WEBVTT
00:00:05.839 --> 00:00:09.039
Welcome to the cybersecurity podcast by EC Council.
00:00:09.359 --> 00:00:11.519
I'm Jay Bavisi, your host.
00:00:11.919 --> 00:00:19.440
This is where we have some of the deepest meaningful conversations with some of the movers and shakers of the cybersecurity industry.
00:00:19.920 --> 00:00:25.440
My guest today managed a platform that was used by over 3 billion people.
00:00:26.160 --> 00:00:27.600
Think of that for a second.
00:00:28.079 --> 00:00:34.880
Not just that, he was subject to congressional and Senate hearings and an international ban.
00:00:35.359 --> 00:00:38.240
The questions that we ask here are not theoretical.
00:00:38.560 --> 00:00:41.359
They are about cybersecurity leadership at its finest.
00:00:41.759 --> 00:00:46.000
How do you manage an organization when the stakes are so high?
00:00:46.320 --> 00:00:55.520
If you're in cybersecurity, you lead an organization or you're part of a board, this conversation is not optional, it's mandatory.
00:00:55.759 --> 00:00:58.320
Please welcome Roland Clautier.
00:00:58.640 --> 00:00:59.600
Thank you, sir, for having me.
00:00:59.840 --> 00:01:00.560
It's great to be here.
00:01:00.799 --> 00:01:01.039
Thank you.
00:01:01.200 --> 00:01:02.479
Thank you for being here, Roland.
00:01:02.719 --> 00:01:08.400
Running a platform with three billion people is not something that everyone can actually uh claim that they have done.
00:01:08.799 --> 00:01:10.480
I don't know who's crazy enough to do that.
00:01:11.280 --> 00:01:13.680
Let's start by talking about you as a person.
00:01:14.079 --> 00:01:16.319
How did you get into cybersecurity?
00:01:16.480 --> 00:01:19.040
And uh, you know, what's your what's your journey been like?
00:01:19.280 --> 00:01:22.239
Uh actually, I came from the total opposite side of security.
00:01:22.400 --> 00:01:32.239
I was in uh the military and worked for the Department of Defense in aerospace defense as a combat security policeman and um essentially a raven on military aircraft.
00:01:32.319 --> 00:01:33.920
And then I got into federal law enforcement.
00:01:34.000 --> 00:01:41.280
But what what started happening is criminal and civil investigations in those realms really started at having a lot of computer stuff.
00:01:41.519 --> 00:01:43.840
And uh I couldn't even spell computer at the time.
00:01:43.920 --> 00:01:50.640
So I went back to university and uh really focused on computer science and then discovered I loved it.
00:01:50.799 --> 00:02:11.680
Like, you know, I had tech at heart, and um uh when I graduated uh from BU, I decided to put my toe into the dark world of commercialism coming out of uh federal law enforcement and you know, just jumped into what was doing stopping bad guys.
00:02:11.759 --> 00:02:13.120
It was the same thing as in law enforcement.
00:02:13.280 --> 00:02:16.719
You're stopping bad guys, you're chasing, you know, you're securing things, you're protecting stuff.
00:02:16.800 --> 00:02:22.319
You could have an entire career doing what I was doing with technology, and oh yeah, it doubled my paycheck when I left.
00:02:22.400 --> 00:02:23.280
So it wasn't too bad.
00:02:23.360 --> 00:02:24.800
And and I've been having fun since.
00:02:24.960 --> 00:02:28.240
I've uh you know found I had a knack for team building.
00:02:28.319 --> 00:02:42.800
I think my military experience uh really helped me figure out how to create high-performing teams, and doing that in a commercial sense really makes you pretty successful in this business.
00:02:43.039 --> 00:02:44.240
So let's talk about that a little bit.
00:02:44.400 --> 00:03:00.879
CISOs are the uh people that in the organization that get blamed all the time whenever there is a security problem, and that's why it's a job that not many people you know hang on to for a long time in an organization, and it's sad, but a CISO is not able to function without high-performing teams.
00:03:01.120 --> 00:03:05.120
So, what would be your advice to CISOs out there?
00:03:05.199 --> 00:03:06.400
You know, how did you do that?
00:03:06.560 --> 00:03:11.919
Because you have a high-stake platform that cannot come down, is used by three billion people, right?
00:03:12.080 --> 00:03:17.840
And what are the lessons that you have uh learned over the years that you are able to share to our audience?
00:03:18.080 --> 00:03:21.199
I I think first and foremost, there's a mindset that CISOs have to have.
00:03:21.280 --> 00:03:29.039
And I want to go back to that, Jay, the kind of the first thing you talked about, which was that some CISOs don't last long in this field because they're always getting blamed for things.
00:03:29.280 --> 00:03:31.680
People that do this work are passionate.
00:03:31.840 --> 00:03:38.960
They're passionate about defending, they're passionate about doing the right thing, they're passionate about engaging their business to do it, you know, to do what's right.
00:03:39.120 --> 00:03:44.159
And oftentimes they blame themselves more than other people blame them.
00:03:44.400 --> 00:04:00.400
And so I think when individuals can change the mindset to saying, I'm engaged with the business, I provided incredible transparency, good advice, and options, and it's the business's decision on what they want to do or not do.
00:04:00.639 --> 00:04:02.159
And we all agree with that.
00:04:02.319 --> 00:04:11.840
So, meaning I operate in the sense of the executive leadership team or the broader context of the leadership within the business, and it's the business that makes decisions.
00:04:12.000 --> 00:04:16.319
When we hold the decisions to ourselves, that's typically when things go wrong.
00:04:16.480 --> 00:04:20.639
So, number one is change your mindset, become a business leader.
00:04:20.879 --> 00:04:24.720
Now, with regards to how to build teams, I think everybody does it a little differently.
00:04:24.879 --> 00:04:26.480
Every leader is a little bit different.
00:04:26.639 --> 00:04:30.319
I like to have what it's kind of funny in this work, but I call a command staff.
00:04:30.399 --> 00:04:40.000
I believe that I should have strong men and women that enjoy being leaders, that understand their jobs, and can operate under high pressure.
00:04:40.079 --> 00:04:41.519
So those are the people I seek.
00:04:41.759 --> 00:04:45.759
The second thing I seek is people that want to do different jobs.
00:04:46.000 --> 00:04:51.839
Typically, if you're on my leadership team, my command staff, you are probably going to move jobs every two or three years.
00:04:52.079 --> 00:05:01.759
I want a well-rounded practitioner that can support the man or woman to their left or to their right and can be the backup to another person on the team should there be a problem.
00:05:01.920 --> 00:05:09.839
So I build extremely strong teams with independent accountability and authority to go do their jobs.
00:05:10.160 --> 00:05:19.360
And in that sense, you end up creating an organization that understands how to function closer and closer to where they're defending against the bad guys.
00:05:19.439 --> 00:05:21.439
And that's just the style I've taken.
00:05:21.600 --> 00:05:28.079
It's come through years of seeing really good leadership in different organizations, and I think that's a starting point.
00:05:28.319 --> 00:05:34.560
So I want to come back real quickly to the earlier point that you talked about that you know, speak the business language, absolutely correct.
00:05:34.639 --> 00:05:35.439
I agree with you.
00:05:35.600 --> 00:05:38.399
And the fact that is the business that has to decide.
00:05:38.639 --> 00:05:46.959
But when you run a critical software or platform, and the business says, Look, we need speed, we need agility, we gotta launch now.
00:05:47.040 --> 00:05:48.240
The competitors are coming out.
00:05:48.319 --> 00:05:49.839
Take a look at what's happening AI.
00:05:49.920 --> 00:05:52.079
Take a look at RSA, where we are, right?
00:05:52.319 --> 00:05:59.360
Everyone has AI, companies have AI now, they've rebranded their company names to add AI at the end of it to just to show relevance.
00:05:59.680 --> 00:06:02.000
That only took six minutes to say AI, I think.
00:06:02.879 --> 00:06:03.759
Not bad.
00:06:04.079 --> 00:06:14.959
And and the challenge there would have would be when something goes wrong, the blame is going to come to the CISO, whether or not the CISO has said or warned ahead of time that this is not the right way.
00:06:15.199 --> 00:06:19.040
So while theoretically, you know, and I might challenge you a little bit, right?
00:06:19.279 --> 00:06:28.480
Theoretically, it might be fair to say that, hey, I will want the business owners to say these are the risks, but CISOs have other balls in the air that they have to juggle.
00:06:28.560 --> 00:06:35.759
They have compliance, they have governance, they have the bot to respond, and ultimately, when something happens, they fall on the sword.
00:06:36.079 --> 00:06:38.160
Uh, what do you think of that statement that I've just made?
00:06:38.240 --> 00:06:39.040
You know, would you agree?
00:06:39.120 --> 00:06:41.839
And and so how do you navigate those turbulent waters?
00:06:42.079 --> 00:06:43.199
Let's stick with AI for a second.
00:06:43.279 --> 00:06:44.639
I mean, you brought it up, you want to focus.
00:06:44.800 --> 00:06:45.759
I'm I'm I'm all in.
00:06:45.920 --> 00:06:46.959
First of all, I love AI.
00:06:47.040 --> 00:06:59.040
I think the things that I learned at TikTok were simply amazing in the realm of what it can actually provide for the customer base of the organization you're serving.
00:06:59.360 --> 00:07:05.040
It is an incredible technology, and now that I'm actually deeper into it, I really see the advancements.
00:07:05.120 --> 00:07:09.040
But let's talk about it from CISO's perspective, because I think that's the most important point.
00:07:09.360 --> 00:07:18.160
You have to remember that CISO has three jobs when it comes to AI, and they're all very important, and I don't think I can measure one over the other.
00:07:18.399 --> 00:07:25.120
The first one is they have to enable AI for the business to use it at the speed that they have to compete in a global market, period.
00:07:25.439 --> 00:07:26.160
Or none.
00:07:26.319 --> 00:07:26.639
Right?
00:07:26.800 --> 00:07:31.680
This isn't about setting up standards and setting up governance.
00:07:31.839 --> 00:07:34.160
I mean, it's all in there, all that has to happen.
00:07:34.240 --> 00:07:43.519
But at the end of the day, the CISO has to be focused and engaged in ensuring the organization can use the technology it is necessary to be successful and win in the market.
00:07:43.759 --> 00:07:45.439
So that's job one.
00:07:45.519 --> 00:07:46.319
How do I do that?
00:07:46.560 --> 00:07:49.199
Job two, I have to protect from AI attacks.
00:07:49.360 --> 00:08:01.360
You know, I remember four or five years ago when you're in an advanced technology company and you know, one of the big techs or one of the big platforms, that it's not we get attacked 275, you know, times uh a day.
00:08:01.439 --> 00:08:04.319
It's like you know, 200,000 times a day.
00:08:04.639 --> 00:08:08.319
You really have to understand what's coming at you.
00:08:08.480 --> 00:08:17.839
And we would see early onset of AI-based attacks against our platform based on the controls we implemented at any given time in the attempted workarounds.
00:08:17.920 --> 00:08:19.759
And you could just see the automation behind it.
00:08:19.839 --> 00:08:26.959
Like Jimmy behind the keyboard in his mom's basement isn't going to be making those changes in sub-second parallels, right?
00:08:27.040 --> 00:08:27.759
It's not happening.
00:08:27.839 --> 00:08:32.559
That's pure automation against a controller you just implemented, and it's testing its new attack against you.
00:08:32.720 --> 00:08:34.000
That was four years ago.
00:08:34.240 --> 00:08:48.799
So, what I'm saying is the world has changed, our defensive posture needs to change, and our mechanisms and capabilities to defend against AI have to be, you know, just right up front because our entire organization is going to change, and I'll get to that in a second.
00:08:48.879 --> 00:08:52.960
But then so you got to enable the business to use it, you've got to know you're gonna get attacked by it.
00:08:53.120 --> 00:08:54.720
How are you going to defend against it?
00:08:54.879 --> 00:08:57.039
And the third is you're a business person.
00:08:57.200 --> 00:08:57.600
You're right.
00:08:57.679 --> 00:09:02.320
If you're truly a CISO in today's world, you're a business operations protection executive.
00:09:02.480 --> 00:09:08.879
You belong in a company, and you may have 50 to 500 practitioners to a thousand practitioners in your organization.
00:09:09.039 --> 00:09:14.159
If you've got a budget like a large, you know, global, maybe it's$50 million to protect your organization.
00:09:14.320 --> 00:09:16.159
But that's a company ready to go public.
00:09:16.240 --> 00:09:17.360
You're running a business.
00:09:17.600 --> 00:09:20.159
You have to do your business better with AI.
00:09:20.399 --> 00:09:26.960
What is your 10x plan to use AI to be a better business leader in your company?
00:09:27.279 --> 00:09:32.639
Make sure that your operations run more succinctly, you're achieving better cost containment, right?
00:09:32.799 --> 00:09:38.240
All of those things that every other business person in the business is being measured on, you need to be measured on.
00:09:38.399 --> 00:09:41.840
So three very different jobs, all focused on AI.
00:09:42.399 --> 00:09:47.679
And that is how you truly align and become a business partner with the company.
00:09:47.759 --> 00:09:52.159
You're taking accountability, you're driving them forward, and you're protecting them.
00:09:52.320 --> 00:10:00.480
And I think when you do those things right, and you know, with almost anything, that it's not let's go blame the CISO, it's how do we support the CISO?
00:10:00.799 --> 00:10:03.279
So let's unpack a lot of things that you've talked about.
00:10:03.440 --> 00:10:10.720
If we look globally right now, you're seeing many organizations have chief AI offices that are that are beginning to be hired.
00:10:11.360 --> 00:10:15.200
Chief AI, chief CTOs, EIOs, yeah.
00:10:15.519 --> 00:10:15.679
Right.
00:10:15.759 --> 00:10:19.039
And then you have got CTOs, you have CIOs, you have CISOs, right?
