Latest / You've Been Heard / Security Is Just Business Risk

Transcript

Security Is Just Business Risk · You've Been Heard

• 0:09
  Speaker A: All right, everyone, welcome back to you've been heard today. Edward Marchuka on the show cio, Illinois Bone and Joint Institute. You've written a book, I've heard. Or maybe more than one. Why don't we just start off with that?
• 0:25
  Speaker B: Yeah. So, yeah. So I wrote a book, A Cybersecurity Leader's Journey Speaking the Language of the
• 0:31
  Speaker A: Board, which is awesome because I did wrote Speaking the language of business it. So I'm sure there's maybe some parallels,
• 0:37
  Speaker B: but I'm sure there are. So I did my dissertation and so I took the principles and ideas from it and turned it into a narrative story so that it was actually digestible. And the feedback's been great on other books I've contributed to a couple others. The famed CISO Compass by Todd Fitzgerald, I contributed a piece to that. And then I co wrote chapters for NGOs in both the third and fourth edition of the ABA's Cybersecurity Handbook.
• 1:10
  Speaker A: So when it comes to speaking to the board about security and I've had a brilliant CTO on the show before and had worked towards, oh, what do we want to say? Was working towards Zero Trust for a year and a half, had everyone's buy in. Everyone knew how important it was. And then when it came to the announcement of like, guys, great news, we became Zero trust certified today at the boardroom meeting, whatever it was. And to her, the level of accomplishment, happiness that you'd feel when you finally accomplish this goal was high. But the boardroom response was deflating because it was kind of like good, I guess. So maybe you got a few comments on that, on how we tell stories to the boardroom or how we make them actually involved in something that might be geeky or nerdy to them or above their head or if you say sock seam and all different types of things to them and honey pots and, I don't know, different things like that. What's your approach there? You wrote the book, it did.
• 2:19
  Speaker B: So first is recognizing that there is what's called an information asymmetry gap from an academic perspective. But really all it is is you know something and they don't. And you have to cross that bridge and you have to close that gap. And we've all experienced that gap. Like, you go to the doctor, right? You want them to know more than you about whatever your ailment is. If you have a heart issue, you want your heart document to have that big information asymmetry gap. However, in that case, they're just going to do what they need to do. To save you. In our case, we've got to convince them that there's something going on. The second thing we've got to overcome is what's called the effect heuristic, or more simply an emotional response. Research has shown that people go negative when they hear cybersecurity. So we have to anticipate that. And one of the ways to close that gap and to anticipate or prevent the effective response is really through building trust. And the number one way of doing that is changing the direction and how you discuss what's happening. And it's by lowering self orientation. Make it all about the other person. The numerator and trust equation is credibility, reliability and intimacy. That's all you, your degrees, your certs, how you show up, how close you get and how much you talk to people. That's the numerator. But when you make it about them. So how can you help them and how can you explain things in terms that they understand? Your CFO probably wants numbers, your CEO probably wants availability. Marketing probably wants integrity of reports. The CEO wants something in terms of how people are working. And so when we have those discussions with them, find out what they care about. So when we say, oh, Zero Trust certified great, what does that mean to me? How does that impact what I'm doing every day? And so when we don't come in and say I got Zero Trust certified for the organization, I'm great. Give me my fanfare. The reaction is, so what? But when you come and say we got Zero Trust certified, it's going to allow us to do X, Y, Z and A, B, C. People go, that's awesome, that's great. Because you've closed the gap. You reduce their immediate negative response because you've made it about them. That's the like TLDR version of the book.
• 4:40
  Speaker A: I was a sales manager and trainer back in the day and the only reason I got there was because I was able to do what most of the other people were not able to do and kind of was in this like Cisco, what people would call like churn and burn. And I really attribute my success only to always being a solution oriented, sit on the same side of the table as them, I guess, sales professional. And one of the things that I always told my people and no one was ever able to break our records like until this day. Like we, we were always number one, we were always in the top. We basically broke a lot of the rules, which is a good book by the way. First break all the rules. But the one thing that I told him is it's very, very easy. I was like, there's one thing you have to do them first is get everyone smiling. If they smile, they're happy. You've already like, kind of broken down their initial barrier, so to speak. Number two, ask five really, really good, damn good questions. But before you speak to anyone, before you walk into any door, before you do anything you need to say in your head, it's all about them. It's all about them. It's all about them. It has to be about them first. And if you just help another people get what they want, you in return will get you what you want. Also a famous Zig Ziglar thing. And you're reminding me of all of this from like 20 years ago.
• 6:00
  Speaker B: Yeah.
• 6:00
  Speaker A: And really, as I would say, as, yeah, CISO ctos, we have to learn to sell. And that's not a bad thing. Again, that's another negative thing. But I really am fascinated by the fact that you said they go negative right away. Why is that? If your Internet goes down and you're calling carriers yourself, that's not strategic. It. When we help teams centralize monitoring, proactive tickets and escalation across every location without capex, less noise, more uptime, make it boring again, just go to you've been heard.com and answer the seven questions to simplify, streamline and save the reason why.
• 6:42
  Speaker B: It's. There's anchoring biases, recency biases, what they hear in the news. Yes. So anchoring bias is this idea of like, you're set in your ways and you're going to be stuck with it. And so when people think of cyber, they think of hackers, they think of bad guys, they think of identity theft and they go through it. Or there's a recency bias. So if something recently happened, like if your company had a breach or if someone's dealt with an elder case, they're like, oh, yeah, that was horrible. That was terrible. I didn't want to deal with it. Or my kid just had to deal with the whole canvas hack type of thing. She was like, I stayed home from school and I can't do my homework now. I'm going to be in trouble. It's like you literally couldn't access it last night, so let's not worry about it. And it's all related to cyber. And there was a study and I can't remember it off the top of my head, but they just gave people like a happy face button and a sad face button and it was puppies, happy Flowers, happy, cyber, sad. And like everyone went negative when they saw the cyber thing. And so there's this inclination to just be negative. And so when you walk into the room as the ciso, it's not like, oh, you're the helpful guy, you're the cyber guy. And if you can overcome that, it really absolutely helps.
