Managing messaging with management, becoming a CISO with Mary Gardner from Goldiknox

1
01:00:00,016 --> 01:00:04,416
[MUSIC]

2
01:00:14,233 --> 01:00:17,016
Hello everybody, it is Brian and I am

3
01:00:17,016 --> 01:00:19,133
back with another one of my fantastic

4
01:00:19,133 --> 01:00:21,266
interviews that we've lined up with

5
01:00:21,266 --> 01:00:22,133
people in the industry.

6
01:00:22,966 --> 01:00:25,516
This is the BreakSec Education Show and

7
01:00:25,516 --> 01:00:27,216
thank you all for being here.

8
01:00:27,766 --> 01:00:29,083
I have with me this week,

9
01:00:29,599 --> 01:00:31,500
Mary Gardner from Goldinox.

10
01:00:32,000 --> 01:00:34,133
And Mary, thank you for taking the time

11
01:00:34,133 --> 01:00:36,016
to come and speak with me this week.

12
01:00:38,083 --> 01:00:38,533
Thanks Brian.

13
01:00:39,800 --> 01:00:42,699
Mary Gardner, I've

14
01:00:42,699 --> 01:00:44,166
been in the industry for

15
01:00:44,316 --> 01:00:45,883
about 25 years,

16
01:00:46,533 --> 01:00:48,533
mostly in management roles.

17
01:00:49,849 --> 01:00:51,583
Worked in industries from

18
01:00:51,583 --> 01:00:55,000
finance to tech to healthcare.

19
01:00:55,733 --> 01:00:58,066
I'm currently working with

20
01:00:58,066 --> 01:01:00,016
a company called Goldinox.

21
01:01:00,783 --> 01:01:02,933
We're a security consulting company

22
01:01:02,933 --> 01:01:05,599
that's really focused on helping

23
01:01:05,633 --> 01:01:08,099
customers achieve right size security for

24
01:01:08,099 --> 01:01:09,116
their organizations.

25
01:01:10,116 --> 01:01:12,800
And building an organization that's

26
01:01:12,800 --> 01:01:13,583
focused on real

27
01:01:13,583 --> 01:01:16,333
security and risk management.

28
01:01:17,433 --> 01:01:18,716
So thanks for having me.

29
01:01:19,383 --> 01:01:22,099
Right on, just posting up a link to

30
01:01:22,099 --> 01:01:25,883
goldinox.com on the chat there.

31
01:01:27,199 --> 01:01:30,816
And so I had you on because

32
01:01:30,816 --> 01:01:33,533
one, we have a mutual friend.

33
01:01:34,083 --> 01:01:38,416
And I used to work with her at Leviathan.

34
01:01:39,366 --> 01:01:41,900
Amazing individual, far better

35
01:01:41,900 --> 01:01:44,683
than I am at most everything,

36
01:01:44,683 --> 01:01:46,966
which is why y'all started.

37
01:01:47,583 --> 01:01:52,283
I guess the big question for me is, it

38
01:01:52,283 --> 01:01:54,566
hasn't, the pandemic,

39
01:01:54,566 --> 01:01:55,866
we're coming out of the pandemic,

40
01:01:56,733 --> 01:01:58,216
depending on who you talk to,

41
01:01:58,216 --> 01:01:59,483
hiring is good or not good.

42
01:02:01,916 --> 01:02:03,983
Why was now the time for you to go ahead

43
01:02:03,983 --> 01:02:05,699
and establish Goldinox?

44
01:02:05,699 --> 01:02:07,783
Was it just you felt like it was a good

45
01:02:07,783 --> 01:02:09,933
time in the industry and

46
01:02:10,116 --> 01:02:13,283
or you were just tired of the corporate

47
01:02:13,283 --> 01:02:16,666
life and you wanted to be the navigator

48
01:02:16,666 --> 01:02:17,333
of your own boat?

49
01:02:17,383 --> 01:02:19,400
What was the impetus to start Goldinox?

50
01:02:20,733 --> 01:02:22,483
That's a really good question.

51
01:02:23,116 --> 01:02:23,900
And I think it's kind

52
01:02:23,900 --> 01:02:24,883
of all of the above.

53
01:02:28,016 --> 01:02:31,283
The right time, the SEC is really

54
01:02:31,283 --> 01:02:34,516
focusing on security and

55
01:02:34,566 --> 01:02:38,716
organizations, especially publicly facing

56
01:02:38,716 --> 01:02:40,466
publicly traded companies.

57
01:02:41,583 --> 01:02:47,083
And I think between myself, the friend

58
01:02:47,083 --> 01:02:48,533
that you mentioned from Leviathan,

59
01:02:49,583 --> 01:02:51,916
we found that consulting companies were

60
01:02:51,916 --> 01:02:56,783
really lacking in the good advice and

61
01:02:57,033 --> 01:03:00,483
really focusing on what organizations

62
01:03:00,483 --> 01:03:02,716
needed from a security company,

63
01:03:02,916 --> 01:03:06,316
rather than what they pro forma provided

64
01:03:06,316 --> 01:03:07,866
as a consulting company.

65
01:03:08,683 --> 01:03:10,566
So I think we're really trying to take a

66
01:03:10,566 --> 01:03:11,616
bespoke approach and

67
01:03:11,616 --> 01:03:14,566
understand our customers and how we can

68
01:03:14,566 --> 01:03:17,366
really help them build

69
01:03:17,366 --> 01:03:24,333
a security organization that will meet

70
01:03:24,333 --> 01:03:26,533
the needs of their customers and

71
01:03:26,533 --> 01:03:27,300
the compliance

72
01:03:27,300 --> 01:03:28,983
requirements they have to fulfill.

73
01:03:29,766 --> 01:03:30,866
Right, okay.

74
01:03:31,883 --> 01:03:33,666
So you mentioned SEC, are

75
01:03:33,666 --> 01:03:34,733
these the new requirements for

76
01:03:34,766 --> 01:03:37,166
like breach

77
01:03:37,166 --> 01:03:39,633
notifications or material control or

78
01:03:39,633 --> 01:03:40,500
are there other ones

79
01:03:40,500 --> 01:03:42,516
that I was unaware of?

80
01:03:43,083 --> 01:03:44,733
That's primarily the one.

81
01:03:45,699 --> 01:03:49,333
They did have a proposal

82
01:03:49,333 --> 01:03:52,599
to require cybersecurity

83
01:03:52,599 --> 01:03:55,300
educated members of the

84
01:03:55,300 --> 01:03:58,199
board on publicly facing boards.

85
01:03:59,433 --> 01:04:00,666
They've since rescinded

86
01:04:00,666 --> 01:04:02,916
that, they've taken it back and

87
01:04:03,883 --> 01:04:05,833
are trying to massage that I think.

88
01:04:05,833 --> 01:04:07,133
I think we'll still see

89
01:04:07,133 --> 01:04:09,216
some sort of requirement for

90
01:04:10,566 --> 01:04:13,333
board reporting from the SEC, but it

91
01:04:13,333 --> 01:04:14,766
hasn't gone through yet.

92
01:04:14,766 --> 01:04:15,616
They haven't figured out

93
01:04:15,616 --> 01:04:17,066
exactly how to word it.

94
01:04:17,783 --> 01:04:21,016
Right, but I mean, it sounds great.

95
01:04:21,416 --> 01:04:23,033
I mean, having somebody on the board who

96
01:04:23,033 --> 01:04:24,733
actually understands security because

97
01:04:24,733 --> 01:04:28,083
it feels like a lot of these boards are

98
01:04:28,083 --> 01:04:30,183
just there because either you've invited

99
01:04:30,366 --> 01:04:32,633
your friends to hang out with you at your

100
01:04:32,633 --> 01:04:34,516
company or you've

101
01:04:34,516 --> 01:04:37,699
paid the toll fee to get

102
01:04:37,699 --> 01:04:40,416
in to the executive washroom.

103
01:04:40,416 --> 01:04:42,500
I mean, why do you

104
01:04:42,500 --> 01:04:44,466
think they push that back?

105
01:04:44,800 --> 01:04:47,433
Do you think that there was just a lack

106
01:04:47,433 --> 01:04:49,966
of people in the information security

107
01:04:50,033 --> 01:04:51,566
industry that could be on a board?

108
01:04:52,716 --> 01:04:56,433
I think there's a couple reasons.

109
01:04:56,766 --> 01:04:59,683
I think one is there is a lack of people

110
01:04:59,683 --> 01:05:03,333
experienced in information security.

111
01:05:04,099 --> 01:05:06,483
They could sit on a board and understand

112
01:05:06,483 --> 01:05:11,099
all of the rest of the board concerns.

113
01:05:12,783 --> 01:05:15,699
And maybe that's not truly the case.

114
01:05:15,900 --> 01:05:19,400
Maybe it's the general feeling among

115
01:05:19,400 --> 01:05:23,266
corporations who are trying to find

116
01:05:23,266 --> 01:05:24,516
members for their boards.

117
01:05:24,783 --> 01:05:27,033
They want well-rounded board members that

118
01:05:27,033 --> 01:05:30,216
will help them take care

119
01:05:30,216 --> 01:05:32,016
of their company and be good

120
01:05:32,033 --> 01:05:33,666
stewards and help them

121
01:05:33,666 --> 01:05:36,099
manage and grow their companies.

122
01:05:37,616 --> 01:05:40,866
And I think in a lot of cases from a

123
01:05:40,866 --> 01:05:42,400
security perspective, we have

124
01:05:42,400 --> 01:05:44,099
a tendency to speak in terms

125
01:05:44,199 --> 01:05:50,216
of security jargon, vulnerabilities and

126
01:05:50,216 --> 01:05:52,883
breaches and incidents

127
01:05:52,883 --> 01:05:55,116
and response and resilience.

128
01:05:56,366 --> 01:05:59,699
And that's not always the way a

129
01:05:59,699 --> 01:06:02,316
corporation wants to have

130
01:06:02,316 --> 01:06:03,466
their board meetings go.

131
01:06:03,866 --> 01:06:07,183
So I think it's incumbent upon us if we

132
01:06:07,183 --> 01:06:10,199
want people who care

133
01:06:10,199 --> 01:06:12,183
about information security to

134
01:06:12,433 --> 01:06:15,516
start speaking the business language and

135
01:06:15,516 --> 01:06:18,500
really show that we deserve

136
01:06:18,500 --> 01:06:20,433
a place at the board table.

137
01:06:22,099 --> 01:06:25,800
I know we do because frankly, I've had

138
01:06:25,800 --> 01:06:28,016
the pleasure of working with a lot of

139
01:06:28,016 --> 01:06:29,183
security people who are

140
01:06:29,183 --> 01:06:30,583
the smartest kids in the room.

141
01:06:32,133 --> 01:06:36,783
Not just information security, but also

142
01:06:36,783 --> 01:06:38,599
they understand finance.

143
01:06:38,866 --> 01:06:42,000
I think we have to understand finance and

144
01:06:42,000 --> 01:06:45,083
business and technology

145
01:06:45,083 --> 01:06:47,800
and product development

146
01:06:47,966 --> 01:06:49,300
because of what we do.

147
01:06:49,683 --> 01:06:51,400
It's such a broad ranging field.

148
01:06:52,199 --> 01:06:54,383
So I think we can speak to it.

149
01:06:54,383 --> 01:06:55,483
We just need to

150
01:06:55,483 --> 01:06:57,883
convince everybody else we can.

151
01:06:59,216 --> 01:06:59,416
Right.

152
01:07:00,183 --> 01:07:05,466
So you mentioned the language of the

153
01:07:05,466 --> 01:07:07,866
board and I'm kind of interested in that.

154
01:07:08,199 --> 01:07:10,133
I'm sorry, we're going we're going a

155
01:07:10,133 --> 01:07:11,166
little bit further than what

156
01:07:11,166 --> 01:07:12,333
I put on the original Google

157
01:07:12,366 --> 01:07:12,716
notes.

158
01:07:12,716 --> 01:07:14,816
But you talk about the language of the

159
01:07:14,816 --> 01:07:17,233
board and, you know, security people.

160
01:07:18,816 --> 01:07:21,616
So I kind of see that it's like, you

161
01:07:21,616 --> 01:07:22,400
know, you've got your

162
01:07:22,400 --> 01:07:23,633
levels, you've got your tactical,

163
01:07:23,900 --> 01:07:25,500
you've got your operational, you've got

164
01:07:25,500 --> 01:07:26,866
your strategic kind of

165
01:07:26,866 --> 01:07:27,766
stuff, you've got your,

166
01:07:27,766 --> 01:07:29,583
you know, whatever's above strategic,

167
01:07:29,816 --> 01:07:32,616
strategic is fairly broad at that point.

168
01:07:32,616 --> 01:07:35,066
But what do what does

169
01:07:35,066 --> 01:07:35,883
the board care about?

170
01:07:38,150 --> 01:07:42,416
Generally, the bottom line and any any

171
01:07:42,416 --> 01:07:45,199
risks that could impact that.

172
01:07:46,366 --> 01:07:49,800
You know, when I think when we think

173
01:07:49,800 --> 01:07:50,833
about information

174
01:07:50,833 --> 01:07:52,633
security risk, it's always top

175
01:07:52,633 --> 01:07:54,366
of mind for us because we know

176
01:07:54,366 --> 01:07:57,233
what's out there and we know.

177
01:07:57,583 --> 01:08:02,733
I lost my word.

178
01:08:03,433 --> 01:08:05,199
We know the impact it could have.

179
01:08:05,800 --> 01:08:06,066
Right.

180
01:08:06,300 --> 01:08:07,199
And we know that it

181
01:08:07,199 --> 01:08:08,483
could be very detrimental.

182
01:08:09,483 --> 01:08:12,783
But in reality, we have, you know, boards

183
01:08:12,783 --> 01:08:14,833
that are taking care of chains or grocery

184
01:08:14,833 --> 01:08:17,966
stores that have slip and fall issues

185
01:08:17,966 --> 01:08:22,100
from their customers on a daily basis.

186
01:08:22,783 --> 01:08:24,966
So they have hundreds of

187
01:08:24,966 --> 01:08:26,783
thousands of potential lawsuits.

188
01:08:26,833 --> 01:08:28,366
There are also risks that

189
01:08:28,366 --> 01:08:29,866
risk that they care about.

190
01:08:30,600 --> 01:08:30,816
Right.

191
01:08:31,933 --> 01:08:32,100
Right.

192
01:08:32,100 --> 01:08:34,583
And we have to we have to understand that

193
01:08:34,583 --> 01:08:35,816
and understand where we fit

194
01:08:35,816 --> 01:08:37,216
in that business landscape

195
01:08:37,566 --> 01:08:40,199
and how we ultimately

196
01:08:40,199 --> 01:08:41,500
impact the bottom line.

197
01:08:41,833 --> 01:08:44,116
We have to understand that every time we

198
01:08:44,116 --> 01:08:47,216
create a policy to

199
01:08:47,216 --> 01:08:48,899
require a longer password,

200
01:08:50,466 --> 01:08:52,800
we're adding time to everybody who has to

201
01:08:52,800 --> 01:08:54,933
input a password 10 times a day.

202
01:08:54,933 --> 01:08:55,399
Right.

203
01:08:55,399 --> 01:08:56,533
We're taking that time

204
01:08:56,533 --> 01:08:57,533
from their productivity.

205
01:08:57,633 --> 01:09:00,616
So those are the things

206
01:09:00,616 --> 01:09:02,100
that the board cares about.

207
01:09:02,333 --> 01:09:04,100
They want to understand

208
01:09:04,100 --> 01:09:09,283
that we're a business partner.

209
01:09:09,283 --> 01:09:10,899
We understand the business and we

210
01:09:10,899 --> 01:09:12,633
understand how to enable the

211
01:09:12,633 --> 01:09:14,483
business with security with

212
01:09:14,483 --> 01:09:18,183
good security practices and also that we

213
01:09:18,183 --> 01:09:21,233
can speak to them about

214
01:09:21,233 --> 01:09:23,933
what we've done to impact

215
01:09:23,933 --> 01:09:25,100
the business positively.

216
01:09:25,783 --> 01:09:26,800
Right. Right.

217
01:09:27,083 --> 01:09:28,633
That makes sense.

218
01:09:30,433 --> 01:09:31,300
Yeah. Yeah.

219
01:09:31,500 --> 01:09:32,399
And sort of.

220
01:09:32,683 --> 01:09:34,883
No, I it makes complete sense to me and

221
01:09:34,883 --> 01:09:36,133
I've kind of I don't want

222
01:09:36,133 --> 01:09:36,966
to say I've railed against

223
01:09:36,966 --> 01:09:39,283
this and other shows, but it's like we're

224
01:09:39,283 --> 01:09:42,166
we don't have a lot of

225
01:09:42,166 --> 01:09:44,666
positives that we tend to be able

226
01:09:44,666 --> 01:09:45,500
to look at.

227
01:09:45,766 --> 01:09:47,916
And I guess if you're on a board and

228
01:09:47,916 --> 01:09:49,183
you're always thinking doom

229
01:09:49,183 --> 01:09:50,466
and gloom or you're always

230
01:09:50,516 --> 01:09:52,866
expecting the worst and you know, there

231
01:09:52,866 --> 01:09:54,300
in some ways some of the

232
01:09:54,300 --> 01:09:55,333
board people are expecting

233
01:09:55,399 --> 01:09:57,466
cheerleaders and to be behind an idea.

234
01:09:57,966 --> 01:10:00,366
And when I think of something, especially

235
01:10:00,366 --> 01:10:01,216
at work and I'm not

236
01:10:01,216 --> 01:10:02,316
even at a board level,

237
01:10:02,683 --> 01:10:03,716
I'd like to be one day.

238
01:10:04,433 --> 01:10:06,566
But you know, when a product team or

239
01:10:06,566 --> 01:10:07,283
something comes in and

240
01:10:07,283 --> 01:10:08,316
goes, hey, we've got this great

241
01:10:08,316 --> 01:10:09,183
idea for a floating

242
01:10:09,183 --> 01:10:10,300
toilet seat or whatever.

243
01:10:10,300 --> 01:10:12,383
And it's like why?

244
01:10:13,416 --> 01:10:15,100
And, you know, a product person or a

245
01:10:15,100 --> 01:10:15,916
person who's like, you

246
01:10:15,916 --> 01:10:16,766
know, marketing or whatever

247
01:10:16,766 --> 01:10:18,316
would be like, yeah, that's great.

248
01:10:18,316 --> 01:10:19,133
Yeah, let's let's do that.

249
01:10:19,233 --> 01:10:19,933
Let's sell a million

250
01:10:19,933 --> 01:10:21,433
floating toilet seats.

251
01:10:21,433 --> 01:10:24,000
And the security person is like, we don't

252
01:10:24,000 --> 01:10:25,583
really need a floating toilet seat.

253
01:10:25,800 --> 01:10:28,199
You know, I think in some ways, yeah,

254
01:10:28,199 --> 01:10:29,583
we're there's some

255
01:10:29,583 --> 01:10:31,816
realism there or some, you know,

256
01:10:31,816 --> 01:10:33,399
I don't want to say grounded or whatever,

257
01:10:33,399 --> 01:10:35,300
but security doesn't

258
01:10:35,300 --> 01:10:36,233
come off as being overly

259
01:10:36,233 --> 01:10:36,666
positive.

260
01:10:36,933 --> 01:10:37,833
We're we're restrictive.

261
01:10:38,233 --> 01:10:39,183
We add things.

