Unspoken Security Ep14: Evolution of the CISO Live from RSAC!

If you're not trusted, you don't have a brand. Yes. Right. You, there are companies that have gone through incidents who have survived, and that's because they are otherwise competent and trustworthy. So security leads to those things. Security tends to be the most audited function in a company, whether it's through customer contracts, SOC 2, ISO, FedRAMP, PCI, whatever.

Welcome to Unspoken Security by ZeroFox, the raw and gritty podcast for cybersecurity professionals who want to understand how threat actors are leveraging The Internet. In each episode, your host AJ Nash engages with various industry experts to dissect current trends, share practical insights, and address the blunt truths surrounding security. Ultimately, the lessons learned will enable security professionals to take an intel-driven, proactive approach to physical and cybersecurity that extends past the perimeter. Let's get started.

This is how legends are made. Welcome to another episode of Unspoken Security. My name's AJ Nash, I'm your host. This show is brought to you by ZeroFox, as you know, and as you can see by the background, a little different this week. We're at RSA Conference, so we're gonna have a special edition of the show, a little bit shorter, a little bit quicker, 'cause there's just not enough time around here, but we have an amazing guest today. I'm really excited to have a chance to talk with her. It's Kayla Williams. Kayla is a 10-year cybersecurity veteran. Currently serves as the CISO at DEVO. For those unfamiliar with DEVO, this is not the new wave band from the '70s and '80s. And if you're not old enough to know that joke, I don't want to hear about it. This DEVO is actually a cybersecurity firm. They replace traditional solutions with real-time security data platform that includes security information event management. That's the SIEM, of course. Security orchestration, automation, and response, your SOAR, and user identity behavior analytics, UEBA. I don't know if anybody ever calls it UEBA, but I did. Before her current role, Kayla held various roles on both sides of the Atlantic Ocean, primarily focused on governance, risk, and compliance, which we're gonna talk about, really interesting stuff. She's a graduate of NYU Polytechnic School of Engineering, so she's way smarter than I am. She also has a master's degree in project management from La Salle University. So anything in that bio that I missed, Kayla? Anything else you wanna add about yourself?

No, I like dogs. We'll add that.

I like dogs too.

There we go, perfect.

That's awesome. What kind of dog do you have?

I have two. They are pit bull mom and dad.

Oh, okay.

Mom and son. I don't know why I just said dad. Mom and son.

That's okay. Listen, it's a long week.

I'm tired.

It's a long week.

I asked for milk in my cappuccino. That's how tired.

But I— it's— this is how it works out here. We all know. So no sweat. I've got a— I got a Wheaten Terrier and a hound mix, and they're totally different dogs, and I love them both in very different ways. So I'm also a dog person, and most people who watch the show know— they've seen Riley the Wheaten on more than once. Myrtle the hound hasn't made an appearance because she's even louder than I am. So we try to keep her off mic if we can. All right, so listen, I want to jump into this show quickly because again, we're doing this on a much shorter timeframe than usual.

Let's do it.

The topic for today is evolution of the CISO. CISO, every company has a CISO, right? There's a lot of different paths of getting there. I think everybody knows CISOs who are super technical and some that are less so and all these different ways of getting there. Yours is really, I won't say unique because I can't prove it's unique, but certainly unusual. I haven't seen a lot of people, you know, you came up through governance, risk and compliance, right? And most folks are more on the technical side. I'm an Intel guy. I'm excited to see Intel people start getting there too. But GRC is not really like the standard path. You don't see a lot of that. So the first question I want to ask is, what do you see as the benefits and challenges of moving into a CISO role from that non-traditional background like GRC?

So the pro is being able to speak the business. I have a great collaborative relationship with folks that are my peers and above and with the board because I can take security and make it relevant to their different functional departments. And I can make it kind of land at home for them. I would say a con is it's not often, but sometimes there are people who are like, you've never written a line of code. How can you tell me how to secure something? Right. And I just like, okay, if you have a CISO who's writing code, you have a problem right now. That's not what my role is. The another, I'd say like another con is having to gain the respect of people like that. And it's difficult because they, the detractors can be a problem. So it's really positive in the sense that you get to collaborate a bit more. You can really tailor your conversations to your stakeholders, which comes in handy for budget season and roadmaps if you can understand the corporate objectives. But then on the other flip side of that, sometimes there are other areas where you have to work a little bit harder and you have to negotiate. And having those skills, I think, comes with being— so governance, risk compliance, GRC, like you have to do that constantly.

