Simply Solving Cyber - Leon Ravenna

Thanks for tuning in to Simply Solving Cyber. I'm Aaron Pritz.

And I'm Cody Rippers.

And today we're here with Leon Ravenna, CISO by background and owning IT and infrastructure and some of the other capabilities as well. But why don't you introduce yourself and then we'll dive right into the discussion?

Sure. So happy to be here. I'm Leon Ravenna. I have, uh, I've been doing technology now for 36 years, and, uh, so way, way, way long. I know I look like 29. It is what it is. So I've been doing technology since the mid-'80s. I grew up doing endpoint stuff. I was a Master CNA, I was Unix admin. And for those of you that are young, you don't know what a Master CNA is, but it was in the network world a long, long, long time ago. And, uh, done a lot of technology, built data centers. Started doing security about 2003, and unfortunately I was the guy that didn't step back fast enough when we were asked who wanted it. And so started doing that kind of in, in both roles. Did a lot of technology up through about 2014, came into Interactive Intelligence to run security. And so I ran global security privacy for them and then moved to Carr Global about 6 years ago. And I've been doing global CISO role, tactical privacy. So some of the work behind privacy, a lot of compliance. Then I picked up the CIO role a little over a year ago, and that includes everything in IT except for development and for data center compute.

A lot of people that came up early in security mentioned kind of didn't get out of the way fast enough. When did it— when did it convert from you from a, hey, I was there, I did it, to more of a passion, like I'm all in on this?

Yeah, you know, it's funny, the, uh, I originally wanted to go in college to University of Minnesota and study, um, law enforcement. I wanted to go Secret Service and, uh, ended up going to a small private school in Indiana that had a great computer science program. And, uh, so it's always been kind of in the, the background of passion, but really, you know, in, in the mid-2000s, okay, started being a lot of focus.

Awesome. And, uh, kind of owning the CIO role, and a lot of our industries have talked a lot, you know, should it be separate, should it be combined? I think it, uh, for For me, the answer a lot of times is it depends on the person, on the company, on the broader buy-in. But give me your take on that. How have you leaned into that role and what do you think the right mix is?

It's a great question. And I think it's really balancing the voices in my head. They consistently argue, but I come at things with a security-first view. It helps as we're starting to think about how we do new things. It drives more of the IT folks that I have reporting into me to think about security. The classic piece there is I'm trying to shut the pipes down from a security standpoint, open them up from an IT standpoint. So it's striking that balance. I know there's been a lot of discussion over time about where should the CISO report and stuff like that, reports to the CIO. And it really is, in a lot of cases, And that's changing, but having both roles kind of gives you focus into being able to help on both sides, to do things in a balanced approach.

Okay. Do you find yourself with broader reach owning both?

If you think about uptime, the example that I use a lot is from an IT standpoint, I want 5 nines. Okay. From a security standpoint, 5 nines sucks. Okay. If you think about it, if I'm doing 5 nines and I'm trying to protect 100 100 million emails a year. Well, that means 1,000 get through. Yep. Okay, so the numbers actually have to be a lot tighter on the security side. And so it— having a background in both helps drive it. I think if you came into it and say you grew up on, say, the GRC side and you're a CISO, you're probably not going to have as much reach into some of the IT things. By virtue of having done technology for so long, I mean, I was doing software delivery in the mid-'90s on Windows 3.1, and we're doing—

you're doing a lot of Windows 3.1 today? Yeah, yeah, yeah.

Now I'm doing a lot of software delivery.

Okay.

Um, you know, the— realistically, my job is again to strike a balance between what we're doing, and I look at uptime from a couple different, different perspectives. So very cool.

I would too. And just take a step back too, maybe give listeners just a brief overview of what Carr Global does so they can understand what a task you have at your hands. They're running both sides.