• 7:50
  Speaker A: Okay, yeah, I would think the negative stuff would help. So maybe this is the problem. We think that all that negative stuff
• 7:58
  Speaker B: should help us, but it doesn't because people then shut down and they become defensive. So when you go negative emotionally, you become defensive and then it's like, well, I don't know if I believe you. I know if this is the right time. There's a lot of hesitation in that.
• 8:15
  Speaker A: How do we make it fun and good?
• 8:17
  Speaker B: Yeah, make it fun, make it engaging, build trust, have one on one preparatory discussions. That's one of the things I mentioned in the book, is to overcome these challenges is the first time you talk to someone about it shouldn't be in the boardroom because board members and executives have egos and they're not going to show that they don't know something or that they're not prepared. But if you can go in ahead of time, they've had a chance to stew on it. They've had a chance to ask you directly those questions. When you think about like that emotional response and that negative information asymmetry, if you've ever had the fun experience of buying a car, right. It's somewhat adversarial. And when they come in, we're defensive immediately. Oh, hey, I ran the numbers. Sign here. We'll get this going. Not too many people are like, yeah, this is good, I'm happy. This is a great transaction. It's always negative. I've never talked to anyone that's been like, oh yeah, it's always smooth and it's great. And it's my most, one favorite thing to do is go buy a new car. So when think about it from that perspective at this time, you're selling the car, zero trust, a new sim. And they're like, I don't believe you.
• 9:26
  Speaker A: So we have a guy in our community, Cyber Mike, he kind of leads up some of the cyber stuff and he built a whole basically having a cybersecurity like hero or mascot in your company that matches with everybody's like kind of like the culture of the company. So they had like a little like, I think they called it Snowball, which was like, the company's like white dog basically. So every time someone clicked on a phishing email or something bad happened in the company. It was like Snowball would pop up or they would use Snowball to actually be the cyber villain. Oh, what it was, it was a cyber villain. So Snowball actually became the cyber villain and then the whole company, kind of like their whole cybersecurity vibe, I guess, so to speak, turned around to like a fun thing like cybersecurity.
• 10:16
  Speaker B: It is. I did that at a previous organization. It was Agent Hope. It was this like spy sneaky guy. But he was also there. He was like a double agent, was there to protect you. And we had this whole like logo for it.
• 10:29
  Speaker A: Just back to the beginning again. You mentioned. What was the one term at the beginning again that we must know that must come out of the show?
• 10:36
  Speaker B: Information asymmetry. It's the gap between what you know and what they know.
• 10:40
  Speaker A: And you have to go in with that gap and make people look stupid that have big egos. You're going to look.
• 10:46
  Speaker B: So you. Yeah, so you close that gap by meeting with them one on one to help close the gap. Because they'll come to me like, I have no idea what you're talking about. I've had tons of conversations where they're like, look, you could buffalo me all day long and I would have no idea. But when on one on one, they'll ask the questions, they'll get the clarity because they're not going to do it in front of their peers unless you've got someone who's just really strong and confident. But my experience has been most of the people in the room need that one on one chat beforehand.
• 11:15
  Speaker A: Share with me some of these terms that people were willing to say. I have no clue what you're talking about. What was that? What's some of the most common ones?
• 11:24
  Speaker B: I think when we talk about any of our security metrics, if we talk about even like phishing results or the antivirus stats that a lot of people will put out. But what does that mean? Or if we talk about a zero trust initiative. Okay, is that good? Is that bad? What does that mean? Like, do zero people trust us? Do we assume that we can't trust them? Like, where are we at?
• 11:48
  Speaker A: Yes. And oh, that sounds great. Yeah, we need to be zero trust. But then when you actually become zero trust and they realize that there's a whole bunch of new policies and procedures they need to follow, they're quickly like, well, I didn't sign up for that. Yeah, how do you deal with that?
• 12:03
  Speaker B: Well, some of that is how we teach and train adults. And so then we gotta like go into our educational theory and pull out this assumptions of andragogy, which is like how we teach adults and remember that adults want to know why we're doing something. What's the impact to my day to day? How are you meeting me where I'm at? So where does this drive in to that desire? Adults have a wealth of life experience. So how can we bridge what they know to what we're trying to get them to know and tie those things together. When we bring in those in our discussions and frame it that way, it can really help get that message and story across.
• 12:47
  Speaker A: It's actually quite fascinating because if you study anything that's outside of security or anything that you do for fun, whether it be, I don't know, me, I'm a Brazilian jiu jitsu fan and like I like surfing and other things as well. And I had a teacher the other day say, well yeah, when I have to teach you differently than I teach the kids, I was like, why can't I just learn with the kids? Just put me in class for the kids. Like with kids we just tell them to do it and they do it with adults. Like what you just said, it's actually quite fascinating. Why do we need the why and why do we need all this? And it is a deeper and then we get into this thing. Well, when you get older, you can't learn like you can as a kid. Kids can learn things faster. No, kids just have the time. And we might actually be able to learn things at a, in a deeper level. I think it's quite fascinating.
