บทถอดความฉบับเต็มของ Analysis and Lessons from Kiteworks Top 11 Data Breaches in 2024 Report

assessment, 10%, attack vector sophistication. That was 10%. That hopefully added up to seven or eight there. Maybe it's seven, seven, not eight, pardon me, that we came up with. And that's actually detailed in the report. So the report's linked at the bottom of the podcast. All of you can click on it you can read the report at your leisure. And that's on page five, if that is helpful. And then we went through and looked at, they had 10 in the ITMC report and looked at those 10 different data breaches from the vantage point of those seven different elements. And we scored them on a scale of one to 10. then one of my colleagues came and said, well, how about the national data, public data breach? It was huge. In fact, I was hacked, he told me, and all of my bank accounts have been frozen. So yeah, that wasn't included in their data. So we threw that into the mix and that's how we ended up with 12, 11 rather than 10, which is hopefully an interesting story for our audience. And ironically enough, national public data ends up at the very top of the list with a score of 8.93 on a scale of 10, one to 10. And then we can go through the others, whether it's change healthcare was 8.7 and Ticketmaster Entertainment was 8.7. 8.5 for AT &T and you can go down the list. That's on page six in the report if that's helpful. So no one will have to listen to me talk, especially myself, but probably the audience as well. Let's dive into some of the details Arun and Mike have digested the report. Let's start by looking at industry shifts and trends and then we'll look at some other elements later on in the podcast. Patrick Spencer (07:38.562) But financial services, if you look at it, seem to overtake healthcare, at least in the findings we had when you look at the top 11 now. If you go and look at Verizon or IBM, they still have healthcare there at the top in terms of the total costs of a data breach, which I suspect won't change this year. Things may be changing. But three of the top 11 were in the financial industry. Let's start with you there. you have any thoughts? know, why is that the case? Are cyber criminals paying more attention? Seems like healthcare breaches are in the news every day still, but are they paying more attention to financial services because there's more money there? There's more data that's sensitive? Arun DeSouza (08:20.366) Well, yes, I agree. But I think you see immediately that you want ROI in a bad investment or bad attacks of the time they're making is much, I mean, arguably easier to go after the banks because they have a lot of money. Health care, on the other hand, you know, trying to get money from them may not be as easy because they have trustees, board, HIPAA and, know, and they probably will not pay you, right? Banks are more liable to pay you. think that's really what it is. The immediacy and the quote unquote, the return to them in the shortest period of time, I think. And I believe that banks don't want to be down too long

if there's a problem because obviously they have a lot of unhappy customers. Now that's not to say healthcare, is now demoted to number two, doesn't have a problem. There's patient health and everything. But I think the issues that... they won't get paid very fast. Patrick Spencer (09:19.618) No, that's a good point. Mike, on that note, we look at the types of attacks. A lot of this involves data exfiltration, right? They're stealing the data and they don't want to give it back. one of the other findings in the report was it's more than just the financial impact, right? We always talk about the financial impact. It's XYZ. IBM has their fabulous report they publish every year on the cost of a data breach. which is really interesting to see how that's changed over the years. keeps going up obviously, but operational impact, you you look at the change healthcare breach was speaking of healthcare was really huge. You know, do you see a shift there where, you know, it's very malicious in many ways. And when you're talking about healthcare, you know, it's an attack where they can't deliver healthcare, you know, life saving activities sometimes can be obstructed. Mike Crandall (10:15.788) Yeah. And I think, you know, the one thing I learned, you know, 20 years in the military is the enemy is always going to adapt to your tactics and procedures that you've put in, in defense. And so they move from healthcare because like Arun's saying, they're not paying, their insurance is probably not going to cover it. And then in that shift, well, if they're not paying ransom, what else can we get them with? And that's got now into that extortion, right? We have your records. and we're either going to just sell them because why not, or we're going to try to extort you out of a payment and then maybe still sell the records. But that's more their goal, I think now is that extortion to threaten you with, we've got your records. If you don't pay, we're going to release them and just cause the damage. then it's more, you know, beyond financial, it's your reputation. Although, I'm beginning to see that breaches happen so often that that reputation damage seems to be lessening. Right? Because everyone's been breached. So now when you get that letter saying, hey, we've been breached, we're sorry we lost your records, we're like, okay, again, versus how dare you and I'll never trust you again. Arun DeSouza (11:21.562) Hmm. Arun DeSouza (11:31.77) And a little tidbit, a few years ago I was at one of the conferences that Patrick was talking that I speak at and there another speaker there that actually had done a study on companies that had been breached and what happened to the stock price. Well, expectedly it went down, but what was shocking to me is the stock price rebounded in, I won't say almost no time, but Patrick Spencer (11:33.784) Yeah, yeah. Arun DeSouza (11:58.38) Relatively almost no time because to your point I think reputation is kind of okay while it goes At the

