Simply Solving Cyber - Jeff Ton

Leadership skills that got many of us to positions of leadership, especially in technology, are not the skills that our businesses need today, nor will demand in the future.

Welcome to Simply Solving Cyber. I am Aaron Pritz.

And I'm Cody Rivers.

And we are here again for season 2 with Jeff Tunne. He is an Indianapolis icon, I would say, in the CIO community.

My God.

He's a former CIO. Head of this IndieCIO network, and we want to talk a little bit about your TechPoint merger/acquisition. And then also, I guess, president, CEO, and Grand Pumba of TON Enterprises, a strategic IT advisory.

My cat would say that she's in charge.

Very nice. Awesome. So, Jeff, we've caught up before, and for our recurring listeners, they've heard a little bit of your story, but maybe fast-forwarding from some of your background and as a CIO of Goodwill and a long IT background, talk to us about what you're doing now, the CIO Network, and kind of where that's transitioned.

Yeah, well, uh, so I've been in IT for 40 years here around Central Indiana. Seems like that's a long, long time, and it is. But one of the things that I did about 3 or 4 years ago was I stepped away from the corporate world, um, and founded Tunn Enterprises. Again, I was really creative with the name.

You're living large.

Yeah, yeah. Very large, very heavy, very heavy. But what I really wanted to dedicate this part of my career to is something I call changing the face of IT. And that means a lot of things. But basically the leadership skills that got many of us to positions of leadership, especially in technology, are not the skills that our businesses need today, nor will demand in the future. So all those things that we used to call soft skills, are really essential skills. Collaboration, communication, design thinking, some of those things that we just didn't focus on as IT leaders. We got to where we were because we were good technologists. Yeah. The other thing that I wrap into changing the face of IT is diversity and inclusion. As you all know, the numbers in the technology field is horrible.

Right.

And so trying to drive that change within the industry as well.

Awesome. Well, talk to us about the origin of the CIO network and then kind of where the TechPoint evolution has taken you.

Yeah, absolutely. So the Indy CIO Network, which is now the Indiana CIO Network, really started as 5 CIOs got together for lunch 13 years ago. and we had a great conversation and somebody said, well, we should do this again next month. So I raised my hand and said, well, I'll set it up. And so I've been doing that for 13 years now. What started as those 5 CIOs getting together, though, has grown into a network of 250+ Central Indiana CIOs and IT leaders that get together sometimes a couple of times a month.

And some transplants that have moved on. I know some have dialed in from California.

Exactly.

Yeah.

They don't want to leave us, right? They relocate. And I always ask them, do you still want to be on the mailing list? And they're like, oh, God, yeah, we want to stay in touch. The group has really evolved into a community. I like that word. I saw that in a LinkedIn post last week about don't call it your network, call it your community. And I really like the sound of that. So we've been going along for 12 or 13 years and being very successful, but was really looking for a way to make it to, to have a bigger impact. Right. At the same time, TechPoint, who many of your listeners know, is a nonprofit here in Indiana focused on promoting the tech sector within the state and driving employment in the tech sector. They were pivoting a little bit from more from tech product and service companies to tech-enabled. So corporate IT, which is where the sweet spot of the Indy CIO Network was, is that corporate IT CIO. At the same time, I'm hitting that stage in my career where it's time to start thinking about who's going to take this over when, when, you know, I hang up the sneakers.

Ahead of that, I've heard with CEOs and leaders, it's the giveback, the philanthropic portion of your career.

That's right. A dear friend of mine calls it the back nine of your career. It's like, oh gee, thanks.

Yeah.

But seriously, I was looking for how does it continue, right? How does it get bigger? How does it get better? How does it continue? So I was having these informal conversations with a couple of folks at TechPoint, and they were like, well, we've been wanting to start networking groups in other communities in the state. Why don't we get together and do this? So long story short, we, we talked over October and November and signed a letter of intent, and they acquired the CIO Network as of January 1st, rebranded it the Indiana CIO Network, and we've got some great plans that you'll start to see over the course of the next several months of doing just that. Growing it beyond Central Indiana.

Yep.

Through a variety of means. If a city has a CIO group already, maybe we just partner with them, pick them up. If they don't have them, then maybe we start one. So that's the idea, is to grow that. The, the TechPoint partnership also provides, I think, better access to facilitators and speakers that can come in and really work with this group. And so the content will improve as well.

So within that network, what are some of the topics that are bubbling to the top of your list?

Oh man, the, the— so we do a survey every year about, hey, what do you, what do you all want to talk about next year? Um, and, uh, the, the, the top 3, I, I found these really interesting because typically when you survey this group, the number 1 and number 2 are cybersecurity and attracting and retaining talent. Those, for years, those have been number 1. Not this year. Number 1 was creating change in our organization or driving change in our organization. Number 2 was digital transformation, whatever that means.

