Most of our tools are getting an AI upgrade whether we like it or not. “Going AI” is seen as a means to stay competitive. The increased productivity also requires increased scrutiny. Traditional security penetration testing efforts suddenly look very different when dealing with an LLM.

This week’s episode is hosted by me, David Spark (@dspark), producer of CISO Series and Andy Ellis (@csoandy), partner, YL Ventures. Joining us is our sponsored guest Nathan Hunstad, director, security at Vanta.

Got feedback? Join the conversation on LinkedIn.

Huge thanks to our sponsor, Vanta

Full Transcript

Intro

0:00.000

[Voiceover] What’s a great approach from a security vendor? Go!

[Nathan Hunstad] So, I love it when a security vendor will just shut up, ask me what problems I’m having, and then honestly tell me whether they can help me with those problems or say, “Nope, we can’t help you, you are better looking elsewhere,” because it’s so rare.

[Voiceover] It’s time to begin the CISO Series Podcast.

[David Spark] Welcome to the CISO Series Podcast. My name is David Spark, I am the producer of the CISO Series. My co-host for this very event, it’s Andy Ellis, and he’s a partner with YL Ventures. Andy, say hello to the nice audience.

[Andy Ellis] Good morning, folks, or depending on when you are in the world, good afternoon, good evening, or good night.

[David Spark] When you are in the world, don’t you want to say where you are in the world?

[Andy Ellis] No, I meant when. What time zone you’re in, like that’s a when, not a where.

[David Spark] Well, a where also refers to the when.

[Andy Ellis] It could, or a when could refer to the where.

[David Spark] There you go. We’re available at CISOseries.com. As I had mentioned on another recording, we have heard from many health officials that going there at least minimum three times a day will keep you healthy and fit, so we recommend it. The CDC even recommends it as well. That’s why they’re here.

Our sponsor for today’s episode is Vanta. Automate compliance, manage risk, and prove trust continuously. None of this one-time nonsense. Continuously. In fact, we’ll be talking about that later in the show. And in fact, Vanta is responsible for bringing our guest, who I’ll introduce in a moment. But Andy, I just learned that you are or were an enormous comic book collector, had thousands, and you’re unloading them all.

[Andy Ellis] Yep.

[David Spark] And maybe some of our listeners who are also comic book collectors might want to score one, interested to know how they could. What’s your most valuable? Why did you start collecting? And do you have a favorite series?

[Andy Ellis] So, my most valuable was Giant Size X-Men #1. For those who are familiar with it or not familiar with it, that was when they introduced the characters that you now think of as the X-Men, not the original sort of core set, but the new X-Men. That was most valuable. I started collecting when I was a kid.

I loved reading comic books.

[David Spark] And you held on to these. That’s unbelievable.

[Andy Ellis] And I held on to them, individually wrapped all of them, about 2,000 comics. I’ve been moving them around for 30 years and we’re about to move, and my wife suggested maybe it was time to finally get rid of them. Like, my kids weren’t interested, which is one of the reasons I’d kept them around.

[David Spark] Did you ever go back to them, like pull out one and read one, an old one?

[Andy Ellis] Oh, yeah. I’d occasionally go read them.

[David Spark] So, what is your favorite series?

[Andy Ellis] Oof. It’s really hard. I’m going to go with actually a favorite character, which is Kitty Pryde. And so, back and forth between the New Mutants and the X-Men.

[David Spark] So, it’s a Marvel character.

[Andy Ellis] Yeah, Marvel character. Those of you who don’t know who Kitty Pryde is, also known as Shadowcat, Ariel, and Pixel, it’s had many, many names, is the mutant who can phase through walls. So, you see her briefly in a couple of the X-Men series and they give her some weird time traveling power in X-Men Days of Future Past.

[David Spark] And were you also a big fan of Comic-Con in San Diego?

[Andy Ellis] Not really. I wasn’t a big convention person. So, I just had these and I’ve had them for a very long time and finally decided to get rid of them. So, literally this morning, the guy who handles the auctions and consignment came over to my house. He was like, “This is great,” because they were all packed in half-yard boxes, individually wrapped.

He’s like, “Usually I have to go like digging through somebody’s attic to go get their comics.”

[David Spark] So, they’re all in pretty good condition, yes?

