Recent studies have shown that employees cause as many significant cybersecurity incidents as outside threat actors. Does this come down to a lack of awareness or poorly designed security implementation? And what can we do to improve this situation?

This week’s episode is hosted by me, David Spark (@dspark), producer of CISO Series and Andy Ellis (@csoandy), operating partner, YL Ventures. Joining me is our guest, Alex Green, CISO, Delta Dental.

Got feedback? Join the conversation on LinkedIn.

Huge thanks to our sponsor, Silk

Full Transcript

[Voiceover] What I love about security vendors. Go!

[Alex Green] Look, security vendors get a lot of hate. And being specific to security because they take the brunt of it. And realistically, we need them. They’re solving our problems that we’re facing on a daily basis. We’re relying on them for the innovation so that we essentially don’t have to. We’re focusing on what we’re strongest at.

[Voiceover] It’s time to begin the CISO Series Podcast.

[David Spark] Welcome to the CISO Series Podcast. My name is David Spark, I’m the producer of the CISO Series. And joining me as my co-host for this very episode, you know him, you have to love him, you have no choice in the matter. His name is Andy Ellis. He’s the operating partner over at YL Ventures.

Andy, say hello to the audience.

[Andy Ellis] Good morning, or depending on when you are listening to this, good afternoon, good evening, or good night.

[David Spark] He wants to make sure he addresses all listeners. We’re available at CISOseries.com where you can check out all of our wonderful programming as well. Our sponsor for today’s episode is Silk Security, a brand-new sponsor of CISO Series. We love that. Revolutionize your risk resolution process with Silk Security.

Yes, risk management. We’re going to tell you all about that a little bit later in the show. Andy, when I started the CISO Series, really it was just a concept that was based on a few articles, and it was in reaction to really what Alex was referencing in his opening tease, our guest who I’m going to introduce in just a moment, which is the hate that a lot of vendors got.

And I don’t know, you may have been a part of these panel discussions, I’m sure you saw some of them where CISOs would be at a conference just railing on vendors. Yes, you’ve seen this, yes?

[Andy Ellis] I’ve certainly seen them, and I’ve had many of those thoughts. I tried not to be public hate on vendors, I try to be helpful, but yeah, I know what they’re talking about.

[David Spark] You do have a rebuff letter. If you have not seen that, I would highly recommend checking it out. But here’s my question, and honestly, I can only respond anecdotally from what I hear, but from early 2018 to now, we’re at the end of 2023, we’re recording this episode, anecdotally, I hear a lot less hate towards vendors.

Agree or disagree or do you think it’s all the same?

[Andy Ellis] So, I think that you’re hearing less hate, but that’s partly because the behaviors that people see, they’ve gotten used to. Like I look at my inbox and I used to get maybe a dozen to two dozen cold outreaches a day. That number has actually gone up, but I’m just more aggressively deleting them.

You referenced my vendor rebuff letter. I barely use it because many of the things I’m getting feel like automation, and there’s a limit to how much I want to interact with what’s now automated coming out of vendors.

[David Spark] Ah, so you’re seeing more automation from vendors. So, you don’t think it’s gone down, you just think our management has become better?

[Andy Ellis] I think our management of it has become better, and I think some of the really egregious things have gone away. Like there were certain things vendors would do, like the cell phone calls at 7:00 a.m. Although I still do get calls on my cell phone, please vendors, go check the phone numbers you’re calling, and if it’s a cell phone, please don’t.

[David Spark] Honestly, I don’t think anyone picks up a landline anymore, to tell you the honest truth.

[Andy Ellis] Well, that tells you all you need to know about whether you should be calling someone cold.

[David Spark] All right. Well, I’d be interested to know from the audience if anecdotally, I don’t know if anybody has hard numbers on this, but anecdotally, do you feel this is improved? Because this has been sort of our charter at the very beginning was we wanted to improve relationships between vendors and practitioners.

Heck, it was the original name of this whole darn series. But let’s get to our guest who essentially teased this whole discussion at the beginning, of which we’re not going to be discussing this, we got lots more to discuss on today’s episode. It is a CISO over at Delta Dental Plans Association, none other than Alex Green.

