Managing messaging with management, becoming a CISO with Mary Gardner from Goldiknox の全文書き起こし

01:04:21,416 --> 01:04:23,033 I mean, having somebody on the board who 96 01:04:23,033 --> 01:04:24,733 actually understands security because 97 01:04:24,733 --> 01:04:28,083 it feels like a lot of these boards are 98 01:04:28,083 --> 01:04:30,183 just there because either you've invited 99 01:04:30,366 --> 01:04:32,633 your friends to hang out with you at your 100 01:04:32,633 --> 01:04:34,516 company or you've 101 01:04:34,516 --> 01:04:37,699 paid the toll fee to get 102 01:04:37,699 --> 01:04:40,416 in to the executive washroom. 103 01:04:40,416 --> 01:04:42,500 I mean, why do you 104 01:04:42,500 --> 01:04:44,466 think they push that back? 105 01:04:44,800 --> 01:04:47,433 Do you think that there was just a lack 106 01:04:47,433 --> 01:04:49,966 of people in the information security 107 01:04:50,033 --> 01:04:51,566 industry that could be on a board? 108 01:04:52,716 --> 01:04:56,433 I think there's a couple reasons. 109 01:04:56,766 --> 01:04:59,683 I think one is there is a lack of people 110 01:04:59,683 --> 01:05:03,333 experienced in information security. 111 01:05:04,099 --> 01:05:06,483 They could sit on a board and understand 112 01:05:06,483 --> 01:05:11,099 all of the rest of the board concerns. 113 01:05:12,783 --> 01:05:15,699 And maybe that's not truly the case. 114 01:05:15,900 --> 01:05:19,400 Maybe it's the general feeling among 115 01:05:19,400 --> 01:05:23,266 corporations who are trying to find 116 01:05:23,266 --> 01:05:24,516 members for their boards. 117 01:05:24,783 --> 01:05:27,033 They want well-rounded board members that 118 01:05:27,033 --> 01:05:30,216 will help them take care 119 01:05:30,216 --> 01:05:32,016 of their company and be good 120 01:05:32,033 --> 01:05:33,666 stewards and help them 121 01:05:33,666 --> 01:05:36,099 manage and grow their companies. 122 01:05:37,616 --> 01:05:40,866 And I think in a lot of cases from a 123 01:05:40,866 --> 01:05:42,400 security perspective, we have 124 01:05:42,400 --> 01:05:44,099 a tendency to speak in terms 125 01:05:44,199 --> 01:05:50,216 of security jargon, vulnerabilities and 126 01:05:50,216 --> 01:05:52,883 breaches and incidents 127 01:05:52,883 --> 01:05:55,116 and response and resilience. 128 01:05:56,366 --> 01:05:59,699 And that's not always the way a 129 01:05:59,699 --> 01:06:02,316 corporation wants to have 130 01:06:02,316 --> 01:06:03,466 their board meetings go. 131 01:06:03,866 --> 01:06:07,183 So I think it's incumbent upon us if we 132 01:06:07,183 --> 01:06:10,199 want people who care 133 01:06:10,199 --> 01:06:12,183 about information security to 134 01:06:12,433 --> 01:06:15,516 start speaking the business language and 135 01:06:15,516 --> 01:06:18,500 really show that we deserve 136 01:06:18,500 --> 01:06:20,433 a place at the board table. 137 01:06:22,099 --> 01:06:25,800 I know we do because frankly, I've had 138 01:06:25,800 --> 01:06:28,016 the pleasure of working with a lot of 139 01:06:28,016 --> 01:06:29,183 security people who are 140 01:06:29,183 --> 01:06:30,583 the smartest kids in the room. 141 01:06:32,133 --> 01:06:36,783 Not just information security, but also 142 01:06:36,783 --> 01:06:38,599 they understand finance. 143 01:06:38,866 --> 01:06:42,000 I think we have to understand finance and 144 01:06:42,000 --> 01:06:45,083 business and technology 145 01:06:45,083 --> 01:06:47,800 and product development 146 01:06:47,966 --> 01:06:49,300 because of what we do. 147 01:06:49,683 --> 01:06:51,400 It's such a broad ranging field. 148 01:06:52,199 --> 01:06:54,383 So I think we can speak to it. 149 01:06:54,383 --> 01:06:55,483 We just need to 150 01:06:55,483 --> 01:06:57,883 convince everybody else we can. 151 01:06:59,216 --> 01:06:59,416 Right. 152 01:07:00,183 --> 01:07:05,466 So you mentioned the language of the 153 01:07:05,466 --> 01:07:07,866 board and I'm kind of interested in that. 154 01:07:08,199 --> 01:07:10,133 I'm sorry, we're going we're going a 155 01:07:10,133 --> 01:07:11,166 little bit further than what 156 01:07:11,166 --> 01:07:12,333 I put on the original Google 157 01:07:12,366 --> 01:07:12,716 notes. 158 01:07:12,716 --> 01:07:14,816 But you talk about the language of the 159 01:07:14,816 --> 01:07:17,233 board and, you know, security people. 160 01:07:18,816 --> 01:07:21,616 So I kind of see that it's like, you 161 01:07:21,616 --> 01:07:22,400 know, you've got your 162 01:07:22,400 --> 01:07:23,633 levels, you've got your tactical, 163 01:07:23,900 --> 01:07:25,500 you've got your operational, you've got 164 01:07:25,500 --> 01:07:26,866 your strategic kind of 165 01:07:26,866 --> 01:07:27,766 stuff, you've got your, 166 01:07:27,766 --> 01:07:29,583 you know, whatever's above strategic, 167 01:07:29,816 --> 01:07:32,616 strategic is fairly broad at that point. 168 01:07:32,616 --> 01:07:35,066 But what do what does 169 01:07:35,066 --> 01:07:35,883 the board care about? 170 01:07:38,150 --> 01:07:42,416 Generally, the bottom line and any any 171 01:07:42,416 --> 01:07:45,199 risks that could impact that. 172 01:07:46,366 --> 01:07:49,800 You know, when I think when we think 173 01:07:49,800 --> 01:07:50,833 about information 174 01:07:50,833 --> 01:07:52,633 security risk, it's always top 175 01:07:52,633 --> 01:07:54,366 of mind for us because we know 176 01:07:54,366 --> 01:07:57,233 what's out there and we know. 177 01:07:57,583 --> 01:08:02,733 I lost my word. 178 01:08:03,433 --> 01:08:05,199 We know the impact it could have. 179 01:08:05,800 --> 01:08:06,066 Right. 180 01:08:06,300 --> 01:08:07,199 And we know that it 181 01:08:07,199 --> 01:08:08,483 could be very detrimental. 182 01:08:09,483 --> 01:08:12,783 But in reality, we have, you know, boards 183 01:08:12,783 --> 01:08:14,833 that are taking care of chains or grocery 184 01:08:14,833 --> 01:08:17,966 stores that have slip and fall issues 185 01:08:17,966 --> 01:08:22,100 from their

customers on a daily basis. 186 01:08:22,783 --> 01:08:24,966 So they have hundreds of 187 01:08:24,966 --> 01:08:26,783 thousands of potential lawsuits. 188 01:08:26,833 --> 01:08:28,366 There are also risks that 189 01:08:28,366 --> 01:08:29,866 risk that they care about. 190 01:08:30,600 --> 01:08:30,816 Right. 191 01:08:31,933 --> 01:08:32,100 Right. 192 01:08:32,100 --> 01:08:34,583 And we have to we have to understand that 193 01:08:34,583 --> 01:08:35,816 and understand where we fit 194 01:08:35,816 --> 01:08:37,216 in that business landscape 195 01:08:37,566 --> 01:08:40,199 and how we ultimately 196 01:08:40,199 --> 01:08:41,500 impact the bottom line. 197 01:08:41,833 --> 01:08:44,116 We have to understand that every time we 198 01:08:44,116 --> 01:08:47,216 create a policy to 199 01:08:47,216 --> 01:08:48,899 require a longer password, 200 01:08:50,466 --> 01:08:52,800 we're adding time to everybody who has to 201 01:08:52,800 --> 01:08:54,933 input a password 10 times a day. 202 01:08:54,933 --> 01:08:55,399 Right. 203 01:08:55,399 --> 01:08:56,533 We're taking that time 204 01:08:56,533 --> 01:08:57,533 from their productivity. 205 01:08:57,633 --> 01:09:00,616 So those are the things 206 01:09:00,616 --> 01:09:02,100 that the board cares about. 207 01:09:02,333 --> 01:09:04,100 They want to understand 208 01:09:04,100 --> 01:09:09,283 that we're a business partner. 209 01:09:09,283 --> 01:09:10,899 We understand the business and we 210 01:09:10,899 --> 01:09:12,633 understand how to enable the 211 01:09:12,633 --> 01:09:14,483 business with security with 212 01:09:14,483 --> 01:09:18,183 good security practices and also that we 213 01:09:18,183 --> 01:09:21,233 can speak to them about 214 01:09:21,233 --> 01:09:23,933 what we've done to impact 215 01:09:23,933 --> 01:09:25,100 the business positively. 216 01:09:25,783 --> 01:09:26,800 Right. Right. 217 01:09:27,083 --> 01:09:28,633 That makes sense. 218 01:09:30,433 --> 01:09:31,300 Yeah. Yeah. 219 01:09:31,500 --> 01:09:32,399 And sort of. 220 01:09:32,683 --> 01:09:34,883 No, I it makes complete sense to me and 221 01:09:34,883 --> 01:09:36,133 I've kind of I don't want 222 01:09:36,133 --> 01:09:36,966 to say I've railed against 223 01:09:36,966 --> 01:09:39,283 this and other shows, but it's like we're 224 01:09:39,283 --> 01:09:42,166 we don't have a lot of 225 01:09:42,166 --> 01:09:44,666 positives that we tend to be able 226 01:09:44,666 --> 01:09:45,500 to look at. 227 01:09:45,766 --> 01:09:47,916 And I guess if you're on a board and 228 01:09:47,916 --> 01:09:49,183 you're always thinking doom 229 01:09:49,183 --> 01:09:50,466 and gloom or you're always 230 01:09:50,516 --> 01:09:52,866 expecting the worst and you know, there 231 01:09:52,866 --> 01:09:54,300 in some ways some of the 232 01:09:54,300 --> 01:09:55,333 board people are expecting 233 01:09:55,399 --> 01:09:57,466 cheerleaders and to be behind an idea. 234 01:09:57,966 --> 01:10:00,366 And when I think of something, especially 235 01:10:00,366 --> 01:10:01,216 at work and I'm not 236 01:10:01,216 --> 01:10:02,316 even at a board level, 237 01:10:02,683 --> 01:10:03,716 I'd like to be one day. 238 01:10:04,433 --> 01:10:06,566 But you know, when a product team or 239 01:10:06,566 --> 01:10:07,283 something comes in and 240 01:10:07,283 --> 01:10:08,316 goes, hey, we've got this great 241 01:10:08,316 --> 01:10:09,183 idea for a floating 242 01:10:09,183 --> 01:10:10,300 toilet seat or whatever. 243 01:10:10,300 --> 01:10:12,383 And it's like why? 244 01:10:13,416 --> 01:10:15,100 And, you know, a product person or a 245 01:10:15,100 --> 01:10:15,916 person who's like, you 246 01:10:15,916 --> 01:10:16,766 know, marketing or whatever 247 01:10:16,766 --> 01:10:18,316 would be like, yeah, that's great. 248 01:10:18,316 --> 01:10:19,133 Yeah, let's let's do that. 249 01:10:19,233 --> 01:10:19,933 Let's sell a million 250 01:10:19,933 --> 01:10:21,433 floating toilet seats. 251 01:10:21,433 --> 01:10:24,000 And the security person is like, we don't 252 01:10:24,000 --> 01:10:25,583 really need a floating toilet seat. 253 01:10:25,800 --> 01:10:28,199 You know, I think in some ways, yeah, 254 01:10:28,199 --> 01:10:29,583 we're there's some 255 01:10:29,583 --> 01:10:31,816 realism there or some, you know, 256 01:10:31,816 --> 01:10:33,399 I don't want to say grounded or whatever, 257 01:10:33,399 --> 01:10:35,300 but security doesn't 258 01:10:35,300 --> 01:10:36,233 come off as being overly 259 01:10:36,233 --> 01:10:36,666 positive. 260 01:10:36,933 --> 01:10:37,833 We're we're restrictive. 261 01:10:38,233 --> 01:10:39,183 We add things. 262 01:10:39,533 --> 01:10:42,399 We we tend to create stumbling blocks 263 01:10:42,399 --> 01:10:43,816 instead of enabling things. 264 01:10:44,600 --> 01:10:46,966 I can I can understand why being on a 265 01:10:46,966 --> 01:10:48,516 board that might be a 266 01:10:48,516 --> 01:10:50,033 limiting thing for the company. 267 01:10:50,033 --> 01:10:52,566 You know, it seems like that would be 268 01:10:52,566 --> 01:10:55,466 best left to legal type folks. 269 01:10:55,466 --> 01:10:57,033 Hey, what kind of risk does 270 01:10:57,033 --> 01:10:58,683 this cause to the organization? 271 01:10:59,183 --> 01:11:02,033 You know, and the lawyers are necessary. 272 01:11:02,366 --> 01:11:04,283 Evil security is not in this case. 273 01:11:04,633 --> 01:11:06,300 And in many cases, they they're 274 01:11:06,300 --> 01:11:07,983 unnecessary where where 275 01:11:07,983 --> 01:11:09,783 legal and PR would be the people 276 01:11:09,783 --> 01:11:10,966 would be like, hey, what is this? 277 01:11:10,966 --> 01:11:11,983 How is this going to affect the company 278 01:11:11,983 --> 01:11:13,316 as a whole instead of? 279 01:11:14,600 --> 01:11:16,183 Those things is that is that 280 01:11:16,183 --> 01:11:17,816 how you're you're

seeing it. 281 01:11:26,166 --> 01:11:28,600 I think that that can be the. 282 01:11:33,149 --> 01:11:36,100 I think that that can definitely be the 283 01:11:36,100 --> 01:11:38,316 way the board sees us. 284 01:11:40,050 --> 01:11:40,283 Right. 285 01:11:40,616 --> 01:11:42,816 We're the we're the Department of No. 286 01:11:43,633 --> 01:11:43,883 Right. 287 01:11:44,633 --> 01:11:44,833 Exactly. 288 01:11:45,183 --> 01:11:45,483 We're exactly. 289 01:11:45,833 --> 01:11:48,116 We're the reason we can't do things. 290 01:11:49,033 --> 01:11:49,233 Right. 291 01:11:49,483 --> 01:11:53,800 And I think we get a bad rap. 292 01:11:54,966 --> 01:11:58,583 Because honestly, I a lot of the security 293 01:11:58,583 --> 01:12:01,100 people I know want to help 294 01:12:01,100 --> 01:12:02,866 people figure out how to do 295 01:12:02,866 --> 01:12:03,766 things securely. 296 01:12:04,899 --> 01:12:05,183 Right. 297 01:12:06,516 --> 01:12:08,733 And what we've got to do. 298 01:12:08,833 --> 01:12:14,033 There's a tension between the product 299 01:12:14,033 --> 01:12:15,083 people that want to make 300 01:12:15,083 --> 01:12:16,433 the floating toilet seat 301 01:12:17,233 --> 01:12:19,399 and the security people that want to 302 01:12:19,399 --> 01:12:20,716 attach it to the right plumbing. 303 01:12:21,483 --> 01:12:21,766 Right. 304 01:12:22,133 --> 01:12:22,333 Right. 305 01:12:22,750 --> 01:12:22,916 Right. 306 01:12:24,183 --> 01:12:27,183 And we have to I think we 307 01:12:27,183 --> 01:12:29,100 have to figure out a way to 308 01:12:31,966 --> 01:12:34,699 move through that tension and be a team 309 01:12:34,699 --> 01:12:36,333 that that functions as a whole. 310 01:12:37,316 --> 01:12:38,833 It's not us and them. 311 01:12:38,833 --> 01:12:41,033 It's ultimately I think what the board 312 01:12:41,033 --> 01:12:43,916 wants to see is a cohesive 313 01:12:43,916 --> 01:12:46,983 team that's working to build 314 01:12:47,883 --> 01:12:49,933 the business and make the business more 315 01:12:49,933 --> 01:12:51,699 profitable because you 316 01:12:51,699 --> 01:12:53,116 need both sides of that point. 317 01:12:54,199 --> 01:12:55,966 But I think sometimes what 318 01:12:55,966 --> 01:13:00,116 the board sees is a brokenness. 319 01:13:01,483 --> 01:13:02,199 Like a line. 320 01:13:02,483 --> 01:13:02,683 Or a friction. 321 01:13:03,516 --> 01:13:03,616 Yeah. 322 01:13:04,600 --> 01:13:06,566 And I think you felt that friction. 323 01:13:07,600 --> 01:13:07,800 Yeah. 324 01:13:08,016 --> 01:13:08,899 I feel it all the time 325 01:13:08,899 --> 01:13:09,883 and I'm not even on a board. 326 01:13:10,333 --> 01:13:13,616 It's like just trying to get people in a 327 01:13:13,616 --> 01:13:14,600 product team to 328 01:13:14,600 --> 01:13:15,716 understand, hey, you're not. 329 01:13:17,166 --> 01:13:18,716 It's not that you can't do that. 330 01:13:18,716 --> 01:13:19,533 It's that you're going. 331 01:13:20,850 --> 01:13:23,333 I understand the evil that bad people are 332 01:13:23,333 --> 01:13:24,133 going to do with something 333 01:13:24,133 --> 01:13:25,183 that might actually be a good 334 01:13:25,183 --> 01:13:25,500 thing. 335 01:13:25,916 --> 01:13:30,283 But yeah, it's hard, especially with 336 01:13:30,283 --> 01:13:32,666 ideal and IoT security. 337 01:13:32,699 --> 01:13:36,333 So privacy, security, the floating toilet 338 01:13:36,333 --> 01:13:38,116 seats exist everywhere and 339 01:13:38,116 --> 01:13:39,000 everybody thinks they're a 340 01:13:39,000 --> 01:13:39,566 great idea. 341 01:13:40,016 --> 01:13:45,983 And it just ends up being a trading game. 342 01:13:45,983 --> 01:13:48,300 It's like, OK, yeah, OK, you can put that 343 01:13:48,300 --> 01:13:51,466 out, but you're going to run into issues. 344 01:13:51,983 --> 01:13:54,983 Or at times I've ended up having to 345 01:13:54,983 --> 01:13:56,616 leverage legal or PR and 346 01:13:56,616 --> 01:13:59,616 say, hey, there's a similar 347 01:13:59,733 --> 01:14:00,966 product out there or there's 348 01:14:00,966 --> 01:14:04,000 a real risk of this happening. 349 01:14:04,000 --> 01:14:06,916 And sometimes we resort to FUD and 350 01:14:06,916 --> 01:14:08,766 sometimes we resort to things 351 01:14:08,766 --> 01:14:10,466 that don't make any sense or 352 01:14:11,483 --> 01:14:12,433 yeah, asteroids are 353 01:14:12,433 --> 01:14:13,266 going to hit the earth. 354 01:14:13,266 --> 01:14:14,283 We need to worry about that. 355 01:14:14,500 --> 01:14:17,899 And I can understand we've shot ourselves 356 01:14:17,899 --> 01:14:19,616 in the foot with that for years. 357 01:14:19,616 --> 01:14:21,066 It took us 20 years to get people to 358 01:14:21,066 --> 01:14:23,433 adopt really complicated passwords. 359 01:14:23,433 --> 01:14:24,500 And then it's like, oh, no, 360 01:14:24,500 --> 01:14:27,066 no, now you need to do 2FA. 361 01:14:27,100 --> 01:14:29,583 And it's like, we just got passwords. 362 01:14:30,466 --> 01:14:32,183 So now we need to go to-- 363 01:14:32,416 --> 01:14:32,616 yeah. 364 01:14:34,433 --> 01:14:36,266 Anyway, so yeah. 365 01:14:37,000 --> 01:14:44,433 It's interesting because you 366 01:14:44,433 --> 01:14:46,966 can play the spin game with 2FA. 367 01:14:48,666 --> 01:14:50,533 And you can make it-- 368 01:14:51,666 --> 01:14:53,399 in the past, I've been able 369 01:14:53,399 --> 01:14:58,066 to make 2FA a business enabler. 370 01:14:58,533 --> 01:14:59,399 Yeah. 371 01:15:00,066 --> 01:15:02,399 Because you're putting it in place and 372 01:15:02,399 --> 01:15:03,566 you can reduce the 373 01:15:03,566 --> 01:15:05,216 times you use the passwords. 374 01:15:06,066 --> 01:15:06,266 Right? 375 01:15:06,816 --> 01:15:07,016 Right. 376 01:15:09,316 --> 01:15:10,316 So I think it's-- 377 01:15:11,366 --> 01:15:13,933 I'm not a marketing person and I don't 378 01:15:13,933 --> 01:15:15,383 want

