Simply Solving Cyber - Chetrice Romero

Welcome back to Simply Solving Cyber. My name is Aaron Pritz.

And I'm Cody Rivers.

And today we are here with Chatrice Romero. She's the Cyber Program Director for the State of Indiana and also heads the Indiana Executive Council on Cybersecurity.

Yep. So I am just tired all the time.

I bet. Well, so we're excited to hear about both of those things, but before we get started into that, give us your intro into cyber. How did you get into the field? And I think from chatting a little bit before, non-conventional, not— you're not an IT techie. So give us your story.

I'm not, and actually I love that I'm not because I think that's consistent, like, theme to a lot of workforce development talks with students is that cybersecurity people come from a variety of walks of life. Yeah. So my original two degrees are in journalism and public relations and communications and liberal arts. So I definitely use my degrees every day. That's definitely— wasn't like I did a total 180, but yeah, I've always been with the state of Indiana. It's really, honestly, I just got bit by the service bug and working for private just kind of seems good for other people, but for me, I don't think I'd be as happy with the ability to kind of affect change and help people through government service. So yeah, I did public relations with the Department of Revenue, did crisis communications with Department of Labor and IOSHA. Then since I got labor and taxes, um, where like literally my day-to-day job was death and taxes, which was the weirdest thing, I got moved over into the Utility Regulatory Commission where I actually got more of my start in the cyber realm from the energy sector. and kind of being spooked by actually Ukraine attack back in 2016 on their energy grids. So, that kind of just really went from 0 to 100 and just had a huge interest in cybersecurity. Worked with our Emergency Operations Center, assisted them with building out our emergency support function over energy. So, what that means is when the lights go out and everybody's lights go out and it starts really making people upset, but also starts putting our safety and health at risk, then Emergency Operations Center for the state of Indiana kind of kicks in and starts to try to coordinate and make sure people get what they need, especially if it's a long outage. So I did a lot of work on that end and then came into— when Holcomb took office, he continued the executive order that established the Indiana Executive Council on Cybersecurity. And of course, I'm one of those people, I always tell students that I lecture to, if you're gonna say maybe something didn't work as well or how something can work, you always bring solutions. And so that's what I did, not realizing that that was an interview. So they came back and they're like, "Why don't you just take it?" And so I was like, "You know what? This seems fun and it seems exciting and seems like an area I could really make a difference in," which with 250 other people we really have. So, yeah.

That's excellent. So, comms and public relations has a prominent role in cyber now, especially with ransomware. So, I know on the corporate side, having a plan, having rehearsals, having practice was night and day difference. Readiness for how a company reacts to it. Yeah. You've seen it on the government side, but what have you learned on readiness and preparedness with teams, helping people understand their role and be proactive in that?

Oh no, that's a great question. So, I think the thing I've learned the most with the readiness component is that people, when you're talking about like energy, for example, or healthcare, they are doing pretty good. They're already pretty regulated. Banking, there are already a lot of requirements of them testing these processes out. It's just part of the risk management of just being a utility or a critical infrastructure, but the kind of aspect of risk management that trickles through all industries, I still believe is quite lacking. And I think it's not for the sake that people don't care about it or they don't think of it. I really do think that it's just not in front of them. And cybersecurity is very different from the other things we hear about prepping for, right? Like we, we know there's going to be a snowstorm, so we can always prep for that, right?

Yeah.

We live in fantastic Indiana, right? So there's going to be a tornado or two or 25. So we know these things are going to happen. Insurances typically require us to make sure that we are following building codes and we're following fire codes and so on so that we're prepared for those things. So when it comes to cyber, it's just a lot more out of sight, out of mind. But I would say that of all those threats, when we do risk assessment, cybersecurity is still the top threat to businesses with the most to gain— most businesses to lose. And yet it's still not a priority with preparing for it. So a lot of what the council does is how can we make that simpler for people? Of all sizes, from all sizes of businesses, organizations, and not just in critical infrastructures, but on a constant basis from the beginning, I'm like, is that going to be helpful for the mom-and-pop shop selling cupcakes? Because if it's too complicated for them, it's going to be too complicated for other, even if it's a critical infrastructure. So we really need to always think of, let's try to simplify this because if we truly understand it, we should be able to simplify it.

Get the basics right.

Absolutely.

The 101 class, not skip into the 501 class.

Exactly.

PhD track to figure it out. Right.

Absolutely.

And a lot of people think they hear cyber and they're like, it's technical.

Yeah.

