Latest / The Diary of a CFO / Why Culture Is Your Biggest Cybersecurity Risk, with Dutch Schwartz

Transcript

Why Culture Is Your Biggest Cybersecurity Risk, with Dutch Schwartz · The Diary of a CFO

0:00
I'm an unhappy, disengaged employee. I'm unhappy.
0:03
I'm not engaged. I'm not really dialed into our
0:05
mission. It's much more likely then that I'm
0:07
not going to follow any of the process or procedure.
0:09
Companies with poor culture are three times more
0:11
likely to have a breach. Today's guest is Dutch
0:14
Schwartz, vice president of cloud services at
0:17
Sci Channel, a leading cybersecurity provider.
0:20
He previously served as a senior security advisor
0:22
at Raytheon and AWS. Dutch has led security strategy
0:26
and customer engagement for 50 global enterprises
0:29
across industries like aviation, fintech, media,
0:33
software, and gaming. Today, he partners with
0:36
Fortune 100 CSOs to build cybersecurity strategies
0:39
that deliver real business value. What would
0:42
you say is one cybersecurity mistake you see
0:45
big companies, small companies make over and
0:48
over again? There's been really tragic examples
0:50
of where somebody received AI simulated voice
0:54
memo. People have transferred money and not insignificant,
0:56
like $25 million in one instance where they transferred
0:59
money because they believed it was their CEO.
1:02
That one voice memo, even if it appears to be
1:04
your CFO or CEO, that is not enough. There has
1:07
to be a process of checks, right? If cybersecurity
1:10
is only thought as this group of two people,
1:12
20 people, 200 people over here, then the implication
1:15
is there's a bias that happens unintentionally
1:18
in people's brain, where they go, oh, well, that's
1:19
not my job. I don't have a piece of this. I promise
1:21
you you do, because that's where most of the
1:23
risk lies. It's an unintended risk, because the
1:27
criminals know this. They understand human behavior
1:29
very well. You need to build a culture of security.
1:32
What do any CFOs at any size company know about
1:35
cybersecurity? Yeah, there's probably two things.
1:40
Welcome back to the Diary of a CFO podcast, the
1:43
podcast where finance leaders share the lessons,
1:45
wins, and challenges that shape their careers,
1:47
as well as their organizations. I'm your host,
1:50
Waseea Kamon, and today I'm super delighted to
1:53
have with me, Dutch Schwartz. Welcome to the
1:56
show, Dutch. Waseea, thank you so much for having
1:58
me. I know we're recording it today, so you might
2:00
be listening to us at a later date, but it's
2:02
Juneteenth, so I just wanted to... note that
2:05
and reflect on what a cool day this is to be
2:08
here and sharing it with you. So thanks for the
2:09
invitation. I appreciate it. Of course, the pleasure
2:12
is mine. I really wanted to start with your story
2:15
and how did you end up in the cybersecurity space
2:18
in the first place and any unexpected twist along
2:21
the way? Yeah, no, it's almost all twists. So
2:24
I started my career as a military officer. So
2:26
I was an infantry officer in the army. It doesn't
2:29
seem to have any kind of obvious connection to
2:31
what I do today. So at one point in my career,
2:34
I actually put up a poll right on LinkedIn and
2:36
said, hey, how did you get into cybersecurity?
2:39
It used to be called information security. And
2:41
the favorite answer was pull up a chair. So so
2:46
it's actually very common. Yeah, it was like
2:48
46%. It's really common, probably more so it's
2:52
a little bit of a timeline discussion, right?
2:54
So probably maybe today, if you're coming straight
2:56
out of a certification program or a military
2:59
program, a transition program, or a university,
3:03
that's probably a little bit different today.
3:05
But if you go back 25, 30, certainly more than
3:08
30 years ago, you didn't have these kinds of
3:10
programs, right? So really most people who are
3:12
above a certain age, let's just pick 40, let's
3:15
say arbitrarily. probably there wasn't a path.
3:18
So they probably found their way somehow into
3:20
what was then information security. In my case
3:23
was very similar. So I had transitioned from
3:25
the active duty into the reserves. And I had
3:28
a friend, we were both interviewing, right, for
3:30
new jobs, right? And she found a job in like
3:33
three or four days. I'm like, oh my gosh, Ann
3:34
Jeanette, that's amazing, right? But her, both
3:37
her parents, she said, oh no, both my parents
3:38
are in the tech industry. And so they had set
3:41
her up with a bunch of interviews with people
3:42
they knew. And she said, you know, I interviewed
3:44
with this little company and I actually really
3:46
think that based on your personality and like,
3:49
you would be a really good fit. And so that's,
3:51
I got in really. accidentally. And that's a case
3:54
with a lot of people. They find their way in
3:56
from something. And maybe it's just they really
3:59
love puzzles, problem -solving. They love tech,
4:02
maybe. They're in some adjacent role. And then
4:05
somebody's like, hey, we need somebody to figure
4:07
out security for us. And they foolishly maybe
4:10
raise their hands and go, I'll do it. But a lot
4:13
of people came through. So that's a really interesting...
4:16
a reflection on how Chief Information Security
4:19
Officer, sometimes it's pronounced CISO, sometimes
4:21
it's CISA, but I'll just call it CISO for the
4:24
rest of the episode. So a lot of CISOs again
4:27
came up. experientially, right? So like hands
4:30
on keyboard, maybe to do an audit or investigation.
4:33
So there's pros and cons like anything like that,
4:36
right? So a lot of times they have a lot of great
4:38
empathy and understanding for what their employees
4:41
are doing, but they may have not had that structured
4:43
path, right? That some other more mature roles,
4:46
certainly the chief financial officer role, which
4:48
has been around for hundreds of years in a sense,
4:51
right? So there's a nasancy. right, to the CSO
4:55
role. And that will play out as we have our conversation.
4:57
I can kind of point out how that plays out, right,
5:00
when you're working with the rest of the C -suite
5:02
and the board. Because there are some nuances
5:03
there, as you'd expect, right, being a newer
5:05
role. Yes. And so what would you describe as,
5:09
what would be your definition of cybersecurity?
5:12
And what do people do in cybersecurity? Like,
5:15
grade level five. Yeah, that's a great question.