• 13:31
  Speaker B: Oh yeah, I, I, when you mentioned martial arts, I think like the instructor, cause I train with my daughter, so they'll be like, do this. And the kids will do it. And then the adults will be like, couldn't we do this? What about this? Isn't it like this other thing? Like we're starting to connect these things together? Or like, well, why would we do it that way versus this way? It's that like help me explain. So now the instructor is like, okay, so for extra detail for you adults who are processing this at a higher level, let's go into some of the different details. Or like, well, there's this extra thing.
• 14:06
  Speaker A: Yeah, like sometimes kids will just do it, just do like a Granby rule or they'll just do something. Right. And adults like, no, you need to do it this way because if you don't press this way, the hip won't get the right leverage. And yeah, if you had to teach new IT leader. Let's this. A lot of times a lot of people listen to the show are mid market IT leaders. So they might not have any budget for a ciso. Okay, this is why I say IT leader. But we can say CISO or fill in the blank as well. Your playbook for creating real business outcomes, not just fake KPIs that we kind of fudge the numbers, I guess. I don't think anyone does that in it. I think that's possible. They might. If you had to teach a new IT leader your playbook for creating real business outcomes, what would the top three steps be? And it can be five or seven. I don't care. We just have a. We have a three in there. Yeah.
• 15:03
  Speaker B: Number one would be understand your business. So if you're coming in, find out what it is you do and how you do it. And not just on the surface of oh, we sell xyz. But go deeper into how that actually happens from beginning to end, as that's where you can enable. People use the term like IT or security should enable the business. But if you don't know what it is you do or how you do it, you can't enable that. And a lot of technology programs are cost centers. Like we all talk about, like, oh, you should be a profit center. It's like, well, it's not viewed that way in a lot of places. And let's accept that you are the back of the boat trying to help push it forward. You're a support organization.
• 15:52
  Speaker A: Let's just always the biggest service people hate the most. If I had to ask all the things that came up in this show, if I asked, what do you hate? We do not want to be referred to as the department of IT as if we are this separate entity. Yeah. And when everything is working and not working, we're invaluable. But when everything's working great, we're a cost center.
• 16:13
  Speaker B: Unless you can find a way to resell your services to the outside world, that's what it is. Some organizations can profit like their security program. When they sell a product without it, they can't sell it. And you are truly enabling and becoming more of a profit center.
• 16:30
  Speaker A: Healthcare might go to the dark center, I might go to the dark side.
• 16:33
  Speaker B: I'm.
• 16:33
  Speaker A: You're convincing me to go back to cost center when I've been saying it is a business force multiplier for the last eight years and that we need to switch it to a business force multiplier.
• 16:44
  Speaker B: Let's think about this all right, we're all familiar with the idea of a submarine. What's the purpose of a submarine? Put ordinance on target. Right? That's the purpose of it.
• 16:53
  Speaker A: Please explain that, because to me, I would be like to go underwater.
• 17:00
  Speaker B: We can go underwater with. With plenty of stuff, but you can't go underwater and blow things up. Right. That's the purpose of that boat. But you can't because of range issues. You can't be a Norfolk and hit the bad guys on the other side of the world. So you got to get the boat close enough. How do you get there? The back half of that submarine makes it drive, makes it go forward. When you look at like if you take a diagram of a submarine, the fire control room is this tiny little box in the whole thing. The rest of that boat is supporting, getting it there so they can push that button. But that back half is the engine room. That's what gives you power and what gives you propulsion. Without it, it doesn't work, it just sinks. So it is the back half of the boat. We're going to make sure you get there so you can put ordnance on target. Now you can also switch power and you could actually power a small city with a submarine so you could resell those services in an emergency. In fact, I think it was Last Ship that show on TNT from like 15 years ago, they actually did some of that. They hooked up the city to the destroyer and destroyer provided power to the unit. And so can it be a profit center? Yes. Is it it often a cost center? Yeah, because you're supporting the organization for their mission and what they do at ivgi? We do orthopedics. We help people that are sick, in pain, they're broken. I'm not that kind of doctor. We're going to help make that happen. We're going to provide systems that provide information that gets patients what they need, the doctors what they need, so they can treat the patient, provide care. But no one's coping. IBJI and buying IT services, they're buying medical care.
• 18:53
  Speaker A: We help build the information for it, unless without it. Okay, so let's just go back to this beginning. So we go into step one. We go and we learn the business. We learn the entire process, A to Z. What do we do? Do how it.
• 19:04
  Speaker B: Whatever.
• 19:04
  Speaker A: How we make money, prosthesis, whatever in your industry. I don't know. Knee replacements, hip replacements. I don't know. Whatever it is, I'm probably way off. Have you ever gone in and that's broken and you're like, why is There a gap here. Like, we could do this. And if it fixes that gap, they now do better. I'm just like, is at that point, is it still a cost center or is it a business enabler?
• 19:30
  Speaker B: That point, the question is, can they and. But does leadership have that overall view? And I worked at one place, we were doing a strategy meeting and it was brought in to be part of it. And the facilitator says, what do you do here? And the GM says, oh, we make pumps. And the VP of sales says, we make drives. And they put a full stop to the meeting. And they're like, you need to decide what you do in this manufacturing facility before we can go forward. Because what we do will determine what all other departments do between purchasing, it, finance, even the manufacturing floor. What you do determines where you're going and how you make that happen. And so we had like a two hour discussion on do we do pumps or do we do drives? Yes, the end product will move fluid via a pump, but the thing that made that happen was this box or a drive. They just happened to attach a pump head to it. And so if we made pumps, then that was the product. If we made drives, we could attach other things to the drive that spun other items. And it was a deep discussion of what it is we actually did there because that drove what everyone else did.
• 20:47
  Speaker A: You ended up with drives, I'm assuming?
