WEBVTT
00:00:13.942 --> 00:00:15.149
and hello.
00:00:15.149 --> 00:00:15.639
I'm Dr.
00:00:15.639 --> 00:00:25.405
Joye Purser, Global Field CISO of Cohesity, and I'm so glad that you've joined us for a
live episode of our podcast called Zero Downtime.
00:00:25.405 --> 00:00:30.948
We know that security leaders have zero downtime because the threats never stop.
00:00:30.948 --> 00:00:38.991
And so the purpose is to help educate at the operational level some lessons learned by
leaders in the field.
00:00:38.991 --> 00:00:44.574
Today, I am delighted to have Erin Joe with me as my guest
00:00:44.574 --> 00:00:46.544
Erin, please introduce yourself.
00:00:46.544 --> 00:00:47.534
Hello everyone, enjoy.
00:00:47.534 --> 00:00:48.546
Thank you for having me.
00:00:48.546 --> 00:00:56.430
I'm Erin Joe, and I had a long career in the FBI before going into Mandiant and then
Google Cloud.
00:00:56.430 --> 00:01:04.455
And now I have joined Wiley Ryan's law firm where I'm enabling their cyber practice,
helping our clients before, during, and after cyber incidents.
00:01:04.455 --> 00:01:13.450
And I will say very briefly that although I had a long career in the FBI, I have to give a
disclaimer here, Disclaimer that I'm no longer in the government and so all of my
00:01:13.450 --> 00:01:17.644
conversations today will be based on my personal experience and personal opinions.
00:01:17.644 --> 00:01:18.616
Fantastic.
00:01:18.616 --> 00:01:28.229
So Erin, you bridge the legal profession with security risk as well as the management and
protection of big data.
00:01:28.229 --> 00:01:34.674
And so talk to us on the first topic that we discussed about data security.
00:01:34.735 --> 00:01:40.359
Yeah, so it's really interesting when you think about it because organizations hold data
of all kinds.
00:01:40.359 --> 00:01:45.171
They hold their own data, they hold the data of others, and they're entrusted with that
data.
00:01:45.171 --> 00:01:49.963
And for most organizations, they don't really think about...
00:01:50.388 --> 00:01:54.671
how comprehensive that risk really is and how to manage it comprehensively.
00:01:54.671 --> 00:01:56.704
So you have to think about a number of things.
00:01:56.704 --> 00:02:02.218
You have to think about, you have good data governance in place and can you enforce it in
a way that matters?
00:02:02.218 --> 00:02:13.824
Can you prove that you can take care of that data and prove that you're protecting it, not
only from a legal compliance perspective, but really just from a trustworthiness
00:02:13.824 --> 00:02:19.196
perspective and recognizing that much of the data is regulated in some way.
00:02:19.567 --> 00:02:29.833
and if it's breached and compromised in some way, you may have a number of reporting
requirements or notification requirements, but then there's also the goodwill and
00:02:29.833 --> 00:02:38.739
trustworthiness of letting people know that you've had an incident and letting them know
that what care you took to protect their data, what may have been compromised, and what
00:02:38.739 --> 00:02:40.761
steps need to be taken next.
00:02:40.761 --> 00:02:45.184
So there's a whole host of things that go around being entrusted with data.
00:02:45.184 --> 00:02:47.967
And what comes to mind very briefly is,
00:02:47.967 --> 00:02:58.111
I mentioned about the governance, I mentioned about proving, right, your ability to take
care of it as well as your ability to track and trace it, but then also on the back end,
00:02:58.111 --> 00:03:08.515
being able to do analytics on that data and being able to do an impact or damage
assessment on the back end of that is critically important, not only for you, but for the
00:03:08.515 --> 00:03:13.645
other organizations that lost data as well and are impacted by that compromise.
00:03:13.645 --> 00:03:19.548
So in the past two minutes, you've used the word trust eh three times.
00:03:20.573 --> 00:03:21.413
And...
00:03:22.103 --> 00:03:29.386
I'd say a few years ago at the RSA conference, zero trust was a term that was used so
much.
00:03:29.726 --> 00:03:45.773
And I believe that that's fairly well understood in terms of the technical perspective and
guardrails, policies in place to cordon off, classify, protect sensitive data.
00:03:45.954 --> 00:03:48.895
But in terms of trust now,
00:03:50.767 --> 00:03:57.232
It goes far beyond that, and from a business perspective, trust is reputational risk.
00:03:57.232 --> 00:04:00.415
Not only data security risk.
00:04:00.415 --> 00:04:04.178
trust and risk tend to go hand in hand.
00:04:04.178 --> 00:04:15.802
And so, in the legal profession, and specifically with security expertise, where do you
see the term trust used a lot in your daily life?
00:04:15.802 --> 00:04:23.722
Yeah, that's a really interesting question because I think organizations inherently know
that their business is built on trust.
00:04:23.722 --> 00:04:30.762
But then as they evaluate what they're going to do, typically it's a very legalistic
analysis.
00:04:31.442 --> 00:04:38.822
So it's a really interesting question because I think organizations would be better served
to think of those together.
00:04:39.802 --> 00:04:45.282
Not only what am I legally required to do or what am I...
00:04:45.818 --> 00:04:47.580
What are my obligations?
00:04:47.580 --> 00:04:57.065
But what is the right thing to do for the organization and for the company and for your
customers or whoever it is that you serve?
00:04:57.085 --> 00:04:59.346
Why are you in business in the first place?
00:05:00.633 --> 00:05:12.170
And I think that's where those two ideas converge in a really lovely way and can impact
decision making in a way that can best suit an organization.
00:05:12.170 --> 00:05:19.569
So for example, you may have legal notification obligations or reporting requirements if
you have a cyber incident.
00:05:19.569 --> 00:05:22.173
and those you have to follow.
00:05:22.173 --> 00:05:28.920
So an organization may not have significant decision making around that because it's a
requirement.
00:05:29.221 --> 00:05:38.290
But then there are many situations in which there may not be a legal obligation, but it
may be wise to do so.
