CISO Competency - Security

00:03

Okay. I think we're set to go. Welcome, everyone to compensate for security. The effective See self.

00:12

All right, leave. Did you want to take a couple minutes before we get started and just share with the group little bit about the cyber reefer business? I think it's probably pretty consistent with

00:21

some of the things we talked about last week. I'd like

00:24

You know, I think it would be great for you to share a little bit about that. Then we'll get started with our lecture today. So leave share with us a little bit. Yeah, Absolutely. Thanks. I appreciate it. So as we covered in session to finance administration, sometimes you're looking a lower your budget this time of the year.

00:39

One of the ways that you could do that off is by, uh, looking for alternatives to your professional development.

00:46

So, for example, the 71 person, too.

00:50

Ah, course for a week. Sometimes that cost you, like, $7 you lose that person for only $828 per person for a whole year. You can sign up for cyber for business. It's the fastest growing catalog in the industry. We have over 5000 hours of content

01:07

across a number of different work rules.

01:10

Over 50% of our content has been created in the past six months, and some of it is from head. Obviously has done a fantastic job. Um, and, uh, we'll reach up to at the end of this call, See, if you wanna win a demo of the product

01:26

and looking forward to it

01:27

on with that I'd want Why don't you take away? Well, that's great. That's a short and sweet advertisement. I have a lot of respect, Lee, for you on the team, you guys. D'oh!

01:38

A nice job. This is such a great experience. For those of you wondering, you probably wonder what

01:44

you know I'm doing on these courses. Leaf and I are friends and I found out about Cyber Harry and

01:49

this is the second course of Dunning. I love it because it gets me access to

01:53

a big group,

01:56

and it seems like the people who are part of this community are very like minded here. It's not like there are some things that I've done in the past that have these big audiences, but a lot of times it's a lot of people who may be somewhat adjacent

02:12

to our community. It seems likely if you guys have done a good job really reaching the enterprise security professional and that's those are the people who I think enjoy and benefit hopefully benefit

02:23

from the material that we go through here. So I put a lot of time into these things, and leaf in the team have been helpful in them. I'm glad you guys were doing. I really do hope you're enjoying the course what I was trying to do.

02:35

No, but a lot of people listening here do courses as well. I know this sounds a little weird, but I just always try to create courses that I think I would enjoy. And

02:45

maybe that works. Maybe it doesn't, but I was, I think, all right, is this Like I look at every chart. I think this is boring. Is this repetitive? If it's either of those, I get rid of it.

02:54

And then you know how when you're giving a presentation and like Chart five is your favorite one you can't get. You can't wait to get to chart five. It's great. There's a great story.

03:07

The trick in giving great courses of presentations is if every charter's chart five. Then you love doing

03:13

if one through four and the kind of boring but five is great, get rid of one through four and think up more. Five. So it's like Here's I become a millionaire First, get a $1,000,000. I know it's not that easy to dio, but as you do, you teach and cut out all the boring stuff and stick

03:31

the things you really enjoy. Make sure it's chart each

03:35

each little bit of your lectures, stuff you can't wait to get to. So so again, I hope you guys will,

03:40

um, continue a relationship with cyber. Think very fine company now competency for his security. That sounds funny because the S and C so is security.

03:50

But I think it's important to recognize that there are a lot of security executives you don't really know much about. Cyber security.

03:59

Um,

04:00

we're in new discipline where this is a new

04:02

position.

04:04

In fact, I'll bet a lot of you listening are probably in a position in your company

04:11

where you're the first person to hold the job that you do right now. That's an interesting thought, right?

04:16

Maybe run

04:19

incident response for a retail company.

04:23

I'll bet you you may be the first person to do that. And you're you're forging new ground. And if you're not, you're probably the second

04:30

you know, there are 34 generations of people. In most cases,

04:34

we're doing the job that you do right now. So

04:36

So it may be that in some cases, recruiting and getting people into positions require some recruiting from adjacent areas. So I want to talk to you today about how you stay up on cybersecurity, what some techniques are to be. You know, here we go to the store, our statement that we always use at the top of our

04:57

lectures here, effective ceases, pleased to serve as the senior most eggs expert in cybersecurity for the organization. So that means and again, whether you're see, so are just a part of the management team or anybody. You are seen as an expert,

05:12

and you have to be ready. You have to understand stuff like let me give you an example There. There are topics that people just presume

05:21

that I must be an expert on because I worked until come, and sometimes they're right like I've had people just stopped me out of the blue and say, Hey, where I'm in an argument about B G P routing. You worked at A T and T, and then they'll say something really technical. And if I know the answer, I'm I'm very happy. But sometimes I don't

05:41

It could be real obvious stuff, like somebody asked me

05:44

right out of the blue. Hey, we're reading about Sim swapping. Can you explain it? And and I sort it could, But it wasn't my best explanation. I was mad at myself.

05:53

I thought. That's what I'm supposed to hit out of the park

05:56

explaining Sim swapping. Give me a break, Look. Where were my whole career in Tel? Com. So So There's something to

06:03

making certain that you are always ready

06:06

as the senior most executive in the company, or just as an executive in the company, with the ability to to do the kinds of things that you need to dio to answer tough questions. Thio. Whether it's from the board or from your management team or from customers or whomever that's it's an important role

06:26

as a sea stone. It's something we're going to spend a little time on.

06:29

Now, I want to say something kind of fun.

06:31

I would walk into your office.

06:33

What would I see

06:35

on your whiteboard?

06:38

What would be there?

06:39

And if you walked in mind, you'd probably see something like this.

06:42

It is. Really Know what? That is what a B and C are. But they apparently connected to a firewall.

06:47

Um,

06:48

if if you walk into someone's office and you just sort of nose around a little bit, there's

06:55

there's something to that. And as a senior, most person in cyber security,

07:00

um, pretty good idea to just go in and look around your office and see if you act that way. Maybe, you know, I don't know. You know, maybe you have nothing in your office minutes, corporate art,

07:11

um, or maybe have a bunch of books on finance. Or maybe I don't know what you got.

