Latest / Cyber Go-To-Market Talk: The Cybersecurity Podcast About Cyber Sales, Marketing & Revenue Growth / 164: Two CISOs discuss the conviction of ex-Uber CISO, Joe Sullivan

Transcript

164: Two CISOs discuss the conviction of ex-Uber CISO, Joe Sullivan · Cyber Go-To-Market Talk: The Cybersecurity Podcast About Cyber Sales, Marketing & Revenue Growth

• 0:44
  SPEAKER_02: Welcome to the Sales Bluebird podcast, which exists because at cybersecurity companies it's hard to get to a repeatable sales process and then scale the business.
• 0:54
  SPEAKER_02: Sales Bluebird gives you tips, tricks, experiences, examples, ideas, and inspiration from people who know a thing or ten about building great cybersecurity companies.
• 1:04
  SPEAKER_02: I am your host, Andrew Monahan, and today we have a very different type of episode.
• 1:08
  SPEAKER_02: I've got two guests on the podcast with us this week.
• 1:13
  SPEAKER_02: First of all is uh Mike Travett.
• 1:15
  SPEAKER_02: Mike's the CISO at Passport.
• 1:16
  SPEAKER_02: Mike, do you want to say hi?
• 1:18
  SPEAKER_00: Hey everybody.
• 1:19
  SPEAKER_02: Mike is a multi-time CISO advisor to startups and works with VCs as well, uh, looking to invest in some uh cybersecurity early stage startups.
• 1:29
  SPEAKER_02: And he is also the founder at Return on Security, a great resource about the business and funding and trends going on inside our world of cyber.
• 1:40
  SPEAKER_02: Also joining us today is Ben Halpert.
• 1:42
  SPEAKER_02: Ben is a CISO at Groupon.
• 1:44
  SPEAKER_02: Uh Ben, do you want to say hi?
• 1:46
  SPEAKER_01: Hello, hello.
• 1:48
  SPEAKER_02: Ah, good.
• 1:49
  SPEAKER_02: And uh Ben is also a multi-time CISO advisor to startups, and he's currently also the founder of Savvy Savvy Cyber Kids, which is all about educating our children about the do's and don'ts and good things and bad things about being online.
• 2:05
  SPEAKER_02: Uh so welcome both of you to the episode.
• 2:09
  SPEAKER_02: Topic today is a little bit different.
• 2:11
  SPEAKER_02: So on Wednesday evening, the news came out of California, out of San Francisco, that the former Uber CISO, Joe Sullivan, was convicted on charges stemming from a cover-up of a 2016 data breach at Uber.
• 2:31
  SPEAKER_02: Uh the official charges were obstruction of proceedings of the FTC and misprision, I think that's how you pronounce it, of felony.
• 2:39
  SPEAKER_02: And for those of you like me that have no idea what that means, it's actually when a crime occurs that someone knows a felony has been committed but fails to inform the authorities about it.
• 2:52
  SPEAKER_02: And the U.S.
• 2:53
  SPEAKER_02: attorney in San Francisco, Stephanie Hines, said Sullivan affirmatively worked to hide the data breach from the Federal Trade Commission and took steps to prevent the hackers from being caught.
• 3:04
  SPEAKER_02: We will not tolerate concealment of important information from the public by corporate executives more interested in protecting their reputation and that of their employers than in protecting users.
• 3:17
  SPEAKER_02: Where such conduct violates the federal law, it will be prosecuted.
• 3:23
  SPEAKER_02: He hasn't been sentenced, uh, but it looks like based on the reporting from the case, he's facing possibly a maximum of eight years in prison, um, split between the two uh charges.
• 3:36
  SPEAKER_02: And somewhat interestingly, I think, is that Sullivan actually once worked as a prosecutor for the same district, uh the Northern Jurist of California, working on these types of cases.
• 3:47
  SPEAKER_02: Um the details that that I've got are really only from the reporting, so take take from that what you will.
• 3:53
  SPEAKER_02: Um and I think it stems from the idea that Uber wanted to characterize the event as a bug bounty event and not a breach.
• 4:05
  SPEAKER_02: Um he actually paid the hackers$100,000.
