Simply Solving Cyber - Abhishek Bharti

Thanks for tuning in to Simply Solving Cyber. I'm Aaron Pritz.

And I'm Cody Rivers.

And today we're here with Abhishek Bharti. He's a former managing director in a Big Four consulting practice focused on privacy, information security, and risk management. And without further ado, I'd like to introduce Abhi and maybe start with a little bit of background. Abhi, tell us about yourself. Your journey into cyber and what you're passionate about in this field.

Thanks, Aaron, and thanks, Cody, for that intro. Hello everyone. My background has been, as Aaron mentioned, entirely in the information security space. I have over 20 years of experience in this field, and my passion in this area began after I finished my master's. Uh, from— by way of background, I did my education and schooling all in India, and once I finished my master's My first exposure in the world of cybersecurity came by way of my first job, which was for India's largest internet service provider at that time, and also, you know, a collaboration with a company based in the US which dealt with digital certificates. And that brought me to the field of cryptography and encryption and digital signatures, and that was really my introduction in this field. And ever since my passion and interest grew in this area and I never left. Post that experience, I had a chance to work for one of the Big Four organizations in India. I worked for them for around 4 and a half years, and by working with them, I got an opportunity to have a global exposure to a lot of global clients as well as experience working in a lot of global locations. And then 14 years later, uh, I came to the US and had an experience here working with multiple financial institutions by working for that Big Four. And as part of my experience, my focus area was on cybersecurity strategy, risk, and compliance. And in this field, as we all know, over the last few years, we've seen lots of regulations change in the cybersecurity and privacy space, both in the US as well as globally. So I've been actively involved in that area for a lot of, uh, time in the past.

Awesome. So what would you say has been the biggest challenge that you've seen? You've been in consulting for a long time. What are some of the biggest challenges that you've seen clients struggle with? And where have you felt like in your consulting career you've given some of the most impactful advice, processes, solutions?

Yeah, great question. I think in this area we've seen lot of clients and people who are working in this area be familiar with a lot of standards as well as frameworks and regulations. But the challenge, I would say, in my experience comes on the aspect of applying that to your organization, because I know it's a consulting cliché statement on one size fits all does not— one size does not fit all. So But what that really transpires and means in the context of your organization is to understand how you want to tailor your capabilities within the cybersecurity program to the relevant risk profile and understand the implications of what these— those regulations mean. And the final part of that challenge would also be that as and when new regulations come up, I've seen organizations less mature, medium maturity to high maturity, almost all of them struggle with the aspect that something new has come up and they want to start from scratch with respect to that compliance. So the program needs to be built in such a way where you are doing the basics right. And believe it or not, even in this day and age, while we talk about artificial intelligence, blockchain, and all those emerging technologies, the number one reason for a cybersecurity incident to affect any organization still remains the basic block-and-tackle aspects that get missed. Example being, you know, vulnerability or patches not being applied on time. So yes, there are more sophisticated attacks, but there continues to be a sufficient number of missing elements on basically doing the basics right.

Yeah, I've totally seen that. I feel like sometimes cyber teams or new leaders want to jump to build the third story of the house and maybe the loft with the game room and the arcade before laying the foundation to the house or maybe digging a basement. May not always be the fun stuff, like thousands or millions of vulnerabilities is daunting, but you are right, like that is most of the time it's like vulnerability exploited through a human error that linked to an unpatched vulnerabilities on core servers. So I think back to the basics is always one of the first things that we make sure to call out. And, you know, if those are gaps in any kind of program.

Yeah, Aaron, great commentary. And Avi too, a lot of our listeners are folks who are new to cyber, they're growing in their cyber careers, or they're mature, you know, seasoned cyber executives. But what's some kind of advice with new regulation coming out as people are being Task to Do More with Less. What's some kind of general advice you would say for new consultants or new practitioners who are getting into the arena?

Great question. I think my advice would be continue to be a learner, continue to be inquisitive, continue to keep up with the learning. You can't rest on past laurels if you want to succeed in this industry and do well for yourself in your career and as well as for the organizations that you work with. Because again, it may sound cliché, but cybersecurity is so complex and changing so fast, probably fastest than any other field or in any other industry in this world, that you have to keep pace with what is happening. And it does not necessarily mean that you need to know all cutting-edge stuff. So for example, you know, the latest buzzwords around quantum and the cryptography world and the crypto world. Yes, it's good to know. You need to increase your awareness, but you don't all necessarily need to be suddenly become experts in quantum right off as of now, because the whole industry will take a while before we get there. But having said that, if I compare, let's say, the quantum computing buzzword with, let's say, the cloud technology, cloud has already, in my opinion, reached that tipping point where it is applicable to most organizations. So if you are starting new in your career and you are not aware of how the cloud infrastructure operates and you are still thinking traditional data center infrastructure, then you are falling behind the curve and are not going to be as competitive in your career with respect to moving up in the industry and getting the right jobs.