• 20:49
  Speaker B: No, they ended up with pumps.
• 20:50
  Speaker A: Why is that?
• 20:52
  Speaker B: It was keep it simple. We even during a little bit later, I had worked with some of the engineers and we developed accessories for the drives. We're like, hey, we have a sister company that's making these like test tube shakers like this, and they're selling them for $800 a piece. And it was this little desktop cheap thing. We're like, this is ridiculous. We said, hey, in $30 in spare parts. And this was not at scale. This was just like. We just grabbed it, went to the machine shop, we built a test tube shaker that we could attach to our drive. And then we had the developer code it so it just oscillated 15 degrees in each direction. We're like, see, we made it. Now we have a higher likelihood of burning out the drive because they're using it more often and they'll buy a new one. And they were like, no, we're not going to risk going into a new business. And we were like, wow, okay. Do you realize the margin on this is ridiculous? And it was too much risk to EBITDA to try and do something New.
• 21:47
  Speaker A: Wow. You just opened up another kind of like a deep hole that I want to go down, but which is, why do I t people spend $140,000 on Gartner? And I was going over it from a long time ago, and I was like, because when I speak with a lot of leadership, they're like, well, yeah, we go to the expos and we go to the whatever. But it's kind of a mixed bag of people. It's not really what I'm looking for. I'd rather have sophisticated conversations with my colleagues. Okay. And we don't really use their library of stuff because, quite frankly, I'm a better Googler than all of this stuff, and I can find it on my own. And. Well, what do you pay for then? Sanity checks?
• 22:27
  Speaker B: What do I pay for?
• 22:28
  Speaker A: No, no, no. I'm just saying I asked them, like, what do you pay for Gartner for? Like, why are you guys paying for Gartner? I'm just saying for the people that pay for Gartner. And the reason what triggered this thought was too much risk to ebitda. How often do we make decisions in business based on fear and risk over the right decision or a better decision? Yeah, it might happen to be both. But I'm just asking, like, why is this example important? Why am I picking on Gartner here? I'm picking on Gartner because a lot of times people have told me we are with Gartner because we need to make defendable decisions. Not necessarily the right decision. We just need to be able to defend it.
• 23:07
  Speaker B: It's the idea of third party validation. And I've experienced this throughout my career. I'm sure you have, and I'm sure the listeners have as well. Where, oh, we're doing this. And here's what Gartner says. And Gartner's a trusted resource. It's not just me. Your CIO with 25 years of experience. And I remember working at one organization, we made a bunch of recommendations. The CFO and I worked together to present to the CEO. So he had two of his executives be like, this is the right thing to do. And he's like, I don't know. So they brought in, I don't know, McKinsey or RSM or someone to say, and we spent 25 grand on it. They took our materials, used 80 plus percent of it. And then the CEO goes, yeah, that's a great idea. We should do all these things. And the CFO and I looked at each other like, is this guy serious?
• 23:57
  Speaker A: I've had it happen.
• 23:58
  Speaker B: Yeah.
• 23:58
  Speaker A: And I'm like, I've had large firms, I mean, take my insight, no pun intended.
• 24:05
  Speaker B: Yeah.
• 24:06
  Speaker A: And repackage it as their own insight. Just kind of wild to me. And I was like, why not get all of the defendable decisions that you need and also the right one at the same time? I was just like, you can have both.
• 24:22
  Speaker B: And you don't need to spend 140 grand on Gartner. You don't need to spend 25 grand on RSL or whoever you bring in.
• 24:28
  Speaker A: They're going to bring in an entry level guy out of college anyways and put some butt in the seat for half the stuff. And then when I start to go deep into it, it becomes almost conspiracy level. It's like a triple dip model. It's like we're going to charge you and we're going to charge the vendors and then we're going to charge at the Expo also. So it's like crazy to me.
• 24:50
  Speaker B: It is.
• 24:50
  Speaker A: Okay, make a prediction. Eighteen months from now, what will everyone be talking about that they're ignoring today?
• 24:57
  Speaker B: I like this one. And you know, I think people would think, oh, you're going to say AI and going to do something different. I think people are going to be talking about how security is not needed in the way it is now. And this is what I mean. The idea of total quality management happened in like the 80s and 90s and so the quality profession went from being this standalone thing and it just became what you did. And I think security is going to go the same way where it's going to start to wane, meaning businesses are going to really realize that's what they just have to do. And it's going to become an operational concern where as long as you're blocking and tackling and doing the basic stuff, and with more CIOs coming up with security mindsets versus availability mindsets, they're going to own the technical piece of it, but the risk management is going to become operationalized. I think that's what we're going to be talking about more of is, hey, security is just what we're doing and CISOs and those levels are starting to potentially wane. Unless you're in a very specialized industry. Like there are still cheap quality officers in certain organizations, but a lot of them just have directors that report in on operations to make sure that they're checking boxes that are needed. Because quality is just what you do in a lot of manufacturing, a lot of healthcare, et cetera.
• 26:27
  Speaker A: Let's Break that down because I'd like to go back to the 90s because I was in high school when I graduated in 95 and I remained 386 in the 90s. Please tell me or enlighten me as to. We weren't in quality before that. What was this like industrial revolution of changes that happened in the 90s?
• 26:46
  Speaker B: All right, so we actually gotta go all the way back to like 1915 for this. So 1915 quality became this like mathematical standardized thing that you could do. And then Demian kind of picked this up in like the 50s as it became more popular and then went to Japan with it and then he spent 20 years there. And in the 70s America realized Japan was kicking their in car manufacturing.
• 27:10
  Speaker A: Yeah.
