WEBVTT
00:00:04.480 -->
00:00:09.919Welcome to Cross Examining Cyber, a podcast brought to you by Herbert Smith Freehills Kramer.
00:00:10.240 -->
00:00:21.120In this podcast series, we speak to our business leaders about all things cyber, including the legal, governance, technical, regulatory, and policy developments that impact corporates around the world.
00:00:21.359 -->
00:00:28.800In this episode, we continue our director series with part two of our cross-examination of Catherine Brenner and John Mullen.
00:00:29.039 -->
00:00:31.600In our last episode, we left you on a cliffhanger.
00:00:31.760 -->
00:00:33.520We now pick up where we left off.
00:00:33.679 -->
00:00:46.719We also discussed the value in good communications, the human factor and cyber incident response, a values-led approach, as compared with a compliance-led approach, AI, of course, and board simulations.
00:00:46.960 -->
00:00:54.560This is cross-examining cyber as part of our director series, the cross-examination of Catherine Brenner and John Mullen, part two.
00:00:54.960 -->
00:00:56.000Here we go.
00:01:01.039 -->
00:01:22.000You touched on this, John, the suggestion that the lessons that you learn from these incidents may not be what you do in that immediate response, but when you look back on both of you, the incidents you've been involved with, whether it's directly or on the periphery, or even the exercises you've run as organisations, because they can elicit great learnings too.
00:01:22.159 -->
00:01:22.400Yeah.
00:01:22.640 -->
00:01:23.519What have you learned?
00:01:23.680 -->
00:01:29.439What what what would be your sort of top one, two or three lessons from dealing with the cyber crisis?
00:01:29.760 -->
00:01:45.359In many ways, it's the same as dealing with any crisis, that the problem's never as you first think it is or as it's first presented to you, and that you will be working in an environment that's dynamic with incomplete information, with stressed individuals.
00:01:45.519 -->
00:01:45.840Yeah.
00:01:46.159 -->
00:01:53.840Not the exact team that if you planned it would be there, you know, someone will be on holidays, someone will be uncontactable, all of those sorts of things.
00:01:54.000 -->
00:02:05.359So having pre-agreed processes and structures and having built a bit of that muscle of working under stress through whether it's simulations or whatever, I think one of the key things I've learned.
00:02:06.000 -->
00:02:09.919I think that communications is just absolutely critical.
00:02:10.240 -->
00:02:19.120The technical problem may be manageable, but how it's communicated, the narrative internally, externally, with regulators, stakeholders, yeah, there's a long list.
00:02:19.759 -->
00:02:26.240Because I've seen organizations manage an incident technically, but have lost control of the narrative.
00:02:26.479 -->
00:02:26.639Yes.
00:02:26.960 -->
00:02:28.639And that's been much more damaging.
00:02:29.039 -->
00:02:29.360Absolutely.
00:02:29.599 -->
00:02:39.599I think the other bit, and we've touched on this in the conversation already, is you have a business to run, you have people who depend on you, you need to keep safe, etc.
00:02:40.159 -->
00:02:43.919And thinking about that, and sometimes it might mean you have parallel teams.
00:02:44.000 -->
00:02:47.199These are running the business day to day, and these are dealing with the incident.
00:02:47.520 -->
00:02:53.759But having done the preparation to say this is how we're going to run it is, I think, really critically important.
00:02:54.400 -->
00:02:57.360How the chair and the CEO are going to communicate, all of that sort of stuff.
00:02:57.520 -->
00:03:01.439So pre-planning, having done a bit of practice and put a bit of pre-thought into it.
00:03:01.759 -->
00:03:03.759Yeah, Eisenhower, a plan does nothing without planning.
00:03:04.639 -->
00:03:06.960So that's uh so true.
00:03:07.520 -->
00:03:10.479I I agree word for word with with what Catherine said.
00:03:10.719 -->
00:03:16.719Communication one is actually very difficult because you've got two opposing pressures.
00:03:17.039 -->
00:03:21.680On the one side, you're under pressure to communicate as quickly and early as fulsomely as you can.