07:15

If you came to my office, you see a lot of tech stuff that's May. But when? When there's something very symbolic

07:24

aboutthe senior most expert about, or anybody expert in a company,

07:29

you know, having sort of in their environments or the visual environment that they work in

07:33

some evidence that they do think about cyber security, that it's something that they spend a little time on. Now, in my own consulting business, I created this thing here, actually taught a course Cyberia on this

07:46

where I listed out 50 things that I think you need to know.

07:50

People say, Is it the NIST framework? Now,

07:54

is it a control framework? Now they go, we're sore and

07:58

GDR, where's all the things that I see from Gardner? Nice. This isn't fourths isn't a gardener. Things isn't for the vendor industry. This is for you guys. This if you want to be smart and enterprise security,

08:11

I really over the last few years have tried to think through What do you need to be able to answer questions on? So let's just take a couple examples. If somebody comes up to you and ask you about the LP and you'II be a

08:24

I really hope you know what that stands for, right? I mean, if you don't know what you know, Deal P. But many of you know you'II be a or what if somebody asked you in the cafeteria line?

08:35

Hey, um

08:37

you know such and such your your RC So what's the difference in U E. B A N u B A

08:43

and my answer that I would be There is no difference, that they're just, you know, different companies, you know,

08:48

might like to use E because it it maybe gives him entree into the eye ot market like he makes a little comment. And there's generally great comfort that the senior executives and the security team

09:01

No things like that. If I went, I don't even know what that stands for. I believe that undermined your whole program. Now, I know that sounds funny, but I really do think it undermines appropriate. You don't know what something is. That's basic.

09:18

Then I think you have No, no, no. I think no right to run. The organization isn't dead. Speaking may disagree.

09:26

There's a low collage of different opinions about this,

09:28

and I throw out some things here that might be a little provocative. You should have an opinion, but, for example, to go down here to, uh, I don't know, multi factor authentication. That's an easy one.

09:39

But we all know that their great nuances there

09:43

like, is it reasonable to have two or three different forms of multi factor authentication in place across the company. Is that a good thing or bad thing? You might say, Hey, man, why do we have three different multi factor authentication solutions? And you're asked that question? You should know the answer, and the answer might be what we shouldn't.

10:00

We really should just have one. We should be using. Duo. Are we just?

10:03

Or maybe there's a reason why you have three different ones. There might be some diversity advantage to having three, but you should know something about that. Look, de Mark. I hope you know what that stands for.

10:16

And if you're publishing records, great. If you're not, then you need to explain to me why,

10:20

you know, and the senior most person needs to know all of this stuff, and I put a bunch of other things and you'd never see

10:28

in a frame like like you should know what information assurances? Because that's the

10:31

the flavor of cybersecurity done in government.

10:35

And if you're anything above a small small business, you are going to be dealing with government. You should understand how information assurance proceeds, say the D O D environment versus cybersecurity. In a banking environment, they're a little different. You should know

10:50

the advantages and disadvantages of dealing with evaluated reseller to buy Securities Commission. So

10:56

So these 50 controls you get him on my website and leave comm point you to the course I taught in the sun for cyber, but

11:07

this is what I This is your crib sheet. You need to know these things. You need to have a kn answer to each of these, in my opinion. Now,

11:15

let's go back and and I wanna sort of

11:18

bring you

11:20

maybe back in time, a little bit too

11:22

to this guy. This is, uh this is Mr Tompkins. But here, this is a great physicist. Name is Jorge Gama.

11:31

And he may be my my personal favorite physicists and I bring up physics a lot because I was a physics undergrad, and it's still my favorite thing to read. Like if you see me on the beach, I've got some geeky physics book, but,

11:43

um, but Jorge Gama lived at a time

11:46

when it was considered,

11:48

you know, kind of socially unacceptable

11:52

to be ignorant of technology and of physics. They say from 1919 30.

11:58

But he was very excited by that. If you went to like a premiere

12:03

of Charlie Chaplin, movie wouldn't be unusual to see, like Einstein at the premiere in a tuxedo. So people very excited about

12:13

you know, the changes in physics. I think we have a little bit of that intact, like we probably worship Alon Musk. And you know, there's a lot about Zuckerberg and others. But in cyber security, maybe not so much. Let me tell you why this is important. What Grandma did in his books, like Mr Tomkins is, he tried to explain,

12:33

to allay audience

12:35

what these complex technical issues are.

12:37

And for you as a senior executive and enterprise security, it's your job

12:43

toe have the ability

12:46

to explain things in a way that people are gonna get, you know? I mean, look, there's, um

12:50

some of the things we do are nestle complicated, like what Grandma did was he invented this cartoon guy, Mr Tompkins

13:00

and Mr Tompkins has these escapades where Gamla puts Tompkins and a little scenario, and Tompkins sees the world in an exaggeration of relativity, for example.

13:13

So you see what happens when one person's moving quickly, and the other person's moving slowly on the age at a different rate. It's time passes differently or you get thes relativistic kind of use that are exaggerated where, you know, we don't notice these things in our dated existence. But Mr

13:31

Tompkins lives in the world where you noticed them,

13:33

and it's a beautiful, very sweet book. I'm forced all my kids to read them. They probably were mad when I made them. I hope at some point is they get the

13:43

older they'll come back to it.

13:46

But I think there's a little bit of Jorge Gama that you need tohave as a chief security officer is a

13:52

ahead of compliance in a large organization or just as a manager supervisor doing cybersecurity want to be able to explain things and not using the jargon that makes all of us so darn comfortable. Look, I get it.

14:07

I'm a jargon guy too, huh?

14:09

We like to talk in things that make ourselves comfortable. Is that the things that

14:15

you know some sense are? Uh, um, you know, that's the fun of doing cyber, But let me give you an example, like a lot of times I'll be talking to execs and they'll say I don't get hacking, you know, I don't get why

14:28

Why is it so hard

14:30

to deal with Hack and stop? Why is that? And here's an example. Something that I've gone too many times. This is an old vintage kendo soda machine. This one works great with board members because board members used put 10 cents in these things and

14:46

and buy a soda is the kind of machinery. And get your hand on the tip of the bottle here.