Yeah.

Okay. But I would totally disagree with that. And I'm a living example in the sense that we do so much stuff that's not technical. You're looking at 90% of, up to 90% of all cyberattacks for all types of businesses, whether it's an energy grid or a cupcake shop, it comes from human error. So because they didn't update something or they're using password 123 or they're using the same password and they're not changing it regularly, or yeah, they're getting phished, they're clicking that link, right? Yeah, absolutely. So it really is that class 101. That takes care of about 70% of all cyber problems. So that's kind of our mission on the council is to help people understand that, prepare for the worst, but also just change a little bit of behavior, doing simple things that are not technical, and it will make a difference.

So for that cupcake shop, how is the word out? How do they know? How do they find the resources that the IEC, IECC, Indiana Executive Council?

Oh yeah, we're government. We love acronyms.

They gotta have an acronym, right?

IECC. Yep, absolutely. So we have a great website, something that the state didn't have many years ago when we started. It's in.gov/cybersecurity.

Awesome.

Pretty easy. Even if you just throw in Google Indiana cybersecurity, that will come up. And it's not like most government websites. So to everybody, you're welcome, because I really fought for it not to be like the other ones. It has buttons. Are you an individual? Are you a business? Are you a government? Do you want to assess yourself? They wouldn't let me do the assess yourself before you wreck yourself, um, something about copyrights or whatever.

But I'm sure there's an Easter egg if we look close enough.

I'm not gonna say yay or nay, but or maybe Easter eggs throughout the website, definitely in our strategy. So we try to make it as simple as possible. The way I look at it is if I'm trying to get, like you said, a cupcake shop, a friend of mine to do something simple with cyber, how would I want them to do it? I'm not going to send them to something that's super difficult. And as much as I love and appreciate the work that federal does in like NIST, which is the standards for cybersecurity, and you can find that with that National Institute Standards of Technology. When you, when you go there, it is super technical. There are literally hundreds of controls and it's just—

109.

Yes, yes. And it's just, it's impossible for any normal organization to put the time and effort into learning all that, right? Like, it's just not helpful. So, we have things as easy as a scorecard, which just gets you like literally like red, yellow, green. Where are you from a very high-level perspective of cyber to get you understanding, maybe I should be looking into this, maybe I should take this to the CEO. We did the scorecard that the state of Indiana and Purdue worked on very hard to simplify it to like an 8th-grade reading level that's operation-focused. So, it's things like, do you have a cyber incident response Plan. We don't need 10 things to talk about it. We just want to know, do you have one? Yes. No.

Start there.

It's— yeah, exactly. Simple, right? It's like operations. Like, what am I asking the manager? And not just the IT manager, like the general manager of a store.

Yeah.

If they don't know, then it's a problem because they're the ones running the show, right? So that's a lot of what we aim to do is just simplify the really good work that's out there by super ridiculously smart people. But it just— it misses the mark on getting to the people who really need it most.

Yeah.

We're getting ready in May, which is Small Business Month, to kind of as a giveback for our staff to bring a group of 3 to 5 small businesses together to kind of almost be like a cohort to work through over 6 months, teach them to fish, how they do it themselves. But we should definitely start with the resources that are already available to them as a base and say, hey, have you taken advantage of this yet? Let's not spend your time redoing what has already been created, you know.

Yeah, absolutely.

Resource.

Yeah, there's a lot of free resources on there. In your healthcare, there's a Cyber in a Box that basically brought a whole bunch of really cool resources that are all over the place into one area. We have the scorecard that I just talked about. We have a template for an incident response plan to start with. We have a business kit that the IEDC, the Economic Development Corporation, put together for small businesses that kind of go through— has simple to understand videos. I'm in agreement with you, having a cohort and teaching them to fish is such a key thing because I always tell people like, well, they should have a cybersecurity person. Well, they're just never going to have it because at the end of the day, at the end of the day, the cupcake owner is like, I want somebody else to bake more cakes. Like, they're too small to justify that. And understandably, I think it's unreasonable to expect small and medium-sized companies that it doesn't quite fit the line of that. But there's a lot of services and a lot of things out there that can help them get over that without having a full-time person that an office manager can take on. Or a lot of places like HR does it too, or COO. So I I think that that's what we try to do is just simplify it and make it easy to understand chunks. And I also believe that it isn't a black and white, all or nothing kind of thing. When it came to cybersecurity, I would say back in the day, it made it seem like if you don't do it, you're sucking. And if you do, you're awesome. You have to do all of it.

