Latest / Identity at the Center / #304 - Identity and Cybersecurity Insights with United Airlines' CISO Deneen DeFiore

Transcript

#304 - Identity and Cybersecurity Insights with United Airlines' CISO Deneen DeFiore · Identity at the Center

0:00
You know, back in the day, as you mentioned, they didn't have
0:02
cyber security degrees, right, Right.
0:05
So you kind of like work your way into this industry, which is
0:08
what I I love about it so much. Yeah, I do too.
0:11
I think that's a a really important point for people to
0:16
remember. A lot of us got our like, didn't
0:19
get our start in cybersecurity. We got our start in technology
0:22
or, or some other biology. For me, you know, it, it, it was
0:26
different, but someone took a chance on us.
0:28
And with the, you know, pervasiveness of the need for
0:32
cybersecurity professionals, identity professionals, I think
0:35
that we need to remember to, you know, look at potential, look at
0:39
transferable skill sets and really take a chance on, on
0:42
people because someone took a chance on us.
0:44
So let's let's pay it back for sure.
0:51
This is identity at the center if it has anything to do with
0:57
IAM. This is the go to podcast now
1:01
your hosts Jim McDonald and Jeff Stedman.
1:11
Welcome to the Identity at the Center podcast.
1:14
I'm Jim McDonald. I'm not here with Jeff Steadman
1:17
today. He was unable to make our
1:19
session today, but we've got a fantastic episode coming up.
1:24
Before I get into things, I wanted to do some housekeeping
1:26
items and kind of go over our discount codes for upcoming
1:30
conferences. So the first one is very much in
1:34
the very near future is Identity Week America.
1:37
That's going to be in Washington, DC, September 11th
1:40
and 12th. We have a discount code for 30%
1:43
off. It's IDAC 30.
1:46
We'll have a link in the show notes if you want to follow
1:48
that. Or you can just Google Identity
1:50
Week America and go through the registration process.
1:54
As you know, we've attended and covered the Authenticate the
1:59
Fido Alliance Authenticate conference for the past few
2:03
years. We have a discount code for that
2:05
as well. It's the best one that you're
2:07
going to find anywhere to get you 15% off your registration.
2:11
It's IDAC 15. Again, we'll have a link in the
2:15
show notes, but it's definitely a conference that we recommend.
2:18
We had Andrew Schicchiar. We've recorded an episode with
2:22
him that'll drop here in the next couple of weeks.
2:25
Today we have a fantastic guest. It's somebody that I met at the
2:30
Identiverse conference this year, Danine Defiore.
2:35
She's the chief information security officer from United
2:38
Airlines. Welcome to the show, Janine.
2:41
Thank you. It's great to be here.
2:43
I'm excited. Yeah.
2:44
We're really excited to have you, Danine.
2:47
It's kind of our tradition here to get your identity origin
2:52
story. How did you get into the
2:53
industry? So the question is, how did you
2:56
get into identity? Did it choose you or did you
2:59
choose it? Well, I think it shows me
3:03
actually, I had various roles in technology and, and actually
3:10
kind of, I'll say fell into the identity scope in space.
3:14
I was working at General Electric back in the day and
3:18
they were starting, we were really starting to build
3:21
capabilities around cybersecurity at that time,
3:26
information security, IT governance, risk management and
3:31
you know, being the company that GE was very separate, you know,
3:35
had different business units. But one of the core principles
3:38
we established very on was having a centralized identity
3:43
system, which was interesting at that time at, at such a large
3:48
diverse company, but was able to get into it that way.
3:52
And I guess ironically, coincidentally moved around, you
3:57
know, a couple times in my career at GE and different roles
4:01
and different businesses and ended up running identity for
4:05
the company several times. So it keeps choosing me.
4:08
Actually, I don't know that I'll ever get away from it.
4:11
That's a really cool story. And as we were getting ready for
4:13
the show, you mentioned your background.
4:16
You got a degree in biology, which is similar story to me.
4:20
I have my degree in political science.
4:23
You know back in the day, as you mentioned, they didn't have
4:26
cyber security degrees, right? Right, so.
4:29
You kind of like work your way into this industry, which is
4:31
what I love about it so much. Yeah, I do too.
4:34
I think that's a really important point for people to
4:39
remember. A lot of us got our like, we
4:42
didn't get our start in cybersecurity, we got our start
4:45
in technology or, or some other biology.
4:48
For me, you know, it, it, it was different, but someone took a
4:50
chance on us. And with the, you know,
4:53
pervasiveness of the need for cybersecurity professionals,
4:57
identity professionals, I think that we need to remember to, you
5:00
know, look at potential, look at transferable skill sets and
5:04
really take a chance on, on people because someone took a
5:07
chance on us. So let's let's pay it back for
5:09
sure. Pay it back.
5:10
Yeah, I love that. Now you mentioned your time at
5:13
GE General Electric. It sounds like that's really
5:17
where you kind of like cut your teeth in identity.
5:20
And I'm wondering, do you have any interesting project stories
5:24
or things that you kind of were involved with or LED in terms of
5:29
identity and access management? Yeah, we we did a lot of
5:32
interesting things there. And you know, you look back at
5:34
the time, you don't think it was that innovative or that cutting
5:38
edge or or you know, or that impactful.
