. They’re all numbered, and I’m explaining this to the listening audience as well.

Imagine, if you will, because we copied the design from the original Let’s Make a Deal. So, it’s each one is designed like that.

[Audience Member] Monty Hall.

[David Spark] Monty Hall, right. The Monty Hall Era, if you will. Behind 11 of them, Sasha and Cyrus, and our audience and listeners, is something crappy. Varying degrees of crappy. One good thing is behind them. I’m going to each, one at a time, you’re going to pick a number, and we have Fernando helping us out here.

You’re going to pick a number, and it’s going to reveal something probably bad, but might be something good. At the end, you’re going to argue why the other person’s environment is worse, and then the audience is going to determine which one of your environments SOCs the most. Okay, got that all? All right, so Sasha, I’ll have you go first.

You’re going to actually be the color blue. You’ll see in a second. So, pick any number. 

[Sasha Pereira] I’m going to go with my son’s age, nine. 

[David Spark] So, number nine, let’s reveal it. What do we got? Every week, employees upload PII to a different unapproved SaaS app. 

[Laughter] 

[David Spark] Not good. All right, not good. All right, that’s not good. You’re not starting out well, Sasha. I’ll just [Inaudible 00:19:30] that. All right, pick a number. 

[Cyrus Tibbs] Two. 

[David Spark] Number two, let’s see what we got here. All right, staff forgets everything they learned in security awareness training. All right, bad, not nearly as bad as Sasha there, though. All right, Sasha, pick another one. 

[Sasha Pereira] I’m going to go with 11. 

[David Spark] Eleven, let’s see what we see with 11. Oh, your CEO is having an affair with your auditor. 

[Groans]

[David Spark] Okay, that is not good. Sasha, it is not good right now for you. That is really, really bad. All right, Cyrus, pick another one.

[Cyrus Tibbs] Seven. 

[David Spark] Seven, let’s see what we got. You hire the CEO’s son who turns out to be a toxic employee. All right, also not good. All right, remember the blue are Sasha, the red are Cyrus. One more for you, Sasha. 

[Sasha Pereira] God, I’ll go with five. 

[David Spark] Number five. So, the traveling employee brings their phone to a local repair shop and provides login credentials. All right, also not good. All right, you get the last one, Cyrus. 

[Cyrus Tibbs] Four. 

[David Spark] Employees took bribes to install remote access software. All right.

[Laughter] 

[David Spark] Okay, so let me just review, and each of you have to defend why yours is not as bad as the other person’s here. 

[Laughter] 

[David Spark] Sasha, I know yours is pretty bad, but look, make a good argument. Try to convince this audience. Sasha, your CEO is having an affair with your auditor, your traveling employee brings their phone to a local repair shop and provides login credentials, and this one’s a doozy. Every week, employees upload PII to a different unapproved SaaS app.

But Cyrus has staff forgets everything they learned in security awareness training, so you can forget about that wall of defense. You hire the CEO’s son who turns out to be a toxic employee. That’s going to ruin your whole staff. And employees took bribes to install remote access software. That could bring down the castle right there.

All right, so Sasha, you go first. Why is your environment not as bad as Cyrus’s? 

[Sasha Pereira] I think mine’s not that bad because it turns out the CEO was the one who took his local phone and provided his login credentials, and he’s having an affair with the auditor, so he’s gone. 

[David Spark] [Laughter] You think the board’s just going to kick the CEO out? All right, good argument. There you go. 

[Cyrus Tibbs] I don’t think mine is as bad because first, everyone already forgets what they learned in security awareness training. 

[David Spark] Yeah, that actually, that’s not new news. [Laughter] 

[Cyrus Tibbs] And then the CEO having a toxic son, we can probably figure out some way to box in his responsibilities to not have a big impact. And the remote access software, depending on the remote access software, it’s probably something we’re already using and being breached anyway, so we already have controls in place…

[Laughter] 

[Cyrus Tibbs] …to try and have layered approach to that. We assume that would happen anyway. So, I think all of ours are… Mine are existing assumptions. 

[David Spark] Okay, so I’m going to ask the audience to applaud to who [Inaudible 00:22:15] that has it worse? Remember, you don’t want to win this one, either one of you, all right? By applaud, remember red is Cyrus. By applaud, how many people think Cyrus’s environment is worse? 

[Applause]

[David Spark] Okay, and by applaud, how many people think it’s Sasha? 

[Applause]

[David Spark] Yeah, Sasha, you lose. 

[Applause]

[Audience Member] Whoo, Sasha!

Would this person be a good fit for the job? 

