Latest / You've Been Heard / 466- Talk Business First, Then Tech w/Fletus Poston III

Transcript

466- Talk Business First, Then Tech w/Fletus Poston III · You've Been Heard

0:00
Speaker A: I sit in a lot of peer groups and I have been told by many board members and senior leaders, your deputy CISO will never be CISO because we see him as an operational leader. I have to now be bilingual in the sense that I talk business first and then I introduce tech because your CISOs, your C levels are now being invited to the room and your C suite doesn't need to know that you're blocking and tackling with firewall rules. They want to know what is my return on my investment. If I don't have compassion, empathy for the individuals I'm working with and securing, I will lose my voice at the table.
0:47
Speaker B: Welcome to the show, man. Everybody, Flea is posting the third, so why don't we start out this way? Give us an introduction. How did you get started out in the technology world? What was your first piece of technology that got you hooked and I don't know, made you fall in love with fixing everyone else's problems?
1:06
Speaker A: Sure. So I have been doing this, let's see, officially since 2006. Prior to that I tinkered, did some small IT stuff like anyone else. Yeah, our first computer was, ooh, Commodore 64. There we go with that. Played with floppy disk for the first time. I think it was 30 some floppy disk to install Windows. So you can see very quickly everyone else played the five and a quarter organ trail, continued to dive malaria like everyone else. But it was probably in middle school, high school when they actually put computers in our school, which dates me a little bit. But I was like, these are going to grow, these are going to be important. So I started taking more classes where I could get my hands on a computer. In high school I started doing IT support, building web pages with front page and some other stuff. Figured out splash screens. That was back in MySpace days. HTML was popular. It was easy to build something with HTML. And then I went to Appalachian State where I picked up my bachelor's in information assurance or information systems. Took a intrusion detection part time role doing IDS work for a satellite security company. After that I went to Wachovia where I was an IT auditor, then went to Duke Energy where I worked the next 13 years doing IT service management, web app monitoring, electronic document management. When I was on that team is when I got the itch to do security again. So I picked up the identity and access management piece of their document management suite, supporting several hundred ad groups, dozens of process account service accounts, and then in 2016 I joined the security operations center for Duke Energy, helping build out their security engineering team. So I took the team from 5 to 15, then left them in 22, went to an endpoint backup and recovery after carve out built out their security program. When I left them in 24, I was their acting deputy CISO servicing AppSec, TVM, SecOps, et cetera. Now I serve as a director of IT and Cybersecurity for an additive 3D manufacturing company called 3D Systems. We print, we build and print 3D printers for commercial use.
3:17
Speaker B: And then I serve. I'm looking at some of your stuff right now on this.
3:20
Speaker A: I serve as an adjunct at Appalachian State, so hence the poll. Today I teach an AI business cybersecurity class for them as well as consulting with the SANS Institute, both on their commercial side and their edu side.
3:32
Speaker B: Super fun man. So teaching AI security on the side, I'm assuming you can almost build your own curriculum. It's kind of like what do we want to put in it and where do we begin? Because there's not a lot of that we have.
3:47
Speaker A: So just a little bit about that class. It's a semester long prototype. They're doing an order validation system so introduced into cloud code, they're running into a GitHub repo and using Google Colab. Those are the three pieces of technology they're using to build their prototype throughout the semester. The first half of the semester is AI for business. Second half of the semester is A for security. So they'll have their midterm this week and then next week they'll start securing that agent so they'll start implementing the security components where they've been building for the first half of the semester.
4:17
Speaker B: What's the prereqs for something like that? I can turn on a computer.
4:22
Speaker A: I mean yeah, pretty much they're business students. So the cybersecurity program at Appalachian State sits in the business school. So most of them are IT business students. So they're getting their mis cis whatever school you want to call it. Some of them are just taking it as a concentration. So they're a marketing, a finance major and they just know the AI is going to be part of their job. So they're taking this to understand. And then I have a few that are outside the school who were able to get in. They're a PolSci Communications who are just interested in learning what this is going to look like in their job when they get hired.
4:56
Speaker B: What's like what's day one look like there in that course? I'm just curious like what's the first week?
5:01
Speaker A: So we introduced this is Claude.
5:03
Speaker B: This is how you open up a command prompt.
5:05
Speaker A: I start at the top and say, this is what a business system is. So you've heard the term application. You turn the app, you know what, what you're looking at. So, and then we turn on, hey, here's what Claude code looks like. Here's Claude versus a chatbot. So they do a agent design document where they have to like think about what the agent wants. Then I give them a prompt engineering lab. They practice eight different prompts, adding different contexts, sensations, casualization, understanding the process. They turn those in and then they start developing. So I give them introduction of how to build a design document. How do you do prompt engineering? Because prompting is important in AI. And then they start to build. So that first two weeks is just what is business systems? What is Claude code? Or Claude and cloud code. And then by week three, they're setting up their GitHub and they're deploying code.
5:53
Speaker B: I have a few developer friends, believe it or not, and they really to get like real deep in on the philosophy of just like, of the. You building out the project before you touch anything. Kind of the whole like, what's your thoughts there? Like, how do you guys go about that before you even.
6:11
Speaker A: That is a hot topic, both academic and professionally. I, for people who followed anything, AppSec was something I picked up in my last role because we're a software development company. I learned very quickly the importance of plan, build, run, even as, even not just thinking from a security point of view. If you don't have a reference architecture, you don't have your data flow diagrams and you start writing code, you're pretty much, I use the analogy you've decided to put the trust on your house before you even built your foundation.
6:42
Speaker B: Can we just break that down a little bit just for like, for like nerdy times? Because we don't do that a lot. Can we just kind of just go through that a little bit? Because there's a lot of people out there that. And I say that because what I would love to do is if we had a section of the show where we could just be like, hey, we'll train your end users on how to use AI and we'll just cut out this part of the show and hey, give it to them how not to do something. In other words, really what we're saying is how to do something. But most people probably just get down and be like, hey, look what I built today. And then it doesn't last because it's going to break once you start layering different things on top and calling for different APIs or whatever.