00:10:19.120 --> 00:10:22.720
So you said that CISOs have three jobs, but is it really fair?
00:10:22.879 --> 00:10:26.480
Because I mean, you've been a CISO yourself and you're advising CISOs today.
00:10:26.720 --> 00:10:28.320
CISOs already have a lot to do.
00:10:28.639 --> 00:10:47.039
They have to protect the infrastructure, they have to deal with program management, they've got security operations going on, and you know, now comes a whole layer of AI, and the business use case is tremendous because if you're not using AI, then your board and your CEO, and if you're publicly listed, your stockholder valuations all impacted to AI.
00:10:47.200 --> 00:10:51.200
You know, but you are asked to defend against an pretty much unknown.
00:10:51.919 --> 00:10:53.759
Ask the question a different way.
00:10:54.000 --> 00:10:57.840
Is it fair to the CEO that now he has to drive a company of AI?
00:10:58.080 --> 00:11:00.000
Like, I mean, what's fair?
00:11:00.159 --> 00:11:15.919
I mean, at the end of the day, if my job is business operations protection and the technology they chose to use today is AI to drive it, then it as part of the resiliency, protection, and assurety of the company, yeah, it's my responsibility.
00:11:16.080 --> 00:11:17.279
It might cost the company more.
00:11:17.360 --> 00:11:18.559
They may have to make some decisions.
00:11:18.720 --> 00:11:24.240
We might have to not do some things, and the business will have to make some joint decisions on whether or not we do certain things.
00:11:24.399 --> 00:11:25.919
But yeah, I think it's fair.
00:11:26.080 --> 00:11:33.279
I think as long as you want to sit in this seat that you have to understand that the world's going to change.
00:11:33.440 --> 00:11:40.080
Like when, you know, the first time, it was probably 2015 we started talking about cloud, maybe 2014.
00:11:40.240 --> 00:11:43.279
You know, we operated in the organization I was in at the time.
00:11:43.360 --> 00:11:46.879
We operated in six major data centers around the world.
00:11:47.120 --> 00:11:48.799
We had just lost one to fire.
00:11:48.879 --> 00:11:52.799
I mean, it was like it was crazy times and big honking data centers.
00:11:52.879 --> 00:11:57.120
And they were like, hey, we're gonna build that product and we're gonna put it in a cloud.
00:11:58.080 --> 00:11:58.399
Okay.
00:11:59.120 --> 00:12:00.240
What do you want me to do?
00:12:00.320 --> 00:12:00.559
Right?
00:12:00.639 --> 00:12:06.399
Like, the next thing you know, hey, we're gonna transfer these two data centers holistically into cloud.
00:12:06.639 --> 00:12:08.000
This wasn't lift and shift.
00:12:08.159 --> 00:12:10.799
This was dynamically changed how we do business.
00:12:11.039 --> 00:12:22.240
And I didn't have cloud security engineers at the time, I didn't have cloud defense technologies, the big platform providers didn't have integrated threat management or monitoring capabilities.
00:12:22.320 --> 00:12:25.039
You could shim in and pull stuff out, but I mean it was painful.
00:12:25.200 --> 00:12:32.000
I mean, 2015 to you know, 2020 trying to do mass migrations was painful.
00:12:32.159 --> 00:12:33.200
But that was my job.
00:12:33.440 --> 00:12:35.840
And so I kind of take it the same thing with AI.
00:12:35.919 --> 00:12:36.960
It's going to be painful.
00:12:37.039 --> 00:12:45.519
We're gonna have amazing partners in the industry, we're gonna have incredible new companies that stand up that are actually gonna make us more secure and do do our jobs better.
00:12:45.679 --> 00:12:49.039
So I'm actually hopeful, and and I think that, yeah, it's fair.
00:12:49.200 --> 00:12:54.000
If I chose to protect the company, then I need to protect what they need to do their jobs.
00:12:54.320 --> 00:13:16.879
So there's there's some uh conversations happening at RSA here where they're saying that when it comes to AI, because AI implementation is so close to the business, it should probably be the implementation of AI and the and the evaluation of AI should be part of the BSOs at the business units, where else the CISOs are actually you know too far away from the business, right?
00:13:17.039 --> 00:13:22.159
Now, in a large organization, you know, my national reaction would be how many companies have BSOs to begin with?
00:13:22.639 --> 00:13:27.360
I was about to say that's right, it's maybe 12% of the major multinationals out there have a BISO model.
00:13:27.519 --> 00:13:28.879
Right, right, right, exactly.
00:13:29.039 --> 00:13:32.720
So so I guess in absence of that, I think that your answer is probably gonna be.
00:13:33.039 --> 00:13:38.639
But no, I I like where the conversation's going though, because you know, uh, shift left worked, right?
00:13:38.720 --> 00:13:38.799
Right.
00:13:39.039 --> 00:13:53.679
So when we started saying, there's no way I'm gonna take a code defense and product security organization and now take over responsibility for all good quality, assured secure code for a company that's doing 40 million lines of code a day.
00:13:53.919 --> 00:13:55.440
Like, it's crazy.
00:13:55.600 --> 00:13:57.200
It's just not gonna happen, right?
00:13:57.279 --> 00:13:58.879
Like, so how do you do it?
00:13:58.960 --> 00:14:06.960
You enable tools training, capability access, and we get transparency and independent testing analysis and output of tools.
00:14:07.039 --> 00:14:14.000
So we have a view of what's going on, what the quality looks like, they have the tools to do it right, and you shift left, left, left.
00:14:14.159 --> 00:14:17.279
I think we start as far to the left as possible.
00:14:17.440 --> 00:14:25.120
I'm seeing technologies here and other things I'm looking at that sit on the wire and look at intent of actions.
00:14:25.279 --> 00:14:39.919
I see technology here uh that came and spurned out of the ASPM world that is doing at time of coding both machine-generated code and human-generated code at the time it's being developed to show flaws or issues.
00:14:40.080 --> 00:14:41.759
So we're we're catching it earlier.
00:14:41.919 --> 00:14:44.559
I think we keep shifting left, and I think we do the same thing with AI.
00:14:44.799 --> 00:14:45.360
Fantastic.
00:14:45.519 --> 00:14:46.720
So let's talk about AI.
00:14:46.799 --> 00:14:50.240
There's a lot to talk about, but there's the data that's gonna be a thing, right?
00:14:50.399 --> 00:14:52.559
Yeah, it probably already is a thing.
00:14:52.879 --> 00:15:03.440
Last year, everyone was rushing into implementation of AI, and this year I see a lot of conversations around governance of AI and you know, ethical governance of AI.
00:15:03.600 --> 00:15:05.519
Now, let me put this in context for you.
00:15:05.679 --> 00:15:09.120
The European Union has already launched uh the EU AI Act, right?
00:15:09.200 --> 00:15:10.559
Uh scorecard.
00:15:10.879 --> 00:15:14.799
Yeah, there's ISO 42001, there's NISER, right?
00:15:14.960 --> 00:15:15.039
Yeah.
00:15:15.200 --> 00:15:15.919
Those are already there.
00:15:16.000 --> 00:15:16.159
Sure.
00:15:16.320 --> 00:15:18.639
But it's not been mandated in the US yet.
00:15:18.720 --> 00:15:20.240
I think the direction is moving there.
00:15:20.320 --> 00:15:20.639
Yeah.
00:15:20.879 --> 00:15:27.200
But 72 countries have already implemented governance frameworks or regulations around AI.
00:15:27.360 --> 00:15:28.240
So this is coming.
00:15:28.320 --> 00:15:29.759
There's no question about this.
00:15:29.919 --> 00:15:33.679
How should AC so prepare for what's coming ahead of them?
00:15:34.000 --> 00:15:39.519
I love this question because I think it is very forward-looking.
00:15:39.600 --> 00:15:54.399
And I hope the people that uh hear and see this podcast really take this to heart because it is coming, they need to do it now, and they need to instrument their pipelines and their capabilities and the services they're delivering back with these services.
00:15:54.559 --> 00:16:08.399
So I truly believe, and I, you know, there are a couple great companies out there that are doing generative AI, LLM, pipeline review, infrastructure review, creating scorecards for you, then aligning them to the different countries which you operate in.
00:16:08.480 --> 00:16:08.960
Do it now.
00:16:09.039 --> 00:16:11.440
You don't have to do it, the AI is gonna do it for you.
00:16:11.600 --> 00:16:21.200
You know, it it get away from the old GRC model in your head where, oh my God, I gotta get 15 more people to get 32 more spreadsheets and put something new in Archer.
00:16:21.360 --> 00:16:22.399
I love Archer, don't get me wrong.
00:16:22.480 --> 00:16:41.759
I'm not complaining about Archer, but my point being is that there are new ways to do this in a very automated fashion that give you assurance validation, red teaming, and compliance and scorecarding for every product, every time someone runs a new, you know, creates a new pipeline and a new output of your AI models.
00:16:41.919 --> 00:16:42.320
Do it.
00:16:42.480 --> 00:16:44.000
Do it today, make it part of your baseline.
00:16:44.240 --> 00:16:45.519
But they don't have the people.
00:16:46.080 --> 00:16:47.440
The systems do it for you.
00:16:47.519 --> 00:16:49.519
I mean, you know, and you still need people, right?
00:16:49.600 --> 00:16:52.399
Because Do you need a firewall, you know, engineer 101?
00:16:52.559 --> 00:17:04.880
Do you need a third-party risk engineer, or can you go to a company outside that can do the collective analysis of all your third parties and dump it for you and prioritize it into your SIM environment for an operational, for a risk ops view, right?
00:17:05.039 --> 00:17:07.200
Like change your operations.
00:17:07.839 --> 00:17:10.240
Your operations will need to change with AI.
00:17:10.400 --> 00:17:18.079
Start thinking strategically about the programs you need people for, what you need people for, and what you don't.
00:17:18.240 --> 00:17:27.039
And then use appropriate funding to convert those over to AI automation and use the people for the right things.
00:17:27.359 --> 00:17:32.960
It's gonna require a strategic organizational shift, just like it did with cloud, right?
00:17:33.119 --> 00:17:39.759
You're sure you have now most organizations have more cloud security engineers, architects, and automated systems that do security better.
00:17:39.920 --> 00:17:43.519
I'm excited, you know, when people say we're going over to cloud, good, about time.
00:17:43.599 --> 00:17:46.640
Better controls, faster controls, more complete awareness.
00:17:46.720 --> 00:17:47.599
Have a nice day.
00:17:47.759 --> 00:17:48.160
Move on.
00:17:48.480 --> 00:17:53.119
Do you think AI is going to eat human jobs in cybersecurity?
00:17:53.440 --> 00:17:54.960
Or do you think expand it?
00:17:55.200 --> 00:17:57.359
Oh no, I mean I it's gonna expand it.
00:17:57.440 --> 00:17:58.079
I mean why?
00:17:58.160 --> 00:18:00.000
Because we're going to agents can do everything.
00:18:00.079 --> 00:18:01.200
I mean, there's an agent for everything.
00:18:01.279 --> 00:18:02.400
They're robots for everything.
00:18:02.720 --> 00:18:09.519
But but output validation assumptions in alignment to the business, understanding the context of the data assets they're accessing.
00:18:09.680 --> 00:18:12.720
I mean, did you have data sciences people on your team?
00:18:12.960 --> 00:18:23.519
No, but there's gonna be a certified data science defense specialist coming out of your company pretty soon that people are gonna go get certified for because they don't have people that know how to do that, right?
00:18:23.759 --> 00:18:32.160
We didn't go look at Caltech or any of the polys to go steal people from data sciences programs to staff our organizations because we didn't need them before.
00:18:32.319 --> 00:18:34.160
AI pipelines, same issue.
00:18:34.319 --> 00:18:37.599
You ask somebody, can you talk to me about what an AI pipeline looks like?
00:18:37.759 --> 00:18:42.079
And they have no idea on what the actual structure of an AI pipeline.
00:18:42.240 --> 00:18:46.319
They know that there's AI algorithms and they know that there's certain things.
00:18:46.480 --> 00:18:53.839
Maybe they even read up on MITAR Atlas and know the 12 different domains associated, you know, with it, but they've probably never built it.
00:18:53.920 --> 00:19:08.880
So now we're gonna be hiring AI-specific people that are AI defenders that are gonna take the output of this information, help with architecture, deliver engineering specific to it, understand AI threat attacks in stack and in pipeline.
00:19:09.039 --> 00:19:10.480
Do you have anyone that can do that today?
00:19:10.640 --> 00:19:11.279
Probably not.
00:19:11.440 --> 00:19:12.640
The jobs will change.
00:19:12.799 --> 00:19:23.599
What is super cool is that it's going to be better toolage, it's going to be more meaningful work that practitioners will do.
00:19:23.759 --> 00:19:28.720
I'm sorry to say it to the GRC and the third-party risk teams, but those jobs are not going to exist.
00:19:28.880 --> 00:19:29.759
They just aren't.
00:19:30.000 --> 00:19:31.200
I mean, think about it.
00:19:31.359 --> 00:19:51.359
If I can have a system that understands where my business data moves to, who my third parties are, and that I have an external threat advisory capability from a third party, and I do that at speed and understand the controls inside my organization and the validity of their controls through a technical hub, and then that provides me an active threat review.
00:19:51.759 --> 00:19:53.440
Why do I need a person doing that?
00:19:53.599 --> 00:19:56.960
I've got validation, I've got proof, and it's and it's it's immediate.
00:19:57.119 --> 00:20:08.400
So there's just some whole areas of our practitionership that will go away, but there are these big new bubbles of work that are coming up that we don't have anybody in there.
00:20:08.559 --> 00:20:15.039
And if someone wants to be really successful, they start thinking three, five years down and start training themselves for it.
00:20:15.279 --> 00:20:29.119
So you would say a new career like offensive AI security professional will be important for Rit Teamers, where they are actually training in attacking LLMs and being able to protect AI systems that their organization use, or AI program management, for example.