00:03:21.840 -->
00:03:30.639But at the same time, quite often you don't actually know what's happened or the extent of it, and therefore you risk going too early and saying, don't worry about that, but it's okay.
00:03:30.879 -->
00:03:32.479And then suddenly, no, it's not okay.
00:03:32.639 -->
00:03:34.319And then you have to go back out again.
00:03:34.479 -->
00:03:39.520And I think that's one of the most difficult decisions that companies have to make when they're hit with these things.
00:03:40.240 -->
00:03:46.400You obviously by definition want to go as fast and as hard as you can on communication, but be very careful you get the right message.
00:03:47.360 -->
00:03:52.479Another interesting dynamic, I think, is you sort of crises really sort humans out.
00:03:52.639 -->
00:03:56.960You know, some CEOs and and board members panic.
00:03:57.039 -->
00:04:08.319They go, hey, well whereas some actually rise sort of Winston Churchill like into the challenge, and that's motivating and keeps people working the weekend and late hours still working on it, you know.
00:04:08.400 -->
00:04:11.360That that leadership thing really comes to the fore in a crisis.
00:04:12.080 -->
00:04:12.960I completely agree.
00:04:13.039 -->
00:04:25.279That good crisis management or governance or whatever you want to call it, I think it's as much a test of character as it is of process and the human factor is um really significant.
00:04:25.680 -->
00:04:36.560And maybe that's one of the first questions for the board, really, when they get presented with this is unfolding, it's have we got the right people, support, capacity, capability to manage through this.
00:04:36.879 -->
00:04:38.079Yeah, and part of it Would that be fair?
00:04:38.319 -->
00:04:49.279Yeah, and part of that includes you know having people on your board who have been through a crisis before and that know themselves and that the chair knows will rise to the occasion.
00:04:49.439 -->
00:04:51.040And that's where subcommittees are all too.
00:04:51.360 -->
00:04:51.759Yeah, absolutely.
00:04:52.639 -->
00:04:57.839The thing, it'll be able to tell the director we're gonna have a board meeting every single night for the next week.
00:04:58.560 -->
00:05:00.879Oh well, sorry, it's three o'clock in the morning in the US.
00:05:00.959 -->
00:05:01.519Well, I don't care.
00:05:01.600 -->
00:05:02.959That c it comes with the territory.
00:05:03.279 -->
00:05:06.639But get some extra coffee and we are gonna have that meeting.
00:05:06.720 -->
00:05:11.680And you see how many people rise to that, and and not most do, but a few don't.
00:05:11.920 -->
00:05:12.000Yes.
00:05:12.240 -->
00:05:13.360And that's very disappointing.
00:05:13.920 -->
00:05:15.439It's remarkable, isn't it, human nature?
00:05:15.680 -->
00:05:20.240You never really quite know how someone's going to react until the blowtorch is applied.
00:05:20.399 -->
00:05:28.800And because we work on so many of these, I regret, that we've seen people break in a way which the most unexpected people break.
00:05:29.040 -->
00:05:31.920And I understand the mental strain.
00:05:32.160 -->
00:05:44.639We're blessed because we see so many that we hope that one of the biggest contributions that we can make, positive contributions, is that we can actually bring a calm to the room and put a bit of perspective around this, particularly for those individuals that might struggle.
00:05:44.720 -->
00:05:48.959But you're absolutely right people and sometimes the most unexpected people will crack.
00:05:49.279 -->
00:06:03.600If you're clear on your values and everyone acts consistently with it, it makes such a difference, whether it's the way our team at Centre Group responded to the unprovoked attack at Bondi, uh Westfield Bondi, through to when I've seen cyber attacks.
00:06:03.839 -->
00:06:11.199If you're very clear on your values and on your customer and your community, you can actually navigate most decisions.
00:06:11.519 -->
00:06:11.680Yeah.
00:06:12.639 -->
00:06:13.920We're all human beings underneath, aren't we?
00:06:14.240 -->
00:06:17.120You know, we've got a job title and a role today, but we're all humans.
