Simply Solving Cyber - Jeff Ton

I'm Aaron Pritz, and I'm Teddy Guzik. Welcome to Simply Solving Cyber, the show that focuses on solving complex technology and cybersecurity issues with creative solutions featuring people and process, the human element. Alright, so I I'd like to now welcome to the show Jeff Tun, author, speaker, and founder of the Indie CIO Network. And he also does consulting and one-on-one coaching with local leaders and CIOs here in the network. And I have the pleasure of being part of that network in the many roles that I play and love taking part in some of the discussions and sharing across the community here. So Jeff, welcome to the show.

Thank you very much.

Yeah, I would like to get to know you a little bit more and have our audience get to know you as well. So tell us a little bit about yourself and kind of what, how you journeyed through your career and kind of key insights, especially for those that are getting into the field.

Well, I started out in technology as a programmer. That was my first role. You know, when I got done with school, I didn't really know what I wanted to do. When I grew up, so to speak. And at that point, it was the very early '80s. That'll date myself right there. And I bought a Commodore 64 and just fell in love with writing code. I taught myself how to, how to program at that point in BASIC, but then on into machine learning and really focused the next several years in getting into the information technology field and as a programmer. And I worked here locally in Indianapolis for Indiana National Bank for a number of years, uh, writing software for them. I worked for Thomson Multimedia, which the brand that everybody recognizes for that is RCA, and wrote software for them. And About 6 years into my role with Thompson, I joke and say I was drug kicking and screaming into management. I didn't really want to do it, didn't really, really want to play the political games, but found out that I was really good at leading people, at building strong teams. And so I spent the next several years at Thompson kind of rising in the ranks there, so to speak, and left there in 2006 because I wanted to be CIO. I really wanted, felt like I wanted to build an IT department and mold it after some ideas that I had. So I joined a local commercial real estate development firm as their, really their first CIO that they had and built that department and helped them kind of transform their business. About 2010, I left there and joined Goodwill here in Central Indiana. Goodwill is an interesting organization because it's actually made up of about 185 different locally owned and operated nonprofits that share a common brand. Got it. And one here in Indianapolis is one of the largest in the world. So I ran their IT department for about 5 years and just had an amazing journey of transformation that the team and I went on over that 5-year period and just accomplished some incredible things for the organization and its constituents that they serve. And then I joke and say I went to the dark side and I became a vendor. I really wanted to take what I had learned in my career and move to the other side of the desk. And so I joined a local cloud company by the name of BlueLock to be their first executive in charge of product. Their primary product line, some may recall, was disaster recovery as a service and infrastructure as a service. So we, we really built out that product line and then we were acquired in 2018 by Intervision Systems. I spent the next 2, 2.5 years with Intervision Systems helping with the integration of that acquisition and several others that they had performed. Then I left earlier this year because who wouldn't start their own business in the midst of a global pandemic? I launched the author, speaking, coaching business that you referenced about in March of this year. Very nice. Been quite a journey. Yeah.

So talk to us a bit more about your journey with the ND CIO Network. And I think what started as a small community into a very large community and how that group enables sharing and especially connected into some of the people and process and kind of human capital elements we'll talk about here in a bit, how that group helps in that space.

Yeah, this is an amazing group. It started about 10 years ago, and I always say I wish I'd written down the first time that we had lunch so that I knew when the 10-year anniversary actually was. But it was about 10 years ago. It was a group of 4 or 5 of us that had met at an IT gala here in town and decided we wanted to have lunch. And so we sat down and just had a fantastic conversation over lunch. Just 5 or 6 IT leaders, and someone said, "Well, this was really great. We should do it again next month." And I raised my hand and said, "Well, I'll schedule it." So I've kind of been raising my hand every month for 10 years, scheduling this lunch. And what has grown out of this is just tremendous because it's all, first of all, it's all organic growth.

Right.

We've gone from 5 or 6 people to our mailing list now is over 300, and all organically, all because someone said, well, you need to talk to so-and-so, or you need to talk to so-and-so, they need to be in the group. And so we, we keep growing, but we've always kept our lunches pretty much the same, which is it's, it's dialogue around a given topic. It might be as simple as we sit down, order lunch, and I say Today's topic is social media. Do you allow your employees to access it within your company or not?

