TRANSCRIPTION 🔗
WEBVTT
00:00:04.480 --> 00:00:09.919
Welcome to Cross Examining Cyber, a podcast brought to you by Herbert Smith Freehills Kramer.
00:00:10.240 --> 00:00:21.120
In this podcast series, we speak to our business leaders about all things cyber, including the legal, governance, technical, regulatory, and policy developments that impact corporates around the world.
00:00:21.359 --> 00:00:28.800
In this episode, we continue our director series with part two of our cross-examination of Catherine Brenner and John Mullen.
00:00:29.039 --> 00:00:31.600
In our last episode, we left you on a cliffhanger.
00:00:31.760 --> 00:00:33.520
We now pick up where we left off.
00:00:33.679 --> 00:00:46.719
We also discussed the value in good communications, the human factor and cyber incident response, a values-led approach, as compared with a compliance-led approach, AI, of course, and board simulations.
00:00:46.960 --> 00:00:54.560
This is cross-examining cyber as part of our director series, the cross-examination of Catherine Brenner and John Mullen, part two.
00:00:54.960 --> 00:00:56.000
Here we go.
00:01:01.039 --> 00:01:22.000
You touched on this, John, the suggestion that the lessons that you learn from these incidents may not be what you do in that immediate response, but when you look back on both of you, the incidents you've been involved with, whether it's directly or on the periphery, or even the exercises you've run as organisations, because they can elicit great learnings too.
00:01:22.159 --> 00:01:22.400
Yeah.
00:01:22.640 --> 00:01:23.519
What have you learned?
00:01:23.680 --> 00:01:29.439
What what what would be your sort of top one, two or three lessons from dealing with the cyber crisis?
00:01:29.760 --> 00:01:45.359
In many ways, it's the same as dealing with any crisis, that the problem's never as you first think it is or as it's first presented to you, and that you will be working in an environment that's dynamic with incomplete information, with stressed individuals.
00:01:45.519 --> 00:01:45.840
Yeah.
00:01:46.159 --> 00:01:53.840
Not the exact team that if you planned it would be there, you know, someone will be on holidays, someone will be uncontactable, all of those sorts of things.
00:01:54.000 --> 00:02:05.359
So having pre-agreed processes and structures and having built a bit of that muscle of working under stress through whether it's simulations or whatever, I think one of the key things I've learned.
00:02:06.000 --> 00:02:09.919
I think that communications is just absolutely critical.
00:02:10.240 --> 00:02:19.120
The technical problem may be manageable, but how it's communicated, the narrative internally, externally, with regulators, stakeholders, yeah, there's a long list.
00:02:19.759 --> 00:02:26.240
Because I've seen organizations manage an incident technically, but have lost control of the narrative.
00:02:26.479 --> 00:02:26.639
Yes.
00:02:26.960 --> 00:02:28.639
And that's been much more damaging.
00:02:29.039 --> 00:02:29.360
Absolutely.
00:02:29.599 --> 00:02:39.599
I think the other bit, and we've touched on this in the conversation already, is you have a business to run, you have people who depend on you, you need to keep safe, etc.
00:02:40.159 --> 00:02:43.919
And thinking about that, and sometimes it might mean you have parallel teams.
00:02:44.000 --> 00:02:47.199
These are running the business day to day, and these are dealing with the incident.
00:02:47.520 --> 00:02:53.759
But having done the preparation to say this is how we're going to run it is, I think, really critically important.
00:02:54.400 --> 00:02:57.360
How the chair and the CEO are going to communicate, all of that sort of stuff.
00:02:57.520 --> 00:03:01.439
So pre-planning, having done a bit of practice and put a bit of pre-thought into it.
00:03:01.759 --> 00:03:03.759
Yeah, Eisenhower, a plan does nothing without planning.
00:03:04.639 --> 00:03:06.960
So that's uh so true.
00:03:07.520 --> 00:03:10.479
I I agree word for word with with what Catherine said.
00:03:10.719 --> 00:03:16.719
Communication one is actually very difficult because you've got two opposing pressures.
00:03:17.039 --> 00:03:21.680
On the one side, you're under pressure to communicate as quickly and early as fulsomely as you can.