22:38.284

[David Spark] All right, the future is low/no ops, or rather the SOC, the security operations center, is doomed, so states an anxious sentiment held by many SOC professionals on the cybersecurity subreddit. That anxiety is translating into, “How do I move on? Specifically, how do I get into DevOps or DevSecOps?” So, here’s some of the suggestions that were on the subreddit.

Start personal programming and automation projects, build credibility by documenting your progress, get relevant certifications, and pursue a consulting role in DevOps. That last one’s good. So, we get the sense that the SOC is a great starting ground, but like a doctor who works in the ER, they don’t want to work there forever.

So, I’ll start with you, Sasha. What are some good paths out of the SOC? 

[Sasha Pereira] So, if you look at it from a path out of the SOC, if you look at it from probably 10 years ago when you had IT operations and you had developers, there was no DevOps. Or maybe a little bit more, maybe 12, 13 years, right? And then you had people in there, and if you look at my previous firm, the DevOps team that we had, we had a really nice mix.

We had IT ops specifically, so we had guys who were like VMware experts, VM experts come in, and then you had developers, and there was a really nice mix. And then now you look at it, and it’s like, “Wait, those guys, VMware’s kind of going down a path, so it’s like, okay, where are we going now?” I think the same thing has to be said in terms of DevOps, and where it’s going to DevSecOps.

You have to adapt with the way things are. So, it’s just the same way that people adapted back then. I mean, there aren’t that many systems admins, or systems engineers, unless you’re managing really old equipment. So, I think in that sense, getting certifications or trying to get more involved in security would be a good path for anyone who’s in DevOps to kind of get themselves future-proofed.

[David Spark] Cyrus, your thoughts? 

[Cyrus Tibbs] As somebody who has built and worked in SOCs, and got my way out of the burnout factory that they can turn into, I feel like the shift from SOC to DevSecOps is actually, sounds like a difficult one. I would think that was…

[David Spark] Well, this seemed like the demand from this discussion on Reddit. 

[Cyrus Tibbs] Yeah. I think the DevSecOps is because that’s sort of where the future of a lot of new investment is going. But I really think that the best skill sets for DevSecOps is really having someone who has application developer background, or cloud engineering background, and I think those two kind of are converging together.

I think for a SOC analyst, I think the more natural path would be focusing on like a security engineering function, where you’re kind of running a variety of security engineering tools because you kind of already know what they generate. I also think SOC analysts make great security architects because they generally know where there are gaps in their network and know where there are problems, so they can take that experience.

That’s kind of how I took my career was, I was running a SOC at a company, and then I wrote a report about everything wrong with the infrastructure, and then they put me in charge of the infrastructure. 

[Laughter] 

[Cyrus Tibbs] And I didn’t really want that job, but that’s kind of how it happened, and that sort of led to a lot of where my career went, so I kind of fell into it that way. But SOC is definitely…

[David Spark] So, watch what you say is your advice. 

[Cyrus Tibbs] Yes, yeah. It’s definitely you got to do your gumshoe work before you move up, yeah. 

[David Spark] Well, then let me ask, has that happened to you where any employee has mentioned that they’re eager to get out of the SOC? Are they able to express what they want to do? Or, I mean, what have you heard from SOC employees? I mean, I got to imagine they’re enjoying the experience, but they are getting burnt out.

Again, I liken it to the ER environment. What do they say? 

[Cyrus Tibbs] Good SOC people are hard to find, and so I generally try to keep them in SOC if I can. So, I think really…

[David Spark] Is there an average tenure for a SOC employee? 

[Cyrus Tibbs] I wouldn’t know the stats on that, but I would say I try to focus on what is the thing that’s burning them out. And generally, one of the most important things you need to do is find out what the false positives and ghosts that the people in your SOC are chasing, and then turn that into projects and actions to actually fix those things.

Because that’s usually where their burnout is coming from, is that they’re just chasing ghosts and they’re kind of doing useless work because of some design problem. So, I think you’ve got to figure out a way to automate as much to level one as you can, filter out as much of the noise as you can. But I would typically push them more towards security engineering type work, or even cybersecurity really is just applied data science.

So, you could take them and say, “Hey, work on your SIEM data science skills and work on building insights into an organization.” It’s probably where I would encourage them to move. 

[David Spark] And what have you heard, Sasha? 

[Sasha Pereira] Yeah, I mean, I had personally on my team, one of the engineers expressed a lot of interest. So, he actually is doing some very specialized course or certifications that AWS has, and he’s actually doing the Azure ones as well, which is a certified security specialist, right? And they have them for AWS as well as for Microsoft for Azure.

