Simply Solving Cyber - Chris Farr

Welcome or welcome back to Simply Solving Cyber. I'm Aaron Pritz.

And I'm Teddy Guzik.

And episode 5, we are excited today. We're going to be talking to Chris Farr of Eli Lilly. He is an advisor and owns strategy, strategic projects for the cybersecurity organization. And yeah, his background is interesting. So we've obviously talked to a lot of people across our first 4 episodes that have unconventional vectors into cybersecurity, but Chris comes from a background of finance and sales and marketing.

Yeah. Yeah. And I think Chris is the perfect example of someone that, you know, I'm always going around telling people anyone can get into cyber. Everyone thinks it has to be tech related, but he's been the perfect example of how you don't have to be, you know, get a major in tech or get all these sort of certifications. Sure, they help, but you can get into it anyway.

Yeah, he definitely lives in the people and process space, so we're excited to talk more to him. All right, welcome to the show, Chris Farr. Chris, thanks for joining. Tell us a little bit about yourself, and I know you have a unique journey getting into cyber, but tell our listeners kind of a little bit about you. We want to really get to know you and then kind of some diverse thinking and how to approach cyber and how you got involved personally.

Yeah, sure. Well, first of all, thanks for having me on the show. Uh, so the most important thing is, uh, I'm a, I'm a husband and a father of 2 kids, uh, live in the Indianapolis area. I've grown up my entire, uh, most of my adult life has been spent here in Indiana. I spent time in Chicago and St. Louis as well. But, um, so I worked for Eli Lilly and Company. For those listeners that don't know, it's a biopharmaceutical company. Based here in Indianapolis, um, 100 and almost 45-year-old company, but I've worked for Lilly now for 17 years, so really my entire adult life. I come at 2Cyber with a very different background than most professionals. I graduated with an undergraduate business degree from the Kelley School of Business at IU.

Go Hoosiers!

Actually, go Hoosiers!

We're actually all Hoosiers, so, uh, yeah, we gotta take a pause and a moment of silence there for the the alma mater.

Yes, exactly. Hopefully this doesn't— hopefully we don't offend the Purdue demographic that you're seeking. But anyway, started my career at Lilly and in sales as a pharmaceutical sales representative, thinking that that was going to be, you know, my career path. But a company like Lilly, you sometimes get opportunities to do different things. And so after spending time then as a district sales manager, I came back into Indianapolis Lilly had a really great program at the time called Lean Six Sigma, which you got your black belt certification and you spent really 2 to 3 years, you know, working on projects. And so I worked at that time supporting our diabetes business in the US, mostly commercial-based projects. But through that experience, I was looking to do something internationally and an opportunity came up within Lilly where they wanted someone to be a, what they called at that time, a business advisor. So essentially be the link between, at the time, Procter Gamble and our emerging markets outside the United States. And after talking to Aaron and a few others, at first I didn't, I really didn't have an interest in doing that job, but based on those conversations, I decided to get into it. And since that time, that was the beginning of 2016, I've really pivoted my, my career from going in thinking, hey, this is going to be a rotational assignment and I'd go back into the commercial business, to now thinking that information cybersecurity is, is my, is my chosen career path. And so to help supplement that, I just finished a Master of Science in Cybersecurity Risk and Strategy from New York University, just graduated in May with that. And currently in my role at Lilly, I lead kind of strategic cross-functional projects for information security. In the past, I also led Lilly's security awareness and training program and was a business advisor supporting all of our commercial affiliates outside the United States in that information security advisor capacity. So that is, that's me.

Very cool. I do remember that conversation in one of the cafeterias trying to convince you to to make that jump. And actually, that reminds me, early in my career, I took an audit role and I kind of got into it for the desire to travel when I didn't have a wife and kids to kind of need to stay local to that space. But I remember thinking kind of before audit that it was one thing and it was going to be a lot of paperwork and, you know, having to be mean to people. But then as I got into it, I kind of unpack that, man, this is business learning. This is solving process problems. This is identifying issues, but then helping them figure out how to fix those. So, did you have a similar awakening? Obviously, you must have, as you mentioned that you have kind of shifted your focus to really back up this path. But what were some of the ahas that you had of what you thought it was going to be versus what it really ended up being that is keeping you in it for the longer haul?