Yeah. So Carr Global is a— I think it's Fortune 900 now. When I started, it was Fortune high 6. We spun off a billion-dollar company in 2019. That company should be acquired next week, should go through for $7.2 billion. So pretty good shareholder transaction. We also sold our biggest business unit last year to Carvana. And so I have, it's kind of interesting, I have 5,000 people that I take care for part of KAR, but I also take care of 5,000 people that are still on my network from that transaction. So what KAR does is in the vehicle logistics space, we do a lot of things at the end of a lease or the selling cars to dealers. We do things like inspect vehicles, we sell vehicles on behalf of manufacturers, we cut keys or the key fobs, things like that. We do auto inspections, we do short-term leases. Leasing for dealers and things like that. I think the number is we touched in '19, this was a few years ago, but about 3 million vehicles globally. And we have facility in US, Canada, in Europe. I have a UK in Brussels and then a couple small offices throughout EU. I have dev teams around the world.

Excellent.

From a risk standpoint in that sector, and it's fairly common in, in auto to have leasing part of a lot of large companies. But I would say some of the traditional financial management risks, and then manufacturing, or anything on the delivery or operational side that you have to consider.

We don't do a lot of manufacturing, but we do a lot of IoT. One of the things that, that we had done prior to COVID is we do real-time video streaming of auctions. And so there's a lot of IoT devices there. And so we take care of that. We pivoted in during COVID in about 2 weeks from selling about half of our vehicles online to 100% of the vehicles online.

Hallo, smart.

So in some of our prep discussions, we talked about 2 things and they're probably 2 separate topics, but you'd mentioned the term picking your hill to die on. And I think that's important as a CISO. And then second, but related topic is prioritization. As I was on the corporate side and as now I work with a lot of clients, I'm always telling my key customers, the leaders, CISOs, whatever level, is the biggest enemy of success in cybersecurity is not prioritizing enough and spreading yourself too thin, both from a burnout and from a human capability and ability to achieve projects. So what are your thoughts on— let's start with the picking your hill to die on and maybe some good stories that kind of have helped have helped you contemplate that or refine your picking?

One of the things that I've told people for a long time, and in my role, whether it was heavy infrastructure or security, you may be the guy that is at fault for something. A system's down, there's a breach, things like that. And I've told people forever, I have to be prepared for every day to be my— because in a lot of ways, you may be the scapegoat. You may have done something wrong, not intentional, you missed something. I hearken back to the SolarWinds CISO and people were going after him because he missed a bad password. I've got 5,000 people with lots of systems and we have controls in place for that, but the possibility exists. Mm-hmm. You may miss something. So always being prepared for that and understanding that It's business, it's not personal. I think there's things that as you look at your career, both on the things in the— on the IT side and the security side, there's going to be things that are just the wrong thing to do that you have to be prepared to— for that to be your last day for. There's cases where long, long time ago in 2001, I left a company because they owed a major manufacturer in the— I think it's 7 figures, so well over $10 million— and just said, we're not going to pay it. And I resigned the next day. We live in Indianapolis, and it's way too small of a town to be tagged with that. Yep. So there, there's things where you have to be prepared. I'm exiting. Um, it's interesting, I talked to a recruiter a few weeks ago, and she said, it sounds like you like your job. And I said, Why is that? Why do you say that? Because most CISOs hate their job.

Yeah.

And they're desperate to get out. And so we talked about that and I said, I'm really thankful for my team who was a really solid team. Yep.

Yeah. And one thing I thought about too was that with the, back to the topic of the hill you want to die on, you've got so many folks with digital transformation want more access from more devices to more data. And then the CISO hat says, I got to limit access or control access. But any, a big win you got over the past 6 to 12 months in that area where you're able to kind of satisfy both sides?

Yeah, I think, give you an example. One of the things before I moved in the CIO role, I wanted to update Google on a regular basis or do Chrome. And it was hard, but I explained to folks that every time there's a zero-day, I'm going to make you drop everything you do to go fix it. And remarkably, about a month after I became CIO, the endpoint guys came and said, hey, we figured out how to do it and we can go start to finish 30 minutes from the time that Google drops an update to when we're deploying it. Wow. And they said, if you want it faster than that, we can do that. But we figure 30 minutes is good.