14:52

You know, you can get your hand on there. You try and pull it out, but it won't pull up, which with 10 cents and you pull it out. Um, I've always explained sort of cyber security in this context, and I'm showing this to you now. I think I've already shown that I might have even had this on before.

15:09

But which one of reprise this one? Because I think it's so important

15:13

for your explanation when you show somebody what you could do here to crack this machine. And the obvious crack is you pop the top off the bottle, you put a strong and you drink out all the soda. So when you do that, you don't put 10 cents in you open the store. It popped the top off the bottle, which can't pull out. But, Aiken,

15:31

how top Put straw and drink it.

15:33

I got it. But the question is, how would you solve this?

15:37

And I love posing this two groups

15:39

and two executives who don't get cybersecurity. And you go to a white board and you take your marker out and you say, All right,

15:48

how would you solve this? Let's say you're not an electrical engineer. You're just a shop owner in a candy store. Tell me what you would do here. What would you do to solve this? And then I wait to see what they say

16:00

and,

16:00

you know, somebody inevitably will say, Well, how about you put a camera,

16:06

but I go Great. All right, you put a camera up here,

16:08

and, uh, And what is the camera? D'oh! It points down, and it keeps track of somebody stealing soda

16:17

and you go. Okay. Well, I would have to believe that you're actually sitting there monitoring. And if I'm some little dude, little kid, what do I care? Come open the thing. Drink the soda wave to the camera. Walk away. What if you saw them? Furthermore, how much is that camera cost?

16:30

And where do you store the tape?

16:33

And who are you paying to review the stuff and all to save 10 cents

16:38

like, is that really worth it? And by the way, do you hide the camera or do you leave that blinking light so they get some feel? For what?

16:47

Detection and monitoring is about some of the issues we were about other people will say things like, Well, why don't you move this thing from the outside to the insides and watch? And then you show that maybe

16:59

you might be reducing revenue a little bit if you if you introduce um, impedance

17:03

to commerce because of security. This thing out on the front curb of a building like this machine used to be out in front of a gun shop

17:12

in Neptune, New Jersey, where I grew up.

17:15

By the way, putting a camera outside the front of a gun shop is a little dubious. But you know, there's all kinds of things, and what we usually come to is that the most effective way to stop. This is to put a little sticker, a little sign here telling kids to cut it out.

17:30

But yet be careful. You can't say, Hey, you kids quit popping the top off these bottles and drinking all the soda because you just told them what the hack is.

17:38

But if you're too vague A you kids, that thing you're doing and you know the thing I'm talking about, stop doing that thing to the thing that you know the way. Like mobsters talking movies.

17:48

That doesn't work either. But a little sign that says if you tamper with this with this machine,

17:56

then I'm going to call your mother or something like that. That may be the cheapest, simplest thing. I could do it across Nothing. And maybe you cut out half to 2/3 of the problems. You might still have it happen, but you get the point. This is an example of the kind of thing that this guy was doing with relativity creating fun,

18:14

kind of appropriate to the era kind of narratives that help people understand a little bit about the cyber security challenge. So you should create and use things that are consistent with that

18:27

now, the way I think you should think of yourself

18:32

in the context of maybe your aspiration to be in the

18:37

the big C. C n roll or to be in one of the senior executive roles is I think you should want to be like this guy, Walter Cronkite. I like Brinkley's

18:45

biography of Cronkite.

18:47

Here's Walter Cronkite,

18:49

who looks to be looking over the shoulder

18:52

of a military or space expert in front of a console,

18:57

and he's learning enough to be able to report back to others what he learned.

19:03

And that's the essence of being the security executive.

19:07

I can't tell you how many times

19:10

in the last 20 years that's been me leaning over a console

19:15

with somebody saying, Oh, Ed, here, look, let me show you. This is the consul I use. Here's how we collect our data. Let me bring up a little map here. This is how we, you know, graft the alarms. And when they do this, we do that. And when we see that we do this and I'm sitting there nodding and taking notes,

19:32

and if you're doing it right,

19:33

then you absorb it

19:36

and you bring it back to others. You get the point like Cronkite is not the guy in front of the console. Look at his face there

19:45

he looks engaged. I loved Walter Cronkite, man. I would give anything

19:51

toe, have more. Walter Cronkite's back on TV.

19:53

I granted. The guy only had 15 minutes. He had to do it every night, four nights a week. So it's a little easier than

20:00

then. All the news were barraged with now, but

20:03

But I always tried to sort of be like that, to be interested to wanna learn to really, really be emotionally connected. You watched him report during the Apollo mission of the Big One. That power 11.

20:17

The guy was basically emotional. Looked like he was gonna break down crying. You so excited, like a little baby there. You should be like that. You should be interested in what your team is doing and let them see that you're absorbing it. And they're really trying to take what you learn

20:34

and bring it back toe budgeting

20:37

to setting priorities to making sure the organization's headed in the right direction. You need to be a little bit like that Cronkite guy.

20:45

Look, I don't want to carry this

20:48

analogy too far, but

20:51

you probably ought to learn to read off the teleprompter to, um,

20:53

if you're doing it right, it probably should be talking to your team via video. Um,

21:00

always amazed how many Don't, um,

21:03

if you're anything but a team with three or four people, you know, it's you have 20 people, then they're all scattered around 20 people. You got to communicate with them,

21:12

I think videos. Good way to do it. And thats why I bring up the Cronkite thing, you know, because he's the obvious things on TV every night. I see no reason why you should be on TV as well or find some way to communicate. I think that building a little studio if you're in a bigger business

21:30

is, has now become almost trivial.

21:33

I don't know. This may sound ridiculous to you,

21:37

but you really could easily get yourself a camera and a backdrop in your office or in a conference room,

21:45

and you can stream to your team.

