The Vulnerability Playbook with David Sims

Thanks for tuning in to Simplifying Cyber. I'm Aaron Pritz. And I'm Cody Rivers. And today we're here with Dave Sims, most recently Staff VP at Elevance Health, which is formerly Anthem here in town. I was a long time at Eli Lilly, so right across the street for many years. Welcome to the show.

Well, thank you, Aaron. I've enjoyed the Eli Lilly walking park many times on Walking 111 there from Elevance.

Aaron Pritz.

Thanks for the welcome.

Yeah, awesome. So we wanted to, what we're trying to do on this show is focus on some deep dive topics where our audience can learn from longtime practitioners and leaders that have solved problems in the industry. And I think that as we were chatting with you, one of the ones that we wanted to talk about, we'll start with an overview of your background and kind of how you got into cyber. We really want to focus in this episode on vulnerability risk management, risk-based, and how you made that effective for both the business and the customers. But before we dive into that specific technical challenge, give us the Dave Sims story in brief.

Well, thank you. Would you believe that my career found me instead of me finding my career? I was a package handler at UPS when I was approached to join the information services group. I was approached because I was hassling my manager to buy a computer from me. I was building and selling computers in college to pay for tuition at the time. I joined the information services group. I kind of found that my gaming habit was also a passion for just making things work. And it kind of leapfrogged from there. At one point in my career, I got the nickname of Mr. 10-0 for getting 10 information security reversals for my IT group from being able to go and explain to them how the technology worked— to get them to allow us to go forward. That 10-0 experience actually led me to information security, where I thought if I just knew how to talk to them better, I could explain it better the first time. It didn't really work out that way, but I did find a new career and another way to engage.

And were you Army background?

I was. I was in the Army for 6 years total. Well, really 8 years. And then, you know, 6 years as active duty, both as active duty servicemen and a reservist.

Now we have a number of military veterans at Reveal Risk, but what did the military background and training equip you with that you've leveraged to this day in cyber?

So funny story, I was an infantryman in the Army and later a drill sergeant. People hear that and they kind of recoil and then they're shocked. Dave, you couldn't have been a drill sergeant. I was, and I was really pretty good at it. One of the things that I learned from my time as a drill sergeant is how to relate with human beings. And it's odd. You would think that the guy in your face yelling all the time is understanding how to relate. But that's, that's what the movies show you. It's not what's real. A drill sergeant needs to be able to see small tells. They need to be able to understand details in the environment, and they need to be able to respond to them very quickly to maintain the health and safety of the people in their charge, sometimes over 60 people. And so you've got to become very tuned in and pay very close attention to people.

I think of drill sergeant where you like the real tight brim and the little buckle here. Like I think of like Full Metal Jacket is what I think of a drill sergeant.

See, you said the movies shapes your perception. Yeah, it does.

Yeah, it absolutely does. And there is a version of Dave that can do that. I still have the hat.

Oh man, that's great.

That's great. I thought you were going to Major Payne there, but—

Major Payne's another option. You got either one.

Awesome. All right. Well, let's get into vulnerability risk management. So maybe for our non-technical users, define vulnerability risk management and kind of its intersection with IT and patching and the whole world that is fixing things.

So it's kind of funny, there's a way to define this and we maybe start with what it's not. Many people, when they come to vulnerability management, they think of it as patch management. You'll see that a lot of vulnerability management professionals also have patch management in their purview. You'll also hear people talking a lot about patch management, vulnerability management interchangeably. It's not. Vulnerability management is really the art of finding issues on the enterprise via configuration, via system weakness, via applications and software, and finding ways to remediate them. So it's really about having intelligence about what the business does to make money and the systems used to do it.

Why do you think, you mentioned as you were framing that, a lot of VRM people have patching in their title too. Why is that phenomenon? Because leadership has looked down and said, why are they just finding the issues? They should be accountable for finding and fixing versus just giving us lists. How would you counter that? Or is that a fair read to some of the reason why it's maybe mushed together?

So I think there's a, there's a big gray mushy pool there. And there's some things, there's some leadership misunderstanding perhaps, but I think there's also practitioner misunderstanding because way back in the day, vulnerability management really was very close to patch management. And it still has, patch management still has a great impact on the vulnerability management picture, but it's not all there is. And it isn't enough to patch always, right? You really need more intelligence about the enterprise. You need to know how the business makes money.