• 4:08
  SPEAKER_02: The usual cap on bug bounty payments was just$10,000.
• 4:13
  SPEAKER_02: And he had them sign an NDA as part of the process.
• 4:17
  SPEAKER_02: One of the things that came out in the reporting was that there were edits to the NDA.
• 4:22
  SPEAKER_02: I wasn't quite clear whether it was after the fact or the standard maybe bug bounty NDA had been edited before it was sent.
• 4:28
  SPEAKER_02: I'm not quite sure, but that seems to be a key part of this.
• 4:32
  SPEAKER_02: Um, what's interesting is it doesn't seem to have been a cover-up internally at Uber at the time.
• 4:38
  SPEAKER_02: Uh Travis uh Kalinick was the CEO and he knew he was informed, as was a lawyer, but not the general counsel.
• 4:46
  SPEAKER_02: So a lawyer was involved.
• 4:48
  SPEAKER_02: Uh and Kalanak was the one that actually approved the strategy of giving the$100,000 payment and getting them to sign the NDA.
• 4:56
  SPEAKER_02: And uh I'll finally say that if I could read the tea leaves on the community, the cybersecurity community, the commentary is going on over the last day and a bit.
• 5:05
  SPEAKER_02: Um, I might unfairly put it in two camps.
• 5:08
  SPEAKER_02: One is a bit of outrage about the idea of a CISO being scapegoated, uh, complete lack of accountability from the other executives who were involved.
• 5:19
  SPEAKER_02: Why is this the person that's being convicted and charged and not the other people that knew about it and authorized it?
• 5:24
  SPEAKER_02: Um, and then what does this mean for security when you know one of the downsides to do your job uh with the support of your company is you end up going to jail.
• 5:33
  SPEAKER_02: And the other uh side of this that I've seen a little bit about is look, the dude covered it up from federal authorities.
• 5:40
  SPEAKER_02: What do you expect?
• 5:41
  SPEAKER_02: So, what's going on?
• 5:43
  SPEAKER_02: Uh big news in our world.
• 5:44
  SPEAKER_02: Uh, Ben, I'll throw it over to you first of all.
• 5:47
  SPEAKER_02: What's your thoughts, first of all, as you as the news came out and you got the chance to really digest this?
• 5:52
  SPEAKER_01: Yeah, so the first thing I thought about was what it means for all currently sitting CISOs and all CISOs in the future.
• 6:00
  SPEAKER_01: Um, you know, that means more of a microscope, more of a strong hand when it comes to uh breach notification, uh, potentially new legislation that's gonna come down.
• 6:12
  SPEAKER_01: And so that's what I thought of initially.
• 6:15
  SPEAKER_01: I don't know Joe Sullivan personally, I uh obviously don't know anything beyond what I've read in the Wall Street Journal, New York Times, etc., um, about the case.
• 6:23
  SPEAKER_01: I haven't seen you know the actual evidence or read the actual testimony.
• 6:27
  SPEAKER_01: Um, but one of the things that that caught my eye was that the GC wasn't notified.
• 6:34
  SPEAKER_01: And so that to me was very surprising.
• 6:38
  SPEAKER_01: In you know, my in my career, I've always made it a point that the GC and I are like best friends because there's so many things that I run by GC as well as other attorneys, uh, based on what's happening.
• 6:53
  SPEAKER_01: And so that's just something that I've learned over the years.
• 6:56
  SPEAKER_01: And actually, you know, I kind of put uh security, legal, and human resources like in a bucket together where you have to be have really, really close relationships with all three of those organizations because you're always dealing with something, a potential something, whether it's a it's a potential event, a potential incident, um, uh potent an investigation on potential claims of some sort.
• 7:21
  SPEAKER_01: So it's it's part of what we do.
• 7:23
  SPEAKER_01: Um, you know, and so that that was a little surprising to me.
• 7:26
  SPEAKER_01: I don't know, Mike, uh, what your thoughts are on that.
• 7:28
  SPEAKER_02: Yeah, Mike, did you catch up uh catch that as well?
• 7:32
  SPEAKER_00: I did.