Yeah, similar to you. I mean, probably even less so. I mean, just for the listeners, this will tell you a little bit about my career pivot. I think the last technology course that I had taken was an undergraduate business IT course at Kelley. And so I had literally, I had no foundational technology experience at all. And so My thought going into it was, you're right, Aaron, it's going to be, we're the office of no, and my job was going to come in and be the bad guy all the time. Frankly, I think some people still view information security that way. I'm sure if you talk to colleagues at Lilly, they may look at us that way and other multinationals. However, I think the reason that I've stayed is I see information security as being a business enabler. We exist within companies like Lilly to support our overall business objectives and our mission at Lilly. My job does not exist if Lilly wasn't investing in, you know, life-saving medications, and products for patients. Our job is to enable Lilly's business to succeed and do so in a way that mitigates the information security risk that we inevitably accept by, you know, embarking on that business. And so for me, for me, I think the reason that I've stayed is I've always had an interest in problem solving, and that really was honed through my Six Sigma experience. I've always had an interest in geopolitics. And so I think what I found, and I've always had an interest in business, and so I think I found in information security, particularly the role that I'm in, is that you get an opportunity to scratch each one of those, those itches. Because really, if you think about the current state of cyber and information security today, it is a convergence of business and politics and nation-state interests and societal issues. And so if you like to work on big meaty problems, which I do, this is an excellent place to be able to do that.

Yeah, that's a great point. And your point about kind of the office of no or saying no, I've even evolved my thinking in the last couple years. I think it's easy as a risk and compliance professional to kind of identify the okay or the good practices and say no to the things that are bad. But I found kind of blurring or mixing technology, process, and people, there's more opportunities that cyber professionals can use their, their cross-functional skill set to determine how to enable business capabilities, but put the right controls around them to make sure that what is happening or what tools they choose to use are safe and still, still protecting the company and maybe even personal data that's being handled by the company. How have you seen that evolve with some of the projects that you work on to really help enable the business, as you mentioned, as a core tenet of the, of the function?

Yeah, I think it's one of those things where we have to admit as cybersecurity professionals, information security professionals, We don't have this all figured out yet. You know, I think we've made strides to be able to enable that, but I don't think we've solved it yet. I think the thing that gets us to where we need to go is a complete— I think it's a couple things. One is a complete mindset shift in realizing that your job exists in large part to help the business succeed. At the same time, as I mentioned earlier, mitigate the information security risk that we, we have to accept. I think the other way we get there is by hiring and attracting a different type of candidate for these positions than what we would have considered in the, in the past. And when I say that, that's not to disparage any of the listeners that have a deep deep technical background and expertise. I wish that I had some more knowledge in that area, but I've kind of accepted I'm going to— I've tried to build a foundation, but I'm never going to be a technical expert. I need to be proficient in that. But my point is this, is that the more people we can get into cyber that understand how a business operates, the more people we can get into cyber that understand how to make a risk-driven decision, I think the closer to that goal of enabling the business we really, truly, truly get to. And I think the first thing, Aaron, to your point, and asking about what are some potential ways to do that, I think the first thing you have to understand is what is the risk that you're, you're truly, you know, accepting before you, before you get there. So if, you know, a business unit wants to employ a new tool to reach a customer segment, okay, well, tell me about, business partner, tell me about what's the information that you are going to be sharing as part of this tool. You know, what, how is it classified if you have a classification system? Okay, great. Based on the classification system, then if that information were to be, you know, disclosed somehow, what would the impact be to our, you know, to be to the organization, to, you know, the customers we're trying to reach, to, you know, etc. Okay, so that's kind of covering the confidentiality. And then, oh, all right, so from an integrity perspective, what happens if that data is manipulated? Or what happens if that system's unavailable? And I think by having those types of conversations, I think a lot of what the business is asking for in most cases isn't unreasonable. And so, and so I think having more of those conversations upfront really helps get to the point where you can truly provide advice that meets the business need while at the same time too, you're doing your job as a cybersecurity professional.