5:42
But kind of looking back on our approach and philosophy and
5:46
where we push the boundaries with some pretty cool and
5:48
significant things. I mean, one of the things that
5:51
came to mind was again, pulling all those disparate businesses
5:56
together into one central identity system was it was, it
6:01
was tough and we did it. We collapsed, you know, back in
6:04
the day collapsed. I, I can't even remember how
6:06
many domains until, you know, really one domain we had, we
6:10
really went after what I'll say true single sign on, you know,
6:15
single sign on at that time back 15 years ago was, was not really
6:19
single sign on. You logged it, you know, and
6:20
still to this day, a lot of organizations don't get it
6:23
right. So what we developed with the
6:25
tools and technologies at that time, we, we developed a great
6:29
user experience so that you could get access to the
6:33
applications you needed, when you needed them and only be
6:37
challenged, you know, for a different form of
6:40
authentication, when, when was when it was appropriate.
6:43
So we were starting single sign on, you know, risk based
6:46
authentication, zero trust authentication or zero trust
6:49
type identity systems before. I think those terms were, were
6:54
cool, right? But looking back on it, it was,
6:56
it was, it was, it's interesting to reflect on that and see, you
7:01
know, that is kind of like the, the table stakes now and the
7:04
standard ways of approaching things.
7:05
So a lot of a lot of great projects, programs and people
7:08
that were there to to help with that.
7:11
You know, that provides me so much of, of my history and
7:15
identity or how I got into identity.
7:18
So I was an AD administrator. So I was one of those domains.
7:22
I was at a company called Ingersoll Rand, which was a
7:26
global diversified industrial company, whatever that means is
7:29
like we bought a bunch of brands, pushed them all together
7:32
and said they're one company. And you know, GE always had the
7:37
reputation of having fantastic management training.
7:41
So the CIO of the, of the sector that I work for, you know, he
7:47
came from GE and we were kind of driving toward that same, you
7:52
know, why do we have 15 Active Directory domains around the
7:56
company? And, you know, there's a lot of
7:59
fiefdoms, if you will, when it's not as much today, but I, I, I
8:04
don't think. But back in the day, that was
8:06
very much a real thing. Right.
8:08
I agree. And I also think identity back
8:11
in the day was looked at as a, I'll say like an IT thing.
8:17
Like you know, it's basically an IT thing, right.
8:19
It was kind of you just needed it to get the ACT access to
8:22
systems. It wasn't really looking at
8:26
looking at a strategy that not just enables, you know, just
8:30
access to systems, but you know, a a better use it user
8:35
experience, right? And then enables privacy and
8:38
trust and different things like that.
8:40
So I think we've come a long way, which is really cool to
8:42
see. Yeah, the conversations we were
8:44
having 20 years ago was I wanted to take my laptop and go to this
8:48
other office and plug it in, and I just want to be able to use
8:51
the printer, right? And it's like, you can't just
8:54
use the printer you're thinking. So let's shift the conversation.
8:58
We've been talking a lot about back in the day, but today
9:02
you're the CSO of United Airlines and you gave a
9:06
presentation at Identiverse. I thought it was fantastic.
9:10
It was obviously longer than some of our podcasts.
9:13
So can you give us kind of the Cliff Notes of that
9:16
presentation? Yeah, yeah.
9:19
So you know, we've we've been looking at specifically customer
9:24
identity as an enabler of a few things I, I just mentioned,
9:28
right, trust with our customers enabling that higher level of
9:33
digital interactions. Like how do we get more value
9:36
between ourselves as United Airlines and our customers by
9:40
increasing the trust. So looking at customer identity
9:43
as an enabler for that, you know, we've done things which
9:47
might not be like super, you know, super creative or super
9:53
innovative, But when you think about the I can't millions and
9:59
millions and millions of accounts that we manage globally
10:02
and the the use case for airlines like the passenger use
10:06
case, right? Moving those identities into a
10:09
modern authentication and authorization platform with, you
10:13
know, with the ability to have a customer be secure, enable
10:19
privacy, things like MFA, things like adaptive authentication in
10:24
the future choice around authenticators is really
10:28
something that we're striving for.
10:30
So we're trying to make sure that we're taking all the the
10:33
the goodness of the identity technologies from a security,
10:37
privacy and trust perspective, but then also using that to
10:40
enable better experiences for our customer.
10:43
The more we know about our customer, the more that we
10:45
understand how they like to interact digitally with our
10:48
channels, the better experience and personalized journey we can
10:52
offer them. So it's been an interesting and
10:56
really cool journey for us to start to implement that changing
11:01
from the legacy, you know, kind of authentication, get access to
11:04
our website, your mileage plus member to now having this
11:07
holistically holistic customer identity journey that provides
11:12
not only the security and privacy and trust, but also
11:14
that, you know, really, really personalized and and meaningful
11:20
customer experience. Yeah, that customer experience,
11:23
CIM to me, like that is where it's at in terms of exciting
11:28
stuff. And I think part of that for me
11:32
is, you know, the whole idea that whatever your back end is,
11:36
like if it's different applications that kind of build
11:39
the whole the.com is really like, you know, a set of
11:43
infrastructure, different applications that should not be
11:46
your customers concern, right? They they just want one
11:50
experience. So there's the ability to drive
11:52
a better user experience and talk about trust and their data
11:57
not ending up maybe in 3rd party systems that their
12:00
authentication is strong. That's one of the challenges I
12:03
think with going to pass their list is even though we all hate
12:08
the password because it's behind so many breaches, some people
12:11
think if I don't then her password maybe it's not as
12:14
secure. So I think that's one of the
12:16
things our industry will have to take on.
