WEBVTT
00:00:00.050 --> 00:00:07.759
Today on cyber work, will Sweeney of Avit joins me to discuss data privacy, GRC and the future of privacy regulations.
00:00:08.419 --> 00:00:13.970
Avit has overseen complex information security audits for much of the Fortune 100 companies.
00:00:14.419 --> 00:00:18.679
We talk about everything from the split between the skills needed for security auditing.
00:00:18.879 --> 00:00:31.239
Versus security implementation, whether privacy, regulatory frameworks will continue multiplying or begin a process of consolidation, as well as a key way to understand many different compliance frameworks at once.
00:00:31.600 --> 00:00:36.460
The tip is to focus on the security processes themselves, not the structure of the framework.
00:00:36.909 --> 00:00:38.049
GRC, aspirants.
00:00:38.109 --> 00:00:42.009
There's a lot of tips to get you started here, so that's all today on cyber work.
00:00:42.957 --> 00:00:45.747
The IT and cybersecurity job market is thriving.
00:00:46.078 --> 00:00:51.328
The Bureau of Labor Statistics predicts 377, 500 new IT jobs annually.
00:00:51.768 --> 00:00:59.807
You need skill and hustle to obtain these jobs, of course, but the good news is that cybersecurity professionals can look forward to extremely competitive salaries.
00:01:00.128 --> 00:01:09.862
That's why InfoSec has leveraged 20 years of industry experience Drawing from multiple sources to give you, cyber work listeners, an analysis of the most popular and top paying industry certifications.
00:01:10.222 --> 00:01:13.332
You can use it to navigate your way to a good paying cyber security career.
00:01:13.632 --> 00:01:19.203
So to get your free copy of our cyber security salary guide ebook, just click the link in the description below.
00:01:19.203 --> 00:01:20.962
It's right there near the top, just below me.
00:01:20.962 --> 00:01:21.582
You can't miss it.
00:01:21.983 --> 00:01:26.852
click the link in the description and download our free cyber security salary guide ebook.
00:01:27.112 --> 00:01:29.433
Your cyber security journey starts here.
00:01:29.813 --> 00:01:40.132
Now let's get the show started Welcome to this week's episode of the Cyber Work Podcast.
00:01:40.313 --> 00:01:41.813
I'm your host, Chris Sanko.
00:01:41.843 --> 00:01:45.623
My guests are a cross section of cybersecurity industry thought leaders.
00:01:45.893 --> 00:01:57.772
Our goal is to help you learn about cybersecurity trends and how those trends affect the work of InfoSec professionals, as well as leaving you with some tips and advice for breaking in or moving up in the cybersecurity industry.
00:01:58.358 --> 00:02:02.798
My guest today, will Sweeney is the founding and managing partner of Aviant.
00:02:03.158 --> 00:02:13.147
Before starting the firm in 2016, he held leadership roles at companies, including KPMG, Comcast and IBM, gaining valuable experience overseeing complex information security audits.
00:02:13.603 --> 00:02:26.112
Data privacy compliance for much of the Fortune 100 today will leads Ian's ever-growing team of data privacy and security experts who serve as trusted advisors to some of the nation's most prominent enterprises.
00:02:26.443 --> 00:02:29.263
Will has been featured in the Philadelphia Business Journal.
00:02:29.268 --> 00:02:34.367
40 under 40 and Titan 100 lists and is an active member of the Forbes Technology Council.
00:02:34.698 --> 00:02:39.168
Additionally, he is frequently published and quoted in the media for his ex industry expertise.
00:02:39.707 --> 00:02:51.647
When networking at aviant Will is involved in a number of community and philanthropic initiatives, including the Giorgio Foundation, Irish American Business Chamber Network, the Centennial Education Foundation, the Uncommon Individual Foundation.
00:02:51.937 --> 00:02:54.877
And the Union League of Philadelphia's Legacy Foundation.
00:02:55.207 --> 00:02:59.948
So today we're gonna be talking data privacy and GRC and whatever else comes up today.
00:02:59.948 --> 00:03:02.737
So Will, thanks for joining me and welcome to Cyber work.
00:03:03.147 --> 00:03:05.962
Hey Chris, thank you so much for having me look forward to the conversation today.
00:03:06.307 --> 00:03:06.997
Absolutely.
00:03:06.997 --> 00:03:07.478
Same here.
00:03:07.478 --> 00:03:10.358
So, uh, so will, let's start, uh, about your early years.
00:03:10.358 --> 00:03:14.737
Do you remember what the initial spark was that got you excited about, uh, tech Cybersecurity?
00:03:15.518 --> 00:03:15.758
Yeah.
00:03:15.758 --> 00:03:22.057
So, um, I was really lucky at an early age for, um, my dad who, uh, knew nothing about computers.
00:03:22.057 --> 00:03:25.538
He was a, uh, HVAC and, and plumbing technician.
00:03:25.897 --> 00:03:31.147
Um, he, he knew that computers were gonna be important, so he, he went out and bought me a computer at a very early age.
00:03:31.487 --> 00:03:31.707
Hmm.
00:03:31.973 --> 00:03:38.992
I remember it being a Packard Bell computer and just kind of, you know, doing some initial experimentation with it and trying to learn.
00:03:39.353 --> 00:03:45.443
I think at that point we were on Windows 95, maybe, I'm not even a hundred percent sure, but,
00:03:45.687 --> 00:03:45.907
Hm.
00:03:46.252 --> 00:03:56.842
you know, had a chance to, to learn a lot about it and just getting used to the Windows environment and then just taking various courses at, um, both my middle school and in, in high school.
00:03:57.247 --> 00:04:08.407
Um, I can still remember I had a professor in, in middle school who, um, he made us memorize the keyboard and I can still, to this day, I know all of the keys on the keyboard and what order they go in.
00:04:08.828 --> 00:04:09.187
Yeah.
00:04:09.307 --> 00:04:13.147
and I also was really fortunate to have a, uh, a teacher in high school.
00:04:13.177 --> 00:04:14.828
Uh, Carolyn Fisher was her name,
00:04:15.157 --> 00:04:15.457
Hmm.
00:04:15.848 --> 00:04:20.288
who, uh, let me actually build the high, the, uh, website for our high school.
00:04:20.677 --> 00:04:25.447
Um, and uh, it was kind of the first, uh, website that the high school had and.
00:04:26.093 --> 00:04:28.642
You know, just really started to kind of pick things up from there.
00:04:28.642 --> 00:04:33.923
And, um, going to college, I built my own computer and assembled the parts and things.
00:04:33.923 --> 00:04:35.812
And now that's kind of a trendy thing to do.
00:04:35.812 --> 00:04:37.612
I think a lot of people do that nowadays.
00:04:37.612 --> 00:04:41.033
But, um, back then it was, um, not, not as common.
00:04:41.377 --> 00:04:42.997
It was a leap of faith back then for sure.
00:04:43.028 --> 00:04:47.108
'cause yeah, you were, you were just sort of putting all these pieces together and, and yeah.
00:04:47.108 --> 00:04:52.987
Even now there's still you, you know, doing little mismatches can really cause big problems down the line.
00:04:52.987 --> 00:04:53.348
So Yeah.
00:04:53.348 --> 00:04:55.298
That's a, that's a hard challenge now.
00:04:55.327 --> 00:04:58.267
Um, I I wanted to back up a couple of things there.
00:04:58.327 --> 00:05:09.367
Uh, when you were, uh, asked to do the school's website, was it, were you already sort of learning HTML or was this like a real big leap of faith in terms of like, oh, I have to.
00:05:09.742 --> 00:05:13.882
I have to learn how to do this now, but they just sort of were like, you're a, you know, you're a computer guy.
00:05:13.973 --> 00:05:14.603
Why don't you do it?
00:05:15.127 --> 00:05:15.548
Yeah.
00:05:15.728 --> 00:05:16.927
Um, a little bit of both.
00:05:16.987 --> 00:05:27.908
Um, I did, I did spend some time learning about HTML and, um, you know, just some basic, um, tags and, and things like that and how to structure a website and, um, I took to that pretty quickly.
00:05:27.968 --> 00:05:32.377
Um, but back then we were using a product called, um, Dreamweaver,
00:05:33.038 --> 00:05:33.458
Oh, yeah.
00:05:33.458 --> 00:05:34.822
That's what I, that's what I learned on too.
00:05:34.853 --> 00:05:35.122
Nice.
00:05:35.168 --> 00:05:35.677
yeah,
00:05:35.903 --> 00:05:35.992
Mm-hmm.
00:05:36.007 --> 00:05:43.358
started building with Dreamweaver and then learned a little bit about, um, flash Script and I, I think it was called Action Script back then.
00:05:44.452 --> 00:05:49.913
so, you know, started learning about the action script language and then, um, the website from there.
00:05:49.913 --> 00:05:55.583
And like, looking back at it, I mean, you can go back on the, on the way back machine and see the website, what I created back then and,
00:05:55.802 --> 00:05:56.033
Yeah.
00:05:56.062 --> 00:05:57.442
um, very rudimentary.
00:05:57.442 --> 00:06:03.473
But, um, you know, it was, it was exciting, you know, it was something that I, I'd never done before and I, I was given a really nice opportunity to do it.
00:06:04.627 --> 00:06:05.798
That, that is really cool.
00:06:05.798 --> 00:06:13.898
And, uh, yeah, I, I'm in full agreement that, uh, I think, uh, of all the things I learned in high school learning, uh, touch typing and knowing where all the keys on the keyboard are.
00:06:14.978 --> 00:06:17.588
Nothing else has served me in life quite like that has
00:06:17.978 --> 00:06:18.548
Right.
00:06:18.908 --> 00:06:20.708
absolutely cornerstone at this point.
00:06:20.737 --> 00:06:21.038
So,
00:06:21.127 --> 00:06:21.487
Yeah.
00:06:21.697 --> 00:06:24.577
so I wanna go a little forward into some of your, your key career roles.
00:06:24.577 --> 00:06:30.187
You started strongly in roles around it, but your interest in focus, uh, over the past many years has been, I.
00:06:30.627 --> 00:06:38.427
Uh, specifically around data security, data privacy, regulation, uh, was this a, a a, an interest pivot or an opportunity pivot?
00:06:38.427 --> 00:06:47.968
Did you, did someone sort of get you, uh, you know, into these type of roles, or did, was this like more interesting to you than the sort of ITIS stuff?
00:06:48.023 --> 00:06:51.533
You know, I, I kind of, kind of stumbled my way in.
00:06:51.562 --> 00:06:59.723
To, um, data security compliance, starting at, um, KPMG, doing a lot of Sarbanes Oxley and IT general control testing.
00:07:00.173 --> 00:07:05.122
Um, and then spent some time doing, um, FSMA and fiscam reviews for the federal government.
00:07:05.603 --> 00:07:08.122
Um, so that was mostly kind of audit experience.
00:07:08.122 --> 00:07:15.802
And then later when I worked for IBM, um, I was in their data security and privacy, uh, practice and helping companies actually sit on the other side.
00:07:15.802 --> 00:07:17.663
So not doing the audits, but actually doing.
00:07:18.052 --> 00:07:22.523
Uh, implementations and consulting engagements to help companies to comply with a variety of,
00:07:22.952 --> 00:07:23.242
Okay.
00:07:23.423 --> 00:07:25.612
you know, primarily information security frameworks.
00:07:25.612 --> 00:07:27.952
So SOC two, iso, nist, that kind of thing.
00:07:28.403 --> 00:07:40.733
Um, and, and, um, of out of the blue, one of the partners and I were talking a little bit about, um, GDPR, which, um, at the time was a, an emerging data privacy regulation that nobody really knew very much about.
00:07:41.033 --> 00:07:44.302
Um, and she said to me, she said, Hey, listen, we think that this is gonna be a big thing.
00:07:44.302 --> 00:07:47.572
We we're not really sure, but we'd like for you to go kind of learn about it.
00:07:47.963 --> 00:07:54.833
Um, and I started really going out there and just initially just reading and understanding the text around the GDPR and what, what the article
00:07:55.098 --> 00:07:55.338
Mm-hmm.
00:07:56.512 --> 00:08:03.773
And I pretty quickly realized that, you know, this was gonna be a huge problem for companies, that they were gonna have to comply with this regulation.
00:08:04.403 --> 00:08:09.173
It was kind of a, its first of its kind, which carried very significant fines for noncompliance.
00:08:09.173 --> 00:08:09.653
So,
00:08:09.653 --> 00:08:09.952
Yeah.
00:08:10.103 --> 00:08:13.012
um, you know, I knew that they were gonna have to do something and.
00:08:13.718 --> 00:08:20.858
also baked in a lot of, uh, in addition to the data privacy requirements, it baked in a lot of information security requirements as well, which I had a strong background in.
00:08:21.307 --> 00:08:36.878
Um, so, you know, honestly I think I spent probably about a year really, you know, gaining a, a really strong understanding of the GDPR and then shortly after, um, started Zian and went out to market thinking like maybe this is an area where we can, we can help some companies.
00:08:36.908 --> 00:08:41.258
And, um, I always tell people, I think I drastically underestimated the.
00:08:41.602 --> 00:08:48.232
Amount of work that was out there and the, uh, the opportunity around helping companies comply with these, um, these requirements.
00:08:48.232 --> 00:08:50.067
It really was just opportunistic.
00:08:50.918 --> 00:08:51.307
Thanks.
00:08:51.607 --> 00:08:52.327
Uh, okay.
00:08:52.327 --> 00:08:53.258
So, um.
00:08:54.173 --> 00:09:02.842
Because a lot of, uh, the listenership of this show is, is sort of trying to figure out what types of work they want to do later on.
00:09:02.842 --> 00:09:12.773
Can you draw a distinction in terms of like, the actual day-to-day tasks between someone who's doing the, uh, the sort of audit versus doing the implementation?
00:09:12.773 --> 00:09:19.702
Obviously, I, I, I realize they're sort of related, uh, and obviously one's a lot more hands on than the other, but, uh, what, what, what, what's the difference between the two?
00:09:20.457 --> 00:09:30.687
Yeah, so when you're doing an audit, and, and one of the things that I, I did not really like about audit was, um, you, you would go in and conduct these assessments of these organizations and.
00:09:31.043 --> 00:09:32.332
You would issue a report.
00:09:32.332 --> 00:09:34.403
Here are where all of your problems are.
00:09:34.462 --> 00:09:34.793
Right?
00:09:34.793 --> 00:09:36.653
And, and really that's what the audit's meant to do.
00:09:36.653 --> 00:09:42.472
It's to, um, yeah, we obviously want to give credit for the good things that you're doing, but we wanna point out more
00:09:42.513 --> 00:09:43.302
Like that.
00:09:43.763 --> 00:09:44.033
right?
00:09:44.033 --> 00:09:50.663
So that you can go out and start actually remediating those gaps in preparation for getting a clean audit opinion in the future.
00:09:51.143 --> 00:09:58.403
Um, you know, in a consulting, in, in, in a consulting engagement, you're still doing that assessment to understand where the gaps are.
00:09:59.648 --> 00:10:05.707
you know, what I really liked about it was then taking those gaps and actually solving those problems for, for customers, right?
00:10:05.707 --> 00:10:06.337
Where the audit
00:10:06.462 --> 00:10:06.543
Hmm.
00:10:07.057 --> 00:10:14.707
You know, what I didn't really like about it was, um, in, in my experience, a lot of times it wasn't that these companies didn't understand that they had problems.
00:10:14.707 --> 00:10:17.347
It, that they didn't really understand how to fix the problems.
