WEBVTT
00:00:00.080 --> 00:00:01.600
Humans can be the weakest link.
00:00:01.760 --> 00:00:03.279
Humans can be your greatest asset.
00:00:03.359 --> 00:00:08.320
You know, in the US, the workforce really is split 50-50 between male and female.
00:00:08.560 --> 00:00:11.359
And in technology and in cyber, that's about 20%.
00:00:11.839 --> 00:00:16.640
That's nowhere near where we need to be from a technology perspective or from a cyber perspective.
00:00:16.879 --> 00:00:19.359
It is unfortunately a male-dominated industry.
00:00:19.440 --> 00:00:22.559
It cannot stay a male-dominated industry if we want to keep evolving.
00:00:22.719 --> 00:00:40.399
To Margarita's point, the diversity and even really the neurodiversity, because women do think differently and do see things from a different mindset versus males, brings a lot of enhancements to the field that can very much help keep us not just keep pace, but really push us forward to evolving.
00:00:48.799 --> 00:00:56.880
Hey there and welcome to the latest episode of the Black Hat Files, a behind-the-scenes look at the world of cybersecurity.
00:00:56.960 --> 00:00:57.600
My name's Richard.
00:01:04.319 --> 00:01:09.200
And I'm delighted to say it is a special Miami edition of the Black Hat Files.
00:01:09.280 --> 00:01:10.400
Let's welcome our guest today.
00:01:10.560 --> 00:01:16.879
First of all, Margarita Rivera, Global Chief Information Security Officer, Carnival Corporation in Miami.
00:01:16.959 --> 00:01:17.680
Hey Margarita.
00:01:18.000 --> 00:01:19.439
Hello there, Miami edition.
00:01:19.599 --> 00:01:19.840
Wow.
00:01:19.920 --> 00:01:21.519
Now you know it's going to be a fun podcast.
00:01:21.680 --> 00:01:22.879
I was going to say Miami Vice.
00:01:22.959 --> 00:01:23.840
It would have been a cliche.
00:01:24.239 --> 00:01:25.680
Perhaps inappropriate.
00:01:25.920 --> 00:01:32.480
But also from Miami, Marcos Merrero, Chief Information Security Officer at H I G Capital.
00:01:32.560 --> 00:01:33.359
How are you, Marcus?
00:01:33.519 --> 00:01:34.079
I'm doing well.
00:01:34.159 --> 00:01:37.519
And it may be a caliente podcast.
00:01:38.159 --> 00:01:38.480
Okay.
00:01:38.799 --> 00:01:39.519
He doesn't speak Spanish.
00:01:40.000 --> 00:01:41.439
I've been spanol, por favor.
00:01:41.680 --> 00:01:42.079
Well, you see?
00:01:42.400 --> 00:01:42.959
Yes, he does.
00:01:43.120 --> 00:01:44.000
A little bit, a little bit.
00:01:44.159 --> 00:01:45.120
Let's stick to English.
00:01:45.359 --> 00:01:45.439
Okay.
00:01:45.599 --> 00:01:45.920
Absolutely.
00:01:46.159 --> 00:01:52.640
But it's good to have you both here, but you do know each other from the kind of the you say there's a bit of a CISO Miami Mafia.
00:01:52.799 --> 00:01:53.120
Absolutely.
00:01:53.280 --> 00:01:57.599
And that Miami Mafia, because that sounds, you know, a little dark there.
00:01:57.680 --> 00:02:08.800
But yeah, there's definitely a CISO community in Miami, which Marcos and I are a part of leading and, you know, really helping to grow and network and do activities and development for our community.
00:02:08.879 --> 00:02:10.000
So we know each other from there.
00:02:10.159 --> 00:02:10.479
Okay, cool.
00:02:10.560 --> 00:02:12.319
I've insulted you twice now, Vice and Mafia.
00:02:12.400 --> 00:02:13.759
So I'm going to stick the straight and narrow.
00:02:13.840 --> 00:02:17.360
Now you are good, you are fine, upstanding people, but you are not the bad guys.
00:02:17.759 --> 00:02:18.400
You are the good guys.
00:02:18.719 --> 00:02:19.199
We protect.
00:02:19.360 --> 00:02:20.000
You do protect.
00:02:20.240 --> 00:02:27.840
So let's talk a little bit about, first of all, you're in Miami, but we're here in Riyadh, Saudi Arabia, for Black Hat Middle Eastern Africa 2025.
00:02:28.159 --> 00:02:31.280
My question to you, Margarita, first of all, is about events.
00:02:31.439 --> 00:02:32.719
You go to quite a lot of events.
00:02:32.800 --> 00:02:34.719
You're selective about the ones you go to.
00:02:34.960 --> 00:02:42.879
What separates, from your perspective, the good from the great events that are one, the ones that are worth going to, the ones that are worth going back to?
00:02:43.280 --> 00:02:43.680
Sure.
00:02:43.919 --> 00:02:50.000
So I would say Black Hat MEA has ruined it for all of us, but in a good way.
00:02:50.319 --> 00:02:52.719
This is definitely one that you want to attend.
00:02:52.800 --> 00:02:53.680
It's very different.
00:02:54.080 --> 00:03:11.360
The great events have great speakers, have great content, really have a lot of thought that's put into the quality of the information that's going to be shared and the dynamics of the personalities that are going to come together in panels and who's available from vendors and partners.
00:03:11.439 --> 00:03:15.840
And really, Black Hat has been just amazing here in Riyadh, Saudi Arabia.
00:03:15.919 --> 00:03:19.280
You have the top of the top, and you have folks from all over the world.
00:03:19.439 --> 00:03:22.639
It's truly a blend of such diverse culture and thought.
00:03:22.800 --> 00:03:23.680
It's been incredible.
00:03:23.840 --> 00:03:31.439
I mean, those events that typically you want to stay away from don't put in the amount of detail that we've seen here this week.
00:03:31.520 --> 00:03:34.479
And I'm actually very sad that it's coming to an end.
00:03:34.639 --> 00:03:37.680
Um it's gonna be very hard for me to go to any event after this.
00:03:38.319 --> 00:03:38.960
Kind words.
00:03:39.120 --> 00:03:42.000
Uh Marcos, your your perspective, again, you've been to a lot of these events.
00:03:42.159 --> 00:03:46.560
What for you is the secret source that makes you think, yeah, it's worth me getting on a plane?
00:03:46.639 --> 00:03:48.479
It's worth that effort to go there.
00:03:48.800 --> 00:04:01.439
So I'll add two things to the content piece, which is the logistics and the organization of the event, plus also but also the the curated, I guess, aspect of the content, plus also the individuals that are attending.
00:04:01.680 --> 00:04:03.199
This is now in my top three.
00:04:03.439 --> 00:04:10.000
Just like Margarita said, it is one that I will look forward to attending because every single day has been insightful.
00:04:10.080 --> 00:04:16.000
You've learned something new, you've seen a topic that maybe you have not seen before at any other conference or any other event.
00:04:16.160 --> 00:04:22.240
So those would be the three main areas that I say will definitely separates Black Hat uh Mia from all the other ones.
00:04:22.480 --> 00:04:28.240
Okay, well let's look at the substance, some of the things that have been uh discussed over the past three days or so.
00:04:28.560 --> 00:04:34.639
AI, certainly, that is the here and now, but more and more talk about quantum computing.
00:04:34.959 --> 00:04:37.120
Be prepared for quantum computing.
00:04:37.199 --> 00:04:38.399
What's your take, Mother Rita?
00:04:38.720 --> 00:04:40.240
So definitely, be prepared.