00:03:21.840 --> 00:03:30.639
But at the same time, quite often you don't actually know what's happened or the extent of it, and therefore you risk going too early and saying, don't worry about that, but it's okay.
00:03:30.879 --> 00:03:32.479
And then suddenly, no, it's not okay.
00:03:32.639 --> 00:03:34.319
And then you have to go back out again.
00:03:34.479 --> 00:03:39.520
And I think that's one of the most difficult decisions that companies have to make when they're hit with these things.
00:03:40.240 --> 00:03:46.400
You obviously by definition want to go as fast and as hard as you can on communication, but be very careful you get the right message.
00:03:47.360 --> 00:03:52.479
Another interesting dynamic, I think, is you sort of crises really sort humans out.
00:03:52.639 --> 00:03:56.960
You know, some CEOs and and board members panic.
00:03:57.039 --> 00:04:08.319
They go, hey, well whereas some actually rise sort of Winston Churchill like into the challenge, and that's motivating and keeps people working the weekend and late hours still working on it, you know.
00:04:08.400 --> 00:04:11.360
That that leadership thing really comes to the fore in a crisis.
00:04:12.080 --> 00:04:12.960
I completely agree.
00:04:13.039 --> 00:04:25.279
That good crisis management or governance or whatever you want to call it, I think it's as much a test of character as it is of process and the human factor is um really significant.
00:04:25.680 --> 00:04:36.560
And maybe that's one of the first questions for the board, really, when they get presented with this is unfolding, it's have we got the right people, support, capacity, capability to manage through this.
00:04:36.879 -->
Load full transcript
00:04:38.079
Yeah, and part of it Would that be fair?
00:04:38.319 --> 00:04:49.279
Yeah, and part of that includes you know having people on your board who have been through a crisis before and that know themselves and that the chair knows will rise to the occasion.
00:04:49.439 --> 00:04:51.040
And that's where subcommittees are all too.
00:04:51.360 --> 00:04:51.759
Yeah, absolutely.
00:04:52.639 --> 00:04:57.839
The thing, it'll be able to tell the director we're gonna have a board meeting every single night for the next week.
00:04:58.560 --> 00:05:00.879
Oh well, sorry, it's three o'clock in the morning in the US.
00:05:00.959 --> 00:05:01.519
Well, I don't care.
00:05:01.600 --> 00:05:02.959
That c it comes with the territory.
00:05:03.279 --> 00:05:06.639
But get some extra coffee and we are gonna have that meeting.
00:05:06.720 --> 00:05:11.680
And you see how many people rise to that, and and not most do, but a few don't.
00:05:11.920 --> 00:05:12.000
Yes.
00:05:12.240 --> 00:05:13.360
And that's very disappointing.
00:05:13.920 --> 00:05:15.439
It's remarkable, isn't it, human nature?
00:05:15.680 --> 00:05:20.240
You never really quite know how someone's going to react until the blowtorch is applied.
00:05:20.399 --> 00:05:28.800
And because we work on so many of these, I regret, that we've seen people break in a way which the most unexpected people break.
00:05:29.040 --> 00:05:31.920
And I understand the mental strain.
00:05:32.160 --> 00:05:44.639
We're blessed because we see so many that we hope that one of the biggest contributions that we can make, positive contributions, is that we can actually bring a calm to the room and put a bit of perspective around this, particularly for those individuals that might struggle.
00:05:44.720 --> 00:05:48.959
But you're absolutely right people and sometimes the most unexpected people will crack.
00:05:49.279 --> 00:06:03.600
If you're clear on your values and everyone acts consistently with it, it makes such a difference, whether it's the way our team at Centre Group responded to the unprovoked attack at Bondi, uh Westfield Bondi, through to when I've seen cyber attacks.
00:06:03.839 --> 00:06:11.199
If you're very clear on your values and on your customer and your community, you can actually navigate most decisions.
00:06:11.519 --> 00:06:11.680
Yeah.
00:06:12.639 --> 00:06:13.920
We're all human beings underneath, aren't we?
00:06:14.240 --> 00:06:17.120
You know, we've got a job title and a role today, but we're all humans.