Yeah, there's a lot of fearmongering.

It is so much. And I'm like, you know what, if an owner of a business says, hey, if you're not sure about the email, I want you to just not click it. Just come talk to me first. That is significantly more powerful than any fearmongering, right? I think that there's just different ways that we can approach this. And I think just empowering small businesses instead of telling them what they're missing and what they need, um, or if they want cyber insurance, we have a cyber insurance toolkit to help them understand like that process and the questions they're going to get asked so they can just see, is it worth even going through the process and then getting denied at the end? Like, who wants that?

Well, what I love is you keep saying the words process and people, which are two things that we lean heavily on here. And we just had an attorney on here. But she is in healthcare and she said a lot of things she deals with on the incident response and the breach side is that this overconfidence or abundance sometimes of tools and that, well, I've got a lot of tools, I'm safe, I'm great. And then you look and see, okay, well I had the lock on the door, I had the chain, I had the dog ready to go, but someone knocked and I opened up everything and let them right in. So tying it to a fish, it's like, it's great the tools, but if people don't know what they're doing or they aren't trained, education, they're the much better defense to have first in the process. It's so. Again, I like this, it's not rehearsed. No, this is just organic, but everything you're saying is what we believe in heavily and try and push a lot.

Yeah. And I use the door lock all the time. Maybe they're a medium-sized business. They do have an IT division, right? Maybe not to the scope of a security person, but they have somebody who's, that's their job. And I always say it's like when you go into a business and to a division and the maintenance person gives them the key to the door of the business, whose job is it to keep that door open and closed? It's not the maintenance guy. He's enabling that, right? He's providing the resources for it, which is what IT does, but At the end of the day, the management has to make sure that they know and that their employees know to keep the door locked, right? So cybersecurity is just like that. You know, IT people, they enable and they're supporters of divisions, but they are most certainly in no way in charge of doing all cyber for an organization. It's absolutely something that everybody's in charge of. I think the more that we like shift that culture in organizations, the more that people will take it on as a, hey, let me think about this for 2 seconds. How significantly effective that can be is powerful.

Yeah. You mentioned to me earlier that the Indiana Executive Council on Cyber is not made up of all technical and IT people. So, right. How have you used your comms and PR background to help educate to the point you just made on it doesn't have to be all technical, like how are you opening up minds? And obviously some of it's with the toolkits that you're providing, but even in that forum of 250 people that are part of it.

Yeah, I know it's a crazy amount of people. People are like, I think it's the largest government council, from my understanding, in like the state. And I wasn't trying to like beat anybody's record. So, I'm sorry about the second and that has the largest. I wasn't trying to beat you, but I felt like if we were going to truly approach the people and organizational issue, we needed to have representation from the experts in those fields. For example, we're talking about cyber insurance. I have a legal and insurance committee. Well, I don't have IT people. Now, people that I have legal people who work with IT people in the cyber insurance world who litigate on issues on cyber, but so they have awareness awareness of it, but really they're like, their day-to-day is the insurance or to your point, the response, right? Having an IT person, like I always say, you don't go to your CIO and write the press release, right? You have a communications person do that because talk to the IT person and then they are the ones that know how to communicate something to vast amount of people because sometimes IT people are not the best communicators and that's okay because that is not—

I've never heard that before.

That is not— I know, I know. It's a surprise to me too. So I felt like I feel like the way I established the council was that we needed the, not just the breadth of expertise, but we needed the depth within those areas, whether it was response, recovery, risk management. And so those areas, and then within the industries, I as a state person should not be at all dictating what finance should be doing or energy should be doing. It should be that sector and the leaders in that sector that are saying, these are the things we need. These are resources would be useful because they are the experts in their field. Really rely on empowering all the council members. And they're all also not just Central Indiana. They are all from all over the state, some national, to represent it because I wanted the diversity of our regions. Yeah. Our regions work differently sometimes, but they bring so much to, to, to the table. And then we also have a diversity of sizes. So I didn't want a large energy company leading the energy thing. Well, that's great, but how about the small energy company that really is struggling with this? Yeah. Or the medium size. So throwing a lot of diversity and everybody's welcome to the party makes it a really fun thing to manage because it's just me doing the whole thing with a communications manager who takes care of the website and, and probably helps keep me sane along with my husband. But I think it's really the passion of everybody on the council. That's like my favorite thing on there.

Does everyone— that's a big group. Does everyone ever get together physically or post-COVID?