[Andy Ellis] They’re all in decent condition, but the challenge is the modern comic book market, basically anything published from the ’80s and after is so saturated, the value isn’t that high. So, he said I’ll be lucky if I get like $1,500 to $2,000 for my 2,000 comics.

[David Spark] Really?

[Andy Ellis] So, basically, I lost money on these.

[David Spark] Yeah. Especially because the cost of moving them everywhere as well.

[Andy Ellis] Yeah.

[David Spark] So, a good thing I didn’t invest in comics.

[Andy Ellis] No, no, not really a good investment unless you knew. He’s like, “Oh, you have all these X-Men. Did you have this one?” He says, “Oh, if you’d had this one, that was when Gambit first appeared and that one had value.” So, there’s a bunch of those that it’s like the first time a specific character appeared, that comic has value.

[David Spark] So, if you’d like the B-sides of comic books, contact Andy. [Laughter]

[Andy Ellis] Yeah, basically.

[David Spark] Some will go for 10 cents, is my guess. All right, well, let’s bring in our guest, thrilled to have him on. In fact, we’ve had many wonderful people from Vanta on our show, and this is the first time he’s been able to join us. He’s the director of security over at Vanta, none other than our sponsor guest, Nathan Hunstad.

Nathan, thank you so much for joining us.

[Nathan Hunstad] Yeah, thanks for having me. Happy to be here.

Do you trust this LLM?

5:06.285

[David Spark] “Red teaming GenAI must involve critical thinking about both the organizational conditions within which a model is built and the societal condition in which a model is deployed.” Now, a team of AI and cybersecurity researchers recently published a report with Data & Society and outlined the process most GenAI red teaming follows right now.

This starts by organizing a group of critical thinkers, giving them access to the GenAI system or platform, having them identify undesirable behavior while using it, either manual or automated prompting, and then looking at evidence to mitigate that behavior. But a key difference with red teaming your cybersecurity posture in an AI system is who are you trying to emulate?

Traditionally, this means trying to act and think like a threat actor, but the report points out that because GenAI tools are usable by virtually anyone, red teaming needs to have a wider cultural context beyond a purely hacker mindset to be effective. That seems too much. Andy, where do you start with this?

[Andy Ellis] So, sort of it’s fascinating to me because I don’t think this is novel and new.

[David Spark] Okay.

[Andy Ellis] Like any system that you are going to red team, you have to think about all of the possible adversaries, and one of the adversaries is always your normal users.

[David Spark] Mm-hmm.

[Andy Ellis] I like to think about the Microsoft guidelines for inclusive design, where they talk about if you design for one-armed people, you can design for the permanently one-armed, but there’s not very many of them, the temporarily one-armed, everybody who’s just had shoulder surgery or broken an arm, and the situationally one-armed, the people who are carrying a baby or groceries only have one arm.

[David Spark] Mm-hmm.

[Andy Ellis] So, you have to design for these situational people, even though, like, you might use as a template, the permanent. Same thing for threat actors. The adversary is the permanent adversary, but every one of your users is temporarily an adversary when your system doesn’t let them get what they need.

And so, you should always be thinking like this. They’re just calling it out. Like this is one of those lovely reports that references a lot of academic research out there, 70 pages, if you want to go read it yourself. But this is important. Like GenAI, what it really is, is it’s a concierge is the way to think about it, which is you have a concierge who’s helpful, but kind of dumb, and anybody who asks them something, it wants to be helpful, and it knows a lot of stuff, but it doesn’t always say, “Should I do this for the person?” And so, that’s really the model you have to walk into and say, “Any user, what would they want to use this model for?

And what would they want to abuse the model for?” And so, that’s really, I think the summary of the whole thing is how will users abuse this system for their own profit?

[Nathan Hunstad] I totally agree with you, Andy, there. And I think that a lot of people have come across GenAI or see it as this completely new, very unique kind of tool. And at its core, it’s just another kind of application. And so, you still need to be concerned about all of your typical application security issues.

It is true that it may be used by more people or that it may not necessarily have the same failure modes as other application security types of tests, but I think at its core, a GenAI tool is a tool like anything else. So, you do need to identify from your own organization’s perspective, what do you care about in terms of things that go wrong?

Do you care about things that are inaccurate? Do you care about whether you can use this tool to generate something that’s offensive or dangerous? And once you define the failure modes you’re most concerned about, then you can start from there and work backwards to try to trigger them and ensure you have the right controls in place.