• 27:11
  Speaker B: And so then America decided we got to do something. And so then you saw the Six Sigma revolution with Motorola in the 80s and the big pickup. And then people were talking a lot about quality and we got to do this, we got to make things better. And then in the 90s, it started to wane. Not necessarily that it went away, but it became more of what you did.
• 27:33
  Speaker A: So just based out of curiosity, are you telling me before we were making pickup trucks all randomly that just like some were good, some were bad, it just wasn't efficient?
• 27:43
  Speaker B: Yeah, I think it just the efficiencies that quality brought in were doing quality at the end caused bad product. And so when you integrated quality into the process, it became what you did. Like even DevSecOps. Right. People talk about, oh, DevSecOps, the latest, greatest new thing. And I was like, you're talking about it's a quality process. If you embed security throughout the operations and the development cycle, your end product is secure, just like you have quality. Quality throughout the process leads to a quality product at the end.
• 28:21
  Speaker A: So your prediction is going to be we're not going to need CISOs anymore because it's just going to be standard operating procedure.
• 28:27
  Speaker B: That's my prediction. I think that's where it's going. And the idea of total security management is about a 20 year old idea. But that's kind of what happened with quality. Quality started 1950 and it took a while to catch on. 1950s, Deming took off with it. So is it going to be a product?
• 28:41
  Speaker A: Is it going to be like a crowd strike on steroids? What is it? What's it going to be? Is it going to be a bunch of different bolt on things that people just do? It's going to be like email or something. We don't need someone to Implement email anymore because we just buy it.
• 28:52
  Speaker B: Right. I think as a service, folks are definitely going to have a play in it. More of what we do. Yeah. I think it's just going to start becoming more of an operation.
• 29:03
  Speaker A: Top three security vendors, what are they?
• 29:05
  Speaker B: All right, I really like Okta and what they're doing. I think identity is so key to the entire ecosystem. They were just doing sso, now they're doing more cloud, brokerage, et cetera. So in the identity space, I've got experience with Okta. I really like what they're doing there. If I have to name names. CrowdStrike's doing some really cool stuff on EDR, MDR, the SIM, bringing it all together, the kill chain on the callback home. That's some great things.
• 29:33
  Speaker A: Doesn't have to be a product either. It actually could be like person, believe it or not, could be like. Because there's like security training. Right?
• 29:40
  Speaker B: Like, so, okay, I'm gonna call person. Since you mentioned it, Andrew Hoog from now Secure in the mobile app space, I think is absolutely brilliant in the space. And I've seen Andrew present and he's like, so this cool, fun app, this free game, everyone's like, yeah. He's like, look at how much data is leaking out of this. And you're like, oh, brilliant. So you mentioned, when you say a person. Yeah, that's who comes to mind.
• 30:08
  Speaker A: For years I didn't get into security or I didn't. Let's just play. I didn't play in the sandbox as much because I figured, no, security is for security guys. And that was a mistake because what I realized is there's a lot of people disguising themselves as security companies. They love to talk security. They love to talk. I don't even want to say, like, theory or what do we want to call it? Be very subjective, not objective. But what I find is that there's a lot of people that are kind of like, insecurity, being insecure. And I don't know if it's. Let me give you a perfect example. I had to help evaluate a bunch of MSSPs. Okay. And when I started really breaking it down, terms and conditions seem sag, whatever, edr, all of these different things. Right. And then what really matters in security? Like, what's like, kind of like the end goal for your company, especially in healthcare, like, what's the main goal? So pretty much to not get screwed.
• 31:13
  Speaker B: Yeah.
• 31:14
  Speaker A: I mean, I don't know what. What would the answer be? Like, what? I need to hire a security Guy. Why? What's the main reason?
• 31:20
  Speaker B: Yeah, I think the biggest fear factor, especially in healthcare, is a confidentiality loss in a HIPAA issue challenge. And actually, so I have this diagram where around six key business metrics in which industries care more about which ones. And healthcare is usually around these three. Confidentiality of data, impact to financials, and a people impact or people score, meaning can doctors get access to the information that they need or can patients get access to their information that they need? Of the six are. Those are their three main. Now, the next one that people care about is integrity of the data. Because if something should happen, and actually we've seen this before, right. Left leg versus right leg type of issue, people writing with marker on their legs. Not this one, this leg. You see some of those.
• 32:16
  Speaker A: I actually have a friend, a very close friend. I'm not kidding you. They replaced his wrong hip.
• 32:23
  Speaker B: Right.
• 32:24
  Speaker A: They literally replaced the wrong hip. How bad that is like the worst.
• 32:31
  Speaker B: Literally.
• 32:32
  Speaker A: They had to use a marker. How did you get that one wrong?
• 32:35
  Speaker B: Yeah, I don't know. So crazy. Now, other orgs, for instance, telecom, they're going to care about availability, they're going to care about reputation, and then they're going to care about either finance or integrity of data. Because integrity of data and accuracy of data is related directly to billing. When you look at like data usage and phone calls and all the things that they charge for, I'd say it's
• 33:01
  Speaker A: financial because if you're a really heavy telecom user, then when you go down. I have some very large clients that if phones go down, they lose 20, $40,000.
• 33:13
  Speaker B: Yeah. But their biggest things are availability of systems and reputation.
• 33:18
  Speaker A: Yeah.
• 33:18
  Speaker B: Because if it's not up, it doesn't work. And if there's a bad reputation, you're just going to change carriers.
• 33:23
  Speaker A: It's customer experience. Customer experience. Oh, you're saying telecom as in like the actual telecom provider. Okay, I thought you were talking more telecom. From a CTO's perspective, telecom, he's a street.
• 33:34
  Speaker B: That's.