end of the day people said do we really want the services have they done me a call for and people just forget People's memory shot so I think you know the reputational impact doesn't have the same Gravitas is used to in the past. I don't think Mike Crandall (12:12.76) Yep. Patrick Spencer (12:20.198) I think you're right. I remember doing a webinar with Charles Carmichael from Mandiant. It's probably been two years ago or so. It has been a year and half ago. And he noted in some of the supply chain attacks that they were seeing that more and more organizations were opting not to pay the actual ransom. And that that was a potential trend that was taking place. Maybe we see that happening here where, you know, we'll risk it. We'll take the brand impact. It'll wear off after. Mike Crandall (12:20.802) What? Arun DeSouza (12:40.1) Mm-hmm. Patrick Spencer (12:49.324) six months and maybe organizations from a perception standpoint, which is usually true, not always. If you've been breached, it actually may be a flag that you've hardened your security. You may be in better shape than those who haven't been breached. They just don't know it because you've actually gone through that process. You have a... Mike Crandall (13:08.152) Well, and I think you, yeah, I think you began chasing your tail. Like on the list was AT &T. Well, the year before it was T-Mobile. So all those people who are like, I'm leaving T-Mobile because, know, damn, this happened to me, moved to AT &T or whatever. then, you're next. So unless you want to change carriers every year, you're going to have to just learn that this stuff happens, right? And that, that becomes our mindset. Patrick Spencer (13:25.454) It's fine. Arun DeSouza (13:28.473) Thanks. Arun DeSouza (13:36.41) In the report, there is actually a very tangible, solid example of exactly what you just said, Patrick or Mike or the company are paying and that's Loan Depot. And Loan Depot, the demand rises, they didn't pay. But I'm missing that not only because of the fact they didn't pay the ransom, but how did that compromise happen? It's through a phishing campaign targeting Loan Depot employees, right? Where they... moved the lateral network and know, in 48 hours and very help was created. Now, why is it important? You know, I've been tracking this factoid since 2013. Mike probably have to see IBM index of what percentage of incidents are attributable to people. And God bless us all. Every year it comes at 25%. It's like a statistical anomaly, it's almost a truism now. The point is, you know, the greatest ROI as we know is by tuning the human firewall, doing training and awareness and everything, right? But I think the thing is sometimes people don't remember, they're too much in a rush. And in yet another of the breaches here, you know, we'll talk about the MFA. fatigue where they keep bombarding you with these MFA stuff. Now how many times have probably you and I trained the users, right? So sometimes the simplest things that get you because you're in a hurry or in a rush, but I think tuning the human firewall is so very important, right? And training and awareness. Mike Crandall (15:19.5) Well, and the adversary is getting smarter about learning about us. know, LinkedIn, great networking tool, we're all on it. But it also is a great tool for like, wow, Patrick, I see you were just hired by, know, Kiteworks. Guess what? I'm your CEO, and I want to tell you something. Arun DeSouza (15:37.786) But not to belabor this phishing statement, yet another of the breaches is giving me a second time to remember. It was actually at Dell, a full technology company where a bunch of execs, was fear phishing campaign targeted against them. And through that, they were able to, I believe, impersonate a technology partner by doing very sort of probably AI-generated convincing communications that led to Credential theft now, you know, it's gonna say room. you missing it again? Well, the fact of the matter is, know When you talk about defenses and training people training cannot be one size fits all so these folks That are more highly exposed. I call the VIPs or very attacked people. need to train them more you need to have higher level of Controls against them. Maybe they have stronger multi-factors or dual factors or triple factors And so everything more of it, more training, boot camps, you know, controls and more challenge response and things like that. And of zero trust, obviously my favorite subject, one of them. Patrick Spencer (16:48.322) Well, about half of the results of a credential theft, which usually goes back and you have multifactor authentication. Everyone has that in place now, but credential theft continues to plague organizations. you five of the 11, why do you think that's the case? Mike Crandall (16:48.898) What happened? Arun DeSouza (17:07.354) I think because, you know, it's social engineering, right? Social engineering, these guys, like you mentioned earlier, Mike, and I was paying rap attention. You're on Twitter, you're on Facebook, you post