00:06:17.680 --> 00:06:29.680
I extend that to our third-party ecosystem because when a cyber incident or a crisis occurs, you want all your friends around you at that point in time and isolating.
00:06:29.920 --> 00:06:34.160
And we've certainly been in circumstances where the knee-jerk reaction is who's responsible.
00:06:34.399 --> 00:06:44.319
And you get that in some organizations where there is a knee-jerk reaction to not allocate blame, but find who was responsible and what should we be doing about those.
00:06:44.480 --> 00:06:49.439
And that is at a point in time when you need them more than 100% ever before.
00:06:50.399 --> 00:06:56.480
You might remember a while ago there was an ASIC proposal that uh companies and directors be held personally liable for all this sort of stuff.
00:06:56.879 --> 00:06:56.959
Yes.
00:06:57.199 --> 00:06:58.399
It's the worst thing you could do.
00:06:59.199 --> 00:07:02.240
You actually want complete transparency of what happens.
00:07:02.560 --> 00:07:04.000
Everybody else can learn by it.
00:07:04.160 --> 00:07:13.680
You want, notwithstanding competition laws, you want to share with others in your industry if if the attack was specific to your type of industry, share that information with the others.
00:07:14.560 --> 00:07:19.279
Yeah, this this reaction of allocating blame and everything is totally the wrong way to do it.
00:07:19.759 --> 00:07:20.079
100%.
00:07:20.480 --> 00:07:28.480
Because so often a cyber incident can turn into uh a physical security issue, a product contamination issue, whatever it might be.
00:07:28.720 --> 00:07:42.560
And we're, in fact, my organizations are doing simulations that involve our partners because probably from the very beginning there are other parties involved, whether it's you know, whatever they might be, and you know, it could be a you know the technology stack that you've got.
00:07:42.639 --> 00:07:43.040
Yeah, of course.
00:07:43.120 --> 00:07:43.360
Yeah.
00:07:43.600 --> 00:07:52.800
And so doing those exercises with government, with customers, etc., everyone learns something and the learnings have been really valuable.
00:07:52.879 --> 00:07:57.360
And everyone gets to know each other a bit better as well, which is really important if you do find yourself in a crisis.
00:07:57.680 --> 00:07:58.879
Yeah, nice community.
00:07:59.120 --> 00:08:04.720
You could not have missed the AFR articles around AI accelerating at this pace.
00:08:04.879 --> 00:08:08.319
It just takes a couple of headlines in the AFR and my phone goes off the hook.
00:08:08.480 --> 00:08:08.639
Yeah.
00:08:08.800 --> 00:08:13.839
What are you thinking about at the moment in relation to things like what's happening with anthropic and the like?
00:08:14.000 --> 00:08:20.879
I'm not going to ask you to have understood everything that's going on, but just that sheer pace of change now.
00:08:21.439 --> 00:08:24.399
Well, the mythos thing is fascinating.
00:08:24.639 --> 00:08:31.199
So you couldn't think of a better marketing approach, basically, than to say I've got something so powerful I can't actually tell you what it is.
00:08:31.439 --> 00:08:35.759
What we can't avoid is that even if it isn't as powerful as it is, it will be soon.
00:08:35.919 --> 00:08:43.039
And and so will other ones even before you get to quantum computing, which I don't even understand, but the risk goes through the roof again.
00:08:43.279 --> 00:08:44.080
Yes,
yes, you know.
00:08:44.240 --> 00:08:54.080
So I I think for for boards, trying to keep on top of of that as best you can and manage change like what we agree this week, maybe irrelevant by next week, not next year.
00:08:54.480 --> 00:08:59.039
Yeah, cyber AI tools are scaling incredibly fast.
00:08:59.279 --> 00:09:08.879
And you know, so the risk is not stable and the threat profile six months, one month, whatever it might be, will be dramatically different to what it is today.
00:09:09.120 --> 00:09:14.960
And so I think it isn't about what static controls we have, but how are we learning, how are we adapting.
00:09:15.200 --> 00:09:19.840
AI governance and cyber governance are not separate topics, they're related.