Better than most. Yeah.

And that's a big win because it just takes one more thing off the table.

Yep.

I have some wicked smart folks that that are, that do a phenomenal job. And it's doing things like that to just take some of those risk things off the table.

Do you think that the team came to you with the solution once you had the CIO role, or was it just happenstance, lucky timing?

No, I mean, I think it was more of a, hey, this is a good thing for us to do and this is what Leon's going to want. And quite frankly, a lot of the things that we go back to people from a security standpoint, are really trying to make their life easier. Yep. If you build that process that it happens in an automated fashion, you don't really care when Google drops a new zero-day, and it's going to happen because it's a browser. So there's things like that that start to make life just a little bit simpler. And if we can start taking, you know, one or two of those off every so often, make life just a tad easier, There's plenty of other things that are coming at us. We'll talk about prioritization, but it's take those things off table that are somewhat easy.

Yep.

And then move on to the bigger things.

Yeah. But right before we move on to prioritization, do you think that cybersecurity needs more org change management and almost user experience? Because I do.

Yeah.

Your comment resonated to me. If you make it easier, it's— there's less likeliness that somebody is going to try to bypass a control or to try to work around you. So I see where teams are spending the time making processes, people, technology more accessible, more easy, more clear to know and do the right thing. There's less friction. Has that been your experience as well, or what are your thoughts on that?

Yeah, the typical picture of a CISO is this Dr. No. No, you can't do that. There's no way. Part of my job is to try and enable things. It's being a little bit more flexible on what needs to happen and understanding that at the end of the day, we got to make money. So we have to transact business. The absolute most secure thing is that everything's turned off. You have no customers, you have no people, but you're not making any money. You have to do it in blocks, but you can still do it. It's a constant battle, but trying to make things easier for people, for instance, like MFA, We mandate it, but we try and make it as easy as possible. We do a ton of single sign-on, so people don't have to worry about what's my password for X. Yep.

Great points. So yeah, let's shift on to prioritization. Across your career, across your CISO roles, where have you seen teams, the teams that you've led, have too much, and maybe some examples of where you've had to rationalize both on tech, but also on workload?

I've never been in an organization where I had all the resources that I wanted. There's things that if I look back at— I was at a company in Pittsburgh about a dozen years ago, and when I walked in to work for a former boss, he said, here's the 10 things that nobody's ever gotten done. And we did them in the first 6 months. And to be perfectly blunt, we didn't ask any questions. We did horrible change management. Um, I remember having a discussion. We had moved 12 locations onto a new Cisco phone system, and we got to our two biggest ones, and I had a call the week before, and they said, hey, we've got 20 operators, and what's actually happening here? I said, you're not going to need them because we're dropping in DIDs for everybody. And they're like, oh, okay. And what I found there, as long as things are flawless, there's no questions. And oddly, the only two things that didn't work out of that whole rollout was there were two DIDs that happened to be for the CIO and the CEO that they didn't know about. Oh my. But they didn't come through. Okay. Didn't come through the day that they did. It was about 4 hours later, but I still got chewed on for not getting those two things done that they didn't know about. And about 2 weeks later, I was walking by the CEO's office and he screamed my name. And I came in and he said, "What's with these phones?" I'm like, "What's the problem?" He goes, "When I'm yelling at somebody, it's like they're sitting right next to me. Isn't that what you wanted?" "Yes." "Do you need anything else?" "No." But it's—

Did he just always talk in a yell and you thought you were getting scolded, but he was actually praising you?

I think in a kind of a backhanded way. But when we look at Again, you're never going to have the resource, never going to have the dollars. We do some interesting things. We talk to a lot of early-stage startups, and so it's helped us maintain a flatter budget, but getting in some of the things that we need to do. It's a little bit more of a risk on what we're doing, but as an example, we were looking at cloud posture tools 2.5 years ago. And the biggest thing I was concerned about was, am I leaking data? Do I have any exposure there? And none of the tools really did that. And we looked at a tool and that's one of the things they did. And we said, I'm not as worried about, can you automatically fix things, but can I get good visibility right now? And it installed as a role in AWS. It was quick to roll out. Boom, it was done. And it's been there for 2 and a half years. And does its job every day. It's one of the things I check 7 days a week without fail.