00:10:17.587 --> 00:10:24.217
So, going into that consulting setting was, you know, not only were we calling out the, the issues, we were actually helping this to solve'em and.
00:10:24.577 --> 00:10:34.207
I think that's the big difference between the two is in a consulting engagement, you're really hands-on sitting with the company and, and, and, uh, and helping to fix the issues that you've, you've identified.
00:10:34.442 --> 00:10:34.863
Mm-hmm.
00:10:34.947 --> 00:10:35.158
Mm-hmm.
00:10:35.427 --> 00:10:45.868
And I, I, I imagine that requires a little, a lot different background in terms of like your skills or, or are, are, or can you sort of start from the same and sort of diverge into the two different roles?
00:10:46.182 --> 00:10:50.528
You know, I, I think what's interesting is I think I probably started more so on the, I.
00:10:51.577 --> 00:11:05.918
Technical side of things and some of my, my colleagues who are auditors and I think that they, the auditors, um, are typically very good at understanding the requirements and how to apply them, but they may not have the technical acumen to actually go out and fix those gaps.
00:11:05.998 --> 00:11:06.347
Right.
00:11:06.427 --> 00:11:11.048
So I kind of started more on the technical side and then did the audit, and then moved into the consulting.
00:11:11.048 --> 00:11:14.557
So I would say you're right, there's very similar skillset there, but I
00:11:14.842 --> 00:11:15.113
Got it.
00:11:15.398 --> 00:11:17.977
it can be difficult for an auditor to bridge that gap.
00:11:19.043 --> 00:11:19.582
Good to know.
00:11:19.582 --> 00:11:26.243
So, uh, you mentioned that, you know, the, these, these particular types of, uh, job roles.
00:11:26.258 --> 00:11:30.758
Uh, basically moved you into where you are now with, with Zian Consulting.
00:11:30.758 --> 00:11:33.097
Can you talk about your current role as, as managing partner?
00:11:33.128 --> 00:11:41.648
'cause uh, obviously this is a pretty, uh, big role and a pretty big jump up and you've, you know, helped a lot of big time companies with their compliance and security posture.
00:11:41.648 --> 00:11:48.817
So what is, what is the work like now in, in the sort of managing partner space as as opposed to the implementation that you did before?
00:11:48.817 --> 00:11:48.878
Yeah.
00:11:49.352 --> 00:11:49.623
Yeah.
00:11:49.623 --> 00:12:03.993
So yeah, now I'm, I'm really, um, my focus is really on, you know, making sure that the team, uh, understands, um, the services that we're going to market and that we're providing, making sure that we're bringing the best possible delivery to our clients.
00:12:03.993 --> 00:12:04.052
I.
00:12:04.357 --> 00:12:10.957
Um, going out and finding new opportunities, um, with, with, with new, new clients.
00:12:11.437 --> 00:12:15.128
Um, and, you know, my role has really shifted, right?
00:12:15.128 --> 00:12:19.207
So I'm not as hands-on with the delivery of the service as I once was.
00:12:19.508 --> 00:12:27.878
Although I love doing the delivery of the service now, I'm really focused more on kind of scaling and growing a business and in my capacity as a managing partner here.
00:12:28.298 --> 00:12:33.013
Um, but in order for me to be successful in that role, I still need to be able to talk to the clients.
00:12:33.712 --> 00:12:39.263
Understand the problems that they're having, understand the regulations that they're having to comply with.
00:12:39.653 --> 00:12:53.393
Uh, I'm still working very closely to make sure we have stakeholder buy-in across the various levels of the business, including in the C level, um, communicating across different, you know, jurisdiction is in different operating entities.
00:12:53.753 --> 00:12:59.898
Um, so that, that, is kind of shifted is, I would say more, uh, communication heavy and stakeholder heavy.
00:13:00.317 --> 00:13:00.918
Um.
00:13:01.863 --> 00:13:07.113
That, that's kind of the big difference now is I'm not as hands-on with the delivery as I once was.
00:13:07.352 --> 00:13:16.893
And, and I'm very fortunate because my team is, is really, you know, there, there's some really good experts on our team who are really probably at this point better than I am at, at doing the delivery.
00:13:16.893 --> 00:13:16.952
I.
00:13:18.423 --> 00:13:31.442
Um, without, uh, you know, obviously, uh, you know, listing out specific problems that certain clients have, but can you gimme an example of some of the types of challenges that you're being asked to.
00:13:32.118 --> 00:13:34.577
Solve in these particular situations.
00:13:34.577 --> 00:13:42.677
Can you sort of give me some of the, like the, the top level, most common, uh, you know, security regulation problems or whatever that ENT is, is working on?
00:13:43.623 --> 00:13:46.832
A lot of, a lot of what we're doing is helping companies to come.
00:13:46.893 --> 00:14:00.842
Comply with things like the GDPR and the US State Privacy Laws, um, helping to build out third party risk management programs, um, helping companies to comply with things like the CMMC or ISO 27,001.
00:14:01.442 --> 00:14:10.832
Um, and I think kind of the, the common theme there amongst those requirements is, again, just going back, I think you really need stakeholder buy-in and support across the
00:14:11.067 --> 00:14:11.357
Yeah.
00:14:11.493 --> 00:14:12.903
of the, of the organization.
00:14:13.307 --> 00:14:22.067
Um, and you know, one of the things I'm doing quite regularly is helping just kind of navigate the complexity of all of those requirements and how they relate to each other and how they differ.
00:14:22.908 --> 00:14:33.498
and coming at it from kind of a, a programmatic point of view to say, you know, maybe if we do these five things for GDPR compliance, it also helps us, for us state privacy law compliance.
00:14:33.692 --> 00:14:34.143
Mm.
00:14:34.368 --> 00:14:38.207
I would say those big themes are the, the, uh, data privacy laws and the,
00:14:38.373 --> 00:14:38.673
Yep.
00:14:38.807 --> 00:14:41.597
party risk programs and information security requirements.
00:14:42.153 --> 00:14:45.903
What are the most common hindrances to buy-in?
00:14:45.903 --> 00:14:51.557
Because I, you know, I, I, you would think maybe it's, it's money, but it's not money because they're, they're hiring you to get this thing done.
00:14:51.658 --> 00:14:52.317
So is it just.
00:14:53.118 --> 00:14:55.817
The complexity of it, is it people don't want to change?
00:14:55.817 --> 00:15:03.557
Is it, uh, general exhaustion with having to sort of like, figure out all these new sort of compliance regulations?
00:15:03.557 --> 00:15:05.927
Where, where, where's the, the friction happening usually?
00:15:06.452 --> 00:15:06.903
It.
00:15:06.903 --> 00:15:08.403
I think a lot of it is.
00:15:08.942 --> 00:15:10.232
You know, a knowledge gap.
00:15:10.293 --> 00:15:12.663
And I think a lot of it is a resource gap.
00:15:12.722 --> 00:15:20.043
So, you know, a, I think a lot of people really don't understand, you know, exactly how to go about solving these issues.
00:15:20.342 --> 00:15:30.332
And then B, even if they do understand it, a lot of times they don't think they, they have the, the either the right resources or the number of resources that they need to deal with these problems.
00:15:30.332 --> 00:15:35.312
Because the reality is that, you know, complying with these requirements.
00:15:36.332 --> 00:15:39.722
can be very, um, resource intensive and time intensive.
00:15:39.722 --> 00:15:42.633
It's, it's not something that you just do one time.
00:15:42.783 --> 00:15:45.932
You have to do it, and then you have to maintain it on an ongoing basis.
00:15:45.932 --> 00:15:48.148
So it, it is very resource and time intensive.
00:15:48.918 --> 00:15:49.187
Yeah.
00:15:49.217 --> 00:16:00.932
Does that, I mean, do those resources involve just adding more sort of work to the workflow, more people to the pipeline or sort of throwing money at the problem or just sort of a combination of all those things?
00:16:01.388 --> 00:16:04.533
Yeah, I would say it's a combination of, of all of those things.
00:16:04.592 --> 00:16:05.072
Um.
00:16:05.373 --> 00:16:19.893
But you know, you the pro, one of the other issues I would say is you can't take someone who's really good at network engineering and have them help with, you know, complying with the GDPR or building out a data map or building out a privacy
00:16:20.028 --> 00:16:20.628
Right.
00:16:20.852 --> 00:16:22.592
two very different skillsets.
00:16:22.832 --> 00:16:23.133
You
00:16:23.302 --> 00:16:23.543
yeah.
00:16:23.763 --> 00:16:27.783
as much as we can't go do network engineering and administration or
00:16:27.962 --> 00:16:28.312
Right.
00:16:29.342 --> 00:16:34.113
you know, they cannot go, do, you know, the same things that we can do around, um, the compliance requirements.
00:16:34.113 --> 00:16:34.442
So.
00:16:34.842 --> 00:16:35.133
Okay.
00:16:35.163 --> 00:16:44.913
say there's a big kind of, um, you know, to my earlier point, I think there's a, there's both a resource issue from like a number of resources, but a really an expertise standpoint.
00:16:44.913 --> 00:16:45.153
And,
00:16:45.258 --> 00:16:45.827
Interesting.
00:16:45.903 --> 00:16:54.138
that's an industry wide problem where I think across the industry, we just don't have enough folks who really understand, um, how to deal with these problems.
00:16:55.038 --> 00:16:55.398
Yeah.
00:16:55.398 --> 00:17:07.097
Now, uh, I'm assuming that most of the, uh, the companies you work with, their solution is not, well, let's hire someone who is an expert in that area, but is sort of like, let's upskill the people we have now.
00:17:07.097 --> 00:17:10.397
Is, I mean, do you have a, any thoughts on that?
00:17:10.428 --> 00:17:19.218
Like, like, I know we're trying to solve the, the primary problem around cybersecurity right now, but, um, you know, I mean, we're also seeing.
00:17:19.232 --> 00:17:27.722
You know, contractions of, of, of SOX and security teams, you know, due to budgets, due to, uh, economic circumstances or whatever.
00:17:27.722 --> 00:17:32.913
So a lot less people are asking to be done, asking to, to do a lot more.
00:17:32.913 --> 00:17:35.762
So, uh, where, where do you see this going?
00:17:35.823 --> 00:17:46.353
Uh, you know, a lot of the expertise that you need for privacy regulation or GDPR or what have you, I assume is, is almost a completely different.
00:17:47.147 --> 00:17:51.827
Person rather than, like you said, the, the, the network engineers and things like that.
00:17:51.827 --> 00:17:54.528
So, um, do what do, what do you think?
00:17:54.528 --> 00:17:57.258
Is this a, is this a, uh, a contractor thing?
00:17:57.258 --> 00:17:59.538
Is this like a temporary services thing?
00:17:59.897 --> 00:18:01.042
Uh, what, what, what do you think?
00:18:02.083 --> 00:18:05.502
So I, I think, first of all, I would say that the song.
00:18:05.502 --> 00:18:13.303
Software that practitioners and experts use for GRC have improved drastically in the past,
00:18:13.488 --> 00:18:13.938
For sure.
00:18:13.992 --> 00:18:23.982
five years, you know, so it's gotten a lot more efficient for people like me to be able to do my job, and there's much better tools that we can deploy with Chev.
00:18:24.363 --> 00:18:25.893
A lot more automation, right?
00:18:25.893 --> 00:18:26.252
So like
00:18:26.458 --> 00:18:26.877
Mm-hmm.
00:18:27.212 --> 00:18:27.813
happening.
00:18:27.843 --> 00:18:29.282
Which is, which is great.
00:18:29.282 --> 00:18:33.002
And it, I think it makes, you know, the practitioners much more efficient.
00:18:33.153 --> 00:18:36.873
They can focus on the problems that maybe software isn't able to solve.
00:18:37.127 --> 00:18:37.248
I.
00:18:37.248 --> 00:18:40.458
Um, so I, I think that's a big part of, of what we're seeing happen.
00:18:40.788 --> 00:18:52.127
Um, and then to be honest, and maybe this sounds, you know, kind of self-fulfilling here, but I really believe that, um, you know, if this is not a core competency for you or your team, I think you should outsource it.
00:18:52.428 --> 00:18:52.698
Um,
00:18:52.813 --> 00:18:52.972
Mm-hmm.
00:18:53.178 --> 00:19:00.798
something where I think you can upskill someone to the extent that they can help maybe project manage it or act as like a liaison
00:19:01.143 --> 00:19:01.492
Right?
00:19:01.817 --> 00:19:04.548
and the, and the, um, the subject matter expert.
00:19:04.548 --> 00:19:04.728
But
00:19:04.782 --> 00:19:05.202
Mm-hmm.
00:19:05.238 --> 00:19:06.738
it's very unlikely that.
00:19:07.563 --> 00:19:12.573
Someone who is not, you know, making this, their core focus on a daily basis is gonna
00:19:12.633 --> 00:19:13.143
Yes.
00:19:14.073 --> 00:19:27.482
Um, so I happen to believe that, you know, again, maybe this is self-fulfilling, but I do believe that outsourcing it to a firm who has a lot of subject matter expertise in this space, I just think is more cost, cost and time effective.
00:19:28.262 --> 00:19:32.913
Yeah, I think, yeah, I think, I think that's probably, uh, gonna be the case, uh, for the foreseeable future.
00:19:32.913 --> 00:19:36.123
Obviously, uh, skills gap is not being solved anytime soon here.
00:19:36.123 --> 00:19:36.452
So,
00:19:36.827 --> 00:19:37.307
Agreed.
00:19:37.353 --> 00:19:42.182
your opinion, will are the most challenging data security and data privacy issues happening in the moment?
00:19:42.182 --> 00:19:47.313
I mean, obviously, you know, uh, what the regulations say the big ones are, but from a big picture, big stroke.
00:19:47.462 --> 00:19:52.682
Uh, perspective, what are some looming threats that organizations are turning to Will Sweeney and others to address?
00:19:53.748 --> 00:19:59.478
So I think, you know what, what we're seeing is there's a lot more compliance requirements that are coming along.
00:19:59.478 --> 00:20:01.157
I think you, you pointed that out earlier.
00:20:01.157 --> 00:20:01.607
So now we
00:20:01.653 --> 00:20:02.133
Mm-hmm.
00:20:02.508 --> 00:20:06.018
you know, CMMC, we've got the SEC cyber rules, we've got.
00:20:06.393 --> 00:20:15.542
Um, you know, the FTC now investigating, you know, contracts law to make sure that if companies are representing that they're compliant with something that they actually are.
00:20:15.873 --> 00:20:26.252
Um, you've got, you know, breaches where companies, you know, previously, you know, represented that they were protecting data that were not, and now they're being, you know, they're on the receiving
00:20:26.353 --> 00:20:26.633
Yeah.
00:20:26.972 --> 00:20:28.262
fines for, for that.
00:20:28.682 --> 00:20:34.022
Uh, and I, I think that this additional complexity around the compliance requirements is gonna conti continue to grow.
00:20:34.847 --> 00:20:38.147
and I think we're gonna continue to see more enforcement, not less.
00:20:38.538 --> 00:20:39.143
Um, I,
00:20:39.192 --> 00:20:39.482
Yeah.
00:20:39.557 --> 00:20:58.548
that, you know, that's something that companies are gonna have to navigate and, um, one of the challenges that I, I think comes along with that is, uh, having to implement software that can actually go out and find and classify data in the environment, um, and determine whether or not it is in scope for some sort of, um, compliance requirement or data privacy law.
00:20:58.847 --> 00:21:01.577
I think that that's, that's an, a challenge that companies have.
00:21:01.577 --> 00:21:01.938
I think they're.