00:09:20.240 --> 00:09:25.840
The AI that your company is creating to do other things creates a new attack surface.
00:09:26.000 --> 00:09:26.399
Yeah, of course.
00:09:26.639 --> 00:09:31.759
The AI that's being deployed is attacking your people, so we can have the best systems in the world.
00:09:32.080 --> 00:09:39.840
But the way our people are trained and behave, often with good intent, that's always going to be a vulnerability.
00:09:40.399 --> 00:09:41.600
It's usual personal behaviour, isn't it?
00:09:41.840 --> 00:09:42.000
Indeed.
00:09:42.159 --> 00:09:43.360
It's not a personality.
00:09:43.440 --> 00:09:44.320
So we need to make a mistake.
00:09:44.639 --> 00:09:48.480
So it's not just a technology risk, it's a broader cultural risk.
00:09:48.639 --> 00:09:57.440
And so alive to the risk of change and making sure that our, whether it's our governance processes or the way we think about things, are dynamic.
00:09:58.159 --> 00:10:06.559
And I think what's changed as well, and I struggle with a lot, and I'm sure my colleagues do, is is our increasing dependence on sort of global platforms.
00:10:06.720 --> 00:10:10.720
You know, whether it's a kind of everyone's got data in the cloud today.
00:10:11.120 --> 00:10:15.360
It's only a few years ago that everything was in a box in the basement of Parsley Street.
00:10:16.240 --> 00:10:17.200
And it was that was it.
00:10:17.360 --> 00:10:17.440
Yeah.
00:10:17.679 --> 00:10:26.960
Whereas now we depend on all of these sales force and all these other things, and you've got very little ability to really influence the way those are engineered.
00:10:27.279 --> 00:10:27.600
That's right.
00:10:27.840 --> 00:10:28.799
But you're dependent on them.
00:10:28.960 --> 00:10:29.120
Yeah.
00:10:29.440 --> 00:10:35.440
I'm slightly hopeful that we're going to get a because at at the moment, I'm going to be a your lawyer for a moment.
00:10:35.759 --> 00:10:46.159
The whole liability pyramids inverse, where somehow you are responsible for picking up on all the patches and the vulnerabilities that exist in a supplier.
00:10:46.639 --> 00:10:56.240
And look, there's a pretty robust discussion going on globally around how those providers need to take more accountability for that sort of stuff, not just push it down.
00:10:56.480 --> 00:11:01.759
And then secondly, you both run organizations with strong governance structures.
00:11:03.039 --> 00:11:04.080
I know for a fact.
00:11:04.480 --> 00:11:13.759
And so I look at this new these new technologies and I just say simply apply those same principles that you apply for any new risk or any new technology.
00:11:13.919 --> 00:11:23.840
Understand that this thing's moving at pace, but with those governance structures that you've got in place, that will put you in a strong position to have fulfilled your obligations as a director and as a board.
00:11:24.000 --> 00:11:31.840
And so when I get a chance to get in front of a board, it's be kind of not even alarmed, be aware, but don't be alarmed.
00:11:32.159 --> 00:11:36.639
Use the principles that you use when you deal with any new issue that arises.
00:11:36.799 --> 00:11:43.759
Those foundational technology neutral components of your business or your structure will put you in a very strong position.
00:11:44.799 --> 00:11:46.320
We do a lot of cyber simulations.
00:11:46.480 --> 00:11:46.639
Yeah.
00:11:46.879 --> 00:11:49.120
Simulations come in many shapes and sizes.
00:11:49.360 --> 00:11:54.080
We can test our IT teams, our crisis management teams, and test our boards.
00:11:54.320 --> 00:11:56.639
They're as broad as your imagination, really.
00:11:57.039 --> 00:12:00.000
There's a cottage industry that's developed around this sort of stuff.
00:12:00.080 --> 00:12:07.360
There's consultants from the front of our door at Pitt Street all the way down to Custom House Key with an offer for you if you'd like one.
00:12:08.000 --> 00:12:11.600
What makes a good simulation at a board level?
00:12:11.759 --> 00:12:14.000
And it doesn't maybe simulation is the wrong word.
00:12:14.240 --> 00:12:18.639
What makes a good exercise around this type of threat at a board level?