262
01:10:39,533 --> 01:10:42,399
We we tend to create stumbling blocks

263
01:10:42,399 --> 01:10:43,816
instead of enabling things.

264
01:10:44,600 --> 01:10:46,966
I can I can understand why being on a

265
01:10:46,966 --> 01:10:48,516
board that might be a

266
01:10:48,516 --> 01:10:50,033
limiting thing for the company.

267
01:10:50,033 --> 01:10:52,566
You know, it seems like that would be

268
01:10:52,566 --> 01:10:55,466
best left to legal type folks.

269
01:10:55,466 --> 01:10:57,033
Hey, what kind of risk does

270
01:10:57,033 --> 01:10:58,683
this cause to the organization?

271
01:10:59,183 --> 01:11:02,033
You know, and the lawyers are necessary.

272
01:11:02,366 --> 01:11:04,283
Evil security is not in this case.

273
01:11:04,633 --> 01:11:06,300
And in many cases, they they're

274
01:11:06,300 --> 01:11:07,983
unnecessary where where

275
01:11:07,983 --> 01:11:09,783
legal and PR would be the people

276
01:11:09,783 --> 01:11:10,966
would be like, hey, what is this?

277
01:11:10,966 --> 01:11:11,983
How is this going to affect the company

278
01:11:11,983 --> 01:11:13,316
as a whole instead of?

279
01:11:14,600 --> 01:11:16,183
Those things is that is that

280
01:11:16,183 --> 01:11:17,816
how you're you're seeing it.

281
01:11:26,166 --> 01:11:28,600
I think that that can be the.

282
01:11:33,149 --> 01:11:36,100
I think that that can definitely be the

283
01:11:36,100 --> 01:11:38,316
way the board sees us.

284
01:11:40,050 --> 01:11:40,283
Right.

285
01:11:40,616 --> 01:11:42,816
We're the we're the Department of No.

286
01:11:43,633 --> 01:11:43,883
Right.

287
01:11:44,633 --> 01:11:44,833
Exactly.

288
01:11:45,183 --> 01:11:45,483
We're exactly.

289
01:11:45,833 --> 01:11:48,116
We're the reason we can't do things.

290
01:11:49,033 --> 01:11:49,233
Right.

291
01:11:49,483 --> 01:11:53,800
And I think we get a bad rap.

292
01:11:54,966 --> 01:11:58,583
Because honestly, I a lot of the security

293
01:11:58,583 --> 01:12:01,100
people I know want to help

294
01:12:01,100 --> 01:12:02,866
people figure out how to do

295
01:12:02,866 --> 01:12:03,766
things securely.

296
01:12:04,899 --> 01:12:05,183
Right.

297
01:12:06,516 --> 01:12:08,733
And what we've got to do.

298
01:12:08,833 --> 01:12:14,033
There's a tension between the product

299
01:12:14,033 --> 01:12:15,083
people that want to make

300
01:12:15,083 --> 01:12:16,433
the floating toilet seat

301
01:12:17,233 --> 01:12:19,399
and the security people that want to

302
01:12:19,399 --> 01:12:20,716
attach it to the right plumbing.

303
01:12:21,483 --> 01:12:21,766
Right.

304
01:12:22,133 --> 01:12:22,333
Right.

305
01:12:22,750 --> 01:12:22,916
Right.

306
01:12:24,183 --> 01:12:27,183
And we have to I think we

307
01:12:27,183 --> 01:12:29,100
have to figure out a way to

308
01:12:31,966 --> 01:12:34,699
move through that tension and be a team

309
01:12:34,699 --> 01:12:36,333
that that functions as a whole.

310
01:12:37,316 --> 01:12:38,833
It's not us and them.

311
01:12:38,833 --> 01:12:41,033
It's ultimately I think what the board

312
01:12:41,033 --> 01:12:43,916
wants to see is a cohesive

313
01:12:43,916 --> 01:12:46,983
team that's working to build

314
01:12:47,883 --> 01:12:49,933
the business and make the business more

315
01:12:49,933 --> 01:12:51,699
profitable because you

316
01:12:51,699 --> 01:12:53,116
need both sides of that point.

317
01:12:54,199 --> 01:12:55,966
But I think sometimes what

318
01:12:55,966 --> 01:13:00,116
the board sees is a brokenness.

319
01:13:01,483 --> 01:13:02,199
Like a line.

320
01:13:02,483 --> 01:13:02,683
Or a friction.

321
01:13:03,516 --> 01:13:03,616
Yeah.

322
01:13:04,600 --> 01:13:06,566
And I think you felt that friction.

323
01:13:07,600 --> 01:13:07,800
Yeah.

324
01:13:08,016 --> 01:13:08,899
I feel it all the time

325
01:13:08,899 --> 01:13:09,883
and I'm not even on a board.

326
01:13:10,333 --> 01:13:13,616
It's like just trying to get people in a

327
01:13:13,616 --> 01:13:14,600
product team to

328
01:13:14,600 --> 01:13:15,716
understand, hey, you're not.

329
01:13:17,166 --> 01:13:18,716
It's not that you can't do that.

330
01:13:18,716 --> 01:13:19,533
It's that you're going.

331
01:13:20,850 --> 01:13:23,333
I understand the evil that bad people are

332
01:13:23,333 --> 01:13:24,133
going to do with something

333
01:13:24,133 --> 01:13:25,183
that might actually be a good

334
01:13:25,183 --> 01:13:25,500
thing.

335
01:13:25,916 --> 01:13:30,283
But yeah, it's hard, especially with

336
01:13:30,283 --> 01:13:32,666
ideal and IoT security.

337
01:13:32,699 --> 01:13:36,333
So privacy, security, the floating toilet

338
01:13:36,333 --> 01:13:38,116
seats exist everywhere and

339
01:13:38,116 --> 01:13:39,000
everybody thinks they're a

340
01:13:39,000 --> 01:13:39,566
great idea.

341
01:13:40,016 --> 01:13:45,983
And it just ends up being a trading game.

342
01:13:45,983 --> 01:13:48,300
It's like, OK, yeah, OK, you can put that

343
01:13:48,300 --> 01:13:51,466
out, but you're going to run into issues.

344
01:13:51,983 --> 01:13:54,983
Or at times I've ended up having to

345
01:13:54,983 --> 01:13:56,616
leverage legal or PR and

346
01:13:56,616 --> 01:13:59,616
say, hey, there's a similar

347
01:13:59,733 --> 01:14:00,966
product out there or there's

348
01:14:00,966 --> 01:14:04,000
a real risk of this happening.

349
01:14:04,000 --> 01:14:06,916
And sometimes we resort to FUD and

350
01:14:06,916 --> 01:14:08,766
sometimes we resort to things

351
01:14:08,766 --> 01:14:10,466
that don't make any sense or

352
01:14:11,483 --> 01:14:12,433
yeah, asteroids are

353
01:14:12,433 --> 01:14:13,266
going to hit the earth.

354
01:14:13,266 --> 01:14:14,283
We need to worry about that.

355
01:14:14,500 --> 01:14:17,899
And I can understand we've shot ourselves

356
01:14:17,899 --> 01:14:19,616
in the foot with that for years.

357
01:14:19,616 --> 01:14:21,066
It took us 20 years to get people to

358
01:14:21,066 --> 01:14:23,433
adopt really complicated passwords.

359
01:14:23,433 --> 01:14:24,500
And then it's like, oh, no,

360
01:14:24,500 --> 01:14:27,066
no, now you need to do 2FA.

361
01:14:27,100 --> 01:14:29,583
And it's like, we just got passwords.

362
01:14:30,466 --> 01:14:32,183
So now we need to go to--

363
01:14:32,416 --> 01:14:32,616
yeah.

364
01:14:34,433 --> 01:14:36,266
Anyway, so yeah.

365
01:14:37,000 --> 01:14:44,433
It's interesting because you

366
01:14:44,433 --> 01:14:46,966
can play the spin game with 2FA.

367
01:14:48,666 --> 01:14:50,533
And you can make it--

368
01:14:51,666 --> 01:14:53,399
in the past, I've been able

369
01:14:53,399 --> 01:14:58,066
to make 2FA a business enabler.

370
01:14:58,533 --> 01:14:59,399
Yeah.

371
01:15:00,066 --> 01:15:02,399
Because you're putting it in place and

372
01:15:02,399 --> 01:15:03,566
you can reduce the

373
01:15:03,566 --> 01:15:05,216
times you use the passwords.

374
01:15:06,066 --> 01:15:06,266
Right?

375
01:15:06,816 --> 01:15:07,016
Right.

376
01:15:09,316 --> 01:15:10,316
So I think it's--

377
01:15:11,366 --> 01:15:13,933
I'm not a marketing person and I don't

378
01:15:13,933 --> 01:15:15,383
want to play one on TV.

379
01:15:15,733 --> 01:15:16,633
Please don't make me.

380
01:15:17,316 --> 01:15:19,966
But I think it's about how you approach

381
01:15:19,966 --> 01:15:22,916
the business when you're saying,

382
01:15:23,600 --> 01:15:26,583
hey, look, we need to change because this

383
01:15:26,583 --> 01:15:27,716
is going to make it better.

384
01:15:33,633 --> 01:15:36,183
If you give them real reasons and show

385
01:15:36,183 --> 01:15:37,483
them it'll make it better,

386
01:15:40,616 --> 01:15:42,016
you can really get a

387
01:15:42,016 --> 01:15:43,133
business win out of it.

388
01:15:44,116 --> 01:15:47,533
I've actually had customers

389
01:15:47,533 --> 01:15:49,333
send my team thank you notes.

390
01:15:50,850 --> 01:15:53,000
And I'm talking executive customers send

391
01:15:53,000 --> 01:15:53,916
my team thank you

392
01:15:53,916 --> 01:15:55,716
notes for deploying 2FA.

393
01:15:56,816 --> 01:15:57,016
Nice.

394
01:15:58,100 --> 01:15:58,283
Yeah.

395
01:15:58,433 --> 01:16:00,333
Because we made it simple.

396
01:16:00,883 --> 01:16:02,316
We held hands.

397
01:16:03,666 --> 01:16:06,416
And we enabled some things we wouldn't

398
01:16:06,416 --> 01:16:07,283
have otherwise been

399
01:16:07,283 --> 01:16:09,166
able to help them with.

400
01:16:09,983 --> 01:16:10,500
That's great.

401
01:16:11,083 --> 01:16:13,633
It depends on how you

402
01:16:13,633 --> 01:16:14,783
approach things, right?

403
01:16:15,466 --> 01:16:15,666
Right.

404
01:16:16,316 --> 01:16:16,516
Yeah.

405
01:16:17,166 --> 01:16:18,166
But that doesn't help with

406
01:16:18,166 --> 01:16:19,199
the floating toilet seat.

407
01:16:21,566 --> 01:16:23,483
I have to use that because if I actually

408
01:16:23,483 --> 01:16:24,416
mentioned something,

409
01:16:25,199 --> 01:16:28,500
yeah, I don't want it to be--

410
01:16:28,600 --> 01:16:30,983
I tried to think about the most useless

411
01:16:30,983 --> 01:16:34,033
thing ever for an IoT connected device.

412
01:16:34,033 --> 01:16:35,566
And a floating toilet seat seems like the

413
01:16:35,566 --> 01:16:36,783
most obvious choice there.

414
01:16:37,416 --> 01:16:38,766
It's a good one.

415
01:16:39,366 --> 01:16:39,600
Yeah.

416
01:16:40,116 --> 01:16:43,666
I completely agree.

417
01:16:43,933 --> 01:16:46,416
And you mentioned, I think before we

418
01:16:46,416 --> 01:16:47,583
talked, you've worked with

419
01:16:47,583 --> 01:16:50,199
medical organizations and

420
01:16:50,199 --> 01:16:50,816
what have you.

421
01:16:51,033 --> 01:16:53,466
And I used to do audits for those things.

422
01:16:53,466 --> 01:16:55,016
And one of the biggest things that we saw

423
01:16:55,016 --> 01:16:57,533
as problems was password enforcement.

424
01:16:57,566 --> 01:16:59,316
Because doctors didn't want to have to

425
01:16:59,316 --> 01:17:02,316
enter their multi-character password

426
01:17:02,316 --> 01:17:03,600
multiple times a day.

427
01:17:04,316 --> 01:17:06,166
And to your point, things like MFA or

428
01:17:06,166 --> 01:17:08,666
badges or something, some kind of system,

429
01:17:08,683 --> 01:17:13,600
tap and go increases security and it

430
01:17:13,600 --> 01:17:15,816
decreases the amount of mistakes.

431
01:17:16,533 --> 01:17:18,933
There are specific things we can do in

432
01:17:18,933 --> 01:17:21,733
security that will help.

433
01:17:22,800 --> 01:17:26,133
And things like badging or that if we can

434
01:17:26,133 --> 01:17:27,300
make MFA more seamless

435
01:17:27,300 --> 01:17:28,483
where we're not having a 15

436
01:17:28,483 --> 01:17:29,866
character password that we have to

437
01:17:29,866 --> 01:17:31,933
enforce and everything, those are great.

438
01:17:32,383 --> 01:17:35,699
And it's great that you could implement

439
01:17:35,699 --> 01:17:36,816
that at your organization.

440
01:17:37,083 --> 01:17:40,033
I don't think we have enough wins like

441
01:17:40,033 --> 01:17:40,600
that in an

442
01:17:40,600 --> 01:17:42,033
organization from time to time.

443
01:17:42,383 --> 01:17:43,816
And it's unfortunate.

444
01:17:44,300 --> 01:17:44,500
So.

445
01:17:45,800 --> 01:17:46,016
Yeah.

446
01:17:47,916 --> 01:17:49,066
And I think part of it

447
01:17:49,066 --> 01:17:50,399
is how we approach things.

448
01:17:51,100 --> 01:17:54,316
If the first word out of our mouth is no.

449
01:17:55,233 --> 01:17:55,566
Right.

450
01:17:56,533 --> 01:17:58,066
Instead of help me understand why.

451
01:17:58,833 --> 01:17:59,133
Right.

452
01:17:59,983 --> 01:18:01,133
And how do we get to...

453
01:18:02,033 --> 01:18:03,833
It's not even

454
01:18:03,833 --> 01:18:06,100
necessarily how we get to yes, but

455
01:18:08,183 --> 01:18:09,699
what's the right thing to do for the

456
01:18:09,699 --> 01:18:11,183
company and how do we get there?

457
01:18:12,033 --> 01:18:12,233
Right.

458
01:18:12,666 --> 01:18:12,866
Yeah.

459
01:18:13,233 --> 01:18:14,716
Yeah, I know that that makes sense.

460
01:18:14,716 --> 01:18:15,216
That makes sense.

461
01:18:16,766 --> 01:18:19,516
So I'm going to start off with the bullet

462
01:18:19,516 --> 01:18:20,516
point that we have in

463
01:18:20,516 --> 01:18:21,633
the in the Google Doc that

464
01:18:21,633 --> 01:18:22,800
kind of leads us to

465
01:18:22,800 --> 01:18:23,666
where we're at right now.

466
01:18:24,116 --> 01:18:25,699
Security people are not going to be on

467
01:18:25,699 --> 01:18:26,583
the board currently.

468
01:18:27,083 --> 01:18:29,383
At some point, the SEC will hopefully

469
01:18:29,383 --> 01:18:30,783
allow that to happen or

470
01:18:30,783 --> 01:18:31,883
find some way to make that

471
01:18:32,283 --> 01:18:32,399
legitimate.

472
01:18:33,083 --> 01:18:34,683
But I saw our Harvard

473
01:18:34,683 --> 01:18:37,000
Business Review article from 2023.

474
01:18:37,266 --> 01:18:38,416
I love Harvard Business Review.

475
01:18:38,916 --> 01:18:40,016
I don't know why they just

476
01:18:40,016 --> 01:18:41,116
have really great articles.

477
01:18:43,316 --> 01:18:44,500
It says boards are having the wrong

478
01:18:44,500 --> 01:18:45,899
conversations about cybersecurity.

479
01:18:46,116 --> 01:18:47,199
And one of the things that I read in

480
01:18:47,199 --> 01:18:48,566
there was they said 69%

481
01:18:49,016 --> 01:18:50,533
of board members responding

482
01:18:50,600 --> 01:18:51,266
board members.

483
01:18:51,266 --> 01:18:52,183
So they sent out a survey.

484
01:18:52,216 --> 01:18:52,416
Okay.

485
01:18:54,133 --> 01:18:56,383
Members, board members see 69% of

486
01:18:56,383 --> 01:18:57,483
responding board members see

487
01:18:57,483 --> 01:18:58,583
eye to eye with their chief

488
01:18:58,600 --> 01:18:59,833
information security officers.

489
01:19:00,066 --> 01:19:02,000
So just 69%, which I'm

490
01:19:02,000 --> 01:19:03,616
thinking that's pretty good.

491
01:19:03,616 --> 01:19:05,199
You know, three quarters, three quarters

492
01:19:05,199 --> 01:19:06,483
see eye to eye with their CISOs.

493
01:19:07,133 --> 01:19:09,283
Fewer than half of members serve on

494
01:19:09,283 --> 01:19:10,083
boards that interact

495
01:19:10,083 --> 01:19:11,583
with their CISOs regularly.

496
01:19:11,583 --> 01:19:12,000
47%

497
01:19:13,316 --> 01:19:15,116
in, you know, serve on boards that

498
01:19:15,116 --> 01:19:17,016
interact with CISOs regularly.

499
01:19:17,416 --> 01:19:21,100
And a third of those 47% only see their

500
01:19:21,100 --> 01:19:22,583
CISOs in board presentations.

501
01:19:24,883 --> 01:19:28,133
It is that indicative of what you've seen

502
01:19:28,133 --> 01:19:31,983
in your career is like, you

503
01:19:31,983 --> 01:19:33,216
know, we only see the CISO

504
01:19:33,216 --> 01:19:35,266
when either something bad has happened.

505
01:19:35,266 --> 01:19:37,316
Again, back to security, we only see the

506
01:19:37,316 --> 01:19:38,699
CISO when something bad happens.

507
01:19:39,716 --> 01:19:42,399
Or, you know, is it, you know, formal

508
01:19:42,399 --> 01:19:43,333
presentations about

509
01:19:43,333 --> 01:19:44,883
initiatives or goals for the next year?

510
01:19:45,133 --> 01:19:45,783
I mean, what is it?

511
01:19:45,816 --> 01:19:47,916
Is that indicative of what you're saying?

512
01:19:49,416 --> 01:19:53,133
Yeah, typically, it's generally the

513
01:19:53,133 --> 01:19:54,283
boards meet quarterly.

514
01:19:56,383 --> 01:19:59,399
You from a CISO perspective, what I've

515
01:19:59,399 --> 01:20:01,300
seen is we generally

516
01:20:01,300 --> 01:20:02,816
present twice a year.

517
01:20:04,216 --> 01:20:05,616
It's a formal presentation.

518
01:20:07,600 --> 01:20:09,966
10 minutes to a half hour on the agenda.

519
01:20:11,183 --> 01:20:13,483
And, you know, it's, it's very scripted.

520
01:20:15,983 --> 01:20:20,366
The, probably I've, I've worked with four

521
01:20:20,366 --> 01:20:22,716
boards over the past 15 years.

522
01:20:23,399 --> 01:20:28,716
And the most productive board meetings

523
01:20:28,716 --> 01:20:30,633
I've had are those where

524
01:20:30,633 --> 01:20:32,966
I've established relationships

525
01:20:33,083 --> 01:20:34,383
with the board members

526
01:20:34,383 --> 01:20:37,466
outside of the board room.