00:05:38.290 --> 00:05:40.532
It may build trust to do so.
00:05:40.652 --> 00:05:42.333
And if you had...
00:05:43.126 --> 00:05:47.917
a reporting requirement, you also run the risk of others finding out, right?
00:05:47.917 --> 00:05:49.508
So that's a risk.
00:05:49.508 --> 00:06:00.411
But then even if you're in a situation where you think no one will find out because it's
internal to you, we really live in a world today where data gets out and gets exposed.
00:06:00.411 --> 00:06:03.432
And then the questions start to come, well, how did this data get out?
00:06:03.432 --> 00:06:05.952
How did this data get exposed?
00:06:05.952 --> 00:06:11.520
So those raise a lot of questions that could become the source of an investigation by a
federal agency.
00:06:11.520 --> 00:06:12.794
It could become,
00:06:12.864 --> 00:06:21.487
a regulatory issue, it could become a privacy issue, and then if the roads lead back to
your organization, it really doesn't look good for your organization to not have come
00:06:21.487 --> 00:06:22.957
forward first.
00:06:22.998 --> 00:06:33.201
So to build trust, you want to own the narrative, and you want to be the one demonstrating
that you are trustworthy, that you're doing the right thing, that you're letting people
00:06:33.201 --> 00:06:35.422
know what has happened, you're...
00:06:36.034 --> 00:06:46.000
providing support and assistance, you're doing your own impact or damage assessment to
what it means to your organization, but you're also supporting what kind of harm could
00:06:46.000 --> 00:06:48.802
come to other organizations whose data was lost.
00:06:48.802 --> 00:06:58.589
All those things are the things that build trust, more so than a report that said, I had
an incident, here's what happened, I'm making my mandatory requirement disclosures.
00:06:58.589 --> 00:07:00.062
That's a check the box.
00:07:00.062 --> 00:07:00.905
Yes.
00:07:01.108 --> 00:07:05.030
but it doesn't build trust across the organization and with your clients.
00:07:05.030 --> 00:07:10.913
No, and there are real business impacts with the degradation of trust of a business.
00:07:10.913 --> 00:07:18.137
And we've seen that to devastating effect oh over time and with specific businesses and
sectors.
00:07:18.137 --> 00:07:30.905
And I would say thank goodness for new technical controls that allow us greater visibility
into whether we are storing and working with sensitive data.
00:07:30.905 --> 00:07:32.075
So for example,
00:07:32.075 --> 00:07:39.511
with Cohesity, as you know, we're a software company that sells backups and other software
and hardware.
00:07:39.511 --> 00:07:46.738
And our why is that we're there for customers on their worst day.
00:07:46.738 --> 00:07:59.210
We see cyber attacks and we think deeply on how do we do our very best so that they can
recover in such a way that there is minimal to no impact
00:07:59.210 --> 00:08:05.894
on business operations and therefore company reputation and more broadly trust.
00:08:06.195 --> 00:08:19.084
And I would say without getting too much into technical details that an innovation we're
proud of is that our backups have data security posture management, DSPM, that is powered
00:08:19.084 --> 00:08:23.707
by Sierra, which is the best of breed in the DSPM business.
00:08:23.707 --> 00:08:28.211
But what it does is it allows organizations
00:08:28.211 --> 00:08:39.803
to see clearly if they have protected health information, oh protected individual, private
information in the secondary data.
00:08:39.966 --> 00:08:53.142
So in the backups, which historically have been like an iceberg in that we see the primary
production data, but what's underneath the surface has been invisible.
00:08:53.682 --> 00:09:04.217
And if you're backing up data that has PHI, there are legal consequences, trust
consequences, reputational damage if that is discovered.
00:09:04.217 --> 00:09:10.013
So I think it's a great innovation and I love to see how tech is rising to meet those
trust
00:09:10.013 --> 00:09:10.906
risks.
00:09:10.906 --> 00:09:13.738
Yeah, you you raised a lot of really important points.
00:09:13.738 --> 00:09:16.720
Organizations struggle, and I've seen it first-hand.
00:09:16.720 --> 00:09:28.506
So from years of experience of being over some of the largest data breaches in the world
and seeing how organizations are able or not able to respond well to that.
00:09:28.506 --> 00:09:35.389
And when you think of incident response, you typically think about can I get my network
and process these back up and running?
00:09:35.389 --> 00:09:38.922
But you don't always think about the long data tail that follows.
00:09:38.922 --> 00:09:42.435
is it's long and challenging for most organizations.
00:09:42.435 --> 00:09:46.878
So you have to then know, was the data accessed in an unauthorized manner?
00:09:46.878 --> 00:09:48.399
Was it exfiltrated?
00:09:48.399 --> 00:09:49.579
Was it taken?
00:09:49.579 --> 00:09:50.290
How do I know?
00:09:50.290 --> 00:09:54.101
How can I prove what was taken and how can I prove what wasn't taken?
00:09:54.162 --> 00:09:59.006
Then you have, like I mentioned, the notifications responsibility or obligations.
00:09:59.006 --> 00:10:01.287
You may have regulatory obligations.
00:10:01.287 --> 00:10:07.071
You may have, like you say, the PII, PHI, like all of those obligations.
00:10:07.071 --> 00:10:11.563
But then you have your own damage or impact assessment and then assisting those who have
to do their own.
00:10:11.563 --> 00:10:21.397
So I walk through that specifically now because you're saying, well, gee, it's not only
for the data that may or may not have been impacted as part of the incident, but now you
00:10:21.397 --> 00:10:22.718
also have the data
00:10:22.718 --> 00:10:25.220
that you need to bring back up as part of your backups, right?
00:10:25.220 --> 00:10:28.463
So you have the same data twice that you're dealing with.
00:10:28.463 --> 00:10:31.486
Oftentimes threat actors access the backups as well.
00:10:31.486 --> 00:10:33.688
Or try to corrupt the backups in some way.
00:10:33.688 --> 00:10:40.102
So now you have a number of different times and ways that you need to be concerned about
protecting the data, right?