00:21:02.192 --> 00:21:10.292
And have not had really good governance around their data and, and had a good understanding of, um, where that data was.
00:21:10.292 --> 00:21:15.002
And that's, that's extremely important for complying with any, um, data privacy law.
00:21:15.002 --> 00:21:20.972
And if you don't know where your data is, there's no way that you can implement the appropriate security controls to protect that data.
00:21:20.972 --> 00:21:25.323
So, you know, I think that those things are gonna continue to, to be important.
00:21:25.728 --> 00:21:34.397
Um, I think another area where I think everybody is talking about it is, um, you know, the, the advent of AI and what that's gonna mean for business.
00:21:34.397 --> 00:21:46.788
And I think a lot of companies now are trying to find new ways to implement AI technology and do it in a way where they're maintaining security and, uh, compliance and avoiding data loss.
00:21:47.147 --> 00:21:53.718
Um, I think, you know, there's gonna be a continued emphasis around, uh, around that and I think, um.
00:21:54.347 --> 00:22:06.407
I think there was a moratorium, uh, put in place either this week or last around states introducing their own ai, ai uh, laws at the state level so that the Fed can kind of preempt those, those laws.
00:22:06.407 --> 00:22:08.117
And we've got the EU AI Act.
00:22:08.117 --> 00:22:19.278
And, you know, I think that that's gonna be something where, um, you know, I, I, I'm, I think there's gonna be a lot more, um, emphasis placed on, on, on those types of things.
00:22:19.278 --> 00:22:20.807
So, I.
00:22:22.097 --> 00:22:43.938
I, I think with, with AI specifically, um, some of the technology you could argue runs counter to the data privacy laws where, uh, individuals are given the right to consent to the processing of their data while have those AI technologies, um, gather that data in a way that's lawful and in compliance with law.
00:22:43.998 --> 00:22:45.798
I'm not sure, um.
00:22:46.218 --> 00:22:53.238
If someone has, you know, wants to exercise their right for an organization to go through and actually delete the data, how do we actually pull that out?
00:22:53.718 --> 00:22:53.877
Mm-hmm.
00:22:54.077 --> 00:22:57.288
I'm not sure if that, if that's, if we're able to do that.
00:22:57.617 --> 00:23:09.887
Um, and so, you know, I think this kind of, there's gonna, there's a little bit of, kind of a juxtaposition happening with, um, you know, these emerging AI tools and the consumption of data that they need to run, be effective.
00:23:10.367 --> 00:23:10.698
Oh yeah.
00:23:10.803 --> 00:23:14.792
what the data privacy laws say that you have to do as an organization when you're processing data.
00:23:14.792 --> 00:23:21.002
So I think those are the big themes that I see happening now and I think will continue to be really important.
00:23:21.452 --> 00:23:23.702
Um, in the next, you know, 12 to 24 months.
00:23:23.702 --> 00:23:23.762
I.
00:23:24.258 --> 00:23:24.468
Yeah.
00:23:24.468 --> 00:23:31.938
Now, uh, you mentioned, you know, you need to know where your date is, to know how to secure it and, and, and, and, and stuff.
00:23:31.938 --> 00:23:32.147
Do you, I.
00:23:33.077 --> 00:23:45.528
Have, are there any commonalities of things that you see a lot of companies need improving that, that kind of surprise you like, like really, you know, what you would think of as like blind spots in terms of their security posture?
00:23:45.798 --> 00:23:50.057
Are, are there things that a lot of companies just aren't doing or aren't thinking to do?
00:23:50.738 --> 00:23:53.347
Yeah, and I, I think, you know, some of the basics, right?
00:23:53.347 --> 00:24:08.198
So doing phishing training, having multifactor authentication in place, making sure that, you know, standard users don't have excessive privileges, like they're not local administrators or have other special privileges within the environment.
00:24:09.377 --> 00:24:14.567
having a lot of service accounts with a, a shared password, you know, stuff like that.
00:24:14.567 --> 00:24:20.238
I think a lot of those things seem, seem very basic, but they, they very often get overlooked.
00:24:20.298 --> 00:24:20.748
And,
00:24:21.032 --> 00:24:21.603
Mm-hmm.
00:24:22.157 --> 00:24:29.538
you know, fixing those particular issues, that goes a very long way into, you know, maturing your, your po, your security posture.
00:24:30.258 --> 00:24:31.307
Oh yeah, absolutely.
00:24:31.307 --> 00:24:31.428
Yeah.
00:24:31.428 --> 00:24:39.258
No, it seems wild to me that that that multifactor is not sort of like standard practice at this point, but it's still not for a lot of people.
00:24:39.887 --> 00:24:40.667
It's very weird.
00:24:40.938 --> 00:24:49.397
I think I, I think the statistic is something like 60 to 70% of security incidents are as, as a result of, you know, a phishing attack.
00:24:49.877 --> 00:24:50.178
Yeah.
00:24:50.178 --> 00:24:58.577
these, you know, I think everyone has this misconception that it's, you know, really sophisticated attackers sitting in a, a room somewhere launching zero day exploits.
00:24:59.553 --> 00:25:04.202
it's, it's kind of brute force phishing attacks that lead to the majority of security incidents
00:25:04.442 --> 00:25:04.863
Mm-hmm.
00:25:04.952 --> 00:25:06.512
a ransomware event or something like that.
00:25:06.512 --> 00:25:09.932
So it's, it's, it's shocking, but you're, you know, you're right.
00:25:09.932 --> 00:25:11.438
It, it, it's a lot of the basics.
00:25:12.708 --> 00:25:21.948
So for listeners who wanna get into the work of, of data privacy and the sort of work that you do, what, what should they be working on now to make themselves more appealing to potential employers?
00:25:21.948 --> 00:25:30.107
Because like, like you said, I know there's a lot of new factors entering, you know, AI tools and, and things are pretty disrupted at the moment.
00:25:30.438 --> 00:25:35.567
Like, what, where should they be focusing their, their talents and interests at the moment to sort of hit this field running?
00:25:36.647 --> 00:25:44.268
I, I think spending time actually researching and learn, learning the background of the data privacy regs, um, what's happening in that space.
00:25:44.268 --> 00:25:52.607
I think also spending time, um, learning around about something like SOC two or ISO 27,001 and understanding those concepts.
00:25:52.847 --> 00:25:54.887
I think that's a good basic understanding.
00:25:55.248 --> 00:25:55.667
Um.
00:25:56.883 --> 00:26:02.462
I would say spend some time learning the very, the basic things that comprise those requirements.
00:26:02.468 --> 00:26:02.887
Mm-hmm.
00:26:03.002 --> 00:26:04.982
understand what a data mapping is.
00:26:05.222 --> 00:26:08.827
Understand what's important about privacy notices and consent management.
00:26:09.528 --> 00:26:09.768
Yep.
00:26:10.113 --> 00:26:22.532
you know, there's a lot of really good, uh, information out there on the web, and although it's very dense, I would say, you know, actually sit down and read what's in those requirements and just kind of familiarize yourself with it conceptually.
00:26:22.952 --> 00:26:29.222
Um, I think that's a good place to start and, and, um, and do some, you know, and, and learn a good bit about this.
00:26:29.688 --> 00:26:30.258
Yeah, I.
00:26:31.067 --> 00:26:39.198
You know, I, I not, not to sort of flatten all of these, these big, you know, privacy, uh, platforms down, you know, too excessively.
00:26:39.198 --> 00:26:53.147
I imagine there's really kind of 10 or 20 sort of core things you need to understand and that a lot of those kind of repeat almost verbatim from, from, uh, you know, re re regulatory, you know, framework to another.
00:26:53.147 --> 00:26:54.018
Is that, is that the case?
00:26:54.242 --> 00:27:14.343
Mm-hmm.
00:27:14.344 --> 00:27:14.345
Mm-hmm.
00:27:14.643 --> 00:27:23.133
policy, have an access management policy, implement controls, make sure those controls are in place and that they're operating effectively o over a certain period of time.
00:27:23.133 --> 00:27:28.863
So a lot of those core concepts, um, regardless of what the regulation or compliance framework is,
00:27:28.932 --> 00:27:29.353
Mm-hmm.
00:27:29.373 --> 00:27:31.863
you know, to your point, they're very, very similar across the board.
00:27:32.673 --> 00:27:45.063
Yeah, no, I, that's, that's interesting because I, you know, I think it would be easy enough to wanna become, you know, a master of one if, especially if you think you're gonna work for a European company or you're gonna work for someone in California, and you just targeted on that.
00:27:45.063 --> 00:27:50.702
But if you spend more time maybe just understanding the core concepts that unite them all, then it gets.
00:27:51.208 --> 00:27:58.198
You, you sort of like diversify your skillset by being able to kind of zigzag between these and say, okay, well this one requires this six things.
00:27:58.198 --> 00:28:02.307
This one requires these 12 things, but six of them are same, you know, from here to there.
00:28:02.307 --> 00:28:05.847
And I suppose that really makes you a lot more flexible as a potential candidate, right?
00:28:06.337 --> 00:28:07.327
Yeah, exactly.
00:28:07.327 --> 00:28:13.718
And when you're talking to, you know, organizations that have to deal with those problems, you can talk about them even at a very high level, right?
00:28:13.718 --> 00:28:14.617
A conceptual level.
00:28:14.617 --> 00:28:14.978
Like I
00:28:15.239 --> 00:28:15.240
Mm-hmm.
00:28:15.548 --> 00:28:16.688
what those things are and.
00:28:16.853 --> 00:28:17.143
Yeah.
00:28:17.222 --> 00:28:20.343
think that in itself is a really good starting point for a conversation.
00:28:21.182 --> 00:28:21.962
Yeah, yeah, yeah.
00:28:21.962 --> 00:28:35.073
You know, I've, I've met some pretty amazing guitarists over the years, and the ones that say they just learned every single chord in the chord book, you know, I think get a lot further than those that, uh, just keep playing the same song over and over until they, they master it or whatever.
00:28:35.073 --> 00:28:40.383
So it's, uh, yeah, I think that's awesome advice in terms of, uh, understanding sort of the, the building blocks of these.
00:28:40.442 --> 00:28:43.353
Uh, so, um, pulling back a little bit, uh.
00:28:43.393 --> 00:28:48.462
You know, not to add a whole bunch of new people to your, uh, to the slipstream here.
00:28:48.462 --> 00:28:52.603
Do you have any advice for people going into data privacy regulation or GRC consultancy?
00:28:52.873 --> 00:29:00.553
So for like, for listeners who might have an entrepreneurial itch, are there hidden challenges to getting a consultancy practice like this off the ground and taking it to a new level?
00:29:01.397 --> 00:29:08.298
You know what I, I think I really, um, everyone talks about going out and starting their own business and
00:29:08.397 --> 00:29:08.817
Mm-hmm.
00:29:08.928 --> 00:29:10.998
consulting firm and, and all those kinds of things.
00:29:11.208 --> 00:29:13.577
I think what people often underestimate is I.
00:29:14.553 --> 00:29:22.442
know, to really be successful, you need to be able to demonstrate to a client or a potential client your expertise in that particular space, right?
00:29:22.442 --> 00:29:23.492
So that's obvious.
00:29:23.643 --> 00:29:25.442
You need to be really good at what you're doing.
00:29:25.833 --> 00:29:29.313
And then the other thing is you really need to be able to build a team, right?
00:29:29.313 --> 00:29:29.732
So once
00:29:29.792 --> 00:29:30.083
Yeah.
00:29:30.692 --> 00:29:34.712
one client or two client, maybe you get to five or 10 clients.
00:29:35.012 --> 00:29:39.002
You need to be able to build a team to be able to go out and execute on those engagements.
00:29:39.272 --> 00:29:43.472
So you need to also be able to attract people to your business to come help.
00:29:43.803 --> 00:29:45.393
You know, those clients, right?
00:29:45.393 --> 00:29:48.153
So, um, that's probably a hidden challenge.
00:29:48.153 --> 00:29:57.482
I, I always say, you know, um, I think, you know, hiring your first person or your second person is probably one of the hardest things you'll, you'll ever do when you start a business.
00:29:57.482 --> 00:29:58.113
At least for me it
00:29:58.113 --> 00:29:58.192
Hmm.
00:29:59.222 --> 00:30:03.603
um, and doing it at the same time as actually going out and executing on,
00:30:03.748 --> 00:30:04.038
Yeah.
00:30:04.053 --> 00:30:05.192
delivery of the service.
00:30:05.252 --> 00:30:06.573
It is very, very challenging.
00:30:07.518 --> 00:30:24.528
but I, I think if you're willing to, you know, spend the time, really gain that expertise, um, provide that thought leadership and, and kind of differentiate, differentiate your, differentiate yourself to, you know, you know, clients about what it is that you're able to bring to the table and why it's important.
00:30:24.708 --> 00:30:26.208
I think that resonates with people.
00:30:26.208 --> 00:30:36.288
And I think that, um, from there it's really just kind of following through and executing at a very high level and making sure your customers are, are, are happy on a continuous basis with the work that you're providing them.
00:30:37.282 --> 00:30:37.472
Okay.
00:30:37.472 --> 00:30:40.893
You said the magic word there, uh, the, the, the hardest job you'll have to do.
00:30:40.893 --> 00:30:48.573
Can you talk about what the, the challenges are or any advice you have around hiring your first employee if you're starting a, a, a consultancy like that?
00:30:48.603 --> 00:30:53.042
'cause that's, that sounds like, uh, something people really are gonna need to watch out for.
00:30:53.042 --> 00:30:54.423
'cause that's like, that's where you start.
00:30:54.423 --> 00:30:57.393
So, uh, what, what, what are some of the pitfalls in involved in that?
00:30:58.042 --> 00:30:58.682
Um.
00:30:59.028 --> 00:31:00.077
Don't hire friends.
00:31:00.107 --> 00:31:00.678
I would say that
00:31:01.008 --> 00:31:01.157
Yeah.
00:31:01.307 --> 00:31:02.268
an obvious one.
00:31:02.633 --> 00:31:02.923
Sure.
00:31:03.107 --> 00:31:06.048
try not to hire, hire friends if you can avoid it.
00:31:06.048 --> 00:31:10.008
Obviously you don't want to, um, know, mess up a personal relationship.
00:31:10.008 --> 00:31:10.698
That's not good.
00:31:10.992 --> 00:31:11.272
Mm-hmm.
00:31:11.867 --> 00:31:18.827
and obviously you need to be also able to provide difficult feedback to people if they're not performing at the level that you need them to.
00:31:18.913 --> 00:31:19.333
Mm-hmm.
00:31:19.428 --> 00:31:21.978
Um, and it's not really nice to do that with a friend.
00:31:22.157 --> 00:31:24.468
Uh, so that's a, that's a common issue.
00:31:24.857 --> 00:31:34.788
Um, I would say, you know, you also need to be in a position where you can compensate someone, you know, equal to or above where the market says that they should be being
00:31:34.833 --> 00:31:35.123
Yeah.
00:31:35.928 --> 00:31:40.248
If you can't do that, then you're gonna have to probably offer them some sort of equity in the business.
00:31:40.248 --> 00:31:43.488
And, you know, people probably, you know, people view that differently.
00:31:43.488 --> 00:31:46.278
Some people are okay with that idea and some people are not.
00:31:46.682 --> 00:32:01.202
Um, you know, my particular case, my feeling was I wanted to be able to go out and, and justify a hire based off of, um, the revenue that existed in the business and not have to, um, start, you know, introducing, you know, equity into the conversation.
00:32:01.232 --> 00:32:03.573
'cause I, I thought that that was gonna be even more confusing.