Alex, thank you so much for joining us.

[Alex Green] Thank you, David. An honor to be here.

What works? What’s not working?

4:17.277

[David Spark] Weren’t we promised that identity was supposed to be the new network perimeter? If access controls and authentication are key pillars of cybersecurity, then why are we seeing so many public failures of them? We’ve seen a rash of high-profile social engineering attacks over the last year that shows that just adding more identity solutions to your stack is not improving things.

Now, this isn’t just anecdotal either. A recent survey from Silverfort, highlighted by Mary Pratt at CSO Online, found the vast majority of respondents had experienced an identity-related breach. And a perfect example is the Help Desk where a lot of times staff will sidestep established zero-trust protocols thinking they’re helping someone out.

So, Andy, is this just a case of humans being humans, which is what the attackers prey on, or is there something more structural at play that needs to be fixed? What do you think?

[Andy Ellis] You know I’m never going to throw the humans under the bus right away.

[David Spark] Right.

[Andy Ellis] I think this is actually evidence that identity is the new perimeter because that’s where the adversaries are attacking. Right? If it wasn’t the new perimeter, why would you bother going after it? So, in one sense, good sign. We’ve moved to identity rather than just network ports, etc. The downside is we haven’t moved in a way that makes sense.

So, people don’t ask the question when they move to identity-based security policies, they don’t say, “Okay, how do we solve the bootstrapping and the re-bootstrapping problems?” And so, what’s happening is they don’t say, “Oh, David’s going to get locked out of his system. What do we do to support David?”

So, when somebody calls in and says, “Hi, I’m David, and I’ve been locked out of my systems, I don’t have any way to verify who I am,” some person in the Help Desk is like, “Okay, well, let me be very helpful because I want to get you back up and running,” because we haven’t designed for that problem case.

If we had, you’d get that phone call and be like, “Oh, I’m not going to help you, here’s what I’m going to do instead.” We used to do this when I was at Akamai, we had a very clear rule. If a customer calls in and says, “Hey, I need help,” the answer is, first thing we do, is we call you right back, right?

And if your cell phone number is not in our system, we’ll call somebody whose cell phone is in our system and get them to authenticate you because we anticipated problems like this, knew that attackers would try to exploit them, and designed tools and systems to protect ourselves. And that’s what’s been missing is that design.

[David Spark] So, it really, so it’s the latter, the structural situation. So, do you agree or disagree here, Alex, and if it’s structural, what needs to be fixed?

[Alex Green] No, I absolutely agree. Andy, you’re spot on in the sense of, I think this speaks well, our current situation speaks well, to what the perimeter is. We’ve gotten better at the network perimeter. So, hackers, much like anyone else, take the path of least resistance. And that now is becoming, well, has become for a while now is social engineering and taking advantage of human nature effectively.

So, I do believe it is more structural and fundamental, and I think the biggest issue is ultimately we’re still figuring out what authentication is. I mean, there’s been a lot of development, a lot of progress along the way, but how do you authenticate someone being who they say they are?

[David Spark] Go a level deeper there. Pick any one problem, like Andy gave one example of a problem, pick any one problem that you’ve recently had to sort of adapt and fixed as a result because humans do act like humans and our structure needs to adapt to the human, not the human adapt to the structure.

Am I right on that thinking, yes?

[Alex Green] Absolutely.

[David Spark] Okay. So, give me one good example of what you’re doing to sort of adapt the structure, if you will.

[Alex Green] No, absolutely. So, a hard technological example would be geo-blocking, that nobody loves geo-blocking. It causes so much pain on both sides of the house. In my opinion, it’s not effective. So, what other factors can you take into account to define authentication? So, we’ve got our SMS two-factor, which obviously has its problems and moving away from, we’ve got our token-based, we’ve got other forms of multi-factor, which is getting us there.

But then we’ve got other issues, a session hijacking with some of our favorite identity vendors recently, but that’s where we’re still evolving as society is defining how to prove out authentication.

