บทถอดความฉบับเต็มของ Roland Cloutier: Leading Security at TikTok, ADP & EMC | Ep 11

time, said, you helped us develop our strategic plan, our technology oversight. You've been here for six months, why don't you come do the job? And I jumped at it. it was exciting to me to be the first chief security officer for their company. And I think you don't know how rough you might be or what skills you lack until someone puts a mirror in front of you. And so they were so gracious I had two external mentors at one time. one on presentation skills, the other one on just how to be a normal human in a corporate environment, like one of the lessons I learned is Roland, "what's the wake you want to leave in the room?" You can't come in as a state trooper every time, right? If you want people to join you, be led by you, And so, you have to want to become better for the environment for which you're serving. they sent me to part time business school. They sent me to classes at Babson. I was fortunate along the way Michael Collins: That's great. Roland: to have offered these type of steps that made me the type of leader I am today. Michael Collins: Love that. There were things that you had to relearn or adjust to be in a private sector environment. What were the advantages that you came in with because of your background? Roland: knowledge, I mean, the government spends a metric butt ton of money on teaching you how to do your job right, I don't care what people say the United States government teaches their men and women to do their job well and I Michael Collins: Mm. Roland: along the way I brought a lot of things that I was trained on to be able to use that within a corporate or non military government environment. I think that's number one. Number two is probably discipline. I think discipline is a mindset. and you're not gonna be successful in life, and in a job with as much pressure without understanding how to manage discipline, self discipline and discipline of others. And then probably a third would be mindset, right? been taught since a kid there's no mountain the Lord will give you that you can't overcome and the military gives you a sense and an attitude of how to overcome things. And I think pushing through fortitude and using the resources to accomplish your mission set is something that the military and government gives you. And I was fortunate to have that from such a young age and even learn how to do that better as I got older. Michael Collins: Love that. you mentioned a couple of examples like IP protection and I guess insider threat with that Russian example. for an IT noob, what other types of functions and day-to-day responsibilities did you have in those early roles in security? Roland: I mean if you look at the premise of the framework of most information security and risk management programs, depends how you measure it, ten to twelve basic structures of disciplines within those frameworks. Subdisciplines under that is like another twenty two. What was funny Michael Collins: My goodness. Roland: is when I started in that space, it's a running joke, and if you asked part of the team that is still around from the old EMC days. They will say Roland started with nine guys and a firewall, and that was our team. I took nine guys out of the network security group and we became the global security organization. Ended up being over 200 FTE in that team within a few years across all those disciplines. you had to build it. You had to find what the mission required, what we were gapping the type of people you needed to technically lead. Back in those days, viruses were coming big. We had to, put a pretty strong antivirus malware detection response team together at the time. and we were having external attacks that were pretty significant. So we built our own edge detection team. the adversaries have the say in how you establish and defend the environment you're protecting. it forms as you go along and as the threat surface changes. Michael Collins: the kind of threats that you were dealing with, were they largely foreign based? or is some of it corporate espionage where they're, seeking IP or something like that, or what sort of the parties involved? Roland: we did criminal prosecutions against kids, in the United States. against organized crime in the United States. but there was obviously a lot of Eastern Europe. we had a fair amount of what we would say today is nation state actors. I remember one case we worked And it was an attack on the certificate infrastructure. and essentially it's the encryption around how we do authentication to protect applications and systems and So we protect the information and make sure that only the right people get access. Well someone attacked that massive key infrastructure And when we dug in deep and did the forensics and really were able to understand the code that was used, we found that it was Chinese code that had broken Michael Collins: Man. Roland: into organized crime infrastructure in Colombia and we're coming through them to attack us, there's Michael Collins: Wow. Roland: been some really interesting stuff in my career that I've seen that even back in the day it was important infrastructure for people to attack and and so they would Michael Collins: That is wild. what do you think the misconceptions are of corporate security and cybersecurity from peers, the other executives that you're Roland: Yeah. Michael Collins: interfacing with and Roland: you get it from both sides. I think corporate security people like to call the cyber people propeller heads, and then you have CISOs that say, gates, guards, and guns. and both wrong. I mean, it's a mission protection capability for defending an organization from people, process, and technology. and so I think the biggest fallacy from my peers sometimes is they can't work together, or they can't be led from a single individual. And that's just totally wrong. you look at major entities like the FBI, they have few deputy directors, around criminal investigations, national security, things