How do you stay up to date? How do you learn? I mean, just to share my own 20-second version, I, every morning I have a news aggregator. Mine specifically is Feedly, but I've got specific keywords and it serves up 10 to 20 news articles and I probably filter it down to 3 or 4 that I'll read. But that's one thing that's been helpful for myself. Consulting gives you another vector, but what are some of the best ways or tips for those listeners that you stay abreast of the latest?

A couple of things. I think news aggregator is certainly one of them. I think it's a great tool to get the right message at least quickly and be aware of what's happening in the industry currently. Another thing is you can't boil the ocean, right? And there's volumes of information that you can't spend all your day reading every day. So you need to, beyond a certain point in your career, decide which areas do you want to focus on and try to then invest time specifically in that area. So the days of being too much of a generalist are gone. So you need to carve that specialization for yourself. So whether it is strategy, whether it is regulatory stuff, whether it is identity access management, you need to pick certain areas within information security and make sure you are keeping yourself updated on those fields. News aggregation sites are certainly important. Others I would suggest would be one, keeping up with some certifications in relevant to your sector and your industry and expertise. That also forces you to study those areas a lot more, right? So you can be challenging yourself and making it a little bit more disciplined approach to cover those areas. And the second would be, I know we, we all talk about networking sites and collaborating with other folks in the industry, making sure you follow people who are leaders in that space so that when they are sharing any article on some of these networking sites, you are able to pay special attention or take out time to read those articles because obviously they will be sharing something relevant which will be useful.

Yeah. Excellent. Excellent. And well, speaking of knowledge and learning new things, one thing that we get a lot of questions about, you have frameworks change and guidance changes, but one thing I want to talk about today is the new SEC Cyber Rule that kind of came out and we had a large influx of how does it impact me? Is it now? Is it retro? Is it current? When does it take effect? How do I define material? So would love to kind of get your summarization and your thoughts on what leaders need to be aware of. And what they need to be doing?

Cody, great question and a great topic, I would say, which is quite relevant for a lot of companies these days. But specifically to talk about the SEC Cyber Rule. So the rule that has recently been finalized by the SEC is around cybersecurity disclosures, and this is relevant for all public listed companies. So it does not matter what industry you are in as long as you are publicly listed. Which means SEC is going to be your regulator, you are subject to these new rules on SEC Cyber. The rules themselves are, are quite elaborate, but I'll try to summarize it for our listeners here. There are basically 3 parts to the rule, but before I go to the 3 parts, I want to spend a little bit of time explaining why this new rule was needed and why was it initiated. So in 2011, and then subsequently in 2018, the SEC did give out guidance around being careful with cybersecurity risks for organizations, and especially public listed organizations, because obviously investors are relying on those companies to do well and are putting in their money by way of investing in those stocks. However, the SEC noticed that in spite of that guidance to have a lot of oversight, governance, and risk management around this particular cybersecurity risk, which was obviously in the last decade becoming, I would say, a top 5 risk. If you look at enterprise risk for any organization in this day and age, we are all reliant on IT systems, and with IT systems and technology obviously comes cybersecurity risk. But coming back to why the rule was needed, so the SEC noticed that post-2018, when the guidance came out specifically around cyber disclosures and being transparent with those risks, Even then, the public listed companies were not being very forthcoming with respect to reporting those risks, although news and media coverage did talk about cybersecurity incidents happening at those organizations, but they were not being formally reported on a timely manner. So the SEC felt that to give them enough teeth to go after organizations for non-compliance, one reason was to make it a rule so that they now have explicit authority to go after organizations that do not do to it. But the intent is not for the SEC to penalize organizations. The intent is transparency for the investors. So before investor invest in a stock of a public listed company, they need to be fully aware of all the risks associated with that organization, including cybersecurity risk. I know enterprise risks are being talked about, leaving aside cyber, but the SEC felt cyber was important enough to be explicitly called out. As a result, they came up with this guidance in 2018, like I mentioned, but now they have made it a rule. Now let's come to what are like 3 broad expectations of these rules. The 3 broad expectations of these rules are that any organization that is subject to this rule has to demonstrate oversight of risk management, oversight on cyber risk management, I should specify, not just enterprise risk management, because enterprise risk management has been around for a while, but specifically demonstrating cyber risk management capabilities and oversight. And by that, what I mean is not just conducting a cyber risk assessment, but also regular reporting at a decent cadence to the board, to the audit committee, on what those cybersecurity risks look like for the organization and how is the organization geared up and prepared to deal with the cybersecurity risks. So that's number one broad area that the SEC expects organizations to manage and also disclose as part of their filing to the SEC. So that's the first part of the expectation.