[Andy Ellis] I think the single biggest problem here is that people haven’t figured out that identity is not a human problem, it’s a cyborg problem, right? That my identity is not Andy Ellis. It’s Andy Ellis and all of his devices. So, I’ve got a Mac here, I’ve got a laptop over here, I’ve got my iPhone, I’ve got my iPad.

All of these are me. And when people are designing authentication solutions so then say, “Oh, is this really Andy?” They don’t actually think through, well, Andy’s collection of devices is really who he is, and let’s tie authentication there. Like, here’s my really simple question for anybody who’s going to build a zero-trust system, which is why are you not using X509 certificate authentication as a base substrate to ensure that you only ever talk to my devices?

Because if you’re not doing that, you’re leaving yourself open above to social engineering attacks.

[David Spark] Here’s what I’m amazed at. I’m just a household here. I’m amazed the number of devices that are connected into our house. We just got something because we’re doing some sort of levels of protection for our kids in the house, and we’re trying to set up parameters for each device. I’m like, “Oh, my God, how many devices do we have in this house?” And I realized, “Oh, wait a second.

All my pinball machines are also connected on the internet as well.” Like, there’s so much and you don’t realize even in your own home how much you have.

[Andy Ellis] We have so many devices in this house that we have loaner laptops and loaner iPhones.

What’s the motivation to do this?

10:10.981

[David Spark] When you’re working with a small security team, what skills are essential for keeping in-house and what can you outsource? Now, this was a question that came up on the CISO Series recent AMA that we hosted on the cybersecurity subreddit. And essentially, we were asking, like, these were all people who were running one-to-three-person security teams, and they were supporting hundreds, if not thousands of people with that leaner security team.

So, Howard Holton, CTO of GigaOm, provided the litmus test for what to take on and what to outsource. So, two questions. One, does the task have significant benefit from tribal knowledge? If so, you should own it internally. And two, does the task benefit from breadth of knowledge and awareness? If number one is a no, and this is a yes, then outsource.

So, Alex, do you agree? And if so, can you provide some examples of these types of tasks where you said, “We’re going to outsource this,” “No, we’re going to take it in”?

[Alex Green] I definitely agree. I think those two points are a really good place to start for understanding between the two on what to keep internally and what to send outside. Now, I think one of the core examples, I’ll start with number two, is pentesting, and that’s a good example of something that’s really expensive to insource.

And realistically, for the amount of time you spend pentesting in an organization, that’s usually much better to outsource. And you can say something along the same lines with the SOC, the Security Operations Center, and the whole analytical flow of your events. So, I’ll jump back to number one in the sense that it definitely benefits from tribal knowledge, from understanding the interconnectivity of your systems and network.

But does the tier one analysis phase necessarily benefit from the same thing? Perhaps. But that’s also super expensive if you’re going to try to insource an entire 24-7 SOC. So, that balance is important as you consider this.

[David Spark] So, getting a little taste of the SOC is necessary for understanding network activity is what you’re saying, but maybe not doing the whole job.

[Alex Green] Well, I think the more advanced capabilities of your incident response analyst is going to absolutely require that tribal knowledge, and that’s why you generally don’t outsource your tier three.

[David Spark] Right.

[Alex Green] But taking that initial look and saying, “Was this SQL injection attack actually malicious or was it successful?” That doesn’t always need the tribal knowledge.

[David Spark] That’s a very good point. All right, Andy, what do you think of these two? And by the way, excellent examples right here, Alex. What do you think of these two sort of litmus tests that Howard puts out?

[Andy Ellis] I think these are a fine first start. I think I would add in, there’s sort of two different sorts of things that you outsource, and I think Alex did a great job of giving very different examples, right? One is something that’s very transactional, like, “Oh, I need a pentest done.” And if the cost of setting up and closing the transaction is low compared to the cost of doing the transaction, then outsource it, right?

Pentest, I can scope it, I can tell you exactly what I need. You go do some work, you hand it back to me, I check it, I’m good, right? But if I’ve got to be micromanaging it, I might as well be micromanaging somebody who works for me. I’m not getting the real benefit of outsourcing, which is using someone else’s staff.

You’re functionally just, at that point, a contractor working for me.