Right.

Boom, that's it. And then the conversation just goes from there. And, you know, every once in a while conversation will slow down and someone will make the mistake of making eye contact with me, so I call on them to keep the story going, right? Um, and, uh, it's just this incredible dialogue of Lunches are probably, we probably get 30, 35 people most of the time attending lunches. So you get this interesting cross-section of different size companies, different industries, all with similar problems, not always the exact same problem, but you get these different perspectives of how to approach it and how to solve it. And together we all grow and our departments grow, our companies grow. Because we're exchanging these ideas. So the next thing that we did was about 4 or 5 years ago, I kept getting asked by vendor partners, "Hey, we want to sponsor your lunch. We, you know, we'll buy lunch for everybody." And I kept saying no because I felt like it would hurt the dynamic if all of a sudden it was a sponsored event. So After being asked that about 455 times, I said, but if you want to buy us drinks and dinner, we'll be there. And so we started the dinner series that you're familiar with. And once a month, give or take, we get together for dinner and it's focused on education. So whoever the sponsor is, is not really selling their wares. So to speak, they're educating on a topic.

Right.

That might be attracting and retaining talent. It might be— we did one a year or so ago on cybersecurity and some of the approaches that the CIO needs to be aware of for that. So all of this has continued to grow, and with the whole COVID-19, we've gone virtual. Which in some ways is a drawback because you're not face-to-face, you don't have that connection. But the other thing that it's done is it's removed the geographic boundaries on the organization. So for example, at the time that we're recording this, tomorrow is one of our dinner events and we have almost 300 people from across the country registered to attend the event. Because they don't have to drive to a restaurant in Indianapolis. They can attend from anywhere. So in some ways it's kind of helped with that, but it's, it's a great organization. And I tell you, I think what, what makes it work is that it's always been centered around dialogue and people sharing their ideas and their thoughts and their insights. And it's just been one of the most rewarding things in my career to be a part of.

So in every show that we do, we, we want to unpack a situation where you faced as an IT leader, a tough challenge, IT or cyber leader, that is. And specifically, I mean, there's always a technical solution. There's always a, a potential silver bullet that never typically yields as such. But the focus of the show is really focusing on the human element and people and process solutions. Regardless of if tech is involved or not. Tech is great, tech is important, but sometimes we overshadow the importance of the human factor. So I wanted to understand one of your scenarios where you faced such an issue and where did people and process come into shine?

That's a great question, and it's always been, I think, a great aspect of being an IT leader is In reality, it always comes down to people or process, and, and, you know, process is carried out by people. So at the end of the day, it's really about the people, and I love how you, you are focusing on that on this program. The story that came to mind when you asked me to be on the, the program was one related to cybersecurity, uh, and it's one that a lot of organizations are faced with, and that's if they accept credit cards, they have to meet a certain security standard called PCI DSS, Payment Card Industry Data Security Standards. And when I first arrived on the scene at Goodwill, there was a belief that because they were a nonprofit, they did not have to adhere to that. And that was a mistaken belief, as you guys well know. And so we embarked on a process, a project to start implementing the security standards that would be required to get certified and get— have somebody come in and assess that we were meeting those requirements so that we could say that we were PCI DSS certified. And as we started to do that, the price tag was incredible. And yes, we were a nonprofit, and it was, it was very sobering to see what it would cost to do that. And the primary reason, the primary driver, was our network topology at the time. First of all, it was very flat, so there wasn't a lot of segmentation in the network, but it also was hub-and-spoke. So all of the traffic from the retail locations would come back to the central— we called it a data center, it was a server closet. Let's get over ourselves. We love to call it that, you know. Hey, it did have conditioned air in it though, you know.

Okay, it's a fancy closet.