00:04:40.319 --> 00:04:46.959
Um I think it's one of the things that we see the most in our industry where our folks are more reactive rather than proactive.
00:04:47.120 --> 00:05:00.639
And even with AI, that has been around for such a long time, uh at the onset of what we're seeing now, the momentum, everything at breakneck speed, we're seeing that the security community is still somewhat trying to catch up from a security perspective.
00:05:00.800 --> 00:05:07.519
And we know quantum computing is here, it's coming, it's been gonna become more proliferal, more pervasive, just like we see AI.
00:05:07.680 --> 00:05:12.000
And we really have to be more proactive in the way that we look at that.
00:05:12.160 --> 00:05:22.240
So a lot of the sessions that we've had here throughout this week has really talked about, you know, quantum computing and how do you prepare and how do you become that forward-thinking CISO and security practitioner.
00:05:22.399 --> 00:05:24.399
So you start building in those practices.
00:05:24.560 --> 00:05:26.399
So you start thinking about the controls.
00:05:26.560 --> 00:05:29.120
So you start thinking how that relates to your organization.
00:05:29.279 --> 00:05:41.040
So I love the fact that we are being proactive in our thought process because historically we've been a very reactive type of industry where something new comes out, it disrupts, and we're trying to catch up.
00:05:41.199 --> 00:05:52.319
When we know that the threat actors, they're being very proactive in their way of how they're going to leverage and use these new groundbreaking disruptive technologies in order to affect organizations.
00:05:52.639 --> 00:05:54.800
Quantum computing does scare.
00:05:55.040 --> 00:05:56.800
Well, quantum computing doesn't scare me.
00:05:57.040 --> 00:06:00.879
The bad guys getting quantum computing does scare me.
00:06:00.959 --> 00:06:08.000
Um and Marcus looking at your world, uh, HIG, it's uh finance company,$70 billion, I think, assets under management.
00:06:08.319 --> 00:06:18.160
And one of the big threats that uh that quantum computing potentially holds is cryptography, breaking passwords in very, very simple terms.
00:06:18.319 --> 00:06:19.519
I I worry about that.
00:06:19.680 --> 00:06:23.519
Am I right to worry or am I overly concerned?
00:06:23.839 --> 00:06:26.959
You are all in all you're right to worry about it.
00:06:27.040 --> 00:06:36.800
And it's funny, and I smiled when you said uh quantum, because that is literally off of the keynote that I just came off of, the one topic or technology that we are not talking about as an industry.
00:06:36.959 --> 00:06:41.839
Um, I've spent the better part of about the last two years continuously talking about quantum.
00:06:42.079 --> 00:06:51.439
My internal team uh from security operations are working on quantum computing resistant cryptography because the world will change once quantum computing enters the private sector.
00:06:51.600 --> 00:06:52.639
Let's make no mistake about it.
00:06:52.720 --> 00:06:54.319
Nation states have access to it now.
00:06:54.480 --> 00:06:55.120
Absolutely.
00:06:55.519 --> 00:07:15.040
But when it becomes democratized and it's now available to the public, that is when we're gonna start seeing a lot of bigger problems because all of the data hoarding out of all the data breaches over the last 10 years is now gonna be data that you can read and data that becomes actionable to threat actors and also to intelligence agencies.
00:07:15.360 --> 00:07:20.879
Well, that reminds me, Margarita River, to pick up on that, of something you wrote on LinkedIn recently.
00:07:21.199 --> 00:07:28.319
You said we talk a lot about threat actors leveling up, but honestly, so are CISOs.
00:07:28.720 --> 00:07:30.240
You have no choice in this industry.
00:07:30.480 --> 00:07:38.079
I mean, as CISOs technologists in general, you have to be continuously learning, continuously growing, continuously preparing yourself.
00:07:38.399 --> 00:07:51.600
Because as I mentioned before, technology is changing quite quickly, and learning and being able to thwart attacks is going to take folks that are willing to put in the time to learn and to grow and to prepare themselves and their teams.
00:07:51.839 --> 00:07:56.560
I think one of the things that we're facing as CISOs today is the upskilling of our teams.
00:07:56.639 --> 00:08:02.399
You know, we can't approach security with 10-year-old tactics or 10-year-old approaches or mindsets.
00:08:02.639 --> 00:08:04.560
We have to continue to evolve.
00:08:04.800 --> 00:08:07.199
It's what I love the most about this industry.
00:08:07.360 --> 00:08:16.399
And you're seeing a lot of CISOs take the time to develop themselves and to develop their teams to be able to prepare for things like quantum computing and other technology.
00:08:16.879 --> 00:08:18.480
How do you prepare for quantum computing?
00:08:18.560 --> 00:08:22.319
It's a question to both of you because it is a very cutting-edge technology.
00:08:22.800 --> 00:08:27.920
CISOs cannot be expected to have in-depth knowledge of precisely how quantum computing works.
00:08:28.079 --> 00:08:29.120
I guess that's not the point.
00:08:29.279 --> 00:08:31.920
So, what resources do you use?
00:08:32.080 --> 00:08:32.799
Who do you work with?
00:08:32.960 --> 00:08:35.360
Do you work with universities, for example?
00:08:35.519 --> 00:08:37.360
Do you work with industry bodies?
00:08:37.600 --> 00:08:38.320
Question to both of you.
00:08:38.480 --> 00:08:39.919
I'd say it's a combination of all of them.
00:08:40.000 --> 00:08:46.799
Um you have to work, number one, as an organization, and you're wanting to become quantum resistant, work with your vendors.
00:08:46.960 --> 00:08:54.799
Because at the end of the day, all of all of your vendors and your service providers have implemented some level of quantum or on some level of cryptography that is not quantum resistant.
00:08:54.879 --> 00:09:00.720
So you need to upgrade all of that or all of that cryptography protocols that you utilize to become quantum resistant.
00:09:00.879 --> 00:09:14.960
But to understand quantum computing at its real fundamental level, and I agree with you, it is a very complex topic when you start talking about qubits and whatnot, definitely the research community, universities, and also your local bodies within countries.
00:09:15.039 --> 00:09:22.159
So NIST in the US, for example, has a lot of materials and a lot of resources that really lays out quantum computing in layman's terms.
00:09:22.480 --> 00:09:22.720
Correct.
00:09:22.799 --> 00:09:24.080
I completely agree with Marcos.
00:09:24.320 --> 00:09:27.759
I mean, there's a wealth of information that is out there.
00:09:27.919 --> 00:09:37.279
And obviously, the foundation of it being on encryption, having folks on your team that are well-versed and understanding that it's kind of taking that to like the next layer, the next level.
00:09:37.440 --> 00:09:42.000
So partnering definitely with network communities, with universities, with peers.
00:09:42.080 --> 00:09:51.440
I mean, coming to events like this and hearing from other thought leaders and how they're approaching things like quantum computing and how they're leveling up really does help that growth curve.
00:09:51.679 --> 00:09:52.639
How are the vendors doing?
00:09:52.720 --> 00:09:54.000
You mentioned vendors mark us.
00:09:54.399 --> 00:09:58.879
How are they doing in creating quantum resistant solutions?
00:09:59.039 --> 00:10:02.639
Can I ask you for maybe it's unfair to ask you for a uh what grade would you give them?
00:10:02.720 --> 00:10:03.200
I'm gonna ask you.
00:10:03.279 --> 00:10:05.840
You don't have to up and say, what grade would you give them?
00:10:06.720 --> 00:10:06.960
Let's ask.
00:10:07.200 --> 00:10:08.960
Okay, what grade would you give them?
00:10:11.759 --> 00:10:14.799
Probably somewhere around the D minus, to be honest with you.