to play one on TV. 379 01:15:15,733 --> 01:15:16,633 Please don't make me. 380 01:15:17,316 --> 01:15:19,966 But I think it's about how you approach 381 01:15:19,966 --> 01:15:22,916 the business when you're saying, 382 01:15:23,600 --> 01:15:26,583 hey, look, we need to change because this 383 01:15:26,583 --> 01:15:27,716 is going to make it better. 384 01:15:33,633 --> 01:15:36,183 If you give them real reasons and show 385 01:15:36,183 --> 01:15:37,483 them it'll make it better, 386 01:15:40,616 --> 01:15:42,016 you can really get a 387 01:15:42,016 --> 01:15:43,133 business win out of it. 388 01:15:44,116 --> 01:15:47,533 I've actually had customers 389 01:15:47,533 --> 01:15:49,333 send my team thank you notes. 390 01:15:50,850 --> 01:15:53,000 And I'm talking executive customers send 391 01:15:53,000 --> 01:15:53,916 my team thank you 392 01:15:53,916 --> 01:15:55,716 notes for deploying 2FA. 393 01:15:56,816 --> 01:15:57,016 Nice. 394 01:15:58,100 --> 01:15:58,283 Yeah. 395 01:15:58,433 --> 01:16:00,333 Because we made it simple. 396 01:16:00,883 --> 01:16:02,316 We held hands. 397 01:16:03,666 --> 01:16:06,416 And we enabled some things we wouldn't 398 01:16:06,416 --> 01:16:07,283 have otherwise been 399 01:16:07,283 --> 01:16:09,166 able to help them with. 400 01:16:09,983 --> 01:16:10,500 That's great. 401 01:16:11,083 --> 01:16:13,633 It depends on how you 402 01:16:13,633 --> 01:16:14,783 approach things, right? 403 01:16:15,466 --> 01:16:15,666 Right. 404 01:16:16,316 --> 01:16:16,516 Yeah. 405 01:16:17,166 --> 01:16:18,166 But that doesn't help with 406 01:16:18,166 --> 01:16:19,199 the floating toilet seat. 407 01:16:21,566 --> 01:16:23,483 I have to use that because if I actually 408 01:16:23,483 --> 01:16:24,416 mentioned something, 409 01:16:25,199 --> 01:16:28,500 yeah, I don't want it to be-- 410 01:16:28,600 --> 01:16:30,983 I tried to think about the most useless 411 01:16:30,983 --> 01:16:34,033 thing ever for an IoT connected device. 412 01:16:34,033 --> 01:16:35,566 And a floating toilet seat seems like the 413 01:16:35,566 --> 01:16:36,783 most obvious choice there. 414 01:16:37,416 --> 01:16:38,766 It's a good one. 415 01:16:39,366 --> 01:16:39,600 Yeah. 416 01:16:40,116 --> 01:16:43,666 I completely agree. 417 01:16:43,933 --> 01:16:46,416 And you mentioned, I think before we 418 01:16:46,416 --> 01:16:47,583 talked, you've worked with 419 01:16:47,583 --> 01:16:50,199 medical organizations and 420 01:16:50,199 --> 01:16:50,816 what have you. 421 01:16:51,033 --> 01:16:53,466 And I used to do audits for those things. 422 01:16:53,466 --> 01:16:55,016 And one of the biggest things that we saw 423 01:16:55,016 --> 01:16:57,533 as problems was password enforcement. 424 01:16:57,566 --> 01:16:59,316 Because doctors didn't want to have to 425 01:16:59,316 --> 01:17:02,316 enter their multi-character password 426 01:17:02,316 --> 01:17:03,600 multiple times a day. 427 01:17:04,316 --> 01:17:06,166 And to your point, things like MFA or 428 01:17:06,166 --> 01:17:08,666 badges or something, some kind of system, 429 01:17:08,683 --> 01:17:13,600 tap and go increases security and it 430 01:17:13,600 --> 01:17:15,816 decreases the amount of mistakes. 431 01:17:16,533 --> 01:17:18,933 There are specific things we can do in 432 01:17:18,933 --> 01:17:21,733 security that will help. 433 01:17:22,800 --> 01:17:26,133 And things like badging or that if we can 434 01:17:26,133 --> 01:17:27,300 make MFA more seamless 435 01:17:27,300 --> 01:17:28,483 where we're not having a 15 436 01:17:28,483 --> 01:17:29,866 character password that we have to 437 01:17:29,866 --> 01:17:31,933 enforce and everything, those are great. 438 01:17:32,383 --> 01:17:35,699 And it's great that you could implement 439 01:17:35,699 --> 01:17:36,816 that at your organization. 440 01:17:37,083 --> 01:17:40,033 I don't think we have enough wins like 441 01:17:40,033 --> 01:17:40,600 that in an 442 01:17:40,600 --> 01:17:42,033 organization from time to time. 443 01:17:42,383 --> 01:17:43,816 And it's unfortunate. 444 01:17:44,300 --> 01:17:44,500 So. 445 01:17:45,800 --> 01:17:46,016 Yeah. 446 01:17:47,916 --> 01:17:49,066 And I think part of it 447 01:17:49,066 --> 01:17:50,399 is how we approach things. 448 01:17:51,100 --> 01:17:54,316 If the first word out of our mouth is no. 449 01:17:55,233 --> 01:17:55,566 Right. 450 01:17:56,533 --> 01:17:58,066 Instead of help me understand why. 451 01:17:58,833 --> 01:17:59,133 Right. 452 01:17:59,983 --> 01:18:01,133 And how do we get to... 453 01:18:02,033 --> 01:18:03,833 It's not even 454 01:18:03,833 --> 01:18:06,100 necessarily how we get to yes, but 455 01:18:08,183 --> 01:18:09,699 what's the right thing to do for the 456 01:18:09,699 --> 01:18:11,183 company and how do we get there? 457 01:18:12,033 --> 01:18:12,233 Right. 458 01:18:12,666 --> 01:18:12,866 Yeah. 459 01:18:13,233 --> 01:18:14,716 Yeah, I know that that makes sense. 460 01:18:14,716 --> 01:18:15,216 That makes sense. 461 01:18:16,766 --> 01:18:19,516 So I'm going to start off with the bullet 462 01:18:19,516 --> 01:18:20,516 point that we have in 463 01:18:20,516 --> 01:18:21,633 the in the Google Doc that 464 01:18:21,633 --> 01:18:22,800 kind of leads us to 465 01:18:22,800 --> 01:18:23,666 where we're at right now. 466 01:18:24,116 --> 01:18:25,699 Security people are not going to be on 467 01:18:25,699 --> 01:18:26,583 the board currently. 468 01:18:27,083 --> 01:18:29,383 At some point, the SEC will hopefully 469 01:18:29,383 --> 01:18:30,783 allow that to happen or 470 01:18:30,783 --> 01:18:31,883 find some way to make that 471 01:18:32,283 --> 01:18:32,399 legitimate. 472 01:18:33,083 --> 01:18:34,683 But I saw our Harvard 473 01:18:34,683 --> 01:18:37,000 Business Review article from 2023. 474 01:18:37,266 --> 01:18:38,416 I love Harvard Business Review. 475 01:18:38,916 -->

01:18:40,016 I don't know why they just 476 01:18:40,016 --> 01:18:41,116 have really great articles. 477 01:18:43,316 --> 01:18:44,500 It says boards are having the wrong 478 01:18:44,500 --> 01:18:45,899 conversations about cybersecurity. 479 01:18:46,116 --> 01:18:47,199 And one of the things that I read in 480 01:18:47,199 --> 01:18:48,566 there was they said 69% 481 01:18:49,016 --> 01:18:50,533 of board members responding 482 01:18:50,600 --> 01:18:51,266 board members. 483 01:18:51,266 --> 01:18:52,183 So they sent out a survey. 484 01:18:52,216 --> 01:18:52,416 Okay. 485 01:18:54,133 --> 01:18:56,383 Members, board members see 69% of 486 01:18:56,383 --> 01:18:57,483 responding board members see 487 01:18:57,483 --> 01:18:58,583 eye to eye with their chief 488 01:18:58,600 --> 01:18:59,833 information security officers. 489 01:19:00,066 --> 01:19:02,000 So just 69%, which I'm 490 01:19:02,000 --> 01:19:03,616 thinking that's pretty good. 491 01:19:03,616 --> 01:19:05,199 You know, three quarters, three quarters 492 01:19:05,199 --> 01:19:06,483 see eye to eye with their CISOs. 493 01:19:07,133 --> 01:19:09,283 Fewer than half of members serve on 494 01:19:09,283 --> 01:19:10,083 boards that interact 495 01:19:10,083 --> 01:19:11,583 with their CISOs regularly. 496 01:19:11,583 --> 01:19:12,000 47% 497 01:19:13,316 --> 01:19:15,116 in, you know, serve on boards that 498 01:19:15,116 --> 01:19:17,016 interact with CISOs regularly. 499 01:19:17,416 --> 01:19:21,100 And a third of those 47% only see their 500 01:19:21,100 --> 01:19:22,583 CISOs in board presentations. 501 01:19:24,883 --> 01:19:28,133 It is that indicative of what you've seen 502 01:19:28,133 --> 01:19:31,983 in your career is like, you 503 01:19:31,983 --> 01:19:33,216 know, we only see the CISO 504 01:19:33,216 --> 01:19:35,266 when either something bad has happened. 505 01:19:35,266 --> 01:19:37,316 Again, back to security, we only see the 506 01:19:37,316 --> 01:19:38,699 CISO when something bad happens. 507 01:19:39,716 --> 01:19:42,399 Or, you know, is it, you know, formal 508 01:19:42,399 --> 01:19:43,333 presentations about 509 01:19:43,333 --> 01:19:44,883 initiatives or goals for the next year? 510 01:19:45,133 --> 01:19:45,783 I mean, what is it? 511 01:19:45,816 --> 01:19:47,916 Is that indicative of what you're saying? 512 01:19:49,416 --> 01:19:53,133 Yeah, typically, it's generally the 513 01:19:53,133 --> 01:19:54,283 boards meet quarterly. 514 01:19:56,383 --> 01:19:59,399 You from a CISO perspective, what I've 515 01:19:59,399 --> 01:20:01,300 seen is we generally 516 01:20:01,300 --> 01:20:02,816 present twice a year. 517 01:20:04,216 --> 01:20:05,616 It's a formal presentation. 518 01:20:07,600 --> 01:20:09,966 10 minutes to a half hour on the agenda. 519 01:20:11,183 --> 01:20:13,483 And, you know, it's, it's very scripted. 520 01:20:15,983 --> 01:20:20,366 The, probably I've, I've worked with four 521 01:20:20,366 --> 01:20:22,716 boards over the past 15 years. 522 01:20:23,399 --> 01:20:28,716 And the most productive board meetings 523 01:20:28,716 --> 01:20:30,633 I've had are those where 524 01:20:30,633 --> 01:20:32,966 I've established relationships 525 01:20:33,083 --> 01:20:34,383 with the board members 526 01:20:34,383 --> 01:20:37,466 outside of the board room. 527 01:20:37,883 --> 01:20:40,183 I.e., you know, meeting with them, 528 01:20:40,399 --> 01:20:41,233 meeting with a couple 529 01:20:41,233 --> 01:20:42,666 interested ones monthly 530 01:20:43,633 --> 01:20:46,733 so that we can go over some metrics, what 531 01:20:46,733 --> 01:20:47,699 interests the board, 532 01:20:48,699 --> 01:20:50,733 what are the topics they're discussing, 533 01:20:52,233 --> 01:20:53,666 you know, and what's hitting the media. 534 01:20:54,166 --> 01:20:54,833 And how are we 535 01:20:54,833 --> 01:20:56,066 addressing it as a company? 536 01:20:56,883 --> 01:20:58,600 So I've, I've been able to 537 01:20:58,600 --> 01:21:01,066 establish that with two boards. 538 01:21:02,833 --> 01:21:03,833 Really positive. 539 01:21:04,583 --> 01:21:07,100 And they were boards that I was able to 540 01:21:07,100 --> 01:21:09,933 either whiteboard with, you know, 541 01:21:10,066 --> 01:21:13,766 or have involved in tabletop exercises. 542 01:21:14,600 --> 01:21:16,516 Having board members actually involved 543 01:21:16,516 --> 01:21:20,399 with some of the response preparation, 544 01:21:21,850 --> 01:21:22,616 I think is really 545 01:21:22,616 --> 01:21:24,183 important and really eye opening. 546 01:21:24,733 --> 01:21:27,733 So they get to see what you deal with 547 01:21:27,733 --> 01:21:30,183 when you think there's an 548 01:21:30,183 --> 01:21:32,333 issue and how you deal with it. 549 01:21:32,766 --> 01:21:42,566 So I think the more interested you can 550 01:21:42,566 --> 01:21:44,166 get the board members, the better. 551 01:21:44,516 --> 01:21:47,883 But I think those numbers are accurate. 552 01:21:48,733 --> 01:21:49,583 They're very 553 01:21:49,583 --> 01:21:51,100 indicative of what I've seen. 554 01:21:52,233 --> 01:21:52,433 Right. 555 01:21:54,183 --> 01:21:54,383 Huh. 556 01:21:55,183 --> 01:21:55,866 So, okay. 557 01:21:56,816 --> 01:22:00,483 So I'm, I'm, I'm, you have 558 01:22:00,483 --> 01:22:01,133 Goldie Knox and I'm, I'm, 559 01:22:01,316 --> 01:22:03,666 I'm, I'm going to assume, 560 01:22:03,666 --> 01:22:04,766 please tell me if I'm wrong here. 561 01:22:04,766 --> 01:22:06,600 This is a, like a virtual CSO thing. 562 01:22:06,600 --> 01:22:09,633 So this is for companies that maybe don't 563 01:22:09,633 --> 01:22:12,866 have a functional on full-time CSO. 564 01:22:13,166 --> 01:22:13,833 They're either startup 565 01:22:13,833 --> 01:22:14,699 or something like that. 566 01:22:14,699 --> 01:22:15,933 Is that sort of understanding? 567 01:22:17,333 --> 01:22:19,583 We do do some