We’ve got both types of issues – compliance and regulation.

9:17.896

[David Spark] When does a SOC 2 report become security theater? One poster on the cybersecurity subreddit was asked for SOC 2 compliance by a client. They were an eight-person healthcare startup fresh off a seed round and weren’t even holding board meetings. The commenters on the post were quick to point out that just for liability purposes, you should really hold board meetings.

Others pointed out that the trust services criteria that SOC 2 is based on are good goals for security controls anyway. For a smaller startup, when does SOC 2 make sense? And I know, Andy, we’ve talked about this before, it’s the first thing you’re going to get, you should get, but I’m going to toss to you first, Nathan.

When does this make sense?

[Nathan Hunstad] Yeah, I think it is correct to separate something like a SOC 2 or an ISO certification from good security in general. And my standard response is that you should get a SOC 2 certification or an ISO certification when a customer asks for it and not necessarily before. If you’re successful, hopefully it won’t be that long before somebody asks for it, but it’s not something that you necessarily need to rush into.

However, good security itself is always a good idea, and you can get a head start on any kind of certification in the security realm by making sure you have some of the good foundations from a security program perspective in place. And so, a lot of people do use a tool like Vanta for the sole purpose of getting a SOC 2.

That’s definitely not all it’s there for. It really is there to enable you to build a security program. So, having things like access controls, multifactor, making sure that developers have the proper limited access to production systems, those are things that every company should be doing. And you don’t need to be more than one or two people to put these security controls into place.

And again, once you do that, then you’ll just be that much better positioned when you start going after your first or second certifications.

[David Spark] Yeah, I mean, Andy, Nathan makes good sense here. Really, people are just interested in the trappings of a SOC 2. There’s nothing about the word SOC 2 that gets them excited.

[Andy Ellis] Absolutely. Like, the reality is, especially if you’re a security startup, but if you’re basically any startup that is selling to a company that has a security team, you need to have a SOC 2. It basically goes along with your very first customer. This is not waiting for customer success.

If you’re lucky, you can get through some design partnerships without a SOC 2, but nobody’s signing a contract and giving you money without one, so you should just plan that, and it is just the trappings. Sometimes I see these SOC 2s, I’m like, “You don’t even have any systems. You’ve got a couple of things in AWS and a couple of laptops, and you’re doing a SOC 2.” I do want to point out to the eight-person startup that just finished a seed round, and you’re not having board meetings, like, who is your seed investor that they didn’t grab a board seat and immediately say, “We’re having meetings,” even if the meeting is just like I, the director, am talking to the CEO every week or every other week?

That’s a board meeting until you have anything interesting to talk about.

Sponsor – Vanta

12:47.920

[David Spark] Before I go any further, let me tell you a little bit about Vanta. If you don’t already know, or if you do know, here’s a refresher. Let me ask you a question. Do you know the status of your compliance controls right now? Like right now. We know that real-time visibility, it’s critical for security.

I mean, the industry has been moving to that for years. When it comes to our GRC programs, we rely on point-in-time checks.

Look at this. More than 10,000 companies like Atlassian and Quora have continuous visibility into their controls with Vanta. And here’s the gist. Vanta brings automation to evidence collection across over 35 frameworks like SOC 2, we were just discussing, and the very popular ISO 27001. They also centralize key workflows like policies, access reviews, and reporting.

Maybe your board meeting as well. So, it also helps you get security questionnaires done five times faster with AI. Now that’s a new way to GRC, and heck, sounds a hell of a lot better. But you can learn more about this, and I’m going to give you a very specific address that I want you to go to so Vanta knows we sent you there.

You’re going to go to Vanta.com/CISO. Do you want this new GRC capability? Take a look at what Vanta’s doing. You’ll like it. Vanta.com/CISO.

It’s time to play “What’s Worse?”

14:21.044

[David Spark] All right, Nathan, are you familiar with this game?

[Nathan Hunstad] I am familiar with this game. Yes, looking forward to it.

[David Spark] It is a risk management exercise. We get great submissions from our audience. Every now and then I’ve had to lean on AI. I don’t like to, but I do it every now and then. But this time I’m not. This comes from a submission from a listener, and this is Aaron Stanley of dbt Labs, and here are the two scenarios.