like that, right? So there's can be disciplines within a managed organization. But the biggest part is they forget that why you would have a single organization is to have a single view of the entirety of the threat surface, to understand who and what would want to do harm to the organization and to have a compiled, leverageable resource capability to support each one of the mission sets at a lower cost. and that those are all really great reasons why you would have a converged security organization Michael Collins: how much interaction was there between the cybersecurity side and the physical security earlier in your career and how has that evolved over time? Roland: the first one was horrible actually. there was a corporate security guy who fancied himself as a intelligence community person and had no need for cyber and we were just propeller heads and totally disregarded my decade of federal law enforcement and military and everything else I've done to be able to support and kept the barrier up and it just wasn't a friendly environment. the second place, actually general counsel played a massive role. I still talk to this general counsel to this day, which is really awesome. I learned to be a little more vocal in saying, no, that's wrong. We should be doing this way as an organization. Or no, if we're gonna do that type of investigation, these other four components need to be there. Or if we want to protect our people, we should be doing this, and when you speak up, you have a present, you apply the data and give them the information, And so although it started off difficult eventually the entire physical security organization came under my leadership. the people that didn't like it left or were no longer in leadership positions and everyone else jumped on the big wagon realized wow what a powerful organization we can have and we drove and did some amazing things. Michael Collins: What are other things that you think peers may misunderstand in legal or other departments that are interfacing with cybersecurity and physical security? Roland Cloutier: first of all, that we don't understand their business. and that may Michael Collins: Mm. Roland Cloutier: be true in some organizations, but it's changed over time. Earlier, I think they thought we were all a bunch of knuckle draggers. But understanding that we understand how the technology works, how the customers engage in our services, our platforms, or the technology we deliver to market. being a part of those discussions is really, really important. And hiring people that can do the translation essentially is super important. so I think the one of the misconceptions is we can't help. The other one is we don't have the business context. And the third is all we can do is provide technology support rather than business support. and I think in today's global security leadership, that has really changed. I think I've been hard pressed to find a leader as a CSO or a CISO in the last several years. that didn't understand their requirement to be a business leader first. Michael Collins: Absolutely. how do corporate security leaders demonstrate their value to the executives and perhaps the board? how is that measured and maybe how could it be better measured in your opinion? Roland Cloutier: I remember I was sitting at my desk and a guy named Dave Donatelli, who was the head of all hardware manufacturing for EMC development manufacturing delivery across the globe. Eighty percent of critical infrastructures across the world had his technology in their data centers. And he called me up and said, Hey Roland, can you come down to my office? I want to talk to you about something. And I was like, Did I screw something up? He never calls me. So I go down, and he is a president in the company and and I'm sitting, he goes, Roland, I want to do a joint venture in China. And but I don't want to get this company in trouble and I want to make sure we protect the interests of the shareholders. And but we have to act fast How can you help me? And I knew at that point I had made it because I was his first call, so to speak, to make sure before Michael Collins: Awesome. Roland Cloutier: and he said, if you say we can't do it, I'm not doing it. And I said, No, we can do it, we'll figure it out. and we did it in a very secured fashion. It was in the early days of a company called Foxconn that was starting to do multinational technology delivery for Western companies. And we created a capability to really protect the interests of the shareholders in the company. I was his first call. So I think that in and itself shows that's when you know you have good measure, when the business calls you to help them solve for a problem. Now, from a metrics point of view, Michael, that's really interesting. I think it's more of some metrics are probably around customer security. So customer security management office