That's a great point, Chris. I've also started to see like sometimes if you say no, and you block something or you instruct someone not to do something, you can sometimes create a workaround or a back channel to get something done that can be worse than the original ask itself. So I think from a risk management standpoint, and as you mentioned, tracing through those challenges or opportunities that they're looking to solve, I think you've got to think about how do you control, you know, how do you, how do you help them enable what they're trying to do, but also add the right controls to protect the bad versus just blocking it and then on the back end something worse happens because of that.

Yeah. And I think it's a great point, Aaron. And I think the other thing that you need to do too is make sure that where you can, you're explaining the why. If you have to say no or if you have to advise against it, just making sure that they understand the reason why. The business partner may not necessarily agree with you at the end of the day, But I think by explaining the why, you're doing your part to educate the business partner on, on that particular risk. Because what I found is most, most, most people don't inherently think about the types of risks that we're working on in cyber necessarily. And so by doing that, you're helping enable the next time that they, that they're thinking about a particular solution or concept, that they're maybe taking that into, they're taking security into account at the very beginning and not necessarily thinking about it at the end.

What do you think makes the perfect— not a perfect, but a good candidate for, for someone moving to cyber? So like, obviously it's important to have diverse backgrounds and everything, but is there a one common theme or something that you think would be there that, that you would look for in someone that's looking to join the cybersecurity field?

Someone that doesn't like to sleep. That's a joke, just because of, you know, this is a pretty nonstop action-driven world, I think, in no matter what role. I don't know if I can answer that question, Teddy, because, you know, there are so many— and this is the part I think that we don't do a good job of educating the general public on— there are so many different jobs now within the information security discipline. Right, if you look at a company like ours where we have a, you know, a relatively sizable information security staff, we have roles that are geared particularly in the risk management kind of business engagement function there. I would say, or more geared towards people that are focused on the people and process side. Then, you know, if you look at some of the other jobs within architecture, those, those require a significant, serious technical foundation. I think the, the thread though across all of that though is the ability, no matter if you are a security architect or if you are a third-party risk assessor, that you have to understand the, the the solutions that you're recommending or the problems that you're trying to solve, how it connects back to the company's overall business objective and mission. I mean, to me, being able to connect what you're doing back to the company's overall mission is extremely important. So to answer your question, what is that unique skill set? I mean, I don't know if I could describe that in a, in a candidate rather than just being able to say, hey, Can you, uh, can you see the big picture as a part? Can you connect what you're doing back to the overall company objective? If you can, then I think that is a really good start and foundation from which to build upon.

Yeah, Chris, that's almost like an element of motivational fit. And I want to ask you a little bit more about motivational fit because my audit story that we talked about, your story when you and I were chatting before you joined this field, you had some, you had some, you were unclear upfront, you had some hesitations. Ultimately, you really embraced it and you throttled in, but motivational fit for somebody that's coming in new is tough to assess if you don't fully know what you're signing up for. So how do you, or how will you help evaluate motivational fit in cyber talent, especially as you're looking at unconventional diverse entry points into the field?

Yeah, it's a good, it's a good question, Aaron. So I think it differs for the candidate that you're assessing. So if it's someone that's making a career change like I did, that's coming in with, that maybe is a mid-career professional that's looking to make a change, I'd want to understand a few different things. I hate using this term because it's thrown out so much, But someone that is learning Agile is extremely important. I mean, it's, it's kind of obvious, right? So for someone like me that's coming from a mostly commercial sales and marketing background and pivoting into information security, you know, I want to make sure that that person can, that has the ability to learn new things and learn it pretty quickly. And, and so that's, that's, that's kind of a given. That's table stakes, if you will. Right. I want someone that's going to be curious. I find the best folks that I've worked with, either at my current company or just, you know, through industry and those types of things, the people that can, again, kind of take themselves out of the day-to-day and see the bigger picture. And I think the only way you can do that is really to be curious about the world around you. So, if you're trying, if we say that, nation-state-inspired economic espionage is a bad problem. To me, you have to understand, uh, what, what is the goal of that nation-state? Why are they using economic espionage to further those countries' objectives? And I, I don't find enough cybersecurity professionals are as curious about that type of stuff, but yet that's an adversary a group of adversaries that we're combating on a daily basis. But if you don't understand their motives, then I think you're gonna have a really hard time mitigating against their tactics. So learning agility, being curious. I also would want someone that has demonstrated before that they've been able to solve difficult problems. That don't have kind of a clear path forward. If you're somebody that, you know, has to always know where you're going, um, I wouldn't necessarily say information security and cyber risk are necessarily the best places because there is, in a lot of cases, there's no roadmap, right? Um, I mean, you can go follow and do an assessment, right? I mean, there's there's well-defined assessment methodology, but sometimes you have to be able to be flexible enough to change your approach to meet, you know, whether it's the demands of the business or your business partners, etc. So I think those were the 3 things that I would say for a mid-career professional. For someone that's coming out of college or, you know, post-grad work, you know, I'd want to understand why they're interviewing, you know, why they've chosen interview at my company, and that's probably no different than anything else, but working for a company like Lilly, you know, we, the company does extremely important work, right? I mean, you're working on, you're supporting medicine development of pills or therapies that are going to go and potentially save a person's life, and so I think that's always really important to me as an early career professional if they're coming to interview at someplace like Lilly. So yeah, overall, that's how I kind of break it down, Aaron.