But that then takes you to the other end, which is, is this a task that the knowledge you need, you do not need that much of, right? So, if you say, “Okay, I need to have half of an FTE working on a project, but it’s specialized knowledge that I don’t need for anything else,” you might think about outsourcing that.

If I needed seven FTE doing it, I might want to think about insourcing it at this point because I want to turn that into tribal knowledge. And that’s, I think, the challenge with using this – does it benefit from tribal knowledge as the first litmus test? Which is, do you want to use this to develop your in-house corporate knowledge and expertise?

[Alex Green] I like the transactional point. That’s a good, succinct definition of what to consider here.

[David Spark] Let me throw this question out to both of you. Many of the things that you want to outsource could actually be great learning potential for especially green people. Do you find sometimes that outsourcing too much can actually hamper your ability to train your own staff? Either one of you jump in on this.

[Alex Green] Absolutely. I think that’s where the budget balance comes back into play. I mean, in a lot of cases, yes, I would much rather build that from the ground up internally and have that flow of education and buildup of knowledge within the team. But that, from my experience, is not always practical, especially for smaller organizations.

[David Spark] Good point. Andy?

[Andy Ellis] No, I’m absolutely with Alex here. I think he used the comment of you want to have tier three of your SOC in-house. But the question is, if you don’t have tier one or tier two in-house, how do you plan on replacing tier three when it’s time for them to move on? Because the way you get to good tier three is not by hiring outside.

It’s by getting good tier two and developing them into tier three where they have all of the knowledge about your systems. So, that’s the tradeoff you have to make. But as Alex says, if you’re trying to run a security program with three or four people, you aren’t going to have enough diversity of capabilities to really sometimes do that.

And that’s a hit you’ll have to take to say, “Look, I’m going to outsource pieces of this because I can’t run a SOC out of a quarter of an FTE, but I can certainly get a quarter of an FTE from a managed service provider.”

Sponsor – Silk Security

15:48.857

[David Spark] Before I go on any further, I do want to tell you about our absolutely awesome brand-new sponsor, and that’s Silk Security. Now, are you feeling anxious about risks lurking in your alert backlogs? Who isn’t? Frustrated with remediation requests stuck in the twilight zone? Instead of toiling over spreadsheets and watching alert backlogs build up, Silk helps security teams regain control over the risk posture.

Now, designed with the security practitioner in mind, Silk consolidates and contextualizes all of your vulnerabilities, misconfigurations, and abstract findings across your IT footprint and assets so you can quickly focus on the most urgent risks to your environment and business.

So, Silk then automates the assigning the right remediation recommendation to the right owner. That is key. And they do this through the right workflow tool as well. Also key. Now using AI and environmental analysis, Silk’s predictive ownership assignment eliminates the time suck of back and forth emailing to identify asset and remediation owners.

So, with Silk’s centralized reporting and ticketing integrations, there’s no more logging into multiple systems to create a ticket for asset owners and track down remediation or exception request status. So, security teams get visibility in one place across all remediation tasks by team, by remediation category, and then can easily communicate with stakeholders through a single dashboard to provide guidance or keep track of exception requests.

Security teams get to both resolve more critical cyber risks in a fraction of the time with Silk, ah, and they shift organizational dynamics through a comprehensive remediation lifecycle for better accountability and transparency. Kind of sounds like the best of all worlds here, doesn’t it? You want to learn more, don’t you?

So, why not check out what they’re doing? Go to silk.security.

It’s time to play “What’s Worse?”

17:57.204

[David Spark] All right, Alex, you’re familiar with this game, correct?

[Alex Green] I am.

[David Spark] And I didn’t even know you were going to come up with that great opening for us, but this “What’s Worse?” has to do with sales tactics and about…

[Andy Ellis] But I thought you said we weren’t going to talk about sales tactics on this show?

[David Spark] We are going to actually.

[Andy Ellis] So, “What’s Worse?” being misled about your “What’s Worse?” so you’re surprised.

[David Spark] I was misled, misled. We are actually going to talk about it in the “What’s Worse?” And this comes from George Strassburger of SG Computers. By the way, I make Andy answer first so you can agree or disagree with Andy. And we have three scenarios here, quick scenarios. George had created a giant setup to this, but it didn’t need all this.