12:19
I think the other thing with CIM is getting to that, that one
12:24
identity that really covers everything that comes a back end
12:28
enabler. So now the business can farm
12:31
data based on the identity. So it's just you're solving so
12:35
many different problems by getting it right, but it's not
12:38
always the easiest. Problem to solve.
12:40
It is not the easiest problem to solve because you like again,
12:43
those, those, the customer ecosystem, right?
12:46
All those different applications and different channels, they're
12:49
all disparate. They're all have been there, you
12:51
know, in different shapes and forms on different levels of
12:54
maturity and capability. And trying to harmonize that and
12:59
make sure that you're not adding additional friction into that
13:02
customer flow is a interesting challenge.
13:06
And it's, it's hard to overcome sometimes, but we're, we're
13:08
working at it and I think we're getting it right.
13:10
So hopefully if you're a, if you're a customer of ours and
13:14
use our mobile or our website, you'll see some great changes in
13:18
the profile account management and you know, login experience
13:23
as well as your, your travel journey based on identity.
13:27
Right, Yeah. If you're seeing the progress,
13:29
then you can, you can thank Danina and her team speaking.
13:34
Yeah. Speaking of kind of a, you know,
13:37
you and your team, like you're not getting it all done.
13:40
You've got a a team of smart people.
13:43
So you're a leader of people within the organization.
13:47
And I wanted to know what is your philosophy for building a
13:52
winning team? Sure.
13:54
Yeah, I've had several experiences across my career,
13:57
you know, building really high performing capable teams that,
14:01
you know, I'm, I'm, I'm really proud of.
14:02
There's been folks that have, you know, I've hired and they're
14:06
there, they're Csos of companies now, which is really exciting
14:09
for me to see their growth and their, you know, their, their,
14:13
their success. So I think, you know, when when
14:16
I look at building teams, it's really, it is a science, but
14:22
it's also more of an art than a science.
14:24
When you look at what you're a highly functional team, the
14:28
first thing you need to do is really understand, OK, the
14:31
outcomes that you're trying to drive.
14:32
What are you, what are you trying to accomplish?
14:35
And then do you have the skills, skills and capabilities of the
14:39
people that can, you know, drive drive to get those outcomes
14:43
achieved? And sometimes, you know, having,
14:48
you know, sometimes based on the people you would organize
14:50
differently, right? Or you would bring in different
14:52
compliments of people, or you would you would have things
14:56
arranged differently if it if it was, you know, if it was
14:59
different outcomes you're trying to achieve.
15:01
So I really think as a leader, you have to understand your
15:05
people, you know, from skill set, a capability, how they work
15:09
together, what motivates them, right, and put those pieces
15:13
together. It's like a puzzle and make sure
15:15
that they all work and they continue to function and
15:17
continue to work and, and nothing's breaking down.
15:20
So it is, you know, it is a science.
15:22
You know, there's skill sets and ways to approach that, but it
15:25
also is an art like you have to like you have to think about it,
15:29
right? And in one situation might be
15:32
the way you've organized, the way the you've rallied around
15:36
people might be great. In another situation, it might
15:38
not work. So you're always kind of
15:40
assessing and and looking at where you are.
15:44
Yeah, it's because people are complex, right?
15:46
I mean, if you might have somebody who is really good in
15:50
their domain, maybe the best in the world, but nobody can work
15:54
with them. And I think they're, I mean,
15:59
speaking from my personal experience here is, you know,
16:02
trying to coach that person, make them to be more likable,
16:05
easier to work with. And hopefully you can do that.
16:09
In some cases, though, it's not possible.
16:11
Yeah, yeah, that's a tough part of being a leader, right?
16:14
I mean, you want your, your main job is you want people, you're
16:17
there for them to be successful, right?
16:19
You want people to succeed. You want them to be their best
16:22
and contribute the, the, the, you know, I mean, the most
16:25
value, right? And that's your job as a leader.
16:27
But you know, the other part of the part of being a leader is,
16:30
is having those tough conversations, right?
16:32
And providing that feedback and, you know, receiving feedback and
16:36
continuously improving. So it's, you know, it is, it is
16:39
a responsibility of a leader to make sure you're doing that.
16:42
You hit the nail on the head. Yeah, the feedback piece, I
16:44
think for most people I've talked to, is the hardest part.
16:47
Telling somebody that they're not doing a good job is never
16:50
easy. Yeah, yeah.
16:51
But always balance it out like I always it, you know, you talk
16:54
about feedback. It's like, you know, in that
16:57
moment and you're like, hey, this situation could have gone
16:59
better if we thought about these things or if you did these
17:02
things right. But also, you know, as a leader,
17:05
don't forget to say, hey, that went awesome.