527
01:20:37,883 --> 01:20:40,183
I.e., you know, meeting with them,

528
01:20:40,399 --> 01:20:41,233
meeting with a couple

529
01:20:41,233 --> 01:20:42,666
interested ones monthly

530
01:20:43,633 --> 01:20:46,733
so that we can go over some metrics, what

531
01:20:46,733 --> 01:20:47,699
interests the board,

532
01:20:48,699 --> 01:20:50,733
what are the topics they're discussing,

533
01:20:52,233 --> 01:20:53,666
you know, and what's hitting the media.

534
01:20:54,166 --> 01:20:54,833
And how are we

535
01:20:54,833 --> 01:20:56,066
addressing it as a company?

536
01:20:56,883 --> 01:20:58,600
So I've, I've been able to

537
01:20:58,600 --> 01:21:01,066
establish that with two boards.

538
01:21:02,833 --> 01:21:03,833
Really positive.

539
01:21:04,583 --> 01:21:07,100
And they were boards that I was able to

540
01:21:07,100 --> 01:21:09,933
either whiteboard with, you know,

541
01:21:10,066 --> 01:21:13,766
or have involved in tabletop exercises.

542
01:21:14,600 --> 01:21:16,516
Having board members actually involved

543
01:21:16,516 --> 01:21:20,399
with some of the response preparation,

544
01:21:21,850 --> 01:21:22,616
I think is really

545
01:21:22,616 --> 01:21:24,183
important and really eye opening.

546
01:21:24,733 --> 01:21:27,733
So they get to see what you deal with

547
01:21:27,733 --> 01:21:30,183
when you think there's an

548
01:21:30,183 --> 01:21:32,333
issue and how you deal with it.

549
01:21:32,766 --> 01:21:42,566
So I think the more interested you can

550
01:21:42,566 --> 01:21:44,166
get the board members, the better.

551
01:21:44,516 --> 01:21:47,883
But I think those numbers are accurate.

552
01:21:48,733 --> 01:21:49,583
They're very

553
01:21:49,583 --> 01:21:51,100
indicative of what I've seen.

554
01:21:52,233 --> 01:21:52,433
Right.

555
01:21:54,183 --> 01:21:54,383
Huh.

556
01:21:55,183 --> 01:21:55,866
So, okay.

557
01:21:56,816 --> 01:22:00,483
So I'm, I'm, I'm, you have

558
01:22:00,483 --> 01:22:01,133
Goldie Knox and I'm, I'm,

559
01:22:01,316 --> 01:22:03,666
I'm, I'm going to assume,

560
01:22:03,666 --> 01:22:04,766
please tell me if I'm wrong here.

561
01:22:04,766 --> 01:22:06,600
This is a, like a virtual CSO thing.

562
01:22:06,600 --> 01:22:09,633
So this is for companies that maybe don't

563
01:22:09,633 --> 01:22:12,866
have a functional on full-time CSO.

564
01:22:13,166 --> 01:22:13,833
They're either startup

565
01:22:13,833 --> 01:22:14,699
or something like that.

566
01:22:14,699 --> 01:22:15,933
Is that sort of understanding?

567
01:22:17,333 --> 01:22:19,583
We do do some virtual CSO work.

568
01:22:19,833 --> 01:22:22,133
We also, you know, one of, one of my

569
01:22:22,133 --> 01:22:23,933
goals is to help a transitional CSO.

570
01:22:25,816 --> 01:22:28,100
So somebody that's new to the role or

571
01:22:28,100 --> 01:22:31,699
somebody who is moving

572
01:22:31,699 --> 01:22:33,566
from one industry to another,

573
01:22:33,899 --> 01:22:36,566
help them establish more patterns.

574
01:22:36,816 --> 01:22:39,433
But we also do offer the virtual or the

575
01:22:39,433 --> 01:22:41,000
fractional CSO services.

576
01:22:41,500 --> 01:22:41,699
Okay.

577
01:22:42,350 --> 01:22:42,683
Cool.

578
01:22:42,683 --> 01:22:43,816
So you're like a CSO

579
01:22:43,816 --> 01:22:45,483
mentor or something like that.

580
01:22:45,483 --> 01:22:46,699
You mentor CSOs.

581
01:22:47,800 --> 01:22:48,333
I hope so.

582
01:22:50,883 --> 01:22:52,816
Well, so I was just wondering from a,

583
01:22:52,816 --> 01:22:54,416
from a virtual CSO point of view,

584
01:22:55,000 --> 01:22:57,666
that relationship must be even more

585
01:22:57,666 --> 01:22:59,783
complicated and difficult because

586
01:23:00,033 --> 01:23:01,366
you're not really part of the company.

587
01:23:02,133 --> 01:23:02,766
You know, it's, it's very

588
01:23:02,766 --> 01:23:05,266
similar to, and I apologize.

589
01:23:05,483 --> 01:23:07,533
I only have my own experiences to go on.

590
01:23:07,533 --> 01:23:09,616
It's like somebody in the company tells

591
01:23:09,616 --> 01:23:11,699
you something's wrong with a system.

592
01:23:12,199 --> 01:23:13,516
You know, management's

593
01:23:13,516 --> 01:23:14,300
not listening to you,

594
01:23:14,300 --> 01:23:15,633
but then you bring in a third party pen

595
01:23:15,633 --> 01:23:17,600
testing or security assessment firm who

596
01:23:17,600 --> 01:23:19,100
comes in, finds the same thing.

597
01:23:19,699 --> 01:23:21,566
They give a $50,000 report

598
01:23:21,566 --> 01:23:23,300
and now management cares.

599
01:23:23,883 --> 01:23:25,466
And you're like, hello, I

600
01:23:25,466 --> 01:23:26,516
was, I was here the whole time.

601
01:23:27,116 --> 01:23:30,683
So what is a, you know, for the, for the

602
01:23:30,683 --> 01:23:31,433
folks out there like,

603
01:23:31,433 --> 01:23:33,433
Hey, I think I could be a virtual CSO or,

604
01:23:33,716 --> 01:23:34,333
you know, I'm, I'm

605
01:23:34,333 --> 01:23:35,916
thinking about becoming a CSO.

606
01:23:36,916 --> 01:23:37,566
What is it?

607
01:23:38,083 --> 01:23:40,100
I mean, what are some of the first things

608
01:23:40,100 --> 01:23:42,283
that they can do when they're, you know,

609
01:23:42,283 --> 01:23:44,133
trying to get in good with the board?

610
01:23:44,133 --> 01:23:45,566
Is it, is it definitely meet the board

611
01:23:45,566 --> 01:23:47,016
members over coffee somewhere else?

612
01:23:47,016 --> 01:23:50,133
It's outside the, the work or what, what,

613
01:23:50,133 --> 01:23:51,533
what kind of things can they do to when

614
01:23:51,566 --> 01:23:53,383
they hit the ground running, you know,

615
01:23:54,683 --> 01:23:56,616
not, you know, you know, mess up.

616
01:23:57,966 --> 01:23:59,383
Yeah. I, I think it's fine

617
01:23:59,383 --> 01:24:00,616
to champion on the board.

618
01:24:02,016 --> 01:24:04,833
Um, you know, and I, I found them a

619
01:24:04,833 --> 01:24:05,966
couple of different ways.

620
01:24:06,233 --> 01:24:09,916
Number one through a CFO that I had a

621
01:24:09,916 --> 01:24:11,000
really good relationship

622
01:24:11,000 --> 01:24:13,616
with gave me some introductions

623
01:24:13,716 --> 01:24:16,916
before the first board meeting so that we

624
01:24:16,916 --> 01:24:18,000
could, we could talk

625
01:24:18,000 --> 01:24:19,066
through and sit down and

626
01:24:20,033 --> 01:24:21,283
walk through some meetings.

627
01:24:21,533 --> 01:24:25,716
I don't, I don't know that you want to go

628
01:24:25,716 --> 01:24:28,000
as informal as a coffee shop,

629
01:24:29,266 --> 01:24:32,133
but a zoom meeting, um, you

630
01:24:32,133 --> 01:24:33,399
know, because it's not really,

631
01:24:34,466 --> 01:24:37,083
it still has to be a formal relationship

632
01:24:37,083 --> 01:24:40,733
because of the, um, oversight.

633
01:24:41,333 --> 01:24:43,716
And there's still some stuff that you,

634
01:24:44,683 --> 01:24:47,183
you have to take to the

635
01:24:47,183 --> 01:24:48,583
general session of the board,

636
01:24:48,683 --> 01:24:50,666
rather than just with a couple of people.

637
01:24:51,000 --> 01:24:53,033
But you can ask those couple

638
01:24:53,033 --> 01:24:55,083
of people how to approach it.

639
01:24:55,783 --> 01:24:58,100
Right. What's the best way to walk

640
01:24:58,100 --> 01:25:01,383
through it and, you know, have a mentor

641
01:25:01,383 --> 01:25:02,633
on the board or somebody

642
01:25:02,683 --> 01:25:06,316
who can help you understand what that

643
01:25:06,316 --> 01:25:07,533
particular board is

644
01:25:07,533 --> 01:25:10,533
concerned about. But generally I've,

645
01:25:10,633 --> 01:25:12,633
I've found those mentors through

646
01:25:12,633 --> 01:25:17,216
management. So either working with the

647
01:25:17,216 --> 01:25:18,416
general council or the

648
01:25:18,516 --> 01:25:23,699
CFO, or in some cases the CIO and the

649
01:25:23,699 --> 01:25:26,716
CEO, it's dependent.

650
01:25:28,633 --> 01:25:28,833
Right.

651
01:25:28,899 --> 01:25:31,000
But yeah, I would say when you hit the

652
01:25:31,000 --> 01:25:32,083
ground and you know,

653
01:25:34,683 --> 01:25:36,716
you know, you're going to be in charge of

654
01:25:36,716 --> 01:25:39,083
security, you need to

655
01:25:39,083 --> 01:25:41,033
establish those relationships,

656
01:25:41,316 --> 01:25:44,716
both from a board perspective and a

657
01:25:44,716 --> 01:25:46,000
leadership and executive

658
01:25:46,000 --> 01:25:47,116
leadership perspective,

659
01:25:47,883 --> 01:25:50,399
because you need to work with everybody

660
01:25:50,399 --> 01:25:51,783
on the leadership team.

661
01:25:54,466 --> 01:25:57,216
I think we all, all security

662
01:25:57,216 --> 01:25:58,616
professionals at some point

663
01:25:58,616 --> 01:26:00,283
say security is a team sport.

664
01:26:00,916 --> 01:26:01,216
Right.

665
01:26:02,433 --> 01:26:04,933
And it really is. You have to engage the

666
01:26:04,933 --> 01:26:06,483
entire company to

667
01:26:06,483 --> 01:26:08,033
help make you successful.

668
01:26:09,066 --> 01:26:09,216
Right.

669
01:26:09,233 --> 01:26:15,716
Right. So so you have to find your your

670
01:26:15,716 --> 01:26:17,833
cheerleaders, your your, you know,

671
01:26:17,833 --> 01:26:19,616
you have to figure out, you know, where

672
01:26:19,616 --> 01:26:21,183
everybody is on the spectrum. So you've

673
01:26:21,183 --> 01:26:22,683
got your attractors,

674
01:26:22,683 --> 01:26:24,966
your your cheerleaders, your your math,

675
01:26:25,333 --> 01:26:26,516
your your people are kind

676
01:26:26,516 --> 01:26:27,633
of middle of the road kind of

677
01:26:27,633 --> 01:26:32,433
thing. It seems like being a see so it's

678
01:26:32,433 --> 01:26:33,199
one of those things that

679
01:26:33,199 --> 01:26:34,183
what got you there won't get

680
01:26:34,199 --> 01:26:37,916
you here kind of things or I know I'm

681
01:26:37,916 --> 01:26:38,766
messing that up, but it's

682
01:26:38,766 --> 01:26:40,383
like at some point you're going

683
01:26:40,383 --> 01:26:42,216
to have to change the way you operate

684
01:26:42,216 --> 01:26:43,783
being a see so or being

685
01:26:43,783 --> 01:26:45,566
even a director of security if

686
01:26:45,566 --> 01:26:47,633
they don't have a see so is on a

687
01:26:47,633 --> 01:26:48,699
completely different level

688
01:26:48,699 --> 01:26:50,416
than than a lot of things that

689
01:26:50,416 --> 01:26:53,583
you've been doing. You've you've made

690
01:26:53,583 --> 01:26:55,683
that transition at some

691
01:26:55,683 --> 01:26:57,300
point in your career. So

692
01:26:58,116 --> 01:27:01,466
what did you find the most difficult when

693
01:27:01,466 --> 01:27:03,283
you made that transition

694
01:27:03,283 --> 01:27:04,933
like you you made the conscious

695
01:27:04,933 --> 01:27:06,983
ever, hey, I'm going to be a see so and

696
01:27:06,983 --> 01:27:08,766
one, I'd love to understand,

697
01:27:08,766 --> 01:27:10,500
you know, what motivated you

698
01:27:10,500 --> 01:27:14,100
to go that route. And, you know, what did

699
01:27:14,100 --> 01:27:15,566
you find difficult there?

700
01:27:15,816 --> 01:27:17,366
Or what did you find easy,

701
01:27:17,399 --> 01:27:20,566
you know, and I understand, depending on

702
01:27:20,566 --> 01:27:21,433
the personality, it's

703
01:27:21,433 --> 01:27:22,433
different. But, you know,

704
01:27:22,699 --> 01:27:24,399
I'd love to hear your insights on that.

705
01:27:26,116 --> 01:27:32,033
Um, so what motivated me I, I found

706
01:27:32,033 --> 01:27:34,800
myself in management, from

707
01:27:34,800 --> 01:27:37,666
a security perspective, it's

708
01:27:37,666 --> 01:27:44,433
I had some really amazing people who

709
01:27:44,433 --> 01:27:45,616
served as my mentors

710
01:27:45,616 --> 01:27:48,283
throughout my career and sponsors.

711
01:27:48,533 --> 01:27:56,033
And they helped me build myself into a

712
01:27:56,033 --> 01:28:00,066
director of security or position. And

713
01:28:01,883 --> 01:28:04,600
I realized that the next step for me was

714
01:28:04,600 --> 01:28:05,666
going to be see so if I

715
01:28:05,666 --> 01:28:06,966
wanted to continue to grow.

716
01:28:08,466 --> 01:28:13,083
So my biggest challenge and

717
01:28:13,083 --> 01:28:15,216
it's still a challenge. I'm

718
01:28:15,233 --> 01:28:20,100
I am not comfortable in front of big

719
01:28:20,100 --> 01:28:23,683
audiences. I am I am not a natural

720
01:28:23,683 --> 01:28:26,199
speaker, public speaker.

721
01:28:26,899 --> 01:28:30,116
I like conversations. I like, you know,

722
01:28:30,800 --> 01:28:33,699
building a team. But I've

723
01:28:33,699 --> 01:28:36,433
had to really work on presence

724
01:28:37,016 --> 01:28:42,633
and building the ability to sit in front

725
01:28:42,633 --> 01:28:44,199
of a board and not have my

726
01:28:44,199 --> 01:28:45,566
heart beat out of my chest.

727
01:28:47,466 --> 01:28:50,633
And just finding ways to get through

728
01:28:50,633 --> 01:28:53,866
that. And probably the other big

729
01:28:53,866 --> 01:28:55,716
challenge I had was taking

730
01:28:57,000 --> 01:29:02,333
geek speak and learning how to take that

731
01:29:02,333 --> 01:29:04,800
to a boardroom and make it

732
01:29:04,800 --> 01:29:06,583
relevant to the board and

733
01:29:06,600 --> 01:29:11,233
to leadership. The first time I presented

734
01:29:11,233 --> 01:29:15,383
to the board, I walked in

735
01:29:15,383 --> 01:29:17,733
with a presentation and it

736
01:29:17,733 --> 01:29:22,883
talked about this date, or 853 and the 17

737
01:29:22,883 --> 01:29:25,083
control families and the 250

738
01:29:25,083 --> 01:29:27,433
controls and I'm boring you

739
01:29:27,566 --> 01:29:31,733
talking about this. No, I can't tell you

740
01:29:31,733 --> 01:29:33,866
what the faces on the board look like.

741
01:29:34,433 --> 01:29:41,366
It was it was a hard lesson to learn, but

742
01:29:41,366 --> 01:29:43,000
I think I put most of the

743
01:29:43,000 --> 01:29:44,466
people in that room to sleep.

744
01:29:45,199 --> 01:29:51,416
Well, so I guess I guess the question is,

745
01:29:52,066 --> 01:29:53,800
did they did they ask

746
01:29:53,800 --> 01:29:54,816
for that? Is that what they

747
01:29:54,816 --> 01:29:58,733
wanted or is that what I'm trying not to

748
01:29:58,733 --> 01:29:59,866
sound is that what you think they wanted?

749
01:30:00,033 --> 01:30:03,266
It's what I thought they wanted. It's

750
01:30:03,266 --> 01:30:04,033
reading the room,

751
01:30:04,033 --> 01:30:05,033
right? It's reading the room.

752
01:30:05,333 --> 01:30:07,133
Yeah, it was what I

753
01:30:07,133 --> 01:30:09,600
thought they wanted based on

754
01:30:11,600 --> 01:30:14,616
conversations with my management chain

755
01:30:14,616 --> 01:30:19,366
and some of the people

756
01:30:19,366 --> 01:30:20,583
who were advising me.

757
01:30:21,116 --> 01:30:23,883
I don't think any of us really knew what

758
01:30:23,883 --> 01:30:25,433
the board wanted in terms of

759
01:30:25,433 --> 01:30:27,566
cybersecurity, right? This is

760
01:30:30,483 --> 01:30:39,633
the 2012-2013 time frame. We were trying

761
01:30:39,633 --> 01:30:41,616
to figure it out and I

762
01:30:41,616 --> 01:30:43,733
wanted to talk to the board about

763
01:30:44,283 --> 01:30:47,083
what our framework would look like and

764
01:30:47,083 --> 01:30:48,083
what we were trying to

765
01:30:48,083 --> 01:30:54,500
achieve. That was way too detailed.

766
01:30:55,383 --> 01:30:59,983
Okay. They want to know that we

767
01:30:59,983 --> 01:31:01,416
understand what our

768
01:31:01,416 --> 01:31:04,566
risks are, that we understand

769
01:31:05,633 --> 01:31:08,183
where we need security to speak to our

770
01:31:08,183 --> 01:31:11,916
customers and enable business.

771
01:31:13,366 --> 01:31:18,266
They want to understand if there's any

772
01:31:18,266 --> 01:31:22,483
risks that they need to help with. I

773
01:31:22,483 --> 01:31:23,533
think ultimately the

774
01:31:23,583 --> 01:31:25,683
board really wants to help the security

775
01:31:25,683 --> 01:31:28,233
program. They just don't know

776
01:31:28,233 --> 01:31:31,583
how. Right. That makes sense.

777
01:31:33,733 --> 01:31:39,583
At that point in time, it was rolling the

778
01:31:39,583 --> 01:31:40,800
dice and seeing what we

779
01:31:40,800 --> 01:31:42,216
ended up with and adjusting

780
01:31:42,216 --> 01:31:45,483
from there. We adjusted. We made it

781
01:31:45,483 --> 01:31:47,683
better. We were invited

782
01:31:47,683 --> 01:31:49,133
back to the next board meeting,

783
01:31:49,266 --> 01:31:51,766
so it wasn't a total loss. That's cool.