00:06:17.680 -->
00:06:29.680I extend that to our third-party ecosystem because when a cyber incident or a crisis occurs, you want all your friends around you at that point in time and isolating.
00:06:29.920 -->
00:06:34.160And we've certainly been in circumstances where the knee-jerk reaction is who's responsible.
00:06:34.399 -->
00:06:44.319And you get that in some organizations where there is a knee-jerk reaction to not allocate blame, but find who was responsible and what should we be doing about those.
00:06:44.480 -->
00:06:49.439And that is at a point in time when you need them more than 100% ever before.
00:06:50.399 -->
00:06:56.480You might remember a while ago there was an ASIC proposal that uh companies and directors be held personally liable for all this sort of stuff.
00:06:56.879 -->
00:06:56.959Yes.
00:06:57.199 -->
00:06:58.399It's the worst thing you could do.
00:06:59.199 -->
00:07:02.240You actually want complete transparency of what happens.
00:07:02.560 -->
00:07:04.000Everybody else can learn by it.
00:07:04.160 -->
00:07:13.680You want, notwithstanding competition laws, you want to share with others in your industry if if the attack was specific to your type of industry, share that information with the others.
00:07:14.560 -->
00:07:19.279Yeah, this this reaction of allocating blame and everything is totally the wrong way to do it.
00:07:19.759 -->
00:07:20.079100%.
00:07:20.480 -->
00:07:28.480Because so often a cyber incident can turn into uh a physical security issue, a product contamination issue, whatever it might be.
00:07:28.720 -->
00:07:42.560And we're, in fact, my organizations are doing simulations that involve our partners because probably from the very beginning there are other parties involved, whether it's you know, whatever they might be, and you know, it could be a you know the technology stack that you've got.
00:07:42.639 -->
00:07:43.040Yeah, of course.
00:07:43.120 -->
00:07:43.360Yeah.
00:07:43.600 -->
00:07:52.800And so doing those exercises with government, with customers, etc., everyone learns something and the learnings have been really valuable.
00:07:52.879 -->
00:07:57.360And everyone gets to know each other a bit better as well, which is really important if you do find yourself in a crisis.
00:07:57.680 -->
00:07:58.879Yeah, nice community.
00:07:59.120 -->
00:08:04.720You could not have missed the AFR articles around AI accelerating at this pace.
00:08:04.879 -->
00:08:08.319It just takes a couple of headlines in the AFR and my phone goes off the hook.
00:08:08.480 -->
00:08:08.639Yeah.
00:08:08.800 -->
00:08:13.839What are you thinking about at the moment in relation to things like what's happening with anthropic and the like?
00:08:14.000 -->
00:08:20.879I'm not going to ask you to have understood everything that's going on, but just that sheer pace of change now.
00:08:21.439 -->
00:08:24.399Well, the mythos thing is fascinating.
00:08:24.639 -->
00:08:31.199So you couldn't think of a better marketing approach, basically, than to say I've got something so powerful I can't actually tell you what it is.
00:08:31.439 -->
00:08:35.759What we can't avoid is that even if it isn't as powerful as it is, it will be soon.
00:08:35.919 -->
00:08:43.039And and so will other ones even before you get to quantum computing, which I don't even understand, but the risk goes through the roof again.
00:08:43.279 -->
00:08:44.080Yes, yes, you know.
00:08:44.240 -->
00:08:54.080So I I think for for boards, trying to keep on top of of that as best you can and manage change like what we agree this week, maybe irrelevant by next week, not next year.
00:08:54.480 -->
00:08:59.039Yeah, cyber AI tools are scaling incredibly fast.
00:08:59.279 -->
00:09:08.879And you know, so the risk is not stable and the threat profile six months, one month, whatever it might be, will be dramatically different to what it is today.
00:09:09.120 -->
00:09:14.960And so I think it isn't about what static controls we have, but how are we learning, how are we adapting.
00:09:15.200 -->
00:09:19.840AI governance and cyber governance are not separate topics, they're related.
00:09:20.240 -->
00:09:25.840The AI that your company is creating to do other things creates a new attack surface.