• 7:32
  SPEAKER_00: You know, and uh I'm in a similar situation as Ben.
• 7:35
  SPEAKER_00: You know, I don't I didn't read any of the testimony notes, only know what's been publicly released.
• 7:39
  SPEAKER_00: Um, I I have seen the outrage uh on both sides of the arguments, whether like, hey, I can't believe this happened, and versus like, hey, no, you know, duh because he didn't uh tell the appropriate authorities this is what you get.
• 7:52
  SPEAKER_00: Um, I'm sure the truth lies somewhere in the middle of all those.
• 7:56
  SPEAKER_00: Um, you know, my I had similar reactions to begin with, is like, man, this means a lot less people are gonna want to go in this field.
• 8:03
  SPEAKER_00: Um, good because now this field carries with it a price tag, or could carry a price tag with it that no other field carries in the civilian world.
• 8:12
  SPEAKER_00: Um, so it's this it's uh equivalent of like hazard uh duty on um something like this, like one wrong mistake or wrong one wrong set of actions, even if they're uh done in good intent or even if they're uh had the right parties involved, it could lead to a very real negative outcome outside of your job.
• 8:31
  SPEAKER_00: Um but obviously it's easy to say that from an abstract standpoint without seeing the real facts on the ground.
• 8:38
  SPEAKER_00: Um and looking at the at what the prosecution focused on, it seemed like they were really just focused on like um the lack of um notification to these governing bodies.
• 8:50
  SPEAKER_00: I think that was probably the biggest uh biggest issue they had.
• 8:53
  SPEAKER_02: Let me ask you then, because I'm I'm you know somewhat informed, but not nearly as informed as you guys are.
• 8:59
  SPEAKER_02: So something like that, let's put ourselves different company, I don't know, made up company, San Jose rather than San Francisco, and you're sitting there as a CISO and you're you're you're contacted by some ransomware group and they're asking for money in exchange for your data back.
• 9:13
  SPEAKER_02: What is your actual obligation to tell anyone outside the company?
• 9:17
  SPEAKER_02: Is there legal obligations?
• 9:19
  SPEAKER_02: Is it the right thing to do?
• 9:20
  SPEAKER_02: What's your view on that?
• 9:24
  SPEAKER_00: Uh I'll I'll take a stab at it.
• 9:26
  SPEAKER_00: Um, you know, I'd say it obviously comes down to, you know, who are you governed by and what uh what state and federal authorities are you beholden to in that regard?
• 9:36
  SPEAKER_00: So uh one, you have to determine is it real?
• 9:39
  SPEAKER_00: Um, and like how can you validate that it's real from the people who are contacting you?
• 9:44
  SPEAKER_00: Um after you have that um verification that it is real or real enough, then I think you have to kick off immediately go back to what Ben said.
• 9:52
  SPEAKER_00: Like get back to your uh your legal partners very, very quickly internally and start talking with their counsel and then in any retained counsel they have externally to say, what one, let's pour through all the contracts we have with our customers and third parties, and then find out specifically who we have to uh contact if it meets a certain threshold.
• 10:11
  SPEAKER_00: Um I think um you know that there are there are different levels of thresholds in terms of like record count or types of data per state uh or per contract that require you then to have to take certain notification processes or even in some cases pay damages for um like credit monitoring and the like.
• 10:30
  SPEAKER_00: Um but yeah, it's really gonna be a fact-finding mission once you determine it is actually a legitimate issue to see who you got to notify.
• 10:38
  SPEAKER_01: So I'd add to that that the first time or the second time or the 15th or the 20th time you get a note like that or a notification like that, because all of us have gotten these kind of notifications at the companies that we're with, shouldn't be that first time shouldn't be when you're like, okay, what do I do now?
• 10:55
  SPEAKER_01: So you should have a documented process, you should have it written written down.
• 10:59
  SPEAKER_01: It's part of normal incident response, right?
• 11:02
  SPEAKER_01: So what's the playbook?
• 11:04
  SPEAKER_01: Have you practiced this playbook?
• 11:06
  SPEAKER_01: This is very, very common.