00:32:04.053 --> 00:32:07.262
Um, and, you know, I, I think just.
00:32:08.448 --> 00:32:13.127
Being very specific about what your expectations are on both sides of the table.
00:32:13.127 --> 00:32:15.678
What does this person want to get out of the job and
00:32:15.792 --> 00:32:16.022
Yep.
00:32:16.157 --> 00:32:21.798
need to get, um, out of the person who's, who's coming into your business and hopefully helping you grow the business?
00:32:21.798 --> 00:32:21.827
I.
00:32:22.413 --> 00:32:22.742
Nice.
00:32:22.772 --> 00:32:23.012
Okay.
00:32:23.012 --> 00:32:24.633
That's, uh, yeah, excellent advice.
00:32:24.633 --> 00:32:25.742
Um, so.
00:32:26.732 --> 00:32:32.942
Looking to the years coming, do you, what, where do you see the state of GRC going?
00:32:32.942 --> 00:32:42.242
I mean, we mentioned AI LLMs, uh, do you see more privacy frameworks mushrooming up or maybe more consolidating of the existing ones?
00:32:42.452 --> 00:32:45.512
What do you think the landscape's gonna look like in, in say, five or 10 years?
00:32:46.383 --> 00:32:51.692
I think in the US we're, we're probably, I think it's unlikely at this point that we'll see a, the.
00:32:51.843 --> 00:32:53.972
Federal privacy law, maybe it will happen.
00:32:53.972 --> 00:32:55.803
I'm not sure, but I think it's unlikely.
00:32:56.222 --> 00:33:06.182
Uh, I think last week it, I think Massachusetts introduced a new privacy law, so I think we're up to somewhere around 20 plus US states with their own individual privacy laws.
00:33:06.268 --> 00:33:06.347
Hmm.
00:33:06.423 --> 00:33:07.923
that that trend is gonna continue.
00:33:08.403 --> 00:33:18.752
Um, I know Australia right now is working on updates to its privacy protection law, um, and we've got a myriad of other privacy regs across, you know, Europe.
00:33:19.143 --> 00:33:24.212
Um, Canada and Latin America, and even India and, and, and Asia and China and so on.
00:33:24.633 --> 00:33:33.002
Uh, so I, I think that this kind of, um, this kind of dispersion of, of different requirements is gonna continue kind of be the same going forward.
00:33:33.002 --> 00:33:41.702
I think as it pertains to, um, AI protection laws, I think that we'll probably see a more unified front on, on that side of things.
00:33:41.702 --> 00:33:43.563
At least in the us I think the US.
00:33:44.403 --> 00:33:50.553
Probably recognizes that, uh, the approach for pri US privacy law was maybe not the best one.
00:33:50.553 --> 00:33:55.532
And I think they're trying to get ahead of putting more sensible requirements in place around ai.
00:33:55.532 --> 00:34:02.073
And I think that's, that's, that's also, you know, representative of how we're viewing the risk around ai.
00:34:02.762 --> 00:34:03.873
Uh, which I think is a good thing.
00:34:05.123 --> 00:34:05.542
Mm-hmm.
00:34:05.702 --> 00:34:11.762
specific to, uh, you know, the GRC role in general, I would say that the role is gonna continue to evolve.
00:34:11.762 --> 00:34:12.152
I think I.
00:34:12.603 --> 00:34:18.063
Uh, what's helpful is the software tools have, have really, really drastically improved over the past several
00:34:18.242 --> 00:34:18.847
Oh gosh, yes.
00:34:19.112 --> 00:34:26.492
a lot more, tools that we can use to help deliver solutions to customers and even manage those requirements internally.
00:34:27.452 --> 00:34:29.253
I think that that's, that's very helpful.
00:34:29.253 --> 00:34:39.063
And I, I would say probably even in these GRC tools, you'll start to see the adoption of some sort of AI technology or AI agent that will help facilitate the.
00:34:39.617 --> 00:34:43.788
Uh, ongoing maintenance of, of controls and, uh, requirements.
00:34:43.788 --> 00:34:50.418
I think that will help reduce the burden and, and introduce some additional efficiency, uh, to GRC.
00:34:51.708 --> 00:34:59.268
and I would say, um, you know, there, there's gonna continue to be this issue around just a resource deficit.
00:34:59.688 --> 00:35:03.288
I think that AI is gonna eliminate certain jobs.
00:35:04.413 --> 00:35:17.762
but I think it's also going to, I think we're gonna wind up in a very similar situation we are in now where you're going to need, uh, practitioners and subject matter experts who will really understand those tools to even be able to implement them and manage them, right?
00:35:17.762 --> 00:35:18.242
So
00:35:18.293 --> 00:35:18.492
Mm-hmm.
00:35:18.588 --> 00:35:20.478
I don't see that shifting and going away.
00:35:20.478 --> 00:35:25.967
I think this GRC function as a whole, uh, continues to be more important in the coming years.
00:35:26.208 --> 00:35:36.557
Um, and I, I think with, with new tools, there's always gonna need to be folks who are really well read up on how to leverage those, uh, software products to help us, um, be successful in this area.
00:35:37.518 --> 00:35:37.818
Yeah.
00:35:37.847 --> 00:35:42.918
Now, uh, as we wrap up here, we're, we're getting close to the end of our, of, of our, of our time here.
00:35:42.978 --> 00:35:43.068
Uh.
00:35:44.807 --> 00:36:07.338
One of the sort of archetypes that you know, or people who, you know, write to us with comments and so forth is, is the, you know, the person who feels they're stuck in a help desk role or a very low level SOC role, and they don't quite know what they need to do to move into more specialized areas and like Yeah, like you said, I think the next 10 years it's gonna be all specialization, it's gonna be all, um.
00:36:07.847 --> 00:36:16.518
Knowledge, you know, based, you know, and, and a lot less sort of brute, uh, you know, rote work and so forth, that, that goes with those type of roles.
00:36:16.728 --> 00:36:25.818
Uh, do you have any sort of, um, strategies for helping someone to, uh, sort of get out of these, these sort of lower level, uh, grunt roles into something more substantive?
00:36:26.512 --> 00:36:27.083
Yeah.
00:36:27.143 --> 00:36:33.713
You know, first of all, I, I would say a, a SOC job or a help desk job is a great entry into this space.
00:36:33.853 --> 00:36:34.273
Mm-hmm.
00:36:34.492 --> 00:36:34.853
and if
00:36:35.027 --> 00:36:35.447
Oh yeah.
00:36:35.543 --> 00:36:49.193
in one of those roles, I would say if there's a GRC function within the organization, if it's, if it's a, um, it's an indu industry that you're working in, I would say reach out to those folks and understand, you know, what they're doing, and try to get involved as much as you can.
00:36:49.652 --> 00:37:04.443
If you're working for an MSSP or some sort of MSP and you want to kind of pivot into more of this GRC and compliance space, go out and, and find those free resources that are out there on Google and LinkedIn and, and read about them.
00:37:04.773 --> 00:37:11.882
Um, we, we have someone on our team who, um, spend about 30 years working in the fitness industry.
00:37:12.588 --> 00:37:15.467
Decided that he no longer wanted to work in the fitness industry.
00:37:15.768 --> 00:37:20.807
Um, started spending a lot of time, um, learning and, and reading resources on Google and LinkedIn.
00:37:21.108 --> 00:37:25.788
And then he went out and got a, a master's in cybersecurity from, from an online university.
00:37:25.788 --> 00:37:27.168
And he's phenomenal.
00:37:27.168 --> 00:37:27.378
I mean,
00:37:27.552 --> 00:37:27.972
Mm-hmm.
00:37:28.458 --> 00:37:32.208
he's one of the best, uh, folks on our team and we're, we're very fortunate to have'em.
00:37:32.628 --> 00:37:38.568
Um, so, you know, but you've gotta be willing to roll your sleeves up and do that work and go out and learn and talk to people and.
00:37:38.943 --> 00:37:45.932
Um, go out and re-skill and, and there's a lot of great free resources out there that are, I would say again, Google and LinkedIn have, have a lot of those.
00:37:46.472 --> 00:37:46.862
Mm-hmm.
00:37:47.043 --> 00:37:55.532
you need to go back and pursue, uh, another degree, I would say, um, it can certainly be worth it if you can, uh, find yourself in even an entry level role in GRC.
00:37:56.432 --> 00:37:56.762
Yeah.
00:37:56.822 --> 00:37:57.123
Yeah.
00:37:57.123 --> 00:38:01.833
No, yeah, we, that's, that's another big part of our, our demographic is people pivoting later in life.
00:38:01.833 --> 00:38:08.132
And I, yeah, I suppose that's probably the, kinda the best advice you can give is, you know, sort of just learn your way into it.
00:38:08.132 --> 00:38:11.972
You know, it's, you're not, you're not necessarily gonna have experience, but you will have, I.
00:38:12.693 --> 00:38:22.322
I suppose some advantage over, you know, an entry level, you know, or a student trying to apply for a, a job like that because people know you can do work.
00:38:22.322 --> 00:38:23.012
You know, that
00:38:23.208 --> 00:38:23.657
Mm-hmm.
00:38:23.822 --> 00:38:27.422
years in the fitness industry means, you know, I know how to come to work every day.
00:38:27.422 --> 00:38:30.632
I know how to, you know, finish a task and so forth.
00:38:30.632 --> 00:38:34.262
And I think that's, I think that's, that's as, as valuable as anything.
00:38:34.262 --> 00:38:36.003
So, uh, so one, yeah.
00:38:36.003 --> 00:38:40.952
As, as we wrap up, what, what's, uh, what's the best piece of career advice or advice in general you ever received?
00:38:40.952 --> 00:38:41.012
I.
00:38:42.407 --> 00:38:49.038
Um, my dad had all, all these like very basic maxims that, um, you know, I told you earlier he was a HVAC and plumbing,
00:38:49.487 --> 00:38:49.878
Yeah.
00:38:50.117 --> 00:38:51.228
plumbing guy, and.
00:38:51.632 --> 00:38:57.632
I just remember working with him when I was in high school on jobs, and he would always tell me like, just do the job, right?
00:38:58.052 --> 00:39:01.682
Um, he would tell me, Murphy's Law, whatever can go wrong, is gonna go wrong.
00:39:02.043 --> 00:39:06.092
Um, he would say never get too excited about the highs or too upset about the lows.
00:39:06.483 --> 00:39:12.152
Uh, so, you know, those were some very basic maxims that he gave me that have always stuck with me through the years.
00:39:12.213 --> 00:39:12.632
Mm-hmm.
00:39:12.813 --> 00:39:20.132
And, um, you know, a, an, an opportunity to watch my dad who, who ran his own, uh, plumbing business up close.
00:39:21.018 --> 00:39:23.297
always treated the customers right?
00:39:23.358 --> 00:39:28.188
Even if they were difficult, he was always going out of his way to make sure that they were happy.
00:39:28.188 --> 00:39:36.827
And in certain cases, he wouldn't charge them for work that he did, just because he felt like this was someone who was gonna continue to be a good customer for him in the long term.
00:39:36.827 --> 00:39:37.097
Right?
00:39:37.097 --> 00:39:37.518
So
00:39:37.637 --> 00:39:38.208
Mm-hmm.
00:39:38.327 --> 00:39:45.288
that that's, that's really important is, um, you know, some of those very basic maxims that he shared with me and, um.
00:39:46.128 --> 00:39:50.297
making sure that you're treating customers extremely well and doing the best possible job you can.
00:39:50.898 --> 00:39:52.788
Yeah, great, great advice.
00:39:52.788 --> 00:39:55.128
All around, they're, they're called maxims for a reason.
00:39:55.128 --> 00:39:56.208
They stick around for a reason.
00:39:56.208 --> 00:39:57.288
They, they are always useful.
00:39:57.288 --> 00:40:01.668
So, uh, as we wrap up, tell our listeners more about, about Zian and, and the work you do.
00:40:02.538 --> 00:40:05.838
So Zavian is a data security and privacy consulting firm.
00:40:05.898 --> 00:40:10.998
Uh, we help our clients navigate complex security compliance requirements and data privacy laws.
00:40:10.998 --> 00:40:11.027
I.
00:40:11.853 --> 00:40:25.538
we do that by building programs, processes and procedures, and by implementing GRC software to support their business requirements, uh, we specialize in things like third party risk management, uh, SOC two and uh, GDPR compliance.
00:40:26.492 --> 00:40:26.822
Nice.
00:40:26.913 --> 00:40:27.213
All right.
00:40:27.213 --> 00:40:28.713
And one last, uh, request here.
00:40:28.713 --> 00:40:32.282
Tell our listeners where to find more Will Sweeney and and ENT online.
00:40:33.242 --> 00:40:36.663
You can find us@zian.com and uh, I'm on LinkedIn.
00:40:36.722 --> 00:40:39.452
I spend a lot of time on LinkedIn and we also, uh, our
00:40:39.483 --> 00:40:39.813
Great.
00:40:39.902 --> 00:40:41.432
on LinkedIn as well, so follow us on there.
00:40:42.032 --> 00:40:42.603
Fantastic.
00:40:42.603 --> 00:40:45.422
Well, we'll will thank you for your insights and all this great privacy talk.
00:40:45.427 --> 00:40:45.807
It was a lot of fun.
00:40:46.322 --> 00:40:47.313
Thank you so much, Chris.
00:40:47.313 --> 00:40:48.333
It was nice talking to you today.
00:40:48.902 --> 00:40:53.072
And, uh, thank you to everyone who watches, listens, and writes into the podcast with feedback.
00:40:53.072 --> 00:40:59.132
If you have any topics you'd like us to cover or guests you'd like to see on the show, drop'em in the comments, uh, or make use of our YouTube community tab.
00:40:59.132 --> 00:41:03.722
We're trying to get that a lot more active, or, Hey, uh, stop by our TikTok channel info sec.
00:41:03.927 --> 00:41:26.483
Edu Uh, before we go, don't forget, InfoSec institute.com/free is a place where you can get a whole bunch of free and exclusive stuff for cyber work listeners, including our free cybersecurity Talent Development Playbook, which, uh, contains in-depth training plans and strategies for the 12 most common security roles, including SOC analyst, pen tester, cloud security engineer, information risk analyst, privacy manager eight.
00:41:26.588 --> 00:41:29.018
The secure coder ICS, professional and more.
00:41:29.498 --> 00:41:38.137
If you wanna know how much a career in cybersecurity pays, get our free cybersecurity salary guide for the latest data on popular certifications and their related roles.
00:41:38.378 --> 00:41:43.867
There's also security awareness posters, eBooks, and you can sign up for a hundred plus free courses, uh, for a month.
00:41:43.867 --> 00:41:45.338
In our InfoSec skills platform.
00:41:45.338 --> 00:41:48.338
You can learn incident response, forensic security architecture, and more.
00:41:48.847 --> 00:41:54.668
Uh, all of that is@infosecinstitute.com slash free, and the link is in the description below.
00:41:55.023 --> 00:41:55.952
One last time.
00:41:55.952 --> 00:41:59.643
Thank you to Will Sweeney and Aviant, and thank you all for watching and listening.
00:41:59.972 --> 00:42:01.443
Uh, this is Chris Sanko signing off.
00:42:01.443 --> 00:42:03.963
Until next time, make sure to learn something new every day.
00:42:04.172 --> 00:42:05.853
Keep one step ahead of the story.
00:42:05.853 --> 00:42:08.163
And don't forget, don't forget to have a little fun along the way.
00:42:08.552 --> 00:42:09.182
All right, bye for now.