5:19
Because we even internally have these crazy debates
5:21
on Why did cyber security become the term right?
5:24
Because it used to be information security, sometimes
5:27
data security. That's a little more understandable
5:29
to the typical person. Cyber security really
5:32
the intent there was to talk about as we move
5:34
from analog to digital, right? So as we move
5:36
from a physical file folder cabinet to an online
5:40
version of that to a digital version of that,
5:42
we were the the essence of it. We're trying to
5:44
capture is how do we now talk about the value
5:48
that it seems kind of ephemeral? those zeros
5:52
and ones that are digital, how do you think about
5:54
that digital value? And then how do you protect
5:57
it? Because again, it feels a little more obvious
6:00
if I can walk over to my file cabinet and say,
6:03
I'm unlocking it, right? Like we used to do,
6:04
been doing it years ago. It's a little less clear
6:08
to, certainly to a non -technical user of, well,
6:10
what do I need to do when it's in the digital
6:12
realm? And so that's really, cybersecurity is
6:15
really about how do I, first and foremost, in
6:19
the 2020s and beyond, right? In this modern,
6:21
what I would consider this current modern era,
6:24
we have to talk about how do I love the business,
6:26
right? How do I deliver business outcomes, right?
6:30
For many, many years, cybersecurity was a subset,
6:33
unintentionally probably, kind of underneath
6:35
information technology. It just sort of grew
6:38
out of that, right? And unfortunately, there's
6:40
some challenges with that. One of it, which is,
6:44
then it feels like it's very removed from the
6:47
business, right? So maybe you're used to work
6:49
with your tech support team, and then there's
6:51
a whole other team and you don't even really
6:52
interface with that team on a regular basis.
6:55
And then it sort of didn't have a voice at the
6:56
table because they were newer. It was sort of
6:59
like going up. So for many, many years, it was
7:01
very common for a CISO to report to the CIO.
7:05
Not that that structure is wrong. It's not wrong,
7:07
but it's maybe on average, it's probably not
7:11
the best structure. right? So that was one of
7:13
the things that CSRS like, hey, I probably should
7:15
report to, again, it's gonna depend on the size
7:18
of your company, the chief risk officer, right?
7:21
Perhaps chief legal counsel, and GC, perhaps
7:24
there's a subcommittee, right? That there's maybe
7:25
there's four or five people that look at risk.
7:27
Maybe it's directly to the CEO, right? Depending
7:30
on if you're a technology company, Amazon would
7:33
be a good example that Amazon and Amazon Web
7:35
Services, both of the companies. In that case,
7:38
it's so critical, right? To the to the safety
7:42
and security of the customers, that in that sense,
7:45
they report directly to the CEO. So again, I
7:47
don't think there's a one size fits all, but
7:49
I mean, you can see this movement of, oh, we're
7:51
just sort of a cost center that's nested underneath
7:54
of IT to, oh gosh, this is becoming more intrinsic
7:58
to our business, right? How do we make sure that
8:01
we have a seat at that table, right? And make
8:03
sure that we're, and it's commensurate on CISOs
8:05
as well then, to understand the business, right?
8:08
And then to not just be a technologist, but to
8:10
be a business executive. And that's a little
8:12
bit of that shift that I've mentioned. And I'd
8:14
say over the last four or five years, particularly
8:17
COVID accelerated that, right? As we sort of
8:19
did the world's largest social science experiment,
8:22
we all went home. People, it became real apparent,
8:24
oh gosh, we really are a digital company. Even
8:27
if we manufacture something, even if we're in
8:30
pharmaceuticals or, you know, to take your pick,
8:32
people suddenly went, oh wow, big part of what
8:34
we do and how we deliver. either internally or
8:37
to our customers or clients or partners is digital.
8:40
That actually catapulted some CISOs to that.
8:43
They went from the kids table, as we might say,
8:45
where I grew up, to the adult table. That's that
8:48
transition. People are still finding their way.
8:51
How do I make sure I'm speaking? the language
8:53
that's used in the boardroom and for my C -suite.
8:57
And so when I'm sort of coaching and mentoring,
8:58
that's a big piece of what I talk about. I like
9:00
the analogy of from the kids table to the adult
9:03
table, because I'm also curious when you said
9:06
a way to deliver business outcomes, what are
9:08
some of the business outcomes that people in
9:10
cybersecurity, the CISOs, can actually bring?
9:13
It will vary, of course. So I start with like,
9:16
first of all, if we're a public company or for
9:18
a large private company, How do we think about
9:20
risk? That's an easy, obvious one, right? So
9:22
if you're a public company in the U .S., you
9:24
look at Section 1A. Right. And let's look at
9:27
our risk. And of course, for your audience will
9:28
know this very well. Right. There's let's say
9:30
we might have risk of what if there is a natural
9:33
event that happens and we have a facility somewhere
9:36
near a coast. OK, that kind of risk would be
9:38
there. You might have the risk of currency exchange
9:40
rates changing. But there will also be some risks
9:43
that will either implicitly or explicitly be
9:45
related to this digital value. So I always would
9:47
start with if it's available, I would go to Section
9:49
Wayne. What is the board, the very learned folks,
9:53
what are they thinking about in terms of risk?
9:56
Then I can put a lens on it and say, what's a
9:59
more cybersecurity focused way of thinking about
10:02
that? But I would go through each of the functions.
10:04
I would talk with my CRO, my CMO, if there's
10:07
a chief product officer and understand. What
10:10
are the three or four things that they're really
10:11
trying to do in terms of outcomes? Let's just
10:13
take so customer experience is another one. So
10:16
there's sort of five that I look at and I just
10:18
sort of start with those on the board and we
10:19
kind of usually pick a couple. Innovation, flexibility,
10:22
speed to market, customer experience, scale.
10:26
These are things that cybersecurity can help
10:28
you with and it's going to play out very differently
10:30
if you're a knowledge based company versus a
10:32
manufacturing company. But there are absolutely
10:34
things that you should be tying to. And when
10:37
I'm stuck, when I try to ground myself, right,
10:39
just based on experiences that I have. And I
10:42
think about that in cybersecurity because that's
10:44
a good sort of analogy of how you think about
10:46
it. Right. So if I talk to you about things like
10:49
customer experience and resiliency, customer
10:52
retention, then now we're having a business conversation.