784
01:31:52,133 --> 01:32:00,366
Yeah. Yeah. Yeah. I think I'm an

785
01:32:00,366 --> 01:32:02,066
extroverted introvert,

786
01:32:02,066 --> 01:32:04,566
so I have my moments. I have my splashes

787
01:32:04,566 --> 01:32:06,983
of energy. My biggest

788
01:32:06,983 --> 01:32:08,266
issue, and I probably

789
01:32:08,283 --> 01:32:09,966
resonates with quite a few folks here,

790
01:32:09,966 --> 01:32:15,166
it's like you can say one thing and

791
01:32:15,166 --> 01:32:16,083
depending on the audience,

792
01:32:16,216 --> 01:32:18,633
it has to be translated five different

793
01:32:18,633 --> 01:32:19,833
ways. What I might say to a

794
01:32:19,833 --> 01:32:21,600
product team won't be what I

795
01:32:21,600 --> 01:32:25,433
tell the CISO and what I tell the CISO is

796
01:32:25,433 --> 01:32:26,366
not what the CISO is

797
01:32:26,366 --> 01:32:27,833
going to tell the board or

798
01:32:28,683 --> 01:32:30,883
that kind of thing. It almost feels like

799
01:32:30,883 --> 01:32:31,966
a weird game of telephone

800
01:32:31,966 --> 01:32:33,816
where it's like I have to speak

801
01:32:33,816 --> 01:32:35,300
English over here. I have to speak

802
01:32:35,300 --> 01:32:37,133
Spanish here. She's going to go speak

803
01:32:37,133 --> 01:32:38,283
German to these folks up

804
01:32:38,283 --> 01:32:40,166
here and it's like, okay, well, it's all

805
01:32:40,166 --> 01:32:41,600
kind of similar. They got the romance

806
01:32:41,600 --> 01:32:42,383
language thing going

807
01:32:42,433 --> 01:32:44,316
on. We got some cognates. You got some

808
01:32:44,316 --> 01:32:45,333
things that say, you

809
01:32:45,333 --> 01:32:46,716
know, sound somewhat similar,

810
01:32:47,633 --> 01:32:48,966
but the message is going to be different

811
01:32:48,966 --> 01:32:49,966
to your point. Yeah. It's

812
01:32:49,966 --> 01:32:51,616
like they didn't want to know

813
01:32:51,616 --> 01:32:53,766
about NIST 800-53. They just wanted to

814
01:32:53,766 --> 01:32:54,466
know that there was some

815
01:32:54,466 --> 01:32:55,833
kind of risk framework in place.

816
01:32:56,100 --> 01:32:56,966
They, we were going to implement

817
01:32:56,966 --> 01:32:58,933
something I would imagine that's, you

818
01:32:58,933 --> 01:33:02,716
know, and, you know, same thing.

819
01:33:02,716 --> 01:33:04,000
Same thing, I think with a lot of folks

820
01:33:04,000 --> 01:33:05,216
that are, you know, upper,

821
01:33:05,216 --> 01:33:06,333
lower middle management, like

822
01:33:06,366 --> 01:33:09,399
myself, it's like, okay, you have to say

823
01:33:09,399 --> 01:33:10,699
the same thing five different

824
01:33:10,699 --> 01:33:12,166
times or five different ways

825
01:33:12,516 --> 01:33:14,766
because the CISO only cares about maybe

826
01:33:14,766 --> 01:33:17,500
the, not the how or the, you know, but

827
01:33:17,500 --> 01:33:18,433
maybe the, you know,

828
01:33:19,100 --> 01:33:20,199
I don't know, I don't know which one of

829
01:33:20,199 --> 01:33:21,100
those questions it would be,

830
01:33:21,100 --> 01:33:22,083
but it'd be like, you know,

831
01:33:22,516 --> 01:33:24,066
I've got it. I've got it under control.

832
01:33:24,283 --> 01:33:25,766
This is the what, okay.

833
01:33:25,766 --> 01:33:26,933
This is the what's happening or

834
01:33:26,933 --> 01:33:28,899
whatever, but not the how I'm going to

835
01:33:28,899 --> 01:33:30,366
fix it. And, you know, with

836
01:33:30,366 --> 01:33:31,199
the product team, you're like,

837
01:33:31,199 --> 01:33:32,633
okay, this is how you're going to have to

838
01:33:32,633 --> 01:33:33,666
fix it or this side, you're

839
01:33:33,666 --> 01:33:34,583
going to have to address it or

840
01:33:35,316 --> 01:33:36,899
what have you. And then, you know, the

841
01:33:36,899 --> 01:33:37,883
board's a completely

842
01:33:37,883 --> 01:33:40,233
different, you know, what a more

843
01:33:40,233 --> 01:33:42,166
generic what I think in that case. But

844
01:33:42,166 --> 01:33:45,116
yeah, I, I think that a lot of people

845
01:33:45,116 --> 01:33:46,633
have that issue in our

846
01:33:46,633 --> 01:33:48,516
in our field, and it's it's it's a trial

847
01:33:48,516 --> 01:33:50,783
by fire, I think. And I think to your

848
01:33:50,783 --> 01:33:52,016
your story, you know,

849
01:33:52,016 --> 01:33:53,066
that's a trial by fire. You're like,

850
01:33:53,066 --> 01:33:54,516
okay, I won't do that again. Right.

851
01:33:55,100 --> 01:33:56,500
Unless you learned. Yeah.

852
01:33:57,483 --> 01:34:02,899
Room to grow, I think. I'm reminding

853
01:34:02,899 --> 01:34:04,716
myself of a story that I read

854
01:34:04,716 --> 01:34:06,066
where the tenure of a CISO is

855
01:34:06,066 --> 01:34:10,783
two years. And I've also been told that

856
01:34:10,783 --> 01:34:12,000
you really have to be at a

857
01:34:12,000 --> 01:34:13,383
job two years before you can be

858
01:34:13,383 --> 01:34:16,516
considered the owner of the thing. So I'm

859
01:34:16,516 --> 01:34:18,316
trying to find out if those two are

860
01:34:18,316 --> 01:34:19,666
corollary. It's like

861
01:34:19,716 --> 01:34:21,883
by the time the CISO gets to actually own

862
01:34:21,883 --> 01:34:22,699
the program or the

863
01:34:22,699 --> 01:34:24,983
project, they're either being

864
01:34:25,016 --> 01:34:27,016
kicked out because they didn't get the

865
01:34:27,016 --> 01:34:29,916
job done or they're moving on because

866
01:34:29,916 --> 01:34:31,216
something has happened.

867
01:34:31,666 --> 01:34:35,500
So what what what is with the short

868
01:34:35,500 --> 01:34:37,566
tenures with a lot of CISOs? Is it

869
01:34:37,566 --> 01:34:39,766
because of stress? Is it

870
01:34:39,766 --> 01:34:42,283
because, you know, they they realize that

871
01:34:42,283 --> 01:34:43,300
they've bitten off more

872
01:34:43,300 --> 01:34:44,366
than they can chew? I mean,

873
01:34:45,516 --> 01:34:48,083
and maybe this is just a media story like

874
01:34:48,083 --> 01:34:49,000
the you know, we have a

875
01:34:49,000 --> 01:34:50,899
talent gap like we had with our

876
01:34:50,916 --> 01:34:52,483
recruiter friend a couple of weeks ago.

877
01:34:52,483 --> 01:34:54,033
It's like it's just trumped

878
01:34:54,033 --> 01:34:56,366
up, you know, metrics where,

879
01:34:56,366 --> 01:34:57,583
you know, that's what they say is

880
01:34:57,583 --> 01:35:00,166
happening. Do you see a lot of CISOs

881
01:35:00,166 --> 01:35:01,816
lasting more than two years

882
01:35:01,883 --> 01:35:09,100
in their jobs? Not really. No, come on. I

883
01:35:09,100 --> 01:35:13,616
I'd love to spin a pretty tale that it's

884
01:35:13,616 --> 01:35:14,500
all a lie. And we're

885
01:35:14,533 --> 01:35:17,183
we find a company and we stay there for

886
01:35:17,183 --> 01:35:20,866
life. Dang it. The grass

887
01:35:20,866 --> 01:35:22,766
is always greener, right?

888
01:35:23,316 --> 01:35:25,083
There's there's always a better

889
01:35:25,083 --> 01:35:30,633
opportunity in some cases. I

890
01:35:30,633 --> 01:35:34,666
I probably left one job that I

891
01:35:34,783 --> 01:35:38,483
completely loved and I was doing really

892
01:35:38,483 --> 01:35:40,883
well to to chase the money.

893
01:35:42,516 --> 01:35:44,616
And, you know, I got offered

894
01:35:44,616 --> 01:35:51,600
stupid money and that was it was cool. I

895
01:35:51,600 --> 01:35:55,300
learned a lot. But I want to

896
01:35:55,300 --> 01:35:57,883
go back because I love that

897
01:35:57,883 --> 01:36:00,116
job. I love the team I was working with.

898
01:36:00,316 --> 01:36:01,300
I love the mission of the

899
01:36:01,300 --> 01:36:04,333
organization. And we were

900
01:36:04,433 --> 01:36:07,816
making some really good progress. Right.

901
01:36:09,100 --> 01:36:10,983
But, you know, I I made that

902
01:36:10,983 --> 01:36:12,300
decision. I have to live with

903
01:36:12,300 --> 01:36:17,300
it and you move on. But in some cases,

904
01:36:17,533 --> 01:36:25,116
you just end up the CISOs generally

905
01:36:25,116 --> 01:36:27,883
buried in an organization,

906
01:36:28,533 --> 01:36:31,916
right? They're expected to be an

907
01:36:31,916 --> 01:36:34,566
executive, but they're three

908
01:36:34,566 --> 01:36:36,383
deep on the executive ladder,

909
01:36:36,383 --> 01:36:43,133
right? There are three levels down. So if

910
01:36:43,133 --> 01:36:46,066
you don't like what mom says, go ask dad.

911
01:36:46,983 --> 01:36:50,733
Right. And you get into that game of

912
01:36:50,733 --> 01:36:55,466
telephone. So it can be hard

913
01:36:55,466 --> 01:36:57,516
to be in an organization where

914
01:36:57,966 --> 01:37:01,216
you're down so far on the chain. Right.

915
01:37:01,216 --> 01:37:01,983
So one of the things

916
01:37:01,983 --> 01:37:04,116
you really have to do is

917
01:37:05,883 --> 01:37:08,216
you have to build trust right away

918
01:37:08,216 --> 01:37:11,816
because you have to be the authority.

919
01:37:12,633 --> 01:37:16,333
So you don't have two years to get to own

920
01:37:16,333 --> 01:37:18,600
the function. Right.

921
01:37:19,116 --> 01:37:20,533
Right. You have to own the

922
01:37:20,533 --> 01:37:22,266
function right away because if the

923
01:37:22,266 --> 01:37:25,083
function fails, you're the one that's

924
01:37:25,083 --> 01:37:26,333
going to be escorted to the

925
01:37:26,383 --> 01:37:33,016
door. Right. Right. So some of my

926
01:37:33,016 --> 01:37:35,800
leadership classes I learned at the

927
01:37:35,800 --> 01:37:36,699
Harvard Business School

928
01:37:36,699 --> 01:37:38,566
online was, you know, you're generating

929
01:37:38,566 --> 01:37:40,433
trust through either

930
01:37:40,433 --> 01:37:41,833
positional authority, which,

931
01:37:41,833 --> 01:37:43,000
you know, if you're brand new CISO, you

932
01:37:43,000 --> 01:37:43,883
don't have any positional

933
01:37:43,883 --> 01:37:45,699
authority. I mean, what you do,

934
01:37:45,699 --> 01:37:47,416
but it's like you've just been there for

935
01:37:47,416 --> 01:37:52,516
two weeks. You've got, you know, your

936
01:37:52,516 --> 01:37:54,183
your reputation. So if

937
01:37:54,199 --> 01:37:56,133
you're like a mud or, you know, Mary,

938
01:37:56,283 --> 01:37:57,166
Mary Gardner or somebody

939
01:37:57,166 --> 01:37:58,500
who's brought in to be CISO

940
01:37:58,500 --> 01:38:00,866
or what have you, they may know you

941
01:38:00,866 --> 01:38:02,966
because you're a celebrity or a rock star

942
01:38:02,966 --> 01:38:04,033
or something like that,

943
01:38:04,033 --> 01:38:05,633
which you've got that kind of authority.

944
01:38:06,399 --> 01:38:11,600
Yeah. Do you how do you

945
01:38:11,600 --> 01:38:13,416
build that trust? Right. I mean,

946
01:38:13,416 --> 01:38:17,100
is it is it do you know coming in what

947
01:38:17,100 --> 01:38:17,883
your playbook looks

948
01:38:17,883 --> 01:38:18,666
like? I mean, this probably

949
01:38:18,683 --> 01:38:20,583
isn't the first time you've been a CISO

950
01:38:20,583 --> 01:38:22,699
or or I mean, if you have

951
01:38:22,699 --> 01:38:23,616
been, you know, the first time,

952
01:38:23,633 --> 01:38:26,283
I mean, what are the things you do to

953
01:38:26,283 --> 01:38:27,733
build trust in an organization? Who do

954
01:38:27,733 --> 01:38:28,666
you start with first?

955
01:38:28,666 --> 01:38:30,116
You start with the CEO. Do you start with

956
01:38:30,116 --> 01:38:30,866
the folks underneath

957
01:38:30,866 --> 01:38:31,866
you? Is it a bit of both?

958
01:38:34,383 --> 01:38:40,399
So you have to start with both, mostly

959
01:38:40,399 --> 01:38:43,300
because when the day is

960
01:38:43,300 --> 01:38:46,183
done, if I don't have a team

961
01:38:46,766 --> 01:38:53,666
that is committed to working with and for

962
01:38:53,666 --> 01:38:56,433
me, we're not going to

963
01:38:56,433 --> 01:38:58,300
be successful. Right.

964
01:38:59,083 --> 01:39:02,466
It doesn't matter what I do. I need that

965
01:39:02,466 --> 01:39:04,983
team. Right. Because I can't do it all.

966
01:39:05,883 --> 01:39:09,500
So I have to establish

967
01:39:09,500 --> 01:39:11,399
trust with the team and

968
01:39:12,366 --> 01:39:18,316
I love the concept of managing up. I

969
01:39:18,316 --> 01:39:19,583
think a lot of people say

970
01:39:19,583 --> 01:39:20,933
that they're going to manage up.

971
01:39:23,183 --> 01:39:25,233
And you can do that, but only if you have

972
01:39:25,233 --> 01:39:29,300
a team that trusts you and

973
01:39:29,300 --> 01:39:31,066
you know, that you trust.

974
01:39:31,516 --> 01:39:34,083
That you trust. So there has to be that

975
01:39:34,083 --> 01:39:36,300
teamwork from a security perspective.

976
01:39:37,800 --> 01:39:39,666
And once you establish that, then you

977
01:39:39,666 --> 01:39:43,300
have to you have to establish

978
01:39:43,300 --> 01:39:45,816
the trust among those people

979
01:39:46,033 --> 01:39:50,683
that are going to be key to your job. And

980
01:39:50,683 --> 01:39:51,433
that's going to be your

981
01:39:51,433 --> 01:39:53,216
direct report, who's probably the

982
01:39:53,266 --> 01:39:57,783
CIO or the chief legal officer or the

983
01:39:57,783 --> 01:39:59,199
chief financial officer.

984
01:40:00,233 --> 01:40:01,316
Right. So those are the three

985
01:40:01,716 --> 01:40:09,933
places. Generally, the CSO reports. I

986
01:40:09,933 --> 01:40:12,583
honestly think the CSO at some point

987
01:40:12,583 --> 01:40:13,666
needs to be elevated

988
01:40:13,800 --> 01:40:15,966
to a position or reporting to the CEO.

989
01:40:16,566 --> 01:40:18,883
Right. Right. They need to

990
01:40:18,883 --> 01:40:20,600
have a seat at that table.

991
01:40:24,750 --> 01:40:26,866
Right. But you have to establish trust

992
01:40:26,866 --> 01:40:28,866
among minimally those

993
01:40:28,866 --> 01:40:30,399
three people because the chief

994
01:40:30,399 --> 01:40:34,933
legal officer can be your best friend.

995
01:40:35,483 --> 01:40:37,616
Right. They're going to

996
01:40:37,616 --> 01:40:38,983
help you when there's breaches.

997
01:40:39,233 --> 01:40:40,966
They're going to help you when there's

998
01:40:40,966 --> 01:40:43,466
issues or incidents.

999
01:40:43,466 --> 01:40:45,466
They'll help you understand the

1000
01:40:45,483 --> 01:40:47,466
regulations that are coming down the

1001
01:40:47,466 --> 01:40:52,766
pike. And the CFO.

1002
01:40:54,383 --> 01:40:57,216
Generally, most of the regulations are

1003
01:40:57,233 --> 01:41:02,033
tied to the CFO's office. So, you know,

1004
01:41:02,466 --> 01:41:05,066
socks, a lot of the sock

1005
01:41:05,066 --> 01:41:08,566
work we do has financial control

1006
01:41:08,783 --> 01:41:13,316
implications. So it's really important to

1007
01:41:13,316 --> 01:41:15,933
build trust there. And, you know,

1008
01:41:16,133 --> 01:41:17,533
ultimately, if the CFO

1009
01:41:17,533 --> 01:41:22,333
is assisting you in getting budget,

1010
01:41:23,100 --> 01:41:24,416
they're always a good

1011
01:41:24,416 --> 01:41:26,283
person to build trust with.

1012
01:41:28,866 --> 01:41:30,416
But ultimately, everybody on the

1013
01:41:30,416 --> 01:41:32,233
executive team should be somebody

1014
01:41:32,916 --> 01:41:38,033
you seek to build trust with. The chief

1015
01:41:38,033 --> 01:41:39,533
people officer is going to

1016
01:41:39,533 --> 01:41:43,066
be a huge, hugely important

1017
01:41:43,066 --> 01:41:48,983
to you. But one of the things you asked

1018
01:41:48,983 --> 01:41:51,416
about the strategy of how do

1019
01:41:51,416 --> 01:41:52,883
you start going about this?

1020
01:41:55,050 --> 01:41:56,800
I make friends with the executive

1021
01:41:56,800 --> 01:41:57,699
assistants first and foremost.

1022
01:41:58,199 --> 01:42:03,833
Oh, yeah. It doesn't matter

1023
01:42:06,600 --> 01:42:11,100
who they are. But if you make them angry,

1024
01:42:11,666 --> 01:42:13,183
you're never going to get

1025
01:42:15,083 --> 01:42:18,133
a meeting with their exact right. Right.

1026
01:42:18,633 --> 01:42:20,566
Treat them well. Right.

1027
01:42:21,399 --> 01:42:22,899
Yeah. Yeah. They have more power,

1028
01:42:23,883 --> 01:42:25,933
I think, than the CEO or the CFO or the

1029
01:42:25,933 --> 01:42:28,183
CRO or whoever. Yeah.