• 33:36
  Speaker A: Yes, yes.
• 33:38
  Speaker B: Now, education.
• 33:38
  Speaker A: Tell it. No one can.
• 33:39
  Speaker B: It's.
• 33:40
  Speaker A: When it comes to the actual telecom carriers, though, I think they're still in third or fourth place for worst customer service in the industry.
• 33:47
  Speaker B: Now, education, what they're going to care about is any direct impact of finances because this is like number one concern. Then it's student data confidentiality and availability. Are systems up and running so that we can teach kids. So, I mean, it's an interesting graphic.
• 34:04
  Speaker A: I love how you broke it down because you took something that again, you made me look like the dumb guy in the room that was not gonna say anything unless you talk to me one on one. Bringing this full circle. Now do you see how we're doing this? Bring this full circle. And you said, well no, it's really not about being hacked. It's not about a ransomware attack, it's not about the boogeyman. It's really about data loss, financial loss, and actually being able to provide a level of service to our patients so that they can access valuable medical information without it being like pulling teeth. No pun intended. Yeah, I love it, it's solid. So what I'm finding however, is that there's a lot of selling of security from the standpoint of it might actually be fud, might be fear, uncertainty, desire. It might be like there's a lot of talk about incident response, but they don't love to talk about remediation. So I find that there's the classic 8020 rule is that you've got a lot of vendors out there that are really good at response. They're going to talk to you about response. We will let you know alerts, we will do this, we will do that. But who's actually doing the remediation? Do you find that there's an imbalance like that where there's a few really, really good people that do remediation?
• 35:24
  Speaker B: I think so. Right now we're onboarding a vendor and I'm like, this is great, we're getting all this info in, but who's doing anything with it? Yeah, that was the first questions I asked. It's like, is it you vendor? Is it my team?
• 35:40
  Speaker A: Oh no, no, no, no, no. If you look on page seven of the fine print, no, no, no, we'll charge you.
• 35:47
  Speaker B: Right? And so it's like I need to understand, like, hey, I love the information but who's doing what when? We got to make sure that that's clear. Like, oh, we have automated tools. We try and do this and then we reach in and if we can't, we'll contact you. Oh, okay.
• 36:03
  Speaker A: But if it's on a Saturday at 2 o' clock in the morning, that's additional.
• 36:07
  Speaker B: That's additional, right? Yeah. This is these like standard hours. I'm like, but we're open till 10pm well, five to ten. That's beyond.
• 36:16
  Speaker A: We're going to get hacked though, at two o' clock in the morning. Again, fear back to the hacker thing. Like that's when it's going to happen.
• 36:21
  Speaker B: That's where you.
• 36:22
  Speaker A: I just didn't know. I mean, so that's when I kind of got hooked and I kind of was like, wow, this is really amazing. This is why people kind of just love to talk about all this stuff. And then so I started grabbing all the top scanning tools and stuff like this and started playing around. And they're coming back at D's and F's and like all kinds of blatant gaps. Like, what's your security strategy? What do you guys do? Oh, he's Arctic Wolf. Do you notice that? Is it like we're paying a bill? And when I talk to everyone, it's like they help us check the box. I mean, this is a story that we've talked about and this is an old thing, but they help us check the box. From a data loss, getting sued, HIPAA compliance policy checkbox thing.
• 37:07
  Speaker B: Well, I think it's that careful business balance that we all have to have of how much are we willing to to spend and do to what level of security. So it starts with a risk appetite discussion and then how far are we willing to go to get that risk appetite to something where we're willing to just go, yeah, we'll eat that. And some of it comes down to how it's displayed. And I did an interview with another group, it's on YouTube that talks about the ROI of security or the ROI of technology when it comes to risk by using contingent liabilities. That's an accounting concept that where it's measurable or estimatable and you have the likelihood. And at a certain point you should put that on a liability line because it's potentially going to happen. Now, depending on which accounting method, Gap will say, well, you can just make a disclosure note. You don't actually have to disclose, you don't have to accrue for it. Isma, the international standard will say, well, if you can estimate it and you have the likelihood, you should put that on there. And if it happens, you now have the dollars set aside. And if it doesn't happen, it becomes retained earnings plan goes from net income to the bottom line right on the income statement. So there's different ways to do it. It's finding the discussion point and having those chats. Too many people are focused on, oh, I rolled out these technologies, I'm doing these things, but they're not having the business conversations. So going back to what do people care about? I found the graphic that I was talking about. So Rick, we talked about healthcare, right? So confidentiality, human resources, that's the people. And then gold, that's finance. That's what they tend to care about and that's who cares about those things. General counsel and the human resource officer. And then you start to bring in finance and operations. But on retail, it's reputation of the organization. Is the store open and are we having lots of fines like think Target.
• 39:03
  Speaker A: Right.
• 39:03
  Speaker B: Like that's where they are manufacturing confidentiality. We've got proprietary information how to build our product. Are people able to work? Can they do it? Can they get to the information they need? And then I need my reports, I need my orders to be accurate and correct so I can ship on time. The other things like we'll deal with that. But these are my focuses now. We always talk about the triad of CIA. So it's like here's your zone. Are you balancing these six key business type of metrics as it relates to our program? And all of our IT metrics can be related back to one or six of these. Ransomware that impacts finances, confidentiality and people's ability to work. That's like right here. That's why healthcare gets hit so hard on ransomware. And you think about what are the statistics.
• 39:54
  Speaker A: As I heard it's some ridiculous high percentage that it's like well over 60% that healthcare organization will get hit with some sort of security breach.