21:47

And whenever you have something to say or you want to communicate,

21:51

you stream it out. Now to do that, you shouldn't be talking about silly stuff. You could, you know, be like Cronkite. You've absorbed what you've learned again. All this stuff back here.

22:03

These are all the things that you're gonna need to do. If you want to be an executive, you need to know what pen testing is and what continuous simulation like reaching attack simulation. You familiar with that? You better be. You better know something about insurance. You better know something about Cloud. You better know something that upset. But I know something of vulnerability. Management better know something about what a wife does

22:22

and on and on and on.

22:23

But you don't have to be an expert. You can be this guy.

22:26

You really can be Cronkite. You could be absorbing it because this guy in front of the console is showing you. And then how do you then push that back out? Are you gonna have meetings and everything? But I think you should also learn to communicate back out with your team.

22:45

This way, I I just think broadcasting is such a wonderful way

22:49

to demonstrate to your team that you're absorbing and you're pushing back. So that's just an idea. But try to be like him. as much as you can in areas that you may not be expert ID. Now there's another guy's my favorite guy. I I don't think there are any books

23:07

that air must reads if you're a technical person,

23:11

but this comes close.

23:14

So look, I want you to listen to me.

23:17

If you've not read this book yet,

23:19

then you need to go buy it. So when we're done, when we finish with this lecture,

23:26

you know, about 1/2 hour so we'll be done. And I have a very cool guess. Jumping on in 20 minutes that you're gonna love. Good friend. Mine.

23:33

Um, when we're done, a two o'clock eastern,

23:37

I want you go on Amazon, and by this I'm getting royalties from it. And

23:41

Mr Professor Fineman died some every years ago, so I don't know where the royalties go, but it's such a delightful book,

23:49

and there's so much about cybersecurity in his book.

23:55

It's incredible, like he's a guy who was cracking safes. So let me give you a little brief summary of the kind of fun that you'll see in this book

24:03

he noticed back during the Manhattan Project. And, yes, the Manhattan Project meaning the atomic bomb.

24:11

He was a young physicist working,

24:12

you know, Los Alamos on that project. And he noticed

24:17

that everybody had a safe, physical safe in their office.

24:21

So those days you didn't have the kind of safe where when you opened it,

24:26

it randomly spun the dial, It would just go. You'd open. It would remain on whatever the last number waas that you had turned it too, before he opened it so he could walk in everybody's office,

24:37

look at the number

24:38

and note that number as more than likely the third number in their combination.

24:44

Which means that suddenly,

24:45

if he's, you know, over a period of time collecting these numbers,

24:49

well, then he probably has a pretty good idea of number three, which means, you know, have a combination that has two numbers that need to be guest. He noticed

25:02

that if you did that over a long period of time and you just jotted down the name of the person, the number that was assigned that was there on their safe,

25:11

that

25:11

overtime, you probably would get the 1st 2 numbers, too, because people would turn to the firsts number, slide their chair wait. Answer the phone, not go back to it.

25:22

And it was his theory. And he proved it in practice that if you did this over a period time, pretty soon you'd have everybody's name and you'd have three numbers on by looking at the frequency of the numbers. It probably had a pretty good idea of what the three numbers were big.

25:37

So when he got reasonably confident that he could get into a bunch of safe's,

25:41

he would wait because it was regular occurrence that people would forget. They're safe combination. So he started telling people, Hey, I am I No, I I can open Safe's and people would be laughing all you cried, Fineman. You're crazy. Where they would say, Surely you're joking, Mr Fineman, which is where the title of the book comes from. People always thought he was nuts,

26:02

but he would say, Yeah, I I can. And then guy would forget his combination. He'd go in, he'd know the three numbers, but he wouldn't tell him how he got it. He put like a stethoscope around up on his ears. He tell everybody to be real quiet. He'd hold the stethoscope up to the safe.

26:19

And then he turned to the first number,

26:22

then turned to the second number, then turned to the third, telling everybody to be quiet. And then he'd open the state very dramatically to a large gasp from everybody in the room.

26:33

And is that hacking one? 01 If you ever heard anything, I mean, that is so funny to me. Like it really is the essence of what the hacker does.

26:44

It's it's sleight of hand. It's being mischievous.

26:48

It's It's fun, it's it's

26:51

It's just a delight. Like if you delight in that kind of hack,

26:53

then you do what we all do for a living. I'm going to guess 2/3 of you on this call

26:59

were brought to this discipline because you find sheer joy in that kind of thing.

27:04

So you're going to enjoy the final thing. By the way, the footnote here where that all ended is he went to military brass and said,

27:11

Hey, you gotta tell everybody

27:14

we need security awareness training here toe flip the spin, the dial randomly or we need new safe CE or whatever. And what did the military dio? They issued a proclamation to not let Fineman in your office again.

27:27

It is exactly the way people tend to treat. You know, hackers. It's just so darn funny. And just such a great book. So So by the by the book

27:38

and ah, and share with us, Drop us a note back

27:42

and, uh, let us all know what you think about the book. I think if you read it this summer,

27:48

you're gonna have a lot of fun with it. So now I said earlier

27:52

that, um,

27:53

security people couldn't be a little mischievous.

27:56

Um,

27:59

let me say one thing first, I'm gonna talk to you about a couple of books. You should read them. We'll get to the mission. Distant. Look, here's the, uh I feel like I need to show you this.

28:07

The steal This book by Abbie Hoffman

28:11

Look, E, I'm gonna full disclosure. There's a crazy buck like it's got bomb recipes and stuff in there. So maybe I'm being a little mischievous pointing to this book.

28:22

If you're offended by that, Don't Buy was written in 1970

28:26

but it's a really spectacular read.

28:30

And some of the rial basic things in cybersecurity were invented there. Gabby Hoffman was the guy who said, When you when you're writing a letter, a paper letter and dropping in the U. S. Postal Service, they call that the U. S. Post office, then

28:44

I mean, when you do that, if you're you're writing to your mom, then just put your mama's The from you is the two

28:52

and don't put postage and they'll return. It's your mother posted John paid, and she'll get the letter you meant to send to her without putting postage. Things like that, like that is pure I peer TCP protocol hacking. It's just it's spoofing. It's so awesome. But again, there's weird stuff in that book.