And those are— you covered all the really interesting points, right? I think the business piece, I think, is really interesting, right? Be able to speak the business, right? So A lot of CISOs, they come up through the tech side and they, yeah, they can write the code and they understand the architecture and all the technical components. They can really make a strong argument for how to build security programs, but then they can't get the budget. And without money, last I checked, we don't get a lot accomplished. And I've never met a CISO yet who said, my biggest problem is I'm just rolling in cash. They just keep handing me all this money and I don't know what to do with it.

Right. Yeah. I'm going to ask a question I'm assuming, but I don't want to assume.

So with governance, risk and compliance, there's a lot of communication in that, right? You have to build relationships. You have to sell the processes of what you're trying to accomplish, right? You have to really gain trust and some of the things you mentioned. That, I assume, is really helping you. Are you, when you compare notes with other CISOs, if you do, do you have those kind of discussions about, hey, what works? How do you communicate? What's getting us more budget? You know, how are we justifying it better? Everybody needs it, but it's about how do you justify it? Does that help at all? Have you had those discussions?

Yeah, we talk constantly. There's a lot of different groups, and I was actually on a panel on Monday here at RSA, and Every single CISO that was there was like, we have to do better at documenting things. And I'm like, oh my gosh, that's GRC. That's exactly what I do. And having people that are technical writers for those that are engineers or the other teams that just don't like to document things, just want to move fast and innovate. Being able to have things documented, it makes it a lot easier to do GRC, to get through your audits, which no one likes audits, right? Yeah, you're rolling your eyes. That's been my life being able to collaborate and document and have an alignment to your business goals and objectives and very clearly be able to articulate, hey, security helps with sales because security builds trust. Collaboration builds trust. You cannot sell if your customers don't trust you. And it is full circle now where security is no longer a cost center. We are a growth driver. Really? Every company is a data company now. Sure. If you're not able to be able to prove that you can be trusted with data, you're not going to get it.

That's interesting because you're saying it's not a cost center. I don't know if that's true in every company. A lot of companies still don't think that way.

I think they don't.

It should be that way.

They need to come to that maturity, that realization that you will not grow if you cannot be trusted.

As is normal whenever you're dealing with something live, my computer has made its own choice on what it wants to do today and immediately just shut off all my notes. So I'm going to go to my backups.

I have my phone. I've got it.

Oh no, I come prepared because I always assume bad things will happen. DR and restoration live on That's right. Love it. You gotta have a backup plan, right? All of a sudden my security system has made choices. So we'll just be done with that and we'll use this one. I just don't have the eyes. So everybody who's watched the podcast, I normally have giant monitors so I don't have to cheat with glasses. I might have to here, but we'll try not to. Anyway, getting back to the more important thing, which is what you were saying, right? I think that's really interesting 'cause most organizations that I've worked with and in, they see security as a cost center, right? And so it's really hard to do it. But you're talking about being able to tie it back to revenue and how this is actually gonna make us more profitable. Or at least more revenue, right? Which matters because companies, in my experience, leadership only care about two things really: improve my bottom line, lower my risk. And a lot of times lower my risk to improving my bottom line is really what they mean. So are you seeing more success in that? Should I understand that DEVO has a giant budget now and we should all show up, all the vendors should show up and try to sell you a bunch of stuff because you're loaded with cash?

Oh God, please don't do that.

No, I'm just kidding.

My LinkedIn is a dumpster fire because of all the vendors that reach out to me. Don't reach out to me on LinkedIn, please. No, I would say that brand reputation is super important when you talk to chief revenue officers, to CEOs, to, you know, CMOs and those teams. And if you don't, if you're not trusted, you don't have a brand. Yes. Right? There are companies that have gone through incidents who have survived, and that's because they are otherwise competent and trustworthy. So security leads to those things. Security tends to be the most audited function in a company, whether it's through customer contracts, SOC 2, ISO, FedRAMP, PCI, whatever. So we tend to already have documentation and processes and are proven competent, and that helps build your brand.