We'll talk about that later.

Yeah. And number 3 was cybersecurity, which, as you guys know, is a broad topic.

Yep.

And really spans all 3 of those topics.

Well, they all 3 are kind of related, right? Because To do digital transformation, you must drive change. And what change are you trying to drive if it's not digital transformation and cybersecurity? Right.

Well, speaking of too, so in your background as a CIO, when did you see cyber start rising on that list of priorities compared to then to now?

Probably a lot later than I should have. I was thinking about that as we were preparing for this conversation and thinking, so my My first CIO gig was with Loth Property Group, a commercial real estate developer, great organization. And I can't remember having that many conversations about cybersecurity at the time. I'm sure we did, but it wasn't like, bam, right there at the top, right?

Were attackers not after punch cards?

It was not that far back. Come on, come on, come on. We'd graduated to paper tape by then. All right, all right. So no, this was— 2004. So, you know, it was internet, but it was early days of internet.

Sure.

And a lot of businesses weren't that connected yet to the internet. You had your, you had your wide area network to connect your own organization together, but you really weren't doing that much on the internet itself, right? Email maybe, right? But you, that was all internal. So we did a strategic plan back then, and I'm trying to remember, I'm sure there was a security project or two in there. But again, it wasn't like it is today. That is so front and center that, as I was mentioning the surveys, cyber is usually the top 1 or 2 items in there that are on the minds of the CIO. It's what keeps you up at night as an IT leader is that breach? Because at the end of the day, if you get breached, it's the CIO that loses their job.

Well, and I, I think on, on that piece, part of that is where is cybersecurity owned? And, and a lot of times it's owned by IT, or that's the default. But a lot of times, like, protecting information has broader ownership. So I think, yeah, maybe your first topic being change management and transformational change, I think the IT community has missed the influence piece of cybersecurity and even broader IT initiatives.

Yeah.

What are some of the stories that you have or the inquiries that are coming into your group on things that need to be different as we approach our business community?

Well, to that end, one of the things that I thought was really interesting was when I went to Goodwill as their CIO, they had a risk management department. Now, Goodwill has a big retail presence, so you would think that they would have loss prevention and risk management, but that group was also involved in cyber. They were also involved in disaster recovery and business continuity. So they were taking that responsibility much broader, and it did not report up through me as the CIO. So I think that's a good point, Aaron, is that It is a company problem. It is not just an IT problem. And because IT has traditionally owned it, it's seen as an IT problem. And I think that's part of the change that we have to drive.

Yeah, I think a lot of times they see as, you know, cyber means tools and tools means IT, you know, forget the people and process part of cyber, which oftentimes is one of your most valuable assets to a cyber program.

And also the weakest link, right?

Also true. The people.

The attackers know this well. I don't know that all business leaders know this.

Social engineering.

Yeah, yeah, yeah, yeah. Here's this email. My, my long-lost uncle from Nigeria wants, uh, wants a million dollars. Why not?

It used to be that, that, that transparent. Now it's like, it's not reset your Zoom password and yes, a lot easier to fail.

Oh yeah, they've, they've gotten more sophisticated in the way that they're going after, uh, people to get their opening in, right? And One of the areas that I know you guys focus on as well is they're not just focused on you for you. They're focused on you for your supply chain, up and down your supply chain. Right. You may think, oh, I'm just this small little boutique firm. Who would want my data? They may not want yours. They want your clients.

Your pivot point.

Yeah, yeah, yeah.

Law firms, accounting firms.

Yes.

CPAs, HVAC firms.

There you go. To name a few.

Yeah.

Speaking of that, you know, When you tie tools and people and everything, when rolling out tools, we see a lot of folks and companies that push the tool out right away. Again, IT's pushing this tool out. You spoke of change management earlier. Thoughts on what we think is aligning the process and the why and the people behind the tool to maximize that kind of symbiotic relationship. But talk about what you've seen there.

Well, I think across the board, we have a problem with with projects that get labeled as IT. We were talking about this earlier. John Thorpe is an internationally known thought leader on helping businesses obtain the value out of their initiatives. And he talks about it as a labeling problem. We say this is an IT problem, just like cyber we were talking about a second ago. And then kind of the next piece that they fail to realize is that there is change involved anytime you implement a new tool. Processes change, people's jobs change, and we take change management too lightly, right? I was talking the other day that, uh, I was CIO for Loth Property Group, commercial real estate construction. We always talked about this concept called value engineering. What value engineering is in the construction industry is how can we make it cheaper, right? And so you look at a lot of IT initiatives, and I was guilty of this myself when I was in leadership role. You see this project and you see this line item called change management. It's like, oh, we're going to value engineer that puppy out, right? We don't need to spend the money on change management. We can implement change. And the fact of the matter is you can't. It's complex. It takes a lot of time and a lot of effort. And it has to start at the beginning before you roll out the tool.