I’m just jumping to the three different “What’s Worse?” scenarios. Okay. And again, all sales tactics. Number one, and you have to tell me which is the worst of these three sales tactics. The bait and switch tactic of a vendor replacing a great established relationship with a salesperson with an overzealous sales guy who disregards security staff input, avoids answering questions, and aggressively pushes a contract.

Not good. That’s scenario number one. Number two, dealing with a vendor who refuses to provide pricing on a product without delivering a full sales pitch, which is essentially the same as every other pitch. So, you got to go through that nonsense. Or the very last, when requesting a demo from the sales team, it takes months to receive the demo and a quote.

Which of these three is worse, Andy?

[Andy Ellis] So, all of these are pretty normal. So, usually when we play “What’s Worse?” it’s…

[David Spark] Yeah, they’re really fantastical scenarios.

[Andy Ellis] Things that are really off the wall. And I was waiting for the really off the wall thing.

[David Spark] No, no, none of these are off the wall.

[Andy Ellis] And here’s my take. The first one is annoying, and you see this happen all the time because many companies don’t understand the difference between hunters and farmers. So, your hunters are the ones who land new logos, and then you hand them over to farmers often to manage them. And sometimes when a hunter leaves, you don’t cleverly move their portfolio to the farmer, and you bring in this new hunter and the hunter is like, “Oh, I got to land more stuff.” You’re like, “Dude, we’ve got a contract.

All you need to do is answer our questions. We’ve got a great relationship. Let’s just manage that.” So, that one’s annoying, it’s a little bit bad.

So, the second one, the enterprise pricing, that’s a norm. And the reason for that often is that vendors have to be able to give sort of variable pricing. Price discrimination is real. If I’m going to buy 50 license, that’s very different than somebody who needs to buy 10,000 licenses. And you can’t just hand over a rate card, like it’s really ugly, it’s nasty.

The worst part of that scenario is where they don’t give a good sales pitch. So, it’s like, “Oh, I’m going to give you my standard sales pitch that says we do enterprise security and make you safe, and I don’t know what your product is.” That’s often a norm. But the real “What’s Worse?” for me is going to be the third one of, “I asked you for a demo.

Give me a demo quickly.” There should be a video-recorded demo on your website that I can just go look at.

[David Spark] Which, by the way, that’s why we started the Capture the CISO show.

[Andy Ellis] Right. Capture the CISO is all about that. It doesn’t have to be the full-blown go into everything, but you should have a less than 10-minute demo that walks me through the major components of your product so I can see what’s going on. And then if I need the personalized demo, you’ll jump in.

And then, yes, it might take a month or two to do paperwork for a proof of concept. But that’s the worst tactic in that it’s going to hurt you the most. The first two are not going to hurt you as much as this third one is because if you’ve got somebody who’s interested in the demo and it takes months to get there, you’re burning somebody because they’ll say you don’t care about customers.

[David Spark] All right. So, you think number three scenario is worse. All right, Alex, do you agree or disagree? But by the way, it’s the worst for the vendor. Sorry, Andy, just coming back to you. It’s worse for the vendor and for you, for both parts.

[Andy Ellis] Yeah, it’s worse for both. Like for the CISO, you’re wasting my time. For the vendor, you’re wasting your time.

[David Spark] Exactly. All right. Agree or disagree here, Alex, about the worst scenario?

[Alex Green] Yes, I’m going to disagree. From the vendor standpoint, I agree. I think the number three is the worst for your potential customers. But from the CISO perspective, I’m going with number one.

[David Spark] Yeah.

[Alex Green] I mean, number three is not good.

[David Spark] It’s pretty bad. Just to remind everyone, that’s just your great relation gets replaced essentially with someone you don’t like. This person disregards security staff input, avoids answering questions, and aggressively just pushes the contract.

[Alex Green] Yeah. So, number three is really frustrating. Number two, I understand there’s a degree of necessary evil there. They have to show you something before throwing numbers at you. But the number one is you have tried to establish a relationship, a partnership with the vendor, you’ve invested the time into that.