Yeah, that makes good sense, right? So I like hearing that. It's nice to hear that you're having success with that message, right? Because again, not a lot of people come from that background. So it sounds like things are getting better.

You gotta sell security.

You gotta sell, that's true. Everybody, we're all salespeople. I had this discussion last night. Granted, it was at the bar after hours, but—

That's where the best conversations happen.

100%. But we're all selling something. You're either selling a product, you're selling a service, you're selling a process, you're selling a— you're selling yourself. Anybody who's here looking for a job, which a lot of people are, you're selling yourself, right? So we're all in sales, which is that communication piece. And it sounds like your non-traditional way into CISO, this GRC piece, probably sets you up really well for that. And of course, you understand the technology. Just because you can't write code doesn't mean you don't understand the tech. You know how to build a program, clearly.

Exactly. And enterprise risk. And having the experience of being— I was an auditor in a former life and being able to look at—

Oh, you were so popular, I'm sure.

You know it. But being able to understand enterprise risk and how it ties back to security helps as well. And I really think that GRC needs to be understood a bit better. Start— always starts out in the CISO org, but I'm a champion of moving it out into COO, making it enterprise-wide and being able to capitalize it. But that is a different conversation for a different day.

We'll have you back. When I'm back home in the studio and we have a whole hour to work with, we'll definitely do that. 'Cause I do want to talk more about that piece. But jumping ahead, I heard that you and I actually have something in common, which sort of sets up the next question here. I think both of us have concerns about how security organizations are structured. I wrote about that with "Rise of the CINO," which I love to plug all the time 'cause I'm very self-serving. But talking about an intelligence organization being elevated, right? But I heard you've got some thoughts on this too, is where does the CISO fit or who should the CISO report to? These are big questions people have, and I know you and I have some interesting differences on how it currently goes. So where do you think the CISO belongs?

So I found success reporting into the general counsel, and that is— it's more prevalent now, but it's definitely newer out of the organizational structures. The reason being is that your general counsel, chief legal officer, whatever the function might be, they understand customer contracts, vendor contracts, laws and regulations, which we're seeing with the rise of the SEC rules change or, you know, GDPR, AI laws coming out of EU as well. Fines, etc., etc., they are more equipped to understand where you're coming from, certain things that happen. And plus they know your cyber insurance policies and they know what you can and can't get away with. And that is definitely— if you're not going to report into them, you must have a strategic partnership with them. And they understand they're probably going to be your closest allies in understanding risk management.

That's really interesting, especially as we get into— you talk about some of the regulations and because of the requirements to publicly report things, right? And where that lands and how quickly that has to happen. I assume that also means you guys probably have a tie to your PR department. You wouldn't report to them, of course, but your PR department, your marketing department for how those get done or your—

My handlers.

Yeah, that's the right way to look at it.

Yes.

Mine's right over there.

Mine is too.

So is yours. Yes. If it weren't for them, neither of us would have made it here today, I'm quite certain. So yeah, a good tie into them. So do you run into any— Well, first of all, do you report to legal now?

Yes, I do. General counsel. Okay, good.

I didn't ask that one up front, so it's a good thing that was the right answer. I don't put you on the spot like a jerk. Are there— do you run into challenges with that? Lawyers, not to take shots at lawyers, but lawyers are very lawyerese, right? They speak lawyer all the time. Is it— are there challenges that go with it as well, or is it just really all the positives that you were just mentioning?

No, there's going to be structured debate because I interpret a contract differently than how they would. But I've turned that on its head and I ask the questions because at the end of the day, they're the attorneys for the company. They're protecting the company. So if I'm reviewing a contract, I'll say, do you read this the same way I do?

Oh, okay. Got it.

And I let them make the decision. Same with GDPR. I'm like, hey, this is the process that we have in place. Does this meet the requirement? Because if they give you it in writing, please document everything. If you have it in writing in an email or somewhere that you can point back to, you know, legal counsel, this is the— that's going to save you at the end of the day.

100%.

And they are better equipped with having that broader knowledge of what's acceptable and what's not. And they are a direct line into the board as well. And if they're hearing things at the board level that you might not always be in tune with, it's a great collaborative relationship. Are there going to be downsides? Sure. But I try to always leverage them, especially if there's an incident. They're the only ones that can declare a breach from a DPO perspective, data protection officer. But they're engaged. And I say, what do you think we should do? And I tend to follow their lead there because at the end of the day, they're the lawyers.