00:20:29.599 --> 00:20:39.279
Or understanding how technology is being used to create the threats to attack, validating the information coming out of the test, and then building controls.
00:20:39.440 --> 00:20:42.960
We'll see they won't have one job, they'll have multiple jobs.
00:20:43.119 --> 00:20:53.200
All of a sudden, it'll become an AI threat control defense engineer at the same time that they're taking the output from red teaming platforms, even red teaming, you know, on AI.
00:20:53.279 --> 00:20:56.559
I mean, think of what you know was released in the last couple of weeks, right?
00:20:56.799 --> 00:21:00.240
Right, you know, around threat development using AI.
00:21:00.480 --> 00:21:02.079
Scary, but great.
00:21:02.240 --> 00:21:02.640
Right?
00:21:02.799 --> 00:21:03.119
Okay.
00:21:03.359 --> 00:21:06.960
Well, I don't need 50 pen testers to do that anymore.
00:21:07.200 --> 00:21:21.119
But I'm going to need someone to help me understand what type of code I have, what type of pipeline infrastructure, how that integrates, third, fourth, fifth party pipelines that I'm integrating into, what is my infrastructure associated with my AIs?
00:21:21.279 --> 00:21:24.240
I mean, do you have an API engineer in your security organization?
00:21:24.319 --> 00:21:26.319
That's going to be really important shortly, right?
00:21:26.400 --> 00:21:28.079
Like, how are we managing APIs?
00:21:28.319 --> 00:21:30.000
Context-based defense, right?
00:21:30.079 --> 00:21:38.240
How does it agentic things integrate into my data, into my APIs, into my general network architecture, right?
00:21:38.400 --> 00:21:40.559
Does anybody in your organization understand that today?
00:21:40.720 --> 00:21:40.880
No.
00:21:41.039 --> 00:21:41.920
But they're better tomorrow.
00:21:42.160 --> 00:21:47.440
So basically, your point is an entire morphed industry where new jobs are coming in.
00:21:47.599 --> 00:21:50.960
Traditional pen testers have to be upskilled to keeping up with times.
00:21:51.119 --> 00:21:54.000
Red teaming will change because of the context of AI.
00:21:54.160 --> 00:21:55.519
Governance is going to change.
00:21:55.680 --> 00:21:59.759
So we just have to be prepared to be agile and to morph into new roles.
00:22:00.000 --> 00:22:00.960
Can I get an amen?
00:22:01.279 --> 00:22:01.599
Right.
00:22:02.079 --> 00:22:02.880
Fantastic.
00:22:03.119 --> 00:22:06.960
Let's talk about some difficult moments in your life, right?
00:22:07.279 --> 00:22:11.119
You were the CISO of Byte Dance during the entire TikTok.
00:22:11.599 --> 00:22:14.000
The early days of their growth cycle.
00:22:14.559 --> 00:22:18.720
The early days of the growth cycle, shall I say, the TikTok controversy or challenges that you face.
00:22:19.119 --> 00:22:25.039
You went through a very difficult time wading through very challenging situations.
00:22:25.359 --> 00:22:27.839
Congressional and Senate testimonies.
00:22:27.920 --> 00:22:29.119
I mean, that's not easy.
00:22:29.440 --> 00:22:36.160
Take us through your mindset when you were faced with a subpoena, right?
00:22:36.400 --> 00:22:39.680
Because a lot of CISOs out there, I mean, regulations are getting tough.
00:22:39.759 --> 00:22:41.759
They're going to be called by regulators every now and then.
00:22:41.839 --> 00:22:44.400
And I can't imagine another better example than you.
00:22:44.640 --> 00:22:45.359
Because I mean still.
00:22:45.599 --> 00:22:46.400
There are a lot of questions.
00:22:46.640 --> 00:22:46.880
Right?
00:22:47.440 --> 00:22:48.000
Exactly.
00:22:48.160 --> 00:22:49.519
So what was it like?
00:22:49.680 --> 00:22:51.759
How how did you navigate through that moment?
00:22:52.000 --> 00:22:55.599
Truth, transparency, facts, and an amazing team.
00:22:55.920 --> 00:22:57.519
I mean, at the end of the day, that's it.
00:22:57.680 --> 00:23:00.160
That's how I operate my career and in general.
00:23:00.240 --> 00:23:05.440
And I think that's what gives me the confidence and the capability to deal with that level of pressure.
00:23:05.599 --> 00:23:08.160
But there must be a personal amount of stress, a very high amount of stress.
00:23:08.799 --> 00:23:15.440
When you actually get a subpoena and say that we want to talk to you, you know that every word you say can and will be used, right?
00:23:15.759 --> 00:23:16.240
It is true.
00:23:16.319 --> 00:23:21.039
But that becomes with preparation, you know, proper preparation prevents piss poor performance, right?
00:23:21.519 --> 00:23:22.640
So so take us through.
00:23:22.720 --> 00:23:24.000
You you show up at the yeah.
00:23:24.160 --> 00:23:30.000
So take me to the weeds of what it was like in that morning or afternoon when you're standing in the Senate and you know that.
00:23:30.480 --> 00:23:31.200
Let's start before that.
00:23:31.279 --> 00:23:31.440
All right.
00:23:31.599 --> 00:23:32.720
I think that's the most important part.
00:23:32.799 --> 00:23:33.920
It's the preparation, right?
00:23:34.160 --> 00:23:36.640
It's the what am I being asked and why?
00:23:36.799 --> 00:23:38.400
And what information do we have?
00:23:38.720 --> 00:23:41.039
So there's getting that information.
00:23:41.599 --> 00:23:42.799
Context, important.
00:23:43.279 --> 00:23:44.480
Why is it being asked?
00:23:44.640 --> 00:23:46.079
Is this a political issue?
00:23:46.240 --> 00:23:47.680
Is this a real issue?
00:23:48.000 --> 00:23:56.880
What is the concern of the jurisdiction, the country, the entity, the legislative body, the legal entity, whatever it may be, what is the concern?
00:23:57.039 --> 00:23:59.039
Real, political, made up, it doesn't matter.
00:23:59.200 --> 00:24:01.519
There's a point of what's being asked.
00:24:01.680 --> 00:24:03.759
And then what's our truth?
00:24:04.000 --> 00:24:05.599
How do we know that?
00:24:05.839 --> 00:24:08.079
Okay, and how do we prepare to answer that?
00:24:08.319 --> 00:24:16.559
And I was fortunate where I had an entire organization that that's how they operated.
00:24:16.799 --> 00:24:34.160
Uh I had an amazing legal support team that understood my focus on want to be transparent, um, deliver very transparent information to whomever I was speaking to, and really helped me understand the context of why.
00:24:34.480 --> 00:24:54.480
And and so now you fast forward, you've done this preparation work, maybe you've done some sessions with hard technical people on your team asking questions and how they would ask them, and you have lawyers asking lawyery terms, you know, that you wouldn't be expecting because I'm I'm just a security guy, and maybe I wouldn't expect it.
00:24:54.640 --> 00:25:15.759
So you go in as prepared as possible, and you go in confident that it doesn't matter, you know, what the screaming happens or if people are saying stuff, that you're answering with truth, that you validated, and you're being transparent to what you're being asked, um, and you continue to answer the questions.
00:25:15.920 --> 00:25:19.680
I don't get caught up in the fray, I don't get caught up in the political questions.
00:25:19.920 --> 00:25:29.359
I have enough training, experience, and awareness to answer the questions that I'm I'm being asked and not delve into you know into silliness.
00:25:29.599 --> 00:25:30.960
Do you feel attacked?
00:25:31.279 --> 00:25:35.200
Because I mean when you watch it from an outsider looking at the television, right?
00:25:35.759 --> 00:25:36.160
Those are difficult.
00:25:36.799 --> 00:25:38.960
Maybe 20% of the time I feel like I'm being attacked.
00:25:39.119 --> 00:25:40.240
Listen, they get a job to do.
00:25:40.319 --> 00:25:44.559
If my team feels attacked when I ask them hard questions, they should get off my freaking team.
00:25:44.799 --> 00:25:45.039
Right?
00:25:45.200 --> 00:25:51.440
Like if I'm going into a place that's asking me hard questions because they're protecting your citizens, they get a job.
00:25:51.680 --> 00:25:57.920
If the technology I'm defending is operating, you know, within their areas, they have a right to ask me hard questions.
00:25:58.160 --> 00:26:08.880
How much of what you went through, and a lot of CISOs that are going through all sorts of governance uh and regulatory framework requirements, and that's where my question is coming from.
00:26:09.119 --> 00:26:14.640
How do you separate between geopolitics and actual security concern?
00:26:14.720 --> 00:26:16.480
Because you're right in the center of it.
00:26:16.799 --> 00:26:19.279
You don't know exactly the kind of questions that are going to be asked.
00:26:19.359 --> 00:26:22.960
It's gonna come from any any question from any corner of the stakeholders.
00:26:23.440 --> 00:26:24.480
How do you navigate that?
00:26:24.799 --> 00:26:25.279
Three words.
00:26:25.519 --> 00:26:27.440
Program consistency counts.
00:26:28.000 --> 00:26:46.960
You implement a program that is focused on informative threat information, understanding your environment, your threat environment, and your business, and you create capabilities to defend, detect, monitor, and respond to those, you can't go wrong.
00:26:47.279 --> 00:26:48.720
You just you just can't.
00:26:49.039 --> 00:27:08.799
As long as you have operational consistency on how you're delivering it, you're consistently understanding the threats to the business, to the technology, to the platforms, to the applications, to the people, and you're applying a risk-based view and having a business discussion on what we are or are not going to do, document that and move on.
00:27:09.039 --> 00:27:11.200
That's not a geopolitical thing.
00:27:11.359 --> 00:27:13.359
That's just doing good work.
00:27:13.680 --> 00:27:24.880
And so when you have geopolitical issues, and you know, there's people are claiming this or claiming that, you go back to truth, transparency, you know, and clarity.
00:27:24.960 --> 00:27:25.680
And that's it.
00:27:25.839 --> 00:27:36.240
I mean, one of my favorite meetings, I'll be honest with you, I don't think I've ever talked about this before, but there's an organization called the World 50, and it's the most senior security practitioners on the globe sit on this.
00:27:36.480 --> 00:27:45.599
And there was some geopolitical blah, blah, blah going on while I was sitting in seat and I was in the middle of doing a lot of visibility detection analysis.
00:27:46.079 --> 00:27:57.759
And I got an opportunity to get in a phone call with probably a hundred of my favorite peers around the world of the biggest companies, and answer hard questions.
00:27:58.720 --> 00:27:59.200
Think about it.
00:27:59.359 --> 00:28:07.039
You've got, you know, companies that are using your technology that are, you know, your customers that are really important.
00:28:07.519 --> 00:28:10.079
And you have, you know, people from all over the world.
00:28:10.160 --> 00:28:12.640
And they sit in there and they were asking questions.
00:28:12.880 --> 00:28:20.079
And I took that meeting, and it which was cool because the business left it up to me whether I wanted to do it or not.
00:28:20.319 --> 00:28:28.240
I'm like, all I can answer is truthfully, all I can show them is the transparency, the evidence of the programs I have, and they can make their own decisions.
00:28:28.400 --> 00:28:30.240
It was one of the best meetings.
00:28:30.720 --> 00:28:32.480
Toughest, but one of the best meetings.
00:28:32.640 --> 00:28:38.079
Probably as tough, if not tougher, than any of the congressional or legislative meetings I had to attend.
00:28:38.319 --> 00:28:39.759
So tell me something.
00:28:40.240 --> 00:28:49.680
You make it sound and you come across as everything's programmatic, you know, you be truth, you be consistent, you have programs, and you're right.
00:28:50.559 --> 00:29:08.640
You and I both know in the real world, in the wild, that's not the way half of the that that cannot describe lives of majority of the CESOs that are out there because so many bells and whistles ringing everywhere, uh, getting a workforce that's competent, having a team, a dream team that's able to do their jobs really well.
00:29:08.720 --> 00:29:19.440
I mean, there's so many challenges, shortage of workforce, talent, you know, a changing uh tech environment, you know, pressure on budget, new CEOs, boards that are building up.
00:29:19.599 --> 00:29:23.920
Political issues at the executive leadership team level, never seen any of that.
00:29:24.160 --> 00:29:28.079
And political issues inside with your own organization, right?
00:29:28.319 --> 00:29:29.039
Backbiting.
00:29:29.119 --> 00:29:30.160
I mean, that's real world.
00:29:30.480 --> 00:29:33.440
So you make it sound like it's really peaceful.
00:29:33.599 --> 00:29:37.119
You know, the duck is above the you know, above the surface.
00:29:37.519 --> 00:29:42.559
But under the surface, the duck is legs, legs are crazy.
00:29:42.960 --> 00:29:45.359
Um I like a challenge.
00:29:45.440 --> 00:29:47.599
I mean, I like every personality is different.
00:29:47.759 --> 00:29:52.559
I don't like to be right, I like to execute correctly.
00:29:52.799 --> 00:29:54.880
Meaning that I don't have to be right.
00:29:55.119 --> 00:29:56.319
My team needs to be right.
00:29:56.400 --> 00:29:58.559
They better be right when I ask some damn questions.
00:29:58.799 --> 00:30:06.160
But at the end of the day, when I'm going in, you know, to a knife fight, I'm bringing an Uzi.
00:30:06.640 --> 00:30:06.880
Right?
00:30:07.039 --> 00:30:16.319
And I, you know, I'm gonna come with the right information, proof, evidence, and you know, a warrior mindset on this is this is what we're trying to accomplish and execute to.
00:30:16.400 --> 00:30:24.000
And whether there's politics are involved, I'll call out the politics, force people to put politics aside, and if that shames them, that shames them.
00:30:24.079 --> 00:30:26.559
But we're gonna move on and we're gonna talk about the facts.