What's that called? Strategy?

Yeah, yeah, yeah, yeah. We were talking about strategy earlier too.

What's that?

Strategy is what you come up with after you implement something.

Yeah, oh, we should have done that.

So have technology leaders changed from like he or she who has the most tools to more of understanding the value of process and scale and getting the results? Are we all geeks at heart where we want more and more and more of the best, coolest technology? And is that— are we defeating ourselves with volume?

Well, we are all geeks at heart. That's why we went into this. But I, I would like to think that we have changed and we've taken a more business-focused approach and spent the time to understand the why, the strategy. Why are we doing this? What value are we going to derive from it and how do we measure that value? And then how do we hold ourselves accountable to that value rather than just stacking up the tools?

I know one thing right now that we see a lot of is information classification or data classification. And part of that protecting is knowing what we're protecting and knowing what information we have. But to start there, Even the CIO is not going to know where all my data is. And so it's teaching the employees of, you know, how to classify information, where's it at. And then once you can see it, you can protect it better. But the first thing is to know where is it.

Yeah.

I guess your next topic was digital transformation. So what— I mean, that can mean a lot of things for a lot of people. What does it mean for Jeff Tunn?

That is such a great question. I love that topic. I'm a fellow for the Institute of Digital Transformation, and we obviously talk about this all the time. In fact, just short plug, we just released a new book, Digital Transformation Demystified. It's co-authored by 10 of the fellows. I wrote the chapter on leadership and Lewis and Clark.

That's not a surprise at all.

And digital transformation.

Can I get that on Amazon?

I think so. I think so. I'll give you the link. I know you can get it from the Institute's website. Okay. You can order it there.

What about Audible? I'm a big audiobook guy.

I don't think it's come out on audio, Audible yet.

If you need a voice, I'm happy to—

You've got the voice. The voice you got, man. So anyway, one of the things that we talk about in this book is that trying to define digital transformation is kind of a red herring because it's different for every organization. One of the folks at the Institute is Frank Granito. Frank is our chief scientist, which means he's a real data geek, but he's also a chef. And he talks about the difference between a cook and a chef. A cook is great at following a recipe, or hopefully they're great at following a recipe. I've been in some restaurants that maybe not so much, but they're great at following. Two stars. They follow a recipe. On the other hand, a chef understands the flavors and the chemistries in the food, how they blend together to create the dishes we all love. Well, if you're running digital transformation, you need to be a chef, not a cook, because there is no recipe. And so it really— one of the things that digital transformation to me really boils down to is this convergence between IT operations and the rest of the business. Those three coming together. And, you know, you can talk about customer first and some of the other nuances of digital transformation, but if you don't have those three converging, you're never going to be successful.

Yep.

Speaking of chefs and cooks, I'm getting hungry, so I'm going to move on to the next question. And Cody, let's say it together: Saturday Night Lifestyle.

Who—

he's not going to do it.

He can't do it.

He's like, who should own digital transformation? Are technology leaders in IT best equipped to do it, or does that need to be owned by somebody in the business?

Oh yeah, good question.

Well, and you warned me you were going to ask this question, and, and I really struggle with this because as a former CIO, I, I want to say the CIO needs to own it. But it really, if you don't have a strong partner within the business that you're partnering with, it's going to be really hard to drive the change that you need to change throughout the organization. So I guess I'll answer it kind of twofold. Yes, they can drive it, but they've got to have a partner in the business that really understands what they're doing. And back to what Cody, you were talking about earlier, the why they're doing it.

Yeah, we see a lot of things too, you know, that driving that like functional ownership, right? So IT, to your point earlier, can help drive security and help, you know, automate it and influence it. But the functions are going to know, they're in the business every day. They're going to know where the crown jewels are. They're going to know how to best talk to them and to socialize those things too. So when the policy comes up, that may not come from IT. Instead of IT being the bad guy, you've got a functional leader says, hey, this is a real thing to do.

Absolutely.

So is digital transformation pulling away from cybersecurity, or is cybersecurity pulling away from digital transformation, or do they need to be one and the same?

Oh, great question. Great question. On a roll today. To me, cybersecurity has to be built into everything you do as an organization, not just technology. Perspective, right? But also the rest of the org from cyber responsibility, making sure your organization is cyber resilient, all those kinds of things. But if it's a line item in a project plan, yeah, it's not going to work. It's got to be embedded from the start. And I'm not suggesting that you don't need a cyber group headed by a CISO. I think you need those. Within your organization to help you drive the strategy. But it really has to be pervasive in everybody in the organization that, hey, we're going to digitally transform, whatever that means for your organization, but we're going to do it securely. Yep.