7:16
Speaker A: But yeah, so I'll roll it back. We always say shift left. So the more business you can put into your app, the better it's going to be. So that's where I'm talking about the design document. This is your plain English use cases. What is my use case? 1. How do I understand success? What is the success criteria? Building on the success criteria. Next part is how do I validate that success criteria? And then you think about later on, do I want to integrate something? Is this going to just run locally on my laptop? Will this ever be deployed? Will it to a software as a service? So think of something you log into in your browser. Is it going to need the API that you were talking about? Is it going to need a database access? Is it going to need data that's not coming from the end user? So that's your design document. You want to be able to say, I'm building something. Think of it like the blueprints of your house. You're not going to put the toilet in your kitchen. I hope not. You're not going to put your bedroom in the basement, unless you just want to live in the basement. You're going to design your house in a flow that someone who walks into your house natively knows. Okay, the bathroom should be here natively, the kitchen should be here. And then if I had a set of stairs, I want to make sure the stairs go up, not down to something unless you have to go down. So, so design Doc, that's one. The next one is deciding what language you want to be in. Most developers, and at least if you're using cloud, it's going to be Python. Can you support Python? Do you have engineers on your team or developers on your team or infrastructure on your team who can support that? Because citizen development is you and I, that's any of us who open up AI and start prompting, say, build me something. After that you need to be able to hand it off to an architect or a site reliability engineer or software engineer and say, read my code, tell me what my glaring weaknesses are and then have an application security review of. Here's my glaring security issues. So if you don't have those, don't deploy your code unless you've had someone review that for you. You can ask Claude Grok OpenAI to be that, but you also want to have a human validated. That's the human in the loop piece of anything we design. And it's important from an it and a security point of view and we
9:24
Speaker B: have to say that so that everyone keeps a job. We can't just eliminate everyone.
9:27
Speaker A: So far with AI, I'm totally fine with live coding the term for something personal. Use your personal agent. We just had a student who's trying to learn Mandarin. So she built a Python based thing to do virtual flashcards for to help her learn Mandarin. She did this all on her own.
9:45
Speaker B: Mm.
9:46
Speaker A: It's a self taught project because she wants to learn Mandarin because she wants to study abroad in herself Mandarin by using a Vibe coded citizen development app to help her to do study.
9:57
Speaker B: I love language learning. I would love to see what how. I would love to see how she did that and what what she was doing as far as the flashcards to help her memorize better. Anywho. Sorry.
10:08
Speaker A: Yeah, it's fun when you start seeing people's development products like again, you and I can date ourselves a little bit. We googled everything, we banged it. Now we just go to YouTube to learn how to do something. Now you can have your agent teach you to do something. Hey, ask me a question about this. Ask me again until I know it. Hey, ask me a third time to make sure I actually know. It's the Fisher Price mindset, people. It's three colors. Can I explain something very simply and get it down to three? I didn't know that at that point. I know something, I can teach it. And teaching is another way to learn something. Always teach yourself or teach others if you want to become a subject matter expertise.
10:43
Speaker B: Once again, Fisher Price mindset. Never heard that before.
10:46
Speaker A: Three colors.
10:47
Speaker B: It's pretty sweet.
10:51
Speaker A: So I have to be careful with that one because I upset a C level when I said I'm going to give you my Fisher Price breakdown. And they thought I was talking about like the 0 to 3. I'm like, no, I'm just like you child.
10:59
Speaker B: Let me speak to you like a child.
11:00
Speaker A: Yeah, I was not saying you were a child.
11:03
Speaker B: Any frameworks there that, that you like to use as far as outlining stuff like that? And, and I guess this is probably way above what you would teach like an end user. Like if you were to go into a company and, and teach. I'll answer the framework thing. But if you, after that, if you were to go into a company and teach your end users AI, where would you start and where do you think it would be really useful?
11:23
Speaker A: So I think to be frank, it goes back to the acceptable use. Are you allowed to put this data in here? Is this data you should put in here and do you know how to manage this data once you put it in there? Because most of our models, unless you're running a local model, is a shared model. They're open, they're, they're not something that you want to just freely put your personal information and your healthcare data in your financial data. Analysts, you know, you've got. So that's how I would tell an end user. I've started reviewing frameworks. NIST has put some stuff out. Mitre's got some new AI based capabilities that they've put out. The cloud security alliance is starting to come out. I don't think anyone's truly got there. I think 47,100 is the closest I've seen and I don't even, I haven't read it in a while to see what they've done to it. But I know NIST has added some stuff and their risk management framework around it because the end of the day AI is just a risk. Just like AI where it's all about risk management. How do I mitigate my blast radius? How do I mitigate and control the risk of data loss, data leakage and then how do I make sure that if something does happen I can protect, defend and respond?
12:34
Speaker B: So I guess last question in this one is any, any, any useful tools or scanning tools as of as of recently maybe SaaS products or something to actually. Because acceptable use is one thing but then whether people actually care is another thing. And I think people are going to be using AI. I guess it's maybe just my glass half empty approach on human beings and the 8020 rule. And 20% of humans are like, you know, high quality individuals and the rest are 80% are kind of just going to do whatever to get by and say screw it. And then there's always like the bottom 10% or just don't give a crap at all. And they, you know, they're like the, probably the biggest risk factor in the company. So yeah, what do you do about them and what's the, what are some of the best ways to. I guess as of recently people are asking me like what's the best scanning tool for here? And I'm like I don't know. Cato Networks has a really good SaaS
13:24
Speaker A: product and I will be completely transparent. I have got, I haven't got that far. Like I have started talking with vendors I could probably name drop 15 but I will not tell you that they're valid at this yet. I will say for the most part right now, go back to your basics of SAS and dast understand your dependency checks. If you've got GitHub, GitLab or whoever you're using, make sure that whatever you're calling is fine. Don't put a vulnerable piece of software unless you've got a run component to update it with APT or whatever you're using RPM package updates early on, which is the infrastructure of code component. We don't have to go that deep that you're updating it. And second pin it so you don't get into the supply chain attacks. AI is very vulnerable to a supply chain attack. If I don't pin a certain version and you automatically upgrade it to the latest version, I could introduce malware or I could introduce code injection into the agent process because we've had Sahalud and other supply chain attacks where I'm going to compromise the supply chain of your agent. And this is not just AI agents, this is any agent. Once you deploy an AI agent, you've kind of lost some control of it. Unless you're continuously putting it back into a box and doing access reviews, identity, lifecycle reviews. Making sure that you run it with a service account or non human identity and not Fletus account is another one to keep you protected. But you ask the tool question. I'm still having active conversations with dozens of vendors weekly trying to figure out who's going to be the leader in this. But today if you've got a SAS DAST SCA tool, they can help you with the agent you're building. But you have to get your citizen developers to load that code into GitLab, GitHub so that you can run those actions against it.