00:10:15.279 --> 00:10:15.519
Wow.
00:10:16.240 --> 00:10:31.759
Um I've started asking vendors over the last eight to nine months, what quantum computing uh controls or uh tactics have you implemented within your platforms to shift the cryptography that is not too towards quantum resistant, and I get blank stairs.
00:10:32.000 --> 00:10:32.799
Wait, wait, what?
00:10:32.879 --> 00:10:35.279
Well, what's but Okay, conversation's over.
00:10:35.360 --> 00:10:36.960
If that's the first answer you give me.
00:10:37.200 --> 00:10:44.720
However, there are a few vendors, and I will not name exactly which one, that are at the forefront of quantum computing.
00:10:45.039 --> 00:10:46.639
So they've been getting an ARP report.
00:10:46.960 --> 00:10:48.559
Oh, they've been getting an A plus in my book.
00:10:48.799 --> 00:10:52.720
Okay, because they are forward-looking, forward thinking, and they're coming to me before I even ask them.
00:10:53.039 --> 00:10:53.919
I completely agree.
00:10:54.000 --> 00:10:59.440
I mean, you have some that again are very proactive, but most tend to lag behind.
00:10:59.600 --> 00:11:02.320
They don't see it as an immediate problem.
00:11:02.559 --> 00:11:08.960
There is, again, this boom around AI security and really putting in the guardrails and the observability and controls around it.
00:11:09.120 --> 00:11:13.279
Not as much focus on quantum, but those that are are doing it well.
00:11:13.600 --> 00:11:15.200
Okay, well, let me flip the question around.
00:11:15.360 --> 00:11:15.519
Sure.
00:11:15.840 --> 00:11:26.159
When you go to your chief finance officers and ask for budget to be signed off to pay for this, let's take your A plus uh vendor, who you're not gonna name, but fair enough.
00:11:26.240 --> 00:11:29.279
Uh I'm sure they charge a significant fee for what for what they do.
00:11:29.360 --> 00:11:29.919
They're very good at it.
00:11:30.080 --> 00:11:31.200
If I can name them, I will name them.
00:11:31.360 --> 00:11:35.360
Not sure if we can or cannot, um, but they are definitely A plus in my book.
00:11:35.440 --> 00:11:36.399
But pilot, sorry.
00:11:36.639 --> 00:11:45.440
But they will charge a fee for that, and you've got to go to the you and people like you have got to go to the finance department, the CFO, and say, okay, we've got to be quantum resistant.
00:11:45.519 --> 00:11:49.759
It's not here yet, but it's there in the future, and it's gonna cost X million dollars.
00:11:49.919 --> 00:11:53.039
And the CFO goes, but this is a theoretical threat.
00:11:53.120 --> 00:11:56.159
It's not really the bad guys haven't got this now.
00:11:56.559 --> 00:11:59.440
Do I really need to spend this money now, Marcos?
00:11:59.600 --> 00:12:01.279
Are you sure you'd sign off on this?
00:12:01.600 --> 00:12:08.159
Yes, because I'm sorry, this A plus vendor is coming to me with the evidence that I'm taking to my CFO showing here's why you need to do this stuff.
00:12:08.480 --> 00:12:09.679
This is not theoretical anymore.
00:12:10.080 --> 00:12:10.720
This is happening.
00:12:11.120 --> 00:12:17.360
It's just it's so expensive to be able to utilize quantum computing that it's not available to the masses.
00:12:18.159 --> 00:12:18.879
That's the problem.
00:12:19.519 --> 00:12:20.960
Let's talk about some other things.
00:12:21.279 --> 00:12:26.399
Leadership shift from compliance to culture was an interesting piece I read by you, Marcos, on LinkedIn.
00:12:26.559 --> 00:12:36.559
You said there needs to be a leadership uh shift within your industry, within CSERs and and others part of the ecosystem, from compliance to culture.
00:12:36.720 --> 00:12:38.559
What do you mean by that and why is it important?
00:12:39.279 --> 00:12:42.960
So compliance has always been a check the box exercise.
00:12:43.440 --> 00:12:48.399
I need to have XYZ, so I need to buy ABC that's gonna take care of XYZ.
00:12:48.960 --> 00:12:50.399
That does not make us secure.
00:12:50.720 --> 00:13:04.960
At the end of the day, risk is a moving target, risk is ever evolving, risk is something that is not it's not something you can uh find a solution for by just buying XYZ or whatnot.
00:13:05.440 --> 00:13:08.879
That is what um compliance really takes you towards.
00:13:09.039 --> 00:13:20.159
So when you shift toward culture, where everyone is in a risk mindset within your organization, then that's when you start moving away from compliance and to a cultural risk shift.
00:13:20.399 --> 00:13:24.559
So now risk becomes something that's at the forefront of all your individuals.
00:13:24.799 --> 00:13:28.720
I say that I have the largest organ or the largest department in the entire organization.
00:13:28.960 --> 00:13:30.639
Every single employee works for me.
00:13:30.799 --> 00:13:33.919
And I get upstairs and looks like what are you talking about?
00:13:34.080 --> 00:13:37.120
Yeah, every single employee is a human firewall for me.
00:13:37.279 --> 00:13:45.360
Every single employee is at the front lines of all of the emails that come in, all of the messages, all of the potential cyber risks that they can be dealing with.
00:13:45.679 --> 00:13:52.720
So when you shift your culture toward having cyber risk at the forefront, you become much stronger as an organization.
00:13:53.200 --> 00:13:56.159
You guys know each other well through the Miami community.
00:13:56.240 --> 00:13:58.399
And I'm wondering if very different industries.
00:13:58.639 --> 00:14:03.759
The hospitality industry with Carnival, the financial services industry with HIG, very different.
00:14:04.000 --> 00:14:08.559
What are the differences and what are the similarities in what you do, would you say?
00:14:08.960 --> 00:14:12.879
So I always say that from a cybersecurity perspective, we're not quite that different.
00:14:13.120 --> 00:14:18.080
I mean, when you look behind everything, what we're trying to do is very similar.
00:14:18.240 --> 00:14:19.600
Our foundations are similar.
00:14:19.759 --> 00:14:28.480
You know, we're all having to tackle identity, we're having to tackle observability, we're having to tackle security operations, engineering, architecture, artificial intelligence.
00:14:28.559 --> 00:14:29.519
That's all the same.
00:14:29.759 --> 00:14:33.679
I think that we have to get a little bit more creative, depending on your industry.
00:14:33.840 --> 00:14:36.559
I mean, you're in a very regulated industry, financial services.
00:14:36.799 --> 00:14:40.639
My first decade of my career was in financial services, so it's very near and dear to my heart.
00:14:40.799 --> 00:14:46.960
But I'm in hospitality where people want to have fun, and security can be seen as a blocker to fun.
00:14:47.120 --> 00:14:56.639
So I have to be incredibly creative in terms of the approach that I have with cybersecurity within my organization, especially because I am essentially securing floating cities.
00:14:56.720 --> 00:15:08.879
I mean, I have 94 floating cities across the globe, and we are tackling all kinds of different things from restaurants to hotels to medical to the operational technology.
00:15:09.120 --> 00:15:10.960
That's where the differences I think come in.
00:15:11.039 --> 00:15:11.840
What are your thoughts?
00:15:12.159 --> 00:15:12.559
Agreed.
00:15:12.720 --> 00:15:17.279
We all have the same base level of threats and risks that we need to address.
00:15:17.440 --> 00:15:19.840
It's no different across any other industry.
00:15:20.080 --> 00:15:24.639
Then as you go up that ladder, then it becomes a bit more specialized in each area.