all these different things. And typically, you know, for example, when people are trying to compromise, go, what's the name of your favorite dog? Well, your favorite dog name was where again? On Twitter. Your birthday was where? On Facebook. And it's so... so much easier for people to harness information now, right? I mean, I remember last year, was this two big casinos got hijacked or hacked last night. I don't want to mention the names. One, of course, refused to pay and the other said, can accept it. The other paid. But how did that actually happen? By this exact thing, social engineering, where of all people, they fear fished an IT employee, if I remember correctly, at least in one of the places, right? Mike Crandall (17:48.354) Yes. Arun DeSouza (18:06.074) One would think that, OK, IT people are, quote unquote, better, more aware. But hey, they're people too. They forget. They're tired. Who knows? So I

think social engineering is the biggest threat. And I think with AI coming, the thing that I really worry about is the attacks against Dell become so much more sophisticated. And it will become omnichannel. What I mean is it won't just be through passive email. I believe it also happened through wishing the voice, right, by deep fake videos. you know, and then what they may even do is they may play a message that imitates your dad, for example, your mom or something, and then actually through a voice modulator, then ask you a trick question, right? You think you're talking to your dad and things like that. This thing, yeah, I love AI, but just sometimes I wonder, you know, is it friend or foe? Of course, I think it's largely friend, of course, but it's like nothing else. And the point I mentioned that is training and awareness is one side, but governance, putting the guardrails, policy-driven, super-wise AI and everything, you need to do all that. Does any of that resonate with you, Mike? Mike Crandall (19:17.368) Yeah, and I like to say that for everyone that's had their credentials stolen, they have to buy a new dog. To your point, I need a new dog now because I have to change my passwords. And for me, what I'm seeing is they're getting more clever, of course, with AI and ChatGVT. They're not as obvious. They used to just train us. you can obviously tell when the Nigerian prince is sending you the email and it's, you know, so poorly written. Well, that's changing. And we've seen a rise in to get around the two factor. You know, they get into one account and then that emails another account, but they're emailing as a, as a, you know, encrypted message or click this link and it's coming from a friend. So you, you don't distrust and then they just kind of perpetuate until they find the person with the purse strings. And that's when they lie in wait. take action. it's, they're smart, right? We gotta, we can't leave it up. It's no longer that poor person, you know, sending the bad email, asking you for a million dollars. Patrick Spencer (20:23.648) And organizations have MFA in place and they still are being hacked as a of that, like to your point. Kaiser, was a, know, MFA fatigue situation that resulted in that hack, is one of her top, top of it. So what do we do? You know, we know there's a problem. So we constantly throw more technology at it. We throw training at it. We try to, you know, shame employees that, you know, do dumb things. We do the training. Mike Crandall (20:29.25) Yeah, because you can capture it in the middle, you know? Mike Crandall (20:35.992) Thank you. Patrick Spencer (20:53.262) Hopefully it happens when we're doing the training, not the actual real life attacks, how do we address this? Because we've been talking about this, well, since all of us have been in fiber, which is over 20 years in all three of our cases. Mike Crandall (21:08.622) Yeah, I would say one of the things, we got to start leveraging that AI to look at this anomalies that are coming in emails. This person hasn't emailed you in 27 days. Their typing of the email was erratic. Or when you're logging in with a password that wasn't an actual type password, that was a replay. Arun DeSouza (21:09.006) Yes, it is. Mike Crandall (21:34.456) You know, there's little things that AI can pick up a lot quicker than our normal tool kits. I don't want to rely 100 % on AI. We do need that human intervention. My wife still looks at our security cameras and says, I love you, AI overlords. So that way she says when Terminator comes, she gets the green screen around her head and she's saved. And as a cyber guy, I'm the one that's getting taken out. But I do think we need to develop, you know, keep up with tech because the enemy will. Arun DeSouza (21:43.342) Yeah. Arun DeSouza (21:54.19) Yeah Arun DeSouza (22:03.45) So I think it's a multi-part answer. First I'll start at the lowest level. We talked earlier about the human firewall, people as the first line of defense, training and awareness, complemented and supplemented by AI-powered training, AI-powered anomaly detection. But... Zero trust is a big thing to me, right? Because the companies that adopt more zero trust, I'm not talking just the multifactor. I multifactors can be low tech. People still, I can't believe it, using the text message, they need to get rid of all that stuff, right? So stronger multifactors. But the principle of zero trust, I think you touched upon it earlier, Mike, is the fact of the matter is that I talk about the identity coin, right? The person, device, location. But the logical side is much more important to me, the