has always been a big thing in my organizations. How do we interact with the customers, ensure that we're helping the company deliver its trust and security services that protect the customer and their interests and getting that engagement with them and getting how many customers call, how many customers does a security organization touch on a monthly or quarterly basis. how many M&As are we involved with against a totality of M&As? Like business context engagement and customer engagement are probably your two best measures. and not just how many complaints do we take? Yeah, that's important, but actual engaging with them, hosting events. I remember Goldman Sachs and Phil over there used to do this customer partner meeting where he would bring in any customer and any partner that wanted to come in and go over his security program every year. And we're like, that's brilliant. And we Michael Collins: Yeah. Roland Cloutier: started replicating it. And it was one of the most well-attended, public facing events outside of the core multinational customer events that

they did. And those things just work. And so I think if your measure touches both in the business and touches within the customer set. Michael Collins: Is there value in your opinion in some of the quantitative stuff? like sort of measuring the inputs, or number of incidents or are there benchmarks where you're sort of looking at a percentage of revenue Roland Cloutier: so one of the critical measures there is how many pre-sales things are you involved with and what did that result from a sales perspective? Not that you're gonna get sales, but if the company did ten billion in sales and you were involved in four and a half billion of those deals to help those customers get over the hump of trusting your organization. That's a big number. And that's Michael Collins: Yeah. Roland Cloutier: an important focus. but like firewall drops and incident management, Michael Collins: Yeah. Roland Cloutier: Those don't even really make it up to executive security councils, oversight organizations, or the board. back in the day they were great, but they have no real place in the boardroom today. Michael Collins: Do they ever look at comparison like comps on similar companies and sort of how they Roland Cloutier: If nothing's going on, like how are we doing a comparison? And those are normally around, Michael Collins: Yeah. Roland Cloutier: how are we measured from a framework perspective? A lot of people use an SCSF they'll measure themselves against those, or they'll have a third-party company measure them. And They'll look at things like bit site scores or things of that nature to see what their external posture looks like to the rest of the world. And so, you use those within industries and adjacencies. but those are frequent things. it's the higher level constructs and delivery of services and what maturity level are. Michael Collins: when that colleague had reached out about the potential joint venture, your response was sort of proactive in how to make it happen or to collaborate on that. I hear from legal leaders and security folks that they're sometimes viewed as the no person they're expected to shut everything down and Roland Cloutier: Yeah. Michael Collins: to just play defense. can you talk a little bit more about that balance? Roland Cloutier: it's service leadership mindset. That's it, right? I can provide you any service you need, We can solve any problem, time people and money. there is should be zero reason to say, no, no, we can't do that that's not protective enough. Like, you have someone wants to go to a threat level orange country. Okay, we can go there. But understand we're gonna have to do these four things to ensure you don't get kidnapped and ransomed So we can provide it for you and it's just cost preparation of money. So, there's always ways to figure it out, even when people think it's really impossible. And by the way, if you don't know the answer, you go find someone that has the answer. I can't know everything about every discipline especially it's in a new space like AI or quantum we're not gonna have every expert known to mankind. Go find the expert. Michael Collins: Love that. How do security leaders manage the burden of responsibility of the risk associated with protecting their organization and their customers? is there a way that you manage that through your career or you see others do or that you recommend? Roland Cloutier: Yeah, I mean I've had to learn over the years. I say it's always easier as you get older to because hindsight's twenty twenty. there's a couple things. you have to get what's important in your mind. And for me that's family and being there first. And that is tough. But when you get those priorities in the mind, you can always make Decisioning and prioritization easier, number one. Number two, physicality. it is hard mental work, which means it puts stress on all parts of your physical system. And if Michael Collins: Mm. Roland Cloutier: if you're not healthy and you're living an unhealthy lifestyle, it makes your body dealing with that stress 10x harder. that's why you see a lot of CISOs are marathon runners. I'm not one of them. Michael Collins: Man. Roland Cloutier: but you know, you see them. Doing some pretty incredible things to make sure that they're taking care of themselves, one of the things I had to learn because I'm such a mission-first individual was part of my pay is my vacation time and