Before we move on to the second, how much— I think this is a big question being discussed— how much needs to be disclosed? Is it a couple bullets? Is it full transparency of all the job aids and details? Probably not, but the answer is always somewhere in the middle. Where do we think that middle is shaping up to be?

Yes, spot on, Aaron. And, and the answer is definitely in the middle. I would say maybe less than the middle. And the reason I say that is this is obviously going to be sensitive information, and anything disclosed to the SEC becomes public information. So with respect to risk management capabilities and what the organization is doing, what sort of cyber risks are they facing, I think to err on the side of caution, organizations will disclose that they are paying attention to it, how they are paying attention to it, but may not disclose too much granular details around those capabilities as well as risks faced by that particular organization. Because once that information becomes public, you are indirectly putting a target on your back by disclosing too much. So very important that individuals or committees being responsible for interaction with the SEC in terms of reporting requirements do a collaborative session with people from other departments. And by other departments, I mean, like, I expect organizations to form committees that will have representation from financial reporting, from, of course, finance, from cybersecurity, from compliance, as well as legal. All these departments need to come together to come to a consensus as to what needs to be reported and how it needs to be reported, because you don't want to give away too much to have a further target on your back.

Yeah, and I suspect like having a playbook or some sort of pre-aligned plan is going to be advantageous versus winging it in mid-December. Is that a fair assumption?

Definitely. In fact, that is one of our common recommendations. We advise our clients to prepare for the situation. God forbid they should not get affected by a cybersecurity incident that forces them to report to the SEC, but Being prepared is always better, and I know that organizations cannot think of all the possibilities of a potential cybersecurity incident, but at least the common ones that they have seen other organizations suffer in the past or their own organization suffer in the past. They need to be prepared with determining how and when they will determine whether it is reportable or not, and then what extent would they report that to the SEC, including determining some at least initial draft language. Yep.

And that's on reporting, but even the risk management and governance, that's not something you need to wait on, like figuring out what you've already done and what level of granularity that you're going to go to to report your program-level information or how you communicate with the board. That's something that's even, you can even prepare more near—

Well, and I thought about too, Aaron, so your point about that is I look at like definition and Avi, love to hear your thoughts here. You've got in other contract languages and stuff that you see a lot of like data sharing agreements, you'll see incident versus event and what defines that. But you have a thing reporting material breaches, material. So I think Aaron, to your point, helping companies define what is material for the company so they know when to report, what not to report. But I think it might be a good question. So Avi, love to hear your thoughts on how you define material. And I know you're not a lawyer, so this is not lawyer advice, but I would love to hear your thoughts on how companies figure out to define what's material and what's not material. So in effect, what they do in doing that report.