Yeah, we actually, we were very excited when we got back from COVID because you heard the stories of these councils and commissions that they came back and people just reprioritized, right? So yeah. They reprioritized. So I'm like, oh my gosh, no one's going to come. They're all going to be like, okay, we're still dealing with COVID I don't have time for this. And we had almost everybody, like it was a huge full house. It was standing room. It was awesome. So it just shows to the importance of this for people, even I think even more so after COVID.

Yeah.

Because I think we just really realized how much connected, more connected, right? Everybody started working from home.

Yeah.

Everybody was using Teams, right? I don't think I ever used Teams before COVID So, I think that also made the cybersecurity a bit more of a priority for the state. And we have a lot of agencies doing really great work. We have our Office of Technology, who's doing a lot of good work in local government. Our Homeland Security is providing a lot of great resources to emergency managers throughout the state. We have some great agencies involved. And then, of course, the Governor's Office, Lieutenant Governor's Office has been very supportive from that perspective. But we have Secretary of State's Office involved and the Attorney General's Office involved. And I love that Treasurer's Office, I love that it's it's mixed and it's not just one politician. It's really the leadership of the state coming together saying, all right, despite everything else might be going on in the news, we're going to come together on this one thing because we can all agree we need to do better in this area, which I get to have the pleasure of leading.

So that's really cool. What is on the forefront of the committee's priorities? What are you guys working on now? What's coming out next?

Yeah, I mean, I think we're really to the point of we built a foundation of having the website in.gov/cybersecurity. But really, I think it's just getting the word out about the tools is kind of the biggest thing right now. It was the number one thing when we talked to our council. We do pull them all together quarterly. Number one thing that was brought up was we need to do better about the awareness of these tools and what we're doing at the state. From like local government side with Office Technology, which they're doing a great job of getting the word out. But I think for me personally, it's really about getting to those mom-and-pop shops because we have so much now to give. You know, a few years ago I've been like, no, don't look over here. We're not ready. But I think now we're at a point where like, how can we make sure this is getting out to the right people? Because it's scary. I mean, businesses go out of business because of ransomware attacks, right? I mean, it's an un— it's unnecessary stress when there's things we can do to prevent it. And so I just want to help that everyday person that like is in there. And then there's also information in there for individuals. So I think people just— we're in an age, a very different age of technology and privacy. And so How do we respond to that as just individuals and humans? Right? So I like to kind of focus on that as the leader of this instead of just saying, well, everybody should just be doing this and this is how we should do it all. And I'm like, well, but humans are different and they come from different backgrounds. So how can we communicate it to them so that they're successful with it?

So, and the how is often the big question, right? I know I need this, right? I think that with the fearmongering, people know there's a need for it. It's like, but how do I go about it? How's the most efficient way? Because it costs money and it, and they constantly go down the wrong hallway. And so find those areas too. But I like how you said too, the small business mom and pop shops, because as you know, the larger companies, finance, healthcare, they're regulated. They know about these things here. But what you're finding out is the bad actors know that too.

So, right.

What happens is third-party risk supplier chain, you know, risk. And they're saying, I can go to a smaller one because I know they're a pivot point into a larger one. So you're seeing now from a vendor management program, they're saying, hey, look, we're going to require you to have these things be compliant because you are a backdoor into our system. And so I like that these small companies— and we have kind of a budding practice now with some of these smaller firms. And we have a local healthcare SaaS firm that came to us from a standpoint of their larger firms are coming to them saying, we need you to be this compliant with these different pieces here. And so we've helped them identify the most efficient path to get that taken care of because they're like, we don't know where to start.

Yeah. And the bad actors are— they— there's a business in this. I mean, they have call centers, they ransomware like organizations, and they're like, hey, here's 3 references so that you check to make sure that they did pay and they got it back. It is a true business model. So like any other business, they're doing exactly what we all do, right? Like they go by best practices, which to your point is like, why would I go spend all my time and effort into a fortress like Chase Bank where I could just go into these small banks that, that I know for a fact that they're not putting money into cyber training or they're not putting money into making sure and emphasizing with all their employees to lock those doors and stuff, right? You're absolutely right. And they get those small ones with just a click, you know, the effort to get them is so much smaller from that perspective. I would say a good way to start for anybody out there though is go to the website. I would even say if you're like, I don't even know where to start on the website, go and subscribe to the blog. We have a very easygoing blog. But yeah, I mean, we do things on there that makes it relative to cyber, right? So like, it's National Chocolate Day. Well, how do you relate cyber to that? Well, in true story, like, I got a call at 7:30 in the morning from American Express saying, hey, are you trying to buy like hundreds of dollars of chocolate at this place we've never seen you at? And I'm like, nope. But so like the blog's about, hey, it can happen to me, it can happen to you, but make sure you have these things in place to protect yourself, right, and your family, your finances. Or take a picture— well, we just had National Pet Day, right? So we've done things on that where it's, hey, take a picture of your pet. We're not saying not to do it, but don't do it on top of a bunch of documents that has passwords on it. So again, people don't like maliciously do it, they just don't connect those dots and like, oh, and you just doing that, you just removing the paper that has confidential information on it and take the picture of the pad has made you more secure. So that's kind of the point where it's like small moves, big impact. Yeah, is what we're kind of going for.