29:11

So,

29:11

um, I like is that I'm being a tad mischievous and

29:17

recommending the book, and I hope none of you were offended by Don't Bite if you if you think that there's curse words and stuff in the book, whatever. But here's one I wrote with my son

29:26

a while back. Don't buy the paper copy of this. It was written to be a Kindle on Amazon. Is this weird thing? When you do a Kindle book, they want to be able to generate a printed version. Has people like to buy the paper back,

29:40

and the printed version was terrible to me. A month

29:42

to try to reform at it to make it look halfway decent. I had written it

29:47

for print. I wrote it for your Kindle and a form that's great on Kindle. The paperback is acceptable now, but you know, I didn't want people paying a bunch of money. It's

29:57

bunch of money for paperback you used. You can get the thing pretty free. It's whatever you can nine bucks if you want to get. So I'm not trying to get you buy a book here. I'm just saying that there are a lot of things you need to do. You should be regularly reading books and it shouldn't be textbooks on cyber security. Should be things of

30:17

about cyber and things that air.

30:18

Interesting sort of sidelights. Like steal this book. If you read it, you're gonna have 100 anecdotes that you can use to help people understand complex topics.

30:29

Now, I want to show you one more thing before we get to, um, our case study,

30:33

cause we're, uh we're getting close to, uh I want a case study. They want to get to David,

30:40

our guest in a few minutes. But

30:41

when you're giving presentations, you know, a security expert there is a presumption that you, as the expert,

30:52

are going to be boring.

30:52

Um,

30:55

and we're all guilty of that, right? If you are a technical person, if you're a security expert, if you're any kind of expert,

31:00

then there is the sad fact that most of the time

31:06

your presentations are going to suck. You know, people are going to just think you're

31:11

talking over their head. They almost gonna roll their eyes when the quote unquote expert rolls in.

31:17

Because you're not gonna understand anything.

31:18

Well, you have to combat that a little bit again. The whole idea here is to serve as a senior most expert, but also be approachable.

31:26

So my favorite thing when I'm giving presentations, I always have a little joke.

31:32

And this is a recent one that I've been doing. Like I'll get up to give a presentation

31:37

and I'll start with this

31:40

like a comprehensive three Q 2018 detailed year of year enterprise information, security analysis and expert review programs, performance operation, technical trends, cyber threats and best practices.

31:52

These are all my fancy affiliations. Document unclassified. This is what you're expecting from an expert.

32:00

And after people absorbed that, I always say, Nah, like, I'm not gonna relax. I'm not going

32:05

make you look at this nonsense. Don't worry, I'm not doing that. And then I put something like that up. You crazy? Walk through cyber. And then and then they go on. They see that

32:15

what we d'oh in cyber security

32:17

is fun and mischievous. Look at just a reality. If you're not a little mischievous, you're not doing this right.

32:24

You're not an expert here in military radar.

32:29

That could be a little dry.

32:30

You're an expert in hacking and in cyber security and in tampering with technology.

32:37

So you have tohave a little mischievous component. If you're this, that this is what your presentations look like

32:45

And God helped anybody has got to be around you every day because you're probably boring them to tears.

32:50

That's not the fun of what we d'oh! We were trying to be a little mischievous here. We're dealing in a topic

32:58

that is, you know, is about tampering. That's why again. And then I said, Look, we're really gonna do crazy walk

33:05

and people generally start laughing. They think, Oh, I get it. This is actually kind of fun stuff. This is not just dry, boring attack.

33:13

And that's part of the messaging as an expert around cybersecurity. So what have we set up to this? I've said you got to know all this stuff. There's a lot of just facts that you need to know. If somebody comes up to you and they say, Hey, what air? The water? Recent trends in digital forensics, then

33:31

that. Then you gotta somehow, you know, no Snow. Something about that.

33:37

You better know what encases you better know. You know, at least enoughto get throw. But at the same token, you want to be doing it in the context of somebody who's absorbed from the experts and you get it in your head and you can report it back.

33:52

But you should be doing it

33:54

with the spirit of Fineman. We're having fun. This is security. This is not like military guidance systems. This is hacking and dealing with crazy cybersecurity issues. So that is the challenge here as you jockey and try and become,

34:13

um, you know, Ah, senior executive, you do need to know Tech. You do need to be an expert, but you could be a Cronkite Take backs for where you absorbing your push back there? Enough. Everybody Got that?

34:24

All right,

34:25

as we do each week,

34:29

we're up to our fourth installment in our

34:32

little saga with Emily, um, as she goes through her

34:37

Our little discussion with the team.

34:39

And let me just sort of summarize this week's case study before we get David in this one. I have Emily again. She's talking to a group of C I ose You can all see the

34:52

the narrative here. And I hope you're reading these.

34:54

And what happens is she, you know, she

34:58

references a friend of hers, Dave. Somebody asked her, You know, how important is it to you know, whether see Says need deeps security knowledge or if they can just hire smart people, do the actual work? Um, and Emily says, Well, I've got this friend

35:15

you know, I want to tell you about and took a job became the sea so enough

35:20

in an organization where they didn't really know a lot about cyber, but it didn't matter. They told him, no big deal. You're pure manager,

35:28

but you'll pick up security, so he's in the position. And then he's got to goto a manager's meeting. I've night flying out the Dallas and the old managers, their management teams there.

35:37

And that evening,

35:39

all hell breaks loose in their data center

35:43

and there's a big attack and a really important application goes down. And for like, 20 minutes, the whole thing is down and then raise going nuts. And it turns out part of the problem relates back to a public he certificate

35:59

and about some of your laughing, because I could tell you how many times

36:01

public he certificate expirations and things have caused me problems.

36:06

But with point is that they're all at this meeting. They get it fixed. But the CEO's pissed.