00:30:26.720 --> 00:30:30.960
I've been grilled in court so many times as a federal law enforcement officer.
00:30:31.200 --> 00:30:34.720
I like like let's stick to the facts.
00:30:34.880 --> 00:30:41.680
And I I honestly, Jay, when you I to me, when you stick to the facts, it it takes the temperature down.
00:30:42.000 --> 00:30:44.720
It takes the silliness and the politics out of it.
00:30:44.799 --> 00:30:54.640
And and the worst the problem is, by the way, like let's take up like a product security flaw uh in a money movement platform or something like that, right?
00:30:54.880 --> 00:31:00.160
And you're dealing with the results of that or some automated fraud against the platform.
00:31:00.240 --> 00:31:05.279
So you're dealing with the incident, you're trying to recover dealing with law enforcement to do the investigation.
00:31:05.599 --> 00:31:16.960
And you know, you have the CEO and general counsel that's worried over here, and then you have the product owner that's trying to defend themselves, and you have the person that didn't fix the vulnerability, you know, yelling at everyone else.
00:31:17.119 --> 00:31:23.440
You're like, okay, look, let's stop, we're gonna deal with the incident, we're gonna stop the bleeding, making sure the patient's breathing.
00:31:23.680 --> 00:31:30.160
And and then, you know, once they're in the hospital, we're gonna start going back and figuring out what really happened, right?
00:31:30.240 --> 00:31:33.200
You you take that tone down.
00:31:33.440 --> 00:31:35.359
We're in a place that's really, really important.
00:31:35.519 --> 00:31:39.519
We do really important work to society and the way that we know that society works.
00:31:39.680 --> 00:31:42.160
And in some cases, it's truly life or death.
00:31:42.240 --> 00:31:51.839
You look at like some of these CISOs that are in charge of major airlines and you know, uh critical infrastructure and hospitals and train lines.
00:31:51.920 --> 00:31:53.200
That's really life and death.
00:31:53.359 --> 00:31:55.599
Most of the stuff we deal with every day is not life and death.
00:31:55.680 --> 00:31:55.759
Right.
00:31:55.920 --> 00:31:57.279
And so you is life and death.
00:31:57.359 --> 00:31:58.960
I mean, my kid, they cannot use TikTok.
00:31:59.039 --> 00:32:00.079
You're kidding me?
00:32:00.880 --> 00:32:01.680
That's insane.
00:32:02.480 --> 00:32:03.359
Are kids related?
00:32:05.839 --> 00:32:07.519
Tell me something about your personal life.
00:32:07.680 --> 00:32:11.119
When all this is going on, how long is this period?
00:32:11.359 --> 00:32:14.559
And what does what does the stress mean?
00:32:14.720 --> 00:32:15.440
So, two questions.
00:32:15.599 --> 00:32:22.400
Uh well, three, how long was this entire period where you had this Senate and congressional hearings that you have to be part of?
00:32:22.960 --> 00:32:25.119
Uh so I I assume a couple of months at least.
00:32:25.279 --> 00:32:30.640
And then what kind of stress do you take on to your on your personal self with your personal life?
00:32:30.720 --> 00:32:34.720
Yeah, because there's a tremendous amount of global lens on you.
00:32:34.880 --> 00:32:35.119
Yeah.
00:32:35.279 --> 00:32:36.400
And how did you manage it?
00:32:36.720 --> 00:32:38.720
It was it was probably a solid year.
00:32:38.799 --> 00:32:39.599
Uh a year.
00:32:40.000 --> 00:32:51.839
Yeah, of of uh well, I was in seat that there was because there was some crazy stuff being said, and and we dove in as any responsible company would, and you have to prove a negative, and you know, all of that sort of stuff.
00:32:52.000 --> 00:32:58.079
And then out of that came a lot of conversations with a lot of agencies, entities, and and governments around the world.
00:32:58.160 --> 00:32:59.039
So it was a lot.
00:32:59.279 --> 00:33:02.240
I like your question on how do you how do you deal with it?
00:33:02.400 --> 00:33:03.359
So two things changed.
00:33:03.680 --> 00:33:04.799
Like you lose sleep, right?
00:33:04.880 --> 00:33:06.799
Uh certainly breathe heavy.
00:33:06.880 --> 00:33:18.079
Uh you're a multinational organization, so you're dealing with building teams around the world, you're on a 12-hour clock, you're working, you know, seven in the morning to eleven at night sometimes.
00:33:18.240 --> 00:33:19.440
You know, it's interesting.
00:33:19.519 --> 00:33:26.079
It was a learning experience for me between cultures because the primary company uh was in Asia.
00:33:26.559 --> 00:33:40.640
And uh, you know, I'm trying to build a global, independent, and national security program for the United States all at the same time and maintain that connectivity uh to make sure we had uh good integration from a global point of view.
00:33:40.799 --> 00:33:48.720
So it was a lot of time, and you know, it messes with stuff like we should all focus on our sleep, our health, oh god, our exercise.
00:33:48.960 --> 00:33:54.400
People in these positions don't think of it as a physically intensive uh job, but it is.
00:33:54.559 --> 00:33:56.640
You have to be healthy to do this job.
00:33:56.799 --> 00:34:05.839
The pressure and the stress and the and the lack of sleep you often get and not knowing and how to do that, what makes up for that is is your physical conditioning and your mental conditioning.
00:34:06.000 --> 00:34:16.320
And so I think, you know, that was a huge issue for me was how do I maintain that level of physicality when you know I'm working so much.
00:34:16.559 --> 00:34:17.519
And how do you do that?
00:34:17.760 --> 00:34:19.360
I didn't for many, many months.
00:34:19.519 --> 00:34:22.880
And that's when stress kind of started to leak in.
00:34:23.039 --> 00:34:27.679
I've been preaching this for many years, and I started, you know, I said, what do you tell everyone else on your team?
00:34:27.920 --> 00:34:28.559
Start doing that.
00:34:28.719 --> 00:34:30.719
So I I started to carve out the time.
00:34:30.800 --> 00:34:32.480
And the other thing is, you know, family time.
00:34:32.639 --> 00:34:33.760
Family time is really important.
00:34:33.840 --> 00:34:35.920
Uh, you know, you have a life beyond work.
00:34:36.079 --> 00:34:40.639
Um, whether you have a family or you're single and or whatever your life is, you have a life beyond work.
00:34:40.880 --> 00:34:49.519
But at the back of your mind, you have this fact that I'm gonna be personally put forward to a testimony that I'm responsible for.
00:34:49.760 --> 00:34:55.599
It could be a slip of tongue, it could be, you know, you know, a mistake from a data, but I'm responsible.
00:34:55.760 --> 00:34:57.119
So that's a very overbearing.
00:34:57.840 --> 00:34:59.119
I don't think of it that way.
00:34:59.360 --> 00:35:00.320
I don't I actually don't.
00:35:00.480 --> 00:35:09.599
I think when when I think about um critical testimony, I have always felt that I'm not gonna do it unless I have a team behind me.
00:35:09.760 --> 00:35:14.559
I trust the people that are below me that are bringing me the information and validating it for me and showing the how.
00:35:14.719 --> 00:35:22.800
I trust the attorneys that I'm working with that uh understand the legal application of the issue and are gonna represent me in the room.
00:35:22.960 --> 00:35:33.440
And this is going to sound funny to you, with the exception of public bombastic uh politics show boating.
00:35:33.760 --> 00:35:41.840
I trust the people in these closed door sessions that are asking hard questions that they're doing it for the right reason.
00:35:42.400 --> 00:35:47.840
Um, and and not not in any specific country, because I've talked to multiple countries around the globe.
00:35:48.079 --> 00:35:50.079
Um I can remember testify.
00:35:50.159 --> 00:35:52.000
I won't tell you the country, I don't want them to go mad.
00:35:52.159 --> 00:35:55.599
A Senate select hearing in another country, in another part of the world.
00:35:55.679 --> 00:36:00.559
They were like the exact opposite time uh around the world.
00:36:00.719 --> 00:36:04.000
Um, and I was on Zoom, I didn't have to fly out.
00:36:04.159 --> 00:36:07.760
And uh I'm wearing shorts and a suit and tie on top.
00:36:10.079 --> 00:36:12.559
That would not be something that is new.
00:36:12.719 --> 00:36:13.679
I think I'm gonna be able to do that.
00:36:14.719 --> 00:36:15.760
It was the first time for me.
00:36:16.000 --> 00:36:18.159
Yeah, I I I have faith in people.
00:36:18.320 --> 00:36:29.519
Uh and and so I go into it trusting that I have a great team with me, and I don't feel like even if I say a wrong word or what have you, that I'm gonna be left.
00:36:29.679 --> 00:36:32.159
I wouldn't work for an organization that I didn't believe had my back.
00:36:32.400 --> 00:36:33.679
So, final two questions.
00:36:33.760 --> 00:36:37.519
Uh that there's so many interesting things to talk about, but final two questions.
00:36:37.679 --> 00:36:42.719
One, during this controversy, you have to maintain the morale of your team.
00:36:43.519 --> 00:36:44.400
How do you do that?
00:36:44.719 --> 00:36:44.960
Mission.
00:36:45.119 --> 00:36:46.159
One word, mission.
00:36:46.320 --> 00:36:49.920
They know every day they get up, they know the mission of our organization.
00:36:50.079 --> 00:37:03.920
That mission is to protect, you know, 100, 200, 300 million people from any given country, 3 billion people on platform, the amount of small businesses that are being developed around the world so people can prosper, they know what they're protecting every day.
00:37:04.079 --> 00:37:08.239
Whatever your company is, your people need to know the mission and be able to articulate it.
00:37:08.400 --> 00:37:13.440
Every day they got up, they got up because they were happy to do this work, because they wanted to do that mission.
00:37:13.599 --> 00:37:14.960
That's how you keep them motivated.
00:37:15.119 --> 00:37:15.599
Nothing else.
00:37:15.679 --> 00:37:16.880
I found nothing else in the world.
00:37:16.960 --> 00:37:18.880
You can throw as much money as you want at them.
00:37:19.119 --> 00:37:22.480
If they're not into the mission, they're gonna go to the next place to try to make more money.
00:37:22.639 --> 00:37:23.039
Let them.
00:37:23.360 --> 00:37:23.599
Right?
00:37:23.760 --> 00:37:25.599
You want mission-minded people.
00:37:25.840 --> 00:37:26.400
Fantastic.
00:37:26.559 --> 00:37:27.920
So, final question.
00:37:28.159 --> 00:37:30.719
You sound like a perfect CISO.
00:37:31.199 --> 00:37:33.360
What was your life's biggest failure?
00:37:33.599 --> 00:37:35.519
And what did you learn out of it?
00:37:35.920 --> 00:37:37.280
Life's biggest failure.
00:37:37.599 --> 00:37:38.239
As a CISO.
00:37:38.400 --> 00:37:39.360
Oh, as a CISO?
00:37:39.599 --> 00:37:40.000
Yeah.
00:37:40.320 --> 00:37:44.320
Apart from the fact that you didn't come to my show earlier, but you know, I'll forgive you.
00:37:44.639 --> 00:37:45.840
I thought I had an invitation.
00:37:46.000 --> 00:37:46.239
All right.
00:37:46.639 --> 00:37:50.400
Uh no, I'll go back to TikTok and bite dance.
00:37:50.719 --> 00:37:51.440
I love what I do.
00:37:51.519 --> 00:37:55.440
I've done it for very large companies around the globe and multiple times.
00:37:55.599 --> 00:37:58.320
And I have a somewhat of a specific playbook.
00:37:58.400 --> 00:38:01.599
Uh, it's not exact, and no business, no two businesses are alike.
00:38:02.400 --> 00:38:13.119
And normally I take the time to step back and think about the implementation of it and and the impact and learn the company a little bit more.
00:38:13.280 --> 00:38:15.039
We were in the middle of COVID at the time.
00:38:15.119 --> 00:38:19.360
We had I I started April 1st of 2020.
00:38:19.519 --> 00:38:22.000
So it was smack dab in the middle of COVID.
00:38:22.239 --> 00:38:27.039
I didn't have the ability to go fly here or fly there.
00:38:27.199 --> 00:38:30.639
Normally I go around the world, you know, three or four times a year.
00:38:30.800 --> 00:38:38.320
And I just didn't have the ability to do that, number one, and I still made decisions without having it.
00:38:38.559 --> 00:38:40.960
I I I wish I would have had more time.
00:38:41.119 --> 00:38:52.400
So my my failure is applying a playbook without the level of due diligence and transparency necessary to make the right decisions about the strategic operations you're developing.
00:38:52.719 --> 00:39:04.400
And uh, you know, that that was, you know, three years into it as I'm building both a global program and a national security program for the US, I realized it didn't fit the company.
00:39:04.559 --> 00:39:11.840
So, I mean that that was probably being a CISO, one of my biggest things I look back and I say, I'll never do that again.
00:39:12.159 --> 00:39:12.480
Wow.
00:39:12.639 --> 00:39:15.039
Roland, it's been a pleasure having you on the show.
00:39:15.280 --> 00:39:15.760
Thanks for having me.
00:39:16.239 --> 00:39:17.039
Thank you for coming.
00:39:17.280 --> 00:39:24.320
That was my guest, Roland Clôtier, the former CISO of ByDance, the company that ran TikTok.
00:39:24.800 --> 00:39:27.840
He ran a platform with over three billion people.
00:39:28.079 --> 00:39:29.519
Think of that for a second.
00:39:29.679 --> 00:39:35.760
If you like this episode, please share and like and subscribe to the Cybersecurity Podcast by C Council.
00:39:35.920 --> 00:39:37.920
I'll see you again on the next show.
00:39:38.159 --> 00:39:39.599
Till then, goodbye.
00:39:39.760 --> 00:39:41.119
This is J Bar VC.
00:39:41.280 --> 00:39:41.840
Checking out.