my time off. Michael Collins: Mm. Roland Cloutier: And if I leave it on the table, it was a badge of honor. I left four weeks carryover Michael Collins: Right. Roland Cloutier: for the year. that's stupid. One of the greatest things they did, and we used to complain about, my God, it's use or lose now. I got no time to take it. Yeah, you do. Take the time. And the last thing is continue to get educated. A lot of us, get into a slump when we think we know it all, we're leading. I don't need to know that. You always need to learn the Technology is changing, the disciplines are changing. Be the leader that people can look up to that understands the space that they're paying to be the expert in. and decide how you're gonna do your own independent development plan. It'll make you more confident in what you're doing, more capable, and more assured. Michael Collins: Related, I've read somewhere that chief information security officers have a really short tenure on average. Is that driven by just how, chaotic and quickly changing this space is, or It's just competitive and the compensation's better elsewhere or Roland Cloutier: I I think there's yeah, Michael, there's a lot to it. I spent six years at my first one, ten years at the second, only three years at the third. and that was in a politically charged, changing environment. but you do see a lot of people less than two and a half years in seat. And there's multiple reasons. sometimes people are what I would call post-incident CISOs. They go in, they are there to fix stuff, they start to fix the

stuff, and all of a sudden there's a financial change in the organization, and the organization starts waning from the cybersecurity support. And they said this is not what I signed up for. I'm here to fix stuff. It's gonna cost money. I'm leaving going some other place that can do it. these people are gonna give me 50% more salary. I can't even make that up in the stock you're giving me, so I'm leaving. I've seen it where it was just such a bigger job for the individual. They went from maybe a tier two, tier three organization to a tier one organization, or they were in a tier two position, stepping up to a tier one in a much larger organization and they weren't ready for it. these jobs are twenty-four by seven. And you have to want and understand how to manage that in your life. I'm doing strategic advisory helping organizations be successful, other CISOs be successful in this space, but I'm not doing operations. And that's after thirty years of doing operations. I knew that Michael Collins: Man. Roland Cloutier: I wanted to not do operations right now. My family deserved it. I needed a break. I knew if I wasn't all in at a hundred percent, I would not be good at the job. Michael Collins: Mm. Roland Cloutier: and so you have to make that decision. Michael Collins: Is that a difficult role to hire for? Does it take somebody like yourself to understand what the company needs, or can they sort of pattern match and they were in this role at a tier two organization and might be ready for the role that we have or Roland Cloutier: I mean converged is hard. CISO is less hard, I think. is it hard to fill? I don't think you should listen to another cyber practitioner. it should be an organizational choice, in my opinion. I think They have to have the DNA that the company looks for in their executive leadership because it's no longer just the security guy reporting to the CIO or the CTO. Often they're tier one or tier two leaders, it's not hard to find someone with the capabilities. It's hard to find someone with the capabilities that match the DNA of the organization. Michael Collins: You mentioned a politically charged decision or environment. And it just seems like chaos for a security leader to try and manage the internal and external forces spun up by a political decision or environment. What is that like you've got a unique perspective in dealing with that with your recent Roland Cloutier: Yeah, I mean Michael Collins: role? Roland Cloutier: you hit it right in the head. there's external and internal forces, Michael Collins: Mm. Roland Cloutier: right? You're gonna have organizations that don't like you, you're gonna have nation states that are gonna probe you more or try to use misinformation about the organization. you're going to have political sides of the aisle, launch unnecessary, unrealistic, untrue. investigations against you. Insider threat, you're going to have people that have access. You've hired them to do the job, to have access to your business. And all of a sudden they're not happy with the way the organization's going. They can really have an effect within the organization. So insider threat becomes, a real issue and how do you manage that? but a lot of transparency, I think a lot of great internal communications partnering with your HR organization and how you're gonna handle these issues, how you're gonna set that tone and tenor and how you're gonna set up professional programs to defend against the issues and address those, I think is important and be very transparent. Michael Collins: Absolutely. Yeah, must have been a nightmare. such a global organization and right the epicenter of such geopolitical drama. I don't think most people have what it takes to to deal with that. Roland Cloutier: It was an education, that's for sure. Yeah, it was a PhD, that's for sure. Michael Collins: Wild. This is the fun part. What are the tools and things that