36:10

Everybody's angry. They're all you know. They've eaten dinner, and now they're gonna go have an evening meeting and the CEO calls Dave and says, Hey, listen,

36:20

we're gonna be meeting in a few minutes. Would you please come down here? We'd like a little tutorial

36:24

on public E certificates and what what broke here? What what is this?

36:30

And Dave breaks into a sweat because he really doesn't know

36:37

like he's frantic.

36:38

He gets on the Internet, is just looking around reading Oh, my God, Oh, my God! Oh my God!

36:45

And it occurs to him

36:47

that he'd mention to the CEO

36:50

that his wife was going for some minor surgery and he thought, He knows it's not today,

36:55

but he thinks move.

36:58

Do I just say, Hey, listen, I've got an emergency, you know, Exit stage left. Because if I get up in front of these execs and show that I don't know anything about public E certificates,

37:09

am I going to look ridiculous?

37:12

So I have Dave sitting down. He's got notes on the pad. He's got 15 more minutes to go into that meeting

37:19

and he looks in the hotel bathroom. Neary looks at himself

37:22

and he decides what he has to do. And again, that's where the case study. It's like what does Dave d'oh

37:28

So first you know, the discussions is a reasonable that Dave is a C. I s o

37:34

doesn't know what a public he certificate is. Well, but a lot of you would say you should know, like, Look, I have back here.

37:42

I have a public he'd infrastructure P k I and C I type

37:46

controls as one of the things that you need to know something about.

37:52

Uh, where's the air up here? See, a p K I Solutions number nine.

37:55

Obviously Dave did not read, You know, my material. If it waas, he would have spent some time learning about what a certification authority is and what what p. K I is and what a certificate is. And he could have gone into this meeting and said, All right, let me give you a little little summary on the difference between conventional cryptography. Public key cryptography.

38:15

Here's what a C A does.

38:17

Here's why the certificates are used to pass public. He's around and it's kind of a mess because infrastructures tough and you talk about the challenges of P K I. Blah, blah, blah. I could explain that in two minutes, and the whole team would be nodding and going. I got it. But here's Dave, who can't

38:37

So So that's the problem. That another question should they go into that meeting? You know, that becomes a real problem.

38:42

Um, should he try and get some expert to dial into the meeting and explain it should be

38:47

it would be honest and say I have no idea what a certificate is And the question is, What would you do if you were Dave? Would you go in there? And do you think that it's a requirement

38:59

that a chief information security officer like Dave

39:01

would would be capable of our evening of answering questions that this may not have been a certificate?

39:09

It might have been a problem with the firewall,

39:12

and, you know, everybody sort of knows at a high level what a firewall is. But let's say it's some weird, you know, next generation firewall orchestration

39:22

issue between multiple gateways that air orchestrating policy

39:25

Well, then you better be able to explain that if it breaks, and if you don't know how to explain it, then you've got a problem.

39:32

So So there is a requirement

39:36

that you have some level of technical understanding. You do not have to be a developer. You don't know how that need to know how to write the fire will rules for a Palo Alto

39:46

gateway, but you should know how these things work at a certain level. So so that's our case study. And as we always recommend with our case studies. I hope you take these things back to your team.

39:58

Um,

39:59

go through them. Good. Good pizza discussion where you explain a scenario and have people sort of discuss and debate the kinds of things that would make good sense. So with that,

40:14

do we have our leaf? Do we have our guest on the line?

40:19

Uh, yes. Uh, David,

40:22

you wear this. David,

40:24

I'm here. Guys can hear me. Ah, we sure can. We sure can. Okay, I've got a picture of you here. Over. Ah, Bed bath, front. David, I'm gonna give you a minute, just maybe introduce yourself a little bit, and then I'm gonna ask you a few questions, but until I tell the folks a little bit about yourself,

40:44

Sure. Hi, everybody. I'm David Ortiz. Um, I oversee information security for bed, bath and beyond.

40:50

Um, we're located in New Jersey. Um, I've been with the company, um, while in a lot of different roles, I would say predominantly information security. Um, about seven years ago.

41:04

That's wonderful on David. I've I've bragged about the fact that you and I are friends because I think you are one of the best in the business. You You have that

41:12

A rare combination of technical and management and understanding of complaints. I think you're awesome. Role model. And I appreciate you taking a few minutes

41:22

to share with our students. Everybody's a eager to learn from you, so thanks. Thanks for making a few minutes. Really appreciate. Except you're too kind. Well, ball keep being kind as long as you keep doing a great job. So But I guess some in some sense,

41:38

you know, we were talking a few minutes ago. You probably listen a little bit

41:43

to this. Um, this question of

41:45

how deep does your security expertise have to be a cease? All right. You and I both have friends in the business that are super gear heads on. We also have friends that are, maybe not, you know, maybe a little more surface. What's been your experience? Like how? How important is that? You You think you're rolling with you for all of us

42:06

tohave a pretty broad understanding of most of the topics that pop up in cyber. What's been your experience? So I'll be honest with you. When I read the case study and I saw the name David Neri did break out into a cold sweat. That was an accident.

42:21

Yeah, The irony of us talking today with the case study and the name gave in there in retail as well. I'll sure, all of you. We had no issues with our

42:29

with any systems, their applications or websites in the last 24 hours. So that way, all the walk away with that funny collision, I should change it. Pretty, pretty ***.

42:39

Um, so I believe you need to be able to research and go deep on a particular topic. I have been in that, um,

42:46

certificate conversation. I've been in

42:51

other conversations as well. Um, and yeah, you got to keep it high level, but at the same point, you have to be able to go deep.

42:59

I would say in your role was he So you're going to acquire the knowledge of security in many areas. And for some of you, I believe as you aspire into this role, you're definitely not gonna have that knowledge at first. But I want

43:14

say that cybersecurity business unit. Right? And I always like to say, even if it reports up the information technology, um, I would say treated as a business unit.