Excellent question. So actually, that ties very nicely with the second grouping of what the SEC's expectations were. So I'll tie your response to that part. So the second part of expectations of the SEC, as we all started touching on that topic, is reporting on incidents. So any and every incident that happens in your organization obviously need not be reported because One, it will overwhelm the SEC and also overwhelm the organization itself in terms of preparing for those incidents. So the expectation of the SEC is they've used that term, as Cody mentioned, material incidents need to be reported. And materiality is a word quite often used in the context of this regulation, and it has been around in this space for quite a while. But I want to distinguish in terms of what the expectation of materiality is, because Clearly, the SEC has not given a formula or an exact sort of definition of how materiality would apply in the context of cybersecurity incident. But based on my experience of working with many clients in this space and helping and assisting them in determining what it should be, I'll share some of my insights. So the first part, as I was alluding to, the word materiality has been around for a while in the financial audit world. There is a dollar value threshold that is typically defined which sort of also ties with the enterprise risk management aspect of it on what is an acceptable level of loss that the organization can sustain without affecting its capabilities in the long term. Right. So a dollar value threshold is defined. So in the financial audit world side, if any transaction mismatches that particular dollar value threshold, if it is below the threshold, it can be ignored for easier terms to understand. But if it is beyond that threshold, then it needs to be investigated and reported to the SEC and some investigation needs to be done. So the concept is similar here where any significant cybersecurity incident needs to be reported. Now, how do we define that significant is really up to the organization to determine. And there is no easy answer for this, as you were alluding to, Cody. So the challenge becomes, one, you can apply multiple inputs to come to that determination. The most important aspect around determining this is whatever criteria you come up with needs to be documented. So the SEC, the first thing will the SEC will come to review when they examine you, if you are chosen for an examination, is whether this criteria was well established, documented, and accepted by the senior management and the board, right? So coming up with a defined criteria. So as Aaron was saying, can we do it on the fly? No, you can't do it on the fly. Even if you do it on the fly, God forbid, if you get selected for an examination, you will fail and you will incur the wrath of the SEC in terms of monetary penalties. So coming back to what these inputs could be, so one could be, you know, your risk appetite based on your well-established or already pre-established enterprise risk management rules that your organization may already follow. Like what is your appetite for a regulatory penalty? What is your appetite for being subject to regulatory non-compliance? Example could be, let's say you are a healthcare organization, so HIPAA laws apply, right? So at what point do you say if 100 records worth of HIPAA-related sensitive PII information was lost, is that going to be considered significant enough, or is it going to be 1,000 records, Or is it going to be much more critical and only 10 records or less than 10 records? So that determination has to be made internally by your privacy team, by your legal team, by your compliance team as only one of the inputs. The other possible inputs, and I can't obviously go through all possibilities because it again needs to be tailored, assessed for each organization. Again, coming back to my original comment on there's no one-size-fits-all philosophy here. So, It really needs to be articulated, determined, and tailored for every organization. But just to give you another example, it would be, are you able to quantify your cybersecurity incident in some manners? And if you are able to quantify it, then based on your enterprise risk level threshold, then you can say this particular cyber incident that happened cost me, you know, $1 million, and my threshold for risk appetite was, $900,000. So it has exceeded that threshold, therefore I need to report this, right? So that is again one of the possibilities organizations can consider as they are thinking of how to make that determination of what is going to be reportable and not reportable. And then the last thing I'll say is on the requirement for 4 business days, the rule currently says you need to report any significant or material event within 4 business days. Does your organization currently have the capabilities once it knows about the incident to make that determination within 4 business days and be ready to report within 4 business days? So those are some things for organizations to consider as we look at compliance with respect to this rule.

Yep. So if an organization has to report it once they've deemed it material, and if material— I think I've got a reference here— means that there's a substantial likelihood that a reasonable shareholder would consider it important to an investment decision, how long can an organization reasonably take to determine materiality? Because I've seen some language on there, determination must be made without unreasonable delay, but that's not qualified. So could I get away with a year of determining materiality? This is rhetorical. And then be like, oh yes, it was. Here's a year later. That's not going to solve anything. What is your read on that?

Yeah, my, that's a great question. And again, that's the gray area that the SEC has left and people consider it as both good news and bad bad news because they have not provided the clarity, but good news because it gives organizations that flexibility to come up with that determination. So I think similar to our earlier conversation, the answer lies based on what is determined to be realistic by the organization itself, right? So tomorrow, let's say the SEC— you determine, as you were giving the example, Aaron, that I will say I'll take one year to determine whether it is material or not. So the SEC will not penalize you for determining that you will take one year, but as part of your risk management processes, when you do end up reporting, all the investors would know that this organization which claims to be mature enough is taking one year to determine whether it is material or not. So some of the onus on determining what is a reasonable time period automatically falls on the organization in itself. So clearly, while the SEC gives you that flexibility, you cannot have all the time in the world to make that determination. And there is additional complexity where even historical events in aggregate, if they are in future considered to be material, you are expected to report to the SEC on that aspect as well. So organizations that may have determined something to be immaterial in the past year face similar incidents in the coming year. Then you are required to then create that analysis to determine all these incidents seem to be related and therefore in aggregate they become material. So those are some of the challenges that organizations need to consider as they prepare their capabilities to meet these objectives.