• 11:09
  SPEAKER_01: And so, you know, having you know, going through a tabletop exercise at least to figure out who are the right people, who should be on this, who do we communicate with, so that in the end, it's not a guesswork.
• 11:21
  SPEAKER_01: Like it maybe there's a reason the GC was left out.
• 11:24
  SPEAKER_01: Maybe that was part of a documented response plan that someone on the legal team gets looped in, but not the GC.
• 11:30
  SPEAKER_01: Again, we don't know.
• 11:32
  SPEAKER_01: Um, where does the decision making happen, right?
• 11:36
  SPEAKER_01: Is it the CISO's job to make a decision like that on behalf of the company?
• 11:40
  SPEAKER_01: Or is it a CISO's job to advise the CEO and give his opinion to the GC and give his opinion about what's happening to the CEO and let them make the GC from the risk-based decision side, from the legal perspective, and the CEO for the one ultimately responsible for the continuity of business, right?
• 12:03
  SPEAKER_01: To make sure that business survives and thrives.
• 12:06
  SPEAKER_01: Is it really a CISO's job to do that, or is it really more to advise and to give opinions and to give options, but not the ultimate decision maker?
• 12:14
  SPEAKER_01: So I'd be interested to see what comes out, you know, in that kind of aspect going forward.
• 12:21
  SPEAKER_02: But Ben, it seems to me that uh, you know, these ransomware attacks, if you believe the news, happen every day of the week to multiple companies all the time.
• 12:30
  SPEAKER_02: Um, and as far as I can tell, you know, they their strategy is not to ask for a shit ton of money.
• 12:36
  SPEAKER_02: So that's actually quite an easy decision for the company to go, yeah, we'll we'll pay them 20K, 50K, 100k, whatever it might be, right?
• 12:41
  SPEAKER_02: And it's not such a big deal.
• 12:43
  SPEAKER_02: So this is happening all the time.
• 12:44
  SPEAKER_02: Why?
• 12:45
  SPEAKER_02: And I can't imagine that the FTC is getting notified of every single incident that ever happens in in the US.
• 12:52
  SPEAKER_02: Um am I right?
• 12:54
  SPEAKER_02: Or is this is this an exception to that, or are people just doing it and the FTC are not being told?
• 12:59
  SPEAKER_01: So so, based on what I've read, um this one is a little bit of an outlier because there was already a data breach years prior at Uber.
• 13:10
  SPEAKER_01: And because of that, they are now under obligation as a company to report to the FTC, if to FTC, if and when this happens again.
• 13:19
  SPEAKER_01: And so most companies that haven't been through a breach that have been found potentially negligent in the past don't have that requirement.
• 13:29
  SPEAKER_01: Right?
• 13:29
  SPEAKER_01: If they're in a certain industry, they do.
• 13:31
  SPEAKER_01: But from generally, most companies don't have the obligation to actually notify the FTC.
• 13:43
  SPEAKER_02: Then we've you might be able to hear us, but we can't hear you anymore.
• 13:47
  SPEAKER_02: I think you're back now.
• 13:48
  SPEAKER_02: Can we hear you?
• 13:49
  SPEAKER_01: Oh, I'm back if you can hear me.
• 13:51
  SPEAKER_02: Yeah, yeah, we can hear you.
• 13:53
  SPEAKER_01: Okay.
• 13:54
  SPEAKER_02: Um so I'll just I'll just cut that bit out, that last bit out at the right point.
• 13:58
  SPEAKER_02: And Mike, I'll come on to you with a question right now.
• 14:01
  SPEAKER_02: Um so, Mike, when you think about what we know about the process they went through, I'm wondering as the CISO at Uber, what would he gain from you know somehow trying to do something a little bit differently?
• 14:16
  SPEAKER_02: Right?
• 14:16
  SPEAKER_02: Is he is he just trying to protect the company?
• 14:19
  SPEAKER_02: Is there something else that that might be in it for him?
• 14:21
  SPEAKER_02: I I was trying to understand his motivation for maybe uh let's say blurring the lines a little bit.
• 14:27
  SPEAKER_00: Yeah, I I wondered that as well.