I think too, to your point, As we become more of a connected environment, it was just PC, it was mainframe, then just PC. And now there's watches, there's phones, there's IoT, there's sensors. I mean, you've got just a rocket ship of things that you keep adding to the network. And so how do you kind of, to Aaron's point, how do you kind of keep all that in control and identify owners and look at prioritizing? I mean, sure, it's just a wild west of things that pop up.

Yeah, the funnel got a lot wider, didn't it? Very quickly. Yes, indeed. I think What we see here really though is an exacerbation of an issue that was really there all along. Vulnerability management in the old days, and many practitioners maybe still have a practice, if we do the scan, we find the issues, we throw 'em over the wall. If we find more issues, that's better. So we have a million issues, we toss 'em over the wall and we yell at people until they get fixed. That was a bad practice at the very beginning. It's low trust, it's also low value. And so a dialed-in approach where you understand where things are, what they do, and why they matter, dialing in to find those most critical issues, the things that matter to the organization the most, and getting those fixed first, actually acting as an advocate for the business and an advocate for the technology groups to make sure that these things are happening together and coordinating all of that, that's an art, right? There's an art to that, scientific approach. And rather than doing the peanut butter spread across, you've actually dialed in, you've understood the organization at a molecular level, and you're helping to move it faster.

You sound like a well-versed translator. Who's, as you're pointing, like cyber's that kind of that in between, between the business and the IT.

Who's harder to—

what's the more difficult one to work with? Is it the executive, business executive, or is it the IT engineer?

I'm, I'm going to have to say both, really. If, if you're successful in information security, you're you're that white stripe between the Oreo, right? You're trying to hold those guys together. Love Oreos. Me too, as we can see. You're trying to hold those organizations together and translate them to each other. You can become the voice of IT and the voice of the business and really that conscience in between if you're trustworthy. You have to act in a trustworthy manner. You have to hold yourself accountable to them, and you have to be their good partner in times when it's hard.

You mentioned understanding the business and we hear across almost all sectors and industries. I can't think of a single company that has reported, we love our CMDB, we got it right. It's awesome. But you mentioned understanding the business. And then I also hear a lot of times it's like, we kind of go to our VRM team for an inventory because their scans are better than the CMDB itself. But my thing is like, it doesn't give you any business context. It just gives you an IP address and an asset type. So how have you pushed your teams to truly understand, document, and have a way to perpetually understand what's on those assets to help you get to that risk-based vulnerability?

So first, I'm going to give you a ringing endorsement for that statement about the vulnerability management database being better than CMDB. Yeah. It absolutely is. The CMDBs are typically very static and they're outdated before you even look at them. The vulnerability management database, will be very dynamic. It's going to, if you're doing it well, you're doing it right, it's going to capture all of the things that do business on your network and it's going to have context around it, where those things are located and how they're used. Now there's this thing called metadata that associates or that you could associate with different objects, especially dynamic objects that come from cloud. As you generate those objects, you can tag metadata with them. And that gives you the context so that you can read, so that you have really a more dynamic inventory, something that you can use to solve problems faster.

Yeah, that makes sense.

Excellent, excellent. So talk about, you know, again, I like the, the go-between. How do you really bring business along to help with like prioritization? Because to your point earlier, there's no shortage of things and you got the, the VRM database, the CMDB. What are some challenges and how'd you kind of overcome the, the prioritization, you know, uh, conversation and challenge?

It's funny, the more technical you become, the more human characteristics matter. Excuse me. We really need to go face to face with our business partners. We need to talk to them and gain their trust. We need to understand their pain points. And when we can, we need to help to remove them, right? There are going to be times where we're held up. I'm thinking of an example. One time we were held up for years with one of our largest customers because they insisted on an inferior cryptographic method for file transfer. That was always the message back from the business. They insist, they insist, they insist. How about we get together with them? I'll go with you and we'll talk. And what we found was that their information security group was frustrated with us because we insisted on using that inferior method. There was some miscommunication there between all of us, this big telephone game. But I sat in that meeting with that vice president and we worked through with the information security group, No blame, no shame, right? We just worked through how to get this done. And we had done— we fixed a 3-year problem in a 30-minute call. That gained me so much credibility with that vice president and her staff that when I went to them for other things, I could get the meeting. I could get the call, right? Tell me what you need fixed most or what you need to have available most. I could get those things answered quickly. Because they trust it.

Yeah.