10:56
Right. It's not about tech. The tech is under
10:58
the scenes in the same way that I went to, like,
11:00
you know, a week long course on on Sarbanes -Oxley.
11:03
And I never, ever really want to talk about it
11:05
again. Okay, it's not my area, it's not my forte,
11:08
but I've had great CFOs and finance officers
11:11
who that is their forte, right? So in the same
11:13
way that I don't necessarily want to get into
11:15
the nitty gritty of that, I don't need to, right?
11:18
As long as you can explain to me why it's important
11:20
and what my role in that is and how I help you.
11:22
It's the same thing. It's really commensurate.
11:24
on the CISOs, right, and the senior people in
11:27
security to not drag you into the, if you want
11:30
to, cool, we can vibe out about the tech or whatever,
11:33
but I need to keep it up here, right? If I can't
11:36
explain it to you, you know, like to your auntie,
11:39
you know, or to teenagers, then I don't really
11:41
understand it, right? I've got to be able to
11:43
make it resonate with you. And I may have to
11:45
try two or three different stories and find a
11:47
way to help you understand. And it's the CISOs
11:51
role to be a business executive first. who's
11:54
got domain expertise and digital and cybersecurity,
11:58
and I have to be able to help you deliver a business
12:01
outcome. If I can't do that, then you should
12:04
keep me at the kids table. I get it. I mean,
12:07
it's still important, but you're like, yes. And
12:09
then this tech nerdy guy Dutch shows up and he
12:12
talks stuff I don't really know he's talking
12:13
about. Like, that's not helpful. I've got to
12:15
be able to. So on the CSO side of the table,
12:17
when I'm coaching people, I said, Look, if you
12:19
can't explain, and I'm various, right, based
12:21
on the company, you can't explain to me how what
12:24
you do impacts net margin. Or you can't explain
12:27
to me how this impacts your free cash flow, or
12:29
return on working capital or go down the list,
12:32
right, then you need to go talk to your finance
12:34
people and have them help you. You probably do
12:38
know it. You just don't know how to articulate
12:39
that today. And you need to be able to do that.
12:42
I need to be. And same thing, same thing for
12:44
Chief Human Resource Officer, CRO. Yeah, I got
12:47
to have that connection, right? And then the
12:49
same thing upwards if you have a board, of course,
12:51
right? Those are often former CEOs, CFOs, COOs,
12:55
right? Certainly understand risk. Yes. And that's
12:59
really, that's the starting point. Like I said,
13:02
risk is the starting point. And then how do I
13:04
help enable things so that customers, clients,
13:07
partners, whomever that ecosystem is, that they
13:10
have a heck of a great experience, right? That's
13:12
part of my role to help you with that. Thank
13:14
you. And speaking of risk, what would you say
13:17
is one cybersecurity mistake you see big companies,
13:22
small companies make over and over again? So
13:25
it's probably the fact that to do this well,
13:31
it takes a village. And what I mean is everyone
13:34
has to be involved. So here's my analogy. If
13:38
you look at the history of quality in the U .S.
13:40
specifically, the history of quality before you
13:43
had systems of systems. It was really your craftsmanship,
13:46
your artisanship, right? So you make shoes and
13:49
I do paintings, right? And I'm ours. You would
13:51
just look at, well, how great, well, look at
13:53
how great those are. But it's really your individual
13:55
craftsmanship or craftspersonship, right? But
13:57
when you start to have manufacturing and systems
13:59
of systems, you have to have quality. And the
14:02
quality revolution was very slow in America,
14:04
quite frankly. And initially what we did is we
14:07
created a quality control department. Well, if
14:10
there's a quality control department, I grew
14:12
up working in a factory. If there's a quality
14:14
control department, there's a bias that happens
14:16
unintentionally in people's brain, where they
14:18
go, Oh, well, that's not my job. Wow. Right.
14:21
That's Jesse's job. That's Sanjay's job. That's
14:24
Tim's job. You know, it's not me. And I understand
14:27
it as somebody who studies history, I understand
14:28
how that happens. But eventually, I can tell
14:31
you working in corporate America, we all had
14:33
to go back to school and learn about total quality
14:35
management or whatever acronym it was, wherever
14:37
you grew up and whatever. But now when you talk
14:40
about you don't even have to actually call out
14:42
quality, everybody understands quality, how doing
14:45
things in a quality process that's repeatable,
14:49
you know, everybody does that. And so you can
14:50
talk to somebody and doesn't matter if it's human
14:52
resources or logistics or finance, it's baked
14:54
in. It's the same sort of thing. If cybersecurity
14:57
is only thought of as this group of two people,
15:01
20 people, 200 people over here, then the implication
15:04
is, oh, well, that's not my job. I don't have
15:06
a piece of this. I don't have a role in it. I
15:08
promise you, you do because that's where most
15:11
of the risk lies. It's an unintended risk. Because,
15:15
of course, the criminals because in most cases,
15:17
they're actually really criminals, right? The
15:19
criminals know this, they understand human behavior
15:22
very well. And so will they will they come after
15:25
me directly? Maybe. But they're more likely to
15:28
do social engineering and find somebody who's
15:30
not aware, right? And they get their credentials.
15:33
And then they get inside your system. And now
15:36
we have a conversation about resilience, right?
15:38
Like how resilient are we if this happens to
15:40
us, right? So you need to build a culture of
15:45
security, not a security culture. When we use
15:47
the phrase that way, then everybody goes, oh,
15:48
well, yeah, that's the culture of Dutch's team.
15:50
That's true. But we need a culture of security,
15:53
right? A culture of security does three things.
15:56
Number one, it attracts talent, right? We have
15:58
a lot of evidence that that's the case, right?
15:59
If you have a great culture. Right. And that
16:02
includes being safe and secure. That attracts
16:04
talent. The board level, it also retains talent.
16:07
Right. So that's really important. Number three,
16:09
we know that companies with great culture period
16:13
outperform their peer group. There's a tremendous
16:16
amount of evidence of that. Right. And you can
16:18
look at any multiple metrics on that. And then
16:20
the fourth thing is companies with poor culture
16:23
are three times more likely to have a breach.