00:00:00.050 --> 00:00:07.759
Today on cyber work, will Sweeney of Avit joins me to discuss data privacy, GRC and the future of privacy regulations.
00:00:08.419 --> 00:00:13.970
Avit has overseen complex information security audits for much of the Fortune 100 companies.
00:00:14.419 --> 00:00:18.679
We talk about everything from the split between the skills needed for security auditing.
00:00:18.879 --> 00:00:31.239
Versus security implementation, whether privacy, regulatory frameworks will continue multiplying or begin a process of consolidation, as well as a key way to understand many different compliance frameworks at once.
00:00:31.600 --> 00:00:36.460
The tip is to focus on the security processes themselves, not the structure of the framework.
00:00:36.909 --> 00:00:38.049
GRC, aspirants.
00:00:38.109 --> 00:00:42.009
There's a lot of tips to get you started here, so that's all today on cyber work.
00:00:42.957 --> 00:00:45.747
The IT and cybersecurity job market is thriving.
00:00:46.078 --> 00:00:51.328
The Bureau of Labor Statistics predicts 377, 500 new IT jobs annually.
00:00:51.768 --> 00:00:59.807
You need skill and hustle to obtain these jobs, of course, but the good news is that cybersecurity professionals can look forward to extremely competitive salaries.
00:01:00.128 --> 00:01:09.862
That's why InfoSec has leveraged 20 years of industry experience Drawing from multiple sources to give you, cyber work listeners, an analysis of the most popular and top paying industry certifications.
00:01:10.222 --> 00:01:13.332
You can use it to navigate your way to a good paying cyber security career.
00:01:13.632 --> 00:01:19.203
So to get your free copy of our cyber security salary guide ebook, just click the link in the description below.
00:01:19.203 --> 00:01:20.962
It's right there near the top, just below me.
00:01:20.962 --> 00:01:21.582
You can't miss it.
00:01:21.983 --> 00:01:26.852
click the link in the description and download our free cyber security salary guide ebook.
00:01:27.112 --> 00:01:29.433
Your cyber security journey starts here.
00:01:29.813 --> 00:01:40.132
Now let's get the show started Welcome to this week's episode of the Cyber Work Podcast.
00:01:40.313 --> 00:01:41.813
I'm your host, Chris Sanko.
00:01:41.843 --> 00:01:45.623
My guests are a cross section of cybersecurity industry thought leaders.
00:01:45.893 --> 00:01:57.772
Our goal is to help you learn about cybersecurity trends and how those trends affect the work of InfoSec professionals, as well as leaving you with some tips and advice for breaking in or moving up in the cybersecurity industry.
00:01:58.358 --> 00:02:02.798
My guest today, will Sweeney is the founding and managing partner of Aviant.
00:02:03.158 --> 00:02:13.147
Before starting the firm in 2016, he held leadership roles at companies, including KPMG, Comcast and IBM, gaining valuable experience overseeing complex information security audits.
00:02:13.603 --> 00:02:26.112
Data privacy compliance for much of the Fortune 100 today will leads Ian's ever-growing team of data privacy and security experts who serve as trusted advisors to some of the nation's most prominent enterprises.
00:02:26.443 --> 00:02:29.263
Will has been featured in the Philadelphia Business Journal.
00:02:29.268 --> 00:02:34.367
40 under 40 and Titan 100 lists and is an active member of the Forbes Technology Council.
00:02:34.698 --> 00:02:39.168
Additionally, he is frequently published and quoted in the media for his ex industry expertise.
00:02:39.707 --> 00:02:51.647
When networking at aviant Will is involved in a number of community and philanthropic initiatives, including the Giorgio Foundation, Irish American Business Chamber Network, the Centennial Education Foundation, the Uncommon Individual Foundation.
00:02:51.937 --> 00:02:54.877
And the Union League of Philadelphia's Legacy Foundation.
00:02:55.207 --> 00:02:59.948
So today we're gonna be talking data privacy and GRC and whatever else comes up today.
00:02:59.948 --> 00:03:02.737
So Will, thanks for joining me and welcome to Cyber work.
00:03:03.147 --> 00:03:05.962
Hey Chris, thank you so much for having me look forward to the conversation today.
00:03:06.307 --> 00:03:06.997
Absolutely.
00:03:06.997 --> 00:03:07.478
Same here.
00:03:07.478 --> 00:03:10.358
So, uh, so will, let's start, uh, about your early years.
00:03:10.358 --> 00:03:14.737
Do you remember what the initial spark was that got you excited about, uh, tech Cybersecurity?
00:03:15.518 --> 00:03:15.758
Yeah.
00:03:15.758 --> 00:03:22.057
So, um, I was really lucky at an early age for, um, my dad who, uh, knew nothing about computers.
00:03:22.057 --> 00:03:25.538
He was a, uh, HVAC and, and plumbing technician.
00:03:25.897 --> 00:03:31.147
Um, he, he knew that computers were gonna be important, so he, he went out and bought me a computer at a very early age.
00:03:31.487 --> 00:03:31.707
Hmm.
00:03:31.973 --> 00:03:38.992
I remember it being a Packard Bell computer and just kind of, you know, doing some initial experimentation with it and trying to learn.
00:03:39.353 --> 00:03:45.443
I think at that point we were on Windows 95, maybe, I'm not even a hundred percent sure, but,
00:03:45.687 --> 00:03:45.907
Hm.
00:03:46.252 --> 00:03:56.842
you know, had a chance to, to learn a lot about it and just getting used to the Windows environment and then just taking various courses at, um, both my middle school and in, in high school.
00:03:57.247 --> 00:04:08.407
Um, I can still remember I had a professor in, in middle school who, um, he made us memorize the keyboard and I can still, to this day, I know all of the keys on the keyboard and what order they go in.
00:04:08.828 --> 00:04:09.187
Yeah.
00:04:09.307 --> 00:04:13.147
and I also was really fortunate to have a, uh, a teacher in high school.
00:04:13.177 --> 00:04:14.828
Uh, Carolyn Fisher was her name,
00:04:15.157 --> 00:04:15.457
Hmm.
00:04:15.848 --> 00:04:20.288
who, uh, let me actually build the high, the, uh, website for our high school.
00:04:20.677 --> 00:04:25.447
Um, and uh, it was kind of the first, uh, website that the high school had and.
00:04:26.093 --> 00:04:28.642
You know, just really started to kind of pick things up from there.
00:04:28.642 --> 00:04:33.923
And, um, going to college, I built my own computer and assembled the parts and things.
00:04:33.923 --> 00:04:35.812
And now that's kind of a trendy thing to do.
00:04:35.812 --> 00:04:37.612
I think a lot of people do that nowadays.
00:04:37.612 --> 00:04:41.033
But, um, back then it was, um, not, not as common.
00:04:41.377 --> 00:04:42.997
It was a leap of faith back then for sure.
00:04:43.028 --> 00:04:47.108
'cause yeah, you were, you were just sort of putting all these pieces together and, and yeah.
00:04:47.108 --> 00:04:52.987
Even now there's still you, you know, doing little mismatches can really cause big problems down the line.
00:04:52.987 --> 00:04:53.348
So Yeah.
00:04:53.348 --> 00:04:55.298
That's a, that's a hard challenge now.
00:04:55.327 --> 00:04:58.267
Um, I I wanted to back up a couple of things there.
00:04:58.327 --> 00:05:09.367
Uh, when you were, uh, asked to do the school's website, was it, were you already sort of learning HTML or was this like a real big leap of faith in terms of like, oh, I have to.
00:05:09.742 --> 00:05:13.882
I have to learn how to do this now, but they just sort of were like, you're a, you know, you're a computer guy.
00:05:13.973 --> 00:05:14.603
Why don't you do it?
00:05:15.127 --> 00:05:15.548
Yeah.
00:05:15.728 --> 00:05:16.927
Um, a little bit of both.
00:05:16.987 --> 00:05:27.908
Um, I did, I did spend some time learning about HTML and, um, you know, just some basic, um, tags and, and things like that and how to structure a website and, um, I took to that pretty quickly.
00:05:27.968 --> 00:05:32.377
Um, but back then we were using a product called, um, Dreamweaver,
00:05:33.038 --> 00:05:33.458
Oh, yeah.
00:05:33.458 --> 00:05:34.822
That's what I, that's what I learned on too.
00:05:34.853 --> 00:05:35.122
Nice.
00:05:35.168 --> 00:05:35.677
yeah,
00:05:35.903 --> 00:05:35.992
Mm-hmm.
00:05:36.007 --> 00:05:43.358
started building with Dreamweaver and then learned a little bit about, um, flash Script and I, I think it was called Action Script back then.
00:05:44.452 --> 00:05:49.913
so, you know, started learning about the action script language and then, um, the website from there.
00:05:49.913 --> 00:05:55.583
And like, looking back at it, I mean, you can go back on the, on the way back machine and see the website, what I created back then and,
00:05:55.802 --> 00:05:56.033
Yeah.
00:05:56.062 --> 00:05:57.442
um, very rudimentary.
00:05:57.442 --> 00:06:03.473
But, um, you know, it was, it was exciting, you know, it was something that I, I'd never done before and I, I was given a really nice opportunity to do it.
00:06:04.627 --> 00:06:05.798
That, that is really cool.
00:06:05.798 --> 00:06:13.898
And, uh, yeah, I, I'm in full agreement that, uh, I think, uh, of all the things I learned in high school learning, uh, touch typing and knowing where all the keys on the keyboard are.
00:06:14.978 --> 00:06:17.588
Nothing else has served me in life quite like that has
00:06:17.978 --> 00:06:18.548
Right.
00:06:18.908 --> 00:06:20.708
absolutely cornerstone at this point.
00:06:20.737 --> 00:06:21.038
So,
00:06:21.127 --> 00:06:21.487
Yeah.
00:06:21.697 --> 00:06:24.577
so I wanna go a little forward into some of your, your key career roles.
00:06:24.577 --> 00:06:30.187
You started strongly in roles around it, but your interest in focus, uh, over the past many years has been, I.
00:06:30.627 --> 00:06:38.427
Uh, specifically around data security, data privacy, regulation, uh, was this a, a a, an interest pivot or an opportunity pivot?
00:06:38.427 --> 00:06:47.968
Did you, did someone sort of get you, uh, you know, into these type of roles, or did, was this like more interesting to you than the sort of ITIS stuff?
00:06:48.023 --> 00:06:51.533
You know, I, I kind of, kind of stumbled my way in.
00:06:51.562 --> 00:06:59.723
To, um, data security compliance, starting at, um, KPMG, doing a lot of Sarbanes Oxley and IT general control testing.
00:07:00.173 --> 00:07:05.122
Um, and then spent some time doing, um, FSMA and fiscam reviews for the federal government.
00:07:05.603 --> 00:07:08.122
Um, so that was mostly kind of audit experience.
00:07:08.122 --> 00:07:15.802
And then later when I worked for IBM, um, I was in their data security and privacy, uh, practice and helping companies actually sit on the other side.
00:07:15.802 --> 00:07:17.663
So not doing the audits, but actually doing.
00:07:18.052 --> 00:07:22.523
Uh, implementations and consulting engagements to help companies to comply with a variety of,
00:07:22.952 --> 00:07:23.242
Okay.
00:07:23.423 --> 00:07:25.612
you know, primarily information security frameworks.
00:07:25.612 --> 00:07:27.952
So SOC two, iso, nist, that kind of thing.
00:07:28.403 --> 00:07:40.733
Um, and, and, um, of out of the blue, one of the partners and I were talking a little bit about, um, GDPR, which, um, at the time was a, an emerging data privacy regulation that nobody really knew very much about.
00:07:41.033 --> 00:07:44.302
Um, and she said to me, she said, Hey, listen, we think that this is gonna be a big thing.
00:07:44.302 --> 00:07:47.572
We we're not really sure, but we'd like for you to go kind of learn about it.
00:07:47.963 --> 00:07:54.833
Um, and I started really going out there and just initially just reading and understanding the text around the GDPR and what, what the article
00:07:55.098 --> 00:07:55.338
Mm-hmm.
00:07:56.512 --> 00:08:03.773
And I pretty quickly realized that, you know, this was gonna be a huge problem for companies, that they were gonna have to comply with this regulation.
00:08:04.403 --> 00:08:09.173
It was kind of a, its first of its kind, which carried very significant fines for noncompliance.
00:08:09.173 --> 00:08:09.653
So,
00:08:09.653 --> 00:08:09.952
Yeah.
00:08:10.103 --> 00:08:13.012
um, you know, I knew that they were gonna have to do something and.
00:08:13.718 --> 00:08:20.858
also baked in a lot of, uh, in addition to the data privacy requirements, it baked in a lot of information security requirements as well, which I had a strong background in.
00:08:21.307 --> 00:08:36.878
Um, so, you know, honestly I think I spent probably about a year really, you know, gaining a, a really strong understanding of the GDPR and then shortly after, um, started Zian and went out to market thinking like maybe this is an area where we can, we can help some companies.
00:08:36.908 --> 00:08:41.258
And, um, I always tell people, I think I drastically underestimated the.
00:08:41.602 --> 00:08:48.232
Amount of work that was out there and the, uh, the opportunity around helping companies comply with these, um, these requirements.
00:08:48.232 --> 00:08:50.067
It really was just opportunistic.
00:08:50.918 --> 00:08:51.307
Thanks.
00:08:51.607 --> 00:08:52.327
Uh, okay.
00:08:52.327 --> 00:08:53.258
So, um.
00:08:54.173 --> 00:09:02.842
Because a lot of, uh, the listenership of this show is, is sort of trying to figure out what types of work they want to do later on.
00:09:02.842 --> 00:09:12.773
Can you draw a distinction in terms of like, the actual day-to-day tasks between someone who's doing the, uh, the sort of audit versus doing the implementation?
00:09:12.773 --> 00:09:19.702
Obviously, I, I, I realize they're sort of related, uh, and obviously one's a lot more hands on than the other, but, uh, what, what, what, what's the difference between the two?
00:09:20.457 --> 00:09:30.687
Yeah, so when you're doing an audit, and, and one of the things that I, I did not really like about audit was, um, you, you would go in and conduct these assessments of these organizations and.
00:09:31.043 --> 00:09:32.332
You would issue a report.
00:09:32.332 --> 00:09:34.403
Here are where all of your problems are.
00:09:34.462 --> 00:09:34.793
Right?
00:09:34.793 --> 00:09:36.653
And, and really that's what the audit's meant to do.
00:09:36.653 --> 00:09:42.472
It's to, um, yeah, we obviously want to give credit for the good things that you're doing, but we wanna point out more
00:09:42.513 --> 00:09:43.302
Like that.
00:09:43.763 --> 00:09:44.033
right?
00:09:44.033 --> 00:09:50.663
So that you can go out and start actually remediating those gaps in preparation for getting a clean audit opinion in the future.
00:09:51.143 --> 00:09:58.403
Um, you know, in a consulting, in, in, in a consulting engagement, you're still doing that assessment to understand where the gaps are.
00:09:59.648 --> 00:10:05.707
you know, what I really liked about it was then taking those gaps and actually solving those problems for, for customers, right?
00:10:05.707 --> 00:10:06.337
Where the audit
00:10:06.462 --> 00:10:06.543
Hmm.
00:10:07.057 --> 00:10:14.707
You know, what I didn't really like about it was, um, in, in my experience, a lot of times it wasn't that these companies didn't understand that they had problems.
00:10:14.707 --> 00:10:17.347
It, that they didn't really understand how to fix the problems.