00:12:18.799 --> 00:12:19.360
Do you believe?
00:12:19.440 --> 00:12:19.840
Catherine.
00:12:20.399 --> 00:12:25.360
I think where you do feel a bit uncomfortable, where it does put a bit of stress into the system.
00:12:25.759 --> 00:12:30.320
We've touched on a number of the things that make it successful in this conversation, you know, have it.
00:12:30.639 --> 00:12:34.639
And really testing whether the board is going to help or hinder, I think is one of the key things.
00:12:34.879 --> 00:12:37.519
And getting the processes and structures right.
00:12:38.000 --> 00:12:43.200
But I think the other bit that makes a simulation really good and effective is the debrief.
00:12:43.519 --> 00:12:43.679
Yes.
00:12:44.080 --> 00:12:49.919
Not what went, well, great job, everyone, but where did we hesitate when we shouldn't have?
00:12:50.320 --> 00:12:51.840
Where did we move too fast?
00:12:52.080 --> 00:12:53.840
What assumptions do we tend to make?
00:12:54.240 --> 00:12:55.759
The debrief should be uncomfortable.
00:12:56.159 --> 00:12:56.399
Yes.
00:12:56.480 -->
00:12:56.720
Yeah.
00:12:56.960 --> 00:12:58.320
Yep, I I agree.
00:12:58.639 --> 00:13:04.480
It's actually very hard to create the same ambiance in a practice as it is in reality.
00:13:04.720 --> 00:13:06.960
So the best possible training is to go through it.
00:13:07.120 --> 00:13:07.279
Yeah.
00:13:07.759 --> 00:13:09.440
And then you remember clearly.
00:13:10.000 --> 00:13:17.200
I certainly found in the briefings and things that we've done, all the simulations we've done, that's a sort of one-hour high-level session doesn't really help very much.
00:13:17.360 --> 00:13:24.960
What does help, I think, is firstly a a drill down into those little details you don't think are important, like literally the callage there.
00:13:25.039 --> 00:13:28.159
You know, what is John's home number or phone mobile number?
00:13:28.480 --> 00:13:31.759
If we need to ring him on on a Sunday night at midnight.
00:13:32.080 --> 00:13:40.399
And you'd be surprised how many people think they've got that, but when you really actually read it, oh yeah, we meant to update that last time, but so and so's left now, and you know, that sort of thing.
00:13:40.639 --> 00:13:42.159
I think just that level of detail.
00:13:42.240 --> 00:13:46.879
But then if what I found very helpful is is sort of real life simulation.
00:13:46.960 --> 00:13:52.480
So had it done by not by the company concerned, but by you know some of the organizations you've mentioned.
00:13:52.720 --> 00:13:55.279
But organizations have allowed them to use real data.
00:13:55.440 --> 00:13:55.600
Yes.
00:13:56.000 --> 00:13:58.799
So say, this is what the board was presented with.
00:13:58.960 --> 00:14:01.600
This is the decision they made and why they made it.
00:14:01.759 --> 00:14:05.440
In retrospect, it proved to be right or wrong, but why was that?
00:14:05.519 --> 00:14:09.759
And then get the whole board debating, yeah, what would I have done if I'd been in that situation?
00:14:10.000 --> 00:14:14.240
And that leads all the way through to a real example of what happened to that company as a result.
00:14:14.559 --> 00:14:15.919
I find that very helpful.
00:14:16.080 --> 00:14:21.840
I've learned a lot much more than from that than just sort of listening to our own team rehearse their plans.
00:14:22.080 --> 00:14:22.320
Yes.
00:14:22.559 --> 00:14:22.799
Yeah.
00:14:22.960 --> 00:14:23.279
Yeah.
00:14:23.519 --> 00:14:41.840
Testing those areas where there might be disagreement or uh discomfort, I guess, on are there individuals who in that sort of situation default to who's to blame or start questioning management's capability or confidence right at the very moment when management needs support.
00:14:41.919 --> 00:14:44.240
You know, those conversations need to happen beforehand.
00:14:44.399 --> 00:14:44.559
Yep.