16:27
Wow. Not poor security. Poor culture. Because
16:31
think about this, pretend let's just do a thought
16:33
exercise. I'm a unhappy, disengaged employee
16:36
for whatever reason, maybe it's me, right? But
16:38
for whatever reason, I'm unhappy, I'm not engaged,
16:41
I'm not really dialed into our mission, whatever
16:43
it is that we do. It's much more likely then
16:46
that I'm not going to follow any of the process
16:48
or procedure. I'm not going to log out of all
16:50
the systems, I'm not going to make sure I change
16:52
all these, I'm just not going to be engaged,
16:54
right? I might just hurry, I might just rush
16:56
through things. And I'd be like, I know the corporate
16:59
standard is I'm supposed to use this software.
17:01
But I'm just going to email this out, you know,
17:03
to the other person, even though I've been told
17:05
not to do that. So when you have a poor culture,
17:08
this comes from a book called Well Aware by George
17:10
Finney. If you have poor culture, you're three
17:12
times more likely to have a breach. So that's
17:14
a really way to it's a way to bring that home.
17:16
So it really starts with leadership, culture
17:19
and strategy. Right. And again, those are not
17:21
technical. But those three things are what helps
17:23
you unlock the technology so that together we
17:27
have the greatest chance of winning, whatever
17:28
that means, whether that's serving in our constituents
17:31
or for charity or for public enterprise, it doesn't
17:34
matter. But whatever it is that we would define
17:36
as, hey, we're high -fiving, you know, at the
17:38
end of the year, that's what you have to focus
17:40
on. So it starts with culture. And that's the
17:42
biggest miss. It's unintended, of course, but
17:44
that's the biggest miss. Small, large, doesn't
17:47
matter. That's the biggest miss. Wow. That's
17:49
very insightful. And I totally make sense that...
17:52
if I'm not engaged and I'm not going to follow
17:54
protocol and then, you know, be an open door
17:58
to the criminals. Now, especially with AI now
18:00
and more companies are afraid of AI attacks because
18:03
they look so slick. Like they can, you can make
18:06
a fake receipt and you can go through software.
18:10
Do you think currently companies should be more
18:13
afraid of AI attacks than they currently are
18:15
or are they not? Or, you know, we think that
18:18
maybe the rate is not as big. The short answer
18:21
is that AI influence attacks, certainly to your
18:24
point, are very slick and dangerous. So what
18:26
do we see? We see a couple of things. One, what
18:30
feels like to us a very human approach is very
18:34
doable today, right? To your point, right? And
18:36
so there's been really tragic examples of, and
18:39
I don't want to call out any company, but where
18:41
somebody received a AI simulated voice memo.
18:45
or an email or a video or what have you. Right.
18:48
And so those have already taken place. Right.
18:50
So you do need to be aware of those. So what
18:52
can you do about that? Right. That's the first
18:54
question. The first my first answer is, well,
18:57
so it starts with what do I care about the most?
18:59
Right. You got to start. It's an inside out conversation.
19:03
What are the what's the data? What's the process?
19:06
What's the information? Do we have intellectual
19:07
property? Is it client or customer facing? You
19:11
start with that. Right. Because that's the easiest
19:13
way. Look, what are the things that If something
19:15
were to go wrong with this, it would cause a
19:18
really bad day. And sometimes it's not intuitive.
19:22
So you really need to say, what do we really,
19:23
really care about? And then you say to yourself,
19:26
what needs to go right every time for that to
19:30
work successfully? OK, cool. How do we make sure
19:33
to the highest degree we can that we make it
19:35
easy to do the right thing and really, really
19:38
hard to do the wrong thing, right? And you reinforce
19:40
that. So you should be concerned. I think there's
19:43
a healthy, that's the long answer. The short
19:46
answer is you should have a healthy amount of
19:48
concern. The way that you would protect data
19:50
and information doesn't change. This is just
19:53
another way that this plays out, right? The same
19:55
way that people live in robbing banks or playing
19:59
three card Monte and trying to misdirect you,
20:01
those haven't changed because they're really
20:03
all triggered on human behavior. Right. True.
20:06
And you mentioned the voiceover and I don't want
20:08
to name any company, but can you provide other
20:10
examples of deep fakes and synthetic data? First,
20:14
what's the difference between deep fakes and
20:16
synthetic data? But what are some of the examples
20:19
that you've seen that happened at companies?
20:22
Yeah. So I'll take them in reverse for us. So
20:24
synthetic data, synthetic data is legitimately
20:27
used. by data scientists and people in AI research
20:31
and other fields that are related. But synthetic
20:33
data is if you and I are building, let's say
20:36
we're building a customer -facing chat, an application
20:38
of some sort, rather than use actual sensitive
20:43
client data or customer data or maybe patient
20:45
data in healthcare, we want to create synthetic
20:48
data. We would use that as we build our large
20:52
language model or AI model. There's more than
20:56
one kind, by the way, but we'll just call large
20:57
language models that as what everybody started
20:59
from there, as we're building that model, we
21:01
go through epochs or iterations, right? So that's
21:04
the way that you train models. And so we'd want
21:07
we need a lot of data to do that right successfully.
21:10
So synthetic data in of itself isn't bad, right?
21:13
It has legitimate uses. But where it can be really
21:16
bad outcomes is if you can alter my synthetic
21:21
data in a way that I'm not aware of or I don't
21:23
realize. And then what it's going to do is it's
21:25
going to create outputs when I'm doing that prompt.
21:28
Let's say it's a chat bot that I wasn't anticipating,
21:31
right? And so you really have to look at that.
21:33
So a lot of that's around. what we would call
21:35
data provenance, right? Where did the data come
21:38
from? And can I show, sort of think of like a
21:40
crime show on TV, right? What's the chain of
21:43
custody, right? So the provenance, where did
21:45
this data come from? And can I prove that that's
21:48
actually where that data came from? And can I
21:50
prove that it has not been altered, right? So
21:52
that's pretty much in the data scientists and
21:55
security realm to look at that. So how does it
21:59
play out kind of in a more typical example? it's
22:02
very easy to have unintended bias then creep
22:05
in. If I can change the data, if I can poison
22:09
the model, you might hear data poison or model
22:11
poisoning, then I can trigger an outcome that
22:14
you don't want, right? So you have to do a look
22:16
at that. So this really around more around sort
22:18
of technical controls, right? And you want to
22:20
have a human in the loop, right? So you want
22:22
to have a human make that last decision. So that's
22:24
all about synthetic data. But what could outcome
22:26
be? I could skew a radiology model so that it
22:30
gives wrong information. I don't know what my
22:32
intention would be there, but I could do that,
22:33
right? More realistically, I could I could skew
22:36
models so that I'm unfairly doing financing right
22:41
for a customer set, right? So there's a lot of
22:44
ways that synthetic data could be messed with.