Keeps you safe, right?

Exactly.

You can't go to jail for doing what the lawyer told you to do, right?

We're hearing otherwise right now with the with SolarWinds, maybe. But it is, it's a safer bet. There will be conflict with an attorney. There's always going to be because it's all about interpretation. But if you can figure out how to leverage that, yeah, it will save your skin.

How long are those meetings?

Oh, no, I'm lucky. The legal team that we have, they're so fantastic. And Slack helps too, because I can like, we have a collaboration channel for all of us because we all report to general counsel and I can just pop in questions there and someone gets back to me and it It's quick. Vendor security, customer security addendums, laws, regulations, and things like that. We're constantly in contact anyway. You might as well foster that relationship. Buy them beer or insert appropriate drink here because maybe they don't drink and that's okay. Take them out.

Yeah. Well, Slack gives you a record too. It gives you a running record of those conversations. Again, I'm with you. I like documentation, but I'm lazy, so I love documentation that takes care of itself. You have a conversation, it's auto-documented. I'll save a lot of emails and I don't have to document things later. Before I move to the last question, it's interesting. In Intel, we run into this sometimes too. Legal protection is really important in Intel because there are things you can cross. I had a team years ago and we were really lucky. We had a lawyer, we had our own lawyer. He was part of the GC team, but he wasn't GC himself. We had our own lawyer. And I used to say, and I'm curious for your thoughts here, I used to say, to me, there's two kinds of lawyers. There's lawyers that start with no and make you get them to yes. And there's a lawyer who goes, that's interesting. Let me see how we can make that happen. And we were really lucky because I had the second kind of lawyer. John was fantastic. I won't give his last name and screw it up for him. Every time we ask a question, his answer, and it could be ridiculous, he'd be like, if it was out and out illegal, he'd say no. But he'd be like, let's, let me check. Let's see how we get to yes. Have you run into those kinds of lawyers that some are more of a no and you got to prove your point, or are they more collaborative and trying to get you there?

It's a mix of both, but I think that's what CISOs are. You have two types of CISOs. It's the absolutely not, no way. We're going to have ChatGPT. We're going to shut off all AI. We're never going to use it. Or it's a no problem. And it's let's document it, let's figure out a way to be collaborative. So I think these are two very similar types of leaders that you run into in both general counsel and security. And in today's day and age, you are not going to survive if you constantly say no because you can't innovate. You block innovation by saying no all the time. Sure, if something's illegal, go for it. Say no.

Work clearly.

Yeah. But if it's something that's going to help benefit the business, find a way to yes.

So you're one of those people.

I am one of those.

Yes.

Yeah. I would rather say yes and not be a hindrance and then people are going to be more likely to collaborate. We can start building security in from the beginning instead of patching it on at the end where it's going to be flimsy and fall apart or cost more money. So I think you have to be able to negotiate. You have to be able to understand value and your corporate objectives and where you're going. Because if you're always saying no, you're not going to have a job for long. Yeah.

And as you said, you're not going to have teammates for long, right? This is a team game and you got to have people that like you. And if people get to the point where they just don't like you, they'll work around you. That's how you get all that shadow IT. She's going to say no anyway. Just go build the thing and we'll cover you later if it goes bad.

Exactly.

I'm sure you love hearing that kind of thing.

Oh yeah. Yeah.

So exciting. All right, so the third question we've got, for anybody at home, listen, I normally read these off a screen. I'm stuck reading today, so you don't get the subtleties. I haven't been a CISO for a couple years now. What do you think are the most important qualities people don't talk enough about when it comes to being successful in the role? Now, I know we already talked about a couple, so we got a little ahead here, but what are those important qualities to be a CISO that people maybe don't talk enough about, they don't really highlight enough?

EQ. EQ, all right. Yeah, I think emotional intelligence is so important in today's day and age, in particular where burnout rates are higher than ever.

I know you're passionate about this.

I am very passionate about it.

You have a preso on this today, right?

Yesterday at 2:30 PM with CyberMinds.org. Please stop by DEVO's booth and we'll scan. They won't be surprised.

This isn't going to go live until we're home.