00:15:24.799 --> 00:15:26.639
Margarita has ships she has to secure.
00:15:26.720 --> 00:15:28.799
I have portfolio companies that I need to secure.
00:15:28.879 --> 00:15:31.200
And these portfolio companies can be in any industry.
00:15:31.360 --> 00:15:32.559
You name it, we own it.
00:15:32.799 --> 00:15:38.559
But it's interesting to go back to your point, Marcus, about everybody in the organization works for me.
00:15:38.879 --> 00:15:42.960
Given what you are at HIG, I would imagine a relatively small workforce.
00:15:43.120 --> 00:15:47.919
That's typically the case with alternative asset managers, which which I think I'm right in describing you as.
00:15:48.399 --> 00:15:59.360
However, with carnival hospitality industry, you've got massive workforces, and we often hear the cliche, or journalists like me use the cliche, humans are the weakest link in any security chain.
00:15:59.519 --> 00:16:02.879
You've just got different HR issues there, I guess.
00:16:03.279 --> 00:16:04.000
Absolutely.
00:16:04.159 --> 00:16:10.720
I mean, it's definitely a different approach and a different driver, but nonetheless equally as important.
00:16:10.879 --> 00:16:14.799
So humans can be the weakest link, humans can be your greatest asset.
00:16:14.960 --> 00:16:26.960
It really all depends on the job that we're doing, you know, with our teams, to provide security awareness, to make everybody understand their responsibility and making that culture pervasive throughout everything that we do.
00:16:27.279 --> 00:16:31.759
Finally, before we wrap up, let me ask you about the role of women in this industry.
00:16:31.919 --> 00:16:46.320
I've been lucky here at Black Hat Middle Eastern Africa 2025 to meet a number of very powerful women in very senior CISO positions, where whether here in Saudi Arabia or in Europe or in the United States, and there's there's yourself as well.
00:16:46.480 --> 00:16:52.480
And perhaps that's giving me a false impression that women play a very prominent role in this industry.
00:16:52.879 --> 00:16:57.200
You say it's about 22-0%, Margarita.
00:16:57.519 --> 00:16:58.080
That's correct.
00:16:58.320 --> 00:17:07.039
So what I love about being here at Black Hat is definitely being able to see all my women peers, very strong executives in the cyberspace.
00:17:07.200 --> 00:17:11.200
I remember when I started 22 years ago, uh, I was the only woman in a room.
00:17:11.359 --> 00:17:13.039
And now to see much more is great.
00:17:13.200 --> 00:17:14.640
But it's nowhere near where it needs to be.
00:17:14.720 --> 00:17:19.920
You know, in the US, the workforce really is split 50-50 between male and female.
00:17:20.079 --> 00:17:22.960
And in technology and in cyber, that's about 20%.
00:17:23.599 --> 00:17:28.480
That's nowhere near where we need to be from a technology perspective or from a cyber perspective.
00:17:28.720 --> 00:17:38.400
So it's very encouraging to come here and see uh everything that's being done in order to really help extend information and knowledge and growth to other women.
00:17:38.480 --> 00:17:43.440
Uh, the first thing I did when I got here uh the other day was go to the women in Saudi Arabia group.
00:17:43.519 --> 00:17:48.400
I was so proud to spend time talking to those women that are growing and really helping get the word out.
00:17:48.559 --> 00:17:52.400
And they're really helping to grow an industry that needs more women in it.
00:17:52.480 --> 00:17:53.200
That's the reality.
00:17:53.359 --> 00:17:55.359
Women think differently, they function differently.
00:17:55.519 --> 00:17:58.640
Marcos and I were actually talking about that during our drive yesterday.
00:17:58.960 --> 00:18:06.400
There's so much value to that cognitive difference because we are built different and it complements our male counterparts.
00:18:06.720 --> 00:18:08.240
Marcos, you're nodding.
00:18:08.480 --> 00:18:11.440
It is unfortunately a male-dominated industry.
00:18:11.680 --> 00:18:15.680
And um, it cannot stay a male-dominated industry if we want to keep evolving.
00:18:15.759 --> 00:18:37.839
To Margarita's point, the diversity and even really the neurodiversity, because women do think differently and do see things things from a different mindset versus males, brings a lot of enhancements to the field that can very much help keep us, not just keep pace, but really push us forward to evolving as threats continue evolving, and that all at the end of the day puts us in a good place.
00:18:38.079 --> 00:18:44.000
So, Marcos, your your one line to summarize Black Hat MEA here in Riyadh 2025.
00:18:44.319 --> 00:18:52.559
One line that summarizes Black Hat MEA Saudi Arabia 2025 will be innovative and refreshing.
00:18:52.799 --> 00:18:54.000
Why do you say that?
00:18:54.319 --> 00:19:06.480
Innovative because of the level of caliber of individuals and content, but refreshing because it's not the same content and the same caliber of the other conferences we're used to attending.
00:19:06.640 --> 00:19:07.680
This is much better.
00:19:14.480 --> 00:19:23.680
So one line to really summarize Black Hat MAA here in Saudi Arabia is definitely collaboration, forward thinking, and innovation.
00:19:24.000 --> 00:19:24.799
Why do you say that?
00:19:25.119 --> 00:19:31.680
It brought together so many folks from all over the world to work together, to think together, to plan together, and that's incredible.
00:19:31.839 --> 00:19:41.440
That's really where you get true innovation, is where you have diverse ways of thinking coming together in one place and really being able to collaborate together holistically.
00:19:41.759 --> 00:19:43.279
We are gonna wrap this up now.
00:19:43.359 --> 00:19:47.119
We're speaking here in Saudi Arabia, Riyadh, December 2025.
00:19:47.279 --> 00:19:51.359
We're recording this at the conclusion of Black Hat Middle East and Africa for 2025.
00:19:51.519 --> 00:19:54.480
Crystal balls 2026, 30 seconds, each of you.
00:19:54.640 --> 00:19:57.920
What's gonna keep you busiest in 2026, Margarita first?
00:19:58.319 --> 00:20:00.559
Uh definitely genetic AI security.
00:20:00.720 --> 00:20:02.880
I think we're gonna see a lot more proliferation.
00:20:02.960 --> 00:20:05.839
And preparedness for quantum computing is definitely on the docket.
00:20:06.160 --> 00:20:07.039
Marcus, same question.
00:20:07.279 --> 00:20:18.799
So, same answer, just flipped quantum computing first, because we've already initiated that project, but then also trying to hoard all of the AI folks in the organization that just want to run off with AI because it's gonna solve all the world's problems.
00:20:19.119 --> 00:20:21.519
It's been an absolute pleasure talking to both of you.
00:20:21.680 --> 00:20:25.920
Thank you very much indeed for bringing a little piece of Miami to read in Saudi Arabia this week.
00:20:26.079 --> 00:20:32.400
My thanks to, first of all, Margarita Rivera, Global Chief Information Security Officer at Carnival Corporation.
00:20:32.480 --> 00:20:33.039
Thank you.
00:20:33.279 --> 00:20:37.839
And to Marcos Morero, Chief Information Security Officer, H I G Capital.
00:20:38.000 --> 00:20:38.559
Thanks for your time.
00:20:38.720 --> 00:20:38.960
Thank you.
00:20:39.359 --> 00:20:40.240
Or should I say gracias?
00:20:40.559 --> 00:20:41.039
Gracias.
00:20:42.240 --> 00:20:45.599
That is it for this edition of the Black Hat Files.
00:20:45.680 --> 00:20:46.720
We will be back with more.
00:20:46.799 --> 00:20:48.160
Thanks for joining us.