Yeah, it was a real fancy closet. And just a side tangent, it also had water-based fire suppression. In there. We fixed that too. Um, but, um, we— so we had this problem that we were faced with, that it was just going to be a huge price tag, because in a sense what that meant was almost every device on our network was in scope, right? Um, and this is, uh, was a network with 51 locations 3,000 employees. You know, we had high schools, so we had 3,000 students in our high schools, just a huge scope. And we were trying to find that silver bullet, right, that, that, you know, you can't actually find, but we were trying to find it. Was there a way to do something? And we brought in a consulting firm that had reached out to us and wanted to come in and talk to us about what we were doing. And they actually brought in one of their consultants from Australia. He happened to be— I don't think he flew in just to meet with us. We were not that big of a client. But they brought— he was in here in the U.S. for kind of, I guess, a speaking tour, if you will. And he came in and talked to us about this new technology, and I know you're not really looking for a technology answer to your question, but he started talking to us about point-to-point encryption and the way that that would eliminate a lot of complexity and remove a lot of devices out of scope. The problem was it wasn't available in the US. It was something that was popular in Australia, obviously, and it was just starting to take hold at that time in Europe. So for reference, when was this? I started for Goodwill in 2010, so it was probably 2011, 2012, something like that, that we're having these conversations. So what we decided to do as a team was focus on the people in the process. As many of your listeners know, and as you guys know, PCI DSS has a lot of process-related things to it in addition to technology.

Right.

And so we started focusing on those aspects and trying to get as much of the people and the process down. You know, the required certifications that people needed to have, the training that developers needed as they were writing code, the processes in the retail stores when they were taking credit cards, all those kinds of things we worked on first. And with the hopes that point-to-point encryption, or P2PE as it's— everyone in IT knows you have to create an acronym out of everything, so that's the acronym for it. And so we focused on the people in the process first, probably for a year or maybe even two. I mean, we were really behind the eight ball anyway. We had a lot of work to do, so it's not like we sat around doing nothing for a couple years, but we were really working towards that. And about the time that we wrapped up the making sure that we had our, our people and processes in place, then that technology was then available in the US and we were able to implement that and eventually get past compliance with PCI DSS. So that's— to me, that was a story of two things. One, the team that didn't get dejected, right? We got— we were on this path and we really thought we had an answer But it wasn't, it wasn't right in front of us. It wasn't something we could implement right away. And it would have been really easy for the team to get demotivated and not continue the process of building all this out. But the team really dug in. And in fact, we probably ended up with a much better solution at the end of the day than we would have if we just bought the technology and implemented it, right? Because we did focus on the people and the process first.

Yeah, no, that's a great point. And I like to use the analogy or the reality of sometimes people need to spend their budget and they buy software. And we used to joke that it's still sitting in the shrink wrap that it was bought in. Now with software as a service, that's not so much the thing. But I think the, you know, if you don't scale a solution across your business in the risk areas that you need to, you may not get the value, but you may still be spending the, you know, the monthly service fee that it takes to own that. So I think you can't underestimate the value of that process, organizational change management, and getting those important tools to scale.

Yeah, yeah, I totally agree. One of the biggest challenges we had— now this was after the technology was already available, we were starting to implement it— was the, um, what was the fallback plan if the store went offline, so to speak, right? So maybe there's a network outage, whatever it is, they still wanted, the retail area still wanted to be able to process transactions. Well, if your terminals are down, what they wanted to do, they wanted to use knucklebusters. So in the retail trade, those are the little mechanical devices that you slide across and imprint the credit card on a physical receipt.

Ah, the carbon paper.

Yeah, so we call them knucklebusters because if you've ever used one, they hurt.

Nice.

Um, the other, the other name for them was runt runts because they make that sound when you, when you do that. Well, so here's this, here's this retail, uh, area division that has 51 locations, all using, uh, all with 3 or 4 checkout lines, all using these manual knucklebuster machines and creating paper slips when their network was down, which admittedly wasn't all that often. That was part of what we'd done in the preceding couple years is stabilize the network. And so we had to do a lot of change management with the retail store to say, you know what, we've calculated the number of sales per, uh, hour and the number of— the amount of downtime. And you're only— you might only miss out on X number of sales for Y amount of money, and it's going to cost us 100 times that to wrap the processes around what to do with those physical receipts with credit card numbers on them. And how to secure them when, when they're at a retail store, and how do you transport them, and how do you destroy them. And so we were able, through change management, negotiation, and influence, change the process so they would say, right, we, we will not take credit cards when we're down. Now again, that was before some of the technology advances. Now these Now the terminals do a store and forward, so they encrypt and keep it there if they're not connected, and they'll do the authorizations later. And even that carries a little bit of risk because the merchandise is already out of the store and you may have— you may get a decline. So we actually went in and studied that too, is how often do you get a decline on a credit card, and we were able to change that process.