15:06
Speaker B: So beautiful answer. And I guess what we have just demonstrated, we have just demonstrated how not to speak to the board of directors and we have just put them. We did that on purpose at the beginning of this podcast that they would all leave and that now we can speak openly. You can speak openly. Openly about the rest of the C suite.
15:31
Speaker A: I'm just looking at something by sea levels. I have a whole different presentation to do this.
15:37
Speaker B: Let's make a promise that or I want to promise from you that everyone listening to this episode today is going to walk away with your awesome whatever that is. If you had to help alleviate some of these stress and or depression or insecurities, really hard days around the role of being a CTO or cio, IT director, IT manager, VP of it, all of those, what would be like the one thing that you taught that you came up that everyone would Just be no head down, just taking notes the whole time. Or they would be head down taking notes the whole time. What would you teach? What would be the one thing that's just really, really valuable that is like a value, I guess a value set in your role of being a technology leader.
16:28
Speaker A: The shift has happened and I think you're alluding to this from our pre banter that I did with one of your colleagues is I have to now be bilingual in the sense that I talk business first and then I introduce tech because your CISOs, your C levels are now being invited to the room and your C suite doesn't need to know that you're blocking and tackling with firewall rules, that you've got a security orchestration automation response tool called a soar in place to do remediation. They want to know what is my return on my investment, what is my total cost of ownership, my tco. They want to know is this going to impact my ebitda? So your debt to loss ratio to what you're making. And then do I need to be scared about my board meeting next week or the earnings call I have? Or is the analyst going to ask me a question that I can't answer? You never want to bring in a large deck. You come in with three to five slides, you're going to cover one, maybe two if you're lucky, unless they give you more than 15 minutes to get past it. You do not want to bore them with numbers unless the numbers will go back to the return on your investment, your total cost of ownership and how it's going to impact your bottom line if you're publicly traded or private so that your stock price can increase. Or if you're a private equity firm, your PE firm is happy with your quarterly earnings and if you're a VC firm that they continue to give you that series A, B, C funding so that you can stay afloat until you either go public with an IPO or you get sold.
17:57
Speaker B: I really, really, really like that last piece that you said which was the. So that they're not afraid going into a meeting, not knowing what they're talking about or not being prepared. That's because that's kind of a large. That could be anything. So how do you prepare your board to be able to speak tech even though they don't or answer unheard of questions?
18:23
Speaker A: The best thing is to have an open line with them. So we meet with our CFO quarterly knowing that the board is semi annually so she has what she needs, she can ask Whatever question she wants, we answer it as concisely as we want. Or she wants us to go into technical details, we do, and then we feed our information. So we give her an appendix that she can reference, we give her quick notes, we make sure that she has the data she has. And then she can call in my ciso, my CI, come in, I'm sitting behind both of them. I can come behind them and give them data and then. But in those other meetings, I'm in those calls having the technical conversations with her so that she can ask the question, hey, that resonated. But now how do I explain it this way? If I get this question about it, what is our response like? Do we have detection? Do we have protection? Can we respond to it? Because every company today is either going to be attacked directly or indirectly. We can pick on target again, it was their H Vac company who came in. We can pick on an executive assistant who gets a weaponized PDF because she's ordering lunch for the board or the ELT executive leadership team. It's not real. They're not attacking the company. They're attacking your provider. So they go after the Italian restaurant that you know the EA loves to order food from. Or you go out to your third and fourth partner. Hit the caterer, hit the cleaning crew, hit your H vac, hit your maintenance team, your law, your. Your lawn services, if they have ability to connect into your network. That's why segmentation is important. That's why you have guest accounts. That's why you do access reviews, both physically and software. So do I know your background check of who I'm letting come into my building? Especially if you've got controlled spaces. So it all comes down to that.
20:06
Speaker B: So is there your own framework around translating your environment into tco, ebitda, flow through profits? How we any of that stuff that's driving business to the bottom line?
20:23
Speaker A: So that's the trickiest problem. I alluded that we're a risk management company, but most owners still see us as a call center. So it's that conversation of I need you to spend $1 million to save you 9 million. I have to be able to show the math that you spending 1 million today will save you 9 million if and when this happens. That is hard math to do. That is what we in risk management of quantitative versus qualitative metrics. So by doing that, you build risk registers and risk mapping. The risk register is where you do this. These are the five things that should keep the company up at night. And those are the five things you cover with your board, they don't have to be cyber. One could be a competitor, one could be a natural disaster. In a certain geolocation which we get most of our parts from or where our suppliers are coming from. Your people should be one of them. What are the key people in your organization that you need to keep happy and content? Because if you lose them or just
21:22
Speaker B: key man risk in general? Just key man risk. Yeah.
21:24
Speaker A: Just understanding those things and then you protect and you put money around those and then you put value propositions and then you put what controls you're putting in place. Whatever the control is, is it. I'm going to make sure that they're getting their training, I'm going to make sure that we have the hardening, we spend that renewal, we do that audit, we do that pen test, et cetera, and then you give that data back to them.
21:44
Speaker B: Let's go through some of those things that could be on the list.