• 40:02
  Speaker B: I, I don't know the number off top of my head, but yeah, I
• 40:05
  Speaker A: was trying to find it while I'm watching this. I need to find this crazy percentage at the same time. Keep going. This is gold.
• 40:11
  Speaker B: Yeah. So other businesses we talked about telecom, right. Like what's character to your reputation? Availability. And again your reporting for billing, et cetera. Not that they don't care about losing people's data, but when it's a decision point of well, we can patch this but it's going to take down the network or we're going to have this availability question. It's like careful balance.
• 40:33
  Speaker A: I found 67%. 60, 67% of healthcare orgs were hit by ransomware in 2024. I think it's believable.
• 40:42
  Speaker B: Unbelievable hit by something. So I worked with a CISO in the finance world and so finance is availability, finance and confidentiality. But one of the things their leadership really glommed onto was when they started relating things to the impact to people when their traders were impacted by their MFA rollout and when they said what we're going to do for the traders is if they're inside our network, on our facility, on our computers, we're going to limit MFA to once or twice A day so that those guys were not slowed down. Even if it's 10 seconds to press a button on their phone, that could be a million dollars. So they're saying limit, be smart about the traders. And when they showed that they were considering the impact of people, it helped their conversation so much because that's what they were really concerned about. Can I get these high powered people to make money? System's gotta be up and are we not bleeding money? So yeah, it's yeah.
• 41:43
  Speaker A: Because in that particular scenario they would be if they didn't have that conversation. That could go really wrong. That would really upset some people.
• 41:52
  Speaker B: That's just a way that I like to think about things and bring it back to the business. And none of that is it speak. I mean maybe CIA a little bit. But like people get it. When I say confidentiality of data, availability of systems and then when you quickly explain integrity as more of accuracy and is it the right thing? Then they're like oh yeah, totally get that. Let's balance that out amongst our financial impact, our people impact and our reputation impact.
• 42:15
  Speaker A: So this is very helpful. We got totally lost from the first three steps. I remember we were on some steps back in the day and oh yeah,
• 42:23
  Speaker B: I said one, let's learn the business. Right. Two is even with respect to technology, it's not just a security thing, but understand the risk appetite because it's like I've been asked a lot of times even from a technical perspective of like, do we have to do this? Well, you don't have to do anything but we should do these things because of impact to the business and how we operate. Like we have 12 year old computers, do we have to replace them? Well no, but from an availability and productivity perspective I highly recommend it. Like yes, we should replace them. It's those types of disk that's not a security concern necessarily. It's because everything's updated in cache but like it's old and it's gonna fail and you're gonna be down and then you replace and you're like oh it's so much better won't. Yes, how about that? So I think it's finding that out and what it's going to be. And then I think lastly is finding out what is it's role in the organization, what is the expectation of the group. And a lot of it is provide the technology. We just want it to work. And so you're a sidebar. But I think if you can shift to being a service organization, we're here to help. We want to work with you, and you start having those conversations and building the trust, people will actually come to you more and look for solutions than just a laptop.
• 43:44
  Speaker A: I want to ask you, if you could get the C suite to hear loud and clear from it, what would it be? But I almost feel like the better question is, what's one lesson every emerging IT leader should know? If you want to answer both of them, go ahead.
• 44:00
  Speaker B: I think the answer to the second question is the one thing that every an emerging leader needs to be is you will not go far if you sit behind your desk. You gotta get out and talk to people, build relationships. Because everything that you want or need to do is about the relationships you have with your stakeholders.
• 44:21
  Speaker A: It's all about them.
• 44:22
  Speaker B: The C suite piece is. It is in your business to help move you forward, just like the engine room is pushing the submarine forward. That's why they're here. We're here to help push you forward. You just gotta let us do it.
• 44:40
  Speaker A: Okay, Is there a disconnect between bad leadership and leadership telling it what they need to do? Is IT leadership telling it what they need to do, or is it IT leadership telling it the problem we're trying to solve?
• 44:54
  Speaker B: IT leadership needs to go to their teams and provide that vision and mission to achieve the business objectives. So the IT leader needs to be able to speak both to their teams, but also to their executive teams and peers. You have to be able to translate in both directions.
• 45:14
  Speaker A: So, final question.
• 45:16
  Speaker B: All right.
• 45:16
  Speaker A: And then I haven't asked you what your first computer was, but how'd you get started in this whole thing? How'd you get to where you are? Because this may be one of the best. And I know I could just ask you for frameworks all day long and you would give them, like, some of the frameworks that you gave me for the. Just the data loss, financial loss when the people score access. I mean, being able to break down security like that is very, very helpful for people. Like, I don't think they could break it down like that is just priceless. Anyways, how did you get here? How did this whole thing start? What was your first computer? Did you play around with computers as a kid or No?
• 45:52
  Speaker B: I did a little bit. I got, like, my first. I think it was like an old refurbished 2.86pos white box thing that, like, I could type on. And my uncle was in it, and so he ended up hooking me up with a laptop and a 144 PCMCIA modem and then began down that path.
• 46:14
  Speaker A: When did you Graduate high school in 92.
• 46:17
  Speaker B: No later 90s. Yeah.
• 46:20
  Speaker A: So.
• 46:20
  Speaker B: But then I went to the Navy, and then when I came back, I was like, I like math and I've liked all the science stuff I was doing. I'm going to be a math teacher. And while I was in school, I realized I wasn't going to be a math teacher because you don't actually teach. You do lots of letters home. And it was just because I was doing my observations and like, the teachers were writing more letters home and versus spending time, lesson planning and teaching. I'm like, no more. I'll teach college all day long. You want to show up, Grace? You don't want to show up. You're an adult. Yeah.
• 46:48
  Speaker A: You paid the bill.