Yeah. And so I have a two-part question coming up. So one, when does this go into effect, you know, from a hard date? And I think my follow-on question would be, Is there a statute of limits to it? So is it after a set time you can't go back to a certain point in time? Not that I'm playing devil's advocate here, but if someone were to miss the 4-day window, is there a time they want to wait and keep it quiet where, hey, we're outside a window, statute of limits to report this concern?

Well, I would say based on what has been determined or documented internally as the process for the organization. So like I was saying, you can create a policy that says and we will take no more than 2 weeks to determine, or we will take no more than 1 month to determine whether it is material or not. So the, the deadline of 4 days cannot be missed, I would say. So at a minimum, you can choose to inform the SEC that yes, we feel that it is potentially a significant event, but we are still investigating or continuing to investigate. But your obligation to report once you have made that internal policy determination, that this is your internal deadline to come up with a decision of go/no-go needs to be honored, so to speak. You can't miss that 4-day deadline. You have to inform the SEC. Otherwise, you can miss it. Obviously, nobody is going to force you to recommend, but then you are inviting the SEC to come and penalize you. Yeah, yeah.

No, great points, Abhi. As we're coming to a close here, for those that are interested in learning more, we actually co-authored— Tim Soule, Abhi, and myself co-authored a white paper. We kept it brief and short. I think it's 3 pages, but it gives some more context to the specific language that Abhi was talking about. And it also provides some tactics of how to get ready and work through some of the challenges, especially on the governance and risk management reporting. And I think one misnomer, like you gotta report that stuff as part of a separate part of this whole SEC Cyber Rule. You've got to report that annually, whether you have an incident or not. So there's no waiting around until you have an incident. You got to start working on what you're going to say literally after December, what is it, Abhi, 15th?

Yes, December 15th is the deadline. And actually, Aaron, that kind of touches to that third pillar that I had mentioned, three parts of the SEC rule. The third part is the administrative requirements of reporting using certain formalities of forms that the SEC has already pre-established. So with respect to informing the SEC about potential sort of material cybersecurity incident, there's a Form 8-K, and I'll not go into details of what the 8-K is. People can Google it and see it. And then on a quarterly basis, there is another mandatory reporting requirement by the SEC, which is called the Form 10-Q, Q standing for quarterly. And then on an annual basis, the same Form 10-Q becomes or is called 10-K, K as in for the annual reporting requirements. So while the incident may not wait for your 10-Q or a 10, you know, the timing cannot sync necessarily with the filing with the SEC on the 10-Q or the 10-K. That is why the SEC has an out-of-turn reporting mechanism of 8-K to meet those 4 business day requirements to use that form for reporting. But on an annual basis, this is what you were alluding to, whether or not an organization gets faced with a cybersecurity incident, they still need to disclose their cybersecurity risk management governance reporting aspects to the SEC by way of this annual filing in the 10-K. And that is very important. And the last thing I'll add to all of these, which often gets missed by organizations considering compliance requirements and capabilities, is this cyber requirements— while it has been called out as a cyber disclosure rule and as a new rule, the SEC, based on the 2018 guidance itself, has rights to come and, you know, investigate and penalize organizations. It need not wait till December 15th deadline. But the missing part that often gets overlooked is when this incident, let's say, is faced— such an incident is being faced by the organization— they need to ensure that other compliance-associated compliance requirements are also being met and controls put in to address those requirements. And by those others, I'll specifically give one example, which is on insider trading. So because a cybersecurity incident which is being potentially considered as significant or material for reporting to the SEC is sensitive information. The organization needs to have enough controls to ensure that this information is being shared on a need-to-know basis and that no insider trading is happening as a result of this. So the compliance department, the IT department needs to monitor the employees to ensure that none of that happens by exploiting this information beforehand.

Perhaps that's because there's been arrests and indictments on such behaviors after a cyber incident. There's always a reason to these new rules, right?

Absolutely. Absolutely. You're spot on. Awesome.

Well, Abhi, thanks for coming on the show today. Really appreciate the deep or moderate dive that we did here. And like I said, for those that want to learn more, we'll put a link to the whitepaper in the show notes as well as on the social media posts so that you can go check it out and follow up with us if you guys have any questions.

Yeah, Abhi, thanks again, sir. It was a pleasure chatting with you, and I'm sure our listeners got some great knowledge and some great tips here for all the upcoming rules and everything.

Sounds good. Thanks everyone.