00:00:05.839 --> 00:00:09.039
Welcome to the cybersecurity podcast by EC Council.
00:00:09.359 --> 00:00:11.519
I'm Jay Bavisi, your host.
00:00:11.919 --> 00:00:19.440
This is where we have some of the deepest meaningful conversations with some of the movers and shakers of the cybersecurity industry.
00:00:19.920 --> 00:00:25.440
My guest today managed a platform that was used by over 3 billion people.
00:00:26.160 --> 00:00:27.600
Think of that for a second.
00:00:28.079 --> 00:00:34.880
Not just that, he was subject to congressional and Senate hearings and an international ban.
00:00:35.359 --> 00:00:38.240
The questions that we ask here are not theoretical.
00:00:38.560 --> 00:00:41.359
They are about cybersecurity leadership at its finest.
00:00:41.759 --> 00:00:46.000
How do you manage an organization when the stakes are so high?
00:00:46.320 --> 00:00:55.520
If you're in cybersecurity, you lead an organization or you're part of a board, this conversation is not optional, it's mandatory.
00:00:55.759 --> 00:00:58.320
Please welcome Roland Clautier.
00:00:58.640 --> 00:00:59.600
Thank you, sir, for having me.
00:00:59.840 --> 00:01:00.560
It's great to be here.
00:01:00.799 --> 00:01:01.039
Thank you.
00:01:01.200 --> 00:01:02.479
Thank you for being here, Roland.
00:01:02.719 --> 00:01:08.400
Running a platform with three billion people is not something that everyone can actually uh claim that they have done.
00:01:08.799 --> 00:01:10.480
I don't know who's crazy enough to do that.
00:01:11.280 --> 00:01:13.680
Let's start by talking about you as a person.
00:01:14.079 --> 00:01:16.319
How did you get into cybersecurity?
00:01:16.480 --> 00:01:19.040
And uh, you know, what's your what's your journey been like?
00:01:19.280 --> 00:01:22.239
Uh actually, I came from the total opposite side of security.
00:01:22.400 --> 00:01:32.239
I was in uh the military and worked for the Department of Defense in aerospace defense as a combat security policeman and um essentially a raven on military aircraft.
00:01:32.319 --> 00:01:33.920
And then I got into federal law enforcement.
00:01:34.000 --> 00:01:41.280
But what what started happening is criminal and civil investigations in those realms really started at having a lot of computer stuff.
00:01:41.519 --> 00:01:43.840
And uh I couldn't even spell computer at the time.
00:01:43.920 --> 00:01:50.640
So I went back to university and uh really focused on computer science and then discovered I loved it.
00:01:50.799 --> 00:02:11.680
Like, you know, I had tech at heart, and um uh when I graduated uh from BU, I decided to put my toe into the dark world of commercialism coming out of uh federal law enforcement and you know, just jumped into what was doing stopping bad guys.
00:02:11.759 --> 00:02:13.120
It was the same thing as in law enforcement.
00:02:13.280 --> 00:02:16.719
You're stopping bad guys, you're chasing, you know, you're securing things, you're protecting stuff.
00:02:16.800 --> 00:02:22.319
You could have an entire career doing what I was doing with technology, and oh yeah, it doubled my paycheck when I left.
00:02:22.400 --> 00:02:23.280
So it wasn't too bad.
00:02:23.360 --> 00:02:24.800
And and I've been having fun since.
00:02:24.960 --> 00:02:28.240
I've uh you know found I had a knack for team building.
00:02:28.319 --> 00:02:42.800
I think my military experience uh really helped me figure out how to create high-performing teams, and doing that in a commercial sense really makes you pretty successful in this business.
00:02:43.039 --> 00:02:44.240
So let's talk about that a little bit.
00:02:44.400 --> 00:03:00.879
CISOs are the uh people that in the organization that get blamed all the time whenever there is a security problem, and that's why it's a job that not many people you know hang on to for a long time in an organization, and it's sad, but a CISO is not able to function without high-performing teams.
00:03:01.120 --> 00:03:05.120
So, what would be your advice to CISOs out there?
00:03:05.199 --> 00:03:06.400
You know, how did you do that?
00:03:06.560 --> 00:03:11.919
Because you have a high-stake platform that cannot come down, is used by three billion people, right?
00:03:12.080 --> 00:03:17.840
And what are the lessons that you have uh learned over the years that you are able to share to our audience?
00:03:18.080 --> 00:03:21.199
I I think first and foremost, there's a mindset that CISOs have to have.
00:03:21.280 --> 00:03:29.039
And I want to go back to that, Jay, the kind of the first thing you talked about, which was that some CISOs don't last long in this field because they're always getting blamed for things.
00:03:29.280 --> 00:03:31.680
People that do this work are passionate.
00:03:31.840 --> 00:03:38.960
They're passionate about defending, they're passionate about doing the right thing, they're passionate about engaging their business to do it, you know, to do what's right.
00:03:39.120 --> 00:03:44.159
And oftentimes they blame themselves more than other people blame them.
00:03:44.400 --> 00:04:00.400
And so I think when individuals can change the mindset to saying, I'm engaged with the business, I provided incredible transparency, good advice, and options, and it's the business's decision on what they want to do or not do.
00:04:00.639 --> 00:04:02.159
And we all agree with that.
00:04:02.319 --> 00:04:11.840
So, meaning I operate in the sense of the executive leadership team or the broader context of the leadership within the business, and it's the business that makes decisions.
00:04:12.000 --> 00:04:16.319
When we hold the decisions to ourselves, that's typically when things go wrong.
00:04:16.480 --> 00:04:20.639
So, number one is change your mindset, become a business leader.
00:04:20.879 --> 00:04:24.720
Now, with regards to how to build teams, I think everybody does it a little differently.
00:04:24.879 --> 00:04:26.480
Every leader is a little bit different.
00:04:26.639 --> 00:04:30.319
I like to have what it's kind of funny in this work, but I call a command staff.
00:04:30.399 --> 00:04:40.000
I believe that I should have strong men and women that enjoy being leaders, that understand their jobs, and can operate under high pressure.
00:04:40.079 --> 00:04:41.519
So those are the people I seek.
00:04:41.759 --> 00:04:45.759
The second thing I seek is people that want to do different jobs.
00:04:46.000 --> 00:04:51.839
Typically, if you're on my leadership team, my command staff, you are probably going to move jobs every two or three years.
00:04:52.079 --> 00:05:01.759
I want a well-rounded practitioner that can support the man or woman to their left or to their right and can be the backup to another person on the team should there be a problem.
00:05:01.920 --> 00:05:09.839
So I build extremely strong teams with independent accountability and authority to go do their jobs.
00:05:10.160 --> 00:05:19.360
And in that sense, you end up creating an organization that understands how to function closer and closer to where they're defending against the bad guys.
00:05:19.439 --> 00:05:21.439
And that's just the style I've taken.
00:05:21.600 --> 00:05:28.079
It's come through years of seeing really good leadership in different organizations, and I think that's a starting point.
00:05:28.319 --> 00:05:34.560
So I want to come back real quickly to the earlier point that you talked about that you know, speak the business language, absolutely correct.
00:05:34.639 --> 00:05:35.439
I agree with you.
00:05:35.600 --> 00:05:38.399
And the fact that is the business that has to decide.
00:05:38.639 --> 00:05:46.959
But when you run a critical software or platform, and the business says, Look, we need speed, we need agility, we gotta launch now.
00:05:47.040 --> 00:05:48.240
The competitors are coming out.
00:05:48.319 --> 00:05:49.839
Take a look at what's happening AI.
00:05:49.920 --> 00:05:52.079
Take a look at RSA, where we are, right?
00:05:52.319 --> 00:05:59.360
Everyone has AI, companies have AI now, they've rebranded their company names to add AI at the end of it to just to show relevance.
00:05:59.680 --> 00:06:02.000
That only took six minutes to say AI, I think.
00:06:02.879 --> 00:06:03.759
Not bad.
00:06:04.079 --> 00:06:14.959
And and the challenge there would have would be when something goes wrong, the blame is going to come to the CISO, whether or not the CISO has said or warned ahead of time that this is not the right way.
00:06:15.199 --> 00:06:19.040
So while theoretically, you know, and I might challenge you a little bit, right?
00:06:19.279 --> 00:06:28.480
Theoretically, it might be fair to say that, hey, I will want the business owners to say these are the risks, but CISOs have other balls in the air that they have to juggle.
00:06:28.560 --> 00:06:35.759
They have compliance, they have governance, they have the bot to respond, and ultimately, when something happens, they fall on the sword.
00:06:36.079 --> 00:06:38.160
Uh, what do you think of that statement that I've just made?
00:06:38.240 --> 00:06:39.040
You know, would you agree?
00:06:39.120 --> 00:06:41.839
And and so how do you navigate those turbulent waters?
00:06:42.079 --> 00:06:43.199
Let's stick with AI for a second.
00:06:43.279 --> 00:06:44.639
I mean, you brought it up, you want to focus.
00:06:44.800 --> 00:06:45.759
I'm I'm I'm all in.
00:06:45.920 --> 00:06:46.959
First of all, I love AI.
00:06:47.040 --> 00:06:59.040
I think the things that I learned at TikTok were simply amazing in the realm of what it can actually provide for the customer base of the organization you're serving.
00:06:59.360 --> 00:07:05.040
It is an incredible technology, and now that I'm actually deeper into it, I really see the advancements.
00:07:05.120 --> 00:07:09.040
But let's talk about it from CISO's perspective, because I think that's the most important point.
00:07:09.360 --> 00:07:18.160
You have to remember that CISO has three jobs when it comes to AI, and they're all very important, and I don't think I can measure one over the other.
00:07:18.399 --> 00:07:25.120
The first one is they have to enable AI for the business to use it at the speed that they have to compete in a global market, period.
00:07:25.439 --> 00:07:26.160
Or none.
00:07:26.319 --> 00:07:26.639
Right?
00:07:26.800 --> 00:07:31.680
This isn't about setting up standards and setting up governance.
00:07:31.839 --> 00:07:34.160
I mean, it's all in there, all that has to happen.
00:07:34.240 --> 00:07:43.519
But at the end of the day, the CISO has to be focused and engaged in ensuring the organization can use the technology it is necessary to be successful and win in the market.
00:07:43.759 --> 00:07:45.439
So that's job one.
00:07:45.519 --> 00:07:46.319
How do I do that?
00:07:46.560 --> 00:07:49.199
Job two, I have to protect from AI attacks.
00:07:49.360 --> 00:08:01.360
You know, I remember four or five years ago when you're in an advanced technology company and you know, one of the big techs or one of the big platforms, that it's not we get attacked 275, you know, times uh a day.
00:08:01.439 --> 00:08:04.319
It's like you know, 200,000 times a day.
00:08:04.639 --> 00:08:08.319
You really have to understand what's coming at you.
00:08:08.480 --> 00:08:17.839
And we would see early onset of AI-based attacks against our platform based on the controls we implemented at any given time in the attempted workarounds.
00:08:17.920 --> 00:08:19.759
And you could just see the automation behind it.
00:08:19.839 --> 00:08:26.959
Like Jimmy behind the keyboard in his mom's basement isn't going to be making those changes in sub-second parallels, right?
00:08:27.040 --> 00:08:27.759
It's not happening.
00:08:27.839 --> 00:08:32.559
That's pure automation against a controller you just implemented, and it's testing its new attack against you.
00:08:32.720 --> 00:08:34.000
That was four years ago.
00:08:34.240 --> 00:08:48.799
So, what I'm saying is the world has changed, our defensive posture needs to change, and our mechanisms and capabilities to defend against AI have to be, you know, just right up front because our entire organization is going to change, and I'll get to that in a second.
00:08:48.879 --> 00:08:52.960
But then so you got to enable the business to use it, you've got to know you're gonna get attacked by it.
00:08:53.120 --> 00:08:54.720
How are you going to defend against it?
00:08:54.879 --> 00:08:57.039
And the third is you're a business person.
00:08:57.200 --> 00:08:57.600
You're right.
00:08:57.679 --> 00:09:02.320
If you're truly a CISO in today's world, you're a business operations protection executive.
00:09:02.480 --> 00:09:08.879
You belong in a company, and you may have 50 to 500 practitioners to a thousand practitioners in your organization.
00:09:09.039 --> 00:09:14.159
If you've got a budget like a large, you know, global, maybe it's$50 million to protect your organization.
00:09:14.320 --> 00:09:16.159
But that's a company ready to go public.
00:09:16.240 --> 00:09:17.360
You're running a business.
00:09:17.600 --> 00:09:20.159
You have to do your business better with AI.
00:09:20.399 --> 00:09:26.960
What is your 10x plan to use AI to be a better business leader in your company?
00:09:27.279 --> 00:09:32.639
Make sure that your operations run more succinctly, you're achieving better cost containment, right?
00:09:32.799 --> 00:09:38.240
All of those things that every other business person in the business is being measured on, you need to be measured on.
00:09:38.399 --> 00:09:41.840
So three very different jobs, all focused on AI.
00:09:42.399 --> 00:09:47.679
And that is how you truly align and become a business partner with the company.
00:09:47.759 --> 00:09:52.159
You're taking accountability, you're driving them forward, and you're protecting them.
00:09:52.320 --> 00:10:00.480
And I think when you do those things right, and you know, with almost anything, that it's not let's go blame the CISO, it's how do we support the CISO?
00:10:00.799 --> 00:10:03.279
So let's unpack a lot of things that you've talked about.
00:10:03.440 --> 00:10:10.720
If we look globally right now, you're seeing many organizations have chief AI offices that are that are beginning to be hired.
00:10:11.360 --> 00:10:15.200
Chief AI, chief CTOs, EIOs, yeah.
00:10:15.519 --> 00:10:15.679
Right.
00:10:15.759 --> 00:10:19.039
And then you have got CTOs, you have CIOs, you have CISOs, right?