So for emerging cyber leaders, what are your tips or lessons learned on prioritization? How do you help those that haven't been through as many hurdles as you have do better at rationalization and picking the right horses?

I've never done a big fluffy strategy. I have one that says, here's kind of what we need to get done in the next year. Here's how we're doing it. More for our cyber insurance carriers than for anything else. I think if you start to look at what are the paths in, you're going to have a path in that's through your firewalls. You're going to have a path in that's through your end users. You're going to have a path in through email. And as you start to look at those paths, what are the most deadly first off and start to go take care for those. I mentioned that we've gotten multiple layers on the email side. And there's nothing that's perfect, and we use one to catch what the other one doesn't catch. And so I look at it that way from a prioritization standpoint on what is the next biggest issue that we have. And you've got 50 things to choose from and you've got a limited set of people and dollars to go fix it, but where can you get the biggest bang for your buck? And that's what we look at.

Yeah, we had Jeff Tennant here on the last episode and he's with the Indiana CIO Network. And what would be your advice to CIOs across the US and Indiana particularly right now that are getting tasked with security or they're looking at their strategy for the next year or objectives and they're security focused and it may not be in their core wheelhouse. So what suggestions or what tips would you give them as far as tackling that role?

Yeah, I think it's, it's interesting. I saw some stats. There's some SEC guidance going to come out probably next month that talks about cybersecurity skills on your board. And there's roughly 9,000 publicly traded companies. There's, I think it's two-thirds of the Fortune 500 actually have a CISO in place. So for those CIOs that are struggling with it, But you need to have kind of rational conversations with your security leaders on what it is that actually gets beyond the bits and bytes. There's a language for all of this stuff. And when I start talking to the finance guys, I can't figure out what they're talking about because I don't understand the language. But it's the CISO's job or the security leader's job to try and explain that in rational terms. And I think for those CIOs that are, and I'll say it bluntly, stuck with that role, is start to reach out to people that are in your circle. As a CIO and as a CISO, you very rarely have people to talk to. You can't talk through and say, I'm working on a problem, how do I go fix it? And I would strongly suggest finding one or two people that that you can do that with. And I do it for a number of people where, you know, hey, you got a problem, you need to yell at somebody. I've been yelled at my whole life. Call me up, yell for 15 minutes. You go your way, I'll go my way, and I'll save that number. You'll probably talk through how to fix that problem. Yep. At the same time, I would strongly recommend going that route. Yep.

So moving on to kind of retention and staffing, You see a lot of stuff now, you mentioned earlier with CISOs and burnout and moving around. What are some challenges that you're facing and kind of some tips of how you kind of curb that as far as retention and then as well as just adding new life and new lifeblood to the tree?

Yeah, so I'll talk first on my security team. At the risk of losing people, I've lost one person in the last 2.5 years. And she actually moved on to Lilly and we brought her in as an intern. She worked through getting her undergrad, got her master's in cyber, and then moved on a much broader role, which is exactly what we want.

Yep.

And so we celebrate that. It's not a bad thing. It's a good thing. You know, the— I've tried to help people over the last 30 years and really 25 years in management If I can help you get to a role that I can accommodate for you, I'm going to do that. And so I've done things where it's— I will go talk to people I know at Company X that someone's looking at going to. Is this a good thing or a bad thing? And done that for people to say, yeah, this company you're not going to fit well.

Yeah.

And then a month later, yeah, this company you're talking to, it's all good. Go with my blessing. The two guys that left 2 and a half years ago, both became CISOs and then decided after a while they didn't want to do that, which is fine. But trying to develop people for that next role, I think, leads a lot to retention. We have a relatively small team, especially when I compare myself to the Anthems of the world or Lilies of the world. And so people are doing really deep and technical stuff early, then they own stuff. So they have a say in how we do it. So I think from a retention standpoint, those are the things we're trying to do. From a staffing standpoint, we've had 3 interns now that are in place for the last 2, at least 1, but a couple of them 2 years. And we keep those interns year round. So we don't just say, hey, you're working in the summer. When it's, hey, you got 5 hours when you're during the school year, come do stuff. But we keep them on. All 3 of them have finished their cybersecurity degree. One of them just finished a double major. One of them is getting his master's in cyber.