17:08
And it went, it was awesome because you did these three
17:10
things, right. Keep doing those, these those
17:12
three things. You know that because that's
17:14
going to help you. Those are going to be skills
17:15
that you're going to lean on and and you know, that's going to be
17:19
your core to, to help you. And no matter, no matter what
17:22
situation you are. So I think always, always
17:24
remember that too. Yeah.
17:27
So some specifics here. So like we're big proponents of
17:33
the conferences that are happening in the identity space.
17:36
We always talk about the discount codes, but even with
17:39
the discount codes and if you get good pricing on a
17:41
conference, still very expensive to send people to conferences.
17:46
What is your attitude on conferences for your team?
17:49
Yeah, So I do, I encourage professional development and
17:53
that comes in a couple of different forms, right?
17:55
It, it, it definitely in this industry particularly is around
17:59
conference attendance. There's all the sessions around,
18:03
you know, the best practice sharing and, you know, meeting
18:06
and networking and understanding what other people are doing in
18:09
this space because it's constantly changing.
18:11
And it is a, it is a, I'll, I'll say a, an ever evolving space,
18:16
right? So I think attending
18:18
conferences, keeping ahead and abreast of what is going on in
18:22
the, in the, in the domain, as well as sharing and networking
18:26
is really, really important. You know, I also really
18:29
encourage, you know, setting aside time for professional
18:33
development. It may be a training course, it
18:36
may be, you know, online stuff, it may be attending something in
18:39
person, or it may be, you know, two weeks of your, you know, a
18:43
week of doing, you know, research or something like that.
18:46
But making sure you're dedicated to continuously learning is
18:50
really important. Yeah, totally agree with that.
18:53
And I want to kind of come back to what you're doing to to get
18:57
your learn on in a little bit. Sure, before we shift topics.
19:01
So along with conferences, I was going to ask your attitude on
19:07
certifications. Sure.
19:09
So I use certifications in my in my organization with with my
19:15
team as a again, a professional development opportunity and
19:19
incentive to continue to grow and learn.
19:22
Do I think they're absolutely necessary?
19:25
No, you know, I mean, I think they offer a validation that you
19:29
have, you understood the content and can demonstrate you, I mean,
19:32
whatever domain knowledge that certification is for.
19:36
And I think you know, as, as you're, you know, my, you know,
19:39
my opinion is as you're starting out, maybe those certifications
19:44
are a little bit more important, right?
19:45
If you maybe like we talked about, you know, how do you get
19:48
your started identity or, or cybersecurity if you're coming
19:51
from a background that maybe wasn't in that domain, but then
19:56
you go and you self, you you're, you're learning where you're
19:59
taking the self. Motivation to learn a new skill
20:01
and you're getting that sort of certification even if you don't
20:04
have that practical experience. I think that's that demonstrates
20:07
a lot of character of knowledge, skills and abilities.
20:10
So I think that's important. I mean, as you, as you get up
20:14
the ranks, maybe not, I mean, maybe not so much.
20:16
Like, I don't know that people would really.
20:19
I don't know that people really care if I have a CISP or if I
20:23
have something else right at this point in my career, you
20:26
know, So I think it just depends.
20:27
But I don't, I don't discourage them.
20:30
I think they're valuable and people are motivated by them and
20:32
they learn knowledge by obtaining them.
20:34
So, you know, I think they have their place.
20:36
Right, right. I think they they're helpful for
20:39
people on like the job hunt, you know, it kind of proves that you
20:43
do have some base of knowledge. And I also what I do like about
20:48
certifications is the kind of sets a target for obtaining
20:52
information. But I do think that the downside
20:55
of them is, is that sometimes you kind of drill into having to
20:59
know some minutia that doesn't really contribute to the job
21:03
that you're going to be. Doing I agree.
21:05
I agree. Yeah.
21:07
So one of the other areas I wanted to ask you about is like
21:10
with the CISO Chief Information Security Officer, it's kind of a
21:16
a position that's maybe 5050 business and technical.
21:21
And so that's what I wanted to ask you about is like, how do
21:25
you strike the balance between being a a business leader and
21:30
being a techie? Yeah, I, I, there definitely is
21:33
a balance and those I think both domain skills are needed if
21:40
you're in a role like mine and really any, I mean any, any
21:45
technology role, if you can understand really what the
21:47
outcomes you're you're trying to achieve are from a business
21:51
perspective, like like what are the, what if you are able to
21:55
break down barriers or, or de risk something, right, then the
22:01
business can do more. They can operate in a different
22:04
market, they can launch a new product, they can add feature
22:07
and capability that they couldn't maybe before because
22:10
there were compliance issues or security issues or risk there.
22:14
So really understanding the business and how it operates
22:17
makes you a better technology leader, a better cybersecure
22:20
leader, a better identity leader or practitioner.
22:23
So I really think you have to have to have that, I'll say
22:26
attitude and and perspective when you're going into into your
22:31
role. Now I lead technical teams.
22:34
I value that skill set and I hold myself accountable to this
22:40
day to make sure that I can at least, you know, talk the talk
22:44
and demonstrate the understanding and knowledge of
22:47
how things work. You know, I'm not, like I said,
22:50
I'm not like rolling up my sleeves, scripting and pounding
22:53
on the keyboard and doing any of that work anymore.