00:00:00.080 --> 00:00:01.600
Humans can be the weakest link.
00:00:01.760 --> 00:00:03.279
Humans can be your greatest asset.
00:00:03.359 --> 00:00:08.320
You know, in the US, the workforce really is split 50-50 between male and female.
00:00:08.560 --> 00:00:11.359
And in technology and in cyber, that's about 20%.
00:00:11.839 --> 00:00:16.640
That's nowhere near where we need to be from a technology perspective or from a cyber perspective.
00:00:16.879 --> 00:00:19.359
It is unfortunately a male-dominated industry.
00:00:19.440 --> 00:00:22.559
It cannot stay a male-dominated industry if we want to keep evolving.
00:00:22.719 --> 00:00:40.399
To Margarita's point, the diversity and even really the neurodiversity, because women do think differently and do see things from a different mindset versus males, brings a lot of enhancements to the field that can very much help keep us not just keep pace, but really push us forward to evolving.
00:00:48.799 --> 00:00:56.880
Hey there and welcome to the latest episode of the Black Hat Files, a behind-the-scenes look at the world of cybersecurity.
00:00:56.960 --> 00:00:57.600
My name's Richard.
00:01:04.319 --> 00:01:09.200
And I'm delighted to say it is a special Miami edition of the Black Hat Files.
00:01:09.280 --> 00:01:10.400
Let's welcome our guest today.
00:01:10.560 --> 00:01:16.879
First of all, Margarita Rivera, Global Chief Information Security Officer, Carnival Corporation in Miami.
00:01:16.959 --> 00:01:17.680
Hey Margarita.
00:01:18.000 --> 00:01:19.439
Hello there, Miami edition.
00:01:19.599 --> 00:01:19.840
Wow.
00:01:19.920 --> 00:01:21.519
Now you know it's going to be a fun podcast.
00:01:21.680 --> 00:01:22.879
I was going to say Miami Vice.
00:01:22.959 --> 00:01:23.840
It would have been a cliche.
00:01:24.239 --> 00:01:25.680
Perhaps inappropriate.
00:01:25.920 --> 00:01:32.480
But also from Miami, Marcos Merrero, Chief Information Security Officer at H I G Capital.
00:01:32.560 --> 00:01:33.359
How are you, Marcus?
00:01:33.519 --> 00:01:34.079
I'm doing well.
00:01:34.159 --> 00:01:37.519
And it may be a caliente podcast.
00:01:38.159 --> 00:01:38.480
Okay.
00:01:38.799 --> 00:01:39.519
He doesn't speak Spanish.
00:01:40.000 --> 00:01:41.439
I've been spanol, por favor.
00:01:41.680 --> 00:01:42.079
Well, you see?
00:01:42.400 --> 00:01:42.959
Yes, he does.
00:01:43.120 --> 00:01:44.000
A little bit, a little bit.
00:01:44.159 --> 00:01:45.120
Let's stick to English.
00:01:45.359 --> 00:01:45.439
Okay.
00:01:45.599 --> 00:01:45.920
Absolutely.
00:01:46.159 --> 00:01:52.640
But it's good to have you both here, but you do know each other from the kind of the you say there's a bit of a CISO Miami Mafia.
00:01:52.799 --> 00:01:53.120
Absolutely.
00:01:53.280 --> 00:01:57.599
And that Miami Mafia, because that sounds, you know, a little dark there.
00:01:57.680 --> 00:02:08.800
But yeah, there's definitely a CISO community in Miami, which Marcos and I are a part of leading and, you know, really helping to grow and network and do activities and development for our community.
00:02:08.879 --> 00:02:10.000
So we know each other from there.
00:02:10.159 --> 00:02:10.479
Okay, cool.
00:02:10.560 --> 00:02:12.319
I've insulted you twice now, Vice and Mafia.
00:02:12.400 --> 00:02:13.759
So I'm going to stick the straight and narrow.
00:02:13.840 --> 00:02:17.360
Now you are good, you are fine, upstanding people, but you are not the bad guys.
00:02:17.759 --> 00:02:18.400
You are the good guys.
00:02:18.719 --> 00:02:19.199
We protect.
00:02:19.360 --> 00:02:20.000
You do protect.
00:02:20.240 --> 00:02:27.840
So let's talk a little bit about, first of all, you're in Miami, but we're here in Riyadh, Saudi Arabia, for Black Hat Middle Eastern Africa 2025.
00:02:28.159 --> 00:02:31.280
My question to you, Margarita, first of all, is about events.
00:02:31.439 --> 00:02:32.719
You go to quite a lot of events.
00:02:32.800 --> 00:02:34.719
You're selective about the ones you go to.
00:02:34.960 --> 00:02:42.879
What separates, from your perspective, the good from the great events that are one, the ones that are worth going to, the ones that are worth going back to?
00:02:43.280 --> 00:02:43.680
Sure.
00:02:43.919 --> 00:02:50.000
So I would say Black Hat MEA has ruined it for all of us, but in a good way.
00:02:50.319 --> 00:02:52.719
This is definitely one that you want to attend.
00:02:52.800 --> 00:02:53.680
It's very different.
00:02:54.080 --> 00:03:11.360
The great events have great speakers, have great content, really have a lot of thought that's put into the quality of the information that's going to be shared and the dynamics of the personalities that are going to come together in panels and who's available from vendors and partners.
00:03:11.439 --> 00:03:15.840
And really, Black Hat has been just amazing here in Riyadh, Saudi Arabia.
00:03:15.919 --> 00:03:19.280
You have the top of the top, and you have folks from all over the world.
00:03:19.439 --> 00:03:22.639
It's truly a blend of such diverse culture and thought.
00:03:22.800 --> 00:03:23.680
It's been incredible.
00:03:23.840 --> 00:03:31.439
I mean, those events that typically you want to stay away from don't put in the amount of detail that we've seen here this week.
00:03:31.520 --> 00:03:34.479
And I'm actually very sad that it's coming to an end.
00:03:34.639 --> 00:03:37.680
Um it's gonna be very hard for me to go to any event after this.
00:03:38.319 --> 00:03:38.960
Kind words.
00:03:39.120 --> 00:03:42.000
Uh Marcos, your your perspective, again, you've been to a lot of these events.
00:03:42.159 --> 00:03:46.560
What for you is the secret source that makes you think, yeah, it's worth me getting on a plane?
00:03:46.639 --> 00:03:48.479
It's worth that effort to go there.
00:03:48.800 --> 00:04:01.439
So I'll add two things to the content piece, which is the logistics and the organization of the event, plus also but also the the curated, I guess, aspect of the content, plus also the individuals that are attending.
00:04:01.680 --> 00:04:03.199
This is now in my top three.
00:04:03.439 --> 00:04:10.000
Just like Margarita said, it is one that I will look forward to attending because every single day has been insightful.
00:04:10.080 --> 00:04:16.000
You've learned something new, you've seen a topic that maybe you have not seen before at any other conference or any other event.
00:04:16.160 --> 00:04:22.240
So those would be the three main areas that I say will definitely separates Black Hat uh Mia from all the other ones.
00:04:22.480 --> 00:04:28.240
Okay, well let's look at the substance, some of the things that have been uh discussed over the past three days or so.
00:04:28.560 --> 00:04:34.639
AI, certainly, that is the here and now, but more and more talk about quantum computing.
00:04:34.959 --> 00:04:37.120
Be prepared for quantum computing.
00:04:37.199 --> 00:04:38.399
What's your take, Mother Rita?
00:04:38.720 --> 00:04:40.240
So definitely, be prepared.