you value today in a security organization? what's the latest and greatest? What are CISOs and CSOs talking about amongst themselves today? Roland Cloutier: Well, I'd be lying if I didn't say AI and I know everyone comes on to a podcast Michael Collins: Mm. Roland Cloutier: and they start talking about AI. the reality is that we're just in a different place than even two years ago. and we're in a metric dynamic place in comparison to five years ago. The automation and capability associated with AI to be able to do the things that people just shouldn't have to do, right? AI should be able to go through it at a speed that we've never seen before, collect those things, sort those things, put those in a way. for instance in the cyber world. we've been doing SOR or essentially alert and response automation for a very long time. but even though SOR would collect and get the logs and bring them together, you'd still need an analyst to go through and make sense out of it. Today, by the time that an alert gets to an analyst, it's already gone out, collected the logs, analyzed the logs, put the path of exactly what happened, collected all of the evidence controls and giving you a infrastructure remediation, defense remediation, and a next step option to click here. In about Michael Collins: It's incredible. Roland Cloutier: Two minutes. Now you can do this across every part of your disciplines, Like if organizations think they're going to have risk analysts in the next year, they're crazy. no one needs a risk analyst anymore when the technology does it for you. No one needs to have an entire center with two individuals watching 600 screens when AI is going to be able to watch each one of your environments be your PSIM for you and be able to derive immediate work out through your comm system to the feet on the street or integrating into your facilities defense infrastructure automatically. sure, will it be humans in the loop? Yes. Will it take us some time to do some of these things? Of course. but like the most amazing integrations are

happening today with AI and it's fantastic. Michael Collins: I love that. I'm so refreshed to hear specific use cases. What do you think are other less obvious ways security changes in the next couple of years for corporations? Roland Cloutier: Ooh, less obvious. I think our ability to automatically defend against a changing threat landscape it doesn't matter if you have door systems or if you're managing web application firewalls, right? It's all code. And so if you think about understanding how code works and implements a control, and then you have an amazing capability to look at my entire threat surface, both physical and virtual, and then make really important decisions. Instead of waiting 18 months to buy a technology, take it through a procurement process cycle, test six things. I can make a code change right now and defend against that and not worry about it. we will have big technology infrastructures in the space of AI, in the space of code management, code automation, in the space of development. But you're gonna see less and less of these every year big buys because changes to defend your mission space will happen in code. Even in physical space, right? Even if you're defending physical manufacturing sites or delivery systems, or It's a technology and manufacturing, but once they become a device, they have to get from where they are to their customer locations, data centers, over trains, planes, automobiles, boats, and they have to defend that entire cycle. That's all gonna be done on code from a simple view from it. and so I think what's gonna change so much is that we can make so many changes so quick to address the moving threat environment that's gonna spin people's heads and people are gonna have to get their head wrapped. Michael Collins: It's exciting. what are your thoughts generally at this early stage on the sort of privateer change of government, some mandate, allowing private companies to enter an offensive posture for cybersecurity? and whether that's generally a good or or bad thing? Roland Cloutier: Yeah, first it's a slippery slope, right? for commercial entities to engage Michael Collins: Mm. Roland Cloutier: in combative like offensive operations, right? when does your technology implicate the safety security of human life? do you know? Do you understand that? and when you attack another entity outside the continental United States or the United States in general, how they see you is as important as legally how you are protected in the United States, if you're seen as a military combatant based on the way you're operating, they will treat you, your people and your organization like it. And there is a lot of legal theories and legal practice around military law, which is applicable here that have to be worked out before people do stupid stuff. can you defend? Sure. Can you do major cuts and create new technology sets that disconnect those environments, reroute them, move the cheese methodologies around honey pots? Sure. but offensively going after organizations is a pretty slippery slope in this space. I would not want to take on that responsibility and reputation issue organizationally and I would be careful from a legal perspective. But that's me. I think we're a long way off before that becomes a reality anyways. Michael Collins: The other question I had was there was a lot of excitement or fear in the press when Anthropic had released new