00:10:17.587 --> 00:10:24.217
So, going into that consulting setting was, you know, not only were we calling out the, the issues, we were actually helping this to solve'em and.
00:10:24.577 --> 00:10:34.207
I think that's the big difference between the two is in a consulting engagement, you're really hands-on sitting with the company and, and, and, uh, and helping to fix the issues that you've, you've identified.
00:10:34.442 --> 00:10:34.863
Mm-hmm.
00:10:34.947 --> 00:10:35.158
Mm-hmm.
00:10:35.427 --> 00:10:45.868
And I, I, I imagine that requires a little, a lot different background in terms of like your skills or, or are, are, or can you sort of start from the same and sort of diverge into the two different roles?
00:10:46.182 --> 00:10:50.528
You know, I, I think what's interesting is I think I probably started more so on the, I.
00:10:51.577 --> 00:11:05.918
Technical side of things and some of my, my colleagues who are auditors and I think that they, the auditors, um, are typically very good at understanding the requirements and how to apply them, but they may not have the technical acumen to actually go out and fix those gaps.
00:11:05.998 --> 00:11:06.347
Right.
00:11:06.427 --> 00:11:11.048
So I kind of started more on the technical side and then did the audit, and then moved into the consulting.
00:11:11.048 --> 00:11:14.557
So I would say you're right, there's very similar skillset there, but I
00:11:14.842 --> 00:11:15.113
Got it.
00:11:15.398 --> 00:11:17.977
it can be difficult for an auditor to bridge that gap.
00:11:19.043 --> 00:11:19.582
Good to know.
00:11:19.582 --> 00:11:26.243
So, uh, you mentioned that, you know, the, these, these particular types of, uh, job roles.
00:11:26.258 --> 00:11:30.758
Uh, basically moved you into where you are now with, with Zian Consulting.
00:11:30.758 --> 00:11:33.097
Can you talk about your current role as, as managing partner?
00:11:33.128 --> 00:11:41.648
'cause uh, obviously this is a pretty, uh, big role and a pretty big jump up and you've, you know, helped a lot of big time companies with their compliance and security posture.
00:11:41.648 --> 00:11:48.817
So what is, what is the work like now in, in the sort of managing partner space as as opposed to the implementation that you did before?
00:11:48.817 --> 00:11:48.878
Yeah.
00:11:49.352 --> 00:11:49.623
Yeah.
00:11:49.623 --> 00:12:03.993
So yeah, now I'm, I'm really, um, my focus is really on, you know, making sure that the team, uh, understands, um, the services that we're going to market and that we're providing, making sure that we're bringing the best possible delivery to our clients.
00:12:03.993 --> 00:12:04.052
I.
00:12:04.357 --> 00:12:10.957
Um, going out and finding new opportunities, um, with, with, with new, new clients.
00:12:11.437 --> 00:12:15.128
Um, and, you know, my role has really shifted, right?
00:12:15.128 --> 00:12:19.207
So I'm not as hands-on with the delivery of the service as I once was.
00:12:19.508 --> 00:12:27.878
Although I love doing the delivery of the service now, I'm really focused more on kind of scaling and growing a business and in my capacity as a managing partner here.
00:12:28.298 --> 00:12:33.013
Um, but in order for me to be successful in that role, I still need to be able to talk to the clients.
00:12:33.712 --> 00:12:39.263
Understand the problems that they're having, understand the regulations that they're having to comply with.
00:12:39.653 --> 00:12:53.393
Uh, I'm still working very closely to make sure we have stakeholder buy-in across the various levels of the business, including in the C level, um, communicating across different, you know, jurisdiction is in different operating entities.
00:12:53.753 --> 00:12:59.898
Um, so that, that, is kind of shifted is, I would say more, uh, communication heavy and stakeholder heavy.
00:13:00.317 --> 00:13:00.918
Um.
00:13:01.863 --> 00:13:07.113
That, that's kind of the big difference now is I'm not as hands-on with the delivery as I once was.
00:13:07.352 --> 00:13:16.893
And, and I'm very fortunate because my team is, is really, you know, there, there's some really good experts on our team who are really probably at this point better than I am at, at doing the delivery.
00:13:16.893 --> 00:13:16.952
I.
00:13:18.423 --> 00:13:31.442
Um, without, uh, you know, obviously, uh, you know, listing out specific problems that certain clients have, but can you gimme an example of some of the types of challenges that you're being asked to.
00:13:32.118 --> 00:13:34.577
Solve in these particular situations.
00:13:34.577 --> 00:13:42.677
Can you sort of give me some of the, like the, the top level, most common, uh, you know, security regulation problems or whatever that ENT is, is working on?
00:13:43.623 --> 00:13:46.832
A lot of, a lot of what we're doing is helping companies to come.
00:13:46.893 --> 00:14:00.842
Comply with things like the GDPR and the US State Privacy Laws, um, helping to build out third party risk management programs, um, helping companies to comply with things like the CMMC or ISO 27,001.
00:14:01.442 --> 00:14:10.832
Um, and I think kind of the, the common theme there amongst those requirements is, again, just going back, I think you really need stakeholder buy-in and support across the
00:14:11.067 --> 00:14:11.357
Yeah.
00:14:11.493 --> 00:14:12.903
of the, of the organization.
00:14:13.307 --> 00:14:22.067
Um, and you know, one of the things I'm doing quite regularly is helping just kind of navigate the complexity of all of those requirements and how they relate to each other and how they differ.
00:14:22.908 --> 00:14:33.498
and coming at it from kind of a, a programmatic point of view to say, you know, maybe if we do these five things for GDPR compliance, it also helps us, for us state privacy law compliance.
00:14:33.692 --> 00:14:34.143
Mm.
00:14:34.368 --> 00:14:38.207
I would say those big themes are the, the, uh, data privacy laws and the,
00:14:38.373 --> 00:14:38.673
Yep.
00:14:38.807 --> 00:14:41.597
party risk programs and information security requirements.
00:14:42.153 --> 00:14:45.903
What are the most common hindrances to buy-in?
00:14:45.903 --> 00:14:51.557
Because I, you know, I, I, you would think maybe it's, it's money, but it's not money because they're, they're hiring you to get this thing done.
00:14:51.658 --> 00:14:52.317
So is it just.
00:14:53.118 --> 00:14:55.817
The complexity of it, is it people don't want to change?
00:14:55.817 --> 00:15:03.557
Is it, uh, general exhaustion with having to sort of like, figure out all these new sort of compliance regulations?
00:15:03.557 --> 00:15:05.927
Where, where, where's the, the friction happening usually?
00:15:06.452 --> 00:15:06.903
It.
00:15:06.903 --> 00:15:08.403
I think a lot of it is.
00:15:08.942 --> 00:15:10.232
You know, a knowledge gap.
00:15:10.293 --> 00:15:12.663
And I think a lot of it is a resource gap.
00:15:12.722 --> 00:15:20.043
So, you know, a, I think a lot of people really don't understand, you know, exactly how to go about solving these issues.
00:15:20.342 --> 00:15:30.332
And then B, even if they do understand it, a lot of times they don't think they, they have the, the either the right resources or the number of resources that they need to deal with these problems.
00:15:30.332 --> 00:15:35.312
Because the reality is that, you know, complying with these requirements.
00:15:36.332 --> 00:15:39.722
can be very, um, resource intensive and time intensive.
00:15:39.722 --> 00:15:42.633
It's, it's not something that you just do one time.
00:15:42.783 --> 00:15:45.932
You have to do it, and then you have to maintain it on an ongoing basis.
00:15:45.932 --> 00:15:48.148
So it, it is very resource and time intensive.
00:15:48.918 --> 00:15:49.187
Yeah.
00:15:49.217 --> 00:16:00.932
Does that, I mean, do those resources involve just adding more sort of work to the workflow, more people to the pipeline or sort of throwing money at the problem or just sort of a combination of all those things?
00:16:01.388 --> 00:16:04.533
Yeah, I would say it's a combination of, of all of those things.
00:16:04.592 --> 00:16:05.072
Um.
00:16:05.373 --> 00:16:19.893
But you know, you the pro, one of the other issues I would say is you can't take someone who's really good at network engineering and have them help with, you know, complying with the GDPR or building out a data map or building out a privacy
00:16:20.028 --> 00:16:20.628
Right.
00:16:20.852 --> 00:16:22.592
two very different skillsets.
00:16:22.832 --> 00:16:23.133
You
00:16:23.302 --> 00:16:23.543
yeah.
00:16:23.763 --> 00:16:27.783
as much as we can't go do network engineering and administration or
00:16:27.962 --> 00:16:28.312
Right.
00:16:29.342 --> 00:16:34.113
you know, they cannot go, do, you know, the same things that we can do around, um, the compliance requirements.
00:16:34.113 --> 00:16:34.442
So.
00:16:34.842 --> 00:16:35.133
Okay.
00:16:35.163 --> 00:16:44.913
say there's a big kind of, um, you know, to my earlier point, I think there's a, there's both a resource issue from like a number of resources, but a really an expertise standpoint.
00:16:44.913 --> 00:16:45.153
And,
00:16:45.258 --> 00:16:45.827
Interesting.
00:16:45.903 --> 00:16:54.138
that's an industry wide problem where I think across the industry, we just don't have enough folks who really understand, um, how to deal with these problems.
00:16:55.038 --> 00:16:55.398
Yeah.
00:16:55.398 --> 00:17:07.097
Now, uh, I'm assuming that most of the, uh, the companies you work with, their solution is not, well, let's hire someone who is an expert in that area, but is sort of like, let's upskill the people we have now.
00:17:07.097 --> 00:17:10.397
Is, I mean, do you have a, any thoughts on that?
00:17:10.428 --> 00:17:19.218
Like, like, I know we're trying to solve the, the primary problem around cybersecurity right now, but, um, you know, I mean, we're also seeing.
00:17:19.232 --> 00:17:27.722
You know, contractions of, of, of SOX and security teams, you know, due to budgets, due to, uh, economic circumstances or whatever.
00:17:27.722 --> 00:17:32.913
So a lot less people are asking to be done, asking to, to do a lot more.
00:17:32.913 --> 00:17:35.762
So, uh, where, where do you see this going?
00:17:35.823 --> 00:17:46.353
Uh, you know, a lot of the expertise that you need for privacy regulation or GDPR or what have you, I assume is, is almost a completely different.
00:17:47.147 --> 00:17:51.827
Person rather than, like you said, the, the, the network engineers and things like that.
00:17:51.827 --> 00:17:54.528
So, um, do what do, what do you think?
00:17:54.528 --> 00:17:57.258
Is this a, is this a, uh, a contractor thing?
00:17:57.258 --> 00:17:59.538
Is this like a temporary services thing?
00:17:59.897 --> 00:18:01.042
Uh, what, what, what do you think?
00:18:02.083 --> 00:18:05.502
So I, I think, first of all, I would say that the song.
00:18:05.502 --> 00:18:13.303
Software that practitioners and experts use for GRC have improved drastically in the past,
00:18:13.488 --> 00:18:13.938
For sure.
00:18:13.992 --> 00:18:23.982
five years, you know, so it's gotten a lot more efficient for people like me to be able to do my job, and there's much better tools that we can deploy with Chev.
00:18:24.363 --> 00:18:25.893
A lot more automation, right?
00:18:25.893 --> 00:18:26.252
So like
00:18:26.458 --> 00:18:26.877
Mm-hmm.
00:18:27.212 --> 00:18:27.813
happening.
00:18:27.843 --> 00:18:29.282
Which is, which is great.
00:18:29.282 --> 00:18:33.002
And it, I think it makes, you know, the practitioners much more efficient.
00:18:33.153 --> 00:18:36.873
They can focus on the problems that maybe software isn't able to solve.
00:18:37.127 --> 00:18:37.248
I.
00:18:37.248 --> 00:18:40.458
Um, so I, I think that's a big part of, of what we're seeing happen.
00:18:40.788 --> 00:18:52.127
Um, and then to be honest, and maybe this sounds, you know, kind of self-fulfilling here, but I really believe that, um, you know, if this is not a core competency for you or your team, I think you should outsource it.
00:18:52.428 --> 00:18:52.698
Um,
00:18:52.813 --> 00:18:52.972
Mm-hmm.
00:18:53.178 --> 00:19:00.798
something where I think you can upskill someone to the extent that they can help maybe project manage it or act as like a liaison
00:19:01.143 --> 00:19:01.492
Right?
00:19:01.817 --> 00:19:04.548
and the, and the, um, the subject matter expert.
00:19:04.548 --> 00:19:04.728
But
00:19:04.782 --> 00:19:05.202
Mm-hmm.
00:19:05.238 --> 00:19:06.738
it's very unlikely that.
00:19:07.563 --> 00:19:12.573
Someone who is not, you know, making this, their core focus on a daily basis is gonna
00:19:12.633 --> 00:19:13.143
Yes.
00:19:14.073 --> 00:19:27.482
Um, so I happen to believe that, you know, again, maybe this is self-fulfilling, but I do believe that outsourcing it to a firm who has a lot of subject matter expertise in this space, I just think is more cost, cost and time effective.
00:19:28.262 --> 00:19:32.913
Yeah, I think, yeah, I think, I think that's probably, uh, gonna be the case, uh, for the foreseeable future.
00:19:32.913 --> 00:19:36.123
Obviously, uh, skills gap is not being solved anytime soon here.
00:19:36.123 --> 00:19:36.452
So,
00:19:36.827 --> 00:19:37.307
Agreed.
00:19:37.353 --> 00:19:42.182
your opinion, will are the most challenging data security and data privacy issues happening in the moment?
00:19:42.182 --> 00:19:47.313
I mean, obviously, you know, uh, what the regulations say the big ones are, but from a big picture, big stroke.
00:19:47.462 --> 00:19:52.682
Uh, perspective, what are some looming threats that organizations are turning to Will Sweeney and others to address?
00:19:53.748 --> 00:19:59.478
So I think, you know what, what we're seeing is there's a lot more compliance requirements that are coming along.
00:19:59.478 --> 00:20:01.157
I think you, you pointed that out earlier.
00:20:01.157 --> 00:20:01.607
So now we
00:20:01.653 --> 00:20:02.133
Mm-hmm.
00:20:02.508 --> 00:20:06.018
you know, CMMC, we've got the SEC cyber rules, we've got.
00:20:06.393 --> 00:20:15.542
Um, you know, the FTC now investigating, you know, contracts law to make sure that if companies are representing that they're compliant with something that they actually are.
00:20:15.873 --> 00:20:26.252
Um, you've got, you know, breaches where companies, you know, previously, you know, represented that they were protecting data that were not, and now they're being, you know, they're on the receiving
00:20:26.353 --> 00:20:26.633
Yeah.
00:20:26.972 --> 00:20:28.262
fines for, for that.
00:20:28.682 --> 00:20:34.022
Uh, and I, I think that this additional complexity around the compliance requirements is gonna conti continue to grow.
00:20:34.847 --> 00:20:38.147
and I think we're gonna continue to see more enforcement, not less.
00:20:38.538 --> 00:20:39.143
Um, I,
00:20:39.192 --> 00:20:39.482
Yeah.
00:20:39.557 --> 00:20:58.548
that, you know, that's something that companies are gonna have to navigate and, um, one of the challenges that I, I think comes along with that is, uh, having to implement software that can actually go out and find and classify data in the environment, um, and determine whether or not it is in scope for some sort of, um, compliance requirement or data privacy law.
00:20:58.847 --> 00:21:01.577
I think that that's, that's an, a challenge that companies have.
00:21:01.577 --> 00:21:01.938
I think they're.