00:10:19.120 --> 00:10:22.720
So you said that CISOs have three jobs, but is it really fair?
00:10:22.879 --> 00:10:26.480
Because I mean, you've been a CISO yourself and you're advising CISOs today.
00:10:26.720 --> 00:10:28.320
CISOs already have a lot to do.
00:10:28.639 --> 00:10:47.039
They have to protect the infrastructure, they have to deal with program management, they've got security operations going on, and you know, now comes a whole layer of AI, and the business use case is tremendous because if you're not using AI, then your board and your CEO, and if you're publicly listed, your stockholder valuations all impacted to AI.
00:10:47.200 --> 00:10:51.200
You know, but you are asked to defend against an pretty much unknown.
00:10:51.919 --> 00:10:53.759
Ask the question a different way.
00:10:54.000 --> 00:10:57.840
Is it fair to the CEO that now he has to drive a company of AI?
00:10:58.080 --> 00:11:00.000
Like, I mean, what's fair?
00:11:00.159 --> 00:11:15.919
I mean, at the end of the day, if my job is business operations protection and the technology they chose to use today is AI to drive it, then it as part of the resiliency, protection, and assurety of the company, yeah, it's my responsibility.
00:11:16.080 --> 00:11:17.279
It might cost the company more.
00:11:17.360 --> 00:11:18.559
They may have to make some decisions.
00:11:18.720 --> 00:11:24.240
We might have to not do some things, and the business will have to make some joint decisions on whether or not we do certain things.
00:11:24.399 --> 00:11:25.919
But yeah, I think it's fair.
00:11:26.080 --> 00:11:33.279
I think as long as you want to sit in this seat that you have to understand that the world's going to change.
00:11:33.440 --> 00:11:40.080
Like when, you know, the first time, it was probably 2015 we started talking about cloud, maybe 2014.
00:11:40.240 --> 00:11:43.279
You know, we operated in the organization I was in at the time.
00:11:43.360 --> 00:11:46.879
We operated in six major data centers around the world.
00:11:47.120 --> 00:11:48.799
We had just lost one to fire.
00:11:48.879 --> 00:11:52.799
I mean, it was like it was crazy times and big honking data centers.
00:11:52.879 --> 00:11:57.120
And they were like, hey, we're gonna build that product and we're gonna put it in a cloud.
00:11:58.080 --> 00:11:58.399
Okay.
00:11:59.120 --> 00:12:00.240
What do you want me to do?
00:12:00.320 --> 00:12:00.559
Right?
00:12:00.639 --> 00:12:06.399
Like, the next thing you know, hey, we're gonna transfer these two data centers holistically into cloud.
00:12:06.639 --> 00:12:08.000
This wasn't lift and shift.
00:12:08.159 --> 00:12:10.799
This was dynamically changed how we do business.
00:12:11.039 --> 00:12:22.240
And I didn't have cloud security engineers at the time, I didn't have cloud defense technologies, the big platform providers didn't have integrated threat management or monitoring capabilities.
00:12:22.320 --> 00:12:25.039
You could shim in and pull stuff out, but I mean it was painful.
00:12:25.200 --> 00:12:32.000
I mean, 2015 to you know, 2020 trying to do mass migrations was painful.
00:12:32.159 --> 00:12:33.200
But that was my job.
00:12:33.440 --> 00:12:35.840
And so I kind of take it the same thing with AI.
00:12:35.919 --> 00:12:36.960
It's going to be painful.
00:12:37.039 --> 00:12:45.519
We're gonna have amazing partners in the industry, we're gonna have incredible new companies that stand up that are actually gonna make us more secure and do do our jobs better.
00:12:45.679 --> 00:12:49.039
So I'm actually hopeful, and and I think that, yeah, it's fair.
00:12:49.200 --> 00:12:54.000
If I chose to protect the company, then I need to protect what they need to do their jobs.
00:12:54.320 --> 00:13:16.879
So there's there's some uh conversations happening at RSA here where they're saying that when it comes to AI, because AI implementation is so close to the business, it should probably be the implementation of AI and the and the evaluation of AI should be part of the BSOs at the business units, where else the CISOs are actually you know too far away from the business, right?
00:13:17.039 --> 00:13:22.159
Now, in a large organization, you know, my national reaction would be how many companies have BSOs to begin with?
00:13:22.639 --> 00:13:27.360
I was about to say that's right, it's maybe 12% of the major multinationals out there have a BISO model.
00:13:27.519 --> 00:13:28.879
Right, right, right, exactly.
00:13:29.039 --> 00:13:32.720
So so I guess in absence of that, I think that your answer is probably gonna be.
00:13:33.039 --> 00:13:38.639
But no, I I like where the conversation's going though, because you know, uh, shift left worked, right?
00:13:38.720 --> 00:13:38.799
Right.
00:13:39.039 --> 00:13:53.679
So when we started saying, there's no way I'm gonna take a code defense and product security organization and now take over responsibility for all good quality, assured secure code for a company that's doing 40 million lines of code a day.
00:13:53.919 --> 00:13:55.440
Like, it's crazy.
00:13:55.600 --> 00:13:57.200
It's just not gonna happen, right?
00:13:57.279 --> 00:13:58.879
Like, so how do you do it?
00:13:58.960 --> 00:14:06.960
You enable tools training, capability access, and we get transparency and independent testing analysis and output of tools.
00:14:07.039 --> 00:14:14.000
So we have a view of what's going on, what the quality looks like, they have the tools to do it right, and you shift left, left, left.
00:14:14.159 --> 00:14:17.279
I think we start as far to the left as possible.
00:14:17.440 --> 00:14:25.120
I'm seeing technologies here and other things I'm looking at that sit on the wire and look at intent of actions.
00:14:25.279 --> 00:14:39.919
I see technology here uh that came and spurned out of the ASPM world that is doing at time of coding both machine-generated code and human-generated code at the time it's being developed to show flaws or issues.
00:14:40.080 --> 00:14:41.759
So we're we're catching it earlier.
00:14:41.919 --> 00:14:44.559
I think we keep shifting left, and I think we do the same thing with AI.
00:14:44.799 --> 00:14:45.360
Fantastic.
00:14:45.519 --> 00:14:46.720
So let's talk about AI.
00:14:46.799 --> 00:14:50.240
There's a lot to talk about, but there's the data that's gonna be a thing, right?
00:14:50.399 --> 00:14:52.559
Yeah, it probably already is a thing.
00:14:52.879 --> 00:15:03.440
Last year, everyone was rushing into implementation of AI, and this year I see a lot of conversations around governance of AI and you know, ethical governance of AI.
00:15:03.600 --> 00:15:05.519
Now, let me put this in context for you.
00:15:05.679 --> 00:15:09.120
The European Union has already launched uh the EU AI Act, right?
00:15:09.200 --> 00:15:10.559
Uh scorecard.
00:15:10.879 --> 00:15:14.799
Yeah, there's ISO 42001, there's NISER, right?
00:15:14.960 --> 00:15:15.039
Yeah.
00:15:15.200 --> 00:15:15.919
Those are already there.
00:15:16.000 --> 00:15:16.159
Sure.
00:15:16.320 --> 00:15:18.639
But it's not been mandated in the US yet.
00:15:18.720 --> 00:15:20.240
I think the direction is moving there.
00:15:20.320 --> 00:15:20.639
Yeah.
00:15:20.879 --> 00:15:27.200
But 72 countries have already implemented governance frameworks or regulations around AI.
00:15:27.360 --> 00:15:28.240
So this is coming.
00:15:28.320 --> 00:15:29.759
There's no question about this.
00:15:29.919 --> 00:15:33.679
How should AC so prepare for what's coming ahead of them?
00:15:34.000 --> 00:15:39.519
I love this question because I think it is very forward-looking.
00:15:39.600 --> 00:15:54.399
And I hope the people that uh hear and see this podcast really take this to heart because it is coming, they need to do it now, and they need to instrument their pipelines and their capabilities and the services they're delivering back with these services.
00:15:54.559 --> 00:16:08.399
So I truly believe, and I, you know, there are a couple great companies out there that are doing generative AI, LLM, pipeline review, infrastructure review, creating scorecards for you, then aligning them to the different countries which you operate in.
00:16:08.480 --> 00:16:08.960
Do it now.
00:16:09.039 --> 00:16:11.440
You don't have to do it, the AI is gonna do it for you.
00:16:11.600 --> 00:16:21.200
You know, it it get away from the old GRC model in your head where, oh my God, I gotta get 15 more people to get 32 more spreadsheets and put something new in Archer.
00:16:21.360 --> 00:16:22.399
I love Archer, don't get me wrong.
00:16:22.480 --> 00:16:41.759
I'm not complaining about Archer, but my point being is that there are new ways to do this in a very automated fashion that give you assurance validation, red teaming, and compliance and scorecarding for every product, every time someone runs a new, you know, creates a new pipeline and a new output of your AI models.
00:16:41.919 --> 00:16:42.320
Do it.
00:16:42.480 --> 00:16:44.000
Do it today, make it part of your baseline.
00:16:44.240 --> 00:16:45.519
But they don't have the people.
00:16:46.080 --> 00:16:47.440
The systems do it for you.
00:16:47.519 --> 00:16:49.519
I mean, you know, and you still need people, right?
00:16:49.600 --> 00:16:52.399
Because Do you need a firewall, you know, engineer 101?
00:16:52.559 --> 00:17:04.880
Do you need a third-party risk engineer, or can you go to a company outside that can do the collective analysis of all your third parties and dump it for you and prioritize it into your SIM environment for an operational, for a risk ops view, right?
00:17:05.039 --> 00:17:07.200
Like change your operations.
00:17:07.839 --> 00:17:10.240
Your operations will need to change with AI.
00:17:10.400 --> 00:17:18.079
Start thinking strategically about the programs you need people for, what you need people for, and what you don't.
00:17:18.240 --> 00:17:27.039
And then use appropriate funding to convert those over to AI automation and use the people for the right things.
00:17:27.359 --> 00:17:32.960
It's gonna require a strategic organizational shift, just like it did with cloud, right?
00:17:33.119 --> 00:17:39.759
You're sure you have now most organizations have more cloud security engineers, architects, and automated systems that do security better.
00:17:39.920 --> 00:17:43.519
I'm excited, you know, when people say we're going over to cloud, good, about time.
00:17:43.599 --> 00:17:46.640
Better controls, faster controls, more complete awareness.
00:17:46.720 --> 00:17:47.599
Have a nice day.
00:17:47.759 --> 00:17:48.160
Move on.
00:17:48.480 --> 00:17:53.119
Do you think AI is going to eat human jobs in cybersecurity?
00:17:53.440 --> 00:17:54.960
Or do you think expand it?
00:17:55.200 --> 00:17:57.359
Oh no, I mean I it's gonna expand it.
00:17:57.440 --> 00:17:58.079
I mean why?
00:17:58.160 --> 00:18:00.000
Because we're going to agents can do everything.
00:18:00.079 --> 00:18:01.200
I mean, there's an agent for everything.
00:18:01.279 --> 00:18:02.400
They're robots for everything.
00:18:02.720 --> 00:18:09.519
But but output validation assumptions in alignment to the business, understanding the context of the data assets they're accessing.
00:18:09.680 --> 00:18:12.720
I mean, did you have data sciences people on your team?
00:18:12.960 --> 00:18:23.519
No, but there's gonna be a certified data science defense specialist coming out of your company pretty soon that people are gonna go get certified for because they don't have people that know how to do that, right?
00:18:23.759 --> 00:18:32.160
We didn't go look at Caltech or any of the polys to go steal people from data sciences programs to staff our organizations because we didn't need them before.
00:18:32.319 --> 00:18:34.160
AI pipelines, same issue.
00:18:34.319 --> 00:18:37.599
You ask somebody, can you talk to me about what an AI pipeline looks like?
00:18:37.759 --> 00:18:42.079
And they have no idea on what the actual structure of an AI pipeline.
00:18:42.240 --> 00:18:46.319
They know that there's AI algorithms and they know that there's certain things.
00:18:46.480 --> 00:18:53.839
Maybe they even read up on MITAR Atlas and know the 12 different domains associated, you know, with it, but they've probably never built it.
00:18:53.920 --> 00:19:08.880
So now we're gonna be hiring AI-specific people that are AI defenders that are gonna take the output of this information, help with architecture, deliver engineering specific to it, understand AI threat attacks in stack and in pipeline.
00:19:09.039 --> 00:19:10.480
Do you have anyone that can do that today?
00:19:10.640 --> 00:19:11.279
Probably not.
00:19:11.440 --> 00:19:12.640
The jobs will change.
00:19:12.799 --> 00:19:23.599
What is super cool is that it's going to be better toolage, it's going to be more meaningful work that practitioners will do.
00:19:23.759 --> 00:19:28.720
I'm sorry to say it to the GRC and the third-party risk teams, but those jobs are not going to exist.
00:19:28.880 --> 00:19:29.759
They just aren't.
00:19:30.000 --> 00:19:31.200
I mean, think about it.
00:19:31.359 --> 00:19:51.359
If I can have a system that understands where my business data moves to, who my third parties are, and that I have an external threat advisory capability from a third party, and I do that at speed and understand the controls inside my organization and the validity of their controls through a technical hub, and then that provides me an active threat review.
00:19:51.759 --> 00:19:53.440
Why do I need a person doing that?
00:19:53.599 --> 00:19:56.960
I've got validation, I've got proof, and it's and it's it's immediate.
00:19:57.119 --> 00:20:08.400
So there's just some whole areas of our practitionership that will go away, but there are these big new bubbles of work that are coming up that we don't have anybody in there.
00:20:08.559 --> 00:20:15.039
And if someone wants to be really successful, they start thinking three, five years down and start training themselves for it.
00:20:15.279 --> 00:20:29.119
So you would say a new career like offensive AI security professional will be important for Rit Teamers, where they are actually training in attacking LLMs and being able to protect AI systems that their organization use, or AI program management, for example.