1030
01:42:29,183 --> 01:42:32,033
Yeah. They know where the

1031
01:42:32,033 --> 01:42:33,966
skeletons are buried. They know, you

1032
01:42:33,966 --> 01:42:34,933
know, they manage the

1033
01:42:34,933 --> 01:42:36,783
calendar, that kind of thing. Yeah,

1034
01:42:36,783 --> 01:42:40,016
they're super powerful people. So. But

1035
01:42:40,016 --> 01:42:41,500
also, they have the

1036
01:42:41,500 --> 01:42:46,666
knowledge. And if you help them,

1037
01:42:46,699 --> 01:42:48,666
they'll help you. They're. Right.

1038
01:42:51,433 --> 01:42:54,000
Amazingly talented, overworked,

1039
01:42:54,416 --> 01:42:56,199
underappreciated people that

1040
01:42:57,566 --> 01:42:59,433
just really want other nice people to

1041
01:42:59,433 --> 01:43:03,100
work with. Nice. Yeah. Yeah.

1042
01:43:03,833 --> 01:43:05,699
So, kind of going back to what

1043
01:43:05,699 --> 01:43:06,983
we were talking about with the different

1044
01:43:06,983 --> 01:43:08,800
messaging and what have you

1045
01:43:08,800 --> 01:43:10,266
with like product teams and

1046
01:43:10,283 --> 01:43:12,933
with CISOs and stuff, your approach to

1047
01:43:12,933 --> 01:43:13,983
getting things done as a

1048
01:43:13,983 --> 01:43:15,066
CISO, depending on who you

1049
01:43:15,083 --> 01:43:16,683
report to is going to be different with

1050
01:43:16,683 --> 01:43:18,066
the CFO is going to be

1051
01:43:18,066 --> 01:43:20,933
numbers game. You know, I need this

1052
01:43:20,933 --> 01:43:24,116
new box. Our systems need to be upgraded

1053
01:43:24,116 --> 01:43:26,183
to blah. Well, we don't got

1054
01:43:26,183 --> 01:43:28,466
the budget for that. Legal is

1055
01:43:28,466 --> 01:43:30,366
going to be what kind of damage can this

1056
01:43:30,366 --> 01:43:31,833
cause the company? I'm

1057
01:43:31,833 --> 01:43:35,583
assuming that you really have to be

1058
01:43:35,583 --> 01:43:37,566
like you really kind of have to leave

1059
01:43:37,566 --> 01:43:38,683
that technical side and

1060
01:43:38,683 --> 01:43:39,783
be more of a people person.

1061
01:43:39,800 --> 01:43:42,699
Right. People, you know, it feels like

1062
01:43:42,699 --> 01:43:45,016
you really have to understand and read

1063
01:43:45,016 --> 01:43:46,183
people properly with

1064
01:43:46,183 --> 01:43:48,699
that, unless you're marketing CISO or

1065
01:43:48,699 --> 01:43:52,000
something like that. Did you

1066
01:43:52,000 --> 01:43:56,233
I mean, when you're mentoring

1067
01:43:56,366 --> 01:43:58,766
new CISOs, is that I mean, what is it?

1068
01:43:58,766 --> 01:43:59,300
What is it you tell

1069
01:43:59,300 --> 01:44:00,283
them other than, you know,

1070
01:44:00,800 --> 01:44:03,566
building trust is great. Yes. But yeah.

1071
01:44:04,266 --> 01:44:05,566
Do you ever size them

1072
01:44:05,566 --> 01:44:06,466
up and go, OK, look,

1073
01:44:07,083 --> 01:44:08,283
you're going to have a rough time of it

1074
01:44:08,283 --> 01:44:10,600
because you're not this or

1075
01:44:10,600 --> 01:44:11,416
you're going to, you know,

1076
01:44:11,416 --> 01:44:12,699
you're going to be really well on this

1077
01:44:12,699 --> 01:44:15,633
job because you can do this. I mean, do

1078
01:44:15,633 --> 01:44:16,883
you have evaluations

1079
01:44:17,083 --> 01:44:19,266
with CISO mentors or people that you're

1080
01:44:19,266 --> 01:44:20,033
you're working with in

1081
01:44:20,033 --> 01:44:21,483
transition that you say, OK,

1082
01:44:21,733 --> 01:44:23,216
you're going to run into this problem

1083
01:44:23,216 --> 01:44:25,466
with these people or what have you.

1084
01:44:26,733 --> 01:44:30,566
Yeah, I. I try and shoot straight with

1085
01:44:30,566 --> 01:44:32,899
people. And if I think there's.

1086
01:44:32,916 --> 01:44:41,116
I think if they're trying to come across

1087
01:44:41,116 --> 01:44:42,183
in a way that could be

1088
01:44:42,183 --> 01:44:45,816
damaging, I'll work with them on

1089
01:44:45,816 --> 01:44:50,816
that and. New CISOs have to be really

1090
01:44:50,816 --> 01:44:57,566
open to. I don't want to say being a

1091
01:44:57,566 --> 01:44:58,583
chameleon, but sort of

1092
01:44:58,600 --> 01:45:01,966
being a chameleon. Right. You know,

1093
01:45:01,966 --> 01:45:03,016
because you've got to

1094
01:45:03,016 --> 01:45:05,083
you do have to change.

1095
01:45:08,516 --> 01:45:11,116
Your tone and tenor, depending on who

1096
01:45:11,116 --> 01:45:12,866
you're dealing with, and it's not just

1097
01:45:12,866 --> 01:45:15,233
positionally, it's also personally.

1098
01:45:15,783 --> 01:45:19,833
Right. Because I have a tendency to be

1099
01:45:19,833 --> 01:45:21,016
extraordinarily informal.

1100
01:45:22,283 --> 01:45:25,766
OK. With people, I just I

1101
01:45:25,766 --> 01:45:27,433
like going in and telling them.

1102
01:45:28,733 --> 01:45:31,816
The way it is and having an open, honest

1103
01:45:31,816 --> 01:45:33,583
conversation with them, but.

1104
01:45:35,083 --> 01:45:36,033
It doesn't work with

1105
01:45:36,033 --> 01:45:39,816
everybody, so I have to adjust.

1106
01:45:40,816 --> 01:45:42,733
It's not incumbent on the people I'm

1107
01:45:42,733 --> 01:45:43,933
going to talk to to adjust to me.

1108
01:45:44,683 --> 01:45:49,866
It's incumbent on me to understand and

1109
01:45:49,866 --> 01:45:50,800
read people like you

1110
01:45:50,800 --> 01:45:52,500
were talking about and.

1111
01:45:52,500 --> 01:45:55,000
Right. Sometimes it's hard.

1112
01:45:57,266 --> 01:46:00,366
Yeah, yeah. But if you one of

1113
01:46:00,366 --> 01:46:02,399
the things I tell people is.

1114
01:46:03,983 --> 01:46:06,000
If you're walking into a conversation,

1115
01:46:06,000 --> 01:46:08,133
it's going to be crucial for your career

1116
01:46:08,133 --> 01:46:08,500
or your your project.

1117
01:46:08,916 --> 01:46:14,483
Talk to people who know that person.

1118
01:46:16,733 --> 01:46:19,116
Get advice, understand what they like,

1119
01:46:19,116 --> 01:46:20,633
what works, what doesn't work.

1120
01:46:21,016 --> 01:46:23,199
Talk to people who report to them.

1121
01:46:24,933 --> 01:46:26,000
But do your homework.

1122
01:46:26,716 --> 01:46:29,283
A lot of it's about just really doing

1123
01:46:29,283 --> 01:46:31,166
homework and understanding approaches.

1124
01:46:33,300 --> 01:46:34,983
The other thing is you have to be willing to listen to the advice.

1125
01:46:34,983 --> 01:46:39,516
Right. People have.

1126
01:46:41,616 --> 01:46:43,816
Cautioned me about walking into the room

1127
01:46:43,816 --> 01:46:45,633
with somebody and and given

1128
01:46:45,633 --> 01:46:47,033
me some really great advice

1129
01:46:47,033 --> 01:46:49,600
that I didn't listen to and.

1130
01:46:51,216 --> 01:46:53,516
I'm still regretting that.

1131
01:46:54,000 --> 01:46:55,199
So, you know, listen to

1132
01:46:55,199 --> 01:46:56,683
the advice people give you.

1133
01:46:58,183 --> 01:46:59,133
Is it one of those things?

1134
01:46:59,366 --> 01:47:00,633
Check your assumptions at the door.

1135
01:47:00,633 --> 01:47:00,733
Check that ego because, you
know, if if you think you're hot shit,

1136
01:47:01,483 --> 01:47:07,333
you're going to find out pretty quickly

1137
01:47:07,333 --> 01:47:10,233
whether or not you are kind of thing.

1138
01:47:11,416 --> 01:47:11,683
Oh, yeah.

1139
01:47:12,666 --> 01:47:13,833
Okay. All right.

1140
01:47:14,333 --> 01:47:15,016
Yeah, you.

1141
01:47:16,233 --> 01:47:17,766
You know, and I think.

1142
01:47:20,533 --> 01:47:21,399
Probably another.

1143
01:47:24,816 --> 01:47:25,300
Another piece of advice I give.

1144
01:47:25,300 --> 01:47:32,600
Is. For the first 30 days.

1145
01:47:34,100 --> 01:47:35,516
Ask questions and listen.

1146
01:47:38,516 --> 01:47:38,883
Right.

1147
01:47:39,816 --> 01:47:40,566
You know, there is.

1148
01:47:43,000 --> 01:47:44,866
There is nothing so.

1149
01:47:48,500 --> 01:47:53,466
There is nothing people.

1150
01:47:53,466 --> 01:47:57,266
There is nothing. There is nothing. There is nothing. There is nothing. There is nothing. There is nothing. There is nothing people like less than

1151
01:47:57,266 --> 01:47:59,516
somebody who comes into a situation

1152
01:47:59,716 --> 01:48:01,266
without understanding it

1153
01:48:01,266 --> 01:48:03,716
and making proclamations.

1154
01:48:04,533 --> 01:48:04,733
Right.

1155
01:48:05,416 --> 01:48:05,616
Right.

1156
01:48:09,500 --> 01:48:09,766
Yeah.

1157
01:48:11,033 --> 01:48:13,433
You know, it's been my experience that,

1158
01:48:13,433 --> 01:48:14,816
you know, yeah, you listen,

1159
01:48:15,383 --> 01:48:18,183
you observe, you ask questions and then,

1160
01:48:18,183 --> 01:48:20,516
you know, like any new leadership,

1161
01:48:21,000 --> 01:48:22,633
you know, you're you're going to have to

1162
01:48:22,633 --> 01:48:23,816
do a reorg at some point

1163
01:48:23,816 --> 01:48:24,716
because that's just kind

1164
01:48:24,716 --> 01:48:25,733
of how everything works.

1165
01:48:25,733 --> 01:48:27,566
That's kind of the playbook to go.

1166
01:48:28,033 --> 01:48:29,783
Yeah, you found the inefficiencies.

1167
01:48:30,000 --> 01:48:31,666
So you have to fix those inefficiencies

1168
01:48:31,666 --> 01:48:34,183
or, you know, to, you know, especially,

1169
01:48:34,183 --> 01:48:37,133
you know, below, not not necessarily

1170
01:48:37,133 --> 01:48:40,116
above maybe, but it's been my experience.

1171
01:48:40,116 --> 01:48:41,666
Anytime new management comes in, there's

1172
01:48:41,666 --> 01:48:42,866
going to be a reorg in anywhere

1173
01:48:42,866 --> 01:48:44,000
between three to six months.

1174
01:48:44,516 --> 01:48:45,633
So kind of expected.

1175
01:48:45,916 --> 01:48:47,066
At least that's how it's

1176
01:48:47,066 --> 01:48:48,433
been where I work right now.

1177
01:48:51,000 --> 01:48:54,466
And I guess it depends on the type of

1178
01:48:54,466 --> 01:48:56,616
projects that the people are working on.

1179
01:48:56,616 --> 01:48:57,716
But yeah, it's been it's been my

1180
01:48:57,716 --> 01:48:59,266
experience that reorganization

1181
01:48:59,266 --> 01:49:02,399
and realignment is is is the way.

1182
01:49:02,783 --> 01:49:11,116
So I mean, that's been my my experience.

1183
01:49:11,116 --> 01:49:12,566
Have you is there is there

1184
01:49:12,566 --> 01:49:14,066
a see so playbook like that?

1185
01:49:14,066 --> 01:49:14,933
Because there was a joke.

1186
01:49:14,933 --> 01:49:15,600
It's like, you know, you

1187
01:49:15,600 --> 01:49:17,383
spend the first 30 days, you know,

1188
01:49:17,783 --> 01:49:18,899
getting to understand the ropes.

1189
01:49:18,933 --> 01:49:20,666
You're going to, you know, try to

1190
01:49:20,666 --> 01:49:21,316
implement something

1191
01:49:21,316 --> 01:49:22,466
with a reorganization.

1192
01:49:22,466 --> 01:49:23,966
And that's that's where the joke of the

1193
01:49:23,966 --> 01:49:24,883
two years came from.

1194
01:49:24,883 --> 01:49:27,283
It's like, you know, by 18 months in, you

1195
01:49:27,283 --> 01:49:28,783
realize that there's a problem.

1196
01:49:28,833 --> 01:49:30,483
And, you know, you can't fix.

1197
01:49:30,483 --> 01:49:31,633
And then by two years, you're out.

1198
01:49:31,883 --> 01:49:36,300
But, you know, it I had

1199
01:49:36,300 --> 01:49:38,300
a point and I lost it.

1200
01:49:38,833 --> 01:49:40,083
And I don't know what that is.

1201
01:49:41,766 --> 01:49:42,883
Are there are there things that are

1202
01:49:42,883 --> 01:49:44,666
expected of you from the see so role?

1203
01:49:45,316 --> 01:49:46,816
I guess is this a thing?

1204
01:49:46,833 --> 01:49:48,516
Are you always expected to do a

1205
01:49:48,516 --> 01:49:50,000
realignment or reorganization?

1206
01:49:50,283 --> 01:49:52,333
Or have you actually seen where, hey,

1207
01:49:52,333 --> 01:49:53,316
everything's going good.

1208
01:49:54,366 --> 01:49:55,616
It seems to me if they've hired a brand

1209
01:49:55,616 --> 01:49:58,233
new see so they want to put their

1210
01:49:58,516 --> 01:50:00,366
paint job on the car, so to speak.

1211
01:50:00,666 --> 01:50:02,583
So I mean, is that is

1212
01:50:02,583 --> 01:50:03,433
that typical behavior?

1213
01:50:07,683 --> 01:50:08,333
It's typical.

1214
01:50:08,383 --> 01:50:19,916
Well, the the two times I've walked into

1215
01:50:19,916 --> 01:50:25,000
a well formed security team, in one case,

1216
01:50:25,233 --> 01:50:27,183
the security team actually had been

1217
01:50:27,183 --> 01:50:28,516
reporting up through it.

1218
01:50:30,116 --> 01:50:31,133
And the see so had

1219
01:50:31,133 --> 01:50:33,016
been reporting into legal.

1220
01:50:34,433 --> 01:50:35,433
So the security team

1221
01:50:35,433 --> 01:50:36,833
didn't report to the see so.

1222
01:50:38,916 --> 01:50:43,566
So when I came in, we collapsed them.

1223
01:50:44,166 --> 01:50:44,416
Okay.

1224
01:50:45,033 --> 01:50:46,966
Um, and there were some

1225
01:50:46,966 --> 01:50:48,516
minor tweaks that I made.

1226
01:50:51,199 --> 01:50:51,966
But for the most

1227
01:50:51,966 --> 01:50:54,416
part, I had a green field.

1228
01:50:55,733 --> 01:50:56,416
So that's nice.

1229
01:50:57,500 --> 01:50:59,933
Yeah, we brought I think we brought in

1230
01:50:59,933 --> 01:51:01,983
one, maybe two managers

1231
01:51:01,983 --> 01:51:04,600
and a program manager,

1232
01:51:04,866 --> 01:51:09,966
but we were able to really work with what

1233
01:51:09,966 --> 01:51:11,866
we had and add some staff

1234
01:51:11,866 --> 01:51:13,333
and augment some functions.

1235
01:51:15,399 --> 01:51:18,783
In the other case, the

1236
01:51:18,783 --> 01:51:20,183
team was pretty functional.

1237
01:51:21,983 --> 01:51:24,866
I made a couple changes adding a GRC role

1238
01:51:24,866 --> 01:51:28,100
that was in house instead of outsourced.

1239
01:51:28,116 --> 01:51:36,016
Um, but the other two see so positions

1240
01:51:36,016 --> 01:51:40,100
I've been in, really,

1241
01:51:40,100 --> 01:51:41,366
we built the organization

1242
01:51:41,566 --> 01:51:42,516
from the ground up.

1243
01:51:43,366 --> 01:51:44,699
So it really didn't exist

1244
01:51:44,699 --> 01:51:47,583
before that, before I joined.

1245
01:51:47,966 --> 01:51:50,583
So we were able to do green field work.

1246
01:51:52,333 --> 01:51:56,300
Um, I think every see so has their

1247
01:51:56,300 --> 01:51:57,533
optimal organization.

1248
01:51:59,616 --> 01:52:02,199
And that's the blueprint you carry with

1249
01:52:02,199 --> 01:52:04,383
you and you change it depending on the

1250
01:52:04,383 --> 01:52:06,066
organization you're in.

1251
01:52:08,266 --> 01:52:09,183
Do I build a sock

1252
01:52:09,183 --> 01:52:10,766
internally or do I outsource?

1253
01:52:11,466 --> 01:52:11,816
Right.

1254
01:52:12,416 --> 01:52:16,333
And normally I outsource that function.

1255
01:52:17,316 --> 01:52:21,166
But depending on the company I was with,

1256
01:52:22,199 --> 01:52:23,399
I would leave that

1257
01:52:23,399 --> 01:52:26,216
option open to build an house.

1258
01:52:27,199 --> 01:52:27,399
Okay.

1259
01:52:29,399 --> 01:52:33,266
But I've never had somebody tell me I

1260
01:52:33,266 --> 01:52:35,016
needed to build it this way.

1261
01:52:36,033 --> 01:52:36,066
Right.

1262
01:52:36,066 --> 01:52:38,100
Or I had to dismantle this.

1263
01:52:40,083 --> 01:52:43,166
I've made, I've absolutely made personnel

1264
01:52:43,166 --> 01:52:45,633
changes within the first 60 days.

1265
01:52:47,083 --> 01:52:47,383
Yeah.

1266
01:52:47,833 --> 01:52:49,733
But everybody's going to

1267
01:52:49,733 --> 01:52:53,583
because it's needs wants.

1268
01:52:54,766 --> 01:52:55,066
Right.

1269
01:52:56,899 --> 01:52:58,366
Well, I mean, they, they hired a see so

1270
01:52:58,366 --> 01:53:00,133
for a reason and it was

1271
01:53:00,133 --> 01:53:01,366
either because the security

1272
01:53:01,399 --> 01:53:03,816
team, yeah, I, I find it hard to believe

1273
01:53:03,816 --> 01:53:06,583
a see so's leaving if,

1274
01:53:06,583 --> 01:53:08,100
you know, they, well,

1275
01:53:08,100 --> 01:53:09,533
like you said, you were chasing, you

1276
01:53:09,533 --> 01:53:11,199
know, heinous money, but

1277
01:53:11,199 --> 01:53:13,300
there's going to be things

1278
01:53:13,316 --> 01:53:14,633
that they're going to find in there, you

1279
01:53:14,633 --> 01:53:16,866
know, hey, why are you doing it this way?

1280
01:53:17,116 --> 01:53:18,566
You know, why are we, why are we doing

1281
01:53:18,566 --> 01:53:19,566
all this stuff manually?