Oh, that's right. I'll tell you then. You can come stop by and we'll scan your badge.

I totally will. And CyberMinds.io is awesome, by the way. Not-for-profit. I definitely recommend them as well.

Yes. And like being able to recognize, especially if teams are so disjointed now and global, if you know someone is not themselves, if you're seeing that they're exhibiting signs of burnout or exhaustion or frustration, recognizing that and being like, hey, do you need some time off? Can I take something off your plate? Let's talk. Because if they feel, if your employees feel like they're being looked after and they're being appreciated and understood, as a leader, it's your job to do that. And I've had people who are neurodivergent who all of a sudden, like, shy, calm, cool, collected, all of a sudden yelling, not at me, but just yelling about frustration. I'm like, oh, okay, take some time. Go ahead. We'll take everything off your plate.

So you don't just fire that person, right?

No, you can't do that. No, no, they're humans. And people, especially in security where it's, you're on constantly in Slack and Teams and Zooms and whatever, you need to be aware that people are— there's a blurred line between home and work now in most companies. And the fiduciary responsibility I think all security professionals feel to their companies or customers, the market, you do feel that pressure. So it's important to have and lead with EQ and set the example. Take time off yourself. I know when I start yelling at my kids and my husband and I'm like, I'm so stressed out and I'm from Boston, I swear a lot too. I'm like, okay, like, probably needs to take a day.

Yeah, that's great to hear. So you're the kind of leader who gets that people are people, and just because somebody flips out, instead of going, let's get rid of them, it's, hey, how do we help this person?

Yeah, you have to understand it and be flexible too, right?

It's a competitive market now for talent. Like, people like you are the ones who are going to attract talent and keep talent. People who don't think that way are going to lose talent, and there's not enough talent to go around. So I love hearing that you're a communicator, you care about people, You're actually focused on the work, but you're not all technical. You've got all this documentation. It sounds like you're a really good CISO, quite frankly. So if anyone's looking for a gig, DEVO might be a good place to check out. I don't know if they're hiring or anything, and I don't own any stock in DEVO. So if anybody's wondering, this isn't self-serving.

All right.

We're running down on time a little bit. So I want to get to the closing questions so we have time to dig into this one. Everybody knows the name of the show is Unspoken Security. And so with that in mind, I ask every guest the same question. Tell me something you haven't told people before, something that so far has been unspoken.

So I've got two.

Oh, good.

We got time for it. I actually gave us extra for this one on purpose.

My first one is I've had four names, last names. I know. And I didn't even know about the first one.

Are you like Bourne Identity? Do you have passports for all these different people?

I wish. That'd be cool.

No.

So I found out when I got my first passport that my mom had my name changed. So I was raised by a single mom. So I was born with my dad's last name, Donovan. And when he decided to leave and do whatever it is that those people decide to do. My mom had my name changed to her last name, which is the Greek last name, Jimidis. I had that, and then I got married when I was 20. I was an Army wife, so that was Richardson. And then now I am a Williams, and I'm Greek and I'm Irish, and I've got some Scottish in me, and I've ticked off the boxes for all of those names. All my identities match my genetic makeup.

How hard is that to get, like, the real ID now when they have to track all that stuff back? Or I know how hard it is to get driver's licenses.

It's horrific. And I'm not like one of those people that's, oh, women shouldn't change their names. When you have 4, I have to get my birth certificate my name change forms and going to all the town halls and stuff. So like I have like a, like a name folder that I keep in my safe.

I admit.

It's just funny. That's so funny.

Yeah. And I admit I grew up, I was one of those guys that when I get married someday, I want my wife's gonna change her name. I don't know why, cuz guys do that.

It's traditional. We'll say that. We'll just leave it at that.

But now I'm far enough along and I've seen it. I'm like, yeah, I think I get it now.

It is such a pain to change your credit cards and your Visa, your Social Security number.

That Social Security card is a nightmare.

I just go to the office now. They're like, hey, Kayla, you're back. What's going on?

You get frequent flyer, punch your ticket. Like, all right, 3 more names and you get a free one.

Right.

I don't think I've had a cool story. I wasn't like a bank robber or an international spy. Not yet, at least.

I mean, I'll be checking out Kayla later. We'll do some research on this. If anybody's out there open sourcing Kayla Williams, she's a CISO at DEVO. Start checking those names out. We'll find out if she's a spy.