00:20:29.599 --> 00:20:39.279
Or understanding how technology is being used to create the threats to attack, validating the information coming out of the test, and then building controls.
00:20:39.440 --> 00:20:42.960
We'll see they won't have one job, they'll have multiple jobs.
00:20:43.119 --> 00:20:53.200
All of a sudden, it'll become an AI threat control defense engineer at the same time that they're taking the output from red teaming platforms, even red teaming, you know, on AI.
00:20:53.279 --> 00:20:56.559
I mean, think of what you know was released in the last couple of weeks, right?
00:20:56.799 --> 00:21:00.240
Right, you know, around threat development using AI.
00:21:00.480 --> 00:21:02.079
Scary, but great.
00:21:02.240 --> 00:21:02.640
Right?
00:21:02.799 --> 00:21:03.119
Okay.
00:21:03.359 --> 00:21:06.960
Well, I don't need 50 pen testers to do that anymore.
00:21:07.200 --> 00:21:21.119
But I'm going to need someone to help me understand what type of code I have, what type of pipeline infrastructure, how that integrates, third, fourth, fifth party pipelines that I'm integrating into, what is my infrastructure associated with my AIs?
00:21:21.279 --> 00:21:24.240
I mean, do you have an API engineer in your security organization?
00:21:24.319 --> 00:21:26.319
That's going to be really important shortly, right?
00:21:26.400 --> 00:21:28.079
Like, how are we managing APIs?
00:21:28.319 --> 00:21:30.000
Context-based defense, right?
00:21:30.079 --> 00:21:38.240
How does it agentic things integrate into my data, into my APIs, into my general network architecture, right?
00:21:38.400 --> 00:21:40.559
Does anybody in your organization understand that today?
00:21:40.720 --> 00:21:40.880
No.
00:21:41.039 --> 00:21:41.920
But they're better tomorrow.
00:21:42.160 --> 00:21:47.440
So basically, your point is an entire morphed industry where new jobs are coming in.
00:21:47.599 --> 00:21:50.960
Traditional pen testers have to be upskilled to keeping up with times.
00:21:51.119 --> 00:21:54.000
Red teaming will change because of the context of AI.
00:21:54.160 --> 00:21:55.519
Governance is going to change.
00:21:55.680 --> 00:21:59.759
So we just have to be prepared to be agile and to morph into new roles.
00:22:00.000 --> 00:22:00.960
Can I get an amen?
00:22:01.279 --> 00:22:01.599
Right.
00:22:02.079 --> 00:22:02.880
Fantastic.
00:22:03.119 --> 00:22:06.960
Let's talk about some difficult moments in your life, right?
00:22:07.279 --> 00:22:11.119
You were the CISO of Byte Dance during the entire TikTok.
00:22:11.599 --> 00:22:14.000
The early days of their growth cycle.
00:22:14.559 --> 00:22:18.720
The early days of the growth cycle, shall I say, the TikTok controversy or challenges that you face.
00:22:19.119 --> 00:22:25.039
You went through a very difficult time wading through very challenging situations.
00:22:25.359 --> 00:22:27.839
Congressional and Senate testimonies.
00:22:27.920 --> 00:22:29.119
I mean, that's not easy.
00:22:29.440 --> 00:22:36.160
Take us through your mindset when you were faced with a subpoena, right?
00:22:36.400 --> 00:22:39.680
Because a lot of CISOs out there, I mean, regulations are getting tough.
00:22:39.759 --> 00:22:41.759
They're going to be called by regulators every now and then.
00:22:41.839 --> 00:22:44.400
And I can't imagine another better example than you.
00:22:44.640 --> 00:22:45.359
Because I mean still.
00:22:45.599 --> 00:22:46.400
There are a lot of questions.
00:22:46.640 --> 00:22:46.880
Right?
00:22:47.440 --> 00:22:48.000
Exactly.
00:22:48.160 --> 00:22:49.519
So what was it like?
00:22:49.680 --> 00:22:51.759
How how did you navigate through that moment?
00:22:52.000 --> 00:22:55.599
Truth, transparency, facts, and an amazing team.
00:22:55.920 --> 00:22:57.519
I mean, at the end of the day, that's it.
00:22:57.680 --> 00:23:00.160
That's how I operate my career and in general.
00:23:00.240 --> 00:23:05.440
And I think that's what gives me the confidence and the capability to deal with that level of pressure.
00:23:05.599 --> 00:23:08.160
But there must be a personal amount of stress, a very high amount of stress.
00:23:08.799 --> 00:23:15.440
When you actually get a subpoena and say that we want to talk to you, you know that every word you say can and will be used, right?
00:23:15.759 --> 00:23:16.240
It is true.
00:23:16.319 --> 00:23:21.039
But that becomes with preparation, you know, proper preparation prevents piss poor performance, right?
00:23:21.519 --> 00:23:22.640
So so take us through.
00:23:22.720 --> 00:23:24.000
You you show up at the yeah.
00:23:24.160 --> 00:23:30.000
So take me to the weeds of what it was like in that morning or afternoon when you're standing in the Senate and you know that.
00:23:30.480 --> 00:23:31.200
Let's start before that.
00:23:31.279 --> 00:23:31.440
All right.
00:23:31.599 --> 00:23:32.720
I think that's the most important part.
00:23:32.799 --> 00:23:33.920
It's the preparation, right?
00:23:34.160 --> 00:23:36.640
It's the what am I being asked and why?
00:23:36.799 --> 00:23:38.400
And what information do we have?
00:23:38.720 --> 00:23:41.039
So there's getting that information.
00:23:41.599 --> 00:23:42.799
Context, important.
00:23:43.279 --> 00:23:44.480
Why is it being asked?
00:23:44.640 --> 00:23:46.079
Is this a political issue?
00:23:46.240 --> 00:23:47.680
Is this a real issue?
00:23:48.000 --> 00:23:56.880
What is the concern of the jurisdiction, the country, the entity, the legislative body, the legal entity, whatever it may be, what is the concern?
00:23:57.039 --> 00:23:59.039
Real, political, made up, it doesn't matter.
00:23:59.200 --> 00:24:01.519
There's a point of what's being asked.
00:24:01.680 --> 00:24:03.759
And then what's our truth?
00:24:04.000 --> 00:24:05.599
How do we know that?
00:24:05.839 --> 00:24:08.079
Okay, and how do we prepare to answer that?
00:24:08.319 --> 00:24:16.559
And I was fortunate where I had an entire organization that that's how they operated.
00:24:16.799 --> 00:24:34.160
Uh I had an amazing legal support team that understood my focus on want to be transparent, um, deliver very transparent information to whomever I was speaking to, and really helped me understand the context of why.
00:24:34.480 --> 00:24:54.480
And and so now you fast forward, you've done this preparation work, maybe you've done some sessions with hard technical people on your team asking questions and how they would ask them, and you have lawyers asking lawyery terms, you know, that you wouldn't be expecting because I'm I'm just a security guy, and maybe I wouldn't expect it.
00:24:54.640 --> 00:25:15.759
So you go in as prepared as possible, and you go in confident that it doesn't matter, you know, what the screaming happens or if people are saying stuff, that you're answering with truth, that you validated, and you're being transparent to what you're being asked, um, and you continue to answer the questions.
00:25:15.920 --> 00:25:19.680
I don't get caught up in the fray, I don't get caught up in the political questions.
00:25:19.920 --> 00:25:29.359
I have enough training, experience, and awareness to answer the questions that I'm I'm being asked and not delve into you know into silliness.
00:25:29.599 --> 00:25:30.960
Do you feel attacked?
00:25:31.279 --> 00:25:35.200
Because I mean when you watch it from an outsider looking at the television, right?
00:25:35.759 --> 00:25:36.160
Those are difficult.
00:25:36.799 --> 00:25:38.960
Maybe 20% of the time I feel like I'm being attacked.
00:25:39.119 --> 00:25:40.240
Listen, they get a job to do.
00:25:40.319 --> 00:25:44.559
If my team feels attacked when I ask them hard questions, they should get off my freaking team.
00:25:44.799 --> 00:25:45.039
Right?
00:25:45.200 --> 00:25:51.440
Like if I'm going into a place that's asking me hard questions because they're protecting your citizens, they get a job.
00:25:51.680 --> 00:25:57.920
If the technology I'm defending is operating, you know, within their areas, they have a right to ask me hard questions.
00:25:58.160 --> 00:26:08.880
How much of what you went through, and a lot of CISOs that are going through all sorts of governance uh and regulatory framework requirements, and that's where my question is coming from.
00:26:09.119 --> 00:26:14.640
How do you separate between geopolitics and actual security concern?
00:26:14.720 --> 00:26:16.480
Because you're right in the center of it.
00:26:16.799 --> 00:26:19.279
You don't know exactly the kind of questions that are going to be asked.
00:26:19.359 --> 00:26:22.960
It's gonna come from any any question from any corner of the stakeholders.
00:26:23.440 --> 00:26:24.480
How do you navigate that?
00:26:24.799 --> 00:26:25.279
Three words.
00:26:25.519 --> 00:26:27.440
Program consistency counts.
00:26:28.000 --> 00:26:46.960
You implement a program that is focused on informative threat information, understanding your environment, your threat environment, and your business, and you create capabilities to defend, detect, monitor, and respond to those, you can't go wrong.
00:26:47.279 --> 00:26:48.720
You just you just can't.
00:26:49.039 --> 00:27:08.799
As long as you have operational consistency on how you're delivering it, you're consistently understanding the threats to the business, to the technology, to the platforms, to the applications, to the people, and you're applying a risk-based view and having a business discussion on what we are or are not going to do, document that and move on.
00:27:09.039 --> 00:27:11.200
That's not a geopolitical thing.
00:27:11.359 --> 00:27:13.359
That's just doing good work.
00:27:13.680 --> 00:27:24.880
And so when you have geopolitical issues, and you know, there's people are claiming this or claiming that, you go back to truth, transparency, you know, and clarity.
00:27:24.960 --> 00:27:25.680
And that's it.
00:27:25.839 --> 00:27:36.240
I mean, one of my favorite meetings, I'll be honest with you, I don't think I've ever talked about this before, but there's an organization called the World 50, and it's the most senior security practitioners on the globe sit on this.
00:27:36.480 --> 00:27:45.599
And there was some geopolitical blah, blah, blah going on while I was sitting in seat and I was in the middle of doing a lot of visibility detection analysis.
00:27:46.079 --> 00:27:57.759
And I got an opportunity to get in a phone call with probably a hundred of my favorite peers around the world of the biggest companies, and answer hard questions.
00:27:58.720 --> 00:27:59.200
Think about it.
00:27:59.359 --> 00:28:07.039
You've got, you know, companies that are using your technology that are, you know, your customers that are really important.
00:28:07.519 --> 00:28:10.079
And you have, you know, people from all over the world.
00:28:10.160 --> 00:28:12.640
And they sit in there and they were asking questions.
00:28:12.880 --> 00:28:20.079
And I took that meeting, and it which was cool because the business left it up to me whether I wanted to do it or not.
00:28:20.319 --> 00:28:28.240
I'm like, all I can answer is truthfully, all I can show them is the transparency, the evidence of the programs I have, and they can make their own decisions.
00:28:28.400 --> 00:28:30.240
It was one of the best meetings.
00:28:30.720 --> 00:28:32.480
Toughest, but one of the best meetings.
00:28:32.640 --> 00:28:38.079
Probably as tough, if not tougher, than any of the congressional or legislative meetings I had to attend.
00:28:38.319 --> 00:28:39.759
So tell me something.
00:28:40.240 --> 00:28:49.680
You make it sound and you come across as everything's programmatic, you know, you be truth, you be consistent, you have programs, and you're right.
00:28:50.559 --> 00:29:08.640
You and I both know in the real world, in the wild, that's not the way half of the that that cannot describe lives of majority of the CESOs that are out there because so many bells and whistles ringing everywhere, uh, getting a workforce that's competent, having a team, a dream team that's able to do their jobs really well.
00:29:08.720 --> 00:29:19.440
I mean, there's so many challenges, shortage of workforce, talent, you know, a changing uh tech environment, you know, pressure on budget, new CEOs, boards that are building up.
00:29:19.599 --> 00:29:23.920
Political issues at the executive leadership team level, never seen any of that.
00:29:24.160 --> 00:29:28.079
And political issues inside with your own organization, right?
00:29:28.319 --> 00:29:29.039
Backbiting.
00:29:29.119 --> 00:29:30.160
I mean, that's real world.
00:29:30.480 --> 00:29:33.440
So you make it sound like it's really peaceful.
00:29:33.599 --> 00:29:37.119
You know, the duck is above the you know, above the surface.
00:29:37.519 --> 00:29:42.559
But under the surface, the duck is legs, legs are crazy.
00:29:42.960 --> 00:29:45.359
Um I like a challenge.
00:29:45.440 --> 00:29:47.599
I mean, I like every personality is different.
00:29:47.759 --> 00:29:52.559
I don't like to be right, I like to execute correctly.
00:29:52.799 --> 00:29:54.880
Meaning that I don't have to be right.
00:29:55.119 --> 00:29:56.319
My team needs to be right.
00:29:56.400 --> 00:29:58.559
They better be right when I ask some damn questions.
00:29:58.799 --> 00:30:06.160
But at the end of the day, when I'm going in, you know, to a knife fight, I'm bringing an Uzi.
00:30:06.640 --> 00:30:06.880
Right?
00:30:07.039 --> 00:30:16.319
And I, you know, I'm gonna come with the right information, proof, evidence, and you know, a warrior mindset on this is this is what we're trying to accomplish and execute to.
00:30:16.400 --> 00:30:24.000
And whether there's politics are involved, I'll call out the politics, force people to put politics aside, and if that shames them, that shames them.
00:30:24.079 --> 00:30:26.559
But we're gonna move on and we're gonna talk about the facts.