context, role. attribute and behavior so that every connection in fact is done on the trifecta of identity, device, posture, and session risk. But that's easier said than done, right? So A, you need the people. Now, you need the business process because you need AI, government policy-driven AI, the governance. also most importantly, at the end of the day, most of the breach is what are they about data? So data sovereignty is important. Mike Crandall (23:04.726) is better than none. Arun DeSouza (23:19.31) Data classification important, business partners is important because at the end of the day, all of us know, yeah, you can talk zero to us all you want, but if you haven't done the proper work to have the proper policies and the proper business engagement, it's not going to happen. Now, obviously, you can't classify all your data manually. You're going to lose that battle. So that's why, like you said, Mike, yeah, it's important because you're able to then determine, you know, are the proper controls in place. or like you were saying earlier, anomalous behavior is happening, Systems is okay. Arun typically works from eight to eight, seven to three in the morning and he downloads one gig of data a day. He's logging at four a.m. in the morning and downloading 10 gigabytes of data, right? So immediately what he does, he's

blocking. So I think it's a comprehensive coalition of people, process and technology safeguards all working together all of the time, right? But I think at the end of the day, Identity is digital perimeter for sure. Zero Trust is sort of the biggest coalition. And then of course, SASE as well, because the thing is today, you're not in the castle involved. You're not like safe in your office and you're working from anywhere. The office is anywhere, right? So SASE and anytime, anywhere authorized access, know, purely borderless work in a secure manner. needs all of the things we were all talking about, if that makes any sense. Mike Crandall (24:48.898) Yeah, with the CMMC, that's the scoping. And if they don't have some sort of sassy solution or zero trust solution, I'm like, when you're working from home, you realize your children are now on your corporate network. And we have to address them. And I love my family, but I don't trust them. That's what I tell them all the time. That's my zero trust. Arun DeSouza (25:02.97) Thank Patrick Spencer (25:03.534) And neighbors, Arun DeSouza (25:11.992) Ha ha ha ha ha. Patrick Spencer (25:15.79) How do we, Arun talked a bit about this in terms of governance controls and so forth, but we've always thought zero trust in the network because of, know, Forrester, the Palo Alto, you know, and how everything derived on that front. But now organizations, and we're big advocates of this, obviously, it's tied to our business. know, zero trust must extend to that data layer. So you have all this data and when you look at all top 11 data breaches, it's different types of data. We'll talk about data classification sensitivity here in a moment if we have time. I'm sure we will. But how do you extend that zero trust layer to the data, just not the network? That's where I think we need to be headed. Arun DeSouza (26:00.98) So if I may take that, think first of all, it has to come from the place that regulatory compliance, and it's talked about in the report, is one of the key factors, right, along with risk and data sensitivities. You've got to understand that, especially understanding which regulations are affecting you. So once you agree to that, you will see a common theme across all these regulations, the fact that you need to respect data sovereignty. you know, everybody is there. so going into the future, I do believe that self sovereign identity can really help that because today we have 20 possible 20 systems will have a digital passport that we're not there yet. In the short term, what can we do? Like we were talking earlier, Mike said it, you said it, Patrick, we're not able to manually classify every data. It's just simply not possible, right? So what you need to do is realize that there are two channels of data, right? Just keep it simple. One is data in transit. So you need to encrypt the communication and transit. In the network layer, you need to have AI, network observability to see those anomalies, like you said, to catch data exfiltration and stop it in its tracks by pattern and anomalous behavior, or even the user anomalous behavior. But to me, think the flip side is sort of really boring, is the data address problem. Data address, now remember, is data in the cloud. Of course, right? So we need the governance again when you go to systems in the cloud, making sure that when you sign a vendor, there are proper controls, all that has to be done. But, or data on campus, but in order to understand what you really have, because you can't be shining the light, flashed into every nook and cranny, you don't have enough people, what one needs is really a no-fooling data characterization governance platform powered by AI that can go out there and then discover the anomalies and actually calibrate it on an as-is basis with your data classification policies and say, well, gee, I think this data looks like social security number. It's not protected or that HR data is on this file server, there's no protection. By the way, we think you need to do something. So I think the heart of data and the data characterization governance platform needs to be able to classify, characterize, and with the notion of observability proactively to the extent