22:46
So you need to look at we're back to how do I
22:48
secure my model right? Or if I'm using someone
22:51
else's model, then tuning it, I want to ask some
22:53
really good questions about how did you guys
22:55
build this model? And do I have visibility right
22:58
into how you built that and what are your guardrails
23:01
right that you put around that so that we don't
23:03
have explicit bias that's kind of obvious but
23:05
also again implicit bias right we've all seen
23:08
this play out gender bias racial bias there's
23:11
a lot of ways that it's maybe unintended but
23:15
doesn't matter it's still a bias right so if
23:18
i feed you only resumes for a role that historically
23:21
was mostly gender normative male And I give you
23:26
those, what a model is going to do is go, oh,
23:29
well, then most of these names are the names
23:32
that I see. And it's going to make an association.
23:35
Wow. Maybe you didn't even intend to, right?
23:37
Because that's what models do, right? Think about,
23:40
let's say, the algorithm for one of your favorite
23:42
streaming platforms, right? What it does there
23:45
is it makes some inferences. It may not be obvious
23:48
to you. So you just click it on. Like the other
23:50
day, we were changing. And my youngest daughter
23:52
was like, no, no, don't do this on my profile.
23:54
it's gonna it's gonna screw up my algorithm,
23:56
right? Which is hilarious. But I mean, at 1415,
23:59
she's about to turn 15. She already knows this.
24:01
She's like, No, no, don't watch that sports show
24:03
on my algorithm. Right? Well, because the algorithm
24:06
makes some subtle inferences. And for whatever
24:09
reason, it goes, I know that people who like
24:11
this show, and this show and watch TV at this
24:14
time of day, I'm going to present them these
24:16
five other shows. And it can't even explain to
24:19
you why it's presenting it. It just knows based
24:22
on a lot of data. that it's likely that you're
24:25
going to like this other show. And so what makes
24:28
inferences, and that's what happens with unintended
24:30
bias, is it makes an inference. It tries to say
24:34
that there's a correlation or causality to these
24:36
two things, a name, as an example, that shouldn't
24:39
exist. It shouldn't matter, right? My name shouldn't
24:42
even be on there, right, when it's looking at
24:43
that resume. So that's how it can play out. And
24:45
in terms of the deep fakes... Yeah, the ones
24:48
that are really obvious are people have transferred
24:51
money and not insignificant, like $25 million
24:53
in one instance where they transferred money.
24:57
Yeah, they transferred money because they believed,
25:00
but fairly so. They believed it was their, I
25:03
don't remember if it was the CEO or the CFO.
25:04
I don't believe, I can't remember who they mimicked.
25:07
And think about it from a voice standpoint or
25:09
an email standpoint. It's fairly easy to do that.
25:13
The criminals have... the tools to be able to
25:15
remember what the differences remember back,
25:17
you know, like, five years ago, you would get
25:19
an email, it'd be really obvious, like, wow,
25:21
okay, grammatically, it's just not quite right.
25:24
And maybe there's a misspelling, it was sort
25:26
of obvious, right, that it wasn't really true.
25:28
But now, one of the things that large language
25:32
models do really well is language, right? That
25:34
so they're trained on natural language processing,
25:37
NLP is what an AI person would call that. So
25:39
they're very good at that. That's why it feels
25:42
like We're talking to human. We're not. It's
25:44
not actually thinking, but it presents itself
25:47
in a way. So now what a criminal can do is create
25:50
a very smooth or slick, as you said before, email
25:52
and also change it really fast, right? You're
25:56
doing it at automation speed. You're not doing
25:58
it human speed anymore, right? If you think about
26:00
if you prompt them, do you use AI like in your
26:03
day to day? But yeah, think about how fast you
26:05
can prompt and reprompt and do. It's that fast,
26:09
right? So you can create an agent, right? to
26:12
do that prompting. And now you're now I'm just
26:14
I'm just walking over here watching, you know,
26:16
watching my favorite show. Because it's now the
26:18
model is doing it right. And so think about how
26:20
quickly that is that that speed of that change
26:22
is very fast. So on the other side, We have to
26:26
have automation to combat that. Yeah, I'm still
26:29
stuck on the voiceover. Like, how does it work?
26:32
Like, how do you get caught into this? There's
26:34
a fun example of recently where a gentleman named
26:38
Perry Carpenter, who's renowned in the cyber
26:40
security industry, I believe he did it with a
26:42
reporter. It'll be one of the news channels,
26:45
let's just say. Right. And all it took is a handful
26:48
of clips of her because, of course, she's a public
26:50
figure and he has that. And he was able to create
26:53
a very, very, very slick video of her talking
26:57
that she had never said, because the whole point
26:59
of natural language processing is I can break
27:02
words into smaller pieces, okay, into tokens.
27:05
And I can reassemble those in a way that is so
27:07
smooth, that to the average person, even to yourself,
27:11
it's eerie. If you do it to yourself, it's very,
27:14
very hard. So what do you do? Well, like, let
27:16
me bring this home kind of at a personal level,
27:18
right? So you have to bring it home to people
27:20
in a way that they can connect with, right? Tell
27:22
them a story that they understand, right? And
27:25
again, there's a piece of this of I have a role
27:28
explicitly, right, to secure things. but you
27:31
also have a role in that. Like if we think about
27:33
our neighborhood, right? Should I lock my door?
27:35
But let's just say I have a security, you know,
27:37
I'm in a gated community and then something happened.
27:41
Well, the gated community has a role, right?
27:43
Because I'm paying, right? Explicitly paying
27:45
for a security team. But what if I didn't lock
27:47
my door? Okay, that's my part too, right? So
27:50
there's security and securing and securing behavior.