1282
01:53:19,833 --> 01:53:22,183
Why are we, you know, well, that's just

1283
01:53:22,183 --> 01:53:22,666
because of the way

1284
01:53:22,666 --> 01:53:23,533
we've always been doing.

1285
01:53:23,533 --> 01:53:25,383
Okay, well, you know, is there a way to

1286
01:53:25,383 --> 01:53:26,516
automate this or is there a

1287
01:53:26,516 --> 01:53:28,000
way to do these things or,

1288
01:53:28,216 --> 01:53:29,733
hey, I know about this technology that

1289
01:53:29,733 --> 01:53:30,666
y'all don't have that you

1290
01:53:30,666 --> 01:53:32,100
probably should have that I used

1291
01:53:32,100 --> 01:53:33,683
at my other company, which may or may not

1292
01:53:33,683 --> 01:53:35,100
work here or that kind of thing.

1293
01:53:35,100 --> 01:53:36,216
So makes sense.

1294
01:53:36,466 --> 01:53:36,883
Makes sense.

1295
01:53:36,883 --> 01:53:37,133
Yeah.

1296
01:53:37,166 --> 01:53:44,133
And I think the, I think those, those

1297
01:53:44,133 --> 01:53:45,283
changes definitely

1298
01:53:45,283 --> 01:53:49,100
happen over the course of

1299
01:53:51,500 --> 01:53:54,316
six to 12 months, maybe not in the first

1300
01:53:54,316 --> 01:53:59,133
90 days though. But if we're generally,

1301
01:53:59,233 --> 01:54:02,066
we're not given a direction to go in and

1302
01:54:02,066 --> 01:54:03,883
wholesale change everything.

1303
01:54:04,733 --> 01:54:04,816
Right.

1304
01:54:05,816 --> 01:54:10,100
But yeah, there's, you always find

1305
01:54:10,100 --> 01:54:12,416
inefficiencies or things you want to

1306
01:54:12,416 --> 01:54:13,533
change when you move into

1307
01:54:13,533 --> 01:54:15,233
a new position. I think

1308
01:54:15,233 --> 01:54:17,133
that's true of everybody.

1309
01:54:18,066 --> 01:54:21,516
Right. Right. Yeah. Yeah. I mean, if you,

1310
01:54:21,516 --> 01:54:22,683
yeah, you clear cut

1311
01:54:22,683 --> 01:54:23,633
everything, you're going to run

1312
01:54:23,633 --> 01:54:25,866
into things like or goals or, you know,

1313
01:54:26,566 --> 01:54:27,233
things that have been

1314
01:54:27,233 --> 01:54:28,883
established that, you know,

1315
01:54:28,883 --> 01:54:31,516
we're going to get into jeopardy. So it

1316
01:54:31,516 --> 01:54:32,616
makes sense. Yeah. You

1317
01:54:32,616 --> 01:54:33,533
want to know where to make

1318
01:54:33,566 --> 01:54:35,000
your cuts. You want to know where to add

1319
01:54:35,000 --> 01:54:37,116
on where to graph new

1320
01:54:37,116 --> 01:54:38,733
capabilities or technologies,

1321
01:54:38,733 --> 01:54:40,883
that kind of thing. And I guess that's

1322
01:54:40,883 --> 01:54:41,533
part of the whole trust

1323
01:54:41,533 --> 01:54:42,866
generation thing. You have to,

1324
01:54:43,083 --> 01:54:44,766
you know, listen to the people who

1325
01:54:44,766 --> 01:54:46,399
actually, you know, maybe need those

1326
01:54:46,399 --> 01:54:47,500
things have been asking

1327
01:54:47,500 --> 01:54:48,883
for them for years and haven't been able

1328
01:54:48,883 --> 01:54:50,783
to get them. So part of it is, you know,

1329
01:54:51,166 --> 01:54:51,766
working with your

1330
01:54:51,766 --> 01:54:53,333
teams to understand that.

1331
01:54:54,583 --> 01:54:57,816
And, you know, one of the things I, there

1332
01:54:57,816 --> 01:54:59,866
are certain people that I will always

1333
01:55:00,283 --> 01:55:04,183
try and tempt to come with me when I find

1334
01:55:04,183 --> 01:55:06,000
a new gig, you know, and

1335
01:55:06,000 --> 01:55:09,233
just figuring out how to,

1336
01:55:09,716 --> 01:55:12,183
and it's because we've developed a long

1337
01:55:12,183 --> 01:55:14,083
standing trust relationship, right?

1338
01:55:14,616 --> 01:55:16,416
Sure. Yeah.

1339
01:55:16,666 --> 01:55:18,533
So those are some of the things that I'll

1340
01:55:18,533 --> 01:55:20,383
look for when I start

1341
01:55:20,383 --> 01:55:22,199
with a new organization is

1342
01:55:23,083 --> 01:55:25,600
who do I need and are there places where

1343
01:55:25,600 --> 01:55:27,000
I can use these people that

1344
01:55:27,000 --> 01:55:28,500
have helped me succeed in the

1345
01:55:28,516 --> 01:55:31,516
past? Nice. And I think that's true of

1346
01:55:31,516 --> 01:55:33,100
everybody. We want to have our tribe.

1347
01:55:34,033 --> 01:55:38,933
Right. That makes sense. So I want to, I

1348
01:55:38,933 --> 01:55:40,783
want to kind of steer back

1349
01:55:40,783 --> 01:55:43,100
to a couple of things that,

1350
01:55:43,800 --> 01:55:47,916
you know, asking about. So you you've

1351
01:55:47,916 --> 01:55:49,766
worked with boards, you're probably

1352
01:55:49,766 --> 01:55:50,816
working with some boards

1353
01:55:50,833 --> 01:55:55,883
right now. What in generalities, if you

1354
01:55:55,883 --> 01:55:57,433
can, what are boards most

1355
01:55:57,433 --> 01:55:58,366
worried about these days?

1356
01:55:58,583 --> 01:56:01,300
Is it the AI stuff? Is it trying to

1357
01:56:01,300 --> 01:56:03,183
figure out how to stay, you know,

1358
01:56:03,983 --> 01:56:05,233
relevant with with that

1359
01:56:05,233 --> 01:56:07,966
new technology? Do a lot of them even

1360
01:56:07,966 --> 01:56:09,266
care or they're just

1361
01:56:09,266 --> 01:56:10,433
trying to figure out how to,

1362
01:56:10,600 --> 01:56:13,583
you know, productize it? And is there,

1363
01:56:13,583 --> 01:56:15,133
you know, what is the things

1364
01:56:15,133 --> 01:56:16,199
they are keeping the boards

1365
01:56:16,199 --> 01:56:16,983
up at night now?

1366
01:56:20,733 --> 01:56:25,083
So it depends on the industry. Right.

1367
01:56:27,316 --> 01:56:30,133
But I think if you're talking about

1368
01:56:32,283 --> 01:56:36,066
tech or manufacturing or any company that

1369
01:56:36,066 --> 01:56:39,783
has intellectual property to protect,

1370
01:56:40,600 --> 01:56:45,399
it's definitely AI is definitely on top

1371
01:56:45,399 --> 01:56:48,566
of their minds. I think

1372
01:56:48,566 --> 01:56:51,433
the other thing is just

1373
01:56:53,166 --> 01:56:56,966
an assurance of resiliency. Resiliency.

1374
01:56:58,416 --> 01:57:02,100
Ransomware, well, the ability to keep

1375
01:57:02,100 --> 01:57:03,533
managing through an attack.

1376
01:57:04,699 --> 01:57:04,983
Okay.

1377
01:57:06,466 --> 01:57:08,216
Whatever that is, or keep

1378
01:57:08,216 --> 01:57:11,383
managing through a loss.

1379
01:57:12,716 --> 01:57:13,666
Right. Right.

1380
01:57:14,583 --> 01:57:19,199
So do boards are definitely

1381
01:57:19,199 --> 01:57:21,899
concerned with the ability to

1382
01:57:23,966 --> 01:57:25,366
maintain the corporation

1383
01:57:25,966 --> 01:57:31,866
through a ransomware attack, through a

1384
01:57:31,866 --> 01:57:35,033
breach. You know, how do we

1385
01:57:35,033 --> 01:57:36,416
handle a breach? How do we

1386
01:57:36,416 --> 01:57:42,800
respond to a breach? And what are the

1387
01:57:42,800 --> 01:57:45,283
repercussions if we do have a breach?

1388
01:57:45,583 --> 01:57:46,616
Right. Especially with

1389
01:57:46,616 --> 01:57:52,533
the SEC breach rules. I think boards are

1390
01:57:52,533 --> 01:57:53,466
struggling with how to

1391
01:57:54,283 --> 01:58:00,383
define material because

1392
01:58:00,383 --> 01:58:02,416
it's not just a number.

1393
01:58:04,899 --> 01:58:05,100
Right.

1394
01:58:05,600 --> 01:58:10,199
You know, if you're a business that has

1395
01:58:11,316 --> 01:58:15,483
reputational impacts, you know, what

1396
01:58:15,483 --> 01:58:16,716
happens if your reputation

1397
01:58:16,716 --> 01:58:18,683
is damaged to the point that

1398
01:58:18,683 --> 01:58:19,516
you're losing business?

1399
01:58:19,933 --> 01:58:23,466
Right. Right. That becomes material, but it

1400
01:58:23,466 --> 01:58:24,683
becomes material over

1401
01:58:24,683 --> 01:58:28,399
time. So how do we set up those

1402
01:58:28,399 --> 01:58:32,300
triggers to know when a breach is

1403
01:58:32,300 --> 01:58:34,133
material and when we need to report?

1404
01:58:35,100 --> 01:58:38,283
Right. I think the other thing is

1405
01:58:42,033 --> 01:58:44,500
boards are concerned about whether or not

1406
01:58:45,083 --> 01:58:47,933
they're getting

1407
01:58:49,083 --> 01:58:52,733
a real picture of the risk of

1408
01:58:52,733 --> 01:58:54,216
cybersecurity threats.

1409
01:58:54,883 --> 01:58:57,183
Right. Especially after the Uber

1410
01:58:57,483 --> 01:59:02,699
situation. You know, is the CSO reporting

1411
01:59:02,699 --> 01:59:04,233
to us accurately? Do we

1412
01:59:04,233 --> 01:59:05,383
know everything that's out

1413
01:59:05,383 --> 01:59:05,699
there?

1414
01:59:06,016 --> 01:59:07,033
Right. Right.

1415
01:59:08,983 --> 01:59:11,600
You know, and I think the

1416
01:59:11,600 --> 01:59:12,916
board's going to have to

1417
01:59:15,883 --> 01:59:19,300
look and see whether or not they have the

1418
01:59:19,300 --> 01:59:20,000
right reporting

1419
01:59:20,000 --> 01:59:22,199
relationship to establish that trust

1420
01:59:22,199 --> 01:59:26,166
with the CSO. So the CSO does have an

1421
01:59:26,166 --> 01:59:26,916
open chain of

1422
01:59:26,916 --> 01:59:28,966
communication to the board without,

1423
01:59:30,600 --> 01:59:32,300
you know, a stop in

1424
01:59:32,300 --> 01:59:34,516
between for executive management.

1425
01:59:36,616 --> 01:59:36,716
Okay.

1426
01:59:37,116 --> 01:59:39,383
Or maybe not without a

1427
01:59:39,383 --> 01:59:40,766
stop, but with the right

1428
01:59:43,716 --> 01:59:44,716
stops in place.

1429
01:59:45,666 --> 01:59:47,266
Right. Right.

1430
01:59:48,449 --> 01:59:54,433
Huh. So has the Uber thing really damaged

1431
01:59:54,433 --> 01:59:56,483
the CSO role that badly?

1432
01:59:56,966 --> 01:59:58,383
That sounds scary. Like we

1433
01:59:58,383 --> 02:00:00,800
can't recover from that. It's been what,

1434
02:00:01,000 --> 02:00:02,416
three, four years since that happened?

1435
02:00:02,466 --> 02:00:07,083
Yeah. So it's been three to four years

1436
02:00:07,083 --> 02:00:08,433
since that breach happened,

1437
02:00:08,866 --> 02:00:10,583
but I believe the prosecution

1438
02:00:10,683 --> 02:00:14,266
was just in the last year? Three years?

1439
02:00:15,166 --> 02:00:17,266
Yeah. Yeah. They handed down. Yeah.

1440
02:00:18,783 --> 02:00:21,300
It was the prosecution more than the

1441
02:00:21,300 --> 02:00:23,433
breach that brought it

1442
02:00:23,433 --> 02:00:24,566
to everybody's attention.

1443
02:00:26,399 --> 02:00:26,583
Okay.

1444
02:00:26,600 --> 02:00:32,066
Yeah. Three years probation for covering

1445
02:00:32,066 --> 02:00:32,983
up data breach involving

1446
02:00:32,983 --> 02:00:34,533
millions of Uber user records.

1447
02:00:35,500 --> 02:00:39,033
Yeah. That was the that was Friday,

1448
02:00:39,033 --> 02:00:41,766
February or May 5th. Yeah.

1449
02:00:43,500 --> 02:00:46,100
Yeah. I mean, yeah, that was that was

1450
02:00:46,100 --> 02:00:48,000
that was terrible. I think

1451
02:00:48,000 --> 02:00:49,683
from a from a CSO point of view,

1452
02:00:49,683 --> 02:00:53,216
but yeah, I guess.

1453
02:00:54,433 --> 02:00:55,466
So I think what do we do?

1454
02:00:55,716 --> 02:00:58,316
I think we do coverable though, because

1455
02:00:58,316 --> 02:01:01,233
we can't all be painted with that brush.

1456
02:01:02,016 --> 02:01:05,416
Right. Right. So is it just a bunch of

1457
02:01:05,416 --> 02:01:08,233
dashboards and metrics or obviously they

1458
02:01:08,233 --> 02:01:09,033
don't want dashboards

1459
02:01:09,033 --> 02:01:11,199
and metrics. They want, you know, some,

1460
02:01:11,199 --> 02:01:12,266
some fairly generic

1461
02:01:12,266 --> 02:01:14,433
things, but that's one of those

1462
02:01:14,433 --> 02:01:16,316
fine lines, right? We can give them 800

1463
02:01:16,316 --> 02:01:19,516
dash 53 and all 17 articles and config,

1464
02:01:19,516 --> 02:01:19,866
you know, and they're

1465
02:01:19,899 --> 02:01:21,883
like, you know, they start glazing over,

1466
02:01:22,399 --> 02:01:24,316
but they probably don't

1467
02:01:24,316 --> 02:01:26,166
want a ton of metrics that,

1468
02:01:27,149 --> 02:01:28,833
you know, they want to be told the story,

1469
02:01:28,833 --> 02:01:30,483
but, you know, so it seems

1470
02:01:30,483 --> 02:01:31,466
like there's a happy medium

1471
02:01:31,466 --> 02:01:32,733
there. Again, that's one of those trial

1472
02:01:32,733 --> 02:01:33,483
and error things, I

1473
02:01:33,483 --> 02:01:34,199
guess, that you're going to,

1474
02:01:34,199 --> 02:01:35,333
you're going to find out either you've

1475
02:01:35,333 --> 02:01:36,566
done really poorly this month

1476
02:01:36,566 --> 02:01:37,933
and you'll improve next month,

1477
02:01:38,500 --> 02:01:40,183
or you, I guess there's

1478
02:01:40,183 --> 02:01:41,500
always room for improvement. So

1479
02:01:41,500 --> 02:01:45,183
and if you're doing it right, you're

1480
02:01:45,183 --> 02:01:46,316
having the conversations

1481
02:01:47,566 --> 02:01:53,966
to understand what they want before you

1482
02:01:53,966 --> 02:01:55,266
even walk into the room.

1483
02:01:55,800 --> 02:01:57,116
And that was, that was my big

1484
02:01:57,116 --> 02:01:59,033
failing because I never met with the

1485
02:01:59,033 --> 02:02:02,133
board before I presented to them in that

1486
02:02:02,133 --> 02:02:05,033
particular case. But

1487
02:02:05,033 --> 02:02:07,316
when you meet with the board and you

1488
02:02:07,316 --> 02:02:08,733
understand what they're looking for

1489
02:02:09,233 --> 02:02:13,600
and whether or not

1490
02:02:16,616 --> 02:02:19,666
they understand what you've presented, it

1491
02:02:19,666 --> 02:02:21,933
helps a lot. Yeah. The

1492
02:02:21,933 --> 02:02:24,116
other thing is you can expect it

1493
02:02:24,116 --> 02:02:28,083
in the full board meeting. So having

1494
02:02:28,083 --> 02:02:29,183
those two or three

1495
02:02:29,183 --> 02:02:30,100
advocates on the board that will

1496
02:02:30,133 --> 02:02:38,300
give you honest feedback is really

1497
02:02:38,300 --> 02:02:40,666
important because the full

1498
02:02:40,666 --> 02:02:42,016
board isn't going to spend the

1499
02:02:42,016 --> 02:02:45,016
time to have a feedback session with you,

1500
02:02:45,383 --> 02:02:49,183
which is unfortunate, but it's just not

1501
02:02:49,183 --> 02:02:53,016
the way it's going to happen. So having a

1502
02:02:53,016 --> 02:02:54,083
few champions on the

1503
02:02:54,083 --> 02:02:55,183
board is really important.

1504
02:02:55,816 --> 02:02:58,416
That's cool. Yeah. Plus at those board meetings, I'm actually going to talk about

1505
02:02:58,433 --> 02:03:00,933
those board meetings. I'm guessing the

1506
02:03:00,933 --> 02:03:02,133
CISO isn't taking up the

1507
02:03:02,133 --> 02:03:03,416
entirety of the time. You

1508
02:03:03,416 --> 02:03:05,483
get maybe what, two or three slides, if

1509
02:03:05,483 --> 02:03:07,533
that and a handful of

1510
02:03:07,533 --> 02:03:08,500
minutes to be able to go,

1511
02:03:08,500 --> 02:03:10,100
okay, this is what we're doing. Or was,

1512
02:03:10,416 --> 02:03:11,783
you know, I guess in the, in

1513
02:03:11,783 --> 02:03:13,883
the case of the NIST 853 story,

1514
02:03:14,033 --> 02:03:17,800
it was a meeting for the CISO to talk

1515
02:03:17,800 --> 02:03:19,766
about those things. But I would imagine

1516
02:03:19,766 --> 02:03:20,533
most board meetings,

1517
02:03:20,733 --> 02:03:22,866
you only get a handful of minutes and a

1518
02:03:22,866 --> 02:03:24,016
slide or two to be able to

1519
02:03:24,016 --> 02:03:25,783
go, okay, this is, this is what

1520
02:03:25,816 --> 02:03:29,433
we're doing. Yeah. In the NIST 853, that

1521
02:03:29,433 --> 02:03:30,633
was my introduction to

1522
02:03:30,633 --> 02:03:32,483
the board. Okay. So that was

1523
02:03:32,483 --> 02:03:36,033
actually an hour long, which was time not

1524
02:03:36,033 --> 02:03:39,199
well spent. But

1525
02:03:39,199 --> 02:03:43,300
generally standard board meeting,

1526
02:03:43,566 --> 02:03:46,166
you get anywhere between 10 minutes to a

1527
02:03:46,166 --> 02:03:48,366
half an hour. Oh, that's

1528
02:03:48,366 --> 02:03:51,333
not too bad, I guess. No, it's

1529
02:03:51,766 --> 02:03:54,166
half an hour is great. And if they're

1530
02:03:54,166 --> 02:03:57,566
engaged in asking questions, that's the

1531
02:03:57,566 --> 02:03:58,716
best of all possible

1532
02:03:59,000 --> 02:04:00,683
scenarios. Because if they're asking

1533
02:04:00,683 --> 02:04:03,383
questions, they're

1534
02:04:03,383 --> 02:04:04,866
understanding what you're saying. And

1535
02:04:04,866 --> 02:04:08,733
that's a really good indicator of whether

1536
02:04:08,733 --> 02:04:12,083
or not you've hit your

1537
02:04:12,083 --> 02:04:15,583
mark. Right. Right. I guess

1538
02:04:15,583 --> 02:04:17,266
there's, I guess it's, you have to figure

1539
02:04:17,266 --> 02:04:18,316
out how much content you

1540
02:04:18,316 --> 02:04:19,333
want to put in. If you put in

1541
02:04:19,399 --> 02:04:21,233
10 minutes of content and have 20 minutes

1542
02:04:21,233 --> 02:04:22,083
of questions, that's

1543
02:04:22,083 --> 02:04:23,000
great. But if you put in

1544
02:04:23,399 --> 02:04:25,266
10 minutes of content, you get like three

1545
02:04:25,266 --> 02:04:25,899
questions, you're

1546
02:04:25,899 --> 02:04:26,933
stuck there with another 20

1547
02:04:26,933 --> 02:04:31,283
minutes and you're like, yeah. And so

1548
02:04:31,283 --> 02:04:32,533
either you did a really good job of

1549
02:04:32,533 --> 02:04:33,216
explaining everything

1550
02:04:33,216 --> 02:04:35,533
in 10 minutes, or they didn't understand

1551
02:04:35,533 --> 02:04:36,916
a thing you were saying and

1552
02:04:36,916 --> 02:04:37,816
don't even know where to start

1553
02:04:37,816 --> 02:04:40,566
asking those questions. I, God, now I

1554
02:04:40,566 --> 02:04:41,466
don't want to be a CISO.