possible, Arun DeSouza (28:25.092) fix the data problem as well. We're not there yet, but I think it's all of those things. Mike, does it make sense? Mike Crandall (28:32.162) Yeah, and I think where we're lacking now is a lot of, know, I'm sure we've all done it. We've asked our client, so what's your important data versus your not so important data? And they either tell me it's all important or none of it's important. No one cares about it. And that's how they treat it on their systems. You know, they'll have a repository and 90 % of the employees can get into it. So until we start thinking about zero trust internally, you know, like You know, poor Arun, doesn't need to see this file. That has nothing to do with his work and we can properly restrict it. Then we can do that externally too and say, okay, using all the tools you said, you know, we got to be smarter about it, but it needs to start internally where we know, no, this, this stuff only 10 % of the company needs to see. And then in addition to that, what is your scale data? Arun, when you talk about data at rest, we have. Arun DeSouza (29:25.06) Mm-hmm. Mike Crandall (29:27.886) probably less than 20 % of the files and data that we have that we use on any regular basis. So how can we archive and put into some sort of cold storage this data that we may need to keep, but we're not going to be accessing it? So that way it's kind of out of touch, out of line, and we can segment it out and keep it away. Then your protection footprint is much smaller because you've got stuff kind of cold storage away. Arun DeSouza (29:52.026) Absolutely. Nielsen. Patrick Spencer (29:53.484) Great point. Well, we'd argue, know, Arun said data in transit, data at rest, we would say data

in use to your point, Mike, right? You have some data that is used, that 20 % or whatever that percentage looks like that is used internally, but also externally with third parties, which is another aspect in the report, you where you open up all these third parties who have access to data. And if you're not using the right governance controls, like Arun referenced, Arun DeSouza (30:01.722) Mm-hmm. Patrick Spencer (30:22.22) then you're exposing it to risk because there's people who are looking at it who don't need to use it should not be looking at it. And they might be forwarding it or changing it when you don't want them to do so. You know, what what was your sense in terms of third party risk is governance, you know, comprehensive governance, the answer to solving that problem. Mike Crandall (30:43.884) think governance is a good step, I believe that we sometimes implore governance instead of security. And you need governance with security. I joke, two-factor authentication we brought up earlier, my wife recognizing me in the morning is not one factor. It doesn't count. It does nothing towards security. But I might say I'm compliant as a two-factor authentication. So we have to look at our compliance. Arun DeSouza (30:44.021) Arun DeSouza (31:03.555) Thank Mike Crandall (31:13.086) and our governance in such a way that it has both teeth and a true security mindset behind it, you know, instead of a tick box. Arun DeSouza (31:25.782) So one of the things that... Patrick Spencer (31:26.062) And influx in fines and penalties that we've seen over the last couple of years and this year, I haven't seen the summary for 2024 yet. It depends on the regulation, those are up. You think that's starting to put some teeth into some of these regulations where organizations will be forced to adhere to much stricter security controls or we still have a long way to go there. Arun DeSouza (31:50.746) I think they will because I mean, the one thing that I wanted to say earlier is I talked about encryption for data transit, but you need data at rest as well. And it's also very important now because with quantum computing coming, you need a higher level of encryption. By the way, I'm not an expert in encryption for quantum, but for example, homomorphic, I think it's called encryption. Patrick Spencer (32:18.156) Encryption, yep. Arun DeSouza (32:20.056) Right, and speaking of multi-factors too, we need to train people to get rid of the low-tech multi-factor security question, my God. You can hack that by social media accounts or the text messages, but going into more stronger, like authenticator, biometric things like your face, et cetera. Now, I say that not tongue-in-cheek, I realize that you've got to put the guardrails around AI, like supervision, you also need. the same level of due care and due diligence from a privacy perspective using biometric. But the of the matter is, everything else being equal, your biometric passport, your biometric signatures, very,