Kind of bridges all three topics from the CIO Group together.

Yeah.

Change management that hasn't been embedded in the past. How do you get it more embedded? I'll tell you for damn sure it's cheaper if you embed it versus trying to clean up the dumpster after the fact. We've seen that countless times.

Yeah, you lose the trust and now they're frustrated and now they're more resistant to the change.

Well, and as we were talking earlier, right, 70 to 90% of IT projects fail.

Yep.

And that number's held true for decades. Why does it fail? You're not driving the change in the organization.

And scope creep.

And scope creep. Yeah, it's similar. Yeah, yeah, yeah.

So on the cybersecurity front, what are the things that have bubbled to the top of your list or the conversations that you're having?

One of the things I'm really looking into right now, I'll put in another shameless plug. I host a podcast called Status Go, and I'm going to be interviewing a guest coming up on zero trust. As a strategy for cyber. So this is a new, a new area for me. I know it's been around for a long time, but it seems to be getting a lot of interest and a lot of traction. So I've been trying to learn about that. I think that's interesting. And another thing that I've seen in the last several months is the concept of continuous pen testing, penetration testing, or penetration testing as a service. I think those are Those are interesting to help companies drive cybersecurity within their organization who may not have all the resources to do it. And especially with continuous pen testing, right? Too many times it's a check the box. Yep, we did our pen test this year. We don't have to worry about that again. And 20 minutes later, you're not secure anymore because something else has come up.

And what is a pen test? Is it a commodity scan? Is it a white hat hacker that— knows what they're doing? Is it a red team?

Yeah.

Lots of depth there. Lots of variety in the market, which makes it tough for CIOs to kind of know what they're—

what they're doing.

Getting a lot of things you see, it's like playing whack-a-mole, right? Like there's always going to be findings on it. But again, to solve the finding, solve the program that, you know, fixes that. So then ongoing, you're getting better as a company.

Yeah, absolutely. I love the visual on that.

Yeah, right. One more pops up.

Great game. So, Jeff, what are some of the things that you'd recommend for all the leaders listening to better themselves and to be more of an influencer within their business community?

Well, I think the top thing they need to do is listen to Simply Solving Cyber. Just, just saying. Just saying.

That's perfect.

I think that's got to be number one. No, I'm serious. You guys, you guys put together a good program. I, I think, uh, it, it is important for CIOs, IT leaders to continuously learn and explore. One of the reasons we got into this field to begin with is we were curious. Yep. We love to solve problems. So don't stop learning, whether it's podcasts, whether it's books, whether it's Audible books that we were talking about earlier, any of that. You have to keep learning because the landscape keeps changing.

Do you see a lot of folks— and I know when you get to large enterprise, the strategy and the investment in that is more prevalent than at the smaller mid-market size. They kind of want to just ready ready, fire, aim type thing. But talk about real quick too, just the importance of strategy and defining. It may not be in 6 months or 12 months or 24 months, but if you have all these tools and you're putting things, you're getting better. How do you know if you're getting better if you don't have a strategy? If you're just putting things in and then as a CIO or a CISO or CISO, however you, your choice of pronouncing it, but then how do you report back on, hey, I've done this, I've moved the needle this much. If there's no strategy, how do you report back? What you've done and how you move the needle?

That is such a great question. And I'm going to take it back even a step and say Simon Sinek was right. It starts with why. Why are we even doing these things to begin with? Then you can define how do we do them. And those become your strategies, right? What are we in business to do? John Thorpe would say, what is value? What is value to us? Right. It may not be just the bottom line. There may be other things in your business that create value that, that you value. So starting with your why, and then let's talk about the ways that we can get there. You'll have multiple strategies to implement. And then the third piece of that is how are we going to measure it?

Yep.

Because if you don't do that at the beginning, you end up with this nebulous thing that just runs amok. You've got to have the discipline to have your why and have it very simple that this is what the company does and why we do it. Now, if our goal is this, then we're going to use strategy A, strategy B, strategy C. For strategy A, we're going to measure it in this way. Strategy B, we're going to measure it in this way. Yep. You've got to do all that, right? Or you won't know when you get there. Yep.

Awesome. Well, Jeff, we'd like to thank you again for coming on the show. I know we are off to our Reveal Risk networking event that we have with various CIOs and CISOs that we do every other Friday. So we're looking forward to talking to you more and hope that some of our listeners come out to the networking event as well.

Yeah.

And thank you for being on the inaugural reboot.

So there you go. There you go. Happy to be here, man. Happy to be here.

Awesome. Thank you.

Thanks, Jeff.