00:10:40.102 --> 00:10:50.819
Not just in active use, but also in your various backups and being able to trace what the
threat actor did and then being able to, with confidence, say what happened to that data.
00:10:50.819 --> 00:10:54.061
and whether or not it was protected or part of the compromise.
00:10:54.061 --> 00:10:58.925
So I think having technical capabilities that enable that are critical.
00:10:58.925 --> 00:11:05.029
I also think about having good data governance and good data governance enforcement is
critical.
00:11:05.029 --> 00:11:10.413
And I always tell people, data that's deleted is at a much lower risk to your
organization.
00:11:10.413 --> 00:11:12.024
So delete some of this data, right?
00:11:12.024 --> 00:11:14.155
You don't necessarily have to keep all of it.
00:11:14.155 --> 00:11:19.159
But then being able to map it and know what was at risk or what wasn't is really critical.
00:11:19.159 --> 00:11:20.339
But afterwards,
00:11:20.460 --> 00:11:31.087
that analysis and having insight into the types of data that you were responsible for and
being able to show the picture of what that meant from an impact standpoint to your
00:11:31.087 --> 00:11:33.481
organization or to others is absolutely critical.
00:11:33.481 --> 00:11:34.384
Fantastic.
00:11:34.384 --> 00:11:37.465
You know, we talked about resilience takes practice.
00:11:38.806 --> 00:11:40.507
And I love that idea.
00:11:40.608 --> 00:11:52.725
And one of the key things that I learned from years of government and years of crisis
management in the FBI and elsewhere and related to the cyber world is that you need to
00:11:52.725 --> 00:11:54.375
continually prepare.
00:11:54.496 --> 00:11:56.717
It needs to become muscle memory.
00:11:57.610 --> 00:12:08.417
you have to test for stress because oftentimes people want to do the tabletop exercises on
the easy things, but they don't really want to test for the stress that your organization
00:12:08.417 --> 00:12:11.100
will encounter in a major incident.
00:12:11.100 --> 00:12:17.625
And that kind of stress is, it's emotional fatigue on an organization, it's financial.
00:12:17.772 --> 00:12:20.307
fatigue on an organization.
00:12:20.469 --> 00:12:23.515
It's a significant business disruption.
00:12:25.716 --> 00:12:35.421
as you're restoring your capabilities to do your day-to-day work, your same employees are
still the ones that need to deal with that long tail that I talked about that happens when
00:12:35.421 --> 00:12:37.441
you have to evaluate now what?
00:12:37.441 --> 00:12:42.173
What are the consequences of having just gone through a major data breach?
00:12:42.654 --> 00:12:46.336
So being able to prepare for that kind of stress is really critical.
00:12:46.336 --> 00:12:54.539
And then building a community around you to be able to support you through a major
incident is a key part of that resilience.
00:12:54.640 --> 00:12:55.680
So being able to have
00:12:55.680 --> 00:13:01.044
partnerships with data companies and those that secure data or can help you identify your
data.
00:13:01.044 --> 00:13:14.052
Having strong relationships and retainers with your incident responders and your law firms
and your ransomware negotiators and all the people that you need to bring in to be there
00:13:14.052 --> 00:13:19.936
with you and for you throughout the course of your incident management is absolutely
important.
00:13:19.936 --> 00:13:25.600
And I do still put in a big plug for having good strong relationships across government,
including the
00:13:25.600 --> 00:13:26.853
FBI, right?
00:13:26.853 --> 00:13:31.116
It's a critical part of the community and building that resilience.
00:13:31.116 --> 00:13:35.458
So I've got a little story to share when it comes to a stress test.
00:13:35.458 --> 00:13:44.602
So you and I have, in our work, had many, many, conversations with CISOs, Chief
Information Security Officers, Chief Security Officers.
00:13:44.602 --> 00:13:54.607
And I sat once with a logistics company, and the CIO and the CISO were in the room, and
some operator level staff.
00:13:54.607 --> 00:13:59.509
And they talked about how they had just begun doing tabletop exercises
00:13:59.849 --> 00:14:04.551
that included the backups, which is what I've been advising even when I was at CISA.
00:14:04.851 --> 00:14:16.134
And they shared that the first time that happened that they did the exercise that included
the backups that basically the backups team did this.
00:14:16.874 --> 00:14:23.236
Like, I'm sorry but we can't do anything and we don't know what else to do.
00:14:25.840 --> 00:14:31.415
There were two lessons learned there, one for operators and one for senior executives.
00:14:31.415 --> 00:14:36.531
the lesson for the operators is that this is not a blame game.
00:14:37.993 --> 00:14:42.736
that with repetition, that you get better.
00:14:43.061 --> 00:14:51.830
And just like any exercise, physical exercise or cyber, it's hard at the beginning and
then it gets better.
00:14:52.411 --> 00:14:59.158
So for them, was an important learning and they got better with subsequent exercises.
00:14:59.158 --> 00:15:01.640
And from the CISO perspective...
00:15:03.717 --> 00:15:18.110
It's so important for executives to message properly and to make sure that the backup
team, who they usually don't manage because they're in IT, to say to them, I'm not your
00:15:18.110 --> 00:15:22.054
boss, but you're going to be an integral part of a recovery.
00:15:22.054 --> 00:15:24.496
And I need you to be part of this.
00:15:24.496 --> 00:15:29.179
And I'm not doing this to embarrass you or anyone else.
00:15:29.522 --> 00:15:35.128
but for defense in depth, you are essential, and so this is what we're going to do.
00:15:35.128 --> 00:15:37.256
What do you say about that?
00:15:37.256 --> 00:15:42.906
So I've always said that your organization is not really ready until every person in your
organization is ready.
00:15:42.906 --> 00:15:48.706
If they don't know what their role is in an incident and they don't understand where they
fall in function.
00:15:48.706 --> 00:15:55.680
then you're not really ready and you're not doing your organization the service it
deserves if you haven't prepared them properly.
00:15:55.680 --> 00:16:01.895
Leaders think about, how do I get the business back up and operational, right?