But again, it’s kind of a mix. It’s hard, kind of like Cyrus mentioned. The people, like good people, are hard to find. And sometimes SOC engineers, they like being SOC engineers. Like I have an excellent network SOC guy. 

[David Spark] By the way, anyone listening, I do not want to knock the fact that you’re working with SOC as it’s something to get out of. I mean, yes, there are people who spend a lot of time in the ER too. 

[Sasha Pereira] Yeah, well, that’s the thing. The guy, one of my guys who works for me, who’s a network SOC guy, he loves his job. And he doesn’t want to go anywhere else. He loves where he is. And he does automate things, and he’s a one person can do three people’s job, so. 

What are the evolving challenges in managing identity and access? 

28:13.210

[David Spark] Passwords are on their way out, we’ve embraced multi-factor authentication, aka MFA, and all our authentication woes have ended, right? Well, wish it were so. It turns out that poorly, sporadically, and inconsistently implemented MFA opens the doors to a ton of security issues while also introducing additional friction to users.

So, as MFA gets a greater rollout, we’re starting to understand the playbook criminals use for getting around MFA. So, everything from push notification bombing, stolen session cookies, and good old-fashioned social engineering. So, no one is arguing against well-implemented MFA, but how do we educate our staff and improve implementation to get its full benefit?

Have either of you been successful? We’ll start with you, Sasha. 

[Sasha Pereira] I feel like MFA, specifically when rolling it out more than 10 years ago, the previous firms as well, yes, well rolled-out MFA is key, but also educating your users is really key. And that’s one of the pieces where I felt like really helped is hitting them on the personal side. So, one of the things that we do when we do a little bit of security roadshows where we go around to the different office locations, we talk about enabling MFA on the personal space.

It’s like how many here have MFA on their bank accounts, on your 401ks, on accounts that are really key? And it’s real interesting when you approach it from that perspective and you get them to understand that, “Hey, this is a security concern.” And then they realize, “Wait a minute, if I’m doing this from a personal level, I understand why it’s needed for work.” It’s worked for me at almost three firms that I’ve been at, and it gets the users to understand.

No one has ever really complained in my org that, “Oh, my God, I got to put my credentials in every 30 days,” because we expire credentials across the board. It’s not the 90 days anymore, it’s 30 days. But I feel like that approach has really helped a lot. 

[David Spark] Let me ask you, I don’t even know, has that changed like, I guess, identity theft or user accounts being compromised, doing the wiping them out every 30 days? 

[Sasha Pereira] So, again, the 30 days is definitely one of the pieces for having a successful MFA. It’s also eliminating SMS-based. I mean, we stopped using SMS a long time ago, and Microsoft’s pushing it out completely. But that’s key, right? Getting rid, using the Microsoft Authenticator app or whatever it is, whichever app you’re using or whatever IAM that you use.

And I think those key pieces really work together, like having the right tools that are watching your account logins. So, even if someone does use MFA credentials. I mean, we got hit with a bunch of adversity in the middle attacks earlier this year. You do need to have something that watches your account logins or locations or is sensing impossible travel and things like that.

[David Spark] All right, I throw this to you, Cyrus. You work at a financial organization, so I’m sure MFA is top priority for you. How are you dealing with it? 

[Cyrus Tibbs] Definitely. I feel like authentication is something people do so often that they do it second nature. So, I don’t think you can rely on them to be educated enough to avoid the risks. So, I feel like the industry as a whole needs to move away from knowledge-based factors, just wholesale, anything that’s six-digit pins, passwords, SMS.

I think all of that needs to go because we need to move to possession-based factors, right? We need to move to FIDO2, we need to move to all of that because this is the place that you’re seeing them attack now. And I think…

[David Spark] And by the way, have you guys experimented with all these? 

[Cyrus Tibbs] We’re on the path to that. So, our high-privileged users, certainly we have on FIDO2 now, we’re planning it out. I mean, it’s very challenging to do that because so many of the legacy systems use knowledge-based factors, and you have a lot of applications that aren’t set up for that. But I think moving to passkeys, FIDO2 needs to be top priority for everybody.

Because people just are so… It’s such a routine thing to log in, that if they see a credential-stealer website, or they accidentally put their password into something, like, it’s just you can’t train that out of people because they do it so often. So, you’ve got to get people to a place where they got to be at that URL with that hard token at that machine to log in.

Because otherwise, it’s just a matter of time before one of your accounts gets broken into. And users actually like it better because you don’t have to teach them all kinds of weird password judo to figure out how to get their passwords to be uncrackable, right? 