• 14:30
  SPEAKER_00: Um, you know, I can't see it it being like a personal cover-up.
• 14:33
  SPEAKER_00: I can't see it being trying to save reputation uh for himself personally.
• 14:37
  SPEAKER_00: And the the job of the CISO often is to bring forth that uncomfortable picture of risk, uh, even if it's actualized in this case.
• 14:45
  SPEAKER_00: Um, so I I think um I I'm not sure that were the that was the motivations.
• 14:50
  SPEAKER_00: Like I do know that we lived in a different time frame back in in 2016, and especially since they already had a prior breach.
• 14:58
  SPEAKER_00: Um, you know, as the years have gone on since then, breaches have not only been exponentially uh performed all throughout the world, but the public seems to care a whole lot less about it in general.
• 15:09
  SPEAKER_00: Uh the public sentiment of it is.
• 15:11
  SPEAKER_00: Um, in fact, you can even see direct correlations.
• 15:14
  SPEAKER_00: So after companies get breached, if they're publicly traded, their stocks end up trading up after hours.
• 15:19
  SPEAKER_00: Uh and it's almost like a sigh of relief, like, okay, we got that out of the way.
• 15:23
  SPEAKER_00: Um, on to the next thing.
• 15:25
  SPEAKER_00: Um it's a really strange uh phenomenon.
• 15:27
  SPEAKER_00: So I think uh, I mean, I'm sure there was a lot of like panic in terms of, hey, this is this could be extremely damaging for our company.
• 15:35
  SPEAKER_00: Uh, and then obviously his livelihood and everyone else's livelihood at the company.
• 15:39
  SPEAKER_00: Um, I think this is the time they were pretty in stark competition with uh with Lyft, um especially coming off the heels of the previous CEO who had some very tumultuous uh headlines um and the culture they created.
• 15:51
  SPEAKER_00: So there's there's probably a lot of uh gray wrapped up in that in general, but um it didn't seem like it was to to cover up anything or to to do any kind of wrongdoing just from the outside.
• 16:03
  SPEAKER_02: Yeah, and it seems like in the timeline that they were talking about that uh when the new CEO came in, uh Dara, he could have find out more by the details.
• 16:11
  SPEAKER_02: He was he felt like he was initially misled, I think he testified, and then he let uh Joe go.
• 16:16
  SPEAKER_02: But it all all happened under the previous CEO, Travis uh Cowanick, because he said has a certain reputation uh about how he ran the company.
• 16:25
  SPEAKER_02: But then, you know, going back to you on this, um, you know, it seems like he he he talked to, except for the GC, he talked to the CEO, is he established in the evidence that he got the sign-off that this was the strategy to go by, and yet somehow he's the one being left out to dry on this.
• 16:41
  SPEAKER_02: Um doesn't seem that's how his corporate governance should work.
• 16:46
  SPEAKER_01: Yeah, no, uh, I agree with that statement completely.
• 16:49
  SPEAKER_01: Um, you know, if if he was given direction from the CEO to go, you know, it like maybe Joe presented two options, three options, four options on how to go forward.
• 17:00
  SPEAKER_01: And the former CEO said, let's go this route.
• 17:03
  SPEAKER_01: Um, you know, I'm I'm I didn't hear about that, if that came out during the trial or not.
• 17:09
  SPEAKER_01: Super curious if something like that comes out in the end.
• 17:12
  SPEAKER_01: Um, again, was Joe the ultimate decision maker that made the choice in a silo and just said, hey, this is what we're gonna do, FYI?
• 17:20
  SPEAKER_01: You know, or was there more of a governance structure in place, which just based on this, it sounds like there wasn't, right?
• 17:26
  SPEAKER_01: When you have other stakeholders involved in the conversation so they can you know provide opinion and expertise in a certain area for a company how to move forward.
• 17:37
  SPEAKER_02: Well, let's draw a line under what happened and then let's think about what should happen going forward.
• 17:42
  SPEAKER_02: Um and Ben, you said that was your first reaction was what does this mean, right?
• 17:46
  SPEAKER_02: What do we have to change?
• 17:47
  SPEAKER_01: Microscope under.