Yeah, so double-clicking on your scenario, you had a technology company that was pitching an Australian software piece that was only available in software. You're a nonprofit with limited budget, and you focused first on people, process, and getting the basics in place. How did you convince your team that— well, it may have been obvious that there was no silver bullet, but more so important, how did you unlock the potential within your IT team to solve the process problems and get excited about that, even though it's maybe not as sexy as turning on the next whiz-bang tool?

Ah, that's a great question. And there's actually two aspects of that that maybe we can dig into in a second, because the other aspect of it was convincing our board that we were going to more or less wait. Right? So that was a whole nother can of worms. But I'll say that this was an amazing team of individuals. And what we had done very early on was we had embarked on a 5-year strategic plan. And everybody got involved and motivated in this plan. Our tagline was any device, any time, any place. So everything that we tried to do as an organization was wrapped around that.

Right.

And so I was always impressed and always just astounded at this team because they were motivated. They were motivated to see that vision for themselves and see that to fruition. over that 5-year plan. The PCI DSS, or better stated, cybersecurity, because as you know, uh, security is far more than just a compliance framework, right? Um, and it's, it's far more than a check the box, uh, kind of thing. So, um, they really bought into that concept that it was it was not a technology solution. It was not a new compliance framework. It was just not another, uh, check the box kind of thing. It was a state of mind. And I, I think that's really what carried through into that particular story about the PCI compliance is because there was so much that they were doing and involved in, in there were— there was a lot of new things that we were implementing at the time. This was one of many. So I think they got their fix, so to speak, on new technology by implementing some other things, and that really fed that part of their personalities. And this part was really more about seeing the big picture and seeing the, the, the whole, uh, vision of what we were trying to achieve and the role that cybersecurity and specifically PCI compliance would fill, uh, in that, that grander vision of any device, anytime, anyplace.

All right, so that's a great example. Yeah, that state of mind or culture change a lot of times can unearth the the human factor to make sure that people are looking at the greater good of what they are trying to accomplish versus just executing on a task.

Absolutely. I think one of the key aspects of leadership is not only being able to have a vision of where you want the department to go, the company to go, whatever level of leadership you're at, but you, you have to be able to convey that vision and tell that story in such a way that the team sees themselves in that vision. They understand their role in the vision and what it's going to mean to them personally and professionally to see that vision to fruition. And if you can create that vision and create that story that's so compelling, they will dive in and they will amaze you with the things that they come up with that you hadn't even considered because they're so engaged in that vision.

Yeah, that's a great, great story. Awesome. Well, last question for you, Jeff, for new employees or new prospects coming up in cybersecurity, in IT, What if you had to give yourself advice 40 years ago when you were getting into it? What are some of your tips to be successful in this field?

Don't. Oh no, I'm kidding. Um, I, I think the number one tip and, and probably the, the, the number one thing that, that I've learned is, uh, it's, it's not about the technology. We all love technology. It's why we as technology professionals get into it, uh, or get into cybersecurity. We love tech, but it's, it's, it's about the business. Uh, and so I would encourage, uh, everyone, whether they're, whether they've been in IT for 40 years or they're in IT for, uh, 40 minutes, uh, to know the role that the technology plays in the business. They need to understand the customer, and I don't mean the customer that sits down the hall in accounting. I mean the customer that buys your company's product or service. Right. They need to understand that and understand how the company makes money. That will set them up for success because they will be able to bring their technology expertise, their technical expertise, to bear on a wide variety of business problems, and they will see, they will be rewarded by seeing how the technology can help solve those problems.

Yeah, that's a great, great answer. Well, Jeff, thanks so much for joining the show and talking with us and letting us get to know you a little bit more, and I'm sure our listeners appreciate that as well. Best of luck as you start your new and I would say enhanced journey into the CIO Network and all the authoring, speaking, and advising that you're doing.

Thank you very much. It was great to be on the show. I really appreciate the opportunity to talk with you folks today.

Excellent.

Have a great night.