21:46
Speaker A: Let's go through the.
21:47
Speaker B: Any of the things that could be on the keeping the CEO or business owners or board or whoever up at night. And I like that you said it doesn't necessarily have to be technology related, but the fact that you know that I think is might be one of the missing keys here that a lot of technology leaders don't have is they're just really not aware of how they can affect other areas of the business. Did I say that right? Is that clear enough?
22:12
Speaker A: When I worked at the regulated, regulated utility, we cared about storms, we cared about hurricanes. Yeah, hurricanes was one of our biggest concerns. Or a big ice storm, a big windstorm. Because most of the power here in the Carolinas is on poles. It's not buried well. It's heavy winds rip through poles. Heavy rains make trees fall down.
22:36
Speaker B: Yeah, hurricanes are bad.
22:38
Speaker A: The risk of that is to the business is now got customers out of power. The risk to the technology team is I may not be able to drive to my data center. I may not be able to get someone into the office. So I'm going to have to bring them all in. We're going to hunker down in a war room, stay at a local hotel that might be one or two blocks away so they can walk back and forth so that we can respond to the threat of us being in a degradated state. Because attackers like to attack companies when they know that there's a natural disaster or they come after you and I after a major event. You see the fake Red Cross, the fake Samaritan purse. That's what I'm there to protect is the fallout of the hurricane, the natural disaster or the geopolitical event to my organization. And that's what the board needs to know. You losing a fire in a data center makes us a bigger attack surface. You having flooding at your HQ and the press tells you that makes another attack surface. So being able to respond to the natural events to protect against the cyber events.
23:39
Speaker B: Few statistics here. CIOs assuming CISOs as well. CTOs who co own projects with business leaders hit their targets 71% of the time. That compares to 48% overall. What does that Business leadership. How do you co own this stuff with your leadership so that you're all on the same page?
24:02
Speaker A: So I got two major initiatives that's going on right now with this. We do a lot of healthcare based work so that's what I'll go with. So we work with the healthcare teams that support our healthcare customers trying to get some stuff across the line. So we go back to them, what is your success criteria? They define their success criteria. Then I define my security criteria. This is the security I have to have in place. And then we tell the business to say, okay, now if we implement those use cases, my security controls. What revenue do you have to get to justify the spend of this project? We put the math back on the table of I have to spend X, we have to do Y to get Z. And if Z doesn't make sense, you go back to the project board and you go back to your parking lot and you start redesigning it until the number actually makes sense. We all know some projects are going to come in the red. Maybe you take a red project because tomorrow is going to lead to a black project. You're going to get back in the black. But you shouldn't be taking all your red projects. That's why your companies lose too much money, your stock prices goes down or eventually people run away because they don't see profitability because you haven't forwarded enough. Thinking, okay, I got to get past today, I got to think about tomorrow. I use the healthcare now all the time. We have to triage. Someone walks in with a phishing email. That's different than someone walking in with a piece of malware. I have to talk with the malware first versus the phishing email. The phishing email is just a band aid. They just got the phishing or they didn't click on anything. I can just give you a band aid. That can wait a little bit. I've got an active piece of malware that's calling out to a command and control. I need to stop that. That's the person who's got a limb that's hanging that needs to be bandaged and stitched and.
25:36
Speaker B: Yeah. Yes. Why health care? So I think it was 2025. I can't imagine that it's changed much. I know that fines are up. Who's that? What's the big health care healthcare finding organization that's like fines are up like 300% or something. I can't off the top of my head, one in, I think it was 2025, like one in three healthcare institutions will be hit with ransomware. Like one in three. Does that not blow your mind?
26:03
Speaker A: Yes and no.
26:04
Speaker B: It blows my mind. Which means every three years you're done, you're going to get hit with something. My question I guess would be is for an industry that seemingly makes a lot of money, where's the gap? Why so why so targeted? Why so behind and would you say healthcare in general is behind the technology on lower on the technology ladder?
26:27
Speaker A: So it depends where in healthcare you're talking about. So let's pick a few right now. So your hospital.
26:33
Speaker B: Yes, hospitals. That's the first thing we think of. Yep.
26:35
Speaker A: Your major hospital is going to have some bleeding technology where the surgeons are working. You may be running some legacy technologies on your point of sale or your medical record. PCs that are rolled into the room, stationary in the room. And to be frank, because the surgeons are responding quickly or the lead doctors, those devices stay open. They're not always locked because they need to be able to quickly get in, get what they need and go in versus being stuck behind a biometric or physically typing in a password. You'll notice certain stations are left completely unlocked. Well, you move to a pediatrics or family healthcare, it's not as fast paced. I can lock that PC, I can put biometrics on it. There's not as much tech that has to grow so that mom and pop or that small family doctor pediatrician is probably going to run Windows 7 for a long time. Maybe get to Windows 10, maybe get to Windows 11. Just because they don't have the budget and they're not seen as this is an attack surface. Unless the big healthcare we'll just pick. I live here in the Carolinas. It's Atrium and Novant are the two bigger two here plus Atrium and Novant says you're going to do this as a standard to be in my network. Then they're not going to spend the money because they don't see that return on investment of upgrading from Win 7 to Windows 10 to Windows 11 where a hospital has to do certain things because they're in that billion dollar organization and they have to be able to turn that CT scanner on, they have to be able to get that X ray quickly, they have to be able to get that microscope or that laparoscopic event end to repair that person's knee who's open on the table or their heart valve quickly before they lose the patient. And to your point, with ransomware, I don't want to ever see the oxygen tank go off or the anesthesia drip stop mid surgery because of a ransomware attack and the person wake up or die.
28:28
Speaker B: Or the, I was going to say or the Elon Musk robot chip, you know, malfunctioning. Wouldn't want that.
28:34
Speaker A: I mean we had that. You think about the self driving cars, when they had the power outages, all the cars just stopped. Like they couldn't move. No power. They relied on power. The battery wasn't there. They couldn't talk to the network. So the cars just shut down and they locked the people inside the car. There wasn't a fell open. They couldn't get out of the car.