• 17:49
  SPEAKER_02: Uh what's your initial conclusions about you know what you see?
• 17:53
  SPEAKER_02: And you said microscope, you talked about perhaps new legislation.
• 17:56
  SPEAKER_02: What do you think is going to happen?
• 17:59
  SPEAKER_01: Yeah, so you know, there's already legislation and something that you know we took a look at um that has recently come out of India, where you actually have now a very short time window when you need to notify the Indian authorities of a potential breach of constituent data.
• 18:20
  SPEAKER_01: And so it's no longer like after the fact when you've made that determination, but it's letting a government entity know in some country that hey, we're you know investigating potentially something that could be something or could not be something, but we're letting you know so we stay in compliance.
• 18:38
  SPEAKER_01: So I think more of that will probably end up being the end result of what we see as opposed to after the fact, so that the you know the politicians can say they're doing more to help protect the people's information.
• 18:54
  SPEAKER_01: Whether they are or not's a completely different story, but that's the optics they go for.
• 19:00
  SPEAKER_02: What would you say, Mike?
• 19:02
  SPEAKER_00: Yeah, I'd agree with that too.
• 19:04
  SPEAKER_00: I think there'll be a tighter squeeze on um on people who lead security functions at companies.
• 19:09
  SPEAKER_00: Um you've already kind of seen this with uh squeeze on CEOs in Capitol Hill, of them pushing them, saying, hey, CEOs can be personally fined and accountable uh for data breaches, um, even though often they're typically very far removed from the day-to-day operations of a security program, as they should be.
• 19:27
  SPEAKER_00: They have uh they have other things to focus on.
• 19:29
  SPEAKER_00: Um, but I think we'll see an overcorrection on that point.
• 19:32
  SPEAKER_00: Um, I think on the security side, I think we'll we'll see a lot more people be extremely guarded in terms of like day-to-day activities, like document everything and email, uh a lot more pro protesting, a lot more, I don't agree with this in writing.
• 19:47
  SPEAKER_00: Uh yeah, a lot more, I told you so.
• 19:50
  SPEAKER_00: Um I I think honestly it's it's gonna create some some negative um repercussions and culture in certain places just because it's gonna be adversarial uh in nature, because everyone's gonna be worried.
• 20:00
  SPEAKER_00: Like, is the the notification or email I do or don't send or the meeting uh I do or don't have gonna be the last one or the one that puts me over into you know criminal activity?
• 20:10
  SPEAKER_00: Um and that's not a good uh area to focus on when there's uh there's a lot more like real work to be done.
• 20:17
  SPEAKER_00: Um so I I think um I think that's pretty common though, the way especially our our our modern society works is event happens, regulation comes in with too strong of a hand uh to force some activities, and then uh some maybe uh consequences come out of that that aren't as intended.
• 20:34
  SPEAKER_00: Um and I think that could be uh happening here.
• 20:38
  SPEAKER_02: And Ben, when you said you looked at the these laws out of India, is is the is there some sort of grindswell that's the sort of thing that we should have over here, or is it just something that you guys were looking at because US operations over there?
• 20:49
  SPEAKER_01: No, it you know, for the latter, definitely.
• 20:51
  SPEAKER_01: So um, but I think that's probably something that we're gonna see.
• 20:56
  SPEAKER_01: We're gonna see more heavy handed um when it comes to how companies deal with potential incidents.
• 21:04
  SPEAKER_02: I I I I did latch onto the word potential incidents because uh potential covers a lot of different things, right?
• 21:12
  SPEAKER_02: As you said, I think, Mike, at the start, you know, your first thing is you've got to determine is this even real?
• 21:16
  SPEAKER_02: Um so at what point does you do you say like this is now a potential incident as opposed to uh a whatever before that or a whatever after that?
• 21:25
  SPEAKER_02: Kind of poses an interesting question about you inundate the uh the Northern California district with a whole bunch of potential incidents and see what they do, or or how do you kind of manage that process?
• 21:39
  SPEAKER_02: Um I think it puts an interesting onus if there isn't already on on the notification side, right?
• 21:46
  SPEAKER_02: That's where you would get latched onto, I think both of you right there.