If I have some like sleeper words that could be said too, I'm fine with that. Cucumber.

No, asparagus.

Cucumber. I like gin.

I like gin too.

So a cucumber gin.

Yeah. That's not going to be a sleeper word then. All right. So what's your second one? You said you had two for us.

Yeah.

I love that you're an overachiever.

Sorry to interrupt.

I am.

I'm Type A.

But this This one I'm actually really proud of, and I was an egg donor.

Really?

Yes.

I heard that's really painful.

It wasn't fun. I was super hormonal. But no, I had my first daughter when I was 23 years old, and I was like, okay, I'm done. I'm not going to have any more. I got divorced. That's the third name. And I was like, you know what? There's so many fabulous people and families out there that want to have children that can't. One of my friends was working in infertility. She's like, why don't you go be an egg donor? Yes. That's awesome. So it's all anonymous and, and things like that. But here, what the great thing is about being in the United States is that you can sign paperwork that says, I will never try to find the children, but if they wanna find me, which again, open door, not knowing my dad and having a child, like all the questions that you have to answer about your personal family health, I was like, I want them to have the opportunity.

Yeah.

So I did that. And then the families, cuz I never met them, but the families came back saying, would she be willing to do more so they can, I can have siblings?

Oh, okay.

So I'd done that a few times and then I ended up having a second child. So I'm a little too old now. I don't think I can do it. Geriatric pregnancy is not, I don't want that.

Not that kind of older.

No, it is. Yeah. Yeah.

For 35. Geriatric, I was gonna say geriatric comes at a really young number for this.

So yeah.

Yes.

Yeah. The medical community's great with that.

It's super. But I think that's a really cool fun fact that I'm obviously now telling the world, which is fine. If you are an opportunity to do something like that, it's more common for men to be donors, but for women, please go and do it.

It's such a wonderful thing. The process is a little different for men. It's a little, it's less painful.

It is.

It is. But, but it's such a great thing to be able to give a, to give family to someone who's deserving. And it is so expensive and they're paying for all your medication.

Mm-hmm.

So they are investing in this and It was one of those things that pulls at your heartstrings. And I'm really proud to say that I've been able to give someone family that deserve it.

That's incredible generosity. Like, it's— I'm impressed. Like, I've done a bunch of these now and I get a lot of people's things and I don't want to put down anybody. They've all been amazing. That one's really impressive though. That's an amazing amount of generosity. And again, I'm aware that's not an easy process. When guys say they've done it, yeah, it's an easy process. Like, we can donate.

Yeah.

We won't go into any details. Everybody who's listening is an adult, understands.

They can look it up.

Yeah. Nobody's cheering us on. Okay.

We're not doing anybody any favors.

You did. That's a huge deal. And like you said, it's expensive, it's time-consuming, it's a lot of energy and effort on your part just to do something nice for people you don't even know.

Yeah.

I'd come work for you just based on this alone. I totally— we definitely— yeah, yeah, don't worry, I'm not really leaving. But don't worry, Maisie, my handler, who's always afraid I'm gonna quit. I'm not going anywhere. But yeah, I would recommend anybody come work here. You just told me all I need to know about you. You're a good person. You care about people. You're shit, obviously. You're good at the job.

Thank you.

But it's the rest of the stuff that makes people want to come work places. So I'm impressed. I'm so happy we were able to do this. Yeah, I appreciate it. We'll definitely do this. I'll have have you come back on for a full episode. We'll talk about other cool stuff. Yeah. But I think that wraps it up for this episode of Unspoken Security live here from RSA Conference. Thank you, Kayla Williams from DEVO for coming and talking to us about some really cool stuff about your unique path to being a CISO and also some amazing stories about your personal life. For that, I'm going to wrap it up here. We're going to get out. We'll do some post-production. Hopefully get this thing out to the world really fast. And I'll get out of the way because RSA's got more people need to have our booth. Yes. So let's call it.

Great.

Thanks very much. Thank you. Appreciate it.

Thank you.

That's a wrap for this episode of Unspoken Security, brought to you by ZeroFox, the only unified external cybersecurity platform. If you enjoyed this episode, follow us wherever you listen to your favorite podcasts. See you next time.