27:55
Everybody has a role in that. right? And if you
27:57
if we don't kind of coach it and teach it and
28:00
emphasize it that way, then it's hard for people.
28:03
Because people like, I can't you let those that
28:05
was the great moment. By the way, that's what
28:06
I can convince everybody. I'm like, right, I
28:09
know you can't remember that, please, I'm begging
28:11
you, use use a password manager. And here's why,
28:14
right? That's a great example. Did we solve it
28:16
all we did, but it was a pain. to do all that
28:19
and undo that and it's all that lost time from,
28:22
you know, and the stress and oh my gosh, I'm
28:23
gonna get, you know, and generally today, companies
28:25
are very good ultimately about getting your money
28:28
back to you, but in the meantime, and sometimes
28:30
that might go unnoticed for a long time, right?
28:32
People might, quote, steal your tax return, right,
28:36
before you even file it. Again, they think in
28:39
longer terms of time than we might in our day
28:42
to day, right? They might steal your child's
28:45
social security number here in the U .S. when
28:47
they're 13. And they'll just wait. They'll just
28:50
wait, right? And they'll just sell that, right?
28:54
With a whole bunch of other social security numbers.
28:56
And then when that person's birthdate is 18,
28:58
they'll go open credit cards in their name. Wow.
29:01
They'll play a very long game, right? Because
29:04
it's organized crime. It's not somebody on the
29:07
corner hustling you. It's not that movie that
29:11
you saw. I mean, those are funny. And those do
29:13
happen, by the way. I mean, that also happens.
29:15
But I mean, if I look at the preponderance of
29:18
breaches that I can identify, the majority, let's
29:21
just call it 55 % or 60%, are clearly the criminal
29:25
activity. So this is a nation state, or I'll
29:29
call it a criminal syndicate or a criminal actor.
29:32
This is their job. They do this the same way
29:35
that we do and candidly they collaborate very
29:37
well. You're an expert in one kind of ransomware
29:40
and I'm an expert in something else. We have
29:43
a trading network that goes on and I'll trade
29:46
your expertise for mine. So I can go hire ransomware
29:51
as a service. By the hour. That's a real thing.
29:56
So think about that. I mean, that is how, that
29:58
is how effective it is, right? So you have to
30:00
think about it differently. It's not, they weren't
30:02
targeting my aunt specifically. They're targeting
30:05
everybody. They're just trying to get information
30:08
and then figure out what's the information that's
30:10
most valuable and how did I do something? And
30:12
that plays out the exact same way in the corporate
30:14
world. Is there corporate espionage? Sure, there
30:16
always has been, right? So there's some that
30:17
are obvious, right? If you're in an environment,
30:20
but there's, there's the more subtle thing where
30:21
they're just always trying to steal information
30:24
and data. You have to presume that's what they're
30:26
doing, right? So then you play that out. Well,
30:28
how would that impact me? How would that impact
30:31
our reputation? Our brand? Yeah, operational
30:34
stuff is usually really obvious. Like, we're
30:37
a manufacturing company, and we can't do in the
30:39
production line to stop. Okay, that's pretty
30:40
obvious, right? that's bad. So but the more subtle
30:43
things are the damage to your brand, the damage
30:46
to your reputation. Do you recover? Probably
30:49
if you have a really strong brand, but it's nevertheless,
30:52
in the meantime, because an argument we're like,
30:54
Well, yeah, but pick a public breach that we
30:57
all know about. And then you look x number of
30:59
months or quarters later, like see their stock
31:01
price came back. That's true. But what would
31:04
it have been? If it didn't take a what would
31:07
it have been if it didn't take a 14 % dip or
31:10
20 % which is often the case right right after
31:13
an announcement right and again the subtlety
31:15
of I lost trust with you if I'm a customer or
31:18
client now we're back to churn right it's real
31:22
hard to put your finger on that but if your churn
31:24
rate changes then the correlation is likely that
31:28
that event had some impact because there's some
31:29
people like I don't feel comfortable with the
31:32
way you know xyz company handled my information
31:36
right? Yes, and vote with their feet, they're
31:38
gonna go somewhere else, right? And you may just
31:40
attribute that to normal term, but maybe not.
31:42
Maybe it's not normal term. Maybe it's, I'm actually
31:45
concerned. I don't know if I trust your I don't
31:47
know if you have the level of trust that I want
31:49
you to have with my information about my child's
31:52
health care information as an example. And so
31:55
when we look in the corporate world, you know,
31:58
people always go to accounting and finance. What
32:00
would you say would be one thing you wish CFO
32:04
knew more about cybersecurity or knew more or
32:08
did better working with CISOs, especially in
32:11
small companies, they're usually not working
32:13
there, but What should any CFOs at any size company
32:17
know about cybersecurity? And again, if there's
32:20
not a CISO, whomever that most senior person
32:23
is, right, who does technology and operations,
32:25
depending on how it's set up in your company,
32:27
where we could benefit from the experience and
32:30
knowledge that CFOs in your community has is
32:33
how do we quantify the risk, right? There's a
32:36
lot of discussion in the CISO community, and
32:37
there has been for a number of years. And I think
32:39
we would benefit from more discussions around
32:42
What's an acceptable amount of risk? Right. And
32:45
so when I think about it, I think about risk
32:48
appetite and risk tolerance. OK. So let's say
32:51
we're in a public company for a second. My expectation
32:54
would be that the board sets the risk appetite.
32:58
In other words, how much risk are we knowingly
33:01
OK taking? Because we might go through periods
33:03
where we want it. We're OK accepting more risk.
33:05
Maybe we're going through a heavy period intentionally
33:08
through M &A. And so we know that while we're
33:10
doing that, or maybe we're opening up in a new
33:12
geography or you pick a risk. Right. But there's
33:15
valid reasons, business reasons. But I need some
33:17
guidance. Right. What is our appetite? And if
33:20
it changes, please tell me. Help us quantify
33:23
what's the acceptable amount. And then let's
33:27
talk through. OK. And then how much then is are
33:29
we going to use cyber insurance for? And then
33:32
how much are we going to essentially self insure?
33:35
Right. And we're going to accept that risk. right?