virtual CSO work. 568 01:22:19,833 --> 01:22:22,133 We also, you know, one of, one of my 569 01:22:22,133 --> 01:22:23,933 goals is to help a transitional CSO. 570 01:22:25,816 --> 01:22:28,100 So somebody that's new to the role or 571 01:22:28,100 --> 01:22:31,699 somebody who is moving 572 01:22:31,699 --> 01:22:33,566 from one industry to another, 573 01:22:33,899 --> 01:22:36,566 help them establish more patterns. 574 01:22:36,816 --> 01:22:39,433 But we also do offer the virtual or the 575 01:22:39,433 --> 01:22:41,000 fractional CSO services. 576 01:22:41,500 --> 01:22:41,699 Okay. 577 01:22:42,350 --> 01:22:42,683 Cool. 578 01:22:42,683 --> 01:22:43,816 So you're like a CSO 579 01:22:43,816 --> 01:22:45,483 mentor or something like that. 580 01:22:45,483 --> 01:22:46,699 You mentor CSOs. 581 01:22:47,800 --> 01:22:48,333 I hope so. 582 01:22:50,883 --> 01:22:52,816 Well, so I was just wondering from a, 583 01:22:52,816 --> 01:22:54,416 from a virtual CSO point of view, 584 01:22:55,000 --> 01:22:57,666 that relationship must be even more 585 01:22:57,666 --> 01:22:59,783 complicated and difficult because 586 01:23:00,033 --> 01:23:01,366 you're not really part of the company. 587 01:23:02,133 --> 01:23:02,766 You know, it's, it's very 588 01:23:02,766 --> 01:23:05,266 similar to, and I apologize. 589 01:23:05,483 --> 01:23:07,533 I only have my own experiences to go on. 590 01:23:07,533 --> 01:23:09,616 It's like somebody in the company tells 591 01:23:09,616 --> 01:23:11,699 you something's wrong with a system. 592 01:23:12,199 --> 01:23:13,516 You know, management's 593 01:23:13,516 --> 01:23:14,300 not listening to you, 594 01:23:14,300 --> 01:23:15,633 but then you bring in a third party pen 595 01:23:15,633 --> 01:23:17,600 testing or security assessment firm who 596 01:23:17,600 --> 01:23:19,100 comes in, finds the same thing. 597 01:23:19,699 --> 01:23:21,566 They give a $50,000 report 598 01:23:21,566 --> 01:23:23,300 and now management cares. 599 01:23:23,883 --> 01:23:25,466 And you're like, hello, I 600 01:23:25,466 --> 01:23:26,516 was, I was here the whole time. 601 01:23:27,116 --> 01:23:30,683 So what is a, you know, for the, for the 602 01:23:30,683 --> 01:23:31,433 folks out there like, 603 01:23:31,433 --> 01:23:33,433 Hey, I think I could be a virtual CSO or, 604 01:23:33,716 --> 01:23:34,333 you know, I'm, I'm 605 01:23:34,333 --> 01:23:35,916 thinking about becoming a CSO. 606 01:23:36,916 --> 01:23:37,566 What is it? 607 01:23:38,083 --> 01:23:40,100 I mean, what are some of the first things 608 01:23:40,100 --> 01:23:42,283 that they can do when they're, you know, 609 01:23:42,283 --> 01:23:44,133 trying to get in good with the board? 610 01:23:44,133 --> 01:23:45,566 Is it, is it definitely meet the board 611 01:23:45,566 --> 01:23:47,016 members over coffee somewhere else? 612 01:23:47,016 --> 01:23:50,133 It's outside the, the work or what, what, 613 01:23:50,133 --> 01:23:51,533 what kind of things can they do to when 614 01:23:51,566 --> 01:23:53,383 they hit the ground running, you know, 615 01:23:54,683 --> 01:23:56,616 not, you know, you know, mess up. 616 01:23:57,966 --> 01:23:59,383 Yeah. I, I think it's fine 617 01:23:59,383 --> 01:24:00,616 to champion on the board. 618 01:24:02,016 --> 01:24:04,833 Um, you know, and I, I found them a 619 01:24:04,833 --> 01:24:05,966 couple of different ways. 620 01:24:06,233 --> 01:24:09,916 Number one through a CFO that I had a 621 01:24:09,916 --> 01:24:11,000 really good relationship 622 01:24:11,000 --> 01:24:13,616 with gave me some introductions 623 01:24:13,716 --> 01:24:16,916 before the first board meeting so that we 624 01:24:16,916 --> 01:24:18,000 could, we could talk 625 01:24:18,000 --> 01:24:19,066 through and sit down and 626 01:24:20,033 --> 01:24:21,283 walk through some meetings. 627 01:24:21,533 --> 01:24:25,716 I don't, I don't know that you want to go 628 01:24:25,716 --> 01:24:28,000 as informal as a coffee shop, 629 01:24:29,266 --> 01:24:32,133 but a zoom meeting, um, you 630 01:24:32,133 --> 01:24:33,399 know, because it's not really, 631 01:24:34,466 --> 01:24:37,083 it still has to be a formal relationship 632 01:24:37,083 --> 01:24:40,733 because of the, um, oversight. 633 01:24:41,333 --> 01:24:43,716 And there's still some stuff that you, 634 01:24:44,683 --> 01:24:47,183 you have to take to the 635 01:24:47,183 --> 01:24:48,583 general session of the board, 636 01:24:48,683 --> 01:24:50,666 rather than just with a couple of people. 637 01:24:51,000 --> 01:24:53,033 But you can ask those couple 638 01:24:53,033 --> 01:24:55,083 of people how to approach it. 639 01:24:55,783 --> 01:24:58,100 Right. What's the best way to walk 640 01:24:58,100 --> 01:25:01,383 through it and, you know, have a mentor 641 01:25:01,383 --> 01:25:02,633 on the board or somebody 642 01:25:02,683 --> 01:25:06,316 who can help you understand what that 643 01:25:06,316 --> 01:25:07,533 particular board is 644 01:25:07,533 --> 01:25:10,533 concerned about. But generally I've, 645 01:25:10,633 --> 01:25:12,633 I've found those mentors through 646 01:25:12,633 --> 01:25:17,216 management. So either working with the 647 01:25:17,216 --> 01:25:18,416 general council or the 648 01:25:18,516 --> 01:25:23,699 CFO, or in some cases the CIO and the 649 01:25:23,699 --> 01:25:26,716 CEO, it's dependent. 650 01:25:28,633 --> 01:25:28,833 Right. 651 01:25:28,899 --> 01:25:31,000 But yeah, I would say when you hit the 652 01:25:31,000 --> 01:25:32,083 ground and you know, 653 01:25:34,683 --> 01:25:36,716 you know, you're going to be in charge of 654 01:25:36,716 --> 01:25:39,083 security, you need to 655 01:25:39,083 --> 01:25:41,033 establish those relationships, 656 01:25:41,316 --> 01:25:44,716 both from a board perspective and a 657 01:25:44,716 --> 01:25:46,000 leadership and executive 658 01:25:46,000 --> 01:25:47,116

leadership perspective, 659 01:25:47,883 --> 01:25:50,399 because you need to work with everybody 660 01:25:50,399 --> 01:25:51,783 on the leadership team. 661 01:25:54,466 --> 01:25:57,216 I think we all, all security 662 01:25:57,216 --> 01:25:58,616 professionals at some point 663 01:25:58,616 --> 01:26:00,283 say security is a team sport. 664 01:26:00,916 --> 01:26:01,216 Right. 665 01:26:02,433 --> 01:26:04,933 And it really is. You have to engage the 666 01:26:04,933 --> 01:26:06,483 entire company to 667 01:26:06,483 --> 01:26:08,033 help make you successful. 668 01:26:09,066 --> 01:26:09,216 Right. 669 01:26:09,233 --> 01:26:15,716 Right. So so you have to find your your 670 01:26:15,716 --> 01:26:17,833 cheerleaders, your your, you know, 671 01:26:17,833 --> 01:26:19,616 you have to figure out, you know, where 672 01:26:19,616 --> 01:26:21,183 everybody is on the spectrum. So you've 673 01:26:21,183 --> 01:26:22,683 got your attractors, 674 01:26:22,683 --> 01:26:24,966 your your cheerleaders, your your math, 675 01:26:25,333 --> 01:26:26,516 your your people are kind 676 01:26:26,516 --> 01:26:27,633 of middle of the road kind of 677 01:26:27,633 --> 01:26:32,433 thing. It seems like being a see so it's 678 01:26:32,433 --> 01:26:33,199 one of those things that 679 01:26:33,199 --> 01:26:34,183 what got you there won't get 680 01:26:34,199 --> 01:26:37,916 you here kind of things or I know I'm 681 01:26:37,916 --> 01:26:38,766 messing that up, but it's 682 01:26:38,766 --> 01:26:40,383 like at some point you're going 683 01:26:40,383 --> 01:26:42,216 to have to change the way you operate 684 01:26:42,216 --> 01:26:43,783 being a see so or being 685 01:26:43,783 --> 01:26:45,566 even a director of security if 686 01:26:45,566 --> 01:26:47,633 they don't have a see so is on a 687 01:26:47,633 --> 01:26:48,699 completely different level 688 01:26:48,699 --> 01:26:50,416 than than a lot of things that 689 01:26:50,416 --> 01:26:53,583 you've been doing. You've you've made 690 01:26:53,583 --> 01:26:55,683 that transition at some 691 01:26:55,683 --> 01:26:57,300 point in your career. So 692 01:26:58,116 --> 01:27:01,466 what did you find the most difficult when 693 01:27:01,466 --> 01:27:03,283 you made that transition 694 01:27:03,283 --> 01:27:04,933 like you you made the conscious 695 01:27:04,933 --> 01:27:06,983 ever, hey, I'm going to be a see so and 696 01:27:06,983 --> 01:27:08,766 one, I'd love to understand, 697 01:27:08,766 --> 01:27:10,500 you know, what motivated you 698 01:27:10,500 --> 01:27:14,100 to go that route. And, you know, what did 699 01:27:14,100 --> 01:27:15,566 you find difficult there? 700 01:27:15,816 --> 01:27:17,366 Or what did you find easy, 701 01:27:17,399 --> 01:27:20,566 you know, and I understand, depending on 702 01:27:20,566 --> 01:27:21,433 the personality, it's 703 01:27:21,433 --> 01:27:22,433 different. But, you know, 704 01:27:22,699 --> 01:27:24,399 I'd love to hear your insights on that. 705 01:27:26,116 --> 01:27:32,033 Um, so what motivated me I, I found 706 01:27:32,033 --> 01:27:34,800 myself in management, from 707 01:27:34,800 --> 01:27:37,666 a security perspective, it's 708 01:27:37,666 --> 01:27:44,433 I had some really amazing people who 709 01:27:44,433 --> 01:27:45,616 served as my mentors 710 01:27:45,616 --> 01:27:48,283 throughout my career and sponsors. 711 01:27:48,533 --> 01:27:56,033 And they helped me build myself into a 712 01:27:56,033 --> 01:28:00,066 director of security or position. And 713 01:28:01,883 --> 01:28:04,600 I realized that the next step for me was 714 01:28:04,600 --> 01:28:05,666 going to be see so if I 715 01:28:05,666 --> 01:28:06,966 wanted to continue to grow. 716 01:28:08,466 --> 01:28:13,083 So my biggest challenge and 717 01:28:13,083 --> 01:28:15,216 it's still a challenge. I'm 718 01:28:15,233 --> 01:28:20,100 I am not comfortable in front of big 719 01:28:20,100 --> 01:28:23,683 audiences. I am I am not a natural 720 01:28:23,683 --> 01:28:26,199 speaker, public speaker. 721 01:28:26,899 --> 01:28:30,116 I like conversations. I like, you know, 722 01:28:30,800 --> 01:28:33,699 building a team. But I've 723 01:28:33,699 --> 01:28:36,433 had to really work on presence 724 01:28:37,016 --> 01:28:42,633 and building the ability to sit in front 725 01:28:42,633 --> 01:28:44,199 of a board and not have my 726 01:28:44,199 --> 01:28:45,566 heart beat out of my chest. 727 01:28:47,466 --> 01:28:50,633 And just finding ways to get through 728 01:28:50,633 --> 01:28:53,866 that. And probably the other big 729 01:28:53,866 --> 01:28:55,716 challenge I had was taking 730 01:28:57,000 --> 01:29:02,333 geek speak and learning how to take that 731 01:29:02,333 --> 01:29:04,800 to a boardroom and make it 732 01:29:04,800 --> 01:29:06,583 relevant to the board and 733 01:29:06,600 --> 01:29:11,233 to leadership. The first time I presented 734 01:29:11,233 --> 01:29:15,383 to the board, I walked in 735 01:29:15,383 --> 01:29:17,733 with a presentation and it 736 01:29:17,733 --> 01:29:22,883 talked about this date, or 853 and the 17 737 01:29:22,883 --> 01:29:25,083 control families and the 250 738 01:29:25,083 --> 01:29:27,433 controls and I'm boring you 739 01:29:27,566 --> 01:29:31,733 talking about this. No, I can't tell you 740 01:29:31,733 --> 01:29:33,866 what the faces on the board look like. 741 01:29:34,433 --> 01:29:41,366 It was it was a hard lesson to learn, but 742 01:29:41,366 --> 01:29:43,000 I think I put most of the 743 01:29:43,000 --> 01:29:44,466 people in that room to sleep. 744 01:29:45,199 --> 01:29:51,416 Well, so I guess I guess the question is, 745 01:29:52,066 --> 01:29:53,800 did they did they ask 746 01:29:53,800 --> 01:29:54,816 for that? Is that what they 747 01:29:54,816 --> 01:29:58,733 wanted or is that what I'm trying not to 748 01:29:58,733 --> 01:29:59,866 sound is that what you

think they wanted? 749 01:30:00,033 --> 01:30:03,266 It's what I thought they wanted. It's 750 01:30:03,266 --> 01:30:04,033 reading the room, 751 01:30:04,033 --> 01:30:05,033 right? It's reading the room. 752 01:30:05,333 --> 01:30:07,133 Yeah, it was what I 753 01:30:07,133 --> 01:30:09,600 thought they wanted based on 754 01:30:11,600 --> 01:30:14,616 conversations with my management chain 755 01:30:14,616 --> 01:30:19,366 and some of the people 756 01:30:19,366 --> 01:30:20,583 who were advising me. 757 01:30:21,116 --> 01:30:23,883 I don't think any of us really knew what 758 01:30:23,883 --> 01:30:25,433 the board wanted in terms of 759 01:30:25,433 --> 01:30:27,566 cybersecurity, right? This is 760 01:30:30,483 --> 01:30:39,633 the 2012-2013 time frame. We were trying 761 01:30:39,633 --> 01:30:41,616 to figure it out and I 762 01:30:41,616 --> 01:30:43,733 wanted to talk to the board about 763 01:30:44,283 --> 01:30:47,083 what our framework would look like and 764 01:30:47,083 --> 01:30:48,083 what we were trying to 765 01:30:48,083 --> 01:30:54,500 achieve. That was way too detailed. 766 01:30:55,383 --> 01:30:59,983 Okay. They want to know that we 767 01:30:59,983 --> 01:31:01,416 understand what our 768 01:31:01,416 --> 01:31:04,566 risks are, that we understand 769 01:31:05,633 --> 01:31:08,183 where we need security to speak to our 770 01:31:08,183 --> 01:31:11,916 customers and enable business. 771 01:31:13,366 --> 01:31:18,266 They want to understand if there's any 772 01:31:18,266 --> 01:31:22,483 risks that they need to help with. I 773 01:31:22,483 --> 01:31:23,533 think ultimately the 774 01:31:23,583 --> 01:31:25,683 board really wants to help the security 775 01:31:25,683 --> 01:31:28,233 program. They just don't know 776 01:31:28,233 --> 01:31:31,583 how. Right. That makes sense. 777 01:31:33,733 --> 01:31:39,583 At that point in time, it was rolling the 778 01:31:39,583 --> 01:31:40,800 dice and seeing what we 779 01:31:40,800 --> 01:31:42,216 ended up with and adjusting 780 01:31:42,216 --> 01:31:45,483 from there. We adjusted. We made it 781 01:31:45,483 --> 01:31:47,683 better. We were invited 782 01:31:47,683 --> 01:31:49,133 back to the next board meeting, 783 01:31:49,266 --> 01:31:51,766 so it wasn't a total loss. That's cool. 784 01:31:52,133 --> 01:32:00,366 Yeah. Yeah. Yeah. I think I'm an 785 01:32:00,366 --> 01:32:02,066 extroverted introvert, 786 01:32:02,066 --> 01:32:04,566 so I have my moments. I have my splashes 787 01:32:04,566 --> 01:32:06,983 of energy. My biggest 788 01:32:06,983 --> 01:32:08,266 issue, and I probably 789 01:32:08,283 --> 01:32:09,966 resonates with quite a few folks here, 790 01:32:09,966 --> 01:32:15,166 it's like you can say one thing and 791 01:32:15,166 --> 01:32:16,083 depending on the audience, 792 01:32:16,216 --> 01:32:18,633 it has to be translated five different 793 01:32:18,633 --> 01:32:19,833 ways. What I might say to a 794 01:32:19,833 --> 01:32:21,600 product team won't be what I 795 01:32:21,600 --> 01:32:25,433 tell the CISO and what I tell the CISO is 796 01:32:25,433 --> 01:32:26,366 not what the CISO is 797 01:32:26,366 --> 01:32:27,833 going to tell the board or 798 01:32:28,683 --> 01:32:30,883 that kind of thing. It almost feels like 799 01:32:30,883 --> 01:32:31,966 a weird game of telephone 800 01:32:31,966 --> 01:32:33,816 where it's like I have to speak 801 01:32:33,816 --> 01:32:35,300 English over here. I have to speak 802 01:32:35,300 --> 01:32:37,133 Spanish here. She's going to go speak 803 01:32:37,133 --> 01:32:38,283 German to these folks up 804 01:32:38,283 --> 01:32:40,166 here and it's like, okay, well, it's all 805 01:32:40,166 --> 01:32:41,600 kind of similar. They got the romance 806 01:32:41,600 --> 01:32:42,383 language thing going 807 01:32:42,433 --> 01:32:44,316 on. We got some cognates. You got some 808 01:32:44,316 --> 01:32:45,333 things that say, you 809 01:32:45,333 --> 01:32:46,716 know, sound somewhat similar, 810 01:32:47,633 --> 01:32:48,966 but the message is going to be different 811 01:32:48,966 --> 01:32:49,966 to your point. Yeah. It's 812 01:32:49,966 --> 01:32:51,616 like they didn't want to know 813 01:32:51,616 --> 01:32:53,766 about NIST 800-53. They just wanted to 814 01:32:53,766 --> 01:32:54,466 know that there was some 815 01:32:54,466 --> 01:32:55,833 kind of risk framework in place. 816 01:32:56,100 --> 01:32:56,966 They, we were going to implement 817 01:32:56,966 --> 01:32:58,933 something I would imagine that's, you 818 01:32:58,933 --> 01:33:02,716 know, and, you know, same thing. 819 01:33:02,716 --> 01:33:04,000 Same thing, I think with a lot of folks 820 01:33:04,000 --> 01:33:05,216 that are, you know, upper, 821 01:33:05,216 --> 01:33:06,333 lower middle management, like 822 01:33:06,366 --> 01:33:09,399 myself, it's like, okay, you have to say 823 01:33:09,399 --> 01:33:10,699 the same thing five different 824 01:33:10,699 --> 01:33:12,166 times or five different ways 825 01:33:12,516 --> 01:33:14,766 because the CISO only cares about maybe 826 01:33:14,766 --> 01:33:17,500 the, not the how or the, you know, but 827 01:33:17,500 --> 01:33:18,433 maybe the, you know, 828 01:33:19,100 --> 01:33:20,199 I don't know, I don't know which one of 829 01:33:20,199 --> 01:33:21,100 those questions it would be, 830 01:33:21,100 --> 01:33:22,083 but it'd be like, you know, 831 01:33:22,516 --> 01:33:24,066 I've got it. I've got it under control. 832 01:33:24,283 --> 01:33:25,766 This is the what, okay. 833 01:33:25,766 --> 01:33:26,933 This is the what's happening or 834 01:33:26,933 --> 01:33:28,899 whatever, but not the how I'm going to 835 01:33:28,899 --> 01:33:30,366 fix it. And, you know, with 836 01:33:30,366 --> 01:33:31,199 the product team, you're like, 837 01:33:31,199 --> 01:33:32,633 okay, this is how you're going to have to 838 01:33:32,633 -->