I like too how like you correlate some of the training to like the real world. And one thing we see with some clients, and we do a lot of awareness program building, but we've seen with the evolution of training, it's out there now, it's more than it used to be, but it's trying to tie those themes together and put them in order and correlate it real-world action. So yeah, the programs are building with— to your point, it's like, why do I get this training? Makes sense, and I read it, but how does it affect me in the business, in my department, at home, with grandma, with the kids? And so trying to take that same training and then apply it and correlate it to real-life action, I think, is— helps it stick a little more.

It does. I agree. I mean, people paying attention to having a baby and getting a baby monitor, you're like— so we have blog on that. We're like, hey, that's great, and look, I loved watching my baby be like, it felt weird after a while, right? Like I would just sit there and watch him breathe. But like at the same time, I'm like, make sure you change your password. Don't use the default password. Oh yeah, I didn't realize. Yeah, I should need to change that. But then you're at work and you're putting in a smart thermometer. Make sure you change your default password. You know, the big Target hack that happened so many years ago that they got crucified for, right? It didn't happen because of a Target employee. It happened through HVAC. Yeah. So people don't realize like the worst ones that we've seen was something simple. Making sure things weren't connected right. And so that's what we're looking for is just that huge impact on those situations.

We do a lot of threat intel things for some of our healthcare clients and we do a brief on each meeting and we show, hey, this is the recent ones in the area relative to you and size. And the point of entry is the most part it's associate left, email wasn't deactivated, we found a phish, old web server. So the points of entry are oftentimes ones that like process, procedures, and training can cover. So you're seeing a massive reduction in your thing earlier that that the tools are great, but the people in the process are going to empower the tool and determine the success of that tool.

Yeah, I always tell people, you can have the best tech in the world, if you don't train your people, you're still going to get hacked. Yeah, it's just that's what's going to happen. They're counting on that, that you're not focusing on the people, and that's what bad actors are counting on.

So if I own a cupcake shop and I'm going on to in.gov/cybersecurity, um, and is anybody else getting hungry?

I know now I want cupcakes. I always say that, and then at the end of it like, I need a cupcake now.

Yeah. So would the scorecard be a good place to start to evaluate, okay, what do I have, what do I not have, what is my IT outsource provider telling me is good enough versus what— absolutely— for a business my size I should be thinking about?

Yeah, I think the scorecard is a perfect step for that. Again, super simple, very basic. I've been giving that to small organizations, small department, a local government, not even just the IT person, and it fits. It talks through the key basically top 20 controls of what best practices are. So I think that's always a good start and it gives you a color reading, right? Add up your points and see where you're at. And if you're in red, you should probably talk to somebody about it, right? And do a deeper assessment.

Is it like the icing on the cake? It's the sprinkles.

I love it. So assess yourself before you wreck yourself.

I know, right? I really wish I could put that on the website.

Missed opportunity.

I know.

That is great.

But at least everybody who goes there will think that when they're looking for the Assess Yourself button. Yeah, right on the top page.

Awesome.

So good. Well, thanks for joining the show. It's great to have you on and learn more about what you're doing for the state and how you've leveraged your background in comms and PR to really use those core skill sets to advocate to others. And super excited to go out and check. I think I've seen some of the items, but I know I learned even in this talk several things that I didn't even know that you guys had done. So I'm excited to go check it out and potentially use it for our cohort of small businesses.

I'm more than happy to come visit them too.

Speaker will sign you up.

Yeah, awesome. I know, I say yes to everything.

Good to know. All right, well, thanks so much for your time and have a great rest of the day.

Awesome.

Thank you guys.

Thanks, Tracy. Bye.