00:21:02.192 --> 00:21:10.292
And have not had really good governance around their data and, and had a good understanding of, um, where that data was.
00:21:10.292 --> 00:21:15.002
And that's, that's extremely important for complying with any, um, data privacy law.
00:21:15.002 --> 00:21:20.972
And if you don't know where your data is, there's no way that you can implement the appropriate security controls to protect that data.
00:21:20.972 --> 00:21:25.323
So, you know, I think that those things are gonna continue to, to be important.
00:21:25.728 --> 00:21:34.397
Um, I think another area where I think everybody is talking about it is, um, you know, the, the advent of AI and what that's gonna mean for business.
00:21:34.397 --> 00:21:46.788
And I think a lot of companies now are trying to find new ways to implement AI technology and do it in a way where they're maintaining security and, uh, compliance and avoiding data loss.
00:21:47.147 --> 00:21:53.718
Um, I think, you know, there's gonna be a continued emphasis around, uh, around that and I think, um.
00:21:54.347 --> 00:22:06.407
I think there was a moratorium, uh, put in place either this week or last around states introducing their own ai, ai uh, laws at the state level so that the Fed can kind of preempt those, those laws.
00:22:06.407 --> 00:22:08.117
And we've got the EU AI Act.
00:22:08.117 --> 00:22:19.278
And, you know, I think that that's gonna be something where, um, you know, I, I, I'm, I think there's gonna be a lot more, um, emphasis placed on, on, on those types of things.
00:22:19.278 --> 00:22:20.807
So, I.
00:22:22.097 --> 00:22:43.938
I, I think with, with AI specifically, um, some of the technology you could argue runs counter to the data privacy laws where, uh, individuals are given the right to consent to the processing of their data while have those AI technologies, um, gather that data in a way that's lawful and in compliance with law.
00:22:43.998 --> 00:22:45.798
I'm not sure, um.
00:22:46.218 --> 00:22:53.238
If someone has, you know, wants to exercise their right for an organization to go through and actually delete the data, how do we actually pull that out?
00:22:53.718 --> 00:22:53.877
Mm-hmm.
00:22:54.077 --> 00:22:57.288
I'm not sure if that, if that's, if we're able to do that.
00:22:57.617 --> 00:23:09.887
Um, and so, you know, I think this kind of, there's gonna, there's a little bit of, kind of a juxtaposition happening with, um, you know, these emerging AI tools and the consumption of data that they need to run, be effective.
00:23:10.367 --> 00:23:10.698
Oh yeah.
00:23:10.803 --> 00:23:14.792
what the data privacy laws say that you have to do as an organization when you're processing data.
00:23:14.792 --> 00:23:21.002
So I think those are the big themes that I see happening now and I think will continue to be really important.
00:23:21.452 --> 00:23:23.702
Um, in the next, you know, 12 to 24 months.
00:23:23.702 --> 00:23:23.762
I.
00:23:24.258 --> 00:23:24.468
Yeah.
00:23:24.468 --> 00:23:31.938
Now, uh, you mentioned, you know, you need to know where your date is, to know how to secure it and, and, and, and, and stuff.
00:23:31.938 --> 00:23:32.147
Do you, I.
00:23:33.077 --> 00:23:45.528
Have, are there any commonalities of things that you see a lot of companies need improving that, that kind of surprise you like, like really, you know, what you would think of as like blind spots in terms of their security posture?
00:23:45.798 --> 00:23:50.057
Are, are there things that a lot of companies just aren't doing or aren't thinking to do?
00:23:50.738 --> 00:23:53.347
Yeah, and I, I think, you know, some of the basics, right?
00:23:53.347 --> 00:24:08.198
So doing phishing training, having multifactor authentication in place, making sure that, you know, standard users don't have excessive privileges, like they're not local administrators or have other special privileges within the environment.
00:24:09.377 --> 00:24:14.567
having a lot of service accounts with a, a shared password, you know, stuff like that.
00:24:14.567 --> 00:24:20.238
I think a lot of those things seem, seem very basic, but they, they very often get overlooked.
00:24:20.298 --> 00:24:20.748
And,
00:24:21.032 --> 00:24:21.603
Mm-hmm.
00:24:22.157 --> 00:24:29.538
you know, fixing those particular issues, that goes a very long way into, you know, maturing your, your po, your security posture.
00:24:30.258 --> 00:24:31.307
Oh yeah, absolutely.
00:24:31.307 --> 00:24:31.428
Yeah.
00:24:31.428 --> 00:24:39.258
No, it seems wild to me that that that multifactor is not sort of like standard practice at this point, but it's still not for a lot of people.
00:24:39.887 --> 00:24:40.667
It's very weird.
00:24:40.938 --> 00:24:49.397
I think I, I think the statistic is something like 60 to 70% of security incidents are as, as a result of, you know, a phishing attack.
00:24:49.877 --> 00:24:50.178
Yeah.
00:24:50.178 --> 00:24:58.577
these, you know, I think everyone has this misconception that it's, you know, really sophisticated attackers sitting in a, a room somewhere launching zero day exploits.
00:24:59.553 --> 00:25:04.202
it's, it's kind of brute force phishing attacks that lead to the majority of security incidents
00:25:04.442 --> 00:25:04.863
Mm-hmm.
00:25:04.952 --> 00:25:06.512
a ransomware event or something like that.
00:25:06.512 --> 00:25:09.932
So it's, it's, it's shocking, but you're, you know, you're right.
00:25:09.932 --> 00:25:11.438
It, it, it's a lot of the basics.
00:25:12.708 --> 00:25:21.948
So for listeners who wanna get into the work of, of data privacy and the sort of work that you do, what, what should they be working on now to make themselves more appealing to potential employers?
00:25:21.948 --> 00:25:30.107
Because like, like you said, I know there's a lot of new factors entering, you know, AI tools and, and things are pretty disrupted at the moment.
00:25:30.438 --> 00:25:35.567
Like, what, where should they be focusing their, their talents and interests at the moment to sort of hit this field running?
00:25:36.647 --> 00:25:44.268
I, I think spending time actually researching and learn, learning the background of the data privacy regs, um, what's happening in that space.
00:25:44.268 --> 00:25:52.607
I think also spending time, um, learning around about something like SOC two or ISO 27,001 and understanding those concepts.
00:25:52.847 --> 00:25:54.887
I think that's a good basic understanding.
00:25:55.248 --> 00:25:55.667
Um.
00:25:56.883 --> 00:26:02.462
I would say spend some time learning the very, the basic things that comprise those requirements.
00:26:02.468 --> 00:26:02.887
Mm-hmm.
00:26:03.002 --> 00:26:04.982
understand what a data mapping is.
00:26:05.222 --> 00:26:08.827
Understand what's important about privacy notices and consent management.
00:26:09.528 --> 00:26:09.768
Yep.
00:26:10.113 --> 00:26:22.532
you know, there's a lot of really good, uh, information out there on the web, and although it's very dense, I would say, you know, actually sit down and read what's in those requirements and just kind of familiarize yourself with it conceptually.
00:26:22.952 --> 00:26:29.222
Um, I think that's a good place to start and, and, um, and do some, you know, and, and learn a good bit about this.
00:26:29.688 --> 00:26:30.258
Yeah, I.
00:26:31.067 --> 00:26:39.198
You know, I, I not, not to sort of flatten all of these, these big, you know, privacy, uh, platforms down, you know, too excessively.
00:26:39.198 --> 00:26:53.147
I imagine there's really kind of 10 or 20 sort of core things you need to understand and that a lot of those kind of repeat almost verbatim from, from, uh, you know, re re regulatory, you know, framework to another.
00:26:53.147 --> 00:26:54.018
Is that, is that the case?
00:26:54.242 --> 00:27:14.343
Mm-hmm.
00:27:14.344 --> 00:27:14.345
Mm-hmm.
00:27:14.643 --> 00:27:23.133
policy, have an access management policy, implement controls, make sure those controls are in place and that they're operating effectively o over a certain period of time.
00:27:23.133 --> 00:27:28.863
So a lot of those core concepts, um, regardless of what the regulation or compliance framework is,
00:27:28.932 --> 00:27:29.353
Mm-hmm.
00:27:29.373 --> 00:27:31.863
you know, to your point, they're very, very similar across the board.
00:27:32.673 --> 00:27:45.063
Yeah, no, I, that's, that's interesting because I, you know, I think it would be easy enough to wanna become, you know, a master of one if, especially if you think you're gonna work for a European company or you're gonna work for someone in California, and you just targeted on that.
00:27:45.063 --> 00:27:50.702
But if you spend more time maybe just understanding the core concepts that unite them all, then it gets.
00:27:51.208 --> 00:27:58.198
You, you sort of like diversify your skillset by being able to kind of zigzag between these and say, okay, well this one requires this six things.
00:27:58.198 --> 00:28:02.307
This one requires these 12 things, but six of them are same, you know, from here to there.
00:28:02.307 --> 00:28:05.847
And I suppose that really makes you a lot more flexible as a potential candidate, right?
00:28:06.337 --> 00:28:07.327
Yeah, exactly.
00:28:07.327 --> 00:28:13.718
And when you're talking to, you know, organizations that have to deal with those problems, you can talk about them even at a very high level, right?
00:28:13.718 --> 00:28:14.617
A conceptual level.
00:28:14.617 --> 00:28:14.978
Like I
00:28:15.239 --> 00:28:15.240
Mm-hmm.
00:28:15.548 --> 00:28:16.688
what those things are and.
00:28:16.853 --> 00:28:17.143
Yeah.
00:28:17.222 --> 00:28:20.343
think that in itself is a really good starting point for a conversation.
00:28:21.182 --> 00:28:21.962
Yeah, yeah, yeah.
00:28:21.962 --> 00:28:35.073
You know, I've, I've met some pretty amazing guitarists over the years, and the ones that say they just learned every single chord in the chord book, you know, I think get a lot further than those that, uh, just keep playing the same song over and over until they, they master it or whatever.
00:28:35.073 --> 00:28:40.383
So it's, uh, yeah, I think that's awesome advice in terms of, uh, understanding sort of the, the building blocks of these.
00:28:40.442 --> 00:28:43.353
Uh, so, um, pulling back a little bit, uh.
00:28:43.393 --> 00:28:48.462
You know, not to add a whole bunch of new people to your, uh, to the slipstream here.
00:28:48.462 --> 00:28:52.603
Do you have any advice for people going into data privacy regulation or GRC consultancy?
00:28:52.873 --> 00:29:00.553
So for like, for listeners who might have an entrepreneurial itch, are there hidden challenges to getting a consultancy practice like this off the ground and taking it to a new level?
00:29:01.397 --> 00:29:08.298
You know what I, I think I really, um, everyone talks about going out and starting their own business and
00:29:08.397 --> 00:29:08.817
Mm-hmm.
00:29:08.928 --> 00:29:10.998
consulting firm and, and all those kinds of things.
00:29:11.208 --> 00:29:13.577
I think what people often underestimate is I.
00:29:14.553 --> 00:29:22.442
know, to really be successful, you need to be able to demonstrate to a client or a potential client your expertise in that particular space, right?
00:29:22.442 --> 00:29:23.492
So that's obvious.
00:29:23.643 --> 00:29:25.442
You need to be really good at what you're doing.
00:29:25.833 --> 00:29:29.313
And then the other thing is you really need to be able to build a team, right?
00:29:29.313 --> 00:29:29.732
So once
00:29:29.792 --> 00:29:30.083
Yeah.
00:29:30.692 --> 00:29:34.712
one client or two client, maybe you get to five or 10 clients.
00:29:35.012 --> 00:29:39.002
You need to be able to build a team to be able to go out and execute on those engagements.
00:29:39.272 --> 00:29:43.472
So you need to also be able to attract people to your business to come help.
00:29:43.803 --> 00:29:45.393
You know, those clients, right?
00:29:45.393 --> 00:29:48.153
So, um, that's probably a hidden challenge.
00:29:48.153 --> 00:29:57.482
I, I always say, you know, um, I think, you know, hiring your first person or your second person is probably one of the hardest things you'll, you'll ever do when you start a business.
00:29:57.482 --> 00:29:58.113
At least for me it
00:29:58.113 --> 00:29:58.192
Hmm.
00:29:59.222 --> 00:30:03.603
um, and doing it at the same time as actually going out and executing on,
00:30:03.748 --> 00:30:04.038
Yeah.
00:30:04.053 --> 00:30:05.192
delivery of the service.
00:30:05.252 --> 00:30:06.573
It is very, very challenging.
00:30:07.518 --> 00:30:24.528
but I, I think if you're willing to, you know, spend the time, really gain that expertise, um, provide that thought leadership and, and kind of differentiate, differentiate your, differentiate yourself to, you know, you know, clients about what it is that you're able to bring to the table and why it's important.
00:30:24.708 --> 00:30:26.208
I think that resonates with people.
00:30:26.208 --> 00:30:36.288
And I think that, um, from there it's really just kind of following through and executing at a very high level and making sure your customers are, are, are happy on a continuous basis with the work that you're providing them.
00:30:37.282 --> 00:30:37.472
Okay.
00:30:37.472 --> 00:30:40.893
You said the magic word there, uh, the, the, the hardest job you'll have to do.
00:30:40.893 --> 00:30:48.573
Can you talk about what the, the challenges are or any advice you have around hiring your first employee if you're starting a, a, a consultancy like that?
00:30:48.603 --> 00:30:53.042
'cause that's, that sounds like, uh, something people really are gonna need to watch out for.
00:30:53.042 --> 00:30:54.423
'cause that's like, that's where you start.
00:30:54.423 --> 00:30:57.393
So, uh, what, what, what are some of the pitfalls in involved in that?
00:30:58.042 --> 00:30:58.682
Um.
00:30:59.028 --> 00:31:00.077
Don't hire friends.
00:31:00.107 --> 00:31:00.678
I would say that
00:31:01.008 --> 00:31:01.157
Yeah.
00:31:01.307 --> 00:31:02.268
an obvious one.
00:31:02.633 --> 00:31:02.923
Sure.
00:31:03.107 --> 00:31:06.048
try not to hire, hire friends if you can avoid it.
00:31:06.048 --> 00:31:10.008
Obviously you don't want to, um, know, mess up a personal relationship.
00:31:10.008 --> 00:31:10.698
That's not good.
00:31:10.992 --> 00:31:11.272
Mm-hmm.
00:31:11.867 --> 00:31:18.827
and obviously you need to be also able to provide difficult feedback to people if they're not performing at the level that you need them to.
00:31:18.913 --> 00:31:19.333
Mm-hmm.
00:31:19.428 --> 00:31:21.978
Um, and it's not really nice to do that with a friend.
00:31:22.157 --> 00:31:24.468
Uh, so that's a, that's a common issue.
00:31:24.857 --> 00:31:34.788
Um, I would say, you know, you also need to be in a position where you can compensate someone, you know, equal to or above where the market says that they should be being
00:31:34.833 --> 00:31:35.123
Yeah.
00:31:35.928 --> 00:31:40.248
If you can't do that, then you're gonna have to probably offer them some sort of equity in the business.
00:31:40.248 --> 00:31:43.488
And, you know, people probably, you know, people view that differently.
00:31:43.488 --> 00:31:46.278
Some people are okay with that idea and some people are not.
00:31:46.682 --> 00:32:01.202
Um, you know, my particular case, my feeling was I wanted to be able to go out and, and justify a hire based off of, um, the revenue that existed in the business and not have to, um, start, you know, introducing, you know, equity into the conversation.
00:32:01.232 --> 00:32:03.573
'cause I, I thought that that was gonna be even more confusing.