00:09:26.000 -->
00:09:26.399Yeah, of course.
00:09:26.639 -->
00:09:31.759The AI that's being deployed is attacking your people, so we can have the best systems in the world.
00:09:32.080 -->
00:09:39.840But the way our people are trained and behave, often with good intent, that's always going to be a vulnerability.
00:09:40.399 -->
00:09:41.600It's usual personal behaviour, isn't it?
00:09:41.840 -->
00:09:42.000Indeed.
00:09:42.159 -->
00:09:43.360It's not a personality.
00:09:43.440 -->
00:09:44.320So we need to make a mistake.
00:09:44.639 -->
00:09:48.480So it's not just a technology risk, it's a broader cultural risk.
00:09:48.639 -->
00:09:57.440And so alive to the risk of change and making sure that our, whether it's our governance processes or the way we think about things, are dynamic.
00:09:58.159 -->
00:10:06.559And I think what's changed as well, and I struggle with a lot, and I'm sure my colleagues do, is is our increasing dependence on sort of global platforms.
00:10:06.720 -->
00:10:10.720You know, whether it's a kind of everyone's got data in the cloud today.
00:10:11.120 -->
00:10:15.360It's only a few years ago that everything was in a box in the basement of Parsley Street.
00:10:16.240 -->
00:10:17.200And it was that was it.
00:10:17.360 -->
00:10:17.440Yeah.
00:10:17.679 -->
00:10:26.960Whereas now we depend on all of these sales force and all these other things, and you've got very little ability to really influence the way those are engineered.
00:10:27.279 -->
00:10:27.600That's right.
00:10:27.840 -->
00:10:28.799But you're dependent on them.
00:10:28.960 -->
00:10:29.120Yeah.
00:10:29.440 -->
00:10:35.440I'm slightly hopeful that we're going to get a because at at the moment, I'm going to be a your lawyer for a moment.
00:10:35.759 -->
00:10:46.159The whole liability pyramids inverse, where somehow you are responsible for picking up on all the patches and the vulnerabilities that exist in a supplier.
00:10:46.639 -->
00:10:56.240And look, there's a pretty robust discussion going on globally around how those providers need to take more accountability for that sort of stuff, not just push it down.
00:10:56.480 -->
00:11:01.759And then secondly, you both run organizations with strong governance structures.
00:11:03.039 -->
00:11:04.080I know for a fact.
00:11:04.480 -->
00:11:13.759And so I look at this new these new technologies and I just say simply apply those same principles that you apply for any new risk or any new technology.
00:11:13.919 -->
00:11:23.840Understand that this thing's moving at pace, but with those governance structures that you've got in place, that will put you in a strong position to have fulfilled your obligations as a director and as a board.
00:11:24.000 -->
00:11:31.840And so when I get a chance to get in front of a board, it's be kind of not even alarmed, be aware, but don't be alarmed.
00:11:32.159 -->
00:11:36.639Use the principles that you use when you deal with any new issue that arises.
00:11:36.799 -->
00:11:43.759Those foundational technology neutral components of your business or your structure will put you in a very strong position.
00:11:44.799 -->
00:11:46.320We do a lot of cyber simulations.
00:11:46.480 -->
00:11:46.639Yeah.
00:11:46.879 -->
00:11:49.120Simulations come in many shapes and sizes.
00:11:49.360 -->
00:11:54.080We can test our IT teams, our crisis management teams, and test our boards.
00:11:54.320 -->
00:11:56.639They're as broad as your imagination, really.
00:11:57.039 -->
00:12:00.000There's a cottage industry that's developed around this sort of stuff.
00:12:00.080 -->
00:12:07.360There's consultants from the front of our door at Pitt Street all the way down to Custom House Key with an offer for you if you'd like one.
00:12:08.000 -->
00:12:11.600What makes a good simulation at a board level?
00:12:11.759 -->
00:12:14.000And it doesn't maybe simulation is the wrong word.
00:12:14.240 -->
00:12:18.639What makes a good exercise around this type of threat at a board level?