28:51
Speaker B: That's kind of wild.
28:52
Speaker A: That's a safety concern.
28:54
Speaker B: That's very bad.
28:55
Speaker A: Yeah, you want safety first. That's why we don't.
28:58
Speaker B: I never heard. I have not heard that story. So what happened where there's a bunch of people smashing windows?
29:02
Speaker A: No, they eventually opened up, but like it hard closed for I think it was like a minute and a half or two which made people panic and then it opened up. It didn't immediately open up. So think of it if there was a fire in the car or something bad. Yeah, I may have the numbers off, but they eventually did open because either they got battery to come back up and the electronics started back and they operated with their safety mechanisms. But that's the things you have to think about is when you have autonomous activities and ransomware is one of those things that could attack anything that's autonomous because there is no human in the loop anymore.
29:36
Speaker B: We have a bullet point to talk about. It's a very, very interesting bullet point. What does it look like when the CIO in the room has no voice and the people below him are the ones being heard? What does that mean?
29:48
Speaker A: Tricky situation. And I hope that people don't have to get in that situation because it's always sad when a C level is at the table but has no voice because they're invited to the meeting. So they're getting the notes, they're seeing their reactions, but they know or they feel like only their team is getting the voice because their team is actively out in the trenches or their team is actively meeting with the business leaders. Going back to your statistic earlier, I'm actually working with a business leader. My project's more successful. Sometimes your cio or we'll just put cxo, whatever C level your is maybe managing up too much. And they're not doing that east, west, or managing down. And that's when it gets tricky for an individual like myself who's got a team of 30 underneath me, one leader. The rest are indirects or a few are directs. How do I make sure they get the information they need to support the projects that I'm gonna have to report out on to that C level or his peers or her peers?
30:44
Speaker B: And so when it's. When it's going bad, what's happening, there's no. There's no communication of the business goals. And the rest of the team's seen as operations guys kicking the blinky lights on. And we love them. And there's just a big disconnect.
31:00
Speaker A: It's that or what's this? Well, I'm going to side with that C level for a moment. Maybe they had a voice at one point. Maybe they were always giving the update that just didn't land right. Like, wasn't tickling their ears. Maybe it felt like it was being. They were always being stabbed or picked on or criticized. And if the leader doesn't catch that soon enough, they lose their voice. But they still have the right ideas. They still, in their mind, are trying to do what's best for the organization, but their delivery is what got them in trouble. So that goes back to our original conversation. Make sure you deliver in a way that lands.
31:35
Speaker B: Like if I. Yeah, let's go.
31:37
Speaker A: Let's.
31:37
Speaker B: Let's hit on that for a second. What's the best way? Because sometimes I've heard, because it might work better. You might have to be savvy enough to change that depending on the organization you're in as well and the type of people that you're talking to. Because I've had some people where you say, like, you know, I've just. You just got to be that. That leader that, you know, tells them what they need to hear. And you've got to be, you know, aggressive on this point so that they don't, you know, I don't know, blow up the company and that might work in one organization and they respect that. And then the other organization, they're like, you know, you're not the right guy. We're going to go a different direction.
32:08
Speaker A: So that's that 30, 60, 90 that you have in any organization. You come in and you sit and learn. What is the culture? Is this a conservative, is this outgoing and just.
32:17
Speaker B: FYI, just, just. And that happened. They used to have a voice, kind of like you said, used to have a voice, don't anymore. I've seen that.
32:25
Speaker A: So some of that to the used to, not to is there's been leadership change that they're not aware of either formally. The leader changed. Something happened with the leader. Let's just go. We're humans. They're either going through an aging parent situation, they've had the birth of a child, so they're distracted. They may themselves be going with some medical issues themselves that they've been diagnosed. So it changes their demeanor when they're at work. So I always tell people it's best to have a relationship in a way that there's transparency. Hey, I'm going through something. I don't need to know everything. Let me know if I'm getting too distant, if I'm getting too direct, if I'm getting too passive. That's where having mentors and mentees is important in my life because I've gotten to burnout and I've had friends come to me. Well, you're really burning at both ends. You're about to burn yourself completely out. You need to reflect and step back. So if you can find that inside the four walls of your organization, maybe a peer who can speak truth into you during your one on ones, your skip levels, it will help keep that voice when that day happens. Either because you've got an aging parent, you've got a new birth adoption, or because it's a happy moment or the sad porn, you're physically going through an ailment or a divorce, et cetera.
33:37
Speaker B: I've literally had every single one of those except for the divorce. So hopefully not. Love you, honey. Where we are, if you can hear me out there,
33:45
Speaker A: I tell people all the time you're going to click on an email if you win the lottery or if your pet dies because emotions drive your action. So if you're heavily excited, you're very passive. You're, you're depressed, you're anxious. You're also very passive. I don't care anymore. So it can be either spectrum can cause you to fall for social engineering, a phishing attack or another security incident because you're just freely giving away information because you're on cloud nine, I just won the lottery or my dog died.
34:13
Speaker B: I, I don't. Out of however many episodes we're at now, I've lost track. We're probably nearing 500. I don't think anyone's ever put it that way. And I think what you've just said is like, essentially we're all humans and you've got to realize that we're all humans and we're dealing with humans here. There is no like that role, the title, all that stuff. That's just pretend. That's just like a. We're pretending that we're more important than we actually are.
34:42
Speaker A: I remind people all the time, human centric security is what drives change. Because if we just say my user fell for this versus my colleague fell for this passion, there's no empathy. And if a security leader can't show compassion and empathy, they're probably never going to get the respect or they're going to lose that voice to pull it back to yours. If I don't have compassion, empathy for the individuals I'm working with and securing, I will lose my voice at the table.