22:55
But I want to be able to ask the intelligent questions.
22:59
I want to be able to challenge my team to think about things
23:02
differently and I need to understand the technical
23:04
technology to do that. So I make sure that I do and
23:07
then I connect the dots with the business outcomes and then I'm
23:10
also able to translate. Okay, You know, I just may have,
23:13
I may have spent an hour or two hours with my customer identity
23:18
team talking about, you know, the, the, the, the data flows
23:23
and the, you know, all the different things that we need.
23:26
But I can't go into our loyalty program operations leader and
23:30
have that conversation. I have to have, OK, you're going
23:33
to get this data and here's the impact on the, the customer
23:38
experience. And now you'll be able to do
23:40
these things because we're putting this technology in place
23:43
to increase trust, right? And I have to be able to have
23:45
those conversations on both ends because that way then we get
23:48
aligned and we achieve better outcomes, you know, together.
23:52
You might have to have those different conversations all
23:55
within the same day, right? You, you've got to have enough
23:59
technology under your belt that your team respects you and
24:03
understands that you get what they do and they don't look like
24:07
they feel like they have to dumb it down for you.
24:10
But at the same time, you've got to be able to go into that
24:13
boardroom and explain why you need money to spend on XYZ
24:18
project. And you used the word earlier
24:21
that I feel like is like the number one word for business
24:27
leaders these days, which is outcomes.
24:29
Yes, I mean, yes. That seems to be the focus that
24:32
people really want to understand.
24:34
If we do these things, what's the outcome we can expect?
24:38
Right, absolutely. And you have to be able to tie
24:41
the work that you do to again those secure business outcomes.
24:45
You have to understand like, OK, if it is customer identity, then
24:48
the outcomes for member conversions or whatever it is,
24:53
right? Is that's, that's what you're
24:55
that's how you're doing that. I mean, you could have the fraud
24:57
metrics and the and the account takeover metrics and all those
25:01
operational metrics. But in the end, what you mean
25:03
like what, what are you contributing to the overall
25:07
business goal? And I think that's really
25:08
important for people to understand, like why you're
25:10
doing what you're doing. You're not existing there to do
25:13
identity or cybersecurity for identity or cybersecurity sake.
25:16
You're, you're, I'm there to help make sure that people trust
25:20
United Airlines when they get on the plane, right?
25:22
That's what I'm there for. I think a lot of our listeners
25:25
who are the identity practitioners of the world would
25:28
love to be able to have an opportunity to develop their way
25:32
into a CSO or CSO like role. And so I'm wondering kind of
25:39
what is, what are some of the tips that you would have for
25:42
them on in terms of how to get the right experience, how to get
25:46
the right education to be able to get into a position like
25:51
that? And then I want to ask you like,
25:53
what do you have to do to keep your saw sharp?
25:56
I would say sharpening the saw is what it's all about.
26:00
What do you do? Yeah.
26:02
So I think actually, I think identity professionals are
26:05
uniquely positioned to get into, you know, I'll say a CISO or a
26:12
cyber leader, cybersecurity leadership position.
26:15
If you think about what we do, it is it evolves around really
26:19
the business. You mean the business processes,
26:21
the HR workflow, you mean like on the enterprise side, the HR
26:25
workflows, on the customer side, that customer experience.
26:28
So you're positioned uniquely to really have the ability to be
26:34
immersed in understanding the business, right?
26:37
And if you can develop that skill set and demonstrate your
26:40
knowledge there and, and, and again to the deliverables you
26:43
have. I, I think that that's really
26:44
one of the, one of the key things.
26:46
It, it might be harder, right? For someone that's it working in
26:49
a sock, right? As an incident response leader,
26:53
because they're not, they're only, not only, but they're
26:56
there when something goes bad, They're not there when, hey,
26:59
we're, we're, you know, we're doing these great things for you
27:01
and we're adding feature functionality.
27:03
So I do think, you know, if you, I, I do think identity
27:06
professionals are uniquely positioned to kind of, you know,
27:10
get closer to the business than some other, some other
27:12
cybersecurity domains. But you know, I think some of
27:16
the things that I've done to get into the position at IM is
27:20
again, really look for, I'll say the the hard, I'll say ugly,
27:26
ambiguous problems and then go after it, right, Because that's
27:30
how you differentiate yourself. And you have to be comfortable.
27:33
Like my job every day is, is like five of those situations,
27:37
you know, in a row at random times working through it, right?
27:40
So you have to be built comfortable for that.
27:42
And I think the earlier on in your career that you can
27:44
practice, I mean, you know, I mean practice and kind of lean
27:48
into those situations and demonstrate your capability and
27:50
values to deliver a solution is really, really important.
27:53
So, you know, I think, I think if you can do that, you're well
27:56
on your way. The other thing, the last thing
27:59
I'll mention on a leadership path would be influencing out
28:02
influencing without direct, I'll say line leadership, especially
28:08
in our roles as cybersecurity professionals, like 90% of what
28:12
I do and my team does, I can't, I can't do it.