very important. And so the reason I mentioned that is we see some of the breaches, I think, to the change health care, the whole entire ecosystem got torched, just like you said. Mike Crandall (33:04.942) Thank Patrick Spencer (33:13.358) Not for Mars. Arun DeSouza (33:15.62) So a chain is as strong as weakest link, you know, and how do you assess the risk posture of all your suppliers? How do you do that? Right. It's very, very difficult because I mean, the way that some of the big companies do is they send you this weekly 300 question or 20 page questionnaire to fill and they say you have put in, we may audit you. That's not the way, right? That's just not the way. I mean, it's a partnership. mean, it's almost to the extent that you've got to Mike Crandall (33:15.718) But in some cases, probably, it's not as Mike Crandall (33:27.703) Thank Arun DeSouza (33:45.211) I think this is where I think public private and private private partnership can come and there's sort of industry specific coalition. mean, kind of taking the thing from the cloud, where you have public cloud and private cloud, but you have community clouds. So taking the same principle thing in action across the supplier and manufacturing ecosystem, have those communities of practice, right? Where people come, they share everything. No one is smart enough to say they know everything. So I think what we need to do is not only just focus on the technology and encryption, but really building the partnerships across public, private, and private, private, so we can all work together in what I call the power of federation, if that helps. Mike Crandall (34:28.812) Yep. Yeah. And I like to say that the problem that we're having is, you know, so many companies feel like an island on themselves, but they feel that they've spent money and therefore they have cybersecurity. And I like to tell people cybersecurity is a myth because you're never getting there, right? It's a journey, but there's no end point. You're not going to spend enough. Arun DeSouza (34:39.95) Mm-hmm. Patrick Spencer (34:51.97) constantly evolves. Arun DeSouza (34:54.254) Well said. Mike Crandall (34:55.598) You're not going to outspend it. Understand your risk and understand what you're doing to prevent things, but know that the new thing is coming. Quantum, I use my Arun, the can of worms. When you said quantum, I'm like, oh no, he's opened that can of worms. Encryption's dead. Because it is. We have to figure out what's next. What's next? If we're always saying I've spent, therefore I'm safe. Arun DeSouza (35:12.186) I wouldn't have to. Mike Crandall (35:24.999) You're not there, you you got to constantly be looking forward. Patrick Spencer (35:28.684) Well, one thing we looked at, talked about maturity of security and documentation and encryption for that matter. This is music to both of yours. We just published not this report, but we published a report on the state of CMMC 2.0 maturity or preparedness. think it was a preparedness in the DIB. And those organizations that said they worked with experienced third party providers like you guys. came back and they had much much I mean we're talking twice as many in many instances better You know comprehensive security controls in place encryption in place You know what? Why do you think that's the case and do too many organizations? Forget that step on the CMMC front you've probably seen that Mike you're being called in but beginning to panic We don't have CMMC compliance. We're gonna lose our business with the DoD, if we don't get this CMMC by the end of the year and you're peeling back the layers and it's a train wreck because they haven't worked with an experienced third party like yourselves. Mike Crandall (36:34.894) Yeah, and I think that goes to so many senior leaders that think the IT department are omnipotent and know everything about everything that has to do with IT. And they just go, they've got it. And if you look at some of these regulatory controls and implementation of those controls, it can be so nuanced that an IT person might just say, and bless them, they're doing their best, but their job is to keep the bits flowing, right? The printer's printing. the boss happy and they're like, yeah, we're doing that. We have to factor, but what is it? And is it meeting the intent of the control and, you know, digging deep into like in CMMC, the objectives under the controls. And I think what we're seeing is a lot of those people who don't have that expertise brought in are relying on what they consider to be their experts, which they are for what they're doing, but they don't understand that whole compliance side of things. And That's where that gap is, that gap in what we're finding is they're not doing it because they don't want to. They think they're doing it, but they don't have a full understanding of what it really is. Patrick Spencer (37:46.988) Is it because of cyber, I'm interested in both your opinion on this, is because the cyber folks just haven't aligned completely with the compliance components yet that, you know, they've been focused on cyber and now they're realizing there's a compliance element that needs to be wed to cyber and they're just beginning to do so. that, is that the case? Mike Crandall (38:03.914) and it is beginning to explode. Yeah, I think that in the, you know, a lot of the times we're just getting the job done. And when you come into compliance, there's a lot of paperwork and the prove it. And, you know, Patrick does it because he's the admin doesn't really cut it or, know, Patrick's the person who monitors the logs. Awesome. show me the last thing you took action on. like last week I did something, you know, and you're like, nope, that has to be documented. We have to. What actions did you take? Were those actions approved? Did it go through a change management process? You you start incorporating that guidance in there and it moves away from you doing your job, just doing