And then suddenly it’s for nothing or for something completely different than what you were hoping for or what you expected. So, I’m picking number one as purely it has wasted a lot more of my time than the other two.

[David Spark] Good answers for both.

[Andy Ellis] And I’m going to respect the disagreement, “but.” Yeah, and we don’t get to change the scenario, so from a scenario perspective, I respect where Alex is. But if you’re the CISO in this condition, you just call, especially if it’s a smaller security company, you just call up the chief revenue officer or the head of sales for whatever geo region you’re in, and you just say, “I can’t work with this sales rep anymore.

They’re nowhere near as good as my last person. What do you want to do about it?” And just stop right there. Let them solve the problem for you. That’s one reason why I didn’t mark it as much worse. I’m like, this one is easy to solve. The, “I can’t get a demo out of you,” is much, much harder to solve.

[David Spark] Well, again, we don’t solve it. Don’t fight the…

[Andy Ellis] No, I’m not fighting. This is just actionable advice for our listeners that if you get into that scenario, here’s what you do.

[David Spark] Every now and then we give actual advice to our listeners. It happens.

[Andy Ellis] Yeah. Once in a while.

How can we align different department’s objectives?

23:52.995

[David Spark] “If you’re working in compliance, learn what the infrastructure and SOC teams are doing. If you’re a pentester or a threat hunter, go chat with the auditor. If you’re a security analyst, learn what the data privacy team is working on. If you’re an identity guru, spend some time with the GRC program manager.”

Now, that advice came from a recent LinkedIn post by William Klusovsky of Stratascale. Great advice, but walk me through, I’ll start with you, Andy, how you actually do this. What’s your approach in, heck, any of these scenarios or any one you want to make up, of doing just that?

[Andy Ellis] So, I think it will depend on the relationships. If this is somebody that you interact with professionally, then it’s really easy. You just ask them one day, say, “Hey, look, I’m trying to be better at my job, and one thing I want to make sure I’m doing is I’m interacting well with my peers.

And so tell me what is one thing that I do that really bothers you or makes your job hard? What could I be doing, or my team be doing to make your job easier?” Or you could say, “What is one thing that you wish people in my job knew about your job that would make us easier to work with?” Right? Great opener.

Now you can start to have a conversation, build that relationship.

[David Spark] So, make it more about them than about you.

[Andy Ellis] Yeah, it’s always make it about them. Like, you’re not trying to tell them how you do your job. You’re trying to learn how to do your job by learning what they do. That’s always the conversation. If you don’t have the relationships, talk to your manager about you want to do peer mentoring, working with other organizations to learn what they do.

You’re not trying to cross-train. This isn’t you saying, “Hey, I want to go be in GRC,” or “I want to leave GRC.” It’s about you want to make those relationships. Can they help you with introductions? Maybe you have a peer-to-peer lunch model you can do if your company will pay for it, or in these days, Zoom coffee.

Something lets you say, “Hey, I’m just trying to broaden and understand more of what’s going on in the organization and ask.” And oftentimes, you might have a manager says, “This is a great idea. I want to facilitate it for a lot of people. Let’s like structure it.” Don’t let them take nine months structuring while you wait.

Figure out how you’re going to just make those connections and always make the conversation about them.

[David Spark] That is excellent advice. All right. What would your advice be to essentially learn whatever it is that you want to learn in terms of cross-training, in terms of mentorship, in terms of growth? How does one make that approach? And I liked your example, Andy. Your example, Alex, is?

[Alex Green] I think the SOC teams and GRC is a pretty obvious one there that often goes overlooked and understanding from a compliance perspective, how does our business actually work from the operations side, from the IT side? Rather than just jumping around requesting evidence for SOC 2 requirements that they might not have even looked at until then.

So, I think that, and this is not distinct to security at all, I think if we solve communication, we solve everything. But understanding what your teammates are doing helps you understand how you can best, like Andy said, help them and make everything more effective along the way.

[Andy Ellis] And if you want a great opener for that, is when you see them do something that your first reaction is, “God, that’s a stupid waste of time,” now you have your opener. Don’t use those words, obviously. But go to them and say, “Look, I don’t understand why we do this.” Don’t say “you.” Why we because you’re talking about the company.