43:23

And as part of that will you also need to be versed in areas of your business, right? Each organizations a little different, but, you know, some of the ones I would point out our legal, um who sometimes runs the privacy areas. Sometimes privacy goes to the to the sea so itself,

43:42

um, risk management is an area I spent a fair amount of time with, as well as finance an internal audit. So those air those are things, you know, you can learn tack, and folks can learn tech. But you have to be able to talk to the finance people, the Internet, all internal audit people as those digital and marketing people as well as if

44:00

those airline to business in the organization. So,

44:01

um, it's important you're gonna gain that knowledge. But ej point you, you you have to know a fair amount of it. But you're not gonna be that gearhead every single time. There's only a few special people out there that could do that.

44:17

David, How important is it to have analogies things that resonate

44:23

with with groups of folks like like the ability to explain a complex topic, using

44:30

stuff that

44:31

people will understand that has that been something you've spent a lot of time thinking about.

44:37

So storytelling is a big topic in our industry, and I always like to say, Know your audience

44:43

So it's going in to speak. Thio Human resource is, um, and finance. It's probably going to be two different conversations, and you want to know your audience, right? If you're going in to talk to

44:55

on executive group ability directors again, No, your audience and Taylor appropriately rate.

45:00

Um, tell the story. Try to relate. And it's a story, um, back in the human resource area or some type of you no relation to the finance team when you're trying to get your point across for a particular area,

45:15

What what do you do to keep up is, other than maybe just a lot of program briefings from teams. But there's some things that you recommend people do to stay current on

45:25

on tech topics and related issues.

45:30

Yeah, research, read the news. Talk to other people. Um,

45:36

you know, I always keep, you know, third parties or vendors at arm's length. But whenever somebody reaches in for a conversation um, I always have a question I wanted them to answer by having them in the conversation. So if they came in to try to sell you something, maybe, But I had a reason for for having them come in to answer a question for me

45:55

that I was researching it

45:57

time. But,

45:58

um e I definitely stay current on what's going on. There's a lot of information out there and you'll you'll quickly realize what information is right for you and not to get overloaded on that. But there's, Ah, a fair amount of threat information out there, right? There's a lot of ability. Information. Um, there is just news,

46:19

right? But I would say it.

46:20

It's it's your role to stay current.

46:22

I always I always felt like and I still feel like there's there isn't a vendor on the planet

46:30

that's not willing to sit down with her and explain what they dio, you know? I mean, it's it's a little rough, like, I'm not suggesting that you take advantage of a vendor if you're really not gonna buy anything,

46:39

but But that said, you know, in the job

46:44

there probably is not a single aspect of cyber security that I can pick out

46:51

where you couldn't find someone

46:52

who would be willing to sit down and really lay it out for, you know, if you have you ever had a se of gender, say, now we don't want to come in and talk. Is it happened, right? You had good experience with that, like you. And I know you don't shy away from them just happy to chat with them. But it seems like that's a good

47:12

sort of means. And I mean, obviously we're sitting here on cyber Berries from sure Leaf is gonna want

47:16

have me reinforced how important it is to do online learning. We'll get to that in a minute, but before we took on line. But do you find that vendors have been very helpful in teaching you things that you didn't know before?

47:29

I'm pretty straight with people, you know. People will come in or say they want to come in, and I am sharing with us. I say, Look, I'm not really looking to rip and replace anything out of the environment. If if you want to come in and talk, um, and see where you you can you're a fit.

47:46

We can talk to that right, and we can. We can develop a relationship, and that's really what I say. Say to say to some of their parties in the vendors is, Let's let's develop a relationship. I don't have a need for your product right now, but get to learn me and our business. And when there's a fit or I know of you and I need something, I'll reach out. But

48:06

and if you want to share some information, that's great.

48:08

Um, and it's a balance, right? Some of them are sort of new to the conversation, but some of them get it, and, you know, they send over timely information hand in the,

48:16

um, I'm in. I'm in the business of protecting email rights. I'll get some information about that from them. They don't they understand. You know when to do it in the timing around all that. So, yeah, I engaged quite often, and you can easily tell which ones are good at it. Which ones or not?

48:35

Yeah, I think that's a great answer. Now let's talk learning a little bit. I know you know in any large company. I think nowadays

48:43

it's almost like everything changes so fast that

48:47

there's no such thing as just sort of developing institutional understanding of anything. And it just sits with you for a bunch of years and just keep applying. It seems like in every industry,

48:59

um, crossed with cybersecurity, certainly that the demand that you keep learning seems just almost insane. What are some tips and do you personally find

49:09

a lot of online stuff and, you know, and courses and things how important of those been

49:15

to you and your team just to keep up? Because it seemed like a bee, almost a full time job for people like you and I to keep up with everything. You can't do that because you have a regular day job. But what are some of your thoughts on the learning experience and training

49:30

in a business environment?

49:32

It's really important, and I stress this to a lot of my teams that

49:37

it's It's

49:39

a career or a profession versus a job, right? It's not really a job. It's a career or a profession that you engaged in, and you have to stay current with the news. It's a big part of it, but you also have to stay current with the technology and the business, right? I want to keep making that point about the business and learning your business.

49:58

But

49:58

online training is a big aspect of what we do now. It's tougher and tougher to get in and out of the office, and, you know, like, I jumped out of a meeting, Um,

50:06

just talked dead today, and, you know, I'm jumping into another meeting right after this, but, you know, I'm gonna go home tonight, and I have some research that I want to read in the federal fall asleep. I'm gonna read it.

50:16

So it's it's that sort of stuff. And I engage with, um a lot of my team members, and

50:24

I would say some of them are specialists in some other areas, and we wanted from one another. Where if if we're saying that we're building a road map for an identity and access management solutions future, some people are gonna go deep in that. And so we have them come and talk to us and teach us about it. We have some really great people on that area, and they'll put,

50:44

um, some some documentation together for some of the other teams, and we talk about that and they teach us. But I'm old fashioned. I like books. I still read a lot of books. The online training is great.

50:58

Um, it's a blend of it all, I would say, but it's it's it's hard to keep up, but it's something that we have to do.