00:16:01.895 --> 00:16:04.676
But you also have to think about, well, what does it take?
00:16:04.676 --> 00:16:05.576
What are the demands?
00:16:05.576 --> 00:16:07.137
Who needs to do what?
00:16:07.573 --> 00:16:08.964
Who will be my leaders?
00:16:08.964 --> 00:16:09.955
Do I have a bench?
00:16:09.955 --> 00:16:11.357
I always say build a bench.
00:16:11.357 --> 00:16:23.427
Build a bench of leaders because you're going to need leadership maybe 24-7 over the
course of months even to lead through any incident and recovery situation.
00:16:23.669 --> 00:16:30.012
And then to be able to handle that long tail I always talk about with respect to the 'Now
what does this mean for organization?
00:16:30.012 --> 00:16:31.833
Do we need to technically rebuild?
00:16:31.833 --> 00:16:34.114
Do we need to handle the data?
00:16:34.114 --> 00:16:38.016
Do we need to do an impact assessment?' All those things that we've been talking about.
00:16:38.016 --> 00:16:47.851
But if you don't have a bench of leaders who understand what it takes and who is going to
own certain command and control of those different pillars that are so critically
00:16:47.851 --> 00:16:52.082
important, then your organization will start to crumble under that stress.
00:16:53.033 --> 00:17:05.434
from a leadership perspective, the other aspect of it now that I'm sitting in the legal
chair is your general counsel needs to understand how to quarterback the recovery as well
00:17:05.434 --> 00:17:16.264
and quarterback the incident and understand that while they're trying to manage some of
the investigative aspects that you may want under privilege that are often not considered
00:17:16.264 --> 00:17:17.264
early on.
00:17:17.787 --> 00:17:23.680
They could actually have some of the investigative activity handled under privilege that
could be very helpful to your organization.
00:17:23.680 --> 00:17:32.790
Recognizing also though that the facts are not privileged and there will be certain parts
of the investigation that will be available to the rest of the organization to be able to
00:17:32.790 --> 00:17:34.264
do something about.
00:17:34.264 --> 00:17:36.224
You have to act.
00:17:36.605 --> 00:17:38.255
You can't just sit there and admire it.
00:17:38.255 --> 00:17:40.506
It doesn't go away.
00:17:40.776 --> 00:17:43.607
So you have to be positioned to make decisions.
00:17:43.607 --> 00:17:50.509
You have to be positioned to have leaders who understand what part they own and how they
are expected to operate.
00:17:50.869 --> 00:17:53.560
And with what principle, right?
00:17:53.560 --> 00:17:55.191
What is your driving principle?
00:17:55.191 --> 00:17:56.631
And we've been talking about trust.
00:17:56.631 --> 00:17:58.572
I think trust is a driving principle.
00:17:58.572 --> 00:18:01.132
This is how we are going to react and respond.
00:18:01.132 --> 00:18:06.614
I always say you can't prepare for everything, but you can prepare for almost anything.
00:18:06.922 --> 00:18:07.774
That's true.
00:18:07.774 --> 00:18:16.220
If you have the right principles, you have the right leadership, if you've tested for
stress of some sort, then it doesn't matter what type of stress comes at you.
00:18:16.220 --> 00:18:19.081
You're going to be able to be resilient for it.
00:18:19.732 --> 00:18:20.863
Very well said.
00:18:20.863 --> 00:18:30.199
And I love how you succinctly discussed people and process and technology because
resilience requires all three.
00:18:30.199 --> 00:18:31.469
It does.
00:18:31.796 --> 00:18:34.107
Yeah, you can't forget any one of those.
00:18:34.127 --> 00:18:39.969
The process, I think, sometimes fails because the people aren't ready.
00:18:40.870 --> 00:18:50.434
You can have all the greatest processes, but if your people don't know how to exercise
them and use them, then you often end up with chaos and paralysis.
00:18:50.870 --> 00:18:51.242
And delays.
00:18:51.242 --> 00:18:51.420
Delays.
00:18:51.420 --> 00:18:52.481
And delays.
00:18:52.481 --> 00:18:53.561
Yeah.
00:18:53.741 --> 00:19:01.425
And those delays can cost your organization time, money, people, resources, reputation:
all those things.
00:19:02.125 --> 00:19:08.548
Building that resilience and building that uh muscle memory is absolutely critical.
00:19:08.628 --> 00:19:11.009
And there are things you can do in advance, right?
00:19:11.009 --> 00:19:15.992
So you can in advance map out your reporting obligations.
00:19:15.992 --> 00:19:19.874
You can map out in advance your contractual obligations.
00:19:19.874 --> 00:19:20.944
You can map out
00:19:20.944 --> 00:19:29.361
who would you want to notify just as part of that trust building, even if you don't have
an obligation?
00:19:29.963 --> 00:19:32.585
Well in advance, you can map out your data.
00:19:32.585 --> 00:19:34.707
You can map out your requirements with the data.
00:19:34.707 --> 00:19:39.931
You can map out the impact if that data were to be compromised.
00:19:40.570 --> 00:19:50.149
Those things can be handled in advance and those are areas that organizations don't
typically invest in on the front end, but they cost you a lot of time and money that you
00:19:50.149 --> 00:19:53.251
don't expect on the back end if you don't get it done.
00:19:53.496 --> 00:19:54.517
Agree.
00:19:54.918 --> 00:19:56.980
Well, we are out of time.
00:19:56.980 --> 00:20:08.995
And I just have to say, Aaron Joe, your perspective based on your experience and where you
are now contributing from security, from the legal perspective, it's just amazing.
00:20:08.995 --> 00:20:12.902
Thank you so much for being with us on this episode of Zero Downtime.
00:20:12.902 --> 00:20:13.894
Well, thank you, Joye.
00:20:13.894 --> 00:20:18.382
I think you've been a tremendous champion in this area.
00:20:18.423 --> 00:20:21.448
I think you're tremendous friend and colleague.
00:20:21.570 --> 00:20:24.234
And I just want to thank you for having me today.