00:04:40.319 --> 00:04:46.959
Um I think it's one of the things that we see the most in our industry where our folks are more reactive rather than proactive.
00:04:47.120 --> 00:05:00.639
And even with AI, that has been around for such a long time, uh at the onset of what we're seeing now, the momentum, everything at breakneck speed, we're seeing that the security community is still somewhat trying to catch up from a security perspective.
00:05:00.800 --> 00:05:07.519
And we know quantum computing is here, it's coming, it's been gonna become more proliferal, more pervasive, just like we see AI.
00:05:07.680 --> 00:05:12.000
And we really have to be more proactive in the way that we look at that.
00:05:12.160 --> 00:05:22.240
So a lot of the sessions that we've had here throughout this week has really talked about, you know, quantum computing and how do you prepare and how do you become that forward-thinking CISO and security practitioner.
00:05:22.399 --> 00:05:24.399
So you start building in those practices.
00:05:24.560 --> 00:05:26.399
So you start thinking about the controls.
00:05:26.560 --> 00:05:29.120
So you start thinking how that relates to your organization.
00:05:29.279 --> 00:05:41.040
So I love the fact that we are being proactive in our thought process because historically we've been a very reactive type of industry where something new comes out, it disrupts, and we're trying to catch up.
00:05:41.199 --> 00:05:52.319
When we know that the threat actors, they're being very proactive in their way of how they're going to leverage and use these new groundbreaking disruptive technologies in order to affect organizations.
00:05:52.639 --> 00:05:54.800
Quantum computing does scare.
00:05:55.040 --> 00:05:56.800
Well, quantum computing doesn't scare me.
00:05:57.040 --> 00:06:00.879
The bad guys getting quantum computing does scare me.
00:06:00.959 --> 00:06:08.000
Um and Marcus looking at your world, uh, HIG, it's uh finance company,$70 billion, I think, assets under management.
00:06:08.319 --> 00:06:18.160
And one of the big threats that uh that quantum computing potentially holds is cryptography, breaking passwords in very, very simple terms.
00:06:18.319 --> 00:06:19.519
I I worry about that.
00:06:19.680 --> 00:06:23.519
Am I right to worry or am I overly concerned?
00:06:23.839 --> 00:06:26.959
You are all in all you're right to worry about it.
00:06:27.040 --> 00:06:36.800
And it's funny, and I smiled when you said uh quantum, because that is literally off of the keynote that I just came off of, the one topic or technology that we are not talking about as an industry.
00:06:36.959 --> 00:06:41.839
Um, I've spent the better part of about the last two years continuously talking about quantum.
00:06:42.079 --> 00:06:51.439
My internal team uh from security operations are working on quantum computing resistant cryptography because the world will change once quantum computing enters the private sector.
00:06:51.600 --> 00:06:52.639
Let's make no mistake about it.
00:06:52.720 --> 00:06:54.319
Nation states have access to it now.
00:06:54.480 --> 00:06:55.120
Absolutely.
00:06:55.519 --> 00:07:15.040
But when it becomes democratized and it's now available to the public, that is when we're gonna start seeing a lot of bigger problems because all of the data hoarding out of all the data breaches over the last 10 years is now gonna be data that you can read and data that becomes actionable to threat actors and also to intelligence agencies.
00:07:15.360 --> 00:07:20.879
Well, that reminds me, Margarita River, to pick up on that, of something you wrote on LinkedIn recently.
00:07:21.199 --> 00:07:28.319
You said we talk a lot about threat actors leveling up, but honestly, so are CISOs.
00:07:28.720 --> 00:07:30.240
You have no choice in this industry.
00:07:30.480 --> 00:07:38.079
I mean, as CISOs technologists in general, you have to be continuously learning, continuously growing, continuously preparing yourself.
00:07:38.399 --> 00:07:51.600
Because as I mentioned before, technology is changing quite quickly, and learning and being able to thwart attacks is going to take folks that are willing to put in the time to learn and to grow and to prepare themselves and their teams.
00:07:51.839 --> 00:07:56.560
I think one of the things that we're facing as CISOs today is the upskilling of our teams.
00:07:56.639 --> 00:08:02.399
You know, we can't approach security with 10-year-old tactics or 10-year-old approaches or mindsets.
00:08:02.639 --> 00:08:04.560
We have to continue to evolve.
00:08:04.800 --> 00:08:07.199
It's what I love the most about this industry.
00:08:07.360 --> 00:08:16.399
And you're seeing a lot of CISOs take the time to develop themselves and to develop their teams to be able to prepare for things like quantum computing and other technology.
00:08:16.879 --> 00:08:18.480
How do you prepare for quantum computing?
00:08:18.560 --> 00:08:22.319
It's a question to both of you because it is a very cutting-edge technology.
00:08:22.800 --> 00:08:27.920
CISOs cannot be expected to have in-depth knowledge of precisely how quantum computing works.
00:08:28.079 --> 00:08:29.120
I guess that's not the point.
00:08:29.279 --> 00:08:31.920
So, what resources do you use?
00:08:32.080 --> 00:08:32.799
Who do you work with?
00:08:32.960 --> 00:08:35.360
Do you work with universities, for example?
00:08:35.519 --> 00:08:37.360
Do you work with industry bodies?
00:08:37.600 --> 00:08:38.320
Question to both of you.
00:08:38.480 --> 00:08:39.919
I'd say it's a combination of all of them.
00:08:40.000 --> 00:08:46.799
Um you have to work, number one, as an organization, and you're wanting to become quantum resistant, work with your vendors.
00:08:46.960 --> 00:08:54.799
Because at the end of the day, all of all of your vendors and your service providers have implemented some level of quantum or on some level of cryptography that is not quantum resistant.
00:08:54.879 --> 00:09:00.720
So you need to upgrade all of that or all of that cryptography protocols that you utilize to become quantum resistant.
00:09:00.879 --> 00:09:14.960
But to understand quantum computing at its real fundamental level, and I agree with you, it is a very complex topic when you start talking about qubits and whatnot, definitely the research community, universities, and also your local bodies within countries.
00:09:15.039 --> 00:09:22.159
So NIST in the US, for example, has a lot of materials and a lot of resources that really lays out quantum computing in layman's terms.
00:09:22.480 --> 00:09:22.720
Correct.
00:09:22.799 --> 00:09:24.080
I completely agree with Marcos.
00:09:24.320 --> 00:09:27.759
I mean, there's a wealth of information that is out there.
00:09:27.919 --> 00:09:37.279
And obviously, the foundation of it being on encryption, having folks on your team that are well-versed and understanding that it's kind of taking that to like the next layer, the next level.
00:09:37.440 --> 00:09:42.000
So partnering definitely with network communities, with universities, with peers.
00:09:42.080 --> 00:09:51.440
I mean, coming to events like this and hearing from other thought leaders and how they're approaching things like quantum computing and how they're leveling up really does help that growth curve.
00:09:51.679 --> 00:09:52.639
How are the vendors doing?
00:09:52.720 --> 00:09:54.000
You mentioned vendors mark us.
00:09:54.399 --> 00:09:58.879
How are they doing in creating quantum resistant solutions?
00:09:59.039 --> 00:10:02.639
Can I ask you for maybe it's unfair to ask you for a uh what grade would you give them?
00:10:02.720 --> 00:10:03.200
I'm gonna ask you.
00:10:03.279 --> 00:10:05.840
You don't have to up and say, what grade would you give them?
00:10:06.720 --> 00:10:06.960
Let's ask.
00:10:07.200 --> 00:10:08.960
Okay, what grade would you give them?
00:10:11.759 --> 00:10:14.799
Probably somewhere around the D minus, to be honest with you.