By the way, I make Andy answer first, so you get more time to think about this. Scenario number one, Andy. You learn that a malicious actor has impersonated a potential customer and progressed through your sales process to meet with many of your top executives. They’ve recorded enough video and audio to generate fake videos, and they have used it to conduct successful vishing campaigns against your staff and have launched a mass disinformation campaign online, significantly damaging the company’s brand.

[Andy Ellis] Why did they bother? Sorry. There’s not a video of my executives that they really wouldn’t need to do this, but okay.

[David Spark] Whatever. They went through all that. It sounds like a lot of heavy lifting.

[Andy Ellis] Sounds like a lot of heavy lifting that exposes them because now they’ve engaged with us in a way that’s traceable by the Bureau. But anyway, let’s go on and see the other one.

[David Spark] Well, the other one, now that you say that, I think you’re going to think this one’s worse, but here we go. You learn that an unauthorized party has identified a zero-day exploit against an internally developed note taker app that automatically joins all of your internal video conferences, but not any with external third parties.

They sold the exploit to an unknown number of actors and also used it to mine the transcripts for sensitive and confidential information to leverage in future attacks. I think I know which way you’re going on this one, Andy.

[Andy Ellis] Wait. So, I built this app, and they have found a way to get access to it.

[David Spark] Yes.

[Andy Ellis] But the only thing it ever does is joins my internal calls.

[David Spark] Just internal calls.

[Andy Ellis] Just internal calls. But now all that data’s out there. Oh, yeah, I’m definitely going to go with that’s the worst one.

[David Spark] Yeah.

[Andy Ellis] Because the first one can happen to anybody, like, “Oh, look, somebody has decided to target my company with deep fakes using our executives.” I’m going to kind of ignore the movie plot, although that does actually make this better, realistically. Like if they’ve engaged with us over and over and over again to collect this, I at least have a package to hand to the Bureau of like, “Hey, here’s how you could start figuring out who’s doing this to us,” because presumably, that’s got its own issues.

The problem with the second scenario is I’ve got a lot of data that’s out there and odds are it’s embarrassing. Like this is embarrassing at the level of Sony Pictures level embarrassing.

[David Spark] Mm-hmm.

[Andy Ellis] Like internal meetings and a AI chatbot that’s transcribing things? Like, the number of things that I suspect got said, that I’m not even worried about the IP, I’m worried about the fact that, let’s be honest, a lot of sales reps are…

[David Spark] Loose with the lips?

[Andy Ellis] …quite colorful when they think nobody’s listening.

[David Spark] Yes.

[Andy Ellis] And I don’t need that. Like, I once had a CRO say to me, in the wake of the Sony Pictures disclosure actually said, “Can we just have email auto delete after 72 hours?” And I was like, “Maybe you could get your staff to not send emails that need to be deleted.”

[David Spark] Yeah. We all go back to our email and find it valuable.

[Andy Ellis] Right, right. Engineers do. Sales reps, maybe not so much. So, anyway.

[David Spark] I don’t know if I could conduct a business if all my history was only three days old. By the way, that could be a good “What’s Worse?” scenario. Like what’s worse, all your emails deleted after three [Inaudible 00:18:04] something else. You know what? Let’s make a call. Give us a matching one to all emails deleted after 72 hours.

[Andy Ellis] Well, I would flip it. All emails deleted after 72 hours, or your emails never deleted, and they’re sent to Nicole Perlroth, and she’s going to write her next book about your company culture.

[David Spark] Yeah. But you know what? We find that nobody’s brand gets that badly damaged. All right, I’m throwing this to you, Nathan. Are you agreeing with Andy or not? Do you think there could be significant damage to the company’s brand with all this impersonation and deep fakes?

[Nathan Hunstad] I am going to agree with Andy here. I don’t think that, honestly, a company that was the target of an attack like this would actually see a ton of damage from it. I want to say I think that it would almost be the opposite. I mean, don’t they say all [Laughter] press is good press? I mean, being the target of such a ham-fisted attack would, I think, generate a lot of sympathy for the company, and most people probably wouldn’t look askance at them because ultimately, that vulnerability is not necessarily their fault.

They didn’t write bad code. Some people got tricked, unfortunately, and got taken advantage of, and everyone can empathize with that. I do think the leaking of internal data, just what your customers are paying for your products, some of the unreleased features, betas, in tech where so much of your value is keeping one step ahead of the competition, you’re definitely losing a lot of potential sales if your competitors or just other people see what it is you’re working on, see who is a churn risk, that kind of very intimate information.