51:05

Let's talk a little bit on tech trends. I'm curious. You know, you and I have been talking for so long. Well, last few years and into the future. Any any trends that

51:15

you think that folks here should be aware of from the tech perspective in cyber security?

51:22

Yeah, This is quite a bit out there. Um,

51:24

I'll give you a few that are just top of mind that I've been in a lot of conversations the last couple of weeks.

51:30

Um,

51:31

I would say digital payment, digital payment card fraud and credential abuse, or two topics I talk about almost every week. Um, and I'll get into a little bit of the attack with, um but, um, I would say with the onset of chip and pin based payment card with the onset of chip and pin,

51:46

um, technology payment card fraud shifted online to the Web or digitally. Um, in some organizations, this is really pushing physical security teams who handled, um, some of the theft in stores more in the digital area and working with the information security into that response. Teams

52:07

who have to respond from a compliance standpoint

52:08

more closely together. So we have an intersection of technology,

52:14

um, that we use and, you know, one team may use one p attack. Another team may use another piece of tech, but

52:21

those areas are blending even more so than they have in the past.

52:25

And it's almost a similar conversation that, you know, physical loss prevention team. Maybe in versus, you know, digital information security. It's a response team.

52:36

Um, just if you wanted to go out and research a little bit about what I'm talking about, go search for things about this car hacking group and you'll get a ton of information. What's happening out there? It's a daily, um,

52:50

conversation. Consumer Web sites are constantly under attack for different things. That's one of them with digital payment card skimming. The other is credential abuse or credential stuffing.

53:04

Um, again, it's plaguing consumer Web sites

53:07

um, the websites are constantly under attack, and these air with prior stolen credentials that they're being used to access customer accounts on these consumer web sites that either steal data were place fraudulent orders. So this these attacks are typically,

53:27

um, performed by box,

53:28

um, on the internet and that there were seeing them launch from a variety of once trusted sources A cz well, as untrusted sources. So for us, and I'm sure other folks as well, we put ah fair amount of focus on protection mechanisms and ratings of websites and things like that. So

53:47

two trends that we're spending a whole lot of time talking about. And as you know, a lot of organizations talk about digital transformation. It just brings all this out into the forefront

53:59

on a digital. That digital transformation is that you see that it both in the front office and back office

54:05

technology, like certainly in the e commerce front. And I see it. You guys see that also in the back end?

54:10

Yeah. There's a lot of talk. Um, you know about supply chain, um, and physical stores and physical stores air really morphing into showrooming of showroom, right? For a store, so the digital footprints in there are continuing to grow. Um, and they're in the tax office.

54:30

Interesting. Interesting.

54:32

What about them? In terms of kind of some of the whiz bang things we all hear about, like artificial intelligence and

54:40

some of the things that deep learning, it's Wendy. What do you think about that? I know you got a very eclectic background, and I know you. You think about those things. You you ambitious that those things will help us fight cyberattacks. Or do you think maybe some of that's hyper Where's your head? Stand on those things? Um, I

54:59

I tend to stray away from some of the marketing terms. Whenever

55:01

somebody wants to talk about Cloud. Iose has the question. What kind of club? So for talking about machine learning or artificial intelligence,

55:10

I quickly go back to Okay, let's talk about automation, right? We definitely want to automate things, and there's definitely, um, an area for it. I was in a conversation with, um

55:22

someone in my organization today, and he was he was letting me know that they're moving forward with automating um,

55:30

some of the scanning on our Dev Ops pipeline and I'm very excited about that because that there's a real benefit to that for us to catch things earlier. Um, along the development,

55:44

I blind for lack of a better word, but it's gonna help us down the road and save some dot real dollars at the end of day. But that's automation, right? Um, I talked to our secret operations teams, and that's an area that's right for automation, right? I would caution everybody to say it's gonna it's gonna

56:02

you can take a human being out of the conversation because I don't think you can. In all instances,

56:07

they're still needs to be some kind of oversight in review of critical things. But for the repeatable areas, Yeah, we're definitely heading in that direction. I you know, I caution myself to step lightly, and you know my my colleagues to step lightly and that in those areas,

56:24

that is fantastic. You know, they David Well, a couple minutes here. Um, a lot of people in the call here that are

56:31

really focused on the career would like to see some advancement, many of whom aspire

56:37

to the kind of position you're in right now. If you were sitting with any of them having a cup of coffee,

56:44

any any one or two bits of advice that you might have for them, you know, based on you know, your experience that they should think about to achieve those goals

56:57

in our industry and anything come to mind.

57:00

Yeah, I would say, you know, plan in advance to be well rounded,

57:04

understand the scope is information security versus just I. T. Or Cyber Security. You know, there's a lot of good, you know, Data points out there about that that you can read about or talk to other people about. But,

57:15

um,

57:16

and I said a little bit earlier, right? Understand that your future responsibilities is also going to include, um, talking to the business unit, right? Know how to speak their language, know how to tell the story, connect with um, right. It's not always going to be a text conversation, but businesses air changing so rapidly these days,

57:37

and your focus area is going to change from time to time. Just be prepared to be able to, um,

57:44

reorganized daily, right? And don't get caught up in the fact that you're reorganizing daily because your business itself is going to have to re prioritize them. And that means you do as well. You're always gonna be aligning with, um the objective is your business, and that's going to help you in the long run.

58:02

That is fantastic advice. I hope people love

58:07

appreciate how how unique and helpful that those points are. They come from Ah, lot of expertise and a lot of experience. So, David Thanks, man. I'm gonna let you get back to your busy day.

58:20

Appreciate you joining us here and for everyone. Listen, we're at the top of the hour here. Oh, uh, enjoyed our

58:25

are our here. I'm going to be on vacation for about a week. I think we've skipped next week.

58:31

Um, well, make sure you know the date of the next one. Or maybe, you know already, but But we'll be skipping next calendar week

58:40

and with our fifth session will come back and pick up where we left off. So behalf of the whole love team. Thanks. Thanks for joining us. And everybody have a wonderful afternoon. Thanks, David.