00:00:13.942 --> 00:00:15.149
and hello.
00:00:15.149 --> 00:00:15.639
I'm Dr.
00:00:15.639 --> 00:00:25.405
Joye Purser, Global Field CISO of Cohesity, and I'm so glad that you've joined us for a
live episode of our podcast called Zero Downtime.
00:00:25.405 --> 00:00:30.948
We know that security leaders have zero downtime because the threats never stop.
00:00:30.948 --> 00:00:38.991
And so the purpose is to help educate at the operational level some lessons learned by
leaders in the field.
00:00:38.991 --> 00:00:44.574
Today, I am delighted to have Erin Joe with me as my guest
00:00:44.574 --> 00:00:46.544
Erin, please introduce yourself.
00:00:46.544 --> 00:00:47.534
Hello everyone, enjoy.
00:00:47.534 --> 00:00:48.546
Thank you for having me.
00:00:48.546 --> 00:00:56.430
I'm Erin Joe, and I had a long career in the FBI before going into Mandiant and then
Google Cloud.
00:00:56.430 --> 00:01:04.455
And now I have joined Wiley Ryan's law firm where I'm enabling their cyber practice,
helping our clients before, during, and after cyber incidents.
00:01:04.455 --> 00:01:13.450
And I will say very briefly that although I had a long career in the FBI, I have to give a
disclaimer here, Disclaimer that I'm no longer in the government and so all of my
00:01:13.450 --> 00:01:17.644
conversations today will be based on my personal experience and personal opinions.
00:01:17.644 --> 00:01:18.616
Fantastic.
00:01:18.616 --> 00:01:28.229
So Erin, you bridge the legal profession with security risk as well as the management and
protection of big data.
00:01:28.229 --> 00:01:34.674
And so talk to us on the first topic that we discussed about data security.
00:01:34.735 --> 00:01:40.359
Yeah, so it's really interesting when you think about it because organizations hold data
of all kinds.
00:01:40.359 --> 00:01:45.171
They hold their own data, they hold the data of others, and they're entrusted with that
data.
00:01:45.171 --> 00:01:49.963
And for most organizations, they don't really think about...
00:01:50.388 --> 00:01:54.671
how comprehensive that risk really is and how to manage it comprehensively.
00:01:54.671 --> 00:01:56.704
So you have to think about a number of things.
00:01:56.704 --> 00:02:02.218
You have to think about, you have good data governance in place and can you enforce it in
a way that matters?
00:02:02.218 --> 00:02:13.824
Can you prove that you can take care of that data and prove that you're protecting it, not
only from a legal compliance perspective, but really just from a trustworthiness
00:02:13.824 --> 00:02:19.196
perspective and recognizing that much of the data is regulated in some way.
00:02:19.567 --> 00:02:29.833
and if it's breached and compromised in some way, you may have a number of reporting
requirements or notification requirements, but then there's also the goodwill and
00:02:29.833 --> 00:02:38.739
trustworthiness of letting people know that you've had an incident and letting them know
that what care you took to protect their data, what may have been compromised, and what
00:02:38.739 --> 00:02:40.761
steps need to be taken next.
00:02:40.761 --> 00:02:45.184
So there's a whole host of things that go around being entrusted with data.
00:02:45.184 --> 00:02:47.967
And what comes to mind very briefly is,
00:02:47.967 --> 00:02:58.111
I mentioned about the governance, I mentioned about proving, right, your ability to take
care of it as well as your ability to track and trace it, but then also on the back end,
00:02:58.111 --> 00:03:08.515
being able to do analytics on that data and being able to do an impact or damage
assessment on the back end of that is critically important, not only for you, but for the
00:03:08.515 --> 00:03:13.645
other organizations that lost data as well and are impacted by that compromise.
00:03:13.645 --> 00:03:19.548
So in the past two minutes, you've used the word trust eh three times.
00:03:20.573 --> 00:03:21.413
And...
00:03:22.103 --> 00:03:29.386
I'd say a few years ago at the RSA conference, zero trust was a term that was used so
much.
00:03:29.726 --> 00:03:45.773
And I believe that that's fairly well understood in terms of the technical perspective and
guardrails, policies in place to cordon off, classify, protect sensitive data.
00:03:45.954 --> 00:03:48.895
But in terms of trust now,
00:03:50.767 --> 00:03:57.232
It goes far beyond that, and from a business perspective, trust is reputational risk.
00:03:57.232 --> 00:04:00.415
Not only data security risk.
00:04:00.415 --> 00:04:04.178
trust and risk tend to go hand in hand.
00:04:04.178 --> 00:04:15.802
And so, in the legal profession, and specifically with security expertise, where do you
see the term trust used a lot in your daily life?
00:04:15.802 --> 00:04:23.722
Yeah, that's a really interesting question because I think organizations inherently know
that their business is built on trust.
00:04:23.722 --> 00:04:30.762
But then as they evaluate what they're going to do, typically it's a very legalistic
analysis.
00:04:31.442 --> 00:04:38.822
So it's a really interesting question because I think organizations would be better served
to think of those together.
00:04:39.802 --> 00:04:45.282
Not only what am I legally required to do or what am I...
00:04:45.818 --> 00:04:47.580
What are my obligations?
00:04:47.580 --> 00:04:57.065
But what is the right thing to do for the organization and for the company and for your
customers or whoever it is that you serve?
00:04:57.085 --> 00:04:59.346
Why are you in business in the first place?
00:05:00.633 --> 00:05:12.170
And I think that's where those two ideas converge in a really lovely way and can impact
decision making in a way that can best suit an organization.
00:05:12.170 --> 00:05:19.569
So for example, you may have legal notification obligations or reporting requirements if
you have a cyber incident.
00:05:19.569 --> 00:05:22.173
and those you have to follow.
00:05:22.173 --> 00:05:28.920
So an organization may not have significant decision making around that because it's a
requirement.
00:05:29.221 --> 00:05:38.290
But then there are many situations in which there may not be a legal obligation, but it
may be wise to do so.