00:14:44.799 --> 00:14:56.559
Even who's going to be on a subcommittee, you know, to get people around the world who have lots of other things going on available at a time that meets the demands of the crisis is important.
00:14:56.960 --> 00:15:01.360
And agreeing that beforehand rather than trying to work it out at 11 o'clock on a Sunday night.
00:15:01.519 --> 00:15:01.759
Yeah.
00:15:01.840 --> 00:15:02.000
Yeah.
00:15:02.639 --> 00:15:07.440
There's a bit of hygiene that like in the same camp as the phone number basis.
00:15:07.600 --> 00:15:07.679
Yeah.
00:15:08.080 --> 00:15:10.399
And there's no reason why we can't decide those things now.
00:15:10.720 --> 00:15:11.039
Exactly.
00:15:11.600 --> 00:15:16.240
None of those, none of the things that we just talked about require you to have gone through or go through something.
00:15:16.639 --> 00:15:19.200
And it happens with pay or don't pay decisions too, by the way.
00:15:19.440 --> 00:15:27.679
The last thing I want to see is a board sort of debating the ethical conundrum of a payment when there's time is ticking.
00:15:27.759 --> 00:15:27.840
Yeah.
00:15:28.000 --> 00:15:30.399
They're there to act in the best interest of the company.
00:15:30.559 --> 00:15:37.519
And that sometimes, even with very experienced directors, can be a confronting thing to have to lean into.
00:15:37.919 --> 00:15:49.759
Having us, having none of us went through business school or law school or university and got taught how do we negotiate with a Russian-speaking thread actor or even a teenager or a teenager sitting in a basement, mum's basement, you know.
00:15:50.399 --> 00:15:50.799
Absolutely.
00:15:51.120 --> 00:15:53.039
Yeah, and it's conflicts is another one.
00:15:53.120 --> 00:15:57.840
And I know we spent a lot of time trying to, you know, what is our process and protocol?
00:15:58.000 --> 00:16:10.639
So rather than in a crisis, if we hadn't sorted through some of those things as to what constitutes a conflict, or that even if someone does have a conflict, how are we going to manage that throughout and just having a process?
00:16:10.879 --> 00:16:11.200
Yes.
00:16:11.440 --> 00:16:13.120
It was a couple of hours well spent.
00:16:13.360 --> 00:16:13.519
Yeah.
00:16:14.080 --> 00:16:14.320
Yeah.
00:16:14.399 --> 00:16:14.639
Yeah.
00:16:15.039 --> 00:16:20.000
Final question, and this is the one where I've uh either keep my job or lose my job.
00:16:20.639 --> 00:16:21.759
Help me help me pick up.
00:16:21.919 --> 00:16:23.120
What is the envelope that is?
00:16:24.320 --> 00:16:38.480
Look, we take enormous pride as a firm to provide excellent legal advice, but we also take great pride in helping companies in a crisis in a way where we don't become an impediment to the delivery of what can be significant.
00:16:39.200 --> 00:16:40.879
You know, we have to move quickly.
00:16:41.279 --> 00:16:42.879
Communications must be made.
00:16:43.039 --> 00:16:46.399
And we take a very practical approach to things like legal professional privilege.
00:16:46.480 --> 00:16:53.919
But we've seen lawyers become impediments and not be the grease in the wheels that they need to be during
an incident.
00:16:54.000 --> 00:17:00.879
Now I may have answered my own question actually, but what do you think makes a good lawyer in a crisis?
00:17:01.840 --> 00:17:02.399
Yeah.
00:17:02.879 --> 00:17:13.920
Well, I've worked with many lawyers in crises, and I when I think about what quality separates the good from the exceptional, um, not really the legal knowledge, that's table stakes.
00:17:14.240 --> 00:17:21.359
You know, the like that you know they understand notification requirements and the acts and what triggers what and sequencing and all of that sort of stuff.
00:17:21.759 --> 00:17:41.680
Best lawyers in a crisis understand that there's legal advice and there's strategic advice and that they can give you a view rather than just throw lots of problems at you, can help you understand the bookends and work on the trade-offs that you make, given that there will be imprecise, dynamic, incomplete information.