[David Spark] “You” is always a fighting word, especially in email.

[Andy Ellis] Right. You is a fighting word. “I don’t understand why we do this. Can you explain it to me? Because clearly I’m missing something.”

[David Spark] I’m the doofus.

[Andy Ellis] I’m the doofus. Teach me. Everybody loves to teach you.

[David Spark] Yes, that’s it. So, let me ask you, and closing this segment out, were there situations, Alex, where you wanted to learn another area, educate yourself, or improve a relationship with a different department? Like, what did you do?

[Alex Green] I think marketing is a good example there of the people who build and manage our websites. Why are they doing some of the things that they do? And some of it is for usability compliance through ADA needs. And that’s something that, as traditional security professionals, we don’t really get a lot of insight into.

So, exactly like Andy said, taking the approach of like, “I’m dumb in this area. Can you please tell me why we’re doing it this way?” is a great approach to have them explain enthusiastically why they’re doing certain things.

[David Spark] That is actually a really good example, is the ADA. Because for those of the listeners who are listening outside, that’s the American Disability Act, who are listeners outside of the U.S. But the fact that you have to comply to certain regulations to make it usable by someone who can’t hear or can’t see on your site.

So, great example. And yeah, you wouldn’t necessarily have input into that as to what needs to be changed, and so to an outside observer it would just be confusing.

[Alex Green] Exactly.

If you haven’t made this mistake, you’re not in security.

28:51.298

[David Spark] We often talk about human creativity when it comes to threat actors, but I think we also need to give some credit to our own staff for finding ways to create security incidents. So, listen, according to a recent Kaspersky survey, over the past two years, 38% of security incidents came about from accidental human error.

Now, that’s on top of the incidents caused by intentional security violations by employees, which accounted for almost as many as threat actors. Andy, are we shooting ourselves in the foot? Is this just too much friendly fire? Why do we see more or less of this?

[Andy Ellis] So, soapbox time, they did not come because of human error. They came because of a system in need of redesign.

[David Spark] Our first segment.

[Andy Ellis] It’s our first segment. I feel like I have to repeat this at least once a month, if not more frequently. It’s like, every time a vendor comes out and says it’s human error, go look at what’s happening under the covers. Right? Because that’s really what’s going on.

[David Spark] But that’s a good point. Let me pause you right there on human error. You can’t just write it off because there is no structural design to reconfigure humans. Is there?

[Andy Ellis] No.

[David Spark] It’s not like you’re going to add an extra elbow, are you?

[Andy Ellis] It would be easier to add an extra elbow. But at the end of the day, a lot of times the violation, right? And Kaspersky says, “Oh, it’s a security violation, like using weak passwords.” Okay. First of all, why are you using passwords? I just want to put a plug for every one of the passwordless vendors out there and for zero-trust.

Like passwords, stop. Enterprises should not be using passwords if they can get away with it. I understand on the consumer side, you need passwords, but this is a choice that you made. If you are breached because of a weak password of one of your employees, you do not get to blame the employee for that.

End of story. And that was the top one on their list. And then visiting unsecured website. If you cannot use a browser and go to any site on the web and have that be a safe experience, that’s a browser configuration problem, not a user problem.

[David Spark] Right. Good point.

[Andy Ellis] And those are the top two.

[David Spark] Yeah. So, it’s interesting. The stats are very much blaming something on users, which shouldn’t be blamed. So, these are rather skewed statistics.

[Andy Ellis] Right. And then the third one was using third-party data files, data sharing platforms. Like, okay, what percentage of those were I needed to share data with a third party, but I couldn’t email it because you don’t let me send a PowerPoint file of above a big certain size because your antivirus can’t scan it.

And you don’t give me a way to do file sharing, so I had to use a third-party file share. Like, boom, that’s not the user’s problem. The user was getting the job done. You did not have a secure way for them to get the job done.

[David Spark] Alex.

[Alex Green] Andy, I think you’re my new best friend. I mean, seriously, it all comes back down to what we first talked about, and that’s the ease of use. I mean, I’m going to relate this to military tactics, but the path of least resistance, the user is going to try and do their job. They can’t remain vigilant 100% of the time.