00:10:15.279 --> 00:10:15.519
Wow.
00:10:16.240 --> 00:10:31.759
Um I've started asking vendors over the last eight to nine months, what quantum computing uh controls or uh tactics have you implemented within your platforms to shift the cryptography that is not too towards quantum resistant, and I get blank stairs.
00:10:32.000 --> 00:10:32.799
Wait, wait, what?
00:10:32.879 --> 00:10:35.279
Well, what's but Okay, conversation's over.
00:10:35.360 --> 00:10:36.960
If that's the first answer you give me.
00:10:37.200 --> 00:10:44.720
However, there are a few vendors, and I will not name exactly which one, that are at the forefront of quantum computing.
00:10:45.039 --> 00:10:46.639
So they've been getting an ARP report.
00:10:46.960 --> 00:10:48.559
Oh, they've been getting an A plus in my book.
00:10:48.799 --> 00:10:52.720
Okay, because they are forward-looking, forward thinking, and they're coming to me before I even ask them.
00:10:53.039 --> 00:10:53.919
I completely agree.
00:10:54.000 --> 00:10:59.440
I mean, you have some that again are very proactive, but most tend to lag behind.
00:10:59.600 --> 00:11:02.320
They don't see it as an immediate problem.
00:11:02.559 --> 00:11:08.960
There is, again, this boom around AI security and really putting in the guardrails and the observability and controls around it.
00:11:09.120 --> 00:11:13.279
Not as much focus on quantum, but those that are are doing it well.
00:11:13.600 --> 00:11:15.200
Okay, well, let me flip the question around.
00:11:15.360 --> 00:11:15.519
Sure.
00:11:15.840 --> 00:11:26.159
When you go to your chief finance officers and ask for budget to be signed off to pay for this, let's take your A plus uh vendor, who you're not gonna name, but fair enough.
00:11:26.240 --> 00:11:29.279
Uh I'm sure they charge a significant fee for what for what they do.
00:11:29.360 --> 00:11:29.919
They're very good at it.
00:11:30.080 --> 00:11:31.200
If I can name them, I will name them.
00:11:31.360 --> 00:11:35.360
Not sure if we can or cannot, um, but they are definitely A plus in my book.
00:11:35.440 --> 00:11:36.399
But pilot, sorry.
00:11:36.639 --> 00:11:45.440
But they will charge a fee for that, and you've got to go to the you and people like you have got to go to the finance department, the CFO, and say, okay, we've got to be quantum resistant.
00:11:45.519 --> 00:11:49.759
It's not here yet, but it's there in the future, and it's gonna cost X million dollars.
00:11:49.919 --> 00:11:53.039
And the CFO goes, but this is a theoretical threat.
00:11:53.120 --> 00:11:56.159
It's not really the bad guys haven't got this now.
00:11:56.559 --> 00:11:59.440
Do I really need to spend this money now, Marcos?
00:11:59.600 --> 00:12:01.279
Are you sure you'd sign off on this?
00:12:01.600 --> 00:12:08.159
Yes, because I'm sorry, this A plus vendor is coming to me with the evidence that I'm taking to my CFO showing here's why you need to do this stuff.
00:12:08.480 --> 00:12:09.679
This is not theoretical anymore.
00:12:10.080 --> 00:12:10.720
This is happening.
00:12:11.120 --> 00:12:17.360
It's just it's so expensive to be able to utilize quantum computing that it's not available to the masses.
00:12:18.159 --> 00:12:18.879
That's the problem.
00:12:19.519 --> 00:12:20.960
Let's talk about some other things.
00:12:21.279 --> 00:12:26.399
Leadership shift from compliance to culture was an interesting piece I read by you, Marcos, on LinkedIn.
00:12:26.559 --> 00:12:36.559
You said there needs to be a leadership uh shift within your industry, within CSERs and and others part of the ecosystem, from compliance to culture.
00:12:36.720 --> 00:12:38.559
What do you mean by that and why is it important?
00:12:39.279 --> 00:12:42.960
So compliance has always been a check the box exercise.
00:12:43.440 --> 00:12:48.399
I need to have XYZ, so I need to buy ABC that's gonna take care of XYZ.
00:12:48.960 --> 00:12:50.399
That does not make us secure.
00:12:50.720 --> 00:13:04.960
At the end of the day, risk is a moving target, risk is ever evolving, risk is something that is not it's not something you can uh find a solution for by just buying XYZ or whatnot.
00:13:05.440 --> 00:13:08.879
That is what um compliance really takes you towards.
00:13:09.039 --> 00:13:20.159
So when you shift toward culture, where everyone is in a risk mindset within your organization, then that's when you start moving away from compliance and to a cultural risk shift.
00:13:20.399 --> 00:13:24.559
So now risk becomes something that's at the forefront of all your individuals.
00:13:24.799 --> 00:13:28.720
I say that I have the largest organ or the largest department in the entire organization.
00:13:28.960 --> 00:13:30.639
Every single employee works for me.
00:13:30.799 --> 00:13:33.919
And I get upstairs and looks like what are you talking about?
00:13:34.080 --> 00:13:37.120
Yeah, every single employee is a human firewall for me.
00:13:37.279 --> 00:13:45.360
Every single employee is at the front lines of all of the emails that come in, all of the messages, all of the potential cyber risks that they can be dealing with.
00:13:45.679 --> 00:13:52.720
So when you shift your culture toward having cyber risk at the forefront, you become much stronger as an organization.
00:13:53.200 --> 00:13:56.159
You guys know each other well through the Miami community.
00:13:56.240 --> 00:13:58.399
And I'm wondering if very different industries.
00:13:58.639 --> 00:14:03.759
The hospitality industry with Carnival, the financial services industry with HIG, very different.
00:14:04.000 --> 00:14:08.559
What are the differences and what are the similarities in what you do, would you say?
00:14:08.960 --> 00:14:12.879
So I always say that from a cybersecurity perspective, we're not quite that different.
00:14:13.120 --> 00:14:18.080
I mean, when you look behind everything, what we're trying to do is very similar.
00:14:18.240 --> 00:14:19.600
Our foundations are similar.
00:14:19.759 --> 00:14:28.480
You know, we're all having to tackle identity, we're having to tackle observability, we're having to tackle security operations, engineering, architecture, artificial intelligence.
00:14:28.559 --> 00:14:29.519
That's all the same.
00:14:29.759 --> 00:14:33.679
I think that we have to get a little bit more creative, depending on your industry.
00:14:33.840 --> 00:14:36.559
I mean, you're in a very regulated industry, financial services.
00:14:36.799 --> 00:14:40.639
My first decade of my career was in financial services, so it's very near and dear to my heart.
00:14:40.799 --> 00:14:46.960
But I'm in hospitality where people want to have fun, and security can be seen as a blocker to fun.
00:14:47.120 --> 00:14:56.639
So I have to be incredibly creative in terms of the approach that I have with cybersecurity within my organization, especially because I am essentially securing floating cities.
00:14:56.720 --> 00:15:08.879
I mean, I have 94 floating cities across the globe, and we are tackling all kinds of different things from restaurants to hotels to medical to the operational technology.
00:15:09.120 --> 00:15:10.960
That's where the differences I think come in.
00:15:11.039 --> 00:15:11.840
What are your thoughts?
00:15:12.159 --> 00:15:12.559
Agreed.
00:15:12.720 --> 00:15:17.279
We all have the same base level of threats and risks that we need to address.
00:15:17.440 --> 00:15:19.840
It's no different across any other industry.
00:15:20.080 --> 00:15:24.639
Then as you go up that ladder, then it becomes a bit more specialized in each area.