00:32:04.053 --> 00:32:07.262
Um, and, you know, I, I think just.
00:32:08.448 --> 00:32:13.127
Being very specific about what your expectations are on both sides of the table.
00:32:13.127 --> 00:32:15.678
What does this person want to get out of the job and
00:32:15.792 --> 00:32:16.022
Yep.
00:32:16.157 --> 00:32:21.798
need to get, um, out of the person who's, who's coming into your business and hopefully helping you grow the business?
00:32:21.798 --> 00:32:21.827
I.
00:32:22.413 --> 00:32:22.742
Nice.
00:32:22.772 --> 00:32:23.012
Okay.
00:32:23.012 --> 00:32:24.633
That's, uh, yeah, excellent advice.
00:32:24.633 --> 00:32:25.742
Um, so.
00:32:26.732 --> 00:32:32.942
Looking to the years coming, do you, what, where do you see the state of GRC going?
00:32:32.942 --> 00:32:42.242
I mean, we mentioned AI LLMs, uh, do you see more privacy frameworks mushrooming up or maybe more consolidating of the existing ones?
00:32:42.452 --> 00:32:45.512
What do you think the landscape's gonna look like in, in say, five or 10 years?
00:32:46.383 --> 00:32:51.692
I think in the US we're, we're probably, I think it's unlikely at this point that we'll see a, the.
00:32:51.843 --> 00:32:53.972
Federal privacy law, maybe it will happen.
00:32:53.972 --> 00:32:55.803
I'm not sure, but I think it's unlikely.
00:32:56.222 --> 00:33:06.182
Uh, I think last week it, I think Massachusetts introduced a new privacy law, so I think we're up to somewhere around 20 plus US states with their own individual privacy laws.
00:33:06.268 --> 00:33:06.347
Hmm.
00:33:06.423 --> 00:33:07.923
that that trend is gonna continue.
00:33:08.403 --> 00:33:18.752
Um, I know Australia right now is working on updates to its privacy protection law, um, and we've got a myriad of other privacy regs across, you know, Europe.
00:33:19.143 --> 00:33:24.212
Um, Canada and Latin America, and even India and, and, and Asia and China and so on.
00:33:24.633 --> 00:33:33.002
Uh, so I, I think that this kind of, um, this kind of dispersion of, of different requirements is gonna continue kind of be the same going forward.
00:33:33.002 --> 00:33:41.702
I think as it pertains to, um, AI protection laws, I think that we'll probably see a more unified front on, on that side of things.
00:33:41.702 --> 00:33:43.563
At least in the us I think the US.
00:33:44.403 --> 00:33:50.553
Probably recognizes that, uh, the approach for pri US privacy law was maybe not the best one.
00:33:50.553 --> 00:33:55.532
And I think they're trying to get ahead of putting more sensible requirements in place around ai.
00:33:55.532 --> 00:34:02.073
And I think that's, that's, that's also, you know, representative of how we're viewing the risk around ai.
00:34:02.762 --> 00:34:03.873
Uh, which I think is a good thing.
00:34:05.123 --> 00:34:05.542
Mm-hmm.
00:34:05.702 --> 00:34:11.762
specific to, uh, you know, the GRC role in general, I would say that the role is gonna continue to evolve.
00:34:11.762 --> 00:34:12.152
I think I.
00:34:12.603 --> 00:34:18.063
Uh, what's helpful is the software tools have, have really, really drastically improved over the past several
00:34:18.242 --> 00:34:18.847
Oh gosh, yes.
00:34:19.112 --> 00:34:26.492
a lot more, tools that we can use to help deliver solutions to customers and even manage those requirements internally.
00:34:27.452 --> 00:34:29.253
I think that that's, that's very helpful.
00:34:29.253 --> 00:34:39.063
And I, I would say probably even in these GRC tools, you'll start to see the adoption of some sort of AI technology or AI agent that will help facilitate the.
00:34:39.617 --> 00:34:43.788
Uh, ongoing maintenance of, of controls and, uh, requirements.
00:34:43.788 --> 00:34:50.418
I think that will help reduce the burden and, and introduce some additional efficiency, uh, to GRC.
00:34:51.708 --> 00:34:59.268
and I would say, um, you know, there, there's gonna continue to be this issue around just a resource deficit.
00:34:59.688 --> 00:35:03.288
I think that AI is gonna eliminate certain jobs.
00:35:04.413 --> 00:35:17.762
but I think it's also going to, I think we're gonna wind up in a very similar situation we are in now where you're going to need, uh, practitioners and subject matter experts who will really understand those tools to even be able to implement them and manage them, right?
00:35:17.762 --> 00:35:18.242
So
00:35:18.293 --> 00:35:18.492
Mm-hmm.
00:35:18.588 --> 00:35:20.478
I don't see that shifting and going away.
00:35:20.478 --> 00:35:25.967
I think this GRC function as a whole, uh, continues to be more important in the coming years.
00:35:26.208 --> 00:35:36.557
Um, and I, I think with, with new tools, there's always gonna need to be folks who are really well read up on how to leverage those, uh, software products to help us, um, be successful in this area.
00:35:37.518 --> 00:35:37.818
Yeah.
00:35:37.847 --> 00:35:42.918
Now, uh, as we wrap up here, we're, we're getting close to the end of our, of, of our, of our time here.
00:35:42.978 --> 00:35:43.068
Uh.
00:35:44.807 --> 00:36:07.338
One of the sort of archetypes that you know, or people who, you know, write to us with comments and so forth is, is the, you know, the person who feels they're stuck in a help desk role or a very low level SOC role, and they don't quite know what they need to do to move into more specialized areas and like Yeah, like you said, I think the next 10 years it's gonna be all specialization, it's gonna be all, um.
00:36:07.847 --> 00:36:16.518
Knowledge, you know, based, you know, and, and a lot less sort of brute, uh, you know, rote work and so forth, that, that goes with those type of roles.
00:36:16.728 --> 00:36:25.818
Uh, do you have any sort of, um, strategies for helping someone to, uh, sort of get out of these, these sort of lower level, uh, grunt roles into something more substantive?
00:36:26.512 --> 00:36:27.083
Yeah.
00:36:27.143 --> 00:36:33.713
You know, first of all, I, I would say a, a SOC job or a help desk job is a great entry into this space.
00:36:33.853 --> 00:36:34.273
Mm-hmm.
00:36:34.492 --> 00:36:34.853
and if
00:36:35.027 --> 00:36:35.447
Oh yeah.
00:36:35.543 --> 00:36:49.193
in one of those roles, I would say if there's a GRC function within the organization, if it's, if it's a, um, it's an indu industry that you're working in, I would say reach out to those folks and understand, you know, what they're doing, and try to get involved as much as you can.
00:36:49.652 --> 00:37:04.443
If you're working for an MSSP or some sort of MSP and you want to kind of pivot into more of this GRC and compliance space, go out and, and find those free resources that are out there on Google and LinkedIn and, and read about them.
00:37:04.773 --> 00:37:11.882
Um, we, we have someone on our team who, um, spend about 30 years working in the fitness industry.
00:37:12.588 --> 00:37:15.467
Decided that he no longer wanted to work in the fitness industry.
00:37:15.768 --> 00:37:20.807
Um, started spending a lot of time, um, learning and, and reading resources on Google and LinkedIn.
00:37:21.108 --> 00:37:25.788
And then he went out and got a, a master's in cybersecurity from, from an online university.
00:37:25.788 --> 00:37:27.168
And he's phenomenal.
00:37:27.168 --> 00:37:27.378
I mean,
00:37:27.552 --> 00:37:27.972
Mm-hmm.
00:37:28.458 --> 00:37:32.208
he's one of the best, uh, folks on our team and we're, we're very fortunate to have'em.
00:37:32.628 --> 00:37:38.568
Um, so, you know, but you've gotta be willing to roll your sleeves up and do that work and go out and learn and talk to people and.
00:37:38.943 --> 00:37:45.932
Um, go out and re-skill and, and there's a lot of great free resources out there that are, I would say again, Google and LinkedIn have, have a lot of those.
00:37:46.472 --> 00:37:46.862
Mm-hmm.
00:37:47.043 --> 00:37:55.532
you need to go back and pursue, uh, another degree, I would say, um, it can certainly be worth it if you can, uh, find yourself in even an entry level role in GRC.
00:37:56.432 --> 00:37:56.762
Yeah.
00:37:56.822 --> 00:37:57.123
Yeah.
00:37:57.123 --> 00:38:01.833
No, yeah, we, that's, that's another big part of our, our demographic is people pivoting later in life.
00:38:01.833 --> 00:38:08.132
And I, yeah, I suppose that's probably the, kinda the best advice you can give is, you know, sort of just learn your way into it.
00:38:08.132 --> 00:38:11.972
You know, it's, you're not, you're not necessarily gonna have experience, but you will have, I.
00:38:12.693 --> 00:38:22.322
I suppose some advantage over, you know, an entry level, you know, or a student trying to apply for a, a job like that because people know you can do work.
00:38:22.322 --> 00:38:23.012
You know, that
00:38:23.208 --> 00:38:23.657
Mm-hmm.
00:38:23.822 --> 00:38:27.422
years in the fitness industry means, you know, I know how to come to work every day.
00:38:27.422 --> 00:38:30.632
I know how to, you know, finish a task and so forth.
00:38:30.632 --> 00:38:34.262
And I think that's, I think that's, that's as, as valuable as anything.
00:38:34.262 --> 00:38:36.003
So, uh, so one, yeah.
00:38:36.003 --> 00:38:40.952
As, as we wrap up, what, what's, uh, what's the best piece of career advice or advice in general you ever received?
00:38:40.952 --> 00:38:41.012
I.
00:38:42.407 --> 00:38:49.038
Um, my dad had all, all these like very basic maxims that, um, you know, I told you earlier he was a HVAC and plumbing,
00:38:49.487 --> 00:38:49.878
Yeah.
00:38:50.117 --> 00:38:51.228
plumbing guy, and.
00:38:51.632 --> 00:38:57.632
I just remember working with him when I was in high school on jobs, and he would always tell me like, just do the job, right?
00:38:58.052 --> 00:39:01.682
Um, he would tell me, Murphy's Law, whatever can go wrong, is gonna go wrong.
00:39:02.043 --> 00:39:06.092
Um, he would say never get too excited about the highs or too upset about the lows.
00:39:06.483 --> 00:39:12.152
Uh, so, you know, those were some very basic maxims that he gave me that have always stuck with me through the years.
00:39:12.213 --> 00:39:12.632
Mm-hmm.
00:39:12.813 --> 00:39:20.132
And, um, you know, a, an, an opportunity to watch my dad who, who ran his own, uh, plumbing business up close.
00:39:21.018 --> 00:39:23.297
always treated the customers right?
00:39:23.358 --> 00:39:28.188
Even if they were difficult, he was always going out of his way to make sure that they were happy.
00:39:28.188 --> 00:39:36.827
And in certain cases, he wouldn't charge them for work that he did, just because he felt like this was someone who was gonna continue to be a good customer for him in the long term.
00:39:36.827 --> 00:39:37.097
Right?
00:39:37.097 --> 00:39:37.518
So
00:39:37.637 --> 00:39:38.208
Mm-hmm.
00:39:38.327 --> 00:39:45.288
that that's, that's really important is, um, you know, some of those very basic maxims that he shared with me and, um.
00:39:46.128 --> 00:39:50.297
making sure that you're treating customers extremely well and doing the best possible job you can.
00:39:50.898 --> 00:39:52.788
Yeah, great, great advice.
00:39:52.788 --> 00:39:55.128
All around, they're, they're called maxims for a reason.
00:39:55.128 --> 00:39:56.208
They stick around for a reason.
00:39:56.208 --> 00:39:57.288
They, they are always useful.
00:39:57.288 --> 00:40:01.668
So, uh, as we wrap up, tell our listeners more about, about Zian and, and the work you do.
00:40:02.538 --> 00:40:05.838
So Zavian is a data security and privacy consulting firm.
00:40:05.898 --> 00:40:10.998
Uh, we help our clients navigate complex security compliance requirements and data privacy laws.
00:40:10.998 --> 00:40:11.027
I.
00:40:11.853 --> 00:40:25.538
we do that by building programs, processes and procedures, and by implementing GRC software to support their business requirements, uh, we specialize in things like third party risk management, uh, SOC two and uh, GDPR compliance.
00:40:26.492 --> 00:40:26.822
Nice.
00:40:26.913 --> 00:40:27.213
All right.
00:40:27.213 --> 00:40:28.713
And one last, uh, request here.
00:40:28.713 --> 00:40:32.282
Tell our listeners where to find more Will Sweeney and and ENT online.
00:40:33.242 --> 00:40:36.663
You can find us@zian.com and uh, I'm on LinkedIn.
00:40:36.722 --> 00:40:39.452
I spend a lot of time on LinkedIn and we also, uh, our
00:40:39.483 --> 00:40:39.813
Great.
00:40:39.902 --> 00:40:41.432
on LinkedIn as well, so follow us on there.
00:40:42.032 --> 00:40:42.603
Fantastic.
00:40:42.603 --> 00:40:45.422
Well, we'll will thank you for your insights and all this great privacy talk.
00:40:45.427 --> 00:40:45.807
It was a lot of fun.
00:40:46.322 --> 00:40:47.313
Thank you so much, Chris.
00:40:47.313 --> 00:40:48.333
It was nice talking to you today.
00:40:48.902 --> 00:40:53.072
And, uh, thank you to everyone who watches, listens, and writes into the podcast with feedback.
00:40:53.072 --> 00:40:59.132
If you have any topics you'd like us to cover or guests you'd like to see on the show, drop'em in the comments, uh, or make use of our YouTube community tab.
00:40:59.132 --> 00:41:03.722
We're trying to get that a lot more active, or, Hey, uh, stop by our TikTok channel info sec.
00:41:03.927 --> 00:41:26.483
Edu Uh, before we go, don't forget, InfoSec institute.com/free is a place where you can get a whole bunch of free and exclusive stuff for cyber work listeners, including our free cybersecurity Talent Development Playbook, which, uh, contains in-depth training plans and strategies for the 12 most common security roles, including SOC analyst, pen tester, cloud security engineer, information risk analyst, privacy manager eight.
00:41:26.588 --> 00:41:29.018
The secure coder ICS, professional and more.
00:41:29.498 --> 00:41:38.137
If you wanna know how much a career in cybersecurity pays, get our free cybersecurity salary guide for the latest data on popular certifications and their related roles.
00:41:38.378 --> 00:41:43.867
There's also security awareness posters, eBooks, and you can sign up for a hundred plus free courses, uh, for a month.
00:41:43.867 --> 00:41:45.338
In our InfoSec skills platform.
00:41:45.338 --> 00:41:48.338
You can learn incident response, forensic security architecture, and more.
00:41:48.847 --> 00:41:54.668
Uh, all of that is@infosecinstitute.com slash free, and the link is in the description below.
00:41:55.023 --> 00:41:55.952
One last time.
00:41:55.952 --> 00:41:59.643
Thank you to Will Sweeney and Aviant, and thank you all for watching and listening.
00:41:59.972 --> 00:42:01.443
Uh, this is Chris Sanko signing off.
00:42:01.443 --> 00:42:03.963
Until next time, make sure to learn something new every day.
00:42:04.172 --> 00:42:05.853
Keep one step ahead of the story.
00:42:05.853 --> 00:42:08.163
And don't forget, don't forget to have a little fun along the way.
00:42:08.552 --> 00:42:09.182
All right, bye for now.