So very awesome.

We have people that are actually doing stuff and we're actively, since I don't have the positions, trying to go find homes for them. In the Indianapolis area. And so it— that's the bargain that we have with them. We're going to let you do work and we're going to, we're going to use your skills, and then we're going to either— we're going to try and place you here, we're going to, we're going to try and move you out because that's what you need to do. Yeah, that's really cool.

So definitely the investment on the people coming in and the investment on helping them out into the next step. One thing that we do a lot of here is try to create a culture that's not grind to the grindstone, burnout, which is one of many things that we're trying to be the opposite of in consulting. The industry in consulting does have a bit of a reputation for that— work hard, 60-hour weeks, and then fold out to a corporate role. So from your side, what are some of the things that you have done or would recommend to others on creating the dynamic culture that people want to stay?

Yeah, I don't know that I— it's not always nose to the grindstone. One of the things that I tell people is I work 7 days a week, and then I have to caveat that with the place that I go for coffee on Saturday and Sunday mornings doesn't let— they took all the tables and chairs out. So I get my coffee, go to work for a couple hours, I check my security stuff and then do odds and sods for a couple hours. But that's my choice. I don't mandate that for people. So knowing that people do have a personal life, but You know, when the phone rings, we need you to pick up. So having that bargain with people, we don't try and raise the flag, but there's some things that I try and take that they— that people shouldn't have to do. So try and do some of that, giving people, you know, what they need to do their role. And quite frankly, having the ability to look at some new and interesting technologies. Is, is really helps people to want to grow. It's not just you're going to do this thing for the rest of your life, and that's— they're really not pigeonholed, and they get exposed to a lot more.

Yep.

And in some cases that's great, in some cases that's, it's a lot to take in.

Yeah, I feel like the cyber nowadays, it's like IT was 20 years ago when you're an IT guy, you did it all. You did some coding, you did, you may have done some networking, you may have done the AV in the conference room. IT now got more diversified. Now cyber before 5 years ago was pretty single thread now. It's like you're in cyber on this, on the tool side, you're cyber on the process side. So I feel like it's evolving now to be more—

it is, although I don't think you ever, ever, ever get away from being the AV guy. But yeah, there's, there's more diversity. Yep. Of, of what to do, how to do it. And I think going back to one of the staffing things is, is looking for people that aren't in that classic path, looking for people in, you know, in, in odd spots. Yep.

On my, the corporate side of my life, some of the best people that we brought into security came from other business units, and I think the differentiator was the motivational fit. There were some that didn't work as well as others, but those that you could see had the spark and the passion went on. I mean, they're still in the field even though they came from finance or from sales and marketing. So that was really cool to watch.

Best pen testers that I've met is a CPA by training. And the reason he's so good is he knows where the money is. He knows how to— he knows what to look for. Yeah. And we actually have one of our guys that grew up on the business side. He was— he ended up working in our area, kind of customer compliance type things. Yep. Went on his own, got a CISSP, and he's doing AppSec for us. Phenomenal. It's that kind of stuff and it's those kind of stories that are— when you look back on your career, that's where you see the real joy out of managing. First week I became a manager, I asked my boss, where do you find joy in managing? And when he got done laughing at me, he said, the only thing that you will ever have that's beneficial is seeing the people that work for you succeed. Period, end of story. And if we can do that and look back on a hopefully long career and say, yeah, I helped this many people go be better than they were, that's a win.

Yep.

I think it's good and fitting to end on that note and hope others that are listening learn early in their career in management to embrace that same approach. So, Leon, thanks for coming on the show. We really enjoyed talking with you and talk soon.