28:15
We can't do it. We have to have the digital
28:18
technology teams do it. We have to have the, the lawyers
28:21
do it. We have to have the compliance
28:22
people do it. We have, you know, like
28:24
everybody else is executing our, you know, I mean our policy and
28:29
operationalizing it. So so I do think the
28:33
relationship management and the and being able to develop skill
28:38
sets to influence people without authority is super important.
28:42
I kind of feel like I'm with you there on that.
28:44
I am piece being a great opportunity to position
28:50
yourself. I also having been at a company
28:53
like Ingersoll Rand sounds a lot like GE.
28:56
You have people that have been in their roles for 30-40 years
29:01
and sometimes it feels like, you know, there's I could work here
29:05
for the next 10 years and not get a promotion.
29:08
But I think it's there come times where you know, big hard
29:13
to do projects are going to come along and that's where you
29:17
should try to insert yourself. Even if it's a little outside of
29:22
your comfort zone, it's going to take some getting outside of
29:25
your comfort zone to build a career.
29:27
Yeah, I agree. And like I think it's a little
29:29
cliche to say, but if you're not like if you don't feel like a
29:33
little uncomfortable, you're probably not, you're probably
29:36
not learning to your Macs, you know, potential.
29:38
So I definitely agree with you on that point.
29:42
Yeah. So, So what are you doing right
29:44
now to stay sharp technology and business wise?
29:48
Yeah. So I definitely, I definitely am
29:51
a firm believer and always have been of continuous learning.
29:55
And that's really from a self starter perspective, right.
29:58
So I spend hours each night kind of looking at different, you
30:04
know, doing research, looking at different, whatever blogs or, or
30:07
sites or on, you know, social media followings, people that
30:12
are, are kind of opining on issues and understanding what is
30:15
going on. Read a lot of like, you know,
30:17
intelligence and threat reports and making sure that we're, that
30:20
I'm up to speed on that, as well as the new technologies that are
30:24
coming up. So I'm, I'm definitely, you
30:27
know, looking at what do I need to learn on a day-to-day basis?
30:34
I have, you know, I'll, I'll spend time with my team.
30:37
OK, how does this work? How this new, this new, you
30:41
know, if it's this new capability for threat detection
30:45
on serverless, what does that mean?
30:47
Right? Like what does that mean and how
30:48
does it actually work? And I also have a great network
30:51
that I can reach out to on a just in time basis, right, for
30:56
different subject matter experts.
30:57
If I can, if I need to know something, I will reach out and,
31:01
and ask them to, to help me, you know, feel comfortable or get
31:04
understand. And that's on the business side
31:06
too. So the technology side I
31:07
described, but I also have people like, OK, well, you know,
31:11
I'm not an expert in, you know, no, I'll say flight operations,
31:16
right? But I need to understand that.
31:18
So I don't impact, you know, the flight operations when we're
31:21
doing MFA on a, on a electronic flight, bad bag in the middle of
31:26
a, you know, middle of a flight. So I go and I learn, I sit with
31:28
people and I observe and I make sure that I'm continuously
31:31
understanding, you know, what, what how people work and, and
31:35
what they need to do. So it it's always about
31:37
continuously learning. Yeah, that would be really bad
31:41
if someone missed their flight because of an MFA prompt or
31:45
something like that or didn't get their bag loaded.
31:47
So, yeah, I'm not. I think that someone in your
31:52
position becomes expert in business, expert in technology
31:56
at the appropriate levels. But then the third area is risk.
32:00
I mean, that's really what we've all become, right, is risk
32:03
professionals? You bet, You bet.
32:05
That's one of the key things that I say like any, any role
32:08
that you're going to have in, in cybersecurity, any of the
32:12
domains, you have to be an excellent risk manager, right?
32:15
That's all about what we do. We identify the risks, we look
32:18
at the, the treatment that we have to apply to, to manage that
32:23
risk or, or understand what it means to accept that risk.
32:27
So that is, that is key. And, and yeah, totally agree
32:30
with that. So any, anything you could do
32:33
to, to keep, you know, flexing that muscle like it becomes
32:37
involuntary, right? Like that's just something in
32:39
the background that you're always doing is assessing risk
32:42
and, you know, identifying treatments and, you know, making
32:45
sure people understand what that what their tolerance is, can
32:48
they accept it or not and and how that influences the path to
32:50
go forward. Absolutely.
32:53
Yeah, definitely. And that you know, if if you're
32:55
in this space and you want to kind of build your career, I
32:59
think that's one of the best ways to do is really to
33:02
understand risk and be able to talk about risk and add risk
33:06
management framework so that your way of approaching
33:09
problems. You you bet you're spot on.
33:11
Totally agree. So I wanted to shift the
33:14
conversation. We, we talked a lot about, you
33:17
know, your role as CSO. I think one of the other areas
33:22
is managing a set of technology. And what I've seen is kind of a
33:29
lot of larger organizations wind up still having to build
33:35
information security or cybersecurity systems to meet
33:38
their particular use cases. And it's one of the scenarios, I
33:43
don't see it in small to mid sized businesses anymore where
33:46
they're doing build versus buy. But I wonder, are you still
33:49
doing build versus buy analysis or do you kind of like start
33:53
with, hey, we want to be on the products for everything?