1555
02:04:41,466 --> 02:04:43,116
This sounds too nuanced for me.

1556
02:04:43,116 --> 02:04:44,600
I can't remember. No, Brian, you need to

1557
02:04:44,600 --> 02:04:46,466
be a CISO. No, you're

1558
02:04:46,466 --> 02:04:47,716
asking the right questions.

1559
02:04:49,633 --> 02:04:52,083
Nobody wants me to CISO. I'm upper,

1560
02:04:52,083 --> 02:04:52,500
lower, middle

1561
02:04:52,500 --> 02:04:53,866
management. You have no idea.

1562
02:04:56,116 --> 02:04:58,800
So upper, lower, middle management is

1563
02:04:58,800 --> 02:05:00,399
kind of what we all are, I think.

1564
02:05:02,116 --> 02:05:03,683
There's always somebody above you on the

1565
02:05:03,683 --> 02:05:04,866
rung on that ladder, I guess.

1566
02:05:05,399 --> 02:05:08,866
Yeah. Okay. Okay. Well, I guess, I guess

1567
02:05:08,866 --> 02:05:10,283
one of the last things we

1568
02:05:10,283 --> 02:05:12,600
get, you know, to segue into

1569
02:05:12,699 --> 02:05:17,483
that is when do you, when does, when

1570
02:05:17,483 --> 02:05:18,500
should somebody feel

1571
02:05:18,500 --> 02:05:20,316
confident that they can be a CISO?

1572
02:05:20,316 --> 02:05:23,016
Because I know people who are CISOs of

1573
02:05:23,016 --> 02:05:24,600
companies where they're

1574
02:05:24,600 --> 02:05:26,333
like employee number two. And,

1575
02:05:26,750 --> 02:05:29,166
you know, you're like, are you really the

1576
02:05:29,166 --> 02:05:30,083
CISO? Because you're

1577
02:05:30,083 --> 02:05:31,266
also the head developer,

1578
02:05:31,983 --> 02:05:35,783
janitor, caterer, you know, head of

1579
02:05:35,783 --> 02:05:36,916
development, IT

1580
02:05:36,916 --> 02:05:38,016
person, that kind of thing.

1581
02:05:38,366 --> 02:05:42,583
You're in, okay, you have CISO in title,

1582
02:05:42,583 --> 02:05:45,000
but it's like, when is

1583
02:05:45,000 --> 02:05:46,100
the time to make the jump?

1584
02:05:46,383 --> 02:05:48,516
When do, you know, is it like, Hey, I'm,

1585
02:05:48,516 --> 02:05:49,466
you know, I'm tired of

1586
02:05:49,466 --> 02:05:50,516
being a technical person.

1587
02:05:50,516 --> 02:05:52,066
I want to go and be a people person now,

1588
02:05:52,066 --> 02:05:53,600
or, you know, what,

1589
02:05:53,600 --> 02:05:55,166
you know, I'm starting,

1590
02:05:55,466 --> 02:05:57,566
I'm not starting to feel this. It's like

1591
02:05:57,566 --> 02:05:59,800
the imposter syndrome in

1592
02:05:59,800 --> 02:06:00,633
me is like, I don't even

1593
02:06:00,633 --> 02:06:02,300
know if I could even be a CISO at this

1594
02:06:02,300 --> 02:06:03,883
point. Who would want me?

1595
02:06:04,366 --> 02:06:06,333
And what does, what does the

1596
02:06:07,166 --> 02:06:08,733
skill set look like for somebody like

1597
02:06:08,733 --> 02:06:11,216
that? It was, you know, I

1598
02:06:11,216 --> 02:06:13,516
guess, I guess I'm asking

1599
02:06:13,633 --> 02:06:14,966
maybe a question. I don't

1600
02:06:14,966 --> 02:06:15,883
know if it's the right question.

1601
02:06:17,116 --> 02:06:20,116
So a couple of things, but I'm going to

1602
02:06:20,116 --> 02:06:22,133
step back a minute because please do.

1603
02:06:22,433 --> 02:06:23,933
I don't want to paint a

1604
02:06:23,933 --> 02:06:25,000
picture of doom and gloom.

1605
02:06:26,000 --> 02:06:29,383
We started with doom and gloom.

1606
02:06:30,116 --> 02:06:37,816
Well, look, this is probably, I started

1607
02:06:37,816 --> 02:06:38,766
out my life as a

1608
02:06:38,766 --> 02:06:42,833
biologist, right? And I made several

1609
02:06:42,833 --> 02:06:46,066
career hops and I found security. Okay.

1610
02:06:46,300 --> 02:06:48,216
And I love this job.

1611
02:06:48,800 --> 02:06:50,916
I love the challenges.

1612
02:06:51,800 --> 02:06:54,833
I love the fact that every single day I

1613
02:06:54,833 --> 02:06:57,166
have to use a different

1614
02:06:57,166 --> 02:06:59,133
skill or use a skill that

1615
02:06:59,166 --> 02:07:03,300
I've grown in a different way. And it's

1616
02:07:03,300 --> 02:07:04,733
not just a technical skill,

1617
02:07:04,733 --> 02:07:06,833
but it's also the people skills.

1618
02:07:07,600 --> 02:07:09,583
Right. I think

1619
02:07:14,433 --> 02:07:17,133
there were two questions that I think I'm

1620
02:07:17,133 --> 02:07:18,300
going to tease out of what

1621
02:07:18,300 --> 02:07:20,500
you asked. The first one is

1622
02:07:22,116 --> 02:07:24,866
a lot of times people get a CISO role

1623
02:07:24,866 --> 02:07:27,533
along with a lot of other stuff.

1624
02:07:28,083 --> 02:07:32,566
Right. So they're doing the function of

1625
02:07:32,566 --> 02:07:33,616
information security

1626
02:07:33,616 --> 02:07:35,199
and they get that title.

1627
02:07:37,716 --> 02:07:38,899
I think you have to

1628
02:07:38,899 --> 02:07:41,733
honestly ask yourself,

1629
02:07:44,350 --> 02:07:47,533
does my CISO role conflict with any of

1630
02:07:47,533 --> 02:07:49,016
the other hats I have to wear?

1631
02:07:50,416 --> 02:07:53,616
Right. And if it does,

1632
02:07:53,883 --> 02:07:58,866
it could be problematic. I've been in a

1633
02:07:58,866 --> 02:08:00,216
position where I was the,

1634
02:08:00,883 --> 02:08:02,500
for all intents and purposes,

1635
02:08:02,800 --> 02:08:06,533
a CISO, a person in the IT department

1636
02:08:06,533 --> 02:08:08,033
left, and I was asked

1637
02:08:08,033 --> 02:08:09,266
to sit in their chair.

1638
02:08:10,133 --> 02:08:13,500
Right. And I said, I will do it, but you

1639
02:08:13,500 --> 02:08:14,883
have to understand that it

1640
02:08:14,883 --> 02:08:16,733
conflicts with my CISO role.

1641
02:08:17,266 --> 02:08:21,733
Right. So there are going to be times

1642
02:08:21,733 --> 02:08:22,899
when I ask somebody else to sit in their chair,

1643
02:08:23,566 --> 02:08:25,916
to help advise me of something because I

1644
02:08:25,916 --> 02:08:27,133
can't make that decision.

1645
02:08:28,366 --> 02:08:30,500
Right. Because there's a conflict of

1646
02:08:30,500 --> 02:08:33,199
interest and it's not fair to

1647
02:08:33,199 --> 02:08:36,066
anybody. So that's one thing.

1648
02:08:36,433 --> 02:08:38,033
But the other thing is from a personal

1649
02:08:38,033 --> 02:08:41,800
perspective, I don't know

1650
02:08:41,800 --> 02:08:46,216
anybody in this role. Well,

1651
02:08:47,166 --> 02:08:48,683
I do know a couple of people. I'll take

1652
02:08:48,683 --> 02:08:49,833
that back. But I think

1653
02:08:49,833 --> 02:08:50,899
everybody struggles with

1654
02:08:50,916 --> 02:08:55,966
imposter syndrome at some point. This is

1655
02:08:55,966 --> 02:08:59,816
a big role. I mean, we used to joke that

1656
02:09:00,033 --> 02:09:02,333
information security was an inch deep and

1657
02:09:02,333 --> 02:09:06,516
mile wide. Right. To

1658
02:09:06,516 --> 02:09:07,783
be good at this role,

1659
02:09:08,166 --> 02:09:10,683
you now have to go at least six inches

1660
02:09:10,683 --> 02:09:14,216
deep and mile wide. Right. Or

1661
02:09:14,216 --> 02:09:16,100
you have to be able to build

1662
02:09:16,116 --> 02:09:24,899
that team. I think you're ready for the

1663
02:09:24,899 --> 02:09:26,066
role if you're ready to

1664
02:09:26,066 --> 02:09:28,116
stand in and take the hits

1665
02:09:29,166 --> 02:09:33,033
and answer the hard questions. If you

1666
02:09:33,033 --> 02:09:34,133
want to lead a team,

1667
02:09:35,383 --> 02:09:38,316
because you have to lead the team,

1668
02:09:38,316 --> 02:09:40,166
you have to be transparent with them, you

1669
02:09:40,166 --> 02:09:41,616
have to let them know what's going on.

1670
02:09:41,633 --> 02:09:46,883
And you have to grow them. I think that's

1671
02:09:46,883 --> 02:09:47,916
probably a mistake

1672
02:09:47,916 --> 02:09:49,716
I've made in the past is

1673
02:09:50,833 --> 02:09:52,816
when I had the opportunity to take

1674
02:09:52,816 --> 02:09:54,766
somebody into the board meeting with me,

1675
02:09:54,766 --> 02:09:55,683
I haven't done that.

1676
02:09:57,383 --> 02:09:59,633
And that's a great growth opportunity for

1677
02:09:59,633 --> 02:10:03,933
people. But I think if

1678
02:10:03,983 --> 02:10:10,500
you go in every day to play with the

1679
02:10:10,500 --> 02:10:14,483
technology, you don't want

1680
02:10:14,483 --> 02:10:16,433
to go to a CSOL role yet.

1681
02:10:17,566 --> 02:10:19,666
Right. When you get past the point of

1682
02:10:19,666 --> 02:10:20,683
wanting to be that

1683
02:10:20,683 --> 02:10:24,383
hardcore technologist that's

1684
02:10:24,716 --> 02:10:26,583
figuring out how to solve everything with

1685
02:10:26,583 --> 02:10:30,100
technology, wait a couple of years.

1686
02:10:30,116 --> 02:10:34,166
Okay. And then see if you change your

1687
02:10:34,166 --> 02:10:35,399
mind and you really want

1688
02:10:35,399 --> 02:10:37,516
to work with people more.

1689
02:10:38,850 --> 02:10:42,600
Right. I think it's a great place to be

1690
02:10:42,600 --> 02:10:44,899
because there's nothing better than

1691
02:10:46,666 --> 02:10:47,800
seeing somebody's eyes

1692
02:10:47,800 --> 02:10:49,683
light up when they understand.

1693
02:10:51,716 --> 02:10:53,866
Right. And you can do

1694
02:10:53,866 --> 02:10:54,933
that with your team,

1695
02:10:54,933 --> 02:10:56,699
you can do that with leadership, and you

1696
02:10:56,699 --> 02:10:57,616
can do that with the board.

1697
02:10:59,333 --> 02:11:02,199
Very good. Okay. Okay. Yeah, it's kind

1698
02:11:02,199 --> 02:11:05,416
of, yeah, that makes 100%

1699
02:11:05,699 --> 02:11:06,716
sense when I was working

1700
02:11:06,716 --> 02:11:08,100
at CrowdStrike. I've told this story, I

1701
02:11:08,100 --> 02:11:09,266
think even to a couple of

1702
02:11:09,266 --> 02:11:10,583
folks who are on our stream here,

1703
02:11:11,116 --> 02:11:12,816
I realized that I did not have the

1704
02:11:12,816 --> 02:11:14,416
mentality to sit for 12

1705
02:11:14,416 --> 02:11:15,899
hours at a computer trying to

1706
02:11:15,966 --> 02:11:20,183
get a shell or to try to do pen testing

1707
02:11:20,183 --> 02:11:21,583
or red teaming or what have

1708
02:11:21,583 --> 02:11:22,500
you. And I realized, well,

1709
02:11:22,600 --> 02:11:26,266
okay, I probably should move to a PM type

1710
02:11:26,266 --> 02:11:26,899
management role,

1711
02:11:26,899 --> 02:11:28,100
which is why I ended up at

1712
02:11:28,100 --> 02:11:32,866
Leviathan with our friend. And I'd like

1713
02:11:32,866 --> 02:11:34,083
to think I'm good at being

1714
02:11:34,083 --> 02:11:37,983
a PM, but yeah, I've found

1715
02:11:37,983 --> 02:11:40,933
myself at a crossroads because I'm now

1716
02:11:40,933 --> 02:11:43,516
colonoscopy years old and I

1717
02:11:43,516 --> 02:11:45,816
realized that you've got to do

1718
02:11:45,983 --> 02:11:48,899
something right with your life. I've got

1719
02:11:48,899 --> 02:11:51,883
to grow up and do something. So it's

1720
02:11:51,883 --> 02:11:52,899
good, good feedback.

1721
02:11:52,899 --> 02:11:55,983
I appreciate that. And, you know, there's

1722
02:11:55,983 --> 02:11:56,800
a lot of folks who say,

1723
02:11:56,800 --> 02:11:57,916
yeah, they're willing to take

1724
02:11:57,916 --> 02:11:59,500
those punches and willing to, you know,

1725
02:11:59,500 --> 02:12:00,399
make those, take those

1726
02:12:00,399 --> 02:12:01,983
hits until they actually end

1727
02:12:01,983 --> 02:12:04,433
up having to do so. And I think that's

1728
02:12:04,433 --> 02:12:06,266
where you, you, you, you,

1729
02:12:06,266 --> 02:12:08,016
you have, you prove your

1730
02:12:08,016 --> 02:12:10,000
medal, right? If, if, you know, you,

1731
02:12:10,000 --> 02:12:11,016
you'll find out at your

1732
02:12:11,016 --> 02:12:12,100
first board meeting, if you,

1733
02:12:12,133 --> 02:12:13,633
you get your ass handed to you and you're

1734
02:12:13,633 --> 02:12:14,816
finally, well, okay, this

1735
02:12:14,816 --> 02:12:16,899
was, this was awful or, you know,

1736
02:12:17,233 --> 02:12:22,899
what have you. But yeah. So

1737
02:12:22,899 --> 02:12:25,333
maybe another key there is

1738
02:12:28,116 --> 02:12:29,699
you don't necessarily treat

1739
02:12:29,699 --> 02:12:31,133
your mistakes as failures.

1740
02:12:33,533 --> 02:12:35,983
Oh, you understand that they're learning

1741
02:12:35,983 --> 02:12:36,883
opportunities.

1742
02:12:36,883 --> 02:12:38,183
They're ways to get better.

1743
02:12:39,166 --> 02:12:43,366
Okay. Okay. You mean like Edison, I

1744
02:12:43,366 --> 02:12:45,233
didn't fail at making a light bulb. I

1745
02:12:45,233 --> 02:12:46,000
just figured out another

1746
02:12:46,000 --> 02:12:48,383
way of not making a light bulb or it said

1747
02:12:48,383 --> 02:12:49,766
in context, right? So,

1748
02:12:49,966 --> 02:12:52,766
okay. Yeah. Okay. Very cool.

1749
02:12:53,733 --> 02:12:57,600
Um, okay. Well, uh, wow. Um, time, time

1750
02:12:57,600 --> 02:12:58,366
does fly when we're

1751
02:12:58,366 --> 02:12:59,266
having fun. I want to,

1752
02:12:59,266 --> 02:13:00,516
I want to talk a little bit about Goldie

1753
02:13:00,516 --> 02:13:03,233
Knox again. Um, uh,

1754
02:13:04,800 --> 02:13:05,533
what, what did, I mean,

1755
02:13:06,199 --> 02:13:08,616
I'm on your website and it's got a very

1756
02:13:08,616 --> 02:13:10,016
hypnotic background, which

1757
02:13:10,016 --> 02:13:13,383
I love. Uh, and, and you're,

1758
02:13:13,383 --> 02:13:14,916
you're doing a lot of different services,

1759
02:13:14,916 --> 02:13:16,100
uh, for enterprises

1760
02:13:16,100 --> 02:13:17,800
startups, which is something I've

1761
02:13:17,800 --> 02:13:19,183
actually, you know, one of the things

1762
02:13:19,183 --> 02:13:20,166
moving to San Diego, we

1763
02:13:20,166 --> 02:13:21,283
have a fairly healthy startup

1764
02:13:21,283 --> 02:13:22,933
community down here. And I was like, Oh,

1765
02:13:22,933 --> 02:13:25,199
I'd love to, you know, be a really cheap

1766
02:13:25,233 --> 02:13:27,183
security advisor to some of these folks

1767
02:13:27,183 --> 02:13:29,316
and, and whatever. And, um,

1768
02:13:30,000 --> 02:13:31,383
uh, when you're, when you're

1769
02:13:31,399 --> 02:13:33,416
talking to startups, you've got cyber

1770
02:13:33,416 --> 02:13:34,516
liability audits and

1771
02:13:34,516 --> 02:13:36,833
certifications. They must come to you

1772
02:13:36,833 --> 02:13:38,283
as a startup at some point and go, okay,

1773
02:13:38,283 --> 02:13:39,899
we've got a customer that's asking

1774
02:13:39,899 --> 02:13:41,583
questions, you know,

1775
02:13:41,583 --> 02:13:43,183
about how we're storing data or

1776
02:13:43,183 --> 02:13:45,066
something. I'm assuming at some point a

1777
02:13:45,066 --> 02:13:45,933
startup will come to you

1778
02:13:45,933 --> 02:13:49,283
and go, okay, we've reached a point where

1779
02:13:49,283 --> 02:13:51,216
people are actually asking about

1780
02:13:51,216 --> 02:13:52,399
security. And, and I

1781
02:13:52,399 --> 02:13:53,733
don't know if it's actually gotten lower

1782
02:13:53,733 --> 02:13:55,066
in the, the initialization

1783
02:13:55,066 --> 02:13:56,666
phase or the unicorn phase,

1784
02:13:56,699 --> 02:13:58,366
you know, before series A or whatever.