Please, enough! No, more!

19:56.178

[David Spark] Today’s topic is vulnerability management. We’ve discussed this a few times before. Thrilling, I know. It’s one of those things that every security team has to deal with, yet somehow, it never feels like we’re winning. It reminds me of playing whack-a-mole, no matter how many vulnerabilities you patch, there are always more popping up.

Andy, I’m going to start with you. What have you heard enough when it comes to vulnerability management and what would you like to hear a lot more?

[Andy Ellis] I am tired of hearing patch the vulnerabilities that matter. I’m tired of this belief that you can prioritize and draw a line and the things above this will burn you and the things below this won’t. The reality is, you basically need to maintain your software. If you’re not maintaining your software, you’re going to have a bad day someday.

And this isn’t just patching. This is just doing the upgrades, keeping things relatively current. This is an engineering responsibility and not a security responsibility. That’s my soapbox.

[David Spark] By the way, you have just slammed the entire vulnerability management industry.

[Andy Ellis] Yes, I have.

[David Spark] Because they operate on exactly what you don’t like.

[Andy Ellis] Yep. And just to be clear, it’s out of their control. The problem is software developers have convinced management that it is security’s job to get systems patched. And as long as that holds true because software developers, they don’t want to maintain their software, especially not when they’ve got product managers yelling at them to roll out new features, so the ecosystem is screwed.

The vendors are just doing their best to help the security professionals who are trying to do somebody else’s job when somebody else doesn’t actually want them to succeed.

[David Spark] All right. I am throwing this to you, Nathan. You can agree or disagree with Andy here on what he said. This is your chance to disagree, by the way. You could jump in on it.

[Andy Ellis] Two agreements so far. Can we get three?

[David Spark] There’s been way too much agreement so far.

[Nathan Hunstad] So, I will partially agree with Andy.

[Andy Ellis] I’ll take it.

[David Spark] Oh, no, you could say, “I’m going to partially disagree with Andy.”

[Nathan Hunstad] I will partially disagree with Andy here.

[David Spark] Okay, that sounds better to me.

[Nathan Hunstad] Yeah, I absolutely hate the vulnerability industry as well. I have led the vulnerability management programs at several organizations. I have been on teams where we have literally hundreds of thousands of open findings, and it is totally true that you cannot use something like a CVE or a lot of the scoring systems and prioritization systems that these tools offer as a way to stay on top of things.

I do think that there has to be some kind of triage in place, though. And I think that where a security team can provide value is understanding the infrastructure and saying, “Hey, these things that are on our external attack surface that are actually being exploited right now, these should be the priorities, not necessarily everything with a CVE score of seven or greater,” or a lot of those typical thoughts because if everything that had a high score was actually exploited, no one’s infrastructure would be up at all.

There is a limit to what is actually being attacked.

And so, being on top of what’s in the news, CISA’s Known Exploited Vulnerabilities Catalog, that’s some data that you can use to do some prioritization, but ultimately, it is everyone’s responsibility to patch the things you own. It is a lifecycle. If you take on a new security tool, if you take on a new software library, if you take on a new application, you’re not just buying it and being done.

You’re responsible for every patch, every update until that’s decommissioned. So, you’re buying an entire process there and you need to keep on top of that, and part of that process is vulnerability management.

[David Spark] So, what would you like vulnerability management to change into beyond sort of the shifting of the responsibilities, I guess?

[Nathan Hunstad] I would like vulnerability management to focus more on how to make it easy and more automated to patch things, and that’s where I’m a big fan of moving to SaaS tools wherever possible because there you are 100% outsourcing the patching responsibility. Now it’s your vendor’s job to stay on top of that.

And to the extent that you can do that and reduce your own manual labor, that’s great. I think things like Dependabot and other automations, they’re fine. It can be hard to get a lot of value or a lot of buy-in. So, we do need better ways of automating the updates, providing more testing, and just getting this to a situation where you don’t have to do a lot to stay up to date, you have safe libraries to begin with, and you’re not using more of a tool than you need to.

[David Spark] Is Vanta doing anything with sort of assisting in the vulnerability management challenge?

[Nathan Hunstad] Absolutely. And we use Vanta internally. Like I said, I run vulnerability management at Vanta. We use it to centralize our vulnerability reports. We can see what assets are being affected by what vulnerabilities, and that does, like I said, feed into some of the prioritization. If there’s something that is affecting a resource that is internal only, it’s not web facing, we’ll probably deprioritize that.