01:33:33,666 fix it or this side, you're 839 01:33:33,666 --> 01:33:34,583 going to have to address it or 840 01:33:35,316 --> 01:33:36,899 what have you. And then, you know, the 841 01:33:36,899 --> 01:33:37,883 board's a completely 842 01:33:37,883 --> 01:33:40,233 different, you know, what a more 843 01:33:40,233 --> 01:33:42,166 generic what I think in that case. But 844 01:33:42,166 --> 01:33:45,116 yeah, I, I think that a lot of people 845 01:33:45,116 --> 01:33:46,633 have that issue in our 846 01:33:46,633 --> 01:33:48,516 in our field, and it's it's it's a trial 847 01:33:48,516 --> 01:33:50,783 by fire, I think. And I think to your 848 01:33:50,783 --> 01:33:52,016 your story, you know, 849 01:33:52,016 --> 01:33:53,066 that's a trial by fire. You're like, 850 01:33:53,066 --> 01:33:54,516 okay, I won't do that again. Right. 851 01:33:55,100 --> 01:33:56,500 Unless you learned. Yeah. 852 01:33:57,483 --> 01:34:02,899 Room to grow, I think. I'm reminding 853 01:34:02,899 --> 01:34:04,716 myself of a story that I read 854 01:34:04,716 --> 01:34:06,066 where the tenure of a CISO is 855 01:34:06,066 --> 01:34:10,783 two years. And I've also been told that 856 01:34:10,783 --> 01:34:12,000 you really have to be at a 857 01:34:12,000 --> 01:34:13,383 job two years before you can be 858 01:34:13,383 --> 01:34:16,516 considered the owner of the thing. So I'm 859 01:34:16,516 --> 01:34:18,316 trying to find out if those two are 860 01:34:18,316 --> 01:34:19,666 corollary. It's like 861 01:34:19,716 --> 01:34:21,883 by the time the CISO gets to actually own 862 01:34:21,883 --> 01:34:22,699 the program or the 863 01:34:22,699 --> 01:34:24,983 project, they're either being 864 01:34:25,016 --> 01:34:27,016 kicked out because they didn't get the 865 01:34:27,016 --> 01:34:29,916 job done or they're moving on because 866 01:34:29,916 --> 01:34:31,216 something has happened. 867 01:34:31,666 --> 01:34:35,500 So what what what is with the short 868 01:34:35,500 --> 01:34:37,566 tenures with a lot of CISOs? Is it 869 01:34:37,566 --> 01:34:39,766 because of stress? Is it 870 01:34:39,766 --> 01:34:42,283 because, you know, they they realize that 871 01:34:42,283 --> 01:34:43,300 they've bitten off more 872 01:34:43,300 --> 01:34:44,366 than they can chew? I mean, 873 01:34:45,516 --> 01:34:48,083 and maybe this is just a media story like 874 01:34:48,083 --> 01:34:49,000 the you know, we have a 875 01:34:49,000 --> 01:34:50,899 talent gap like we had with our 876 01:34:50,916 --> 01:34:52,483 recruiter friend a couple of weeks ago. 877 01:34:52,483 --> 01:34:54,033 It's like it's just trumped 878 01:34:54,033 --> 01:34:56,366 up, you know, metrics where, 879 01:34:56,366 --> 01:34:57,583 you know, that's what they say is 880 01:34:57,583 --> 01:35:00,166 happening. Do you see a lot of CISOs 881 01:35:00,166 --> 01:35:01,816 lasting more than two years 882 01:35:01,883 --> 01:35:09,100 in their jobs? Not really. No, come on. I 883 01:35:09,100 --> 01:35:13,616 I'd love to spin a pretty tale that it's 884 01:35:13,616 --> 01:35:14,500 all a lie. And we're 885 01:35:14,533 --> 01:35:17,183 we find a company and we stay there for 886 01:35:17,183 --> 01:35:20,866 life. Dang it. The grass 887 01:35:20,866 --> 01:35:22,766 is always greener, right? 888 01:35:23,316 --> 01:35:25,083 There's there's always a better 889 01:35:25,083 --> 01:35:30,633 opportunity in some cases. I 890 01:35:30,633 --> 01:35:34,666 I probably left one job that I 891 01:35:34,783 --> 01:35:38,483 completely loved and I was doing really 892 01:35:38,483 --> 01:35:40,883 well to to chase the money. 893 01:35:42,516 --> 01:35:44,616 And, you know, I got offered 894 01:35:44,616 --> 01:35:51,600 stupid money and that was it was cool. I 895 01:35:51,600 --> 01:35:55,300 learned a lot. But I want to 896 01:35:55,300 --> 01:35:57,883 go back because I love that 897 01:35:57,883 --> 01:36:00,116 job. I love the team I was working with. 898 01:36:00,316 --> 01:36:01,300 I love the mission of the 899 01:36:01,300 --> 01:36:04,333 organization. And we were 900 01:36:04,433 --> 01:36:07,816 making some really good progress. Right. 901 01:36:09,100 --> 01:36:10,983 But, you know, I I made that 902 01:36:10,983 --> 01:36:12,300 decision. I have to live with 903 01:36:12,300 --> 01:36:17,300 it and you move on. But in some cases, 904 01:36:17,533 --> 01:36:25,116 you just end up the CISOs generally 905 01:36:25,116 --> 01:36:27,883 buried in an organization, 906 01:36:28,533 --> 01:36:31,916 right? They're expected to be an 907 01:36:31,916 --> 01:36:34,566 executive, but they're three 908 01:36:34,566 --> 01:36:36,383 deep on the executive ladder, 909 01:36:36,383 --> 01:36:43,133 right? There are three levels down. So if 910 01:36:43,133 --> 01:36:46,066 you don't like what mom says, go ask dad. 911 01:36:46,983 --> 01:36:50,733 Right. And you get into that game of 912 01:36:50,733 --> 01:36:55,466 telephone. So it can be hard 913 01:36:55,466 --> 01:36:57,516 to be in an organization where 914 01:36:57,966 --> 01:37:01,216 you're down so far on the chain. Right. 915 01:37:01,216 --> 01:37:01,983 So one of the things 916 01:37:01,983 --> 01:37:04,116 you really have to do is 917 01:37:05,883 --> 01:37:08,216 you have to build trust right away 918 01:37:08,216 --> 01:37:11,816 because you have to be the authority. 919 01:37:12,633 --> 01:37:16,333 So you don't have two years to get to own 920 01:37:16,333 --> 01:37:18,600 the function. Right. 921 01:37:19,116 --> 01:37:20,533 Right. You have to own the 922 01:37:20,533 --> 01:37:22,266 function right away because if the 923 01:37:22,266 --> 01:37:25,083 function fails, you're the one that's 924 01:37:25,083 --> 01:37:26,333 going to be escorted to the 925 01:37:26,383 --> 01:37:33,016 door. Right. Right. So some of my 926 01:37:33,016 --> 01:37:35,800 leadership classes I learned at the 927

01:37:35,800 --> 01:37:36,699 Harvard Business School 928 01:37:36,699 --> 01:37:38,566 online was, you know, you're generating 929 01:37:38,566 --> 01:37:40,433 trust through either 930 01:37:40,433 --> 01:37:41,833 positional authority, which, 931 01:37:41,833 --> 01:37:43,000 you know, if you're brand new CISO, you 932 01:37:43,000 --> 01:37:43,883 don't have any positional 933 01:37:43,883 --> 01:37:45,699 authority. I mean, what you do, 934 01:37:45,699 --> 01:37:47,416 but it's like you've just been there for 935 01:37:47,416 --> 01:37:52,516 two weeks. You've got, you know, your 936 01:37:52,516 --> 01:37:54,183 your reputation. So if 937 01:37:54,199 --> 01:37:56,133 you're like a mud or, you know, Mary, 938 01:37:56,283 --> 01:37:57,166 Mary Gardner or somebody 939 01:37:57,166 --> 01:37:58,500 who's brought in to be CISO 940 01:37:58,500 --> 01:38:00,866 or what have you, they may know you 941 01:38:00,866 --> 01:38:02,966 because you're a celebrity or a rock star 942 01:38:02,966 --> 01:38:04,033 or something like that, 943 01:38:04,033 --> 01:38:05,633 which you've got that kind of authority. 944 01:38:06,399 --> 01:38:11,600 Yeah. Do you how do you 945 01:38:11,600 --> 01:38:13,416 build that trust? Right. I mean, 946 01:38:13,416 --> 01:38:17,100 is it is it do you know coming in what 947 01:38:17,100 --> 01:38:17,883 your playbook looks 948 01:38:17,883 --> 01:38:18,666 like? I mean, this probably 949 01:38:18,683 --> 01:38:20,583 isn't the first time you've been a CISO 950 01:38:20,583 --> 01:38:22,699 or or I mean, if you have 951 01:38:22,699 --> 01:38:23,616 been, you know, the first time, 952 01:38:23,633 --> 01:38:26,283 I mean, what are the things you do to 953 01:38:26,283 --> 01:38:27,733 build trust in an organization? Who do 954 01:38:27,733 --> 01:38:28,666 you start with first? 955 01:38:28,666 --> 01:38:30,116 You start with the CEO. Do you start with 956 01:38:30,116 --> 01:38:30,866 the folks underneath 957 01:38:30,866 --> 01:38:31,866 you? Is it a bit of both? 958 01:38:34,383 --> 01:38:40,399 So you have to start with both, mostly 959 01:38:40,399 --> 01:38:43,300 because when the day is 960 01:38:43,300 --> 01:38:46,183 done, if I don't have a team 961 01:38:46,766 --> 01:38:53,666 that is committed to working with and for 962 01:38:53,666 --> 01:38:56,433 me, we're not going to 963 01:38:56,433 --> 01:38:58,300 be successful. Right. 964 01:38:59,083 --> 01:39:02,466 It doesn't matter what I do. I need that 965 01:39:02,466 --> 01:39:04,983 team. Right. Because I can't do it all. 966 01:39:05,883 --> 01:39:09,500 So I have to establish 967 01:39:09,500 --> 01:39:11,399 trust with the team and 968 01:39:12,366 --> 01:39:18,316 I love the concept of managing up. I 969 01:39:18,316 --> 01:39:19,583 think a lot of people say 970 01:39:19,583 --> 01:39:20,933 that they're going to manage up. 971 01:39:23,183 --> 01:39:25,233 And you can do that, but only if you have 972 01:39:25,233 --> 01:39:29,300 a team that trusts you and 973 01:39:29,300 --> 01:39:31,066 you know, that you trust. 974 01:39:31,516 --> 01:39:34,083 That you trust. So there has to be that 975 01:39:34,083 --> 01:39:36,300 teamwork from a security perspective. 976 01:39:37,800 --> 01:39:39,666 And once you establish that, then you 977 01:39:39,666 --> 01:39:43,300 have to you have to establish 978 01:39:43,300 --> 01:39:45,816 the trust among those people 979 01:39:46,033 --> 01:39:50,683 that are going to be key to your job. And 980 01:39:50,683 --> 01:39:51,433 that's going to be your 981 01:39:51,433 --> 01:39:53,216 direct report, who's probably the 982 01:39:53,266 --> 01:39:57,783 CIO or the chief legal officer or the 983 01:39:57,783 --> 01:39:59,199 chief financial officer. 984 01:40:00,233 --> 01:40:01,316 Right. So those are the three 985 01:40:01,716 --> 01:40:09,933 places. Generally, the CSO reports. I 986 01:40:09,933 --> 01:40:12,583 honestly think the CSO at some point 987 01:40:12,583 --> 01:40:13,666 needs to be elevated 988 01:40:13,800 --> 01:40:15,966 to a position or reporting to the CEO. 989 01:40:16,566 --> 01:40:18,883 Right. Right. They need to 990 01:40:18,883 --> 01:40:20,600 have a seat at that table. 991 01:40:24,750 --> 01:40:26,866 Right. But you have to establish trust 992 01:40:26,866 --> 01:40:28,866 among minimally those 993 01:40:28,866 --> 01:40:30,399 three people because the chief 994 01:40:30,399 --> 01:40:34,933 legal officer can be your best friend. 995 01:40:35,483 --> 01:40:37,616 Right. They're going to 996 01:40:37,616 --> 01:40:38,983 help you when there's breaches. 997 01:40:39,233 --> 01:40:40,966 They're going to help you when there's 998 01:40:40,966 --> 01:40:43,466 issues or incidents. 999 01:40:43,466 --> 01:40:45,466 They'll help you understand the 1000 01:40:45,483 --> 01:40:47,466 regulations that are coming down the 1001 01:40:47,466 --> 01:40:52,766 pike. And the CFO. 1002 01:40:54,383 --> 01:40:57,216 Generally, most of the regulations are 1003 01:40:57,233 --> 01:41:02,033 tied to the CFO's office. So, you know, 1004 01:41:02,466 --> 01:41:05,066 socks, a lot of the sock 1005 01:41:05,066 --> 01:41:08,566 work we do has financial control 1006 01:41:08,783 --> 01:41:13,316 implications. So it's really important to 1007 01:41:13,316 --> 01:41:15,933 build trust there. And, you know, 1008 01:41:16,133 --> 01:41:17,533 ultimately, if the CFO 1009 01:41:17,533 --> 01:41:22,333 is assisting you in getting budget, 1010 01:41:23,100 --> 01:41:24,416 they're always a good 1011 01:41:24,416 --> 01:41:26,283 person to build trust with. 1012 01:41:28,866 --> 01:41:30,416 But ultimately, everybody on the 1013 01:41:30,416 --> 01:41:32,233 executive team should be somebody 1014 01:41:32,916 --> 01:41:38,033 you seek to build trust with. The chief 1015 01:41:38,033 --> 01:41:39,533 people officer is going to 1016 01:41:39,533 --> 01:41:43,066 be a huge,

hugely important 1017 01:41:43,066 --> 01:41:48,983 to you. But one of the things you asked 1018 01:41:48,983 --> 01:41:51,416 about the strategy of how do 1019 01:41:51,416 --> 01:41:52,883 you start going about this? 1020 01:41:55,050 --> 01:41:56,800 I make friends with the executive 1021 01:41:56,800 --> 01:41:57,699 assistants first and foremost. 1022 01:41:58,199 --> 01:42:03,833 Oh, yeah. It doesn't matter 1023 01:42:06,600 --> 01:42:11,100 who they are. But if you make them angry, 1024 01:42:11,666 --> 01:42:13,183 you're never going to get 1025 01:42:15,083 --> 01:42:18,133 a meeting with their exact right. Right. 1026 01:42:18,633 --> 01:42:20,566 Treat them well. Right. 1027 01:42:21,399 --> 01:42:22,899 Yeah. Yeah. They have more power, 1028 01:42:23,883 --> 01:42:25,933 I think, than the CEO or the CFO or the 1029 01:42:25,933 --> 01:42:28,183 CRO or whoever. Yeah. 1030 01:42:29,183 --> 01:42:32,033 Yeah. They know where the 1031 01:42:32,033 --> 01:42:33,966 skeletons are buried. They know, you 1032 01:42:33,966 --> 01:42:34,933 know, they manage the 1033 01:42:34,933 --> 01:42:36,783 calendar, that kind of thing. Yeah, 1034 01:42:36,783 --> 01:42:40,016 they're super powerful people. So. But 1035 01:42:40,016 --> 01:42:41,500 also, they have the 1036 01:42:41,500 --> 01:42:46,666 knowledge. And if you help them, 1037 01:42:46,699 --> 01:42:48,666 they'll help you. They're. Right. 1038 01:42:51,433 --> 01:42:54,000 Amazingly talented, overworked, 1039 01:42:54,416 --> 01:42:56,199 underappreciated people that 1040 01:42:57,566 --> 01:42:59,433 just really want other nice people to 1041 01:42:59,433 --> 01:43:03,100 work with. Nice. Yeah. Yeah. 1042 01:43:03,833 --> 01:43:05,699 So, kind of going back to what 1043 01:43:05,699 --> 01:43:06,983 we were talking about with the different 1044 01:43:06,983 --> 01:43:08,800 messaging and what have you 1045 01:43:08,800 --> 01:43:10,266 with like product teams and 1046 01:43:10,283 --> 01:43:12,933 with CISOs and stuff, your approach to 1047 01:43:12,933 --> 01:43:13,983 getting things done as a 1048 01:43:13,983 --> 01:43:15,066 CISO, depending on who you 1049 01:43:15,083 --> 01:43:16,683 report to is going to be different with 1050 01:43:16,683 --> 01:43:18,066 the CFO is going to be 1051 01:43:18,066 --> 01:43:20,933 numbers game. You know, I need this 1052 01:43:20,933 --> 01:43:24,116 new box. Our systems need to be upgraded 1053 01:43:24,116 --> 01:43:26,183 to blah. Well, we don't got 1054 01:43:26,183 --> 01:43:28,466 the budget for that. Legal is 1055 01:43:28,466 --> 01:43:30,366 going to be what kind of damage can this 1056 01:43:30,366 --> 01:43:31,833 cause the company? I'm 1057 01:43:31,833 --> 01:43:35,583 assuming that you really have to be 1058 01:43:35,583 --> 01:43:37,566 like you really kind of have to leave 1059 01:43:37,566 --> 01:43:38,683 that technical side and 1060 01:43:38,683 --> 01:43:39,783 be more of a people person. 1061 01:43:39,800 --> 01:43:42,699 Right. People, you know, it feels like 1062 01:43:42,699 --> 01:43:45,016 you really have to understand and read 1063 01:43:45,016 --> 01:43:46,183 people properly with 1064 01:43:46,183 --> 01:43:48,699 that, unless you're marketing CISO or 1065 01:43:48,699 --> 01:43:52,000 something like that. Did you 1066 01:43:52,000 --> 01:43:56,233 I mean, when you're mentoring 1067 01:43:56,366 --> 01:43:58,766 new CISOs, is that I mean, what is it? 1068 01:43:58,766 --> 01:43:59,300 What is it you tell 1069 01:43:59,300 --> 01:44:00,283 them other than, you know, 1070 01:44:00,800 --> 01:44:03,566 building trust is great. Yes. But yeah. 1071 01:44:04,266 --> 01:44:05,566 Do you ever size them 1072 01:44:05,566 --> 01:44:06,466 up and go, OK, look, 1073 01:44:07,083 --> 01:44:08,283 you're going to have a rough time of it 1074 01:44:08,283 --> 01:44:10,600 because you're not this or 1075 01:44:10,600 --> 01:44:11,416 you're going to, you know, 1076 01:44:11,416 --> 01:44:12,699 you're going to be really well on this 1077 01:44:12,699 --> 01:44:15,633 job because you can do this. I mean, do 1078 01:44:15,633 --> 01:44:16,883 you have evaluations 1079 01:44:17,083 --> 01:44:19,266 with CISO mentors or people that you're 1080 01:44:19,266 --> 01:44:20,033 you're working with in 1081 01:44:20,033 --> 01:44:21,483 transition that you say, OK, 1082 01:44:21,733 --> 01:44:23,216 you're going to run into this problem 1083 01:44:23,216 --> 01:44:25,466 with these people or what have you. 1084 01:44:26,733 --> 01:44:30,566 Yeah, I. I try and shoot straight with 1085 01:44:30,566 --> 01:44:32,899 people. And if I think there's. 1086 01:44:32,916 --> 01:44:41,116 I think if they're trying to come across 1087 01:44:41,116 --> 01:44:42,183 in a way that could be 1088 01:44:42,183 --> 01:44:45,816 damaging, I'll work with them on 1089 01:44:45,816 --> 01:44:50,816 that and. New CISOs have to be really 1090 01:44:50,816 --> 01:44:57,566 open to. I don't want to say being a 1091 01:44:57,566 --> 01:44:58,583 chameleon, but sort of 1092 01:44:58,600 --> 01:45:01,966 being a chameleon. Right. You know, 1093 01:45:01,966 --> 01:45:03,016 because you've got to 1094 01:45:03,016 --> 01:45:05,083 you do have to change. 1095 01:45:08,516 --> 01:45:11,116 Your tone and tenor, depending on who 1096 01:45:11,116 --> 01:45:12,866 you're dealing with, and it's not just 1097 01:45:12,866 --> 01:45:15,233 positionally, it's also personally. 1098 01:45:15,783 --> 01:45:19,833 Right. Because I have a tendency to be 1099 01:45:19,833 --> 01:45:21,016 extraordinarily informal. 1100 01:45:22,283 --> 01:45:25,766 OK. With people, I just I 1101 01:45:25,766 --> 01:45:27,433 like going in and telling them. 1102 01:45:28,733 --> 01:45:31,816 The way it is and having an open, honest 1103 01:45:31,816 --> 01:45:33,583 conversation with them, but. 1104 01:45:35,083 --> 01:45:36,033 It doesn't work with 1105