your job. Arun DeSouza (38:38.308) Thank Arun DeSouza (38:49.828) Yeah, I think it has to change, For example, we take the example of OT security, right, in manufacturing, the OT people versus IT people, not everywhere, right? Because each are doing their own thing, and then you may have breaches to suppliers who come in through unsecure networks and so on. So I'm going to postulate that companies need to understand that there is an overarching umbrella. And what is that umbrella? The umbrella of enterprise risk. So if you agree to that sort of umbrella, then under that umbrella is security, privacy, audit, governance. They're all part of the stuff. I think normally what happens is enterprise risk is in companies is basically like check the box, like throwing darts and say the risk is this, this, and this. But at the end of the day, there's got to be at least a programmatic level collaboration across those functions because of multidisciplinary problem, right? Because not any of the functions can know everything about everybody else. But if there's the mandate that comes from the board or the audit committee or the chief risk officer to say, guys, you've got to play nice. We need to make sure, OK, what's our balance scorecard to minimize risk across the entire thing? What are risk minimization goals for this year? What are the initiatives? What are the processes? What are the investments you have to make? That's going to be the conversation. So back we come full circle again. So the notion of the partnerships now inside the company, intra-company partnerships, which I think too often don't happen because like you said, Mike, we're all very busy, or Patrick. But I think the fact is we keep having to do more and more, less and less. And if each of us functions an island, how's it going to work? The whole thing is going to come crumbling down. And I say that also because I read an alarming article in LinkedIn the other day that the CISO is being demoted in the organization. which already under IT demoted even further, some cases reporting infrastructure or whatever. But the thing is that's to me and antithetical to the notion that enterprise risk is where every company should pin their hopes to drive their mission and vision forward. Patrick Spencer (40:46.915) Hmm. Patrick Spencer (41:06.358) Yeah. And how do you ensure that that's the case where you have all those islands interconnected? You have bridges built between those islands. Unlike here in the Pacific Northwest where we don't build bridges. You have to get on a boat to visit the islands. How do you build those bridges? Do you have any suggestions there? Arun DeSouza (41:18.785) Hahaha! Arun DeSouza (41:24.474) Well, can, I mean, in the absence of the fact that there's no corporate sponsor with the CRO or the board audit committee, right? I think personally, my opinion, in my opinion, the chief information security officer should be that evangelist storyteller and relationship builder, because no one else is going to do it, right? Because, and it's important to take that and I've done it also building those partnerships, relationship at a time, because when you build those relationships, you know, it's... A rising tide lifts all boats, right? So when all of us are riding the same tide like surfers, right? I think we are much better off. So I think rather than saying what we can do, how much more we can do together. But for that, I think the CISO should be the thing. honestly speaking, think some corporations are already there where the security officer is a peer of the CIO. And in fact, or directly for chief risk officer. Because there's come level of corporate sponsors, we've got to elevate the conversation. Because otherwise, know, it's like the beatings will not stop, right? You can't work like that all the time. It's demotivating. You know, you can't be a scapegoat. You've got to be an equal partner, then well, you should be invited to be a partner. But it's not always going to happen. We know that. So if you want to be more successful, you've got to make that investment of time and effort. And look, everybody's not going to be a friend. You're not asking them to be a friend. What you're trying to paint to them is that I am your ally, I'm your partner, I'll help you, let's work together. And some may not jump, but largely speaking, most will. So I think the principles I would say is, know, vision, collaboration, execution. You paint the vision for these guys, power relationship, commit to collaboration, insist on it even, even if they extend going to lunch or going to coffee or inviting them to your own round table. the CSO round table once a month or whatever. Because once you do those two things, then the strategic roadmap to minimize enterprises with the security plan, et cetera, can be executed in the proper way with balanced scorecards and those things. Patrick, does that make sense? Mike Crandall (43:21.816) Yep. Patrick Spencer (43:35.596) Yeah, that's that's exceeding. That's a whole white paper. We transcribe it, we put it into a cloud or chat GBT and we got a white paper from everything you said. That was great. Arun DeSouza (43:39.076) The next part you'll Mike Crandall (43:46.798) Exactly. I was just going to say, we fight hard, play hard. So that's military training. You do the work, but then you also go out after work and you build your teams that way. You have to have that connection as people. Patrick Spencer (44:03.026) That's very true. One of my guys who's a coder and focused on delivering on some projects, he complains when he goes to the company events, everyone sees him, they talk to him and now they know how smart he is and they come to him wanting help on their projects. But maybe that's causing for a seizure. Mike Crandall (44:20.018) He's just got to learn to dumb it down in public. That's all. You just got to know your limits. It's part of that team building. Patrick Spencer (44:27.278) Exactly.