00:12:18.799 -->
00:12:19.360Do you believe?
00:12:19.440 -->
00:12:19.840Catherine.
00:12:20.399 -->
00:12:25.360I think where you do feel a bit uncomfortable, where it does put a bit of stress into the system.
00:12:25.759 -->
00:12:30.320We've touched on a number of the things that make it successful in this conversation, you know, have it.
00:12:30.639 -->
00:12:34.639And really testing whether the board is going to help or hinder, I think is one of the key things.
00:12:34.879 -->
00:12:37.519And getting the processes and structures right.
00:12:38.000 -->
00:12:43.200But I think the other bit that makes a simulation really good and effective is the debrief.
00:12:43.519 -->
00:12:43.679Yes.
00:12:44.080 -->
00:12:49.919Not what went, well, great job, everyone, but where did we hesitate when we shouldn't have?
00:12:50.320 -->
00:12:51.840Where did we move too fast?
00:12:52.080 -->
00:12:53.840What assumptions do we tend to make?
00:12:54.240 -->
00:12:55.759The debrief should be uncomfortable.
00:12:56.159 -->
00:12:56.399Yes.
00:12:56.480 -->
00:12:56.720Yeah.
00:12:56.960 -->
00:12:58.320Yep, I I agree.
00:12:58.639 -->
00:13:04.480It's actually very hard to create the same ambiance in a practice as it is in reality.
00:13:04.720 -->
00:13:06.960So the best possible training is to go through it.
00:13:07.120 -->
00:13:07.279Yeah.
00:13:07.759 -->
00:13:09.440And then you remember clearly.
00:13:10.000 -->
00:13:17.200I certainly found in the briefings and things that we've done, all the simulations we've done, that's a sort of one-hour high-level session doesn't really help very much.
00:13:17.360 -->
00:13:24.960What does help, I think, is firstly a a drill down into those little details you don't think are important, like literally the callage there.
00:13:25.039 -->
00:13:28.159You know, what is John's home number or phone mobile number?
00:13:28.480 -->
00:13:31.759If we need to ring him on on a Sunday night at midnight.
00:13:32.080 -->
00:13:40.399And you'd be surprised how many people think they've got that, but when you really actually read it, oh yeah, we meant to update that last time, but so and so's left now, and you know, that sort of thing.
00:13:40.639 -->
00:13:42.159I think just that level of detail.
00:13:42.240 -->
00:13:46.879But then if what I found very helpful is is sort of real life simulation.
00:13:46.960 -->
00:13:52.480So had it done by not by the company concerned, but by you know some of the organizations you've mentioned.
00:13:52.720 -->
00:13:55.279But organizations have allowed them to use real data.
00:13:55.440 -->
00:13:55.600Yes.
00:13:56.000 -->
00:13:58.799So say, this is what the board was presented with.
00:13:58.960 -->
00:14:01.600This is the decision they made and why they made it.
00:14:01.759 -->
00:14:05.440In retrospect, it proved to be right or wrong, but why was that?
00:14:05.519 -->
00:14:09.759And then get the whole board debating, yeah, what would I have done if I'd been in that situation?
00:14:10.000 -->
00:14:14.240And that leads all the way through to a real example of what happened to that company as a result.
00:14:14.559 -->
00:14:15.919I find that very helpful.
00:14:16.080 -->
00:14:21.840I've learned a lot much more than from that than just sort of listening to our own team rehearse their plans.
00:14:22.080 -->
00:14:22.320Yes.
00:14:22.559 -->
00:14:22.799Yeah.
00:14:22.960 -->
00:14:23.279Yeah.
00:14:23.519 -->
00:14:41.840Testing those areas where there might be disagreement or uh discomfort, I guess, on are there individuals who in that sort of situation default to who's to blame or start questioning management's capability or confidence right at the very moment when management needs support.
00:14:41.919 -->
00:14:44.240You know, those conversations need to happen beforehand.
00:14:44.399 -->
00:14:44.559Yep.