capabilities that enabled cyber to find vulnerabilities at scale. And there was the conversation about gating this and only making it available to certain organizations for a period of time. And there was a lot of debate, even I think in the mainstream. Yes. Roland Cloutier: Everyone's gonna be doing this But in next year, it doesn't matter whether you use the Mythos or Glasswing or any of the other kind of foundational models. we change models on a quarterly, monthly basis ish. Now we're gonna see models changing on a daily basis, going into next year. So everyone's gonna have their own harnesses. they're gonna pick their favorite thing based on what their organization does, how to protect those informational assets and we will get to a zero defect world in the next two years. It's gonna take a long time to go fix everything we have, the history of our technology baggage that we haven't fixed over the years. all that has to be fixed. Anything in production in operation We're gonna have to fix all that code So we're gonna spend the next two years cleaning it up, maybe even faster. I know of an organization that took this really, really seriously. They had a problem, their code was taken. We looked, the answer was you're gonna have to go fix all the problems in your code because the Chinese and Russians probably already have it. it was probably sold to the highest bidder and resold and resold. And they were in critical infrastructure defense. And they said it's gonna take us three and a half years. they created their own harnesses, went with some different models that weren't available to them at the time, because they weren't on the methos capability string at that point. And they did it and I'm talking like a 20 year old company went back through all of their code in three and a half months and remediated a Michael Collins: Man. Roland Cloutier: hundred percent of their issues. That is Michael Collins: Crazy. Roland Cloutier: what it's gonna look like in the future. this is the beauty. Like we're finally gonna be able to fix our stuff as fast as they find it. And because we understand our environments, because we can move the cheese, change our controls as necessary at the speed of a machine, instead of waiting for budget cycles, hell yeah, we're gonna get ahead of it. Yeah. Michael Collins: That's awesome. What are you most excited about lately in your work? Roland Cloutier: I'm excited about helping these young new leaders that are taking these places that have amazing ideas and that have this new technology at their fingertips. AI excites me to begin with because we're gonna be able to do things I haven't been able to do in 20 years and we're gonna be able do it now. but seeing these fresh young faces that are out there wanting to learn leadership and drive change and are coming up with just amazing background sets, coming out of the military with real life examples or the government. I'm excited about the people that's going to defend society going forward. And we're gonna have a real leg up here. Michael Collins: That's awesome. Would you share more about the business protection group, the work that you're doing, your focus, and the types of projects or clients that you support? Roland Cloutier: Yeah, there's really two sides to what we do. One is the focused on making other practitioners successful. So retain advisory work for CISOs, CSOs, CTOs, CEOs that say we strategically wanna do some stuff different, we need new programs. You've done this, help us build it faster, better. And being able to go in and help my peers actually do this stuff fast has been great. And the second part is some of the thought leadership in the space, really some of the getting people's mind around, instead of getting worried about the million things they have to do, let's go focus on the four. That's gonna make your business successful or the four things in industry. And being able to get that voice and have the mental time to sit back outside of operations to be able to articulate things in a reasonable, fair, simplified way has been fun. Michael Collins: That reminds me, I didn't ask about the book. That's exactly what the book does. I think you wrote that was it about ten years back Roland Cloutier: I think it was released ten years this year. I'm gonna Michael Collins: Man. Roland Cloutier: have to go have a anniversary party about it, but yeah. Michael Collins: Yes. What what was that process like? Did you have outside help Roland Cloutier: way out of my element. I wrote the whole book. I didn't have ghostwriters and I wrote it nights and weekends while I was a sitting CISO, between Michael Collins: Yeah. Roland Cloutier: two jobs actually. so I will say that it was cathartic 'cause I always wanted to do it and a lot of the stuff I always spoke on in programs and things that leaders should be thinking about. and when people started reading it and sending me notes, it was really written as a post grad book, right? saying you helped me immensely get in the right thinking mode to to you helped me solve some real quick internal issues with my company. I was just getting notes that were really fulfilling Michael Collins: That's awesome. Love it. Roland, thank you so much. Sincerely, this was a lot of fun and I learned a lot. really appreciate your time. Roland Cloutier: Yeah, Michael, it was my pleasure and look forward to doing another episode sometime. Michael Collins: Absolutely. That'd be great. Thank you very much.