01:45:36,033 --> 01:45:39,816 everybody, so I have to adjust. 1106 01:45:40,816 --> 01:45:42,733 It's not incumbent on the people I'm 1107 01:45:42,733 --> 01:45:43,933 going to talk to to adjust to me. 1108 01:45:44,683 --> 01:45:49,866 It's incumbent on me to understand and 1109 01:45:49,866 --> 01:45:50,800 read people like you 1110 01:45:50,800 --> 01:45:52,500 were talking about and. 1111 01:45:52,500 --> 01:45:55,000 Right. Sometimes it's hard. 1112 01:45:57,266 --> 01:46:00,366 Yeah, yeah. But if you one of 1113 01:46:00,366 --> 01:46:02,399 the things I tell people is. 1114 01:46:03,983 --> 01:46:06,000 If you're walking into a conversation, 1115 01:46:06,000 --> 01:46:08,133 it's going to be crucial for your career 1116 01:46:08,133 --> 01:46:08,500 or your your project. 1117 01:46:08,916 --> 01:46:14,483 Talk to people who know that person. 1118 01:46:16,733 --> 01:46:19,116 Get advice, understand what they like, 1119 01:46:19,116 --> 01:46:20,633 what works, what doesn't work. 1120 01:46:21,016 --> 01:46:23,199 Talk to people who report to them. 1121 01:46:24,933 --> 01:46:26,000 But do your homework. 1122 01:46:26,716 --> 01:46:29,283 A lot of it's about just really doing 1123 01:46:29,283 --> 01:46:31,166 homework and understanding approaches. 1124 01:46:33,300 --> 01:46:34,983 The other thing is you have to be willing to listen to the advice. 1125 01:46:34,983 --> 01:46:39,516 Right. People have. 1126 01:46:41,616 --> 01:46:43,816 Cautioned me about walking into the room 1127 01:46:43,816 --> 01:46:45,633 with somebody and and given 1128 01:46:45,633 --> 01:46:47,033 me some really great advice 1129 01:46:47,033 --> 01:46:49,600 that I didn't listen to and. 1130 01:46:51,216 --> 01:46:53,516 I'm still regretting that. 1131 01:46:54,000 --> 01:46:55,199 So, you know, listen to 1132 01:46:55,199 --> 01:46:56,683 the advice people give you. 1133 01:46:58,183 --> 01:46:59,133 Is it one of those things? 1134 01:46:59,366 --> 01:47:00,633 Check your assumptions at the door. 1135 01:47:00,633 --> 01:47:00,733 Check that ego because, you know, if if you think you're hot shit, 1136 01:47:01,483 --> 01:47:07,333 you're going to find out pretty quickly 1137 01:47:07,333 --> 01:47:10,233 whether or not you are kind of thing. 1138 01:47:11,416 --> 01:47:11,683 Oh, yeah. 1139 01:47:12,666 --> 01:47:13,833 Okay. All right. 1140 01:47:14,333 --> 01:47:15,016 Yeah, you. 1141 01:47:16,233 --> 01:47:17,766 You know, and I think. 1142 01:47:20,533 --> 01:47:21,399 Probably another. 1143 01:47:24,816 --> 01:47:25,300 Another piece of advice I give. 1144 01:47:25,300 --> 01:47:32,600 Is. For the first 30 days. 1145 01:47:34,100 --> 01:47:35,516 Ask questions and listen. 1146 01:47:38,516 --> 01:47:38,883 Right. 1147 01:47:39,816 --> 01:47:40,566 You know, there is. 1148 01:47:43,000 --> 01:47:44,866 There is nothing so. 1149 01:47:48,500 --> 01:47:53,466 There is nothing people. 1150 01:47:53,466 --> 01:47:57,266 There is nothing. There is nothing. There is nothing. There is nothing. There is nothing. There is nothing. There is nothing people like less than 1151 01:47:57,266 --> 01:47:59,516 somebody who comes into a situation 1152 01:47:59,716 --> 01:48:01,266 without understanding it 1153 01:48:01,266 --> 01:48:03,716 and making proclamations. 1154 01:48:04,533 --> 01:48:04,733 Right. 1155 01:48:05,416 --> 01:48:05,616 Right. 1156 01:48:09,500 --> 01:48:09,766 Yeah. 1157 01:48:11,033 --> 01:48:13,433 You know, it's been my experience that, 1158 01:48:13,433 --> 01:48:14,816 you know, yeah, you listen, 1159 01:48:15,383 --> 01:48:18,183 you observe, you ask questions and then, 1160 01:48:18,183 --> 01:48:20,516 you know, like any new leadership, 1161 01:48:21,000 --> 01:48:22,633 you know, you're you're going to have to 1162 01:48:22,633 --> 01:48:23,816 do a reorg at some point 1163 01:48:23,816 --> 01:48:24,716 because that's just kind 1164 01:48:24,716 --> 01:48:25,733 of how everything works. 1165 01:48:25,733 --> 01:48:27,566 That's kind of the playbook to go. 1166 01:48:28,033 --> 01:48:29,783 Yeah, you found the inefficiencies. 1167 01:48:30,000 --> 01:48:31,666 So you have to fix those inefficiencies 1168 01:48:31,666 --> 01:48:34,183 or, you know, to, you know, especially, 1169 01:48:34,183 --> 01:48:37,133 you know, below, not not necessarily 1170 01:48:37,133 --> 01:48:40,116 above maybe, but it's been my experience. 1171 01:48:40,116 --> 01:48:41,666 Anytime new management comes in, there's 1172 01:48:41,666 --> 01:48:42,866 going to be a reorg in anywhere 1173 01:48:42,866 --> 01:48:44,000 between three to six months. 1174 01:48:44,516 --> 01:48:45,633 So kind of expected. 1175 01:48:45,916 --> 01:48:47,066 At least that's how it's 1176 01:48:47,066 --> 01:48:48,433 been where I work right now. 1177 01:48:51,000 --> 01:48:54,466 And I guess it depends on the type of 1178 01:48:54,466 --> 01:48:56,616 projects that the people are working on. 1179 01:48:56,616 --> 01:48:57,716 But yeah, it's been it's been my 1180 01:48:57,716 --> 01:48:59,266 experience that reorganization 1181 01:48:59,266 --> 01:49:02,399 and realignment is is is the way. 1182 01:49:02,783 --> 01:49:11,116 So I mean, that's been my my experience. 1183 01:49:11,116 --> 01:49:12,566 Have you is there is there 1184 01:49:12,566 --> 01:49:14,066 a see so playbook like that? 1185 01:49:14,066 --> 01:49:14,933 Because there was a joke. 1186 01:49:14,933 --> 01:49:15,600 It's like, you know, you 1187 01:49:15,600 --> 01:49:17,383 spend the first 30 days, you know, 1188 01:49:17,783 --> 01:49:18,899 getting to understand the ropes. 1189 01:49:18,933 --> 01:49:20,666 You're going to, you know, try to 1190 01:49:20,666 --> 01:49:21,316 implement something 1191 01:49:21,316 --> 01:49:22,466 with a reorganization. 1192 01:49:22,466 --> 01:49:23,966 And that's that's where the joke of the 1193 01:49:23,966 --> 01:49:24,883 two

years came from. 1194 01:49:24,883 --> 01:49:27,283 It's like, you know, by 18 months in, you 1195 01:49:27,283 --> 01:49:28,783 realize that there's a problem. 1196 01:49:28,833 --> 01:49:30,483 And, you know, you can't fix. 1197 01:49:30,483 --> 01:49:31,633 And then by two years, you're out. 1198 01:49:31,883 --> 01:49:36,300 But, you know, it I had 1199 01:49:36,300 --> 01:49:38,300 a point and I lost it. 1200 01:49:38,833 --> 01:49:40,083 And I don't know what that is. 1201 01:49:41,766 --> 01:49:42,883 Are there are there things that are 1202 01:49:42,883 --> 01:49:44,666 expected of you from the see so role? 1203 01:49:45,316 --> 01:49:46,816 I guess is this a thing? 1204 01:49:46,833 --> 01:49:48,516 Are you always expected to do a 1205 01:49:48,516 --> 01:49:50,000 realignment or reorganization? 1206 01:49:50,283 --> 01:49:52,333 Or have you actually seen where, hey, 1207 01:49:52,333 --> 01:49:53,316 everything's going good. 1208 01:49:54,366 --> 01:49:55,616 It seems to me if they've hired a brand 1209 01:49:55,616 --> 01:49:58,233 new see so they want to put their 1210 01:49:58,516 --> 01:50:00,366 paint job on the car, so to speak. 1211 01:50:00,666 --> 01:50:02,583 So I mean, is that is 1212 01:50:02,583 --> 01:50:03,433 that typical behavior? 1213 01:50:07,683 --> 01:50:08,333 It's typical. 1214 01:50:08,383 --> 01:50:19,916 Well, the the two times I've walked into 1215 01:50:19,916 --> 01:50:25,000 a well formed security team, in one case, 1216 01:50:25,233 --> 01:50:27,183 the security team actually had been 1217 01:50:27,183 --> 01:50:28,516 reporting up through it. 1218 01:50:30,116 --> 01:50:31,133 And the see so had 1219 01:50:31,133 --> 01:50:33,016 been reporting into legal. 1220 01:50:34,433 --> 01:50:35,433 So the security team 1221 01:50:35,433 --> 01:50:36,833 didn't report to the see so. 1222 01:50:38,916 --> 01:50:43,566 So when I came in, we collapsed them. 1223 01:50:44,166 --> 01:50:44,416 Okay. 1224 01:50:45,033 --> 01:50:46,966 Um, and there were some 1225 01:50:46,966 --> 01:50:48,516 minor tweaks that I made. 1226 01:50:51,199 --> 01:50:51,966 But for the most 1227 01:50:51,966 --> 01:50:54,416 part, I had a green field. 1228 01:50:55,733 --> 01:50:56,416 So that's nice. 1229 01:50:57,500 --> 01:50:59,933 Yeah, we brought I think we brought in 1230 01:50:59,933 --> 01:51:01,983 one, maybe two managers 1231 01:51:01,983 --> 01:51:04,600 and a program manager, 1232 01:51:04,866 --> 01:51:09,966 but we were able to really work with what 1233 01:51:09,966 --> 01:51:11,866 we had and add some staff 1234 01:51:11,866 --> 01:51:13,333 and augment some functions. 1235 01:51:15,399 --> 01:51:18,783 In the other case, the 1236 01:51:18,783 --> 01:51:20,183 team was pretty functional. 1237 01:51:21,983 --> 01:51:24,866 I made a couple changes adding a GRC role 1238 01:51:24,866 --> 01:51:28,100 that was in house instead of outsourced. 1239 01:51:28,116 --> 01:51:36,016 Um, but

the other two see so positions 1240 01:51:36,016 --> 01:51:40,100 I've been in, really, 1241 01:51:40,100 --> 01:51:41,366 we built the organization 1242 01:51:41,566 --> 01:51:42,516 from the ground up. 1243 01:51:43,366 --> 01:51:44,699 So it really didn't exist 1244 01:51:44,699 --> 01:51:47,583 before that, before I joined. 1245 01:51:47,966 --> 01:51:50,583 So we were able to do green field work. 1246 01:51:52,333 --> 01:51:56,300 Um, I think every see so has their 1247 01:51:56,300 --> 01:51:57,533 optimal organization. 1248 01:51:59,616 --> 01:52:02,199 And that's the blueprint you carry with 1249 01:52:02,199 --> 01:52:04,383 you and you change it depending on the 1250 01:52:04,383 --> 01:52:06,066 organization you're in. 1251 01:52:08,266 --> 01:52:09,183 Do I build a sock 1252 01:52:09,183 --> 01:52:10,766 internally or do I outsource? 1253 01:52:11,466 --> 01:52:11,816 Right. 1254 01:52:12,416 --> 01:52:16,333 And normally I outsource that function. 1255 01:52:17,316 --> 01:52:21,166 But depending on the company I was with, 1256 01:52:22,199 --> 01:52:23,399 I would leave that 1257 01:52:23,399 --> 01:52:26,216 option open to build an house. 1258 01:52:27,199 --> 01:52:27,399 Okay. 1259 01:52:29,399 --> 01:52:33,266 But I've never had somebody tell me I 1260 01:52:33,266 --> 01:52:35,016 needed to build it this way. 1261 01:52:36,033 --> 01:52:36,066 Right. 1262 01:52:36,066 --> 01:52:38,100 Or I had to dismantle this. 1263 01:52:40,083 --> 01:52:43,166 I've made, I've absolutely made personnel 1264 01:52:43,166 --> 01:52:45,633 changes within the first 60 days. 1265 01:52:47,083 --> 01:52:47,383 Yeah. 1266 01:52:47,833 --> 01:52:49,733 But everybody's going to 1267 01:52:49,733 --> 01:52:53,583 because it's needs wants. 1268 01:52:54,766 --> 01:52:55,066 Right. 1269 01:52:56,899 --> 01:52:58,366 Well, I mean, they, they hired a see so 1270 01:52:58,366 --> 01:53:00,133 for a reason and it was 1271 01:53:00,133 --> 01:53:01,366 either because the security 1272 01:53:01,399 --> 01:53:03,816 team, yeah, I, I find it hard to believe 1273 01:53:03,816 --> 01:53:06,583 a see so's leaving if, 1274 01:53:06,583 --> 01:53:08,100 you know, they, well, 1275 01:53:08,100 --> 01:53:09,533 like you said, you were chasing, you 1276 01:53:09,533 --> 01:53:11,199 know, heinous money, but 1277 01:53:11,199 --> 01:53:13,300 there's going to be things 1278 01:53:13,316 --> 01:53:14,633 that they're going to find in there, you 1279 01:53:14,633 --> 01:53:16,866 know, hey, why are you doing it this way? 1280 01:53:17,116 --> 01:53:18,566 You know, why are we, why are we doing 1281 01:53:18,566 --> 01:53:19,566 all this stuff manually? 1282 01:53:19,833 --> 01:53:22,183 Why are we, you know, well, that's just 1283 01:53:22,183 --> 01:53:22,666 because of the way 1284 01:53:22,666 --> 01:53:23,533 we've always been doing. 1285 01:53:23,533 --> 01:53:25,383 Okay, well, you know, is there a way to 1286 01:53:25,383 --> 01:53:26,516 automate this or is there a 1287 01:53:26,516 --> 01:53:28,000 way to do these things or, 1288 01:53:28,216 --> 01:53:29,733 hey, I know about this technology that 1289 01:53:29,733 --> 01:53:30,666 y'all don't have that you 1290 01:53:30,666 --> 01:53:32,100 probably should have that I used 1291 01:53:32,100 --> 01:53:33,683 at my other company, which may or may not 1292 01:53:33,683 --> 01:53:35,100 work here or that kind of thing. 1293 01:53:35,100 --> 01:53:36,216 So makes sense. 1294 01:53:36,466 --> 01:53:36,883 Makes sense. 1295 01:53:36,883 --> 01:53:37,133 Yeah. 1296 01:53:37,166 --> 01:53:44,133 And I think the, I think those, those 1297 01:53:44,133 --> 01:53:45,283 changes definitely 1298 01:53:45,283 --> 01:53:49,100 happen over the course of 1299 01:53:51,500 --> 01:53:54,316 six to 12 months, maybe not in the first 1300 01:53:54,316 --> 01:53:59,133 90 days though. But if we're generally, 1301 01:53:59,233 --> 01:54:02,066 we're not given a direction to go in and 1302 01:54:02,066 --> 01:54:03,883 wholesale change everything. 1303 01:54:04,733 --> 01:54:04,816 Right. 1304 01:54:05,816 --> 01:54:10,100 But yeah, there's, you always find 1305 01:54:10,100 --> 01:54:12,416 inefficiencies or things you want to 1306 01:54:12,416 --> 01:54:13,533 change when you move into 1307 01:54:13,533 --> 01:54:15,233 a new position. I think 1308 01:54:15,233 --> 01:54:17,133 that's true of everybody. 1309 01:54:18,066 --> 01:54:21,516 Right. Right. Yeah. Yeah. I mean, if you, 1310 01:54:21,516 --> 01:54:22,683 yeah, you clear cut 1311 01:54:22,683 --> 01:54:23,633 everything, you're going to run 1312 01:54:23,633 --> 01:54:25,866 into things like or goals or, you know, 1313 01:54:26,566 --> 01:54:27,233 things that have been 1314 01:54:27,233 --> 01:54:28,883 established that, you know, 1315 01:54:28,883 --> 01:54:31,516 we're going to get into jeopardy. So it 1316 01:54:31,516 --> 01:54:32,616 makes sense. Yeah. You 1317 01:54:32,616 --> 01:54:33,533 want to know where to make 1318 01:54:33,566 --> 01:54:35,000 your cuts. You want to know where to add 1319 01:54:35,000 --> 01:54:37,116 on where to graph new 1320 01:54:37,116 --> 01:54:38,733 capabilities or technologies, 1321 01:54:38,733 --> 01:54:40,883 that kind of thing. And I guess that's 1322 01:54:40,883 --> 01:54:41,533 part of the whole trust 1323 01:54:41,533 --> 01:54:42,866 generation thing. You have to, 1324 01:54:43,083 --> 01:54:44,766 you know, listen to the people who 1325 01:54:44,766 --> 01:54:46,399 actually, you know, maybe need those 1326 01:54:46,399 --> 01:54:47,500 things have been asking 1327 01:54:47,500 --> 01:54:48,883 for them for years and haven't been able 1328 01:54:48,883 --> 01:54:50,783 to get them. So part of it is, you know, 1329 01:54:51,166 --> 01:54:51,766 working with your 1330 01:54:51,766 --> 01:54:53,333 teams to understand that. 1331 01:54:54,583 --> 01:54:57,816 And, you know,