33:38
Because CISOs want to know that, right? But in
33:40
some cases, they there hasn't been a lot of history
33:43
of that conversation happening. But there's five
33:46
things there. So as somebody who looks at risk
33:48
from a digital standpoint, I want to understand,
33:51
well, which of those kind of impact help me help
33:53
me help you like instead of Jerry Maguire, right?
33:56
Help me help you like help us right. So bring
33:59
me into the conversation. And please bring us
34:01
in soon. I can't tell you how many times a CISO
34:05
or you know, a technology or security person
34:08
found out about an acquisition after it had happened.
34:13
Oh, yeah. Same thing with accounting. I feel
34:15
like some positions... See, look, we're twinning,
34:17
right? With the last year... Yeah, and we really
34:20
do. And even if we, like, as soon as we can,
34:22
I obviously understand there's a measured process
34:24
we have to go through, but as soon as you can,
34:27
please bring us... So I would just say bring
34:28
us to the table, extend us some... you know,
34:32
some trust, you know, initially, but we need
34:34
to be at the table, right? So because and again,
34:37
some of this is on our side as well, right? Because
34:40
we were sort of viewed as technologists solely
34:44
or first and foremost, we weren't in the business
34:46
conversations. So when you're doing big moves,
34:50
we're going to go into new geography, we're building
34:52
a new factory, we're coming up with a new pharmaceutical
34:54
offering, we're coming up with a new service,
34:57
whatever that is. whomever it is that is the
35:00
senior person for you, they should be in that
35:02
conversation. Because they might say, oh, well,
35:05
wait a minute. Well, where are we hosting the
35:07
data for that new software platform? Because
35:11
those customers are in Europe. So this applies
35:15
differently. And the rest of the team might not
35:16
know that. How do I help you move fast? I want
35:18
you to move fast, but safe. Yes. Right? How do
35:22
I help you do that? And you get it. So bring
35:25
us in and help us quantify risk. help us build
35:28
the story around how we talk to them. Maybe you
35:31
and I have got, okay, cool. Hey, how do we go
35:33
talk to the CRO about this? How do we talk with
35:35
the CMO and make sure? Because again, my job
35:37
is to enable you to move quickly, to delight
35:41
our customers, but to do it safely. How safely?
35:45
That's a business choice. And that's okay, right?
35:48
And that's the thing you get. You have to help
35:49
me understand like, hey, how much are we okay
35:51
taking, you know, in terms of risk? I had a great
35:54
CFO at one point. I was a young business leader.
35:57
And I was debating, making acquisition within
36:01
my, you know, within my realm. And I was sort
36:04
of angsty and like, I ran the numbers and, and
36:06
my CFO came down and said, Listen, I need you
36:08
to be able to take risk. And I like was like,
36:11
wait, wait, what? And he was like, No, I need
36:13
you to be able to take risk. And I, and I worked
36:15
at this company was a very old company. So they've
36:17
been doing this a long time, right? He goes,
36:18
No, no, no. We're gonna talk, you know, we've
36:20
got metrics on loss and all these other things.
36:22
And we talked about that for a while. I need
36:24
to, I need you to fit, you know, like emotionally
36:26
understand. I want, I need you to be able to
36:29
take risk. If you don't take any risks, we won't
36:32
grow. Yes. I just need you to, we need to have
36:35
a conversation about it. And he's in at the end
36:36
of the day after we run the models that we did,
36:38
trust me, you know, red, orange, and after we
36:40
ran the models, he said, at the end of the day,
36:43
you're going to look at me and go, let's do this
36:45
one. It's going to be a judgment call. We know
36:47
what the model says. right? And that's okay.
36:50
And he goes, and occasionally we'll be wrong.
36:52
And it can't be wrong more than x percent of
36:54
the time about each year. But I mean, that helped
36:56
me a lot. He's like, No, we need to take risk.
36:58
If we don't take risk, we don't grow. And so
37:01
we need to help with the language of that and
37:03
how to quantify it and how to because in the
37:06
world of cybersecurity risk is just like, it's
37:08
like the big giant capital letters like, oh my
37:10
god, like you're always crime fighting risk.
37:14
And so there's a visceral reaction to anybody
37:16
who's in technology or cybersecurity around risk,
37:19
right? And we need to understand that you have
37:21
to take risk. Yes. Or you can't grow. I just
37:25
need your help and saying, how much is acceptable?
37:28
What kinds of risks are acceptable? When do I
37:30
need to pull you in? You know, if I'm concerned
37:33
about something, I'm getting a signal that I'm
37:35
not sure that we're going in the right direction.
37:37
Help me, right? Do that. Because then together,
37:39
we can help have that conversation with the CRO,
37:42
the CMO, the product team that, you know, whomever
37:44
that is. Does that, does that resonate with you?
37:46
Oh yeah, absolutely. Because sometimes, and I
37:49
feel the same, especially because I came from
37:51
an accounting background where people go make
37:53
all kinds of transactions when they need payment,
37:55
they'll say, oh, accounting, we need this. And
37:57
we're like, where are you? Like literally, where
38:02
are you? Yeah. Last question, what do you like
38:05
to do outside of work? Because I know you're
38:07
very passionate about the security. And he blows
38:09
naturally as a veteran. So I'm always curious,
38:12
what do you like to do outside of work? So we
38:15
have six kids. So we spend a ton of time in sporting
38:18
events and music events. So that takes up big
38:21
chunks of time. And then my wife and I personally,
38:23
we really like to travel. And we really love
38:25
live music. So we went to Coachella earlier this
38:28
year. Oh, nice. And camped out. So we probably,
38:32
you know, we're both big readers. And then just
38:35
outdoor activities is kind of implied in the
38:37
kids sports thing. But like, yeah, so go for
38:40
a hike, go to the beach, read a book, you know,
38:44
that kind of thing. Love going to museums, you
38:47
know, finding out, you know, wherever you travel,
38:49
you know, just trying to get out and not go to
38:51
the chain restaurant and not stay, you know,
38:53
I'm the not tour person. So I want to go out
38:57
and strike out and be like, hey, and then you
38:59
go find somebody, you know, and then you ask
39:00
the the person at your cafe like hey where should
39:03
we go we do that all the time right i like to
39:05
understand so if i came to visit right uh and
39:07
i've been to Atlanta but i would be calling you
39:09
i'm going hey i'm coming in uh to hotlanta you
39:13
know next week yeah what's happening it's a cultural
39:15
thing going on is or is your music going on is
39:18
tell me the great rib place that i already that
39:20
i don't know about that's like not the touristy
39:22
one so that's what we love to do so you know
39:24
food music travel all that kind of stuff and
39:27
the kids Yeah. Okay. Now I'm curious to see,
39:30
especially when you say I like going to the nut
39:33
chains and in the outdoor, how you manage cyber
39:36
security and all that because it must be, it
39:38
must be following you. Like I'm a CFO. So when
39:40
we went to Disney, I was calculating in my head
39:43
how much money they were making at the cotton
39:46
candy stand. Like literally it feels like work
39:49
follows you even outside. So I'm curious, there
39:52
is a fun way that you do that too, when you're
39:55
off in some of your fun activities. Yeah, there's
39:58
probably two things that are, you know, tongue
40:01
-in -cheek, but occupational hazards, right?