00:05:38.290 --> 00:05:40.532
It may build trust to do so.
00:05:40.652 --> 00:05:42.333
And if you had...
00:05:43.126 --> 00:05:47.917
a reporting requirement, you also run the risk of others finding out, right?
00:05:47.917 --> 00:05:49.508
So that's a risk.
00:05:49.508 --> 00:06:00.411
But then even if you're in a situation where you think no one will find out because it's
internal to you, we really live in a world today where data gets out and gets exposed.
00:06:00.411 --> 00:06:03.432
And then the questions start to come, well, how did this data get out?
00:06:03.432 --> 00:06:05.952
How did this data get exposed?
00:06:05.952 --> 00:06:11.520
So those raise a lot of questions that could become the source of an investigation by a
federal agency.
00:06:11.520 --> 00:06:12.794
It could become,
00:06:12.864 --> 00:06:21.487
a regulatory issue, it could become a privacy issue, and then if the roads lead back to
your organization, it really doesn't look good for your organization to not have come
00:06:21.487 --> 00:06:22.957
forward first.
00:06:22.998 --> 00:06:33.201
So to build trust, you want to own the narrative, and you want to be the one demonstrating
that you are trustworthy, that you're doing the right thing, that you're letting people
00:06:33.201 --> 00:06:35.422
know what has happened, you're...
00:06:36.034 --> 00:06:46.000
providing support and assistance, you're doing your own impact or damage assessment to
what it means to your organization, but you're also supporting what kind of harm could
00:06:46.000 --> 00:06:48.802
come to other organizations whose data was lost.
00:06:48.802 --> 00:06:58.589
All those things are the things that build trust, more so than a report that said, I had
an incident, here's what happened, I'm making my mandatory requirement disclosures.
00:06:58.589 --> 00:07:00.062
That's a check the box.
00:07:00.062 --> 00:07:00.905
Yes.
00:07:01.108 --> 00:07:05.030
but it doesn't build trust across the organization and with your clients.
00:07:05.030 --> 00:07:10.913
No, and there are real business impacts with the degradation of trust of a business.
00:07:10.913 --> 00:07:18.137
And we've seen that to devastating effect oh over time and with specific businesses and
sectors.
00:07:18.137 --> 00:07:30.905
And I would say thank goodness for new technical controls that allow us greater visibility
into whether we are storing and working with sensitive data.
00:07:30.905 --> 00:07:32.075
So for example,
00:07:32.075 --> 00:07:39.511
with Cohesity, as you know, we're a software company that sells backups and other software
and hardware.
00:07:39.511 --> 00:07:46.738
And our why is that we're there for customers on their worst day.
00:07:46.738 --> 00:07:59.210
We see cyber attacks and we think deeply on how do we do our very best so that they can
recover in such a way that there is minimal to no impact
00:07:59.210 --> 00:08:05.894
on business operations and therefore company reputation and more broadly trust.
00:08:06.195 --> 00:08:19.084
And I would say without getting too much into technical details that an innovation we're
proud of is that our backups have data security posture management, DSPM, that is powered
00:08:19.084 --> 00:08:23.707
by Sierra, which is the best of breed in the DSPM business.
00:08:23.707 --> 00:08:28.211
But what it does is it allows organizations
00:08:28.211 --> 00:08:39.803
to see clearly if they have protected health information, oh protected individual, private
information in the secondary data.
00:08:39.966 --> 00:08:53.142
So in the backups, which historically have been like an iceberg in that we see the primary
production data, but what's underneath the surface has been invisible.
00:08:53.682 --> 00:09:04.217
And if you're backing up data that has PHI, there are legal consequences, trust
consequences, reputational damage if that is discovered.
00:09:04.217 --> 00:09:10.013
So I think it's a great innovation and I love to see how tech is rising to meet those
trust
00:09:10.013 --> 00:09:10.906
risks.
00:09:10.906 --> 00:09:13.738
Yeah, you you raised a lot of really important points.
00:09:13.738 --> 00:09:16.720
Organizations struggle, and I've seen it first-hand.
00:09:16.720 --> 00:09:28.506
So from years of experience of being over some of the largest data breaches in the world
and seeing how organizations are able or not able to respond well to that.
00:09:28.506 --> 00:09:35.389
And when you think of incident response, you typically think about can I get my network
and process these back up and running?
00:09:35.389 --> 00:09:38.922
But you don't always think about the long data tail that follows.
00:09:38.922 --> 00:09:42.435
is it's long and challenging for most organizations.
00:09:42.435 --> 00:09:46.878
So you have to then know, was the data accessed in an unauthorized manner?
00:09:46.878 --> 00:09:48.399
Was it exfiltrated?
00:09:48.399 --> 00:09:49.579
Was it taken?
00:09:49.579 --> 00:09:50.290
How do I know?
00:09:50.290 --> 00:09:54.101
How can I prove what was taken and how can I prove what wasn't taken?
00:09:54.162 --> 00:09:59.006
Then you have, like I mentioned, the notifications responsibility or obligations.
00:09:59.006 --> 00:10:01.287
You may have regulatory obligations.
00:10:01.287 --> 00:10:07.071
You may have, like you say, the PII, PHI, like all of those obligations.
00:10:07.071 --> 00:10:11.563
But then you have your own damage or impact assessment and then assisting those who have
to do their own.
00:10:11.563 --> 00:10:21.397
So I walk through that specifically now because you're saying, well, gee, it's not only
for the data that may or may not have been impacted as part of the incident, but now you
00:10:21.397 --> 00:10:22.718
also have the data
00:10:22.718 --> 00:10:25.220
that you need to bring back up as part of your backups, right?
00:10:25.220 --> 00:10:28.463
So you have the same data twice that you're dealing with.
00:10:28.463 --> 00:10:31.486
Oftentimes threat actors access the backups as well.
00:10:31.486 --> 00:10:33.688
Or try to corrupt the backups in some way.
00:10:33.688 --> 00:10:40.102
So now you have a number of different times and ways that you need to be concerned about
protecting the data, right?