one of the things I, there 1332 01:54:57,816 --> 01:54:59,866 are certain people that I will always 1333 01:55:00,283 --> 01:55:04,183 try and tempt to come with me when I find 1334 01:55:04,183 --> 01:55:06,000 a new gig, you know, and 1335 01:55:06,000 --> 01:55:09,233 just figuring out how to, 1336 01:55:09,716 --> 01:55:12,183 and it's because we've developed a long 1337 01:55:12,183 --> 01:55:14,083 standing trust relationship, right? 1338 01:55:14,616 --> 01:55:16,416 Sure. Yeah. 1339 01:55:16,666 --> 01:55:18,533 So those are some of the things that I'll 1340 01:55:18,533 --> 01:55:20,383 look for when I start 1341 01:55:20,383 --> 01:55:22,199 with a new organization is 1342 01:55:23,083 --> 01:55:25,600 who do I need and are there places where 1343 01:55:25,600 --> 01:55:27,000 I can use these people that 1344 01:55:27,000 --> 01:55:28,500 have helped me succeed in the 1345 01:55:28,516 --> 01:55:31,516 past? Nice. And I think that's true of 1346 01:55:31,516 --> 01:55:33,100 everybody. We want to have our tribe. 1347 01:55:34,033 --> 01:55:38,933 Right. That makes sense. So I want to, I 1348 01:55:38,933 --> 01:55:40,783 want to kind of steer back 1349 01:55:40,783 --> 01:55:43,100 to a couple of things that, 1350 01:55:43,800 --> 01:55:47,916 you know, asking about. So you you've 1351 01:55:47,916 --> 01:55:49,766 worked with boards, you're probably 1352 01:55:49,766 --> 01:55:50,816 working with some boards 1353 01:55:50,833 --> 01:55:55,883 right now. What in generalities, if you 1354 01:55:55,883 --> 01:55:57,433 can, what are boards most 1355 01:55:57,433 --> 01:55:58,366 worried about these days? 1356 01:55:58,583 --> 01:56:01,300 Is it the AI stuff? Is it trying to 1357 01:56:01,300 --> 01:56:03,183 figure out how to stay, you know, 1358 01:56:03,983 --> 01:56:05,233 relevant with with that 1359 01:56:05,233 --> 01:56:07,966 new technology? Do a lot of them even 1360 01:56:07,966 --> 01:56:09,266 care or they're just 1361 01:56:09,266 --> 01:56:10,433 trying to figure out how to, 1362 01:56:10,600 --> 01:56:13,583 you know, productize it? And is there, 1363 01:56:13,583 --> 01:56:15,133 you know, what is the things 1364 01:56:15,133 --> 01:56:16,199 they are keeping the boards 1365 01:56:16,199 --> 01:56:16,983 up at night now? 1366 01:56:20,733 --> 01:56:25,083 So it depends on the industry. Right. 1367 01:56:27,316 --> 01:56:30,133 But I think if you're talking about 1368 01:56:32,283 --> 01:56:36,066 tech or manufacturing or any company that 1369 01:56:36,066 --> 01:56:39,783 has intellectual property to protect, 1370 01:56:40,600 --> 01:56:45,399 it's definitely AI is definitely on top 1371 01:56:45,399 --> 01:56:48,566 of their minds. I think 1372 01:56:48,566 --> 01:56:51,433 the other thing is just 1373 01:56:53,166 --> 01:56:56,966 an assurance of resiliency. Resiliency. 1374 01:56:58,416 --> 01:57:02,100 Ransomware, well, the ability to keep 1375 01:57:02,100 --> 01:57:03,533 managing through an attack. 1376 01:57:04,699 --> 01:57:04,983 Okay. 1377 01:57:06,466 --> 01:57:08,216 Whatever that is, or keep 1378 01:57:08,216 --> 01:57:11,383 managing through a loss. 1379 01:57:12,716 --> 01:57:13,666 Right. Right. 1380 01:57:14,583 --> 01:57:19,199 So do boards are definitely 1381 01:57:19,199 --> 01:57:21,899 concerned with the ability to 1382 01:57:23,966 --> 01:57:25,366 maintain the corporation 1383 01:57:25,966 --> 01:57:31,866 through a ransomware attack, through a 1384 01:57:31,866 --> 01:57:35,033 breach. You know, how do we 1385 01:57:35,033 --> 01:57:36,416 handle a breach? How do we 1386 01:57:36,416 --> 01:57:42,800 respond to a breach? And what are the 1387 01:57:42,800 --> 01:57:45,283 repercussions if we do have a breach? 1388 01:57:45,583 --> 01:57:46,616 Right. Especially with 1389 01:57:46,616 --> 01:57:52,533 the SEC breach rules. I think boards are 1390 01:57:52,533 --> 01:57:53,466 struggling with how to 1391 01:57:54,283 --> 01:58:00,383 define material because 1392 01:58:00,383 --> 01:58:02,416 it's not just a number. 1393 01:58:04,899 --> 01:58:05,100 Right. 1394 01:58:05,600 --> 01:58:10,199 You know, if you're a business that has 1395 01:58:11,316 --> 01:58:15,483 reputational impacts, you know, what 1396 01:58:15,483 --> 01:58:16,716 happens if your reputation 1397 01:58:16,716 --> 01:58:18,683 is damaged to the point that 1398 01:58:18,683 --> 01:58:19,516 you're losing business? 1399 01:58:19,933 --> 01:58:23,466 Right. Right. That becomes material, but it 1400 01:58:23,466 --> 01:58:24,683 becomes material over 1401 01:58:24,683 --> 01:58:28,399 time. So how do we set up those 1402 01:58:28,399 --> 01:58:32,300 triggers to know when a breach is 1403 01:58:32,300 --> 01:58:34,133 material and when we need to report? 1404 01:58:35,100 --> 01:58:38,283 Right. I think the other thing is 1405 01:58:42,033 --> 01:58:44,500 boards are concerned about whether or not 1406 01:58:45,083 --> 01:58:47,933 they're getting 1407 01:58:49,083 --> 01:58:52,733 a real picture of the risk of 1408 01:58:52,733 --> 01:58:54,216 cybersecurity threats. 1409 01:58:54,883 --> 01:58:57,183 Right. Especially after the Uber 1410 01:58:57,483 --> 01:59:02,699 situation. You know, is the CSO reporting 1411 01:59:02,699 --> 01:59:04,233 to us accurately? Do we 1412 01:59:04,233 --> 01:59:05,383 know everything that's out 1413 01:59:05,383 --> 01:59:05,699 there? 1414 01:59:06,016 --> 01:59:07,033 Right. Right. 1415 01:59:08,983 --> 01:59:11,600 You know, and I think the 1416 01:59:11,600 --> 01:59:12,916 board's going to have to 1417 01:59:15,883 --> 01:59:19,300 look and see whether or not they have the 1418 01:59:19,300 --> 01:59:20,000 right reporting 1419 01:59:20,000 --> 01:59:22,199 relationship to establish that trust 1420 01:59:22,199 --> 01:59:26,166 with the CSO. So the CSO does have an 1421 01:59:26,166 --> 01:59:26,916 open chain of 1422 01:59:26,916 -->

01:59:28,966 communication to the board without, 1423 01:59:30,600 --> 01:59:32,300 you know, a stop in 1424 01:59:32,300 --> 01:59:34,516 between for executive management. 1425 01:59:36,616 --> 01:59:36,716 Okay. 1426 01:59:37,116 --> 01:59:39,383 Or maybe not without a 1427 01:59:39,383 --> 01:59:40,766 stop, but with the right 1428 01:59:43,716 --> 01:59:44,716 stops in place. 1429 01:59:45,666 --> 01:59:47,266 Right. Right. 1430 01:59:48,449 --> 01:59:54,433 Huh. So has the Uber thing really damaged 1431 01:59:54,433 --> 01:59:56,483 the CSO role that badly? 1432 01:59:56,966 --> 01:59:58,383 That sounds scary. Like we 1433 01:59:58,383 --> 02:00:00,800 can't recover from that. It's been what, 1434 02:00:01,000 --> 02:00:02,416 three, four years since that happened? 1435 02:00:02,466 --> 02:00:07,083 Yeah. So it's been three to four years 1436 02:00:07,083 --> 02:00:08,433 since that breach happened, 1437 02:00:08,866 --> 02:00:10,583 but I believe the prosecution 1438 02:00:10,683 --> 02:00:14,266 was just in the last year? Three years? 1439 02:00:15,166 --> 02:00:17,266 Yeah. Yeah. They handed down. Yeah. 1440 02:00:18,783 --> 02:00:21,300 It was the prosecution more than the 1441 02:00:21,300 --> 02:00:23,433 breach that brought it 1442 02:00:23,433 --> 02:00:24,566 to everybody's attention. 1443 02:00:26,399 --> 02:00:26,583 Okay. 1444 02:00:26,600 --> 02:00:32,066 Yeah. Three years probation for covering 1445 02:00:32,066 --> 02:00:32,983 up data breach involving 1446 02:00:32,983 --> 02:00:34,533 millions of Uber user records. 1447 02:00:35,500 --> 02:00:39,033 Yeah. That was the that was Friday, 1448 02:00:39,033 --> 02:00:41,766 February or May 5th. Yeah. 1449 02:00:43,500 --> 02:00:46,100 Yeah. I mean, yeah, that was that was 1450 02:00:46,100 --> 02:00:48,000 that was terrible. I think 1451 02:00:48,000 --> 02:00:49,683 from a from a CSO point of view, 1452 02:00:49,683 --> 02:00:53,216 but yeah, I guess. 1453 02:00:54,433 --> 02:00:55,466 So I think what do we do? 1454 02:00:55,716 --> 02:00:58,316 I think we do coverable though, because 1455 02:00:58,316 --> 02:01:01,233 we can't all be painted with that brush. 1456 02:01:02,016 --> 02:01:05,416 Right. Right. So is it just a bunch of 1457 02:01:05,416 --> 02:01:08,233 dashboards and metrics or obviously they 1458 02:01:08,233 --> 02:01:09,033 don't want dashboards 1459 02:01:09,033 --> 02:01:11,199 and metrics. They want, you know, some, 1460 02:01:11,199 --> 02:01:12,266 some fairly generic 1461 02:01:12,266 --> 02:01:14,433 things, but that's one of those 1462 02:01:14,433 --> 02:01:16,316 fine lines, right? We can give them 800 1463 02:01:16,316 --> 02:01:19,516 dash 53 and all 17 articles and config, 1464 02:01:19,516 --> 02:01:19,866 you know, and they're 1465 02:01:19,899 --> 02:01:21,883 like, you know, they start glazing over, 1466 02:01:22,399 --> 02:01:24,316 but they probably don't 1467 02:01:24,316 --> 02:01:26,166 want a ton of metrics that, 1468 02:01:27,149 --> 02:01:28,833 you know, they want to be told the story, 1469 02:01:28,833 --> 02:01:30,483 but, you know, so it seems 1470 02:01:30,483 --> 02:01:31,466 like there's a happy medium 1471 02:01:31,466 --> 02:01:32,733 there. Again, that's one of those trial 1472 02:01:32,733 --> 02:01:33,483 and error things, I 1473 02:01:33,483 --> 02:01:34,199 guess, that you're going to, 1474 02:01:34,199 --> 02:01:35,333 you're going to find out either you've 1475 02:01:35,333 --> 02:01:36,566 done really poorly this month 1476 02:01:36,566 --> 02:01:37,933 and you'll improve next month, 1477 02:01:38,500 --> 02:01:40,183 or you, I guess there's 1478 02:01:40,183 --> 02:01:41,500 always room for improvement. So 1479 02:01:41,500 --> 02:01:45,183 and if you're doing it right, you're 1480 02:01:45,183 --> 02:01:46,316 having the conversations 1481 02:01:47,566 --> 02:01:53,966 to understand what they want before you 1482 02:01:53,966 --> 02:01:55,266 even walk into the room. 1483 02:01:55,800 --> 02:01:57,116 And that was, that was my big 1484 02:01:57,116 --> 02:01:59,033 failing because I never met with the 1485 02:01:59,033 --> 02:02:02,133 board before I presented to them in that 1486 02:02:02,133 --> 02:02:05,033 particular case. But 1487 02:02:05,033 --> 02:02:07,316 when you meet with the board and you 1488 02:02:07,316 --> 02:02:08,733 understand what they're looking for 1489 02:02:09,233 --> 02:02:13,600 and whether or not 1490 02:02:16,616 --> 02:02:19,666 they understand what you've presented, it 1491 02:02:19,666 --> 02:02:21,933 helps a lot. Yeah. The 1492 02:02:21,933 --> 02:02:24,116 other thing is you can expect it 1493 02:02:24,116 --> 02:02:28,083 in the full board meeting. So having 1494 02:02:28,083 --> 02:02:29,183 those two or three 1495 02:02:29,183 --> 02:02:30,100 advocates on the board that will 1496 02:02:30,133 --> 02:02:38,300 give you honest feedback is really 1497 02:02:38,300 --> 02:02:40,666 important because the full 1498 02:02:40,666 --> 02:02:42,016 board isn't going to spend the 1499 02:02:42,016 --> 02:02:45,016 time to have a feedback session with you, 1500 02:02:45,383 --> 02:02:49,183 which is unfortunate, but it's just not 1501 02:02:49,183 --> 02:02:53,016 the way it's going to happen. So having a 1502 02:02:53,016 --> 02:02:54,083 few champions on the 1503 02:02:54,083 --> 02:02:55,183 board is really important. 1504 02:02:55,816 --> 02:02:58,416 That's cool. Yeah. Plus at those board meetings, I'm actually going to talk about 1505 02:02:58,433 --> 02:03:00,933 those board meetings. I'm guessing the 1506 02:03:00,933 --> 02:03:02,133 CISO isn't taking up the 1507 02:03:02,133 --> 02:03:03,416 entirety of the time. You 1508 02:03:03,416 --> 02:03:05,483 get maybe what, two or three slides, if 1509 02:03:05,483 --> 02:03:07,533 that and a handful of 1510 02:03:07,533 --> 02:03:08,500 minutes to be able to go, 1511 02:03:08,500 -->

02:03:10,100 okay, this is what we're doing. Or was, 1512 02:03:10,416 --> 02:03:11,783 you know, I guess in the, in 1513 02:03:11,783 --> 02:03:13,883 the case of the NIST 853 story, 1514 02:03:14,033 --> 02:03:17,800 it was a meeting for the CISO to talk 1515 02:03:17,800 --> 02:03:19,766 about those things. But I would imagine 1516 02:03:19,766 --> 02:03:20,533 most board meetings, 1517 02:03:20,733 --> 02:03:22,866 you only get a handful of minutes and a 1518 02:03:22,866 --> 02:03:24,016 slide or two to be able to 1519 02:03:24,016 --> 02:03:25,783 go, okay, this is, this is what 1520 02:03:25,816 --> 02:03:29,433 we're doing. Yeah. In the NIST 853, that 1521 02:03:29,433 --> 02:03:30,633 was my introduction to 1522 02:03:30,633 --> 02:03:32,483 the board. Okay. So that was 1523 02:03:32,483 --> 02:03:36,033 actually an hour long, which was time not 1524 02:03:36,033 --> 02:03:39,199 well spent. But 1525 02:03:39,199 --> 02:03:43,300 generally standard board meeting, 1526 02:03:43,566 --> 02:03:46,166 you get anywhere between 10 minutes to a 1527 02:03:46,166 --> 02:03:48,366 half an hour. Oh, that's 1528 02:03:48,366 --> 02:03:51,333 not too bad, I guess. No, it's 1529 02:03:51,766 --> 02:03:54,166 half an hour is great. And if they're 1530 02:03:54,166 --> 02:03:57,566 engaged in asking questions, that's the 1531 02:03:57,566 --> 02:03:58,716 best of all possible 1532 02:03:59,000 --> 02:04:00,683 scenarios. Because if they're asking 1533 02:04:00,683 --> 02:04:03,383 questions, they're 1534 02:04:03,383 --> 02:04:04,866 understanding what you're saying. And 1535 02:04:04,866 --> 02:04:08,733 that's a really good indicator of whether 1536 02:04:08,733 --> 02:04:12,083 or not you've hit your 1537 02:04:12,083 --> 02:04:15,583 mark. Right. Right. I guess 1538 02:04:15,583 --> 02:04:17,266 there's, I guess it's, you have to figure 1539 02:04:17,266 --> 02:04:18,316 out how much content you 1540 02:04:18,316 --> 02:04:19,333 want to put in. If you put in 1541 02:04:19,399 --> 02:04:21,233 10 minutes of content and have 20 minutes 1542 02:04:21,233 --> 02:04:22,083 of questions, that's 1543 02:04:22,083 --> 02:04:23,000 great. But if you put in 1544 02:04:23,399 --> 02:04:25,266 10 minutes of content, you get like three 1545 02:04:25,266 --> 02:04:25,899 questions, you're 1546 02:04:25,899 --> 02:04:26,933 stuck there with another 20 1547 02:04:26,933 --> 02:04:31,283 minutes and you're like, yeah. And so 1548 02:04:31,283 --> 02:04:32,533 either you did a really good job of 1549 02:04:32,533 --> 02:04:33,216 explaining everything 1550 02:04:33,216 --> 02:04:35,533 in 10 minutes, or they didn't understand 1551 02:04:35,533 --> 02:04:36,916 a thing you were saying and 1552 02:04:36,916 --> 02:04:37,816 don't even know where to start 1553 02:04:37,816 --> 02:04:40,566 asking those questions. I, God, now I 1554 02:04:40,566 --> 02:04:41,466 don't want to be a CISO. 1555 02:04:41,466 --> 02:04:43,116 This