33:57
Yeah. So we, we look at it in a, in a
34:00
kind of a specific lens and context, right.
34:03
We again always like trying to figure out what risks are
34:06
reminded, what risks are we trying to manage, what outcomes
34:08
are we trying to achieve. And there's, there's typically a
34:11
platform or solution, right, that can help us meet 80% of
34:16
that. But we also have to take into
34:18
context, you mean the threat actors, the impact of the risks
34:24
associated with, you know, those threats.
34:27
And then we have to kind of match up, you know, are we OK
34:31
with with not having those features or capabilities or on
34:34
the platform or what do we do then?
34:37
So what we typically do is we leverage a lot of platforms and
34:42
commercial like commercial technologies to get like the 80%
34:45
done right. And then that gap between
34:49
commercial technologies and our I'll say our our threat profile
34:54
or risk profile, we typically tend to build solutions that
34:57
close that gap, you know, as as as best we can.
35:01
And then, you know, at some point in time, what typically
35:04
happens, right, is those, that gap like the, that what we built
35:09
becomes now a, for lack of a better word, a commodity.
35:12
It's in the, it's in the platform, it's in the vendor
35:14
solution. And then we deprecate what we
35:17
built. We use the, you know, I mean we
35:19
use the, we use the commercial technology and then we go on and
35:22
move to a different, you know, a different value add.
35:24
So we're continuously kind of learning that way.
35:27
So that's been a philosophy for for a long time for myself and a
35:32
lot of the team members that have have worked for me.
35:35
And it, it seems to work out really well that custom content
35:38
development, custom solution development to bridge the gap
35:42
where we don't have those standards tools.
35:44
And you know, like, again, everybody's, I don't care if you
35:47
work for, you know, a Fortune 100 company or, you know, a
35:51
small to mid sized business, everybody is resource
35:54
constrained. You know, everybody doesn't have
35:56
an unlimited budget, right? We're always, we don't have the,
35:59
the people to do what we need to do.
36:00
So we have to be very, very, I'll say, selective and prudent
36:05
around how we spend money, what we can actually build and
36:10
maintain, you know, going forward 'cause there's always a
36:12
cost to that as well too. Yeah, that's a fantastic answer.
36:17
So you know, one thing I was really excited about was that
36:21
you were part of the keynote at Identiverse, somebody who's kind
36:26
of like another, I am practitioner who is now
36:30
overseeing information security for a well known brand, a very
36:35
big company and you're kind of one of us, right?
36:39
That's the exciting part. And so I wanted to get you on to
36:42
the podcast and it may have been the first time you've heard of
36:45
our podcast Identity at the Center.
36:48
But when you heard that name, what did you think?
36:51
Now I thought it was great. I love it.
36:53
It really, really resonates with me.
36:54
And I, I've said this and you, I, I know people that work for
36:58
me back in the day when I started identity can vouch for
37:01
this, but I always believe identity is at the center.
37:04
It is a center and, and really keystone of any cybersecurity
37:08
strategy. So you know, like the the the
37:13
your name of your podcast just hit home.
37:15
I think it enables a lot and informs any function and any
37:19
capability within your cybersecurity strategy.
37:22
So it is it really is. It is the the the center in in
37:26
Keystone. So love it, love it.
37:28
Yeah, thank you. You know, we, Jeff and I just
37:31
recorded episode 300 during that episode.
37:35
Yeah, thank you. We we talked about this and I
37:39
said, you know how the the buzz term is identity is the new
37:43
perimeter almost such that you can say identity is the
37:46
perimeter. I actually think, I actually
37:49
think identity is the center and we don't really trust the
37:53
perimeter anymore. The perimeter, if you think of
37:56
it as the firewall keeping the threat actors out, yeah, it it
38:01
does that and that's important. But eventually there's people
38:06
that are out inside of the perimeter and we have to have
38:10
safeguards and we can't trust that people inside the perimeter
38:13
are all, you know, the good guys if you.
38:16
Will Yeah. No, I totally agree.
38:18
I totally agree. That's awesome.
38:19
Yeah. So love having you on as an
38:22
identity practitioner and I wanted to kind of tap into your
38:27
futurist point of view and understand what are some of the
38:32
ideas or some of the things that are exciting to you in terms of
38:37
up and coming or areas that are getting a lot of focus now in
38:41
identity. Yeah.
38:42
So I think, you know, a lot of the, the focus in identity is,
38:47
is really around, I'll say like biometrics.
38:51
We're able to, you know, you talk about password list, but
38:54
biometrics in addition with the, with AI and ML have made it
38:59
better, right, and more trusted. And we are able to do different,
39:03
different things. We're able to look at identity
39:06
holistically from a technology perspective because we have
39:11
biometrics integrated with digital identities integrated
39:14
with, you know, I'll say attributes and context, which I
39:18
think is super exciting. There's a lot of, I think
39:22
really, really cool stuff going to be happening in that area in
39:25
the next, next few, you know, next few years.
39:30
Everything from, you know, with our, I'll say with the device
39:34
manufacturer, you mean like with the device manufacturers to the,
39:36
the digital identity providers to the biometrics.
39:39
I think everything's going to hopefully start to merge a
39:43
little bit more and we're going to get some, you know, some
39:47
really cool innovative features that enable a lot of, a lot of
39:51
use cases and then UPS our, our trust, right.