I mean, for a long time we told our users, “Use a made-up word,” because that was the only way we could figure out to make sure it wouldn’t get cracked by some rainbow table somewhere, right? So, we just got to get away from this insanity and just simplify it like that, but I think there’s a lot of legacy out there that needs to catch up to that.

And I think we’re not going to get there… I rarely wish for more regulation, but this is one of the things I wish they would put in the regulations and say, “All of these apps need to move to possession-based factors because you’re just not going to protect it otherwise.” 

It’s time for the audience question speed round. 

33:11.286

[David Spark] All right, right here in my hand I have a bunch of index cards. I have asked this audience right in front of you, I’ve asked them to give me questions that I am now going to ask the two of you. We’ve got a lot of these, and we’ve got a good amount of time, and we’ll see how many we can get through here.

All right, so here we go. From Ashton Long of Beacon Hill asks, what or what can or what is currently AI doing in your environment that is actually alleviating some stress on your staff? Is there anything? 

[Cyrus Tibbs] Yeah, definitely for us. So, we have a data lake strategy where we use like traditional relational database for all of our security data. We run and write queries to that. We plug in very traditional BI, SQL, Python tools, and even it’s accessible to anybody at this point where you can kind of feed your data model into a LLM and then ask questions of it.

So, that helps out a lot. Triage and our incident response team, right? Sometimes you get an alert in the alert space on some command that’s run. You used to have to go and Google the command and figure out what it means and run it, but now you just ask an LLM like, “What is this command?” And it just tells you like, “This is what this thing means.” So, we saw our meantime to triage almost get cut in half once this stuff came out, and it wasn’t even like we told the team to use it.

They just started using it, and then we saw all of our triage times start dropping down. So, we definitely see a ton of value. 

[David Spark] All right, that’s awesome. Sasha? 

[Sasha Pereira] So, we were kind of like evaluating and working on some of the…and one of them I can share with you a little bit is we have about 780 technicians out in the field. And if you all know, a lot of the service manuals for appliances that you own are probably 200 or 300 pages and trying to find things within them is really hard.

So, we have an internal sort of setup where we have a lot of these manuals in there, and we’re trying to kind of use those to kind of find things really quick across multiple manuals. Like we have service manuals, installation manuals. And then having our service technicians using their smartphones to get data really quick instead of trying to read a PDF manual, right, on a phone.

[David Spark] Good tip. All right, this comes from Fernando St. John who was just helping us with the game moments ago, and he’s with the ISSA. All right, you’re going to get a new hire and they’re very green. So, it’s kind of first time in cybersecurity. They can have only one of the three elements.

You tell me, which one do you want? Education, certifications, or experience? What do you want? You only get one. 

[Cyrus Tibbs] Experience.

[David Spark] Experience? What do you say, Sasha? 

[Sasha Pereira] Experience. 

[David Spark] Everyone says that, experience. All right, I’m going with it. They always say that. All right, from Daniel Drees of IT Security Now, and I’m setting this up. The reason for this could be anything. It could be you find a better solution, something’s priced better, or the organization had a security incident, whatever.

Dan wants to know, do you have exit strategies for your tools? Again, the reason could be anything. Do you have an exit strategy? 

[Cyrus Tibbs] I definitely do. I’m very anti-platform marketing. I think it’s nonsense. So, I’m much more of a best of breed and then have a strong data analytic/data science team that can bring your data together. So, for me, all of my vendors are interchangeable. If a vendor starts trying to jack prices up on us, or they start falling apart, or private equity buys them and ruins them, which happens to many of them, well, I limit the blast radius of any particular vendor.

Now there’s varying degrees of that, but I try not to make sure I have any one vendor that has negotiating leverage over me. 

[David Spark] Are you that aggressive, Sasha? 

[Sasha Pereira] I think I’m worse. 

[Laughter] 

[David Spark] Really? 

[Sasha Pereira] And again, it’s interesting because I do have a couple vendors here that I’m working with. Close your ears. But no, usually what I end up doing is the minute I do sign with a vendor, and it usually goes through a pretty rigorous process of going through it, but the day we sign the contract is I literally usually talk with whoever the account sales person, the customer success team, and I tell them, I’m like, “Your clock starts now.

Your clock starts now for me to not renew your contract. So, make sure that you work hard to make sure that I am going to renew it.” And I do that with all my vendors, and some of them have called bluff on it, and then they’ve learned the hard way, but that’s…

[David Spark] So, you threaten them at the beginning. 