sounds too nuanced for me. 1556 02:04:43,116 --> 02:04:44,600 I can't remember. No, Brian, you need to 1557 02:04:44,600 --> 02:04:46,466 be a CISO. No, you're 1558 02:04:46,466 --> 02:04:47,716 asking the right questions. 1559 02:04:49,633 --> 02:04:52,083 Nobody wants me to CISO. I'm upper, 1560 02:04:52,083 --> 02:04:52,500 lower, middle 1561 02:04:52,500 --> 02:04:53,866 management. You have no idea. 1562 02:04:56,116 --> 02:04:58,800 So upper, lower, middle management is 1563 02:04:58,800 --> 02:05:00,399 kind of what we all are, I think. 1564 02:05:02,116 --> 02:05:03,683 There's always somebody above you on the 1565 02:05:03,683 --> 02:05:04,866 rung on that ladder, I guess. 1566 02:05:05,399 --> 02:05:08,866 Yeah. Okay. Okay. Well, I guess, I guess 1567 02:05:08,866 --> 02:05:10,283 one of the last things we 1568 02:05:10,283 --> 02:05:12,600 get, you know, to segue into 1569 02:05:12,699 --> 02:05:17,483 that is when do you, when does, when 1570 02:05:17,483 --> 02:05:18,500 should somebody feel 1571 02:05:18,500 --> 02:05:20,316 confident that they can be a CISO? 1572 02:05:20,316 --> 02:05:23,016 Because I know people who are CISOs of 1573 02:05:23,016 --> 02:05:24,600 companies where they're 1574 02:05:24,600 --> 02:05:26,333 like employee number two. And, 1575 02:05:26,750 --> 02:05:29,166 you know, you're like, are you really the 1576 02:05:29,166 --> 02:05:30,083 CISO? Because you're 1577 02:05:30,083 --> 02:05:31,266 also the head developer, 1578 02:05:31,983 --> 02:05:35,783 janitor, caterer, you know, head of 1579 02:05:35,783 --> 02:05:36,916 development, IT 1580 02:05:36,916 --> 02:05:38,016 person, that kind of thing. 1581 02:05:38,366 --> 02:05:42,583 You're in, okay, you have CISO in title, 1582 02:05:42,583 --> 02:05:45,000 but it's like, when is 1583 02:05:45,000 --> 02:05:46,100 the time to make the jump? 1584 02:05:46,383 --> 02:05:48,516 When do, you know, is it like, Hey, I'm, 1585 02:05:48,516 --> 02:05:49,466 you know, I'm tired of 1586 02:05:49,466 --> 02:05:50,516 being a technical person. 1587 02:05:50,516 --> 02:05:52,066 I want to go and be a people person now, 1588 02:05:52,066 --> 02:05:53,600 or, you know, what, 1589 02:05:53,600 --> 02:05:55,166 you know, I'm starting, 1590 02:05:55,466 --> 02:05:57,566 I'm not starting to feel this. It's like 1591 02:05:57,566 --> 02:05:59,800 the imposter syndrome in 1592 02:05:59,800 --> 02:06:00,633 me is like, I don't even 1593 02:06:00,633 --> 02:06:02,300 know if I could even be a CISO at this 1594 02:06:02,300 --> 02:06:03,883 point. Who would want me? 1595 02:06:04,366 --> 02:06:06,333 And what does, what does the 1596 02:06:07,166 --> 02:06:08,733 skill set look like for somebody like 1597 02:06:08,733 --> 02:06:11,216 that? It was, you know, I 1598 02:06:11,216 --> 02:06:13,516 guess, I guess I'm asking 1599 02:06:13,633 --> 02:06:14,966 maybe a question. I don't 1600 02:06:14,966 --> 02:06:15,883 know if it's the right question. 1601 02:06:17,116 --> 02:06:20,116 So a couple of things, but I'm going to 1602 02:06:20,116 --> 02:06:22,133 step back a minute because please do. 1603 02:06:22,433 --> 02:06:23,933 I don't want to paint a 1604 02:06:23,933 --> 02:06:25,000 picture of doom and gloom. 1605 02:06:26,000 --> 02:06:29,383 We started with doom and gloom. 1606 02:06:30,116 --> 02:06:37,816 Well, look, this is probably, I started 1607 02:06:37,816 --> 02:06:38,766 out my life as a 1608 02:06:38,766 --> 02:06:42,833 biologist, right? And I made several 1609 02:06:42,833 --> 02:06:46,066 career hops and I found security. Okay. 1610 02:06:46,300 --> 02:06:48,216 And I love this job. 1611 02:06:48,800 --> 02:06:50,916 I love the challenges. 1612 02:06:51,800 --> 02:06:54,833 I love the fact that every single day I 1613 02:06:54,833 --> 02:06:57,166 have to use a different 1614 02:06:57,166 --> 02:06:59,133 skill or use a skill that 1615 02:06:59,166 --> 02:07:03,300 I've grown in a different way. And it's 1616 02:07:03,300 --> 02:07:04,733 not just a technical skill, 1617 02:07:04,733 --> 02:07:06,833 but it's also the people skills. 1618 02:07:07,600 --> 02:07:09,583 Right. I think 1619 02:07:14,433 --> 02:07:17,133 there were two questions that I think I'm 1620 02:07:17,133 --> 02:07:18,300 going to tease out of what 1621 02:07:18,300 --> 02:07:20,500 you asked. The first one is 1622 02:07:22,116 --> 02:07:24,866 a lot of times people get a CISO role 1623 02:07:24,866 --> 02:07:27,533 along with a lot of other stuff. 1624 02:07:28,083 --> 02:07:32,566 Right. So they're doing the function of 1625 02:07:32,566 --> 02:07:33,616 information security 1626 02:07:33,616 --> 02:07:35,199 and they get that title. 1627 02:07:37,716 --> 02:07:38,899 I think you have to 1628 02:07:38,899 --> 02:07:41,733 honestly ask yourself, 1629 02:07:44,350 --> 02:07:47,533 does my CISO role conflict with any of 1630 02:07:47,533 --> 02:07:49,016 the other hats I have to wear? 1631 02:07:50,416 --> 02:07:53,616 Right. And if it does, 1632 02:07:53,883 --> 02:07:58,866 it could be problematic. I've been in a 1633 02:07:58,866 --> 02:08:00,216 position where I was the, 1634 02:08:00,883 --> 02:08:02,500 for all intents and purposes, 1635 02:08:02,800 --> 02:08:06,533 a CISO, a person in the IT department 1636 02:08:06,533 --> 02:08:08,033 left, and I was asked 1637 02:08:08,033 --> 02:08:09,266 to sit in their chair. 1638 02:08:10,133 --> 02:08:13,500 Right. And I said, I will do it, but you 1639 02:08:13,500 --> 02:08:14,883 have to understand that it 1640 02:08:14,883 --> 02:08:16,733 conflicts with my CISO role. 1641 02:08:17,266 --> 02:08:21,733 Right. So there are going to be times 1642 02:08:21,733 --> 02:08:22,899 when I ask somebody else to sit in their chair, 1643 02:08:23,566 --> 02:08:25,916 to help advise me of something because I 1644 02:08:25,916 --> 02:08:27,133 can't make that decision. 1645 02:08:28,366 --> 02:08:30,500

Right. Because there's a conflict of 1646 02:08:30,500 --> 02:08:33,199 interest and it's not fair to 1647 02:08:33,199 --> 02:08:36,066 anybody. So that's one thing. 1648 02:08:36,433 --> 02:08:38,033 But the other thing is from a personal 1649 02:08:38,033 --> 02:08:41,800 perspective, I don't know 1650 02:08:41,800 --> 02:08:46,216 anybody in this role. Well, 1651 02:08:47,166 --> 02:08:48,683 I do know a couple of people. I'll take 1652 02:08:48,683 --> 02:08:49,833 that back. But I think 1653 02:08:49,833 --> 02:08:50,899 everybody struggles with 1654 02:08:50,916 --> 02:08:55,966 imposter syndrome at some point. This is 1655 02:08:55,966 --> 02:08:59,816 a big role. I mean, we used to joke that 1656 02:09:00,033 --> 02:09:02,333 information security was an inch deep and 1657 02:09:02,333 --> 02:09:06,516 mile wide. Right. To 1658 02:09:06,516 --> 02:09:07,783 be good at this role, 1659 02:09:08,166 --> 02:09:10,683 you now have to go at least six inches 1660 02:09:10,683 --> 02:09:14,216 deep and mile wide. Right. Or 1661 02:09:14,216 --> 02:09:16,100 you have to be able to build 1662 02:09:16,116 --> 02:09:24,899 that team. I think you're ready for the 1663 02:09:24,899 --> 02:09:26,066 role if you're ready to 1664 02:09:26,066 --> 02:09:28,116 stand in and take the hits 1665 02:09:29,166 --> 02:09:33,033 and answer the hard questions. If you 1666 02:09:33,033 --> 02:09:34,133 want to lead a team, 1667 02:09:35,383 --> 02:09:38,316 because you have to lead the team, 1668 02:09:38,316 --> 02:09:40,166 you have to be transparent with them, you 1669 02:09:40,166 --> 02:09:41,616 have to let them know what's going on. 1670 02:09:41,633 --> 02:09:46,883 And you have to grow them. I think that's 1671 02:09:46,883 --> 02:09:47,916 probably a mistake 1672 02:09:47,916 --> 02:09:49,716 I've made in the past is 1673 02:09:50,833 --> 02:09:52,816 when I had the opportunity to take 1674 02:09:52,816 --> 02:09:54,766 somebody into the board meeting with me, 1675 02:09:54,766 --> 02:09:55,683 I haven't done that. 1676 02:09:57,383 --> 02:09:59,633 And that's a great growth opportunity for 1677 02:09:59,633 --> 02:10:03,933 people. But I think if 1678 02:10:03,983 --> 02:10:10,500 you go in every day to play with the 1679 02:10:10,500 --> 02:10:14,483 technology, you don't want 1680 02:10:14,483 --> 02:10:16,433 to go to a CSOL role yet. 1681 02:10:17,566 --> 02:10:19,666 Right. When you get past the point of 1682 02:10:19,666 --> 02:10:20,683 wanting to be that 1683 02:10:20,683 --> 02:10:24,383 hardcore technologist that's 1684 02:10:24,716 --> 02:10:26,583 figuring out how to solve everything with 1685 02:10:26,583 --> 02:10:30,100 technology, wait a couple of years. 1686 02:10:30,116 --> 02:10:34,166 Okay. And then see if you change your 1687 02:10:34,166 --> 02:10:35,399 mind and you really want 1688 02:10:35,399 --> 02:10:37,516 to work with people more. 1689 02:10:38,850 --> 02:10:42,600 Right. I think it's a great place to be 1690 02:10:42,600 --> 02:10:44,899 because there's nothing better than 1691 02:10:46,666 --> 02:10:47,800 seeing somebody's eyes 1692 02:10:47,800 --> 02:10:49,683 light up when they understand. 1693 02:10:51,716 --> 02:10:53,866 Right. And you can do 1694 02:10:53,866 --> 02:10:54,933 that with your team, 1695 02:10:54,933 --> 02:10:56,699 you can do that with leadership, and you 1696 02:10:56,699 --> 02:10:57,616 can do that with the board. 1697 02:10:59,333 --> 02:11:02,199 Very good. Okay. Okay. Yeah, it's kind 1698 02:11:02,199 --> 02:11:05,416 of, yeah, that makes 100% 1699 02:11:05,699 --> 02:11:06,716 sense when I was working 1700 02:11:06,716 --> 02:11:08,100 at CrowdStrike. I've told this story, I 1701 02:11:08,100 --> 02:11:09,266 think even to a couple of 1702 02:11:09,266 --> 02:11:10,583 folks who are on our stream here, 1703 02:11:11,116 --> 02:11:12,816 I realized that I did not have the 1704 02:11:12,816 --> 02:11:14,416 mentality to sit for 12 1705 02:11:14,416 --> 02:11:15,899 hours at a computer trying to 1706 02:11:15,966 --> 02:11:20,183 get a shell or to try to do pen testing 1707 02:11:20,183 --> 02:11:21,583 or red teaming or what have 1708 02:11:21,583 --> 02:11:22,500 you. And I realized, well, 1709 02:11:22,600 --> 02:11:26,266 okay, I probably should move to a PM type 1710 02:11:26,266 --> 02:11:26,899 management role, 1711 02:11:26,899 --> 02:11:28,100 which is why I ended up at 1712 02:11:28,100 --> 02:11:32,866 Leviathan with our friend. And I'd like 1713 02:11:32,866 --> 02:11:34,083 to think I'm good at being 1714 02:11:34,083 --> 02:11:37,983 a PM, but yeah, I've found 1715 02:11:37,983 --> 02:11:40,933 myself at a crossroads because I'm now 1716 02:11:40,933 --> 02:11:43,516 colonoscopy years old and I 1717 02:11:43,516 --> 02:11:45,816 realized that you've got to do 1718 02:11:45,983 --> 02:11:48,899 something right with your life. I've got 1719 02:11:48,899 --> 02:11:51,883 to grow up and do something. So it's 1720 02:11:51,883 --> 02:11:52,899 good, good feedback. 1721 02:11:52,899 --> 02:11:55,983 I appreciate that. And, you know, there's 1722 02:11:55,983 --> 02:11:56,800 a lot of folks who say, 1723 02:11:56,800 --> 02:11:57,916 yeah, they're willing to take 1724 02:11:57,916 --> 02:11:59,500 those punches and willing to, you know, 1725 02:11:59,500 --> 02:12:00,399 make those, take those 1726 02:12:00,399 --> 02:12:01,983 hits until they actually end 1727 02:12:01,983 --> 02:12:04,433 up having to do so. And I think that's 1728 02:12:04,433 --> 02:12:06,266 where you, you, you, you, 1729 02:12:06,266 --> 02:12:08,016 you have, you prove your 1730 02:12:08,016 --> 02:12:10,000 medal, right? If, if, you know, you, 1731 02:12:10,000 --> 02:12:11,016 you'll find out at your 1732 02:12:11,016 --> 02:12:12,100 first board meeting, if you, 1733 02:12:12,133 --> 02:12:13,633 you get your ass handed to you and you're 1734 02:12:13,633 -->

02:12:14,816 finally, well, okay, this 1735 02:12:14,816 --> 02:12:16,899 was, this was awful or, you know, 1736 02:12:17,233 --> 02:12:22,899 what have you. But yeah. So 1737 02:12:22,899 --> 02:12:25,333 maybe another key there is 1738 02:12:28,116 --> 02:12:29,699 you don't necessarily treat 1739 02:12:29,699 --> 02:12:31,133 your mistakes as failures. 1740 02:12:33,533 --> 02:12:35,983 Oh, you understand that they're learning 1741 02:12:35,983 --> 02:12:36,883 opportunities. 1742 02:12:36,883 --> 02:12:38,183 They're ways to get better. 1743 02:12:39,166 --> 02:12:43,366 Okay. Okay. You mean like Edison, I 1744 02:12:43,366 --> 02:12:45,233 didn't fail at making a light bulb. I 1745 02:12:45,233 --> 02:12:46,000 just figured out another 1746 02:12:46,000 --> 02:12:48,383 way of not making a light bulb or it said 1747 02:12:48,383 --> 02:12:49,766 in context, right? So, 1748 02:12:49,966 --> 02:12:52,766 okay. Yeah. Okay. Very cool. 1749 02:12:53,733 --> 02:12:57,600 Um, okay. Well, uh, wow. Um, time, time 1750 02:12:57,600 --> 02:12:58,366 does fly when we're 1751 02:12:58,366 --> 02:12:59,266 having fun. I want to, 1752 02:12:59,266 --> 02:13:00,516 I want to talk a little bit about Goldie 1753 02:13:00,516 --> 02:13:03,233 Knox again. Um, uh, 1754 02:13:04,800 --> 02:13:05,533 what, what did, I mean, 1755 02:13:06,199 --> 02:13:08,616 I'm on your website and it's got a very 1756 02:13:08,616 --> 02:13:10,016 hypnotic background, which 1757 02:13:10,016 --> 02:13:13,383 I love. Uh, and, and you're, 1758 02:13:13,383 --> 02:13:14,916 you're doing a lot of different services, 1759 02:13:14,916 --> 02:13:16,100 uh, for enterprises 1760 02:13:16,100 --> 02:13:17,800 startups, which is something I've 1761 02:13:17,800 --> 02:13:19,183 actually, you know, one of the things 1762 02:13:19,183 --> 02:13:20,166 moving to San Diego, we 1763 02:13:20,166 --> 02:13:21,283 have a fairly healthy startup 1764 02:13:21,283 --> 02:13:22,933 community down here. And I was like, Oh, 1765 02:13:22,933 --> 02:13:25,199 I'd love to, you know, be a really cheap 1766 02:13:25,233 --> 02:13:27,183 security advisor to some of these folks 1767 02:13:27,183 --> 02:13:29,316 and, and whatever. And, um, 1768 02:13:30,000 --> 02:13:31,383 uh, when you're, when you're 1769 02:13:31,399 --> 02:13:33,416 talking to startups, you've got cyber 1770 02:13:33,416 --> 02:13:34,516 liability audits and 1771 02:13:34,516 --> 02:13:36,833 certifications. They must come to you 1772 02:13:36,833 --> 02:13:38,283 as a startup at some point and go, okay, 1773 02:13:38,283 --> 02:13:39,899 we've got a customer that's asking 1774 02:13:39,899 --> 02:13:41,583 questions, you know, 1775 02:13:41,583 --> 02:13:43,183 about how we're storing data or 1776 02:13:43,183 --> 02:13:45,066 something. I'm assuming at some point a 1777 02:13:45,066 --> 02:13:45,933 startup will come to you 1778 02:13:45,933 --> 02:13:49,283 and go, okay, we've reached a point where 1779 02:13:49,283 --> 02:13:51,216 people are actually asking about 1780 02:13:51,216 --> 02:13:52,399 security. And, and I 1781 02:13:52,399 --> 02:13:53,733 don't know if it's actually gotten lower 1782 02:13:53,733 --> 02:13:55,066 in the, the initialization 1783 02:13:55,066 --> 02:13:56,666 phase or the unicorn phase, 1784 02:13:56,699 --> 02:13:58,366 you know, before series A or whatever. 1785 02:13:59,066 --> 02:14:00,583 Um, have you noticed, you 1786 02:14:00,583 --> 02:14:02,116 know, from, from a Goldie 1787 02:14:02,199 --> 02:14:04,816 Knox part of point of view, when they've 1788 02:14:04,816 --> 02:14:05,733 started asking about 1789 02:14:05,733 --> 02:14:07,533 security, is it, is it become sooner 1790 02:14:07,533 --> 02:14:10,116 rather than later in the, in this 1791 02:14:10,116 --> 02:14:13,683 journey? Absolutely. Um, and 1792 02:14:13,683 --> 02:14:15,716 you know, one of the things 1793 02:14:19,000 --> 02:14:21,899 so people are more and more concerned as 1794 02:14:21,899 --> 02:14:24,266 products are more, um, 1795 02:14:25,033 --> 02:14:26,000 software as a service. 1796 02:14:27,000 --> 02:14:30,416 Right. Um, about making sure that their, 1797 02:14:30,416 --> 02:14:32,233 their data is secure and 1798 02:14:32,233 --> 02:14:35,333 there's more certifications 1799 02:14:36,199 --> 02:14:38,866 for those types of providers. You know, 1800 02:14:38,866 --> 02:14:40,116 when people were buying 1801 02:14:40,116 --> 02:14:42,066 software and just deploying it, 1802 02:14:43,316 --> 02:14:45,699 in data centers themselves, I think there 1803 02:14:45,699 --> 02:14:47,199 was less concern about that. 1804 02:14:47,500 --> 02:14:50,333 But now that I'm trusting my 1805 02:14:50,433 --> 02:14:53,883 data to the service, um, I have more 1806 02:14:53,883 --> 02:14:55,716 concern about that. So I 1807 02:14:55,716 --> 02:14:59,666 would, as a CSO, I would ask 1808 02:15:00,033 --> 02:15:03,716 earlier in the process process for a SOC 1809 02:15:03,716 --> 02:15:04,833 2 or something like 1810 02:15:04,833 --> 02:15:08,716 that. Um, and I think for 1811 02:15:10,683 --> 02:15:12,833 many providers that are offering SAS 1812 02:15:12,833 --> 02:15:16,733 services, it's actually a deal 1813 02:15:16,733 --> 02:15:19,000 lender. If they don't have a, 1814 02:15:19,183 --> 02:15:24,933 a SOC or a SOC, um, to type two, I know 1815 02:15:24,933 --> 02:15:26,183 there's, there's been 1816 02:15:26,183 --> 02:15:27,566 companies I wouldn't 1817 02:15:27,733 --> 02:15:28,883 do business with because 1818 02:15:28,883 --> 02:15:29,899 they didn't have a SOC. 1819 02:15:32,283 --> 02:15:36,983 That makes sense. Yeah. But yeah, so it's 1820 02:15:36,983 --> 02:15:38,383 definitely earlier and 1821 02:15:38,383 --> 02:15:40,666 I would, you know, I, 1822 02:15:40,699 --> 02:15:46,100 this is me being a salesperson without my 1823 02:15:46,100 --> 02:15:49,583 sales hat on. Um, the

