Latest / CYBR.Signal / CISOs and Data Access

Transcript

CISOs and Data Access · CYBR.Signal

• 0:00
  SPEAKER_00: And hello everybody.
• 0:01
  SPEAKER_00: Happy Cyber Sunday.
• 0:02
  SPEAKER_00: Hope you're doing well.
• 0:03
  SPEAKER_00: So I saw a post on LinkedIn by a CISO, and I thought it was interesting.
• 0:11
  SPEAKER_00: And I can't find it now to link to it, which is another whole conversation about LinkedIn and modern social media platforms where you can't find a post that you've literally just clicked on and read.
• 0:22
  SPEAKER_00: Maybe I'm missing something, whatever.
• 0:24
  SPEAKER_00: Just can't find it.
• 0:25
  SPEAKER_00: I would link to it if I could.
• 0:26
  SPEAKER_00: And if I find it later, I'll edit this.
• 0:28
  SPEAKER_00: But essentially what it said was the CISO, and I get the gist of the post.
• 0:34
  SPEAKER_00: And what the CISO said was that their company had entrusted them to be a CISO and to be entrusted with that type of responsibility means that you, as an individual that is a CISO, has to have you have to have integrity.
• 0:52
  SPEAKER_00: And if you don't, then you don't belong in that kind of role.
• 0:54
  SPEAKER_00: 100% agree.
• 0:56
  SPEAKER_00: Integrity is a key component to being any kind of C level generally.
• 1:00
  SPEAKER_00: I mean, you know, you just need integrity.
• 1:03
  SPEAKER_00: But to be a CISO requires a special level of integrity because there's a lot of damage you can do to an organization.
• 1:10
  SPEAKER_00: But should that be the case, meaning, should you be able to do damage to an organization?
• 1:16
  SPEAKER_00: Because this individual specifically said that their company trusts them with access to the most secure areas and the most secure and valuable data in that organization.
• 1:32
  SPEAKER_00: So they had to have integrity.
• 1:33
  SPEAKER_00: And my thought immediately was like, okay, I get again, I get the gist of what you're trying to say from an integrity standpoint.
• 1:41
  SPEAKER_00: But as a CISO, are you the owner of the company's most secure data, the data that needs to be the most secure, the most valuable data, are you the owner of the most valuable assets, the most valuable systems?
• 2:01
  SPEAKER_00: I would argue that unless your company is a like a consultancy and you are the organ, you're one of the people or the person who's in charge of doing all of that work for your customers, like cybersecurity consultancy type stuff, then you should not be the owner of any of those systems.
• 2:24
  SPEAKER_00: That's not your role.
• 2:26
  SPEAKER_00: Because you're not the owner, you should not have access, direct access to those things.
• 2:34
  SPEAKER_00: And this individual did not say, and again, I and if somebody knows this post and has seen it and and thinks it's great, but I don't have anything against the post in general from what they're saying about.
• 2:45
  SPEAKER_00: And please link it if you can find it.
• 2:48
  SPEAKER_00: But if I remember correctly, what they were saying is not that I can do damage specifically because I have control over systems that control those valuable assets.
• 3:00
  SPEAKER_00: It was I have access to those assets and to that data, and therefore my company trusts me to have that, so I've got to have integrity.
• 3:11
  SPEAKER_00: And again, I don't think it's being pedantic.
• 3:15
  SPEAKER_00: You should not have access to those systems and to that data unless you were the owner of it.
• 3:23
  SPEAKER_00: Why would you?
• 3:24
  SPEAKER_00: So, yes, it's important for you to have integrity if you're a CISO.
• 3:29
  SPEAKER_00: It's important because you can do damage to an organization because you have control potentially of systems that are controlling access to the valuable data.
• 3:41
  SPEAKER_00: There are things you can do, but you should be designing the system as this person, not in the way this person at least phrased it and framed it in their post, which is you should not have access, direct access to the most valuable assets and systems in an environment because you're not the owner of them.
• 4:02
  SPEAKER_00: If your system is designed in such a way as the CISO or any C level who is not a direct owner of those, has access and could do damage directly to those systems and to that data, then you've designed your system wrong.
• 4:21
  SPEAKER_00: And it doesn't matter how much integrity you have, you should not be designing them that way.
• 4:27
  SPEAKER_00: I, as a CISO, do not want to have access to that because I can be held liable if something happens to those systems or that data, and I was on the log and I've been shown to access them.
• 4:40
  SPEAKER_00: I don't want that.
• 4:41
  SPEAKER_00: So, again, to sum up, I understand the gist of the post that you should have integrity if you're a CISO, 100% agree.
• 4:49
  SPEAKER_00: I do not agree with how it was phrased and how it was framed that this CISO had direct access to the most valuable assets and the most valuable data within their organization.
• 5:01
  SPEAKER_00: And I mean, that's that's just not the way the system should be designed.
• 5:04
  SPEAKER_00: And you, as the CISO, should know that and should redesign your system if that's the way it actually is.
• 5:10
  SPEAKER_00: So, anyway, let me know what you think.
• 5:12
  SPEAKER_00: Talk to you next time.