• 21:48
  SPEAKER_02: The fact that we have breaches and we have to deal with them is you know, that's gonna not change, but it's really how we deal with notification and make sure the right authorities are involved.
• 21:57
  SPEAKER_02: Imagine if I was a CISO, I'd be erring on the side of over over without any laws, even I might be over um notifying and informing as opposed to under-notifying and informing.
• 22:09
  SPEAKER_01: So the uh the potential issue with over notifying is that um we now have the potential, again, sorry for using that word again, but to actually overload the authorities, right?
• 22:21
  SPEAKER_01: So they don't have enough staff, right?
• 22:24
  SPEAKER_01: The FBI doesn't have enough staff if we're notifying on every single potential uh you know international incident or you know uh cross state line incident.
• 22:32
  SPEAKER_01: That may be occurring, they can't deal with that.
• 22:34
  SPEAKER_01: So, how would they even go through and figure out what's legitimate that they should should work on?
• 22:40
  SPEAKER_01: And plus, once you do notify, you actually are more hands-off at that point, right?
• 22:45
  SPEAKER_01: They come in and they, if they make the determination that, yeah, it's going to be a federal case, you know, they're in charge.
• 22:52
  SPEAKER_01: And your teams provide support as asked, but they are in charge.
• 22:56
  SPEAKER_01: So it's it's very different.
• 22:58
  SPEAKER_01: Um, but that's but that's why companies need to have a mature incident response process so that that triage process from initial contact of, hey, we just breached your site, or we just um, you know, breached your S3 bucket, or we just found X, whatever it may be, um, you know, you should have that that triage process nailed down so that everyone knows what they're doing, and you can make a quick determination whether they're full of it or not.
• 23:27
  SPEAKER_02: And just so I know, um, notification of the authorities is not the same as notifying the public, right?
• 23:33
  SPEAKER_02: The two are not one does not mean the other one has to happen.
• 23:36
  SPEAKER_02: Is that correct?
• 23:38
  SPEAKER_00: Yeah, that's that's typically true.
• 23:39
  SPEAKER_00: Um, it doesn't mean that once you notify a public like uh another authority, it doesn't mean they won't also notify the public.
• 23:46
  SPEAKER_00: Um it really depends on the industry you're in.
• 23:48
  SPEAKER_00: Uh some of this stuff is common knowledge and it'll be posted like government websites, um, just more of as a uh as a communication.
• 23:54
  SPEAKER_00: Uh, but no, it doesn't mean that like the whole world knows.
• 23:57
  SPEAKER_00: Uh but you know that that aspect of public communication plays into the whole crisis management aspect of it as well.
• 24:03
  SPEAKER_00: And this typically that's uh should be a very big part of your incident response process is who's going to make the comment?
• 24:09
  SPEAKER_00: Like who's going to talk to the media if that's the case?
• 24:12
  SPEAKER_00: Who's going to publish the post on the website if you're going to have one?
• 24:15
  SPEAKER_00: Um what messaging will you send your customers that may or may not be public, but expect it to be shared.
• 24:21
  SPEAKER_00: Um so all that has to be um either pre pre-written or or canned in such a way that uh you guys can make decisions on when and if you you pull the communications trigger externally.
• 24:33
  SPEAKER_02: And I imagine there's the expectation of lawsuits gonna flood in after that, right?
• 24:36
  SPEAKER_02: Which is why you gotta word it carefully and be somewhat careful about who knows.
• 24:40
  SPEAKER_00: Yeah, it is.
• 24:41
  SPEAKER_00: And I'll oh sorry, go ahead, Ben.
• 24:44
  SPEAKER_01: Oh no, I was just gonna say, just to expand on that one point that you said, Mike, that when you do notify an agency, it becomes public eventually.
• 24:54
  SPEAKER_01: So they won't make a public announcement about it, but it will fall under freedom of information requests.
• 25:00
  SPEAKER_01: Some states publish a listing of companies that have notified them.
• 25:05
  SPEAKER_01: So if you're going to communicate to an agency, you should also be working with communication and public relations teams because you do need to put out something and pre-proactive as well.