00:17:42.240 --> 00:17:47.039
You need someone who can actually help you paint that and be help you be the grease, I guess.
00:17:47.279 --> 00:17:47.440
Yes.
00:17:47.759 --> 00:17:54.720
I think also that they understand the human and commercial reality and what's happening in the room as well.
00:17:54.880 --> 00:17:55.200
Yes.
00:17:55.519 --> 00:18:02.160
The fatigue, the communication issues, the personal stress, all the various stakeholders, etc.
00:18:02.799 --> 00:18:19.359
And without diminishing the importance of privilege or class actions or something like that, that they understand that the organization needs to survive as a functioning entity rather than optimising for what might happen if the CISO is in the box and a class action in in ten years' time.
00:18:20.480 --> 00:18:25.599
So all of those sorts of factors are what really makes an exceptional legal partner.
00:18:26.000 --> 00:18:26.559
Yeah, correct.
00:18:26.880 --> 00:18:28.880
Not the risk of violently agreeing yet again.
00:18:29.920 --> 00:18:30.960
I do agree with that.
00:18:31.200 --> 00:18:33.279
Maybe just a couple of other reflections.
00:18:33.440 --> 00:18:37.359
Yeah, one, I think an outstanding lawyer is an outstanding lawyer full stop, usually.
00:18:37.599 --> 00:18:43.759
The ones that I trust in your industry and your company particularly is fantastic advice through thick and thin crisis and non-crisis.
00:18:44.079 --> 00:18:44.240
Yeah.
00:18:44.480 --> 00:18:45.759
That usually is the case.
00:18:46.000 --> 00:18:52.480
I think where you can add a particular value, the breadth of experience you have across others who've been through these things.
00:18:52.720 --> 00:18:52.880
Indeed.
00:18:53.119 --> 00:18:54.960
So when it happens to you, you feel awfully alone.
00:18:55.119 --> 00:18:57.920
You know, it's everyone's shouting at you on the pressure.
00:18:58.000 --> 00:19:03.680
And you know, having a calm voice saying, look, we've been through this with 20 other companies, this is what happened.
00:19:03.839 --> 00:19:05.599
Yeah, it's going to be difficult with this amount of time.
00:19:05.759 --> 00:19:08.000
But you know, that that really is helpful.
00:19:08.240 --> 00:19:19.920
I think lifting the board's focus from the immediate IT cyber crisis itself to like we were talking about earlier, to, you know, is this going to be a liquidity issue, all these sort of things?
00:19:20.640 --> 00:19:26.799
Making sure the board tries to stand back, because you you inevitably terminate, you want to dive in and find out who did what and how are we going to fix it.
00:19:27.279 --> 00:19:28.799
Just let the team fix that.
00:19:28.880 --> 00:19:33.279
But what does this actually mean for the company reputationally, financially, all those sort of things?
00:19:33.759 --> 00:19:35.119
I think that adds value.
00:19:35.359 --> 00:19:41.839
And last but not least, I've certainly learned a couple of things that from from your company and which I hadn't realized, but great advice.
00:19:42.000 --> 00:19:49.680
Things like, you know, when you have a cyber attack, immediately you want it to engage an external person to come in and tell us what went wrong and all this analysis.
00:19:49.759 --> 00:19:53.680
And I think you advise us that the law firm should hire that.
00:19:53.839 --> 00:19:54.000
Yeah.
00:19:54.400 --> 00:19:56.319
Not you, which we would have done otherwise.
00:19:56.720 --> 00:19:57.519
Otherwise it doesn't stay.
00:19:57.839 --> 00:19:59.119
Yeah, that's a very privileged term.
00:20:00.720 --> 00:20:02.799
That was a real eye-opener to me.
00:20:03.359 --> 00:20:19.759
I don't know that one company of I haven't worked there, but I've I know people there and they've said they didn't do that and they regretted it bitterly because then the advice they got for themselves, warts and all, mean the kimono, then got used against them in the class action.
00:20:19.839 --> 00:20:23.519
So Because you're dealing with the how and the why.
00:20:23.599 --> 00:20:25.920
And the how and the why have the what?
00:20:26.079 --> 00:20:27.119
The facts are the facts.