Nice. So you mentioned something, the problem-solving ability to problem-solve, think through white space where there's not always a clear answer. So kind of in the spirit of the purpose of this show, we always ask each of our guests to talk about a challenging problem that was in front of them and how they used people, a combination of people and process to work through that. Technology is important and is usually part of almost every solution or many solutions. But sometimes in this space, the people and process elements kind of get overshadowed. So we really want to bring that out. So talk to us about something that you saw or faced that really focused on people process to come to an innovative solution.

Yeah, so I think One thing that is, that's been a hot topic since I started in 2016 and, and, and something that continues to be is what do we do about employees clicking on phishing emails. And, and it's just one of those things where, you know, it's, it's the first thing that we want to do is is blame the individual. You know, I heard when I took the job in 2016, when I got into cyber, it's like, I can't believe they are clicking on those emails and they and they and they, and I'm like, who is they in this whole thing, right? They, it's typically we, the IT professional, represent about 1% of the world and we expect they, the other 99% to conform to all of our things. And so we have, you know, just like most companies, we're trying to figure out, hey, how do we fix the problem of employees clicking on phishing emails? And, you know, at that point we were, you know, we had employed a phishing education program. You know, we'd done, we'd really started to started to mature that, but I had the opportunity to kind of help build the foundation from which we build upon. And so when I was approaching that problem, I didn't necessarily think of it as a— I don't think you can go in and assume, hey, all of our— all the people that are clicking on those emails are either intentionally doing the company harm or they just don't care enough to, you know, not click. I think what we did is we ended up developing a different approach to phishing education, but I think the starting point for us was to figure out, okay, why are— and this is something you learn at Six Sigma early on, right, root cause analysis— so why are employees clicking on phishing emails? If you just stop at the surface and say, well, it's it's that we assume that they are, you know, employees just don't get it, then, you know, maybe you would go immediately to discipline or something like that. Where we decided to take a very different approach. And so the first thing was to understand what are our hypothesis for why, you know, employees are clicking on phishing emails. So we came up with a few different things, right? Well, maybe it's we haven't provided them the, the awareness and the training and education to know not only what a phishing email looks like, key indicators to look for, all of those types of things, right? So we put some things in place where we invested in some, some more engaging kind of quick learning for those that had clicked on emails. Then we also assumed that, you know, maybe leadership hasn't been engaged, and that's more of a people, right, a coaching thing. So We developed a model where we get supervisors involved and make them aware that this problem is occurring for those that consistently click on phishing emails. Then we said, well, maybe it's because that we haven't done a good enough job in our email of identifying, you know, when emails are actually coming from an external party. So we added an external an external tag to emails, which every company has done now. What you find, what we did is we developed this system that is really a progressive model to phishing education. If we would have just focused on, "Hey, it's just a training issue," or, "It's just a technology issue," we would have gotten to a much different place. Instead, we developed more of a holistic program that tries to focus on people, process, and technology to solve the problem. And so that's just one example, and I'm sure there are others, but that's one kind of prominent example, Aaron, that comes to mind.