00:30:26.720 --> 00:30:30.960
I've been grilled in court so many times as a federal law enforcement officer.
00:30:31.200 --> 00:30:34.720
I like like let's stick to the facts.
00:30:34.880 --> 00:30:41.680
And I I honestly, Jay, when you I to me, when you stick to the facts, it it takes the temperature down.
00:30:42.000 --> 00:30:44.720
It takes the silliness and the politics out of it.
00:30:44.799 --> 00:30:54.640
And and the worst the problem is, by the way, like let's take up like a product security flaw uh in a money movement platform or something like that, right?
00:30:54.880 --> 00:31:00.160
And you're dealing with the results of that or some automated fraud against the platform.
00:31:00.240 --> 00:31:05.279
So you're dealing with the incident, you're trying to recover dealing with law enforcement to do the investigation.
00:31:05.599 --> 00:31:16.960
And you know, you have the CEO and general counsel that's worried over here, and then you have the product owner that's trying to defend themselves, and you have the person that didn't fix the vulnerability, you know, yelling at everyone else.
00:31:17.119 --> 00:31:23.440
You're like, okay, look, let's stop, we're gonna deal with the incident, we're gonna stop the bleeding, making sure the patient's breathing.
00:31:23.680 --> 00:31:30.160
And and then, you know, once they're in the hospital, we're gonna start going back and figuring out what really happened, right?
00:31:30.240 --> 00:31:33.200
You you take that tone down.
00:31:33.440 --> 00:31:35.359
We're in a place that's really, really important.
00:31:35.519 --> 00:31:39.519
We do really important work to society and the way that we know that society works.
00:31:39.680 --> 00:31:42.160
And in some cases, it's truly life or death.
00:31:42.240 --> 00:31:51.839
You look at like some of these CISOs that are in charge of major airlines and you know, uh critical infrastructure and hospitals and train lines.
00:31:51.920 --> 00:31:53.200
That's really life and death.
00:31:53.359 --> 00:31:55.599
Most of the stuff we deal with every day is not life and death.
00:31:55.680 --> 00:31:55.759
Right.
00:31:55.920 --> 00:31:57.279
And so you is life and death.
00:31:57.359 --> 00:31:58.960
I mean, my kid, they cannot use TikTok.
00:31:59.039 --> 00:32:00.079
You're kidding me?
00:32:00.880 --> 00:32:01.680
That's insane.
00:32:02.480 --> 00:32:03.359
Are kids related?
00:32:05.839 --> 00:32:07.519
Tell me something about your personal life.
00:32:07.680 --> 00:32:11.119
When all this is going on, how long is this period?
00:32:11.359 --> 00:32:14.559
And what does what does the stress mean?
00:32:14.720 --> 00:32:15.440
So, two questions.
00:32:15.599 --> 00:32:22.400
Uh well, three, how long was this entire period where you had this Senate and congressional hearings that you have to be part of?
00:32:22.960 --> 00:32:25.119
Uh so I I assume a couple of months at least.
00:32:25.279 --> 00:32:30.640
And then what kind of stress do you take on to your on your personal self with your personal life?
00:32:30.720 --> 00:32:34.720
Yeah, because there's a tremendous amount of global lens on you.
00:32:34.880 --> 00:32:35.119
Yeah.
00:32:35.279 --> 00:32:36.400
And how did you manage it?
00:32:36.720 --> 00:32:38.720
It was it was probably a solid year.
00:32:38.799 --> 00:32:39.599
Uh a year.
00:32:40.000 --> 00:32:51.839
Yeah, of of uh well, I was in seat that there was because there was some crazy stuff being said, and and we dove in as any responsible company would, and you have to prove a negative, and you know, all of that sort of stuff.
00:32:52.000 --> 00:32:58.079
And then out of that came a lot of conversations with a lot of agencies, entities, and and governments around the world.
00:32:58.160 --> 00:32:59.039
So it was a lot.
00:32:59.279 --> 00:33:02.240
I like your question on how do you how do you deal with it?
00:33:02.400 --> 00:33:03.359
So two things changed.
00:33:03.680 --> 00:33:04.799
Like you lose sleep, right?
00:33:04.880 --> 00:33:06.799
Uh certainly breathe heavy.
00:33:06.880 --> 00:33:18.079
Uh you're a multinational organization, so you're dealing with building teams around the world, you're on a 12-hour clock, you're working, you know, seven in the morning to eleven at night sometimes.
00:33:18.240 --> 00:33:19.440
You know, it's interesting.
00:33:19.519 --> 00:33:26.079
It was a learning experience for me between cultures because the primary company uh was in Asia.
00:33:26.559 --> 00:33:40.640
And uh, you know, I'm trying to build a global, independent, and national security program for the United States all at the same time and maintain that connectivity uh to make sure we had uh good integration from a global point of view.
00:33:40.799 --> 00:33:48.720
So it was a lot of time, and you know, it messes with stuff like we should all focus on our sleep, our health, oh god, our exercise.
00:33:48.960 --> 00:33:54.400
People in these positions don't think of it as a physically intensive uh job, but it is.
00:33:54.559 --> 00:33:56.640
You have to be healthy to do this job.
00:33:56.799 --> 00:34:05.839
The pressure and the stress and the and the lack of sleep you often get and not knowing and how to do that, what makes up for that is is your physical conditioning and your mental conditioning.
00:34:06.000 --> 00:34:16.320
And so I think, you know, that was a huge issue for me was how do I maintain that level of physicality when you know I'm working so much.
00:34:16.559 --> 00:34:17.519
And how do you do that?
00:34:17.760 --> 00:34:19.360
I didn't for many, many months.
00:34:19.519 --> 00:34:22.880
And that's when stress kind of started to leak in.
00:34:23.039 --> 00:34:27.679
I've been preaching this for many years, and I started, you know, I said, what do you tell everyone else on your team?
00:34:27.920 --> 00:34:28.559
Start doing that.
00:34:28.719 --> 00:34:30.719
So I I started to carve out the time.
00:34:30.800 --> 00:34:32.480
And the other thing is, you know, family time.
00:34:32.639 --> 00:34:33.760
Family time is really important.
00:34:33.840 --> 00:34:35.920
Uh, you know, you have a life beyond work.
00:34:36.079 --> 00:34:40.639
Um, whether you have a family or you're single and or whatever your life is, you have a life beyond work.
00:34:40.880 --> 00:34:49.519
But at the back of your mind, you have this fact that I'm gonna be personally put forward to a testimony that I'm responsible for.
00:34:49.760 --> 00:34:55.599
It could be a slip of tongue, it could be, you know, you know, a mistake from a data, but I'm responsible.
00:34:55.760 --> 00:34:57.119
So that's a very overbearing.
00:34:57.840 --> 00:34:59.119
I don't think of it that way.
00:34:59.360 --> 00:35:00.320
I don't I actually don't.
00:35:00.480 --> 00:35:09.599
I think when when I think about um critical testimony, I have always felt that I'm not gonna do it unless I have a team behind me.
00:35:09.760 --> 00:35:14.559
I trust the people that are below me that are bringing me the information and validating it for me and showing the how.
00:35:14.719 --> 00:35:22.800
I trust the attorneys that I'm working with that uh understand the legal application of the issue and are gonna represent me in the room.
00:35:22.960 --> 00:35:33.440
And this is going to sound funny to you, with the exception of public bombastic uh politics show boating.
00:35:33.760 --> 00:35:41.840
I trust the people in these closed door sessions that are asking hard questions that they're doing it for the right reason.
00:35:42.400 --> 00:35:47.840
Um, and and not not in any specific country, because I've talked to multiple countries around the globe.
00:35:48.079 --> 00:35:50.079
Um I can remember testify.
00:35:50.159 --> 00:35:52.000
I won't tell you the country, I don't want them to go mad.
00:35:52.159 --> 00:35:55.599
A Senate select hearing in another country, in another part of the world.
00:35:55.679 --> 00:36:00.559
They were like the exact opposite time uh around the world.
00:36:00.719 --> 00:36:04.000
Um, and I was on Zoom, I didn't have to fly out.
00:36:04.159 --> 00:36:07.760
And uh I'm wearing shorts and a suit and tie on top.
00:36:10.079 --> 00:36:12.559
That would not be something that is new.
00:36:12.719 --> 00:36:13.679
I think I'm gonna be able to do that.
00:36:14.719 --> 00:36:15.760
It was the first time for me.
00:36:16.000 --> 00:36:18.159
Yeah, I I I have faith in people.
00:36:18.320 --> 00:36:29.519
Uh and and so I go into it trusting that I have a great team with me, and I don't feel like even if I say a wrong word or what have you, that I'm gonna be left.
00:36:29.679 --> 00:36:32.159
I wouldn't work for an organization that I didn't believe had my back.
00:36:32.400 --> 00:36:33.679
So, final two questions.
00:36:33.760 --> 00:36:37.519
Uh that there's so many interesting things to talk about, but final two questions.
00:36:37.679 --> 00:36:42.719
One, during this controversy, you have to maintain the morale of your team.
00:36:43.519 --> 00:36:44.400
How do you do that?
00:36:44.719 --> 00:36:44.960
Mission.
00:36:45.119 --> 00:36:46.159
One word, mission.
00:36:46.320 --> 00:36:49.920
They know every day they get up, they know the mission of our organization.
00:36:50.079 --> 00:37:03.920
That mission is to protect, you know, 100, 200, 300 million people from any given country, 3 billion people on platform, the amount of small businesses that are being developed around the world so people can prosper, they know what they're protecting every day.
00:37:04.079 --> 00:37:08.239
Whatever your company is, your people need to know the mission and be able to articulate it.
00:37:08.400 --> 00:37:13.440
Every day they got up, they got up because they were happy to do this work, because they wanted to do that mission.
00:37:13.599 --> 00:37:14.960
That's how you keep them motivated.
00:37:15.119 --> 00:37:15.599
Nothing else.
00:37:15.679 --> 00:37:16.880
I found nothing else in the world.
00:37:16.960 --> 00:37:18.880
You can throw as much money as you want at them.
00:37:19.119 --> 00:37:22.480
If they're not into the mission, they're gonna go to the next place to try to make more money.
00:37:22.639 --> 00:37:23.039
Let them.
00:37:23.360 --> 00:37:23.599
Right?
00:37:23.760 --> 00:37:25.599
You want mission-minded people.
00:37:25.840 --> 00:37:26.400
Fantastic.
00:37:26.559 --> 00:37:27.920
So, final question.
00:37:28.159 --> 00:37:30.719
You sound like a perfect CISO.
00:37:31.199 --> 00:37:33.360
What was your life's biggest failure?
00:37:33.599 --> 00:37:35.519
And what did you learn out of it?
00:37:35.920 --> 00:37:37.280
Life's biggest failure.
00:37:37.599 --> 00:37:38.239
As a CISO.
00:37:38.400 --> 00:37:39.360
Oh, as a CISO?
00:37:39.599 --> 00:37:40.000
Yeah.
00:37:40.320 --> 00:37:44.320
Apart from the fact that you didn't come to my show earlier, but you know, I'll forgive you.
00:37:44.639 --> 00:37:45.840
I thought I had an invitation.
00:37:46.000 --> 00:37:46.239
All right.
00:37:46.639 --> 00:37:50.400
Uh no, I'll go back to TikTok and bite dance.
00:37:50.719 --> 00:37:51.440
I love what I do.
00:37:51.519 --> 00:37:55.440
I've done it for very large companies around the globe and multiple times.
00:37:55.599 --> 00:37:58.320
And I have a somewhat of a specific playbook.
00:37:58.400 --> 00:38:01.599
Uh, it's not exact, and no business, no two businesses are alike.
00:38:02.400 --> 00:38:13.119
And normally I take the time to step back and think about the implementation of it and and the impact and learn the company a little bit more.
00:38:13.280 --> 00:38:15.039
We were in the middle of COVID at the time.
00:38:15.119 --> 00:38:19.360
We had I I started April 1st of 2020.
00:38:19.519 --> 00:38:22.000
So it was smack dab in the middle of COVID.
00:38:22.239 --> 00:38:27.039
I didn't have the ability to go fly here or fly there.
00:38:27.199 --> 00:38:30.639
Normally I go around the world, you know, three or four times a year.
00:38:30.800 --> 00:38:38.320
And I just didn't have the ability to do that, number one, and I still made decisions without having it.
00:38:38.559 --> 00:38:40.960
I I I wish I would have had more time.
00:38:41.119 --> 00:38:52.400
So my my failure is applying a playbook without the level of due diligence and transparency necessary to make the right decisions about the strategic operations you're developing.
00:38:52.719 --> 00:39:04.400
And uh, you know, that that was, you know, three years into it as I'm building both a global program and a national security program for the US, I realized it didn't fit the company.
00:39:04.559 --> 00:39:11.840
So, I mean that that was probably being a CISO, one of my biggest things I look back and I say, I'll never do that again.
00:39:12.159 --> 00:39:12.480
Wow.
00:39:12.639 --> 00:39:15.039
Roland, it's been a pleasure having you on the show.
00:39:15.280 --> 00:39:15.760
Thanks for having me.
00:39:16.239 --> 00:39:17.039
Thank you for coming.
00:39:17.280 --> 00:39:24.320
That was my guest, Roland Clôtier, the former CISO of ByDance, the company that ran TikTok.
00:39:24.800 --> 00:39:27.840
He ran a platform with over three billion people.
00:39:28.079 --> 00:39:29.519
Think of that for a second.
00:39:29.679 --> 00:39:35.760
If you like this episode, please share and like and subscribe to the Cybersecurity Podcast by C Council.
00:39:35.920 --> 00:39:37.920
I'll see you again on the next show.
00:39:38.159 --> 00:39:39.599
Till then, goodbye.
00:39:39.760 --> 00:39:41.119
This is J Bar VC.
00:39:41.280 --> 00:39:41.840
Checking out.