40:04
And that's, yeah, so you're always thinking about,
40:06
oh, this process is not secure. Like, every time
40:10
I come in, I'm like, how would I game this process?
40:13
How would I get in and not actually be the person
40:17
that's on this picture? Right to your Disney,
40:20
right to your Disney point? right? I mean, so
40:22
you're always thinking about that both sides,
40:24
right? Usually, you're thinking about is the
40:25
fun side, like, how would I break break, you
40:27
know, how would I break this, right? But then
40:29
how I defend against it, that's one. And then
40:31
because of my background in the military, then
40:32
it's all and then also, like, where's my exit?
40:35
Like, how would I where would I go? How do I
40:37
do this? What would I do in the scenario, right?
40:39
And honestly, it's sort of unconscious, right?
40:42
Because it's just sort of how you how you think
40:45
about things. Yeah, all the time. But it's I
40:47
would imagine it's the same thing. I know for
40:50
certain when you know, in military movies, you
40:52
know, we watch and we're like, oh, it would never
40:53
happen that way. And when there's a good one,
40:55
we'll all talk about it. Like, oh, that opening
40:57
scene in this movie was great. Or that scene.
41:01
Weirdly, like there's a scene in Forrest Gump,
41:02
you're like, yeah, that's actually so you then
41:05
you know, you're like, who who is the analyst?
41:07
That's what we call it. Who is the analyst who
41:08
informed the director because they were very
41:11
good. Like it was a spot on I would imagine that
41:13
for doctors, lawyers, when they watch those shows,
41:19
they're like, that's not how that happens. You
41:22
know, like, I love a few good men. And I'm well
41:24
aware that's not how that court see whatever
41:25
play out. Right. But I mean, I'm sure that acts,
41:27
you know, that I'm sure that that attorneys are
41:29
like, ridiculous. It never happens that way.
41:32
But it's good theater, right? It's the same thing,
41:34
right? I mean, there's some stuff that there's
41:36
some again, there's some movies that you're like,
41:38
yeah, that's a pretty accurate scene right there
41:40
what they're doing the movie. But again, some
41:41
of it is just great. You know, it's fictionalized.
41:44
And it's just great fun, right? So yeah, I think
41:47
everywhere you're going, you're always thinking
41:48
this process and also like I think about customer
41:50
experience a lot, I got this process terrible.
41:53
It drives me, you know, so I do think about that
41:56
a lot. Like you said, when you're going into
41:57
places, then when you see great when you're like,
41:58
ah, you get the Disney experience, right, where
42:01
everybody comes to help you. They just stop what
42:03
they're doing and go, oh, how can I? Then you
42:05
go, see, that's good culture. That's good culture,
42:09
because you didn't, you know, there's that story,
42:11
right, that old story, right, where, you know,
42:13
JFK is at the Space Center, right, and he's asking
42:16
somebody using facilities. We're like, hey, what
42:19
do you do? And my recollection, anyway, is the
42:22
gentleman's response was, well, I'm helping put
42:24
a person on the moon. Wow. That's the cult, right?
42:27
So now you go, ah. You guys got it. That's the
42:30
culture because that is it. Everybody's contribution
42:32
matters, right? No more, no less. Everybody's
42:36
got things that contribute to makes it a better
42:40
team. Right. So it has to be a team. It can't
42:43
just be me with a superhero cape. Yes. You know,
42:47
fighting crime. It has to be all of us together
42:50
because that's the only way we succeed. Right.
42:53
The automation, the AI, the sophistication of
42:56
criminals. is too great for any one team, right?
42:59
So we all have to be like, can I make sure that
43:02
I hate the password policy, but I know I get
43:04
it. But I got to explain to you in a way that
43:06
makes sense to you, right? And not just to you,
43:08
but to each person in a way that they understand,
43:10
okay, hey, this is important. Doing things safely
43:13
is just how we do things here. Like that would
43:16
be what I would leave you with. Doing things
43:18
safely. That's just how we do stuff here. So
43:20
when you're hiring, when you're onboarding, when
43:22
you're training new leaders, you explicitly train
43:24
them. And then over time, again, remember I said,
43:26
it's pervasive and it's enduring. So once you
43:29
get that culture going that direction, all the
43:33
what a organizational psychologist say all the
43:35
social cues will just align people. Because then
43:39
they just be like, I will see this. Hey, that's
43:41
not how you do that. Come on. We got to do it.
43:43
You know, we got to do that. Schwartz is going
43:45
to say something if I don't do this in a good
43:48
way, like you're griping, but you know that there's
43:50
a real reason that you're doing it. And you got
43:52
to know there's a real reason you're doing it.
43:53
Yes. Not because I said so. It's not because
43:55
I set a policy that's annoying. Right. Everybody.
43:58
We all hate that. Right. The mandatory training.
44:01
Boo. What's mandatory training? That is it. Right.
44:05
Just the word itself is terrible. Right. Yeah.
44:08
Mandatory training. Yikes. Okay. No. Doing things
44:12
safely is just how we do things here. I think
44:15
that would be what I would do. Love it. Thank
44:17
you so, so much for being here. You're welcome.
44:19
Thanks for having me. I appreciate it. It's great
44:22
to meet you. Same here.