So let's assume, let's, let's, let's do a hypothetical scenario. You're a new CISO in an organization. You're 22 days in. You've done one-on-ones with all your staff. You've addressed the full team. Now you're starting to look at your roadmap, potential priorities, things like that. Executive comes to you, maybe your boss, maybe one of the executives on the governance team. And they say, Dave, VRM has been a problem for us. We have thousands, hundreds of thousands of vulnerabilities. I saw on your resume that you've dealt with this at another big company at Elevance. Where do you start? How do you unpack it? How, you know, there's a lot of people in this situation. So I think how would you process going from giant disaster? We don't know what we're doing. We've got unmanaged vulnerabilities, a lot of data, a lot of scans. Where do you start?

That's happened to me on multiple occasions, as a matter of fact. And really the first thing you have to do for that executive is you have to help them to understand that it may not be as bad as it looks. And that sounds a little counterintuitive, but as we look at that giant stack of multiple millions of vulnerabilities, we may find that if we put this lens of who, what, when, and why, on that stack, who uses the system, what does it do, why do we need it, what does it serve, right? When we understand those things about that giant stack of data and we start discarding things or pushing to the side the things that matter less, we come down to a kernel of a very significantly lower percentage of issues that need to be solved right now. We have really deadly issues that are being masked by this big peanut butter spread that I was talking about before. And so really it's about helping that executive to understand that the mass isn't the problem, it's hiding the problem, and we need to find that.

So what if the organization says, yeah, our CMDB sucks, like we talked before, our tools aren't necessarily giving us that context or that metadata. How have you helped organizations get that business context so they can do the slicers to be able to narrow that down.

You know, we talked about military experience earlier. This is a place where military experience really serves me. I look at organizations as total, and then I like to look from the outside in. And so black box assessment, like continuous black box assessment, walking the wire of the organization, making sure you understand where it does business, how it makes money, what's critical, and protecting those things first. So you walk the wire, make sure that those things are happening. You do continuous black box assessment. So from the outside in, you're looking at the enterprise to find everything you can and you protect those things first. While you're doing that, you're also building from the inside out to meet in the middle.

So how do you coach a team that maybe haven't, hasn't done that yet? Maybe they're not as business savvy. Obviously you can do what you can do, but you've got 1,000 other priorities as well. How do you coach them to shift their mantra from being focused on throwing technical switches and doing follow-ups and tickets to walking that? What is walking the liar?

That's a great question. And I think it's about story, right? We have to change the story for the team. We need the vulnerability management team or the information security team or whatever team that is. We need them to understand that they're part of the greater whole. Many times we say this, we give it lip service. We care about what's going on, but really we care about the vulnerability or the checkbox or whatever that is. That's not serving the business. We need to be part of the greater whole. And so we need to change the story. One of the ways I like to do that is by comparing a business to a race team. So we're all part of the same team, right? We want to win races, don't we? We want to have the best business, don't we?

I like to be fourth place.

No, I'm just kidding. Outstanding. And you still have to race hard to be fourth place, though. That's true. The thing about it, though, is we're all part of that team. And the interesting thing about the most close analog to us in racing is probably the safety team, right? The safety team does fire suits, helmets, brakes, right? All of those safety devices that you put in the car, not one of those devices is put there to slow the car down. Everything is put there so that the team can find the edge, the absolute edge of performance, so that they can do their best every day and go win, right?

Yep.

If information security were tuned like that, if there was no stop sign in front of the business, how fast could we go?

Yeah. So, so how do you tune up a team that you're walking into cold that maybe hasn't gone through that revolution yet? What's the— is it, is it months of coaching and coach up? Is it experiential learning? How do you, how do you, how do you get a team there?

It's the hat first. He comes in with the Bill Belichick hat.

So the funny story there is that doesn't work. I I know from that understanding people thing and understanding how to tune that you can't go and be an authoritarian leader in an information security group, in a group of highly intelligent professionals that know more about things than you do. And they do, right? And so really it's about that story. It's about getting buy-in. It's about continuous improvement and innovation. There's small I and little i, or small I and big I innovation. Big I is that big world-changing thing like iPhone. Small I is all the things that you do to make the organization run faster. It's moving this process forward. It's hearing those small voices down the assembly line or often the information security team and the configuration management team, hearing them tell you how they could do their job better and then helping them to do it.