But if it’s something that is one of our crown jewels, if we know it’s on a service that handles a lot of sensitive data, of course, we’re going to take a closer look at that and make sure that it is addressed appropriately.

[David Spark] I mean, it sounds like good old basic common sense. If this vulnerability is accessible to key systems or crown jewels, fix it, which doesn’t that sound like it goes back to what you said, Andy? It’s an engineering problem.

[Andy Ellis] Right. The systems are so complex that you make it sound simple that like, oh, if it satisfies this criteria, it’s on the CAV [Phonetic 00:26:30] and it affects an impacted system. That’s a tiny, tiny proportion of the vulnerabilities that are out there. And what we tend to find out is that after you get exploited and you hunt through, there’ll be a couple like that, and then there’s going to be a couple of things.

It’s like, “Oh, yeah, no, we were just running like Python that has been deprecated like 12 years ago. We still had apps using that.”

[David Spark] What do you say to the reporting? Because this is the classic thing of someone gets popped, and it was a vulnerability that was sitting out there six, eight months, wasn’t fixed, and then everyone sort of maligns the organization. You’re like, “Well, how did I know it was going to be that one and not the other 150,000?

[Andy Ellis] I’m a firm believer that the only metric that matters for vulnerability management is SLA compliance. You should basically be able to say like, “This engineering team has signed up to 90 days.” Let’s just start at 90. Wouldn’t that be wonderful? And how often are they outside of that 90-day window and fixing vulnerabilities?

And if they’re outside it, that means they’re not just doing system updates and system maintenance at a regular enough cadence, and that’s all we should be measuring is how often are your systems within compliance? I don’t care about individual vulnerabilities. We need to treat vulnerabilities not even like cattle, but like bugs.

[Nathan Hunstad] I would say that this also ties to a closely related item, which is asset management, because without good asset management, you can’t have good vulnerability management. And a lot of times it’s those forgotten dev systems or it was this test system that was forgotten about. And so, even if the engineers are signing up for the SLAs, they’re only patching the things that they know about.

So, you also have to make sure that you know exactly what assets are in your environment, all the things that are connected via VPNs, peer [Phonetic 00:28:23] connections, and make sure those things are accounted for as well.

Is this benefitting the company or just making my life easier?

28:29.209

[David Spark] How can a “rule for thee, but not for me” attitude in cybersecurity leadership negatively impact your security operations? I’m thinking a lot. By the way, I’m going to guess there’s going to be a lot of agreement on this one. So, this came up on the cybersecurity subreddit with a senior member of the security staff who was militant about pointing out when others weren’t following basic security hygiene but then is casually using shady browser extensions on their own work machines.

So, how do you deal working under someone like that? And I know most people would say, “Well, just quit.” And how can you identify when you’re starting to get some of those bad leadership habits yourself? I’ll start with you, Nathan.

[Nathan Hunstad] Yeah, I have worked with people like those.

[David Spark] It’s aggravating.

[Nathan Hunstad] It’s my opinion. Those kinds of people just should not be in security.

[David Spark] Did you tell them to their face that? You know, “You shouldn’t be in security.”

[Nathan Hunstad] I may have once or twice.

[David Spark] And did you keep your job after you said that?

[Nathan Hunstad] I did. Fortunately, I had some leaders who agreed with me on that.

[David Spark] Good. They liked that bold approach.

[Nathan Hunstad] Yes. I have gotten into it with some of my security peers in prior roles who did have this attitude, and it is super damaging because everyone can see that they are being hypocrites. And it’s also usually done in an incredibly condescending way. And security has to be able to collaborate with the organization and build good relationships if we’re to be effective.

Security teams are tiny, and we need to partner effectively with the entire business, and they’re not going to do that if the security team is acting high and mighty and telling people that they’re doing it wrong while doing horrible things themselves.

[David Spark] All right, Andy, you disagree. You should be a hypocrite, right?

[Andy Ellis] Oh, so I’ve been the security leader, but in a very different way.

[David Spark] By the way, have you ever done anything hypocritical?

[Andy Ellis] Well, have I ever violated company policy as a security leader? Absolutely. But it wasn’t my policy. It was something the IT team had written that I thought was stupid. So, I flagrantly violated it so that everybody else could be like…

[David Spark] And did you tell your team to violate it as well?