35:07
Speaker B: I think as a general topic, it comes up a lot, right? No one's going to deny that the biggest weakness of any security problem is the end users. So like, everyone says that, right? But they say it just because they know it to be true. But they don't necessarily know how to talk with other human beings or they don't necessarily kind of like really get it or understand empathy or different. I know it sounds like this. These should be like natural things because I think humans in general are kind of natural lie detectors. Everyone's kind of skeptical, like naturally, but not everyone can. Not everyone's good listeners or active listeners are able to put themselves kind of in the moment, actually in another person's shoes without reading their own autobiography on top of it, being defensive or any of these things.
35:55
Speaker A: I've asked CEOs, CEOs, CFOs, what is your line item for people? Which money are you spending on people? And that's recognition, that's training, that's even security awareness. And don't tell me you just do phishing simulations or you start trying to add your budget for your endpoint agents is protecting them. Now I want to know when's the last time you sent them on a retreat? When's the last time you catered a luncheon? When's the last time you gave them team building exercises that allow them to actually build a team morale and show me that budget. And I can show you the organizations that spend more money on their team. Their users speak up sooner, they're more happy, they're more willing to work with the security team or the IT team when changes have to happen because they know at the end of the day they're doing it for the best interest of them and the organization. Not just the organization, because it's easy to say the org says do this because another thing about human centric I want you to think about, what do you do when you first wake up? You're likely going to be like me. You're going to grab a technology. It's probably going to be your phone. Okay, what if you got a push notification right as you woke up? Would you know what to do? Do you understand that? Not approve that MFA notification. You have to know that at home. You don't even got to work yet. This is someone who just compromised your, your bank account while you were sleeping. So if I can push you to start your day with security, you're going to do security more naturally at work and you're going to talk about it when you go home. Because at the end of the day, security is everyone's job. I just happen to have it in my title.
37:27
Speaker B: You just took it to another level. You just took it from. You just took it from, hey, let's do team building exercises and go out to lunch too. You need to be thinking about security from the moment you wake up. I need to be in your head all the time. Sorry.
37:42
Speaker A: I mean, we've got more technology than we've ever had. Your car is full of technology. Your microwave again, funny joke. Here is, honey, we're going out to dinner tonight because the microwave and the fridge are not talking. They're both Iot devices. They won't talk anymore. So we're going out to dinner.
37:59
Speaker B: Yeah. And the dishwasher and the refrigerator and numerous other things.
38:04
Speaker A: Again overseas, my toilet told me I need to go see my primary physician because I have elevated enzymes. I probably need to go to the doctor. So it said it's scheduling a doctor's appointment for you because of your bowel movement this morning.
38:15
Speaker B: That's a new one.
38:17
Speaker A: That would be Iot.
38:18
Speaker B: It's gonna get there.
38:19
Speaker A: Yes. It's going to analyze your PE or bio and tell you, hey, I'm scheduling a doctor's appointment for you. You got it.
38:24
Speaker B: The three o' clock today.
38:25
Speaker A: Clear your schedule.
38:27
Speaker B: Drink some water. You're Dehydrated. Let's, let's go through some what can IT leaders do to get more recognition and I guess be heard more. Although wait a second, this one, I forgot this one. What's the elevator test? Every IT leader should be able to pass, but most still can't.
38:48
Speaker A: Yes. So I tell people all the time, I mentor a lot of people. It's Monday morning, walk onto the elevator, you step in, you press floor eight. Next person that walks in presses 438. You work in a 38 story building. You can make the assumption that that is now a C level. That C level now turns to you. Hey, Phil, what do you do for my company? Who are you? What do you say? This is where I say, hey, I'm Fleetus Poston. I'm one of your security leaders. I'm one of your business leaders in the organization. I'm here to drive change, help you make sure that individual end of the day, we can get your financial apps back under control by controlling your spend. And at the end of the day, I'm going to protect and respond. I don't tell them that I just pushed a firewall rule or I manage a security team. I tell them how I'm trying to drive business value, business change and that I'm an IT and a business leader. You heard me say both. I introduced myself first as it, but I'm also a business leader because I'm going to think about my financial operations. How do I control my cloud spin, how do I reduce my contracts, how do I add value so I can spend more money in my budget on the people that report to me. With that team lunch that give promotions, give merit increases, give spot bonuses, at the end of the day, I was able to cut the O and M from a product or service to give back to the people.
40:00
Speaker B: I like it. I help us streamline our voice and data networks so that we can become more competitive in the marketplace. So that I don't know Johnson and Johnson doesn't win.
40:10
Speaker A: Yes, it's an elevator pitch. You need to have it down to 10 to 15 seconds because you're not going to keep them very long. Let them ask questions. If they want to know more, they'll ask a question. If not, you've done your elevator pitch.
40:23
Speaker B: I try to keep banning this word pitch forever. It's an endless battle. But I've been trying to ban this word pitch forever because pitch is something that you do to someone, not for them. You know what I mean? Like the sales reps gonna come in and pitch us like, oh, great, I hate it. You know what I mean?
40:36
Speaker A: But if it's, I'm a baseball player, I just think someone's about to throw something at me.
40:39
Speaker B: Oh, there we go. I like that too. And does all of your team like, do they know, do they know how to do that? And do they know how they benefit the company?
40:49
Speaker A: So we have that conversation because I kind of do this something similar with my one on ones. I asked three questions I want you to know. Tell me what you're doing, tell me what you want to be doing, and tell me what you would wish you could be doing. And I reply it back to the same way with me, what's something you want me to continue to do, what's something you want me to stop doing? And what's something you want me to start doing? So yeah, they learn how to tell me their three pitches. This is what I'm working on, this is what my roadblocks are and this is what I wish I could be doing. Well, on the flip side, they tell me what I'm doing well, they tell me what I'm not doing well and they tell me on things that they want me to do better with or to start doing.
41:24
Speaker B: Yeah, I love it. Some real Itil stuff, kind of.
41:27
Speaker A: Yes. And covey, I always do like some break, some good old covey over here because perspective matters. You see a six, I see a nine, I'll never see a six until I look at it from your lens. You'll never see a nine until you look at it from my lens.