You've talked about two things here I want to kind of bring together. You mentioned the kind of tools and technical switches earlier, and you just hit a big thing on like process and people and kind of that. Adoption area. And you were at Elevance for 15 years, which, you know, like, and security is like dog years, right? So that's what, 105 years in security tooling world now.

It feels that way sometimes.

You know, but to your point, so you see a plethora of tools that come out with like, it'll do this for you.

It's as good.

This is the new tool. Would you rather have a $1 million security VRM tool with a $0 budget for OCM and process improvement, or a $250,000 tool with a $75,000 budget to do OCM and process updates?

You probably already know my answer. I don't think tools matter as much. I think that the practice, the application, and the people that apply those things matter more. And so I would add a training budget to that, and I would, I would make sure that I was spending that training budget helping to lift those staff up so that they understood not that they were a tool user, that they were a vulnerability specialist, that they needed to know how to find vulnerabilities and get them fixed, either native with, you know, living off the land or with this tool that makes it a little bit easier, right? I want my professionals to be true professionals. Network security professionals are network security professionals. They're not checkmarks firewall jocks, right? A network security professional should be able to parachute into any position on any network team and add value, right? That means they understand networking. That means that they understand that what this says in Checkmarks is this in Palo Alto, right? Or whatever other tool that you might use. A real true professional understands why we fix things.

So let's go back in time 105 dog years in cyber and maybe we'll do the Wayne's World. Let's call, let's let you, let's hear you make a call to yourself 105 dog years ago, early career Dave, what is adultin' Dave telling pre-adultin' Dave about what you're gonna, you know, how to navigate, maybe avoid some mistakes that you made or just do things earlier that you found out later in your career?

So first I'm gonna tell him to lay off the Oreos. All right.

Poor advice.

Good callback.

Poor advice, man.

At least cut down, right?

I saw that they have the new Oreo Thins, which must be calorie-free. Hold on. Absolutely. Wait, wait, hold on.

I would pause this. Are you, are you an Oreo thin? I'm, I'm a, I'm a DSL, double stuff. I am. I can't go thin, man. If you just— you might as well just forget the whole thing.

I think it's, it's treating them like a treat, like they're supposed to be, and maybe not breakfast. So anyway, uh, I would tell him to lay off the Oreos. The next thing I would say is that, um, don't be wowed by the, the Neato Frito stuff. Don't, don't get caught up in the glitz and glamour. Understand that practice and process and capability matter significantly more than all the shinies.

So maybe for the architect or the technologist listening, how do you help them see the value of themselves as a technologist by getting more process-oriented if they're a little too tool-heavy?

So there's a talk from a gentleman that I listen to frequently, Mike Bechtol. He did this in 2024. South by Southwest. It's called, uh, uh, Width is the New Depth, I think. And what it amounts to, especially for architects and technologists, is there, there is a growing need for you to be able to understand space around you much, much further, right? You need to be a learn-it-all, not a know-it-all. And what I, what I really want people to be in touch with is where to find accurate information and how to action it. Right? And that's, that's threat information, certainly, but it's also information about use of tools or new tools or new incidents or things that happen in the environment. So we really want to get wider as technologists. We want to be able to, to use the, the things around us like AI or like automation or any of these wonderful tools that we have access to now. Any of those things should serve us. We should be able to be wider and understand better how the information security product fits into the overall product of the organization.

Awesome. Yeah.

Cody, why don't you bring us home with your wild and crazy personal question? Oh, yeah.

Here we go. You ready?

OK. So we have no seat belts, right? Yeah.

A lot of us first time here meeting you, Dave, on the show and everything. But what's one fun fact that someone who— even those who've known you for a couple of years may not know? Would it be a fun fact? Is it a hobby? Is it a talent? Give us a fun fact about Dave Sims.

I think I'll go with the safe one. I'm a Mustang fanatic for many years. I could— I can listen to a car, look at a car, tell you what it's equipped with probably, and give you a rough estimate of the horsepower rating of that Mustang from, you know, from '64 all the way up to current.

Can you do one of the radio show gags where you honk the horn and can tell the make, model, and color? I'm pretty sure that's fake. I heard that on a local radio station.

I could look at a Fox Body Mustang and tell you how many horsepower it has by year. No way. I can't listen to the horn.

Okay. That's pretty cool. Well, thanks again, sir, for joining us. We appreciate it and look forward to seeing you around more.

It was a great talk. I really appreciate the opportunity.

Thank you.