00:10:40.102 --> 00:10:50.819
Not just in active use, but also in your various backups and being able to trace what the
threat actor did and then being able to, with confidence, say what happened to that data.
00:10:50.819 --> 00:10:54.061
and whether or not it was protected or part of the compromise.
00:10:54.061 --> 00:10:58.925
So I think having technical capabilities that enable that are critical.
00:10:58.925 --> 00:11:05.029
I also think about having good data governance and good data governance enforcement is
critical.
00:11:05.029 --> 00:11:10.413
And I always tell people, data that's deleted is at a much lower risk to your
organization.
00:11:10.413 --> 00:11:12.024
So delete some of this data, right?
00:11:12.024 --> 00:11:14.155
You don't necessarily have to keep all of it.
00:11:14.155 --> 00:11:19.159
But then being able to map it and know what was at risk or what wasn't is really critical.
00:11:19.159 --> 00:11:20.339
But afterwards,
00:11:20.460 --> 00:11:31.087
that analysis and having insight into the types of data that you were responsible for and
being able to show the picture of what that meant from an impact standpoint to your
00:11:31.087 --> 00:11:33.481
organization or to others is absolutely critical.
00:11:33.481 --> 00:11:34.384
Fantastic.
00:11:34.384 --> 00:11:37.465
You know, we talked about resilience takes practice.
00:11:38.806 --> 00:11:40.507
And I love that idea.
00:11:40.608 --> 00:11:52.725
And one of the key things that I learned from years of government and years of crisis
management in the FBI and elsewhere and related to the cyber world is that you need to
00:11:52.725 --> 00:11:54.375
continually prepare.
00:11:54.496 --> 00:11:56.717
It needs to become muscle memory.
00:11:57.610 --> 00:12:08.417
you have to test for stress because oftentimes people want to do the tabletop exercises on
the easy things, but they don't really want to test for the stress that your organization
00:12:08.417 --> 00:12:11.100
will encounter in a major incident.
00:12:11.100 --> 00:12:17.625
And that kind of stress is, it's emotional fatigue on an organization, it's financial.
00:12:17.772 --> 00:12:20.307
fatigue on an organization.
00:12:20.469 --> 00:12:23.515
It's a significant business disruption.
00:12:25.716 --> 00:12:35.421
as you're restoring your capabilities to do your day-to-day work, your same employees are
still the ones that need to deal with that long tail that I talked about that happens when
00:12:35.421 --> 00:12:37.441
you have to evaluate now what?
00:12:37.441 --> 00:12:42.173
What are the consequences of having just gone through a major data breach?
00:12:42.654 --> 00:12:46.336
So being able to prepare for that kind of stress is really critical.
00:12:46.336 --> 00:12:54.539
And then building a community around you to be able to support you through a major
incident is a key part of that resilience.
00:12:54.640 --> 00:12:55.680
So being able to have
00:12:55.680 --> 00:13:01.044
partnerships with data companies and those that secure data or can help you identify your
data.
00:13:01.044 --> 00:13:14.052
Having strong relationships and retainers with your incident responders and your law firms
and your ransomware negotiators and all the people that you need to bring in to be there
00:13:14.052 --> 00:13:19.936
with you and for you throughout the course of your incident management is absolutely
important.
00:13:19.936 --> 00:13:25.600
And I do still put in a big plug for having good strong relationships across government,
including the
00:13:25.600 --> 00:13:26.853
FBI, right?
00:13:26.853 --> 00:13:31.116
It's a critical part of the community and building that resilience.
00:13:31.116 --> 00:13:35.458
So I've got a little story to share when it comes to a stress test.
00:13:35.458 --> 00:13:44.602
So you and I have, in our work, had many, many, conversations with CISOs, Chief
Information Security Officers, Chief Security Officers.
00:13:44.602 --> 00:13:54.607
And I sat once with a logistics company, and the CIO and the CISO were in the room, and
some operator level staff.
00:13:54.607 --> 00:13:59.509
And they talked about how they had just begun doing tabletop exercises
00:13:59.849 --> 00:14:04.551
that included the backups, which is what I've been advising even when I was at CISA.
00:14:04.851 --> 00:14:16.134
And they shared that the first time that happened that they did the exercise that included
the backups that basically the backups team did this.
00:14:16.874 --> 00:14:23.236
Like, I'm sorry but we can't do anything and we don't know what else to do.
00:14:25.840 --> 00:14:31.415
There were two lessons learned there, one for operators and one for senior executives.
00:14:31.415 --> 00:14:36.531
the lesson for the operators is that this is not a blame game.
00:14:37.993 --> 00:14:42.736
that with repetition, that you get better.
00:14:43.061 --> 00:14:51.830
And just like any exercise, physical exercise or cyber, it's hard at the beginning and
then it gets better.
00:14:52.411 --> 00:14:59.158
So for them, was an important learning and they got better with subsequent exercises.
00:14:59.158 --> 00:15:01.640
And from the CISO perspective...
00:15:03.717 --> 00:15:18.110
It's so important for executives to message properly and to make sure that the backup
team, who they usually don't manage because they're in IT, to say to them, I'm not your
00:15:18.110 --> 00:15:22.054
boss, but you're going to be an integral part of a recovery.
00:15:22.054 --> 00:15:24.496
And I need you to be part of this.
00:15:24.496 --> 00:15:29.179
And I'm not doing this to embarrass you or anyone else.
00:15:29.522 --> 00:15:35.128
but for defense in depth, you are essential, and so this is what we're going to do.
00:15:35.128 --> 00:15:37.256
What do you say about that?
00:15:37.256 --> 00:15:42.906
So I've always said that your organization is not really ready until every person in your
organization is ready.
00:15:42.906 --> 00:15:48.706
If they don't know what their role is in an incident and they don't understand where they
fall in function.
00:15:48.706 --> 00:15:55.680
then you're not really ready and you're not doing your organization the service it
deserves if you haven't prepared them properly.
00:15:55.680 --> 00:16:01.895
Leaders think about, how do I get the business back up and operational, right?