• 25:14
  SPEAKER_01: Because if it looks like you're hiding something, then it's even worse for company reputation.
• 25:18
  SPEAKER_02: I'm going to wrap up with one uh question, comment, I guess.
• 25:21
  SPEAKER_02: Um, one of the things that seems to be well known, the time that the culture at Uber was, I don't know, pretty toxic, let's say.
• 25:29
  SPEAKER_02: There's a lot of um things going on.
• 25:31
  SPEAKER_02: You I've I hear people talking commentary-wise about that that era in Uber is one where you know a lot of different subgroups in the company were marginalized and treated pretty pretty badly.
• 25:43
  SPEAKER_02: I wonder what it says about, you know, if you're going in for a job at a CISO, how important it is to screen for culture.
• 25:49
  SPEAKER_02: Because it's, you know, again, it might be shitty to work there, but you know, people can be put up with that for various reasons.
• 25:55
  SPEAKER_02: But uh if the shittiness ends up you go to jail, that's uh that's not something worth putting up with, right?
• 26:01
  SPEAKER_00: Yeah.
• 26:03
  SPEAKER_00: I I totally agree.
• 26:04
  SPEAKER_00: And I I think um it's hard to know how how thorough their you know the hiring practices were, but uh from all accounts, yeah, you know, from the marginalized groups, it uh it wasn't very good.
• 26:14
  SPEAKER_00: And then if it was, it wasn't good when they got there, um, which is yeah, it needs to be good on the entry point and while you're there.
• 26:21
  SPEAKER_00: Um you know I think uh I think it will make it some things harder um to hire for across all uh fields.
• 26:29
  SPEAKER_00: Um, because if this is part of like a culture, if you if you see yourself in a in a highly regulated field um that may have these overreaching like consequences, um the talent pool just may dry up for that space.
• 26:41
  SPEAKER_00: It may be a lot harder to find people willing to go that far um just for a job.
• 26:47
  SPEAKER_02: Yeah, I think if people feel like you know he's being wronged.
• 26:51
  SPEAKER_02: Um if clearly there was some you know massive crime and all the rest of it, I think people get that.
• 26:57
  SPEAKER_02: But if there is this underbelly of feeling in the community that he's being totally wronged and scapegoated and all the rest of it, I agree, right?
• 27:04
  SPEAKER_02: You kind of you don't want to end up in that same situation.
• 27:06
  SPEAKER_02: Um so it'll be interesting to see what happens at sentencing and what else comes out in the wash uh between now and then and maybe afterwards.
• 27:13
  SPEAKER_01: So, Andrew, I wanted to add um to your point about culture.
• 27:17
  SPEAKER_01: And so my suggestion would be to any security professional that's out there, even if they're not going for a CISO position, but any position within a security organization, part of your questions that you should prepare before your interview should relate to culture, should relate to, hey, can you tell me, do you have a documented incident response plan?
• 27:39
  SPEAKER_01: Who is, you know, who are the the job roles that are actually listed that participate?
• 27:45
  SPEAKER_01: Is there a risk management governance committee?
• 27:48
  SPEAKER_01: You know, how are decisions made when it broadly affects the organization?
• 27:53
  SPEAKER_01: So you could just ask a few questions and and see if you get like a stare back, you know, or if you actually get um a pretty decent response to, you know, just do a really short, you know, quick test of uh of security culture.
• 28:06
  SPEAKER_02: If the answer is, yeah, that's why you're here to create all that, that might not be what you want to walk into, right?
• 28:10
  SPEAKER_02: In 2022.
• 28:12
  SPEAKER_01: It might be an opportunity for you to build something out that's that's really rewarding for yourself.
• 28:16
  SPEAKER_02: Get ready for that.
• 28:18
  SPEAKER_01: If you get the right support to do it the right way.
• 28:22
  SPEAKER_02: Well, listen, uh gents, with that, uh Mike, thanks for joining.
• 28:25
  SPEAKER_02: Ben, thanks for joining.
• 28:26
  SPEAKER_02: Uh really good discussion, very timely.
• 28:28
  SPEAKER_02: We're watching this over the coming weeks and see what happens.