00:20:28.240 --> 00:20:30.480
How this happened, why it happened.
00:20:30.799 --> 00:20:33.039
They go straight to legal exposure.
00:20:33.200 --> 00:20:35.519
And that's really what the board needs to know, actually.
00:20:36.640 --> 00:20:43.680
One final thing I'd add is I was talking about how you receive advice or how it's given so that you understand the trade-offs.
00:20:43.920 --> 00:20:51.839
I think one of the things I've found in a crisis has been really unhelpful is when advice is given in an absolute way, because it has a chilling effect.
00:20:52.000 --> 00:20:55.200
You know, if it's like if you do this, you could all go to jail or whatever.
00:20:55.359 --> 00:20:56.559
I'm over-emphasizing it.
00:20:57.359 --> 00:21:01.039
Most of what a board does is operate in the grey and have to make those trade-offs.
00:21:01.200 --> 00:21:12.240
And so being provided with the advice and information in a way where
we can do that, rather than being given in a way that it has a chilling effect, it's really helpful in a crisis because tensions are already quite high.
00:21:12.559 --> 00:21:15.359
I find boards just so you know, we do a lot with them.
00:21:15.599 --> 00:21:17.920
They empower their legal advisors too.
00:21:18.079 --> 00:21:22.720
There wouldn't be a board that I wouldn't go in front of in a in a crisis and they ask, Well, what do you think?
00:21:22.880 --> 00:21:26.400
If you're not willing to be a participant in the room, you may as well not be in the room.
00:21:26.480 --> 00:21:26.640
Yeah.
00:21:26.799 --> 00:21:36.079
And then to your point, John, this idea of this is what's occurred, this is what's about to happen, some of it's not going to be great, unfortunately.
00:21:36.400 --> 00:21:37.920
You may have this occur.
00:21:38.160 --> 00:21:42.960
This is probably going to last, you know, the intensity might be 10, 15 days.
00:21:43.200 --> 00:21:53.359
We may have a long tail, all of that sort of stuff leaning in with the reality of it's a little bit like being told you want all the news, the good and the bad, so you can make an educated decision.
00:21:53.599 --> 00:21:58.799
I find it's the boards that empower those advisors and bring them into the room.
00:21:59.119 --> 00:22:07.599
I encourage you uh in your organizations, if you want the external advisor that's providing the advice, bring them in.
00:22:07.680 --> 00:22:07.839
Yeah.
00:22:08.079 --> 00:22:08.960
Interrogate them.
00:22:09.039 --> 00:22:11.039
I think it's a it's not a bad thing.
00:22:11.279 --> 00:22:14.000
Catherine, John, thank you very much for your time.
00:22:14.160 --> 00:22:18.960
I know that you're incredibly busy, but this is an incredibly important topic for us.
00:22:19.119 --> 00:22:28.559
It touches not just on cyber but on governance more generally, which is why you invite two of our leading chairs in to speak together in this format is unique for us.
00:22:28.640 --> 00:22:30.319
I've loved the interaction between you.
00:22:30.400 --> 00:22:36.880
So just on behalf of the firm and all of our listeners who will get a chance to listen to this podcast and perhaps even see us.
00:22:36.960 --> 00:22:38.000
Thank you so much for your time.
00:22:38.319 --> 00:22:38.480
Thank you.
00:22:38.640 --> 00:22:38.960
Enjoyed it.
00:22:39.519 --> 00:22:40.319
Privilege to be invited.
00:22:40.480 --> 00:22:41.119
Thanks a lot.
00:22:47.440 --> 00:22:51.440
Yes, indeed, a real privilege to have Catherine and John with us in the same room.
00:22:51.599 --> 00:22:54.160
In our next episode, we deviate slightly.
00:22:54.319 --> 00:23:00.559
Taking the opportunity to speak to Charles Carmarkle, Chief Technology Officer from Mandiant Consulting.
00:23:00.799 --> 00:23:06.319
This is before we pick up our director series again with a cross-examination of David Gonsky.
00:23:06.559 --> 00:23:11.759
Thanks again to Catherine and John for such a great conversation, and thanks to you for listening.