Well, we're about out of time. This has been a fascinating conversation. Before we wrap, just, you know, we'll start with you, Arun. You have any thoughts in regards to the report? Anything that we missed or, know, key takeaways for you? You guys have talked about some of them already, but anything that we may have not touched on yet that you think is worth mentioning? Arun DeSouza (44:47.642) I think I have a few things in my mind, starting what I got from some of the high level attacks, you know, in no particular order. think the API economy, we talked about the API economy, and you and I talked about in the last podcast, API security. I think, you know, some of these breaches could have been prevented if they had stronger API security, making a commitment to that. You talked about cloud misconfiguration. People take things for granted. So I think we need to strengthen that security posture. we've flogged this ad nauseum. Identity is a digital perimeter, but this identity-based attacks keep going up all the time. And yet our controls are not keeping up. We're not adopting zero trust fast enough. We're antiquated multifactors, right? And then, of course, the thing we didn't talk about, we touched upon is the notion of patch management, right? Because you need to be making sure because how many of these stop breaches are done by misconfigurations and vulnerabilities, right? And the thing that's interesting to me is that some of these breaches, they're not just, you know, it's not like a one and done. Like I think you mentioned it earlier. It's like they're patiently waiting, they're evading you, they're sitting in your home, you know, so how do you do that, right? The stealth mode, they're there. And then... I think some of the other things that we can do is commit to zero trust for sure. And then Patrick, talked about it earlier, data minimization, the minimum necessary. think you talked about it too. But that data minimization, whether it's data in use, like you said, or data at rest, or whatever has to come from the foundation of data characterization and proactive governance through an observability and AI-driven platform, I would say, for sure. And then of course, I think you've mentioned earlier, committing and investing in advanced threat protection technologies, right? Because why should only the bad guys have AI? Good guys should have AI too, right? Patrick Spencer (46:55.822) Mike, any thoughts building on some of runes takeaways? Your thoughts on the Mike Crandall (47:00.952) Yeah, for me, for me, these reports come out and I think a lot of senior leaders look at them and go, well, that's not me. I'm not, I don't have 9 million records. don't have a hundred million records or whatever. And, you know, I want people to take away, this is your top 11, but breaches are like oceans 11, the movie it's that's the, what we see in the news are those high intensity, you know, hacks that have the big score at the end that were complicated and you

know, had professionals doing it, but we don't learn about how many convenience stores were robbed last night. And that's you as a business. You're not making the top 10, making the top 11. You're not being the news, but trust us, there are many more. These weren't the 11 hacks of 2024. These were the top hacks. There are literally hundreds of thousands, if not millions more. And that's you. So take this away and learn from it, but don't... look at it and go, whoo, you know, I'm never going to be that. So, you know, look at it and learn from it, but know that you are in that group. Patrick Spencer (48:09.496) That's a great point because these are the ones where the most malicious activity and the biggest impact was seen. We can take lessons from each of these and bring them back into our organizations. These are things that we want to ensure we have locked down, that we've hardened. We have the right governance controls in place so that we minimize those risks. We'll never get rid of the risk. Never will happen. But we can minimize it. Arun DeSouza (48:09.647) Yeah. Mike Crandall (48:31.234) Right. And to that point, when you say these are the biggest impacts, these are the biggest impacts on scale, but not necessarily the biggest impacts because a small business that gets breached could be going out of business, which is a much bigger impact than we had to cover, you know, this kind of damage, which these multi-billion dollar companies do. Arun DeSouza (48:34.254) But. Patrick Spencer (48:53.154) You know, very, very, very true. I know my number one takeaway was a hashtag from Mike, PW no dogs. Arun DeSouza (48:54.178) And yeah. Mike Crandall (49:03.662) That's right. How many dogs can you have in a household? You can't have that many dogs in your household for the number of times you're going to lose your password. Arun DeSouza (49:14.138) If I may say one or two more words because I lost my train of thought earlier, think if you're going to minimize enterprise risk, you've got to focus, in my opinion, the trifecta of monitoring, continuous monitoring, but not just passive monitoring, but embracing observability so that you can take changes correctively. Robust access control that are being tuned all the time and adaptive cybersecurity frameworks. for sure because that's how you're going to be able to fulfill your regulatory compliance in your business vision and vision. Patrick Spencer (49:53.551) Those are great points. That continuous monitoring and observability across your entire environment is critically important. Mike, how can folks get in touch with you if they're interested in engaging your organization? What's the best way to do so? Mike Crandall (50:09.626) The best way is just reach out to either me on LinkedIn or at our website www.digitalbeachhead.com. Patrick Spencer (50:16.898) Great, and Arun, I assume it's probably similar for you. Arun DeSouza (50:19.866) Yeah, mainly to LinkedIn. think that's where people find me fastest, right? I think everyone's there. Thank you, Patrick, for this opportunity. And Mike, thank you also collaborating on this. It's been great fun, really. I had no idea what this was going to be about. But man, we had a great conversation and a ton of fun. Patrick Spencer (50:40.394) I don't think we followed the outline at all that we put together, but an engaging conversation and hopefully your audience found it helpful. The report, make sure you check it out. It's a link for audience at the bottom of the podcast page and check out Mike's organization as well as Arun's profile on LinkedIn and engage them because these guys are very knowledgeable and have years and years of experience in cyber as well as compliance. For those in our audience interested in checking out other Kitecast episodes go to kiteworks.com slash Kitecast. Thanks for joining us and we look forward to having you on our next Kitecast. Arun DeSouza (51:17.924) Thank you. Mike Crandall (51:18.552) Thank you.