[Andy Ellis] No, I just flagrantly violated it publicly, visibly so that everybody could be like, “Well, if it doesn’t apply to Andy, it shouldn’t apply to me,” and I’m like, “Absolutely.”

[David Spark] Oh, so you agreed with him. Okay.

[Andy Ellis] So, that was me not being a hypocrite, but like breaking the rule because it was a bad rule. Because there are a lot of security rules that are just bad rules. And so, we need to, like, not get trapped into that.

[David Spark] Hold it. What was this rule? I want to know what was so bad that you’re the one to flagrantly violate it?

[Andy Ellis] Oh, the personally owned devices. I actually for many, many years used a personally owned device as my primary work machine because it was safer than the corporate laptops we had. And then they tried to ban people using Macs at all for a long time, and I’m like, “Well, good luck with that because I’m using a Mac,” and then eventually they rolled out Macs to everybody.

But I had no remote admin on my system.

[David Spark] But let’s talk about the question that’s here is you’re working in security. You have a leader like this.

[Andy Ellis] Right.

[David Spark] We know it’s not good. Nathan was bold enough to say it to their face. Not everybody’s that good.

[Andy Ellis] Honestly, that’s a career limiting move that you might as well quit at that point.

[David Spark] Although, I mean, Nathan said he moved on beyond it.

[Nathan Hunstad] Yeah. And to be fair, this was a peer. This was not my leader.

[David Spark] Okay. Yeah.

[Nathan Hunstad] So, I want to make that clarification.

[Andy Ellis] Yep. So, I think that the answer is like if it’s a peer, there’s a lot of things you can do. If it’s your boss, there’s kind of fewer things you can do and get away with it. But you should recognize that change is made in long arcs. Right? So, if you have a person who’s doing this, you should find somebody else who’s doing something gentler than this that’s also mildly hypocritical and let the leader sort of make an example of that and say, “Oh, maybe we should make it a policy.

Maybe we should be really clear that when we tell somebody to do something that we’re all willing to follow that rule first.” And so, maybe before we write a policy or roll out a security tool, everyone’s security team gets it first. So, think about it as a campaign to change who they are and what they are.

Force them to face the facts like, “Oh, we want to roll out this policy,” but the first thing we do before we roll out a policy is we actually audit the security team and see who follows the policy. Because if we can’t all follow the policy, how do we expect the company to? Like, that’s a reasonable thing.

It’s not even saying…

[David Spark] So, the security team does the test drive.

[Andy Ellis] Right. I’m a firm believer that the security team should be the pilot users for every annoying new technology and every annoying new policy, and if they can’t handle it, of course, you don’t roll this out to the rest of your business.

[Nathan Hunstad] Absolutely. Yes. I have also been a strong advocate for that, and we do test out new security tools first with the security team every time.

[David Spark] Very good.

Closing

33:39.145

[David Spark] Well, that brings us to the very end of this episode. And you know what? I’m glad everyone listening took this show out for a test. You know what? Why not tell it to the rest of your security team? Tell them it’s safe to listen to, nobody got hurt. Were there any security flaws in today’s episode, Andy?

[Andy Ellis] Oh, almost certainly one or two.

[David Spark] What do you think, Nathan? Did we have any security flaws in today’s episode?

[Nathan Hunstad] We may need to have a red teamer take a look at it.

[David Spark] See what they can poke holes in?

[Nathan Hunstad] To be definitive. Exactly.

[Andy Ellis] I love how carefully he answered that question, he’s like, “I don’t know if I should say yes or no, so I’m going to defer answering.” Nathan, you have a career ahead of you as a CISO.

[David Spark] Let’s get a consultant to look at this. I’m not going to [Inaudible 00:34:19].

[Nathan Hunstad] Absolutely.

[David Spark] Let’s get an outside person that if you’re upset with them, they’ll go away, and you don’t have to worry about it. I want to thank you, Nathan, for coming here. And I want to thank also Vanta for sponsoring this episode and really just being a phenomenal sponsor of the CISO Series. Let me remind everybody that if you want to automate your compliance, manage risk, improve trust continuously, you should check out what they’re doing at Vanta.

Go to Vanta.com/CISO, specifically there so they know we sent you there. But let me ask you, Nathan, any last thoughts, any offers you want to make to our audience, ways they can engage with you? Are you hiring over at Vanta? I believe you are, yes?