No one can. That’s why people burn out. That’s why people click the phishing link. It’s not feasible.

[David Spark] By the way, security professionals are also humans, and they make mistakes as well.

[Alex Green] Exactly. It’s still funny when I get a security person to click the phishing link, but it happens. No one’s perfect.

[David Spark] Yeah. So, in essence, I mean, the study to most of your eyes, given the way they’re measuring it, is not a human error problem, but a structural error problem. Yes?

[Andy Ellis] Absolutely. Of their top eight, number eight is deployment of shadow IT. Let me pull out a really big soapbox. Shadow IT exists because your IT organization does not want to support the business, period. End of story right there. This is not a human problem. This is a, “We have an IT organization that does not actually want to support the business.” In one sense, I’m happy for that, that’s why CISOs exist in the first place is because we’ve always started from shadow IT.

You have e-commerce was the original shadow IT 20 years ago. That wasn’t being deployed by the CIO, that was being deployed by some random engineer, and the security team were the ones who showed up and said, “Oh, well, let’s help you get that right.” And that’s the start of our entire career field was picking up for shadow IT.

[David Spark] By the way, I never heard that line about e-commerce being the first shadow IT, but that makes total sense because yeah, the IT, there’s no way the IT department was the first to say, “Hey, we should implement this e-commerce platform.”

[Andy Ellis] Right. Somebody just did it because they could, and they’re like, “Oh, look, there’s some revenue here.”

[David Spark] Yeah. So, they could make money.

[Andy Ellis] Yep.

[David Spark] Alex, I’ll let you close on the soapbox here.

[Alex Green] Yeah. It’s hard to add to that soapbox. I mean, you’re exactly right. I mean, I’ll say it for a third time, but the path of least resistance is ultimately the users are going to accomplish their job by whatever means necessary. And if that’s negating security controls, then that’s because you haven’t made their job easy enough, or you as IT or the greater environment have made it difficult for them to accomplish their job, and they found a better way.

You have to embrace that path.

[David Spark] And I’ll bring it again full circle. The segment we did just before this talked about this very thing. If you would just interview your users about what they want to do their job better, you could find out and there would be no shadow IT. Honestly, if everyone was interviewing everybody to figure out and understood day to day what they do, no one would have to deploy their own solution.

[Alex Green] Exactly. Back to communication.

[Andy Ellis] Yep.

[David Spark] Just talk to each other, everybody. Get out of your silos.

Closing

34:39.715

[David Spark] Awesome, Alex. Thank you so much for an awesome, awesome episode of the CISO Series Podcast. I want to thank our sponsor, Silk Security. They’re at silk.security. Get better management of your entire remediation process, the vulnerabilities, and get some accountability and understand your risk profile with Silk Security.

Andy, any last thoughts on today’s discussion?

[Andy Ellis] I really love whenever we get to talk about how it’s not the human’s fault and stop blaming them.

[David Spark] Yes, let’s stop blaming the humans. Alex, any last thoughts on today’s conversation? Anything wonderful at Delta Dental we should all know about?

[Alex Green] Oh, this was a great conversation. Thank you. I mean, ultimately, all the topics we discussed today are exactly what we all need to be working towards, making it easier, and through that path, we’ll make it more secure.

[David Spark] And should we all floss?

[Alex Green] Yes, absolutely do that.

[David Spark] Okay, good. All right. Thank you very much, Alex. Thank you very much, Andy. And thank you to our audience. We greatly appreciate your contributions and for listening to the CISO Series Podcast.

[Voiceover] That wraps up another episode. If you haven’t subscribed to the podcast, please do. We have lots more shows on our website, CISOseries.com. Please join us on Fridays for our live shows – Super Cyber Friday, our virtual meetup, and Cybersecurity Headlines Week in Review. This show thrives on your input.

Go to the Participate menu on our site for plenty of ways to get involved, including recording a question or a comment for the show. If you’re interested in sponsoring the podcast, contact David Spark directly at David@CISOseries.com. Thank you for listening to the CISO Series Podcast.