00:14:44.799 -->
00:14:56.559Even who's going to be on a subcommittee, you know, to get people around the world who have lots of other things going on available at a time that meets the demands of the crisis is important.
00:14:56.960 -->
00:15:01.360And agreeing that beforehand rather than trying to work it out at 11 o'clock on a Sunday night.
00:15:01.519 -->
00:15:01.759Yeah.
00:15:01.840 -->
00:15:02.000Yeah.
00:15:02.639 -->
00:15:07.440There's a bit of hygiene that like in the same camp as the phone number basis.
00:15:07.600 -->
00:15:07.679Yeah.
00:15:08.080 -->
00:15:10.399And there's no reason why we can't decide those things now.
00:15:10.720 -->
00:15:11.039Exactly.
00:15:11.600 -->
00:15:16.240None of those, none of the things that we just talked about require you to have gone through or go through something.
00:15:16.639 -->
00:15:19.200And it happens with pay or don't pay decisions too, by the way.
00:15:19.440 -->
00:15:27.679The last thing I want to see is a board sort of debating the ethical conundrum of a payment when there's time is ticking.
00:15:27.759 -->
00:15:27.840Yeah.
00:15:28.000 -->
00:15:30.399They're there to act in the best interest of the company.
00:15:30.559 -->
00:15:37.519And that sometimes, even with very experienced directors, can be a confronting thing to have to lean into.
00:15:37.919 -->
00:15:49.759Having us, having none of us went through business school or law school or university and got taught how do we negotiate with a Russian-speaking thread actor or even a teenager or a teenager sitting in a basement, mum's basement, you know.
00:15:50.399 -->
00:15:50.799Absolutely.
00:15:51.120 -->
00:15:53.039Yeah, and it's conflicts is another one.
00:15:53.120 -->
00:15:57.840And I know we spent a lot of time trying to, you know, what is our process and protocol?
00:15:58.000 -->
00:16:10.639So rather than in a crisis, if we hadn't sorted through some of those things as to what constitutes a conflict, or that even if someone does have a conflict, how are we going to manage that throughout and just having a process?
00:16:10.879 -->
00:16:11.200Yes.
00:16:11.440 -->
00:16:13.120It was a couple of hours well spent.
00:16:13.360 -->
00:16:13.519Yeah.
00:16:14.080 -->
00:16:14.320Yeah.
00:16:14.399 -->
00:16:14.639Yeah.
00:16:15.039 -->
00:16:20.000Final question, and this is the one where I've uh either keep my job or lose my job.
00:16:20.639 -->
00:16:21.759Help me help me pick up.
00:16:21.919 -->
00:16:23.120What is the envelope that is?
00:16:24.320 -->
00:16:38.480Look, we take enormous pride as a firm to provide excellent legal advice, but we also take great pride in helping companies in a crisis in a way where we don't become an impediment to the delivery of what can be significant.
00:16:39.200 -->
00:16:40.879You know, we have to move quickly.
00:16:41.279 -->
00:16:42.879Communications must be made.
00:16:43.039 -->
00:16:46.399And we take a very practical approach to things like legal professional privilege.
00:16:46.480 -->
00:16:53.919But we've seen lawyers become impediments and not be the grease in the wheels that they need to be during an incident.
00:16:54.000 -->
00:17:00.879Now I may have answered my own question actually, but what do you think makes a good lawyer in a crisis?
00:17:01.840 -->
00:17:02.399Yeah.
00:17:02.879 -->
00:17:13.920Well, I've worked with many lawyers in crises, and I when I think about what quality separates the good from the exceptional, um, not really the legal knowledge, that's table stakes.
00:17:14.240 -->
00:17:21.359You know, the like that you know they understand notification requirements and the acts and what triggers what and sequencing and all of that sort of stuff.
00:17:21.759 -->
00:17:41.680Best lawyers in a crisis understand that there's legal advice and there's strategic advice and that they can give you a view rather than just throw lots of problems at you, can help you understand the bookends and work on the trade-offs that you make, given that there will be imprecise, dynamic, incomplete information.