1785
02:13:59,066 --> 02:14:00,583
Um, have you noticed, you

1786
02:14:00,583 --> 02:14:02,116
know, from, from a Goldie

1787
02:14:02,199 --> 02:14:04,816
Knox part of point of view, when they've

1788
02:14:04,816 --> 02:14:05,733
started asking about

1789
02:14:05,733 --> 02:14:07,533
security, is it, is it become sooner

1790
02:14:07,533 --> 02:14:10,116
rather than later in the, in this

1791
02:14:10,116 --> 02:14:13,683
journey? Absolutely. Um, and

1792
02:14:13,683 --> 02:14:15,716
you know, one of the things

1793
02:14:19,000 --> 02:14:21,899
so people are more and more concerned as

1794
02:14:21,899 --> 02:14:24,266
products are more, um,

1795
02:14:25,033 --> 02:14:26,000
software as a service.

1796
02:14:27,000 --> 02:14:30,416
Right. Um, about making sure that their,

1797
02:14:30,416 --> 02:14:32,233
their data is secure and

1798
02:14:32,233 --> 02:14:35,333
there's more certifications

1799
02:14:36,199 --> 02:14:38,866
for those types of providers. You know,

1800
02:14:38,866 --> 02:14:40,116
when people were buying

1801
02:14:40,116 --> 02:14:42,066
software and just deploying it,

1802
02:14:43,316 --> 02:14:45,699
in data centers themselves, I think there

1803
02:14:45,699 --> 02:14:47,199
was less concern about that.

1804
02:14:47,500 --> 02:14:50,333
But now that I'm trusting my

1805
02:14:50,433 --> 02:14:53,883
data to the service, um, I have more

1806
02:14:53,883 --> 02:14:55,716
concern about that. So I

1807
02:14:55,716 --> 02:14:59,666
would, as a CSO, I would ask

1808
02:15:00,033 --> 02:15:03,716
earlier in the process process for a SOC

1809
02:15:03,716 --> 02:15:04,833
2 or something like

1810
02:15:04,833 --> 02:15:08,716
that. Um, and I think for

1811
02:15:10,683 --> 02:15:12,833
many providers that are offering SAS

1812
02:15:12,833 --> 02:15:16,733
services, it's actually a deal

1813
02:15:16,733 --> 02:15:19,000
lender. If they don't have a,

1814
02:15:19,183 --> 02:15:24,933
a SOC or a SOC, um, to type two, I know

1815
02:15:24,933 --> 02:15:26,183
there's, there's been

1816
02:15:26,183 --> 02:15:27,566
companies I wouldn't

1817
02:15:27,733 --> 02:15:28,883
do business with because

1818
02:15:28,883 --> 02:15:29,899
they didn't have a SOC.

1819
02:15:32,283 --> 02:15:36,983
That makes sense. Yeah. But yeah, so it's

1820
02:15:36,983 --> 02:15:38,383
definitely earlier and

1821
02:15:38,383 --> 02:15:40,666
I would, you know, I,

1822
02:15:40,699 --> 02:15:46,100
this is me being a salesperson without my

1823
02:15:46,100 --> 02:15:49,583
sales hat on. Um, the earlier

1824
02:15:49,583 --> 02:15:51,283
you bring a security advisor

1825
02:15:51,483 --> 02:15:55,216
in, especially if you're building a

1826
02:15:55,216 --> 02:15:58,800
product, the better you are, because if

1827
02:15:58,800 --> 02:16:00,966
you build those, um,

1828
02:16:01,216 --> 02:16:05,199
controls in from day one, number one, you

1829
02:16:05,199 --> 02:16:06,466
don't have to retrofit them

1830
02:16:06,466 --> 02:16:07,866
later. They don't, they're

1831
02:16:07,899 --> 02:16:10,866
not as expensive. Number two, you

1832
02:16:10,866 --> 02:16:13,033
establish good practices right up front.

1833
02:16:14,116 --> 02:16:15,816
Um, and our friend that

1834
02:16:15,816 --> 02:16:19,333
we've mentioned from Leviathan, um, is

1835
02:16:19,333 --> 02:16:22,733
really good at advising on

1836
02:16:22,733 --> 02:16:24,733
those services from a software

1837
02:16:24,733 --> 02:16:27,816
delivery perspective. Oh yeah. And I

1838
02:16:27,816 --> 02:16:30,800
think that's one of our shared passions

1839
02:16:30,800 --> 02:16:32,583
is making sure we're

1840
02:16:32,600 --> 02:16:35,700
building better software. Yeah. That's

1841
02:16:35,700 --> 02:16:38,133
yeah, that's awesome. Um, I also, you

1842
02:16:38,133 --> 02:16:39,066
know, just looking at

1843
02:16:39,066 --> 02:16:41,716
your partnerships on your page. Uh, I, I

1844
02:16:41,716 --> 02:16:43,183
also know one of the other companies

1845
02:16:43,183 --> 02:16:45,633
there that is, is, um,

1846
02:16:46,233 --> 02:16:48,516
pretty, pretty good too. So, uh, yeah, I,

1847
02:16:48,516 --> 02:16:51,483
I think, uh, yeah, I

1848
02:16:51,483 --> 02:16:52,716
think it's, it's, you know,

1849
02:16:53,433 --> 02:16:55,783
good to have, you know, good

1850
02:16:55,783 --> 02:16:58,000
partnerships. It's good to, you know,

1851
02:16:58,000 --> 02:16:58,983
bring in security as soon as

1852
02:16:59,016 --> 02:17:02,983
possible. But, um, you know, it, it

1853
02:17:02,983 --> 02:17:04,983
obviously shows due diligence, right?

1854
02:17:04,983 --> 02:17:05,916
When, when a company's like,

1855
02:17:05,916 --> 02:17:07,483
Hey, you know, when, when you're

1856
02:17:07,483 --> 02:17:09,733
self-aware enough to go, maybe we should

1857
02:17:09,733 --> 02:17:10,933
have security. Maybe we

1858
02:17:10,933 --> 02:17:12,283
should talk to somebody about that S

1859
02:17:12,283 --> 02:17:14,233
word, uh, before, you know,

1860
02:17:14,383 --> 02:17:15,566
maybe even before somebody

1861
02:17:15,566 --> 02:17:17,216
customer comes in and goes, Hey, you

1862
02:17:17,216 --> 02:17:19,666
know, we want to give you, you know,

1863
02:17:20,083 --> 02:17:20,733
millions of dollars,

1864
02:17:20,833 --> 02:17:22,916
but we need this. So having that

1865
02:17:22,916 --> 02:17:26,116
proactive approach is, I hope it's

1866
02:17:26,116 --> 02:17:27,216
something you see a lot of and not

1867
02:17:27,233 --> 02:17:29,333
like, Oh my God, we need to do this now.

1868
02:17:29,333 --> 02:17:29,966
And, you know, we've got

1869
02:17:29,966 --> 02:17:31,016
something coming up in a month

1870
02:17:31,016 --> 02:17:32,933
or whatever. I bet you get those too.

1871
02:17:33,133 --> 02:17:34,866
But, um, you know, I, I

1872
02:17:34,866 --> 02:17:36,366
imagine the, the more proactive

1873
02:17:36,366 --> 02:17:38,600
approaches are always the, the ones that

1874
02:17:38,600 --> 02:17:41,316
end up being better for you. So yeah.

1875
02:17:41,666 --> 02:17:44,200
And, you know, it's,

1876
02:17:44,500 --> 02:17:48,416
customers have a lot more leeway when a

1877
02:17:48,416 --> 02:17:51,216
company can say we're in

1878
02:17:51,216 --> 02:17:53,216
process with our SOC 2 type one.

1879
02:17:53,966 --> 02:17:56,983
Right. Right. You know, if, if you can

1880
02:17:56,983 --> 02:18:00,166
say that as a company, most of your

1881
02:18:00,166 --> 02:18:01,983
customers will say, Oh,

1882
02:18:02,533 --> 02:18:06,100
okay. When's it do great. And they now

1883
02:18:06,100 --> 02:18:10,033
have a path forward. Right. Right.

1884
02:18:10,433 --> 02:18:11,566
Especially if you can say,

1885
02:18:11,566 --> 02:18:14,233
we've already, you know, engaged somebody

1886
02:18:14,233 --> 02:18:15,416
services, we have an

1887
02:18:15,416 --> 02:18:16,666
audit company on the line.

1888
02:18:17,316 --> 02:18:23,783
Yep. Yep. Makes sense. Yeah. Um, I'm

1889
02:18:23,783 --> 02:18:25,666
going to ask any last question, any

1890
02:18:25,666 --> 02:18:26,833
questions from the chat

1891
02:18:26,833 --> 02:18:29,933
before we go. Any questions? Last call.

1892
02:18:31,166 --> 02:18:33,700
Because, uh, uh, Mary's

1893
02:18:33,700 --> 02:18:35,683
time is not billable here, but

1894
02:18:35,683 --> 02:18:37,283
you know, it should have been, uh, we

1895
02:18:37,283 --> 02:18:37,466
should have made this billable time for her. Uh, so,

1896
02:18:38,033 --> 02:18:45,333
uh, yeah. Uh, okay. So I'm going to call

1897
02:18:45,333 --> 02:18:47,666
it, uh, Mary, uh, you know,

1898
02:18:48,133 --> 02:18:49,616
golden knocks seems to be going

1899
02:18:49,616 --> 02:18:52,716
well. Uh, Oh, uh, okay. So one of our

1900
02:18:52,716 --> 02:18:54,933
friends GoPro Slo-Yo says, uh, what kind

1901
02:18:54,933 --> 02:18:56,433
of fraction do you do

1902
02:18:56,433 --> 02:18:59,083
fractional type CSO work? Frac is

1903
02:18:59,083 --> 02:19:00,000
fractional different than

1904
02:19:00,000 --> 02:19:01,616
virtual? I don't necessarily

1905
02:19:02,316 --> 02:19:06,583
see. I don't necessarily consider it much

1906
02:19:06,583 --> 02:19:08,316
different. Um, okay.

1907
02:19:08,833 --> 02:19:10,433
But it's, it's providing

1908
02:19:10,433 --> 02:19:13,783
services for part of a week. Yes, we do.

1909
02:19:14,233 --> 02:19:16,233
Okay. Okay. Very cool.

1910
02:19:16,666 --> 02:19:20,833
Um, very nice. Um, yeah. Uh,

1911
02:19:20,916 --> 02:19:23,683
yeah. GoPro, uh, check out golden

1912
02:19:23,683 --> 02:19:25,683
knocks.com, man. Uh, you

1913
02:19:25,683 --> 02:19:27,383
know, uh, you know, if y'all need

1914
02:19:27,483 --> 02:19:30,016
anything, um, amazing people who work

1915
02:19:30,016 --> 02:19:31,899
there, by the way, uh, Mary,

1916
02:19:31,899 --> 02:19:33,216
if people wanted to talk more

1917
02:19:33,216 --> 02:19:35,700
about being a CSO or, Hey, I think I

1918
02:19:35,700 --> 02:19:37,133
could be a CSO, please

1919
02:19:37,133 --> 02:19:39,366
mentor me or whatever. Uh, how,

1920
02:19:39,366 --> 02:19:40,366
how would they get ahold of you? How

1921
02:19:40,366 --> 02:19:42,000
would they, how would they contact? Um,

1922
02:19:42,716 --> 02:19:45,899
email M gardener. Okay.

1923
02:19:45,899 --> 02:19:50,500
At golden knocks.com. Okay. And my

1924
02:19:50,500 --> 02:19:55,283
LinkedIn profile and, uh,

1925
02:19:55,283 --> 02:19:56,100
that's pretty much the best

1926
02:19:56,133 --> 02:19:58,666
ways to get a, get ahold of me. Um, if

1927
02:19:58,666 --> 02:20:03,916
they want to call 206-218-6900. Okay.

1928
02:20:03,916 --> 02:20:05,366
Very nice. Very nice.

1929
02:20:05,933 --> 02:20:08,816
Uh, on, on other than LinkedIn, are you

1930
02:20:08,816 --> 02:20:09,983
on any social medias

1931
02:20:09,983 --> 02:20:11,233
or anything like that?

1932
02:20:13,549 --> 02:20:16,183
I have not a very active, uh, poster on

1933
02:20:16,183 --> 02:20:18,383
social media. That's fine.

1934
02:20:18,383 --> 02:20:19,616
It's, it's probably for the

1935
02:20:19,616 --> 02:20:21,566
better. You know, it's, it's just another

1936
02:20:21,566 --> 02:20:23,416
point of stress. You've

1937
02:20:23,416 --> 02:20:24,266
already got enough being a

1938
02:20:24,283 --> 02:20:26,566
fractional CSO and auditor and all this

1939
02:20:26,566 --> 02:20:28,016
stuff. So you don't need the

1940
02:20:28,016 --> 02:20:29,399
social media stuff as well.

1941
02:20:29,399 --> 02:20:33,733
So that makes sense. Well, somebody told

1942
02:20:33,733 --> 02:20:36,466
me a very long time ago, when you put

1943
02:20:36,466 --> 02:20:37,483
something out there,

1944
02:20:38,816 --> 02:20:41,783
it's really hard to get it back. Oh yeah.

1945
02:20:42,299 --> 02:20:43,666
Yeah. Yeah. That's true.

1946
02:20:44,100 --> 02:20:45,899
So, you know, my, my cat has

1947
02:20:45,899 --> 02:20:48,833
a Facebook account. Occasionally she will

1948
02:20:48,833 --> 02:20:50,583
post something, but that's

1949
02:20:50,583 --> 02:20:52,183
not it. That's fantastic.

1950
02:20:52,583 --> 02:20:56,333
Yeah. Yeah. My, my cats are actually

1951
02:20:56,333 --> 02:20:58,100
surprisingly gone. I would have brought

1952
02:20:58,100 --> 02:20:58,899
mom and Katie on here

1953
02:20:58,899 --> 02:21:00,700
and let you, let you check out mom and

1954
02:21:00,700 --> 02:21:04,516
Katie, but, um, very nice. Um, cool.

1955
02:21:04,516 --> 02:21:05,533
Well, yeah, like I said,

1956
02:21:05,533 --> 02:21:07,683
check out golden ox. Um, I'd like to

1957
02:21:07,683 --> 02:21:09,033
thank onyx for reaching

1958
02:21:09,033 --> 02:21:11,083
out and saying, Hey, and, uh,

1959
02:21:11,083 --> 02:21:14,033
get it making this happen. Um, um, very,

1960
02:21:14,266 --> 02:21:15,233
very happy to have met

1961
02:21:15,233 --> 02:21:17,633
onyx and yourself. And, um,

1962
02:21:18,350 --> 02:21:20,733
I wish, wish y'all the best and hope for

1963
02:21:20,733 --> 02:21:22,100
continued success for, for,

1964
02:21:22,100 --> 02:21:24,816
for golden ox. And, uh, we'll

1965
02:21:25,149 --> 02:21:26,516
definitely have to have y'all back on at

1966
02:21:26,516 --> 02:21:27,166
some point in the near

1967
02:21:27,166 --> 02:21:28,983
future, uh, to, to talk about

1968
02:21:28,983 --> 02:21:30,783
some other things, some compliance, some

1969
02:21:30,783 --> 02:21:32,666
GRC stuff. I'm, I'm all

1970
02:21:32,666 --> 02:21:34,316
in on that stuff. Uh, I've,

1971
02:21:34,316 --> 02:21:35,799
I've actually changed how I feel about

1972
02:21:35,799 --> 02:21:39,166
GRC now in the past few years on this.

1973
02:21:39,366 --> 02:21:41,183
So, um, very cool. So,

1974
02:21:41,183 --> 02:21:42,666
Mary, thank you so much for, for being

1975
02:21:42,666 --> 02:21:45,700
here. Uh, and, uh, yeah, that

1976
02:21:45,700 --> 02:21:46,766
was, that was it for breaking

1977
02:21:47,233 --> 02:21:49,216
security, uh, breaking education this

1978
02:21:49,216 --> 02:21:51,466
week. Uh, you know, Mr.

1979
02:21:51,466 --> 02:21:52,466
Betcher can be found at

1980
02:21:52,466 --> 02:21:54,700
betcher poned on Twitter, B O E T T C H E

1981
02:21:54,700 --> 02:21:57,233
R P W N E D. Uh, miss

1982
02:21:57,233 --> 02:21:58,816
Berlin, who would have been here,

1983
02:21:58,816 --> 02:22:01,116
except she's entertaining people who came

1984
02:22:01,116 --> 02:22:02,216
in for the silver eclipse

1985
02:22:02,216 --> 02:22:04,266
tomorrow, uh, can be found at

1986
02:22:04,266 --> 02:22:08,266
info sister INFOSYSTIR. Uh, she also runs

1987
02:22:08,266 --> 02:22:09,516
the nonprofit hackers

1988
02:22:09,516 --> 02:22:11,033
health, which does villages

1989
02:22:11,233 --> 02:22:13,483
at conferences for, uh, you know,

1990
02:22:13,483 --> 02:22:14,500
bringing awareness to

1991
02:22:14,500 --> 02:22:16,433
mental health issues. And you can

1992
02:22:16,433 --> 02:22:18,983
find that at, um, on, on hackers health

1993
02:22:18,983 --> 02:22:21,333
on, on Twitter as well. And

1994
02:22:21,333 --> 02:22:22,233
you can find me on Twitter,

1995
02:22:22,533 --> 02:22:25,399
Brian break. And you can find me on

1996
02:22:25,399 --> 02:22:27,666
LinkedIn, uh, linkedin.com

1997
02:22:27,666 --> 02:22:29,833
forward slash iron forward slash

1998
02:22:29,833 --> 02:22:32,366
break B. So it's really easy to find. Um,

1999
02:22:32,566 --> 02:22:33,216
but that was it for

2000
02:22:33,216 --> 02:22:34,200
breaking down security this week.

2001
02:22:34,366 --> 02:22:35,566
Hope you have a great week. Thank you

2002
02:22:35,566 --> 02:22:36,700
again, Mary for your time

2003
02:22:36,700 --> 02:22:37,933
and appreciate that so much.

2004
02:22:38,600 --> 02:22:40,416
And, um, you know, take care of

2005
02:22:40,416 --> 02:22:41,700
yourselves. Uh, as

2006
02:22:41,700 --> 02:22:42,683
we're fond of saying here,

2007
02:22:42,683 --> 02:22:45,166
you're the only you, you have, and we

2008
02:22:45,166 --> 02:22:46,766
will talk to you again soon. Bye.