Yeah, no, that's a great point. And I like how you unpack the people, process, technology and took shots on goal across all of them. My biggest pet peeve right now when I see some posts on LinkedIn with kind of polar opposite views, with some people saying, "Hey, we're never going to fix the employee behavior issue, so let's just block everything we can and the technology will prevail. We can't fix the people." They write that off. And then on the flip side, others that think that if we just keep sending the ethical phishing or the phishing simulations redundantly, eventually people are going to learn. Your narrative of the answer is not an either/or, it's an and, and there's probably processes and stakeholder management and organizational change management that come alongside as well.

And too, I wanna be clear, I don't think that this has necessarily been figured out yet. I think the other thing you have to, when working on difficult problems, you have to be humble enough to realize that when someone says, "We've got this completely figured out," they don't have it completely figured out. I mean, that's a, that's a fallacy in my opinion. If you say this is an unhackable system or this tool fixes everything, immediately turn off the television and run in the other direction because it's probably—

Now you're a target.

Yes, yes, exactly right. So listen, we don't have it all figured out around phishing education, but I think one thing I also learned in Six Sigma is the concept of continuous improvement. So, you have to start somewhere, but then what you should be doing is after you employ a solution, whether it's people, process, or technology, that, you know, at a regular time interval, you're going back and saying, "Hey, is this still working?" Right. Is what we developed a year ago still working? If not, let's make some incremental changes. What I see far too often is we say, "Oh, it's not working. We need to invest, you know, millions of dollars in a new solution." In reality, maybe there are incremental changes you could make to solve the problem. Right.

That's a good point. So we are running out of time here, but I want to, to kind of one last thing to talk about. Speak to our listeners that are maybe not in cyber yet or just getting into cyber. What are, what are your best tips of how to advance their careers and get more engaged from an emotional standpoint and just through your learnings and your diverse entry point in, what are, how do you leave the audience on some tips to help further themselves?

Yeah, sure. Great, great question. So I think the first is no matter, no matter, no matter which job you're in, in cybersecurity or information security or what you're doing, I think you do have to have a You have to build a technical foundation. And so I think you have to determine what you, what you want to do within cyber. If you're going to be a domain security architect, you're going to need deep technical expertise. So you should set up a plan and ways to get that, whether it be through a university, a community college, a nonprofit, however you want to do it. If that's the road you choose, you need to build that technical foundation. And it may be very deep in some cases. If you're going, you know, into where I've kind of landed, information cybersecurity, you still have to have a technical foundation, but it's not that deep. And so I think that is a requirement of moving into this field, is I think you have to have some technical foundation because if you're like me, I may not be the one architecting an identity and access management solution, but you at least have to understand what the architects are talking about because if you don't, then it's really hard to be able to articulate risk back to your business partners that aren't InfoSec. So that's, that, that's number one. Number two would be get some experience. Any experience is a good one. If you come and you're, you're trying to interview for a job and all you've had is is just kind of theoretical classroom-based experience, you're probably not going to get the job. So where can you get either an internship, even if it's unpaid, if you're in a position to do that? Any experience just to get that kind of hands-on experience is going to be good and I think looked at favorably by a potential employer. And the third, I think, kind of goes back to what I was saying earlier where, you know, I think we need more curious people to get into this field. And so I would consume, you know, all of the content that you can that is out there, and there's a lot of good free stuff. So I read on a daily basis. Wall Street Journal has a Cybersecurity Pro, which I pay for, which is paid. But you can follow Krebs. Bruce Schire has really good content as well. SANS publishes a lot of free content. And so by reading about all of the different things that are going on in the world, whether they're breaches, both from a government or private industry perspective, you're going to really educate yourself on the field that you're moving into. And I think what you'll find is that if you like to come in and work on big, really important stuff, information and cybersecurity is a great place to do that. And I see this before the— before our current pandemic, I saw information and cybersecurity as being the next big thing, the next worldwide problem that society would have to solve because it's used for good. Technology has been used for good, but it's also being used for bad, whether it's to manipulate an election, steal from people. And so, we need people that are interested in the good to help kind of solve some of these problems. And I think the only way you can do that is to be aware and read a lot, which I do on a daily basis.

Awesome. Well, Chris, thanks for joining us today and best of wishes. Uh, stay in touch and, uh, thanks again.

Thanks a lot. Thank you.