00:17:42.240 -->
00:17:47.039You need someone who can actually help you paint that and be help you be the grease, I guess.
00:17:47.279 -->
00:17:47.440Yes.
00:17:47.759 -->
00:17:54.720I think also that they understand the human and commercial reality and what's happening in the room as well.
00:17:54.880 -->
00:17:55.200Yes.
00:17:55.519 -->
00:18:02.160The fatigue, the communication issues, the personal stress, all the various stakeholders, etc.
00:18:02.799 -->
00:18:19.359And without diminishing the importance of privilege or class actions or something like that, that they understand that the organization needs to survive as a functioning entity rather than optimising for what might happen if the CISO is in the box and a class action in in ten years' time.
00:18:20.480 -->
00:18:25.599So all of those sorts of factors are what really makes an exceptional legal partner.
00:18:26.000 -->
00:18:26.559Yeah, correct.
00:18:26.880 -->
00:18:28.880Not the risk of violently agreeing yet again.
00:18:29.920 -->
00:18:30.960I do agree with that.
00:18:31.200 -->
00:18:33.279Maybe just a couple of other reflections.
00:18:33.440 -->
00:18:37.359Yeah, one, I think an outstanding lawyer is an outstanding lawyer full stop, usually.
00:18:37.599 -->
00:18:43.759The ones that I trust in your industry and your company particularly is fantastic advice through thick and thin crisis and non-crisis.
00:18:44.079 -->
00:18:44.240Yeah.
00:18:44.480 -->
00:18:45.759That usually is the case.
00:18:46.000 -->
00:18:52.480I think where you can add a particular value, the breadth of experience you have across others who've been through these things.
00:18:52.720 -->
00:18:52.880Indeed.
00:18:53.119 -->
00:18:54.960So when it happens to you, you feel awfully alone.
00:18:55.119 -->
00:18:57.920You know, it's everyone's shouting at you on the pressure.
00:18:58.000 -->
00:19:03.680And you know, having a calm voice saying, look, we've been through this with 20 other companies, this is what happened.
00:19:03.839 -->
00:19:05.599Yeah, it's going to be difficult with this amount of time.
00:19:05.759 -->
00:19:08.000But you know, that that really is helpful.
00:19:08.240 -->
00:19:19.920I think lifting the board's focus from the immediate IT cyber crisis itself to like we were talking about earlier, to, you know, is this going to be a liquidity issue, all these sort of things?
00:19:20.640 -->
00:19:26.799Making sure the board tries to stand back, because you you inevitably terminate, you want to dive in and find out who did what and how are we going to fix it.
00:19:27.279 -->
00:19:28.799Just let the team fix that.
00:19:28.880 -->
00:19:33.279But what does this actually mean for the company reputationally, financially, all those sort of things?
00:19:33.759 -->
00:19:35.119I think that adds value.
00:19:35.359 -->
00:19:41.839And last but not least, I've certainly learned a couple of things that from from your company and which I hadn't realized, but great advice.
00:19:42.000 -->
00:19:49.680Things like, you know, when you have a cyber attack, immediately you want it to engage an external person to come in and tell us what went wrong and all this analysis.
00:19:49.759 -->
00:19:53.680And I think you advise us that the law firm should hire that.
00:19:53.839 -->
00:19:54.000Yeah.
00:19:54.400 -->
00:19:56.319Not you, which we would have done otherwise.
00:19:56.720 -->
00:19:57.519Otherwise it doesn't stay.
00:19:57.839 -->
00:19:59.119Yeah, that's a very privileged term.
00:20:00.720 -->
00:20:02.799That was a real eye-opener to me.
00:20:03.359 -->
00:20:19.759I don't know that one company of I haven't worked there, but I've I know people there and they've said they didn't do that and they regretted it bitterly because then the advice they got for themselves, warts and all, mean the kimono, then got used against them in the class action.
00:20:19.839 -->
00:20:23.519So Because you're dealing with the how and the why.
00:20:23.599 -->
00:20:25.920And the how and the why have the what?
00:20:26.079 -->
00:20:27.119The facts are the facts.