41:39
Speaker B: Yeah, the coffee stuff made a big difference in my management stuff. So you mentioned the next generation of IT leaders need to, we need to start teaching them to speak business before they ever open a terminal. Totally agree with that. I actually. What about all the leaders that are in place right now? One of the statistics that's interesting is I think it's like 70. I wish I could remember what the gap was. But basically there's a massive percentage of IT leaders that vastly overrate themselves in this category of business success criteria. So they think I'm a good business leader. And in reality then if you flip the other side, the C levels actually say, well, he's a good operations leader, but I don't trust him 100% to bring him to the, I guess business decision making or strategic strategy around business. And my, I have a theory to this. My theory is that we just kind of were good at technology and we kept moving up the ladder and then now we're all of a sudden sitting in the seat. So we must be good at business. I mean, I'm here, right? Like what other reason would bear. But we never actually got any flavor formal business training unless we went and got an mba, which might, which I'm still arguing whether that really, really helps or not versus just running a business and dealing with all the hard parts of it.
43:07
Speaker A: So that is a topic that happens way too often. So again, I sit in a lot of peer groups and I have been told by many board members and senior leaders, your deputy CISO will never be CISO because we see him as an operational leader. And they will make it very clear that they see some of their deputies, some of their directors as that's where their plateau is because they're great at operational leadership. They can lead an effort, they can drive a project. They haven't got that strategic leadership yet. They can't come into the room, talk with their peers about, hey, I just want to talk finance today. You can ask me questions about IT and tech if you want, but today we're just going to talk about, hey, how do we get this cloud spend under control? Not how do I secure it better, how do I get this under control? Hey, how do I fix the fact that we keep losing laptops to public transportation? How do we get this right off?
43:59
Speaker B: You don't think that happens a lot? We don't. Do we really not do that enough?
44:02
Speaker A: I don't think we talk those things. We talk about how we save you from those fires, not how we can help eliminate those fires from like a loss data loss as physical.
44:12
Speaker B: So salespeople, a lot of salespeople aren't helping them? No, they're actually making it worse.
44:18
Speaker A: You asked about what current leaders. That's another thing I asked. When's the last time you put your leaders through any type of training? Did you put them through any training before you made them, when you took them from an engineer to a people leader? Or did they go directly into like maybe a process leader, like a team lead or a principal or a staff position where they were managing efforts, not people before you put them in. I like that. The organization now has principles and staff roles that the equivalent of senior leaders and directors in your org. Because people don't have to go into leadership if they move past a senior or a lead. They can get into those principals and staff roles, still make the money, still be a contributor and never deal with the HR or people and culture that we now call it issues because they're not meant to deal with People and culture.
45:02
Speaker B: We're here. Take this test. Oh, yes. No, you're, you're over here. You're going to move, we're moving you over to this room. Do you think you learned though?
45:11
Speaker A: I have had several friends who've done people leadership for three or five years and say this is not for me. And they go back into those principal staff, sometimes even go back into team leads because they know that's their niche. So they give up the role because another quick, funny story is we always talk about how to help people get into the field. No one talks about how to get people out of the field. I had a CFO come in, wanted to do forensics accounting. He's like, I can do the forensic side of your accounting. I'll do, I'll be on your insider team and I'll help look for money laundering and stuff like that and help for the forensics accounting. Then he started doing some forensics and did some more cyber work, did GRC work. And he's like, this is more stressful than quarter end and year end. I'm going to go back to quarter end and year end. And for anyone who's in finance, you know the amount of hours you work at quarter end and year end to close the books of a publicly traded company. So we helped get the person back out, not just got him into the field, we helped him get an extra strategy to get back out of the IT security field.
46:03
Speaker B: Here's the game we're going to play. I'm gonna, I'm gonna say the technology, I'm gonna say the technology. Tech speak words and you're gonna translate it into, into stuff that the board understands. So you're gonna explain this in a way that the board understands. That's like as far as numbers and finance and, and TCO and see roi, all that. Okay, so yeah, so we need to upgrade the network.
46:34
Speaker A: Okay, so hey, board member, we're, we're getting to a point now where things are going to start to fail and we're going to have a business impact. The business impact of not doing this is going to cost us X amount of dollars. For X amount of dollars I can start rolling out at our small sites to get low impact remediation done for X dollars by X date. Do I have your approval to start here?
46:57
Speaker B: That's better. Okay. One of the examples was stop losing sales when systems go down. So the network's going down in the hurricane or we need redundancy or something. Means we won't lose sales. We can even Be just make stuff up. Just you can just make it up. Think of like a scenario, okay, it's really bad. We've got all this tech debt.
47:15
Speaker A: So have you ever thought about the amount of money that you're sitting on your monthly subscriptions and gym memberships you're paying every month for this? It's 10, 15, $20. You don't look at it. Your technical debt's roughly the same. We've not been upgrading our hardware, we've not been patching our software, we haven't been spending the money. So we've been throwing away all this money that we could have just been collecting and easily have upgraded this tool or you come out the way with technical debt is a way to say that at some point, at some hour and someday you're no longer going to be able to check your email, respond to the board member who's going to now have to call you and you don't want to be called in the middle of the night when you could have read your email in the middle of the day.
47:54
Speaker B: I like that. The, the answer I had pre approved here was look, we've got a lot of old systems that we pay extra money to keep alive. Automation.
48:05
Speaker A: I work in manufacturing, I use that statement all the time.
48:08
Speaker B: Okay, so let's see, we just need to look man, we're working on a lot of automation. We're doing this which is going to, we're going to upgrade this, we're going to upgrade this and this is all leading to automation which is, you know, it's a great thing. We got to do it. Automation.
48:22
Speaker A: Automation is the hardest thing to ever describe to a board member. I'll be completely transparent with you. We would like to see if we can reduce the amount of overhead on our employees workload by implementing a solution.
48:34
Speaker B: Ding ding, ding. Perfect answer, perfect answer. We're going to do the same work for fewer hours. That's where we want to reduce with
48:43
Speaker A: less people we want to reduce which at the end of the day I'm going to have to come back to in six months and hire those people back because the information didn't.