[Nathan Hunstad] Yes, absolutely. I am hiring for security engineers on my team, along with many other open roles at Vanta. It’s a wonderful place to work. If you know of anyone who is looking for a change, check out our Careers page.

[David Spark] And when you hire engineers for your team, do you invite them to call you out when you’re being a hypocrite?

[Nathan Hunstad] I absolutely do. I want us to be an open, transparent culture, and if they see me getting around our security controls…

[David Spark] Have you ever been called out, by the way?

[Nathan Hunstad] I absolutely have. Normally I have a good reason, mainly it’s because I’m testing things, but yes, I have been called out on using a device I shouldn’t or maybe trying to automate some authentication that’s annoying.

[David Spark] Were you using Andy’s personal computer?

[Nathan Hunstad] I was not. I think it’s probably more secure than the one I was using, but I was not using his.

[David Spark] I think, by the way, it wasn’t personal devices, they just didn’t want you using a personal device, Andy.

[Andy Ellis] No, they didn’t like it because then other people asked to use one, and I was like…

[David Spark] I know. Then they got to do more work.

[Andy Ellis] Provide a supportable system that actually works.

[David Spark] Mm-hmm. But “He gets it, I want it, too.”

[Andy Ellis] Yep. And force them to deal with the problem and then roll out devices that would be supported, that people would be willing to use.

[David Spark] I’m going to date myself a lot here. So, years and years ago, I worked as an IT guy for an ad agency, and we were told because we would roll out computers, and this was when we had 286s, 386s, 486s, Pentiums.

[Andy Ellis] Oh, yeah.

[David Spark] I’m dating myself a lot here. But when we were leveling someone from a 286 to a 386, or a 386 to a 486 or Pentium, we were critically told, “Do not tell anyone.” Because if we tell someone who has a 386 that the office next to them has a 486, they’re going to want it and we’re going to have to deal with it.

So, we were told, “You say nothing.”

[Andy Ellis] Yep. One of the biggest challenges I think companies have, which is they just don’t understand how productive people are with the right hardware.

[David Spark] Mm-hmm.

[Andy Ellis] So many studies are like the single most valuable thing is screen real estate.

[David Spark] Yes, I say, “You want another screen?” and they’re cheap.

[Andy Ellis] Like everybody should be given gaming monitors as big as they want. It is the cheapest way to increase their productivity.

[David Spark] Yeah, I know.

[Andy Ellis] But companies don’t.

[David Spark] Unbelievably cheap. What’s the top productivity thing that you get your employees to do, Nathan?

[Nathan Hunstad] Oh, that’s a good question. I mean, I have two screens in front of me right now. I really enjoy the real estate. The fact that we can all work remotely is, to me, a huge productivity boom.

[David Spark] Mm-hmm, yeah. All right. Well, I want to thank you, Nathan. I want to thank you, Andy. And I want to thank Vanta. And I want to thank our audience. I say this all the time, I greatly appreciate your contributions. Send in lots more “What’s Worse?” scenarios, ones that people will disagree with Andy on.

[Andy Ellis] Ones that involve Marvel superheroes would be even more awesome.

[David Spark] Oh, that’d be good. Marvel superheroes, yes.

[Andy Ellis] I want a “What’s Worse?” that has two Marvel superheroes on each side of it.

[David Spark] Both working in cybersecurity, yes.

[Andy Ellis] Yeah.

[David Spark] Because they lost their job as a superhero, who knows?

[Andy Ellis] Hey, or maybe they had a power like Cypher did, where his only power was he could talk any language he heard. So, he was a great programmer.

[David Spark] That’s pretty good. Oh, yeah, that’d be cool. All right. Well, thank you, everybody. We greatly appreciate your contributions and listening to the CISO Series Podcast.

[Voiceover] That wraps up another episode. If you haven’t subscribed to the podcast, please do. We have lots more shows on our website, CISOseries.com. Please join us on Fridays for our live shows – Super Cyber Friday, our virtual meetup, and Cyber Security Headlines Week in Review. This show thrives on your input.

Go to the Participate menu on our site for plenty of ways to get involved, including recording a question or a comment for the show. If you’re interested in sponsoring the podcast, contact David Spark directly at David@CISOseries.com. Thank you for listening to the CISO Series Podcast.