00:16:01.895 --> 00:16:04.676
But you also have to think about, well, what does it take?
00:16:04.676 --> 00:16:05.576
What are the demands?
00:16:05.576 --> 00:16:07.137
Who needs to do what?
00:16:07.573 --> 00:16:08.964
Who will be my leaders?
00:16:08.964 --> 00:16:09.955
Do I have a bench?
00:16:09.955 --> 00:16:11.357
I always say build a bench.
00:16:11.357 --> 00:16:23.427
Build a bench of leaders because you're going to need leadership maybe 24-7 over the
course of months even to lead through any incident and recovery situation.
00:16:23.669 --> 00:16:30.012
And then to be able to handle that long tail I always talk about with respect to the 'Now
what does this mean for organization?
00:16:30.012 --> 00:16:31.833
Do we need to technically rebuild?
00:16:31.833 --> 00:16:34.114
Do we need to handle the data?
00:16:34.114 --> 00:16:38.016
Do we need to do an impact assessment?' All those things that we've been talking about.
00:16:38.016 --> 00:16:47.851
But if you don't have a bench of leaders who understand what it takes and who is going to
own certain command and control of those different pillars that are so critically
00:16:47.851 --> 00:16:52.082
important, then your organization will start to crumble under that stress.
00:16:53.033 --> 00:17:05.434
from a leadership perspective, the other aspect of it now that I'm sitting in the legal
chair is your general counsel needs to understand how to quarterback the recovery as well
00:17:05.434 --> 00:17:16.264
and quarterback the incident and understand that while they're trying to manage some of
the investigative aspects that you may want under privilege that are often not considered
00:17:16.264 --> 00:17:17.264
early on.
00:17:17.787 --> 00:17:23.680
They could actually have some of the investigative activity handled under privilege that
could be very helpful to your organization.
00:17:23.680 --> 00:17:32.790
Recognizing also though that the facts are not privileged and there will be certain parts
of the investigation that will be available to the rest of the organization to be able to
00:17:32.790 --> 00:17:34.264
do something about.
00:17:34.264 --> 00:17:36.224
You have to act.
00:17:36.605 --> 00:17:38.255
You can't just sit there and admire it.
00:17:38.255 --> 00:17:40.506
It doesn't go away.
00:17:40.776 --> 00:17:43.607
So you have to be positioned to make decisions.
00:17:43.607 --> 00:17:50.509
You have to be positioned to have leaders who understand what part they own and how they
are expected to operate.
00:17:50.869 --> 00:17:53.560
And with what principle, right?
00:17:53.560 --> 00:17:55.191
What is your driving principle?
00:17:55.191 --> 00:17:56.631
And we've been talking about trust.
00:17:56.631 --> 00:17:58.572
I think trust is a driving principle.
00:17:58.572 --> 00:18:01.132
This is how we are going to react and respond.
00:18:01.132 --> 00:18:06.614
I always say you can't prepare for everything, but you can prepare for almost anything.
00:18:06.922 --> 00:18:07.774
That's true.
00:18:07.774 --> 00:18:16.220
If you have the right principles, you have the right leadership, if you've tested for
stress of some sort, then it doesn't matter what type of stress comes at you.
00:18:16.220 --> 00:18:19.081
You're going to be able to be resilient for it.
00:18:19.732 --> 00:18:20.863
Very well said.
00:18:20.863 --> 00:18:30.199
And I love how you succinctly discussed people and process and technology because
resilience requires all three.
00:18:30.199 --> 00:18:31.469
It does.
00:18:31.796 --> 00:18:34.107
Yeah, you can't forget any one of those.
00:18:34.127 --> 00:18:39.969
The process, I think, sometimes fails because the people aren't ready.
00:18:40.870 --> 00:18:50.434
You can have all the greatest processes, but if your people don't know how to exercise
them and use them, then you often end up with chaos and paralysis.
00:18:50.870 --> 00:18:51.242
And delays.
00:18:51.242 --> 00:18:51.420
Delays.
00:18:51.420 --> 00:18:52.481
And delays.
00:18:52.481 --> 00:18:53.561
Yeah.
00:18:53.741 --> 00:19:01.425
And those delays can cost your organization time, money, people, resources, reputation:
all those things.
00:19:02.125 --> 00:19:08.548
Building that resilience and building that uh muscle memory is absolutely critical.
00:19:08.628 --> 00:19:11.009
And there are things you can do in advance, right?
00:19:11.009 --> 00:19:15.992
So you can in advance map out your reporting obligations.
00:19:15.992 --> 00:19:19.874
You can map out in advance your contractual obligations.
00:19:19.874 --> 00:19:20.944
You can map out
00:19:20.944 --> 00:19:29.361
who would you want to notify just as part of that trust building, even if you don't have
an obligation?
00:19:29.963 --> 00:19:32.585
Well in advance, you can map out your data.
00:19:32.585 --> 00:19:34.707
You can map out your requirements with the data.
00:19:34.707 --> 00:19:39.931
You can map out the impact if that data were to be compromised.
00:19:40.570 --> 00:19:50.149
Those things can be handled in advance and those are areas that organizations don't
typically invest in on the front end, but they cost you a lot of time and money that you
00:19:50.149 --> 00:19:53.251
don't expect on the back end if you don't get it done.
00:19:53.496 --> 00:19:54.517
Agree.
00:19:54.918 --> 00:19:56.980
Well, we are out of time.
00:19:56.980 --> 00:20:08.995
And I just have to say, Aaron Joe, your perspective based on your experience and where you
are now contributing from security, from the legal perspective, it's just amazing.
00:20:08.995 --> 00:20:12.902
Thank you so much for being with us on this episode of Zero Downtime.
00:20:12.902 --> 00:20:13.894
Well, thank you, Joye.
00:20:13.894 --> 00:20:18.382
I think you've been a tremendous champion in this area.
00:20:18.423 --> 00:20:21.448
I think you're tremendous friend and colleague.
00:20:21.570 --> 00:20:24.234
And I just want to thank you for having me today.