39:54
And, and really understanding who you mean, really
39:57
understanding and identity proofing and, and verifying
40:01
people and maybe even not, you know, maybe even non human
40:05
identities as well too. So really exciting stuff.
40:08
Yeah, it's really exciting stuff.
40:09
And I would, you know, when I think about areas like that,
40:13
there's there. If the technology is there and
40:17
it's affordable and it's proven, companies could start using that
40:23
right away. I think there's sometimes these
40:27
things feel like, oh, they're so far away and then all of a
40:29
sudden it's like boom, it's ubiquitous.
40:32
MFA is a perfect example. I was looking back in an old
40:35
slide deck. It was like a 10 or 12 year old
40:38
slide deck. And it was something I put
40:40
together for a client and it said, you know, next, next down
40:45
the road you're going to be, you need to implement MFA.
40:50
And it's like you would never make that recommendation out if
40:53
a client didn't have MFA. It's like run for the X.
40:58
'S yeah, yeah, yeah, totally. I agree.
41:01
Yeah, I agree. Well, it's been great having you
41:03
on. It's been a fantastic discussion
41:06
and really appreciate you taking the time.
41:09
It would be wrong of me not to do our traditional end on
41:13
lighter note. And so I came up with a question
41:17
for you and here it goes. So you're from Cincinnati and I
41:22
thought of a couple of things that popped to my mind about
41:26
Cincinnati. And I want you to tell me if
41:28
they are, they should symbolize Cincinnati or if it should be
41:32
something else. OK All right.
41:34
So the first one is WKRP, the old TV show.
41:38
Absolutely. I think that is that is
41:41
quintessential Cincinnati. And are you people all over the
41:45
country and even off the across the world and they're like that.
41:48
What was that show W what they're like?
41:50
Less than. So yeah, it definitely is a it
41:53
definitely is a representation of Cincinnati.
41:56
Yeah, I I really like that show growing up.
41:58
OK, the the next one is great. American Ballpark.
42:03
So I, I am a Reds fan. I like the Reds.
42:08
I think the ballpark is, is a great place to go and it's right
42:11
in the city on the water. So I, I think it's, it's, it's
42:15
good. You know, the Reds have been,
42:17
you know, I would, I wouldn't say the ballpark, but probably
42:19
the Reds, right? I mean, they were one of the
42:21
first baseball teams in America. We still have a great opening
42:24
day parade. You know, every year it's like
42:28
the city shuts down, everybody takes off work.
42:30
So, you know, the ballpark and the Reds I think are are
42:34
definitely representative of Cincinnati.
42:37
So the last one I have I I think it might surprise you that I
42:39
even know this one as a Cincinnati thing, which is
42:43
spaghetti with chili over the top of it.
42:47
Yeah, yeah. Skyline Chiller.
42:48
It's like Cincinnati, Chile. There's a couple of different
42:50
franchises and, and there's a you're either a skyline person
42:55
or a Gold Star person and you know, they they fight about it.
42:58
But I, I've been in Cincinnati for a while now.
43:02
I never like got on that trend. So but you know, when people do
43:07
like people think of Cincinnati, they think of they think of
43:11
Cincinnati chili. So sure, sure, why not?
43:14
We'll take it. I've done a few times with the
43:16
chili at home and I just don't understand why people like it so
43:20
much so. Yeah, you could get it shipped
43:23
to your house now or, or so, you know, all over the country.
43:27
I won't be doing that, but so Denny, is there any other
43:31
Cincinnati hallmarks that you would throw into that list?
43:35
So I definitely think, you know, I, I definitely think it's
43:39
Oktoberfest. So I don't know that people know
43:42
this, but Cincinnati is, you know, a lot of German ancestry,
43:48
ancestry and a lot of, you know, a lot of architecture and things
43:52
like that. We even have a part of the city
43:54
called Over The Rhine, right? So reminiscent of of, of the old
43:59
country, but Oktoberfest. We have a Oktoberfest festival
44:05
every year in Cincinnati and it is the, it is the second largest
44:08
Oktoberfest in the world versus Munich.
44:12
So if you ever have a chance to look up Oktoberfest Cincinnati
44:15
and be in the city, you'll have a great time.
44:17
It's it's really fun. I'm sold.
44:20
Yeah, yeah. Yeah, well, fantastic.
44:23
It was great meeting you, Danina, and doing this show.
44:27
Our podcast can be found on YouTube, Identity Identity Pod
44:32
or I'm sorry, idacpodcast.tv. We're on LinkedIn, we're on
44:39
Twitter, we're on Mastodon. I think if you're a regular
44:43
listener to the show, you know all those links and how to find
44:46
us. It'll all be in the show notes.
44:48
And yeah, look forward to talking to you all in the next
44:52
one. For now, this Identity at the
44:54
Center podcast in Cincinnati. Bye, everyone.
45:03
You've been listening to Identity at the Center.
45:06
We hope you've enjoyed the show. Make sure to like, rate and
45:10
review, and we'll be back soon. But in the meantime, hit the
45:14
website at identity@thecenter.com.
45:18
See you next time on Identity at the Center.