[Sasha Pereira] Yeah. 

[David Spark] That’s great, awesome. 

[Sasha Pereira] And I do that, and not to just threaten them, but it’s also that I’d rather do that than let a vendor go at the end of the contract, and then they’re like, “Why? What happened?” And then they try to fix it in the one month that’s left, which is not fair to them, right? I’d rather give them an absolute opportunity from day one.

[David Spark] All right. Here’s my last question for you. This comes from Richard Greenberg, who’s the president here at ISSA Los Angeles. And I love this question, and I want you to give me an example too. Either one of you jump in first. How do you encourage your team to ask uncomfortable questions?

[Cyrus Tibbs] So, I make sure that I meet with every single person on my team on some frequency. So, if it’s three levels down, it’s quarterly. If it’s two levels down, it’s monthly. If it’s one level down, it’s every other week. And I always kind of put myself in the servant leadership perspective of, hey, I’m here to serve you.

I’m here to help you. I try not to be like a command-and-control leader, and then make people feel safe that they can challenge me because I tell them at the beginning, when I hire them, I give them a Kool-Aid talk where I say, “I expect you to challenge me. I respect the people who challenge me. If you don’t ever challenge me, I’ll lose respect for you.” And so then I get lots of interesting conversations that come from that.

[David Spark] Can you give me an idea of an uncomfortable question? 

[Cyrus Tibbs] Sometimes when I’ve made certain decisions, I’ll have people who have very strong opinions about that, and they’ll kind of give me a, “What are you doing?” kind of question, or they’ll think like, “Hey, this is pointless. Why are we doing this?” So, those are my favorite. 

[David Spark] I love when my team catches my mistakes. I love it. 

[Cyrus Tibbs] Yeah, I always tell them, I say, “We got to sharpen the sword,” right? If we’re not being uncomfortable and honest with each other, we’re going to fail, right? We have to be different, and we have to challenge each other. 

[David Spark] All right, how do you do it, Sasha? 

[Sasha Pereira] So, I think the way I kind of approach this is I invite my team member to sometimes meetings that I’m in with other departments, and I will ask uncomfortable questions as well. And I sort of, it’s a mini way of like…

[David Spark] You set the stage. 

[Sasha Pereira] I set the stage and say, “Okay, see, this is okay to do. It’s okay to question my peer or question someone who’s even higher than me,” if it’s a legitimate question, and you’re asking it in the interest of the business, which is really key. I want them to think that way. Don’t want to think like, “Hey, Sasha set down this roadmap and we follow it,” right?

And so I always try to bring them in, and then they bring that back to my team meetings. And then when the other team members, my direct reports, who hear some of the team members say things, they feel like, “Well, I can ask this question too.” It takes a little bit of time, but you have to just vest that time in it.

Like inviting one of your team members to a meeting, and sometimes you’re like, “Well, not sure if this person’s in the audience for this meeting,” but my agenda, my goals is to get my team to ask those questions. 

Closing 

39:59.314

[David Spark] Well, that brings us to the very end of our episode. Let’s hear it for our guests, Sasha Pereira and Cyrus Tibbs. 

[Applause]

[David Spark] Thank you very much. You were fantastic. I love that. That was great. Hey, let’s hear it also for our sponsor, Nudge Security. Let’s hear it for Nudge. 

[Applause]

[David Spark] Remember, go to their website, nudgesecurity.com/cisoseries, get your 14-day trial. And here’s the cool thing, what they’ll do, if you haven’t seen it, they will scan your environment, let you know how much exposure you have. We all have got it. You’re going to be shocked. You’re always shocked by these things.

It allows you to know what your health is, so you can then start to approach it. So, I highly recommend it. Huge applause also for the ISSA, for Richard Greenberg for making this event happen. 

[Applause]

[David Spark] We greatly appreciate it. We love being invited back year over year, so thank you so much for doing that. We love doing this. So, thank you, everybody, so much. We greatly appreciate you contributing and also listening to the CISO Series Podcast. 

[Applause]

[Voiceover] That wraps up another episode. If you haven’t subscribed to the podcast, please do. We have lots more shows on our website, CISOseries.com. Please join us on Fridays for our live shows – Super Cyber Friday, our virtual meetup, and Cyber Security Headlines Week in Review. This show thrives on your input.

Go to the Participate menu on our site for plenty of ways to get involved, including recording a question or a comment for the show. If you’re interested in sponsoring the podcast, contact David Spark directly at David@CISOseries.com. Thank you for listening to the CISO Series Podcast.