earlier 1824 02:15:49,583 --> 02:15:51,283 you bring a security advisor 1825 02:15:51,483 --> 02:15:55,216 in, especially if you're building a 1826 02:15:55,216 --> 02:15:58,800 product, the better you are, because if 1827 02:15:58,800 --> 02:16:00,966 you build those, um, 1828 02:16:01,216 --> 02:16:05,199 controls in from day one, number one, you 1829 02:16:05,199 --> 02:16:06,466 don't have to retrofit them 1830 02:16:06,466 --> 02:16:07,866 later. They don't, they're 1831 02:16:07,899 --> 02:16:10,866 not as expensive. Number two, you 1832 02:16:10,866 --> 02:16:13,033 establish good practices right up front. 1833 02:16:14,116 --> 02:16:15,816 Um, and our friend that 1834 02:16:15,816 --> 02:16:19,333 we've mentioned from Leviathan, um, is 1835 02:16:19,333 --> 02:16:22,733 really good at advising on 1836 02:16:22,733 --> 02:16:24,733 those services from a software 1837 02:16:24,733 --> 02:16:27,816 delivery perspective. Oh yeah. And I 1838 02:16:27,816 --> 02:16:30,800 think that's one of our shared passions 1839 02:16:30,800 --> 02:16:32,583 is making sure we're 1840 02:16:32,600 --> 02:16:35,700 building better software. Yeah. That's 1841 02:16:35,700 --> 02:16:38,133 yeah, that's awesome. Um, I also, you 1842 02:16:38,133 --> 02:16:39,066 know, just looking at 1843 02:16:39,066 --> 02:16:41,716 your partnerships on your page. Uh, I, I 1844 02:16:41,716 --> 02:16:43,183 also know one of the other companies 1845 02:16:43,183 --> 02:16:45,633 there that is, is, um, 1846 02:16:46,233 --> 02:16:48,516 pretty, pretty good too. So, uh, yeah, I, 1847 02:16:48,516 --> 02:16:51,483 I think, uh, yeah, I 1848 02:16:51,483 --> 02:16:52,716 think it's, it's, you know, 1849 02:16:53,433 --> 02:16:55,783 good to have, you know, good 1850 02:16:55,783 --> 02:16:58,000 partnerships. It's good to, you know, 1851 02:16:58,000 --> 02:16:58,983 bring in security as soon as 1852 02:16:59,016 --> 02:17:02,983 possible. But, um, you know, it, it 1853 02:17:02,983 --> 02:17:04,983 obviously shows due diligence, right? 1854 02:17:04,983 --> 02:17:05,916 When, when a company's like, 1855 02:17:05,916 --> 02:17:07,483 Hey, you know, when, when you're 1856 02:17:07,483 --> 02:17:09,733 self-aware enough to go, maybe we should 1857 02:17:09,733 --> 02:17:10,933 have security. Maybe we 1858 02:17:10,933 --> 02:17:12,283 should talk to somebody about that S 1859 02:17:12,283 --> 02:17:14,233 word, uh, before, you know, 1860 02:17:14,383 --> 02:17:15,566 maybe even before somebody 1861 02:17:15,566 --> 02:17:17,216 customer comes in and goes, Hey, you 1862 02:17:17,216 --> 02:17:19,666 know, we want to give you, you know, 1863 02:17:20,083 --> 02:17:20,733 millions of dollars, 1864 02:17:20,833 --> 02:17:22,916 but we need this. So having that 1865 02:17:22,916 --> 02:17:26,116 proactive approach is, I hope it's 1866 02:17:26,116 --> 02:17:27,216 something you see a lot of and not 1867 02:17:27,233 --> 02:17:29,333 like, Oh my God, we need to do this now. 1868 02:17:29,333 --> 02:17:29,966 And, you know, we've got 1869 02:17:29,966 --> 02:17:31,016 something coming up in a month 1870 02:17:31,016 --> 02:17:32,933 or whatever. I bet you get those too. 1871 02:17:33,133 --> 02:17:34,866 But, um, you know, I, I 1872 02:17:34,866 --> 02:17:36,366 imagine the, the more proactive 1873 02:17:36,366 --> 02:17:38,600 approaches are always the, the ones that 1874 02:17:38,600 --> 02:17:41,316 end up being better for you. So yeah. 1875 02:17:41,666 --> 02:17:44,200 And, you know, it's, 1876 02:17:44,500 --> 02:17:48,416 customers have a lot more leeway when a 1877 02:17:48,416 --> 02:17:51,216 company can say we're in 1878 02:17:51,216 --> 02:17:53,216 process with our SOC 2 type one. 1879 02:17:53,966 --> 02:17:56,983 Right. Right. You know, if, if you can 1880 02:17:56,983 --> 02:18:00,166 say that as a company, most of your 1881 02:18:00,166 --> 02:18:01,983 customers will say, Oh, 1882 02:18:02,533 --> 02:18:06,100 okay. When's it do great. And they now 1883 02:18:06,100 --> 02:18:10,033 have a path forward. Right. Right. 1884 02:18:10,433 --> 02:18:11,566 Especially if you can say, 1885 02:18:11,566 --> 02:18:14,233 we've already, you know, engaged somebody 1886 02:18:14,233 --> 02:18:15,416 services, we have an 1887 02:18:15,416 --> 02:18:16,666 audit company on the line. 1888 02:18:17,316 --> 02:18:23,783 Yep. Yep. Makes sense. Yeah. Um, I'm 1889 02:18:23,783 --> 02:18:25,666 going to ask any last question, any 1890 02:18:25,666 --> 02:18:26,833 questions from the chat 1891 02:18:26,833 --> 02:18:29,933 before we go. Any questions? Last call. 1892 02:18:31,166 --> 02:18:33,700 Because, uh, uh, Mary's 1893 02:18:33,700 --> 02:18:35,683 time is not billable here, but 1894 02:18:35,683 --> 02:18:37,283 you know, it should have been, uh, we 1895 02:18:37,283 --> 02:18:37,466 should have made this billable time for her. Uh, so, 1896 02:18:38,033 --> 02:18:45,333 uh, yeah. Uh, okay. So I'm going to call 1897 02:18:45,333 --> 02:18:47,666 it, uh, Mary, uh, you know, 1898 02:18:48,133 --> 02:18:49,616 golden knocks seems to be going 1899 02:18:49,616 --> 02:18:52,716 well. Uh, Oh, uh, okay. So one of our 1900 02:18:52,716 --> 02:18:54,933 friends GoPro Slo-Yo says, uh, what kind 1901 02:18:54,933 --> 02:18:56,433 of fraction do you do 1902 02:18:56,433 --> 02:18:59,083 fractional type CSO work? Frac is 1903 02:18:59,083 --> 02:19:00,000 fractional different than 1904 02:19:00,000 --> 02:19:01,616 virtual? I don't necessarily 1905 02:19:02,316 --> 02:19:06,583 see. I don't necessarily consider it much 1906 02:19:06,583 --> 02:19:08,316 different. Um, okay. 1907 02:19:08,833 --> 02:19:10,433 But it's, it's providing 1908 02:19:10,433 --> 02:19:13,783 services for part of a week. Yes, we do. 1909 02:19:14,233 --> 02:19:16,233 Okay. Okay. Very cool. 1910 02:19:16,666 --> 02:19:20,833 Um, very nice. Um, yeah. Uh, 1911 02:19:20,916 -->

02:19:23,683 yeah. GoPro, uh, check out golden 1912 02:19:23,683 --> 02:19:25,683 knocks.com, man. Uh, you 1913 02:19:25,683 --> 02:19:27,383 know, uh, you know, if y'all need 1914 02:19:27,483 --> 02:19:30,016 anything, um, amazing people who work 1915 02:19:30,016 --> 02:19:31,899 there, by the way, uh, Mary, 1916 02:19:31,899 --> 02:19:33,216 if people wanted to talk more 1917 02:19:33,216 --> 02:19:35,700 about being a CSO or, Hey, I think I 1918 02:19:35,700 --> 02:19:37,133 could be a CSO, please 1919 02:19:37,133 --> 02:19:39,366 mentor me or whatever. Uh, how, 1920 02:19:39,366 --> 02:19:40,366 how would they get ahold of you? How 1921 02:19:40,366 --> 02:19:42,000 would they, how would they contact? Um, 1922 02:19:42,716 --> 02:19:45,899 email M gardener. Okay. 1923 02:19:45,899 --> 02:19:50,500 At golden knocks.com. Okay. And my 1924 02:19:50,500 --> 02:19:55,283 LinkedIn profile and, uh, 1925 02:19:55,283 --> 02:19:56,100 that's pretty much the best 1926 02:19:56,133 --> 02:19:58,666 ways to get a, get ahold of me. Um, if 1927 02:19:58,666 --> 02:20:03,916 they want to call 206-218-6900. Okay. 1928 02:20:03,916 --> 02:20:05,366 Very nice. Very nice. 1929 02:20:05,933 --> 02:20:08,816 Uh, on, on other than LinkedIn, are you 1930 02:20:08,816 --> 02:20:09,983 on any social medias 1931 02:20:09,983 --> 02:20:11,233 or anything like that? 1932 02:20:13,549 --> 02:20:16,183 I have not a very active, uh, poster on 1933 02:20:16,183 --> 02:20:18,383 social media. That's fine. 1934 02:20:18,383 --> 02:20:19,616 It's, it's probably for the 1935 02:20:19,616 --> 02:20:21,566 better. You know, it's, it's just another 1936 02:20:21,566 --> 02:20:23,416 point of stress. You've 1937 02:20:23,416 --> 02:20:24,266 already got enough being a 1938 02:20:24,283 --> 02:20:26,566 fractional CSO and auditor and all this 1939 02:20:26,566 --> 02:20:28,016 stuff. So you don't need the 1940 02:20:28,016 --> 02:20:29,399 social media stuff as well. 1941 02:20:29,399 --> 02:20:33,733 So that makes sense. Well, somebody told 1942 02:20:33,733 --> 02:20:36,466 me a very long time ago, when you put 1943 02:20:36,466 --> 02:20:37,483 something out there, 1944 02:20:38,816 --> 02:20:41,783 it's really hard to get it back. Oh yeah. 1945 02:20:42,299 --> 02:20:43,666 Yeah. Yeah. That's true. 1946 02:20:44,100 --> 02:20:45,899 So, you know, my, my cat has 1947 02:20:45,899 --> 02:20:48,833 a Facebook account. Occasionally she will 1948 02:20:48,833 --> 02:20:50,583 post something, but that's 1949 02:20:50,583 --> 02:20:52,183 not it. That's fantastic. 1950 02:20:52,583 --> 02:20:56,333 Yeah. Yeah. My, my cats are actually 1951 02:20:56,333 --> 02:20:58,100 surprisingly gone. I would have brought 1952 02:20:58,100 --> 02:20:58,899 mom and Katie on here 1953 02:20:58,899 --> 02:21:00,700 and let you, let you check out mom and 1954 02:21:00,700 --> 02:21:04,516 Katie, but, um, very nice. Um, cool. 1955 02:21:04,516 --> 02:21:05,533 Well, yeah, like I said, 1956 02:21:05,533 --> 02:21:07,683 check out golden ox. Um, I'd like to 1957 02:21:07,683 --> 02:21:09,033 thank onyx for reaching 1958 02:21:09,033 --> 02:21:11,083 out and saying, Hey, and, uh, 1959 02:21:11,083 --> 02:21:14,033 get it making this happen. Um, um, very, 1960 02:21:14,266 --> 02:21:15,233 very happy to have met 1961 02:21:15,233 --> 02:21:17,633 onyx and yourself. And, um, 1962 02:21:18,350 --> 02:21:20,733 I wish, wish y'all the best and hope for 1963 02:21:20,733 --> 02:21:22,100 continued success for, for, 1964 02:21:22,100 --> 02:21:24,816 for golden ox. And, uh, we'll 1965 02:21:25,149 --> 02:21:26,516 definitely have to have y'all back on at 1966 02:21:26,516 --> 02:21:27,166 some point in the near 1967 02:21:27,166 --> 02:21:28,983 future, uh, to, to talk about 1968 02:21:28,983 --> 02:21:30,783 some other things, some compliance, some 1969 02:21:30,783 --> 02:21:32,666 GRC stuff. I'm, I'm all 1970 02:21:32,666 --> 02:21:34,316 in on that stuff. Uh, I've, 1971 02:21:34,316 --> 02:21:35,799 I've actually changed how I feel about 1972 02:21:35,799 --> 02:21:39,166 GRC now in the past few years on this. 1973 02:21:39,366 --> 02:21:41,183 So, um, very cool. So, 1974 02:21:41,183 --> 02:21:42,666 Mary, thank you so much for, for being 1975 02:21:42,666 --> 02:21:45,700 here. Uh, and, uh, yeah, that 1976 02:21:45,700 --> 02:21:46,766 was, that was it for breaking 1977 02:21:47,233 --> 02:21:49,216 security, uh, breaking education this 1978 02:21:49,216 --> 02:21:51,466 week. Uh, you know, Mr. 1979 02:21:51,466 --> 02:21:52,466 Betcher can be found at 1980 02:21:52,466 --> 02:21:54,700 betcher poned on Twitter, B O E T T C H E 1981 02:21:54,700 --> 02:21:57,233 R P W N E D. Uh, miss 1982 02:21:57,233 --> 02:21:58,816 Berlin, who would have been here, 1983 02:21:58,816 --> 02:22:01,116 except she's entertaining people who came 1984 02:22:01,116 --> 02:22:02,216 in for the silver eclipse 1985 02:22:02,216 --> 02:22:04,266 tomorrow, uh, can be found at 1986 02:22:04,266 --> 02:22:08,266 info sister INFOSYSTIR. Uh, she also runs 1987 02:22:08,266 --> 02:22:09,516 the nonprofit hackers 1988 02:22:09,516 --> 02:22:11,033 health, which does villages 1989 02:22:11,233 --> 02:22:13,483 at conferences for, uh, you know, 1990 02:22:13,483 --> 02:22:14,500 bringing awareness to 1991 02:22:14,500 --> 02:22:16,433 mental health issues. And you can 1992 02:22:16,433 --> 02:22:18,983 find that at, um, on, on hackers health 1993 02:22:18,983 --> 02:22:21,333 on, on Twitter as well. And 1994 02:22:21,333 --> 02:22:22,233 you can find me on Twitter, 1995 02:22:22,533 --> 02:22:25,399 Brian break. And you can find me on 1996 02:22:25,399 --> 02:22:27,666 LinkedIn, uh, linkedin.com 1997 02:22:27,666 --> 02:22:29,833 forward slash iron forward slash 1998 02:22:29,833 --> 02:22:32,366 break B. So it's really easy to find. Um, 1999 02:22:32,566 --> 02:22:33,216 but that was it for 2000 02:22:33,216 --> 02:22:34,200 breaking down security this week. 2001 02:22:34,366 --> 02:22:35,566 Hope you have a great week. Thank you 2002 02:22:35,566 --> 02:22:36,700 again, Mary for your time 2003 02:22:36,700 --> 02:22:37,933 and appreciate that so much. 2004 02:22:38,600 --> 02:22:40,416 And, um, you know, take care of 2005 02:22:40,416 --> 02:22:41,700 yourselves. Uh, as 2006 02:22:41,700 --> 02:22:42,683 we're fond of saying here, 2007 02:22:42,683 --> 02:22:45,166 you're the only you, you have, and we 2008 02:22:45,166 --> 02:22:46,766 will talk to you again soon. Bye.