48:51
Speaker B: Yeah, AI didn't solve that one. Let's see. Oh, this is diff. This could be a difficult one. We really need to get our data platform in line because.
49:03
Speaker A: Yes, so born. As you realize over the last several years we've been acquiring numerous companies. When we acquired those companies we never took the time to take data from company A and integrate with company B and now company C. So we no longer have A master data management. So when you ask me for a financial piece of data, I have to go to six locations instead of one. We would really like to standardize the platforms. Get a master data management that can be centralized to allow us the same six to eight hours a week of clicking through systems, saving you roughly about 20, 30k a quarter, giving you about 150k back a year.
49:36
Speaker B: Is there anything I. What else are we going to benefit from? Having all of our data in alignment? Anything?
49:40
Speaker A: I mean, when you're ready for me to put AI and fire me, you can now have one centralized master data management that it can connect to instead of connecting to 12 to make a decision about how to utilize said security platform.
49:51
Speaker B: And some of the benefits also of having data alignment. I'm just like, this is some of the ones that I came up with here. Find out what customers want faster. Maybe you know what I mean?
50:00
Speaker A: Your chatbot can actually answer the question because right now your chatbot doesn't know all the answers because it's in 12 locations and it can't talk to all 12.
50:07
Speaker B: I've got five habits. You add five habits. So I've got five habits to do what we are trying to do here, which is train people that don't know how to speak business to speak business. And the people that are just in the aloof. And what do we say when you believe it's like a sense of false security or false. Oh, what is it where you think you're like safe but you're not really safe. Anyways, they think my job is all set, but it's not really, it's not safe. Okay, so we're going to do these five habits that actually make this C level director who thinks he's a business leader a better business leader. I've got five. You can, you can add five to in the meaning I've got one that is lead with the numbers. Do you agree? Put the dollar figure in your first sentence. Okay, you go now you give one because I don't. If I list all these five then they might be your five and I know I'm just make sure another one.
50:59
Speaker A: Yeah. I say come in with a problem and a solution, not just a problem statement.
51:04
Speaker B: Great. Give options. Not one, ask. So do nothing, do some or do all. And here's what each costs boards like choosing. Here's good, better, best.
51:14
Speaker A: Yeah, it's the abc. Here's option A, option B, option C. I want you to choose B. So I'm going to give you four. So you should go with the one that I want you to.
51:21
Speaker B: Yeah. I disagree with the do nothing, though. I think they should all be yeses. They should all be alternative of choice, alternates of yes. This one says do nothing, do some, or do all. But I say do. I say this was an ex. This was a, like a Gartner example. Gartner's wrong. Gardner's always wrong. No, they're not always wrong. They're wrong sometimes in this one they do nothing. Okay, you got another one? Yeah.
51:42
Speaker A: It was like you never go in asking your board for money. That's you're asking your leadership team for money. Your board's not there to give you more money.
51:50
Speaker B: Oh, here's a good one. I like this habit. These are habits again, like Stephen Covey. The habits. The seven habits of highly effective CTOs. So we should have this get, get the CFO on your side before the meeting.
52:02
Speaker A: Amen.
52:03
Speaker B: The person people have like a close relationship with the cfo.
52:06
Speaker A: What, the person who's paying you or that has the checkbook is the one that you want to make friends with?
52:11
Speaker B: Yeah. Like that's probably one of the most strongest partnerships you can have. I crunch the numbers. It works. John. It makes sense. John. Bill. It makes sense. I crunch the numbers, crunch. We need to do this.
52:22
Speaker A: This is the bia, the business impact analysis. This is the cost savings. This is the loss prevention that we can get by doing, doing X, Y and Z.
52:29
Speaker B: Any other great habits that you do?
52:30
Speaker A: I think the biggest thing for anyone is we always say it is touch grass, walk away, be able to walk away. You don't have to work the 12 hour day. You don't have to work the 18 hour day. Be able to step aside and say, I've done my best. It's time to go, reflect, step outside, take a deep breath, go for a walk. And I say the same thing before you go, before your board, come in prepared, knowing that they're likely going to ask you a tough question. But don't make up something. Just say, that's a great question. I will get back to you in X. I'll follow up by Y. And that's my two feedback. Don't make up an answer and go outside, take a, take a breather, touch some grass, take a walk.
53:11
Speaker B: I love that. I think we're just going to leave it on that one. This other one, this last one that I had on here, everyone knows it's using analogy. Everyone's been using stories and analogies, sports metaphors, race car and metaphor for is they always work Great. I really like the being able to walk away, whether it be you don't have to work 20 hour days every day, every now and then you have to. But it's one of the problems that I have is one of the problems that I have is an ability to actually like stop thinking about the business all the time. Especially when you, if you own the business yourself.
53:43
Speaker A: Correct.
53:44
Speaker B: How do you walk away from your own business? It's kind of difficult to do. So. That's really, really good. It has been an absolute pleasure having you on the show. Any final words of wisdom? Yeah.
53:54
Speaker A: So, last one, I kind of alluded it, but be a mentor, Find a mentor. Be a mentee. No matter if you've been on the job one day or 40 years, your life experiences what adds value to the conversation. As we've talked throughout here, people should be able to come to you for opinions and expertise because you can be a mentor and a mentee. No matter if you've been on the job one year or four. 40 years because your life experiences is what adds value to the conversation, not how long you've worked at the job.
54:20
Speaker B: I love it. And I don't think you necessarily have your mentor doesn't necessarily have to be someone that's better than you.
54:26
Speaker A: And the other one is I always have multiple. I have one above me, so I have the executive that I'm going to. I have one beside me who can challenge me and I have one behind me that I can pass the torch to. So I like to have three. I like to have someone that's ahead of me, someone beside me and then someone that's coming behind me that I can pass the torch to you.
54:42
Speaker B: Super awesome, Fletus. Thank you so much. You've been heard.
54:48
Speaker A: Thank you.