00:20:28.240 -->
00:20:30.480How this happened, why it happened.
00:20:30.799 -->
00:20:33.039They go straight to legal exposure.
00:20:33.200 -->
00:20:35.519And that's really what the board needs to know, actually.
00:20:36.640 -->
00:20:43.680One final thing I'd add is I was talking about how you receive advice or how it's given so that you understand the trade-offs.
00:20:43.920 -->
00:20:51.839I think one of the things I've found in a crisis has been really unhelpful is when advice is given in an absolute way, because it has a chilling effect.
00:20:52.000 -->
00:20:55.200You know, if it's like if you do this, you could all go to jail or whatever.
00:20:55.359 -->
00:20:56.559I'm over-emphasizing it.
00:20:57.359 -->
00:21:01.039Most of what a board does is operate in the grey and have to make those trade-offs.
00:21:01.200 -->
00:21:12.240And so being provided with the advice and information in a way where we can do that, rather than being given in a way that it has a chilling effect, it's really helpful in a crisis because tensions are already quite high.
00:21:12.559 -->
00:21:15.359I find boards just so you know, we do a lot with them.
00:21:15.599 -->
00:21:17.920They empower their legal advisors too.
00:21:18.079 -->
00:21:22.720There wouldn't be a board that I wouldn't go in front of in a in a crisis and they ask, Well, what do you think?
00:21:22.880 -->
00:21:26.400If you're not willing to be a participant in the room, you may as well not be in the room.
00:21:26.480 -->
00:21:26.640Yeah.
00:21:26.799 -->
00:21:36.079And then to your point, John, this idea of this is what's occurred, this is what's about to happen, some of it's not going to be great, unfortunately.
00:21:36.400 -->
00:21:37.920You may have this occur.
00:21:38.160 -->
00:21:42.960This is probably going to last, you know, the intensity might be 10, 15 days.
00:21:43.200 -->
00:21:53.359We may have a long tail, all of that sort of stuff leaning in with the reality of it's a little bit like being told you want all the news, the good and the bad, so you can make an educated decision.
00:21:53.599 -->
00:21:58.799I find it's the boards that empower those advisors and bring them into the room.
00:21:59.119 -->
00:22:07.599I encourage you uh in your organizations, if you want the external advisor that's providing the advice, bring them in.
00:22:07.680 -->
00:22:07.839Yeah.
00:22:08.079 -->
00:22:08.960Interrogate them.
00:22:09.039 -->
00:22:11.039I think it's a it's not a bad thing.
00:22:11.279 -->
00:22:14.000Catherine, John, thank you very much for your time.
00:22:14.160 -->
00:22:18.960I know that you're incredibly busy, but this is an incredibly important topic for us.
00:22:19.119 -->
00:22:28.559It touches not just on cyber but on governance more generally, which is why you invite two of our leading chairs in to speak together in this format is unique for us.
00:22:28.640 -->
00:22:30.319I've loved the interaction between you.
00:22:30.400 -->
00:22:36.880So just on behalf of the firm and all of our listeners who will get a chance to listen to this podcast and perhaps even see us.
00:22:36.960 -->
00:22:38.000Thank you so much for your time.
00:22:38.319 -->
00:22:38.480Thank you.
00:22:38.640 -->
00:22:38.960Enjoyed it.
00:22:39.519 -->
00:22:40.319Privilege to be invited.
00:22:40.480 -->
00:22:41.119Thanks a lot.
00:22:47.440 -->
00:22:51.440Yes, indeed, a real privilege to have Catherine and John with us in the same room.
00:22:51.599 -->
00:22:54.160In our next episode, we deviate slightly.
00:22:54.319 -->
00:23:00.559Taking the opportunity to speak to Charles Carmarkle, Chief Technology Officer from Mandiant Consulting.
00:23:00.799 -->
00:23:06.319This is before we pick up our director series again with a cross-examination of David Gonsky.
00:23:06.559 -->
00:23:11.759Thanks again to Catherine and John for such a great conversation, and thanks to you for listening.