• 46:50
  Speaker B: Yeah. So my buddy was like, hey, you're kind of good with computers. We can like do a little business thing. And so we were doing some field service work, and then I got some certs and it was just one of those things of like, oh, I'm good at this and people will give me money for it. Why not? And that's how it was over time. Ended up doing some bench work and then got into field service and then corporate IT eventually. And security was by happenstance, we had a stable infrastructure at my business unit. And corporate security put out a call that was like, hey, we need some help. Does anyone have some bandwidth? And my controller was like, my guy does. And so they said, cool, here's our global pen test. Reach out to everyone and find out who's remediating it. I'm like, okay. So that was my first foray into infosec, and 80% of the people didn't do remediation. And so then it was like, reach out to all of them, get them to fix their stuff, and then generate the report for the cio. And I was like, okay, sure.
• 47:49
  Speaker A: That's pretty wild.
• 47:51
  Speaker B: Yeah.
• 47:52
  Speaker A: This has been a pleasure. Let's end with this.
• 47:55
  Speaker B: All right.
• 47:55
  Speaker A: If you had to have like a universal framework that we could just plug in different names for, but they're basically the same themes. So when we talked about selling security, not literally selling it, but selling security to the board without it being a fear, doom and gloom thing and removing the negative barriers, you talked about data loss, financial loss, and your people score. Right. And then when it was telecom, it was availability, reputation, financial, whatever, that's where I got that. Is there a framework for everyone out there listening that they can use? Well, we just got to fill in the blanks for selling it or even a hardware sale. The Security budget to the executive boardroom so that they will say aha and actually raise their eyes and maybe ask a question.
• 48:45
  Speaker B: Yeah. So that, like, swirl chart that I showed uses a method that I developed called the Chicago Metrics or Chicago Framework, because that's what the metric sick stand for. But there, my research that I did my dissertation on really simply showed that the metrics don't matter, but what matters is the connection and the story that you tell. So the framework, as long as people don't dismiss it as garbage. So if you use nist, you can use NIST CSF to tell your story. You can use any framework. I mean, if you pull metrics from fair, if you use this stuff that Doug Hubbard and Richard Searson put together, it's all valid. But what you do with it and how you present it and that relationship, that's what they want to know. I had a recent discussion with someone and they're like, look, what the board wants is to know that they're in good hands because they have exposure legally based on the caremark standard in 96 and the stone precedent set in 06, that they have to know about risk and do something about it. And as long as they know that you have their back, you can get the resources you need so that you can protect them as well. So is there one framework? Well, the framework is trust and reliability and getting them to understand that you're on their side.
• 50:18
  Speaker A: I think what you did very, very well was be able to take something from when you said tell a story and correct me if I'm wrong, what I got from you is that you're able to first from your three steps, first take the organizational context, so to speak, how does this apply to how we produce pumps? And then talk about how this affects what our risk engagement is or our risk score. But how does that affect our assets and maybe data leak? And how are you guys going to. We need to do this. We need to monitor and we need to put these things in place so that we don't have any adverse monetary seepage or loss. But what do we do when something does happen? So that's the last piece. Maybe this is the last piece. The last piece is what do we do when something bad does happen? And they say, well, you said we were going to be ready for this, so how do we prepare for the inevitable?
• 51:16
  Speaker B: So have a playbook, stay calm and follow the playbook. Part of that too is drilling and exercising on was what, when I was interviewing for this World, they said, when you have an incident what is, how do you get through it? And I was like, you stay ridiculously calm because you can't fight a fire if you're panicked. And so have a playbook, test it, follow it. And if you've done it, tested it and followed it, you can remediate, contain, and continue to fight the ship. And that's, that's something like I learned in the Navy. I mean, even when I was in training and not even on the boat, but actually at our prototype facility, like we did the same drills in the event that something should happen.
• 52:01
  Speaker A: Were you on a sub or a ship? Like when you say ship, that could be a sub. Were you on a sub?
• 52:05
  Speaker B: Yeah, I did a brief cruise with the Maryland.
• 52:08
  Speaker A: I don't understand. There so many guys that have been on this show were Navy submarine guys
• 52:15
  Speaker B: because we're all nuts. I don't know.
• 52:16
  Speaker A: Some had fires down below. That's crazy.
• 52:18
  Speaker B: That's crazy story, right? And so if you panic, everyone dies. So you stay calm, but you drill that stuff non stop. So it's all second nature. I mean, you said, you said you trained martial arts, right? Like eventually you just start to feel it and you can just react. Someone moves a knee or they create that inch of space because they lifted their shoulder off your chest, it lets you shrimp out. Right. But unless you've been training and used to, it changes the flow.
• 52:45
  Speaker A: Yeah, so. Absolutely. And people don't train under pressure as well. If you're not used to being completely suffocated in, in small spaces, rolling around with sweaty guys. And that can be, that can be mind blogging. Your mind might be somewhere else.
• 52:59
  Speaker B: Absolutely. Like I last night we were training and I was setting up someone for an Americana. I was on mount and I like almost had it. And they were so focused on the arm, they weren't paying attention to the legs. And so it's your preparation, it's your tabletop exercises, it's your live fire exercises. It's getting the team ready to respond to those things in a calm manner. And hopefully you never have to use it, but sometimes you do.
• 53:28
  Speaker A: Super awesome. Any final words to anyone out there listening? That's in it. New people, old people. Any final words?
• 53:35
  Speaker B: Learn the business. It'll help you go bigger and further. And don't sit behind your desk.
• 53:40
  Speaker A: Edward Machuca, you've been heard. Thank you.
• 53:43
  Speaker B: Thanks. Appreciate it.