00:15:24.799 --> 00:15:26.639
Margarita has ships she has to secure.
00:15:26.720 --> 00:15:28.799
I have portfolio companies that I need to secure.
00:15:28.879 --> 00:15:31.200
And these portfolio companies can be in any industry.
00:15:31.360 --> 00:15:32.559
You name it, we own it.
00:15:32.799 --> 00:15:38.559
But it's interesting to go back to your point, Marcus, about everybody in the organization works for me.
00:15:38.879 --> 00:15:42.960
Given what you are at HIG, I would imagine a relatively small workforce.
00:15:43.120 --> 00:15:47.919
That's typically the case with alternative asset managers, which which I think I'm right in describing you as.
00:15:48.399 --> 00:15:59.360
However, with carnival hospitality industry, you've got massive workforces, and we often hear the cliche, or journalists like me use the cliche, humans are the weakest link in any security chain.
00:15:59.519 --> 00:16:02.879
You've just got different HR issues there, I guess.
00:16:03.279 --> 00:16:04.000
Absolutely.
00:16:04.159 --> 00:16:10.720
I mean, it's definitely a different approach and a different driver, but nonetheless equally as important.
00:16:10.879 --> 00:16:14.799
So humans can be the weakest link, humans can be your greatest asset.
00:16:14.960 --> 00:16:26.960
It really all depends on the job that we're doing, you know, with our teams, to provide security awareness, to make everybody understand their responsibility and making that culture pervasive throughout everything that we do.
00:16:27.279 --> 00:16:31.759
Finally, before we wrap up, let me ask you about the role of women in this industry.
00:16:31.919 --> 00:16:46.320
I've been lucky here at Black Hat Middle Eastern Africa 2025 to meet a number of very powerful women in very senior CISO positions, where whether here in Saudi Arabia or in Europe or in the United States, and there's there's yourself as well.
00:16:46.480 --> 00:16:52.480
And perhaps that's giving me a false impression that women play a very prominent role in this industry.
00:16:52.879 --> 00:16:57.200
You say it's about 22-0%, Margarita.
00:16:57.519 --> 00:16:58.080
That's correct.
00:16:58.320 --> 00:17:07.039
So what I love about being here at Black Hat is definitely being able to see all my women peers, very strong executives in the cyberspace.
00:17:07.200 --> 00:17:11.200
I remember when I started 22 years ago, uh, I was the only woman in a room.
00:17:11.359 --> 00:17:13.039
And now to see much more is great.
00:17:13.200 --> 00:17:14.640
But it's nowhere near where it needs to be.
00:17:14.720 --> 00:17:19.920
You know, in the US, the workforce really is split 50-50 between male and female.
00:17:20.079 --> 00:17:22.960
And in technology and in cyber, that's about 20%.
00:17:23.599 --> 00:17:28.480
That's nowhere near where we need to be from a technology perspective or from a cyber perspective.
00:17:28.720 --> 00:17:38.400
So it's very encouraging to come here and see uh everything that's being done in order to really help extend information and knowledge and growth to other women.
00:17:38.480 --> 00:17:43.440
Uh, the first thing I did when I got here uh the other day was go to the women in Saudi Arabia group.
00:17:43.519 --> 00:17:48.400
I was so proud to spend time talking to those women that are growing and really helping get the word out.
00:17:48.559 --> 00:17:52.400
And they're really helping to grow an industry that needs more women in it.
00:17:52.480 --> 00:17:53.200
That's the reality.
00:17:53.359 --> 00:17:55.359
Women think differently, they function differently.
00:17:55.519 --> 00:17:58.640
Marcos and I were actually talking about that during our drive yesterday.
00:17:58.960 --> 00:18:06.400
There's so much value to that cognitive difference because we are built different and it complements our male counterparts.
00:18:06.720 --> 00:18:08.240
Marcos, you're nodding.
00:18:08.480 --> 00:18:11.440
It is unfortunately a male-dominated industry.
00:18:11.680 --> 00:18:15.680
And um, it cannot stay a male-dominated industry if we want to keep evolving.
00:18:15.759 --> 00:18:37.839
To Margarita's point, the diversity and even really the neurodiversity, because women do think differently and do see things things from a different mindset versus males, brings a lot of enhancements to the field that can very much help keep us, not just keep pace, but really push us forward to evolving as threats continue evolving, and that all at the end of the day puts us in a good place.
00:18:38.079 --> 00:18:44.000
So, Marcos, your your one line to summarize Black Hat MEA here in Riyadh 2025.
00:18:44.319 --> 00:18:52.559
One line that summarizes Black Hat MEA Saudi Arabia 2025 will be innovative and refreshing.
00:18:52.799 --> 00:18:54.000
Why do you say that?
00:18:54.319 --> 00:19:06.480
Innovative because of the level of caliber of individuals and content, but refreshing because it's not the same content and the same caliber of the other conferences we're used to attending.
00:19:06.640 --> 00:19:07.680
This is much better.
00:19:14.480 --> 00:19:23.680
So one line to really summarize Black Hat MAA here in Saudi Arabia is definitely collaboration, forward thinking, and innovation.
00:19:24.000 --> 00:19:24.799
Why do you say that?
00:19:25.119 --> 00:19:31.680
It brought together so many folks from all over the world to work together, to think together, to plan together, and that's incredible.
00:19:31.839 --> 00:19:41.440
That's really where you get true innovation, is where you have diverse ways of thinking coming together in one place and really being able to collaborate together holistically.
00:19:41.759 --> 00:19:43.279
We are gonna wrap this up now.
00:19:43.359 --> 00:19:47.119
We're speaking here in Saudi Arabia, Riyadh, December 2025.
00:19:47.279 --> 00:19:51.359
We're recording this at the conclusion of Black Hat Middle East and Africa for 2025.
00:19:51.519 --> 00:19:54.480
Crystal balls 2026, 30 seconds, each of you.
00:19:54.640 --> 00:19:57.920
What's gonna keep you busiest in 2026, Margarita first?
00:19:58.319 --> 00:20:00.559
Uh definitely genetic AI security.
00:20:00.720 --> 00:20:02.880
I think we're gonna see a lot more proliferation.
00:20:02.960 --> 00:20:05.839
And preparedness for quantum computing is definitely on the docket.
00:20:06.160 --> 00:20:07.039
Marcus, same question.
00:20:07.279 --> 00:20:18.799
So, same answer, just flipped quantum computing first, because we've already initiated that project, but then also trying to hoard all of the AI folks in the organization that just want to run off with AI because it's gonna solve all the world's problems.
00:20:19.119 --> 00:20:21.519
It's been an absolute pleasure talking to both of you.
00:20:21.680 --> 00:20:25.920
Thank you very much indeed for bringing a little piece of Miami to read in Saudi Arabia this week.
00:20:26.079 --> 00:20:32.400
My thanks to, first of all, Margarita Rivera, Global Chief Information Security Officer at Carnival Corporation.
00:20:32.480 --> 00:20:33.039
Thank you.
00:20:33.279 --> 00:20:37.839
And to Marcos Morero, Chief Information Security Officer, H I G Capital.
00:20:38.000 --> 00:20:38.559
Thanks for your time.
00:20:38.720 --> 00:20:38.960
Thank you.
00:20:39.359 --> 00:20:40.240
Or should I say gracias?
00:20:40.559 --> 00:20:41.039
Gracias.
00:20:42.240 --> 00:20:45.599
That is it for this edition of the Black Hat Files.
00:20:45.680 --> 00:20:46.720
We will be back with more.
00:20:46.799 --> 00:20:48.160
Thanks for joining us.
