EP104 CISO Walks Into the Cloud: And The Magic Starts to Happen!

Security warning.

Hi there. Welcome to the Cloud Security Podcast by Google. Thanks for joining us today. Your hosts here are myself, Anton Chuvakin, a reformed— reformed, mind you— analyst and senior staff at Google Cloud's Office of the CISO, and Timothy Peacock, the senior product manager for threat detection here in Cloud. You can find and subscribe to this podcast wherever podcasts are sold and distributed. as well as at our website, cloud.withgoogle.com/cloudsecurity/podcast. If you enjoy our content and want it delivered to you piping hot every Monday, please do hit that subscribe button. Please rate our podcast if that option's available in your app. You can follow the show and argue with us on Twitter as well, twitter.com/cloudsecpodcast. You can also use our LinkedIn page.

Who have we got joining us today?

So today we have one more of the C Summit Cloud, you won't believe what happened next episode. It's our third.

Our third.

Yes. And today you're gonna be surprised because we're gonna have a conversation with a CISO who actually dealing with cloud in a very elegant, professional, and beautiful, dare I say, manner.

That's high praise.

That's high praise. And this is really impressive because he also isn't the CISO of a Bay Area startup. He's a CISO of essentially a financial services organization. So this is like doubly impressive, maybe triply impressive.

You know, that was high praise, listeners. I didn't even have to put on my translate Russian praise into English praise for that. That was just straight up very high praise. So perhaps with that expectation setting, let's dive right into it with today's guest. Today we're joined by Gary Haislip, the Chief Information Security Officer at SoftBank Investment Advisors. Gary, thank you for joining us today. We're doing another one of our CISO Meets Cloud episodes, And so, we traditionally start these off by just saying, tell us about your journey migrating to cloud. Give us the 30-second overview of what triggered this, how it's going, and all that good stuff.

Well, I mean, for me, I think most of us have been touching cloud for the last several years, but when I came to SoftBank in 2019, this is my 6th role as a CISO, and it just happened to be my CTO, my boss, who was a previous Googler, He had a vision of us going 100% cloud. So, first, I took a step back and I'm like, what? But he had a vision of, with us, 20+ international offices and people all over the world, there was a specific way he wanted to go ahead and do it, kind of a hub and spoke. And the only way we were going to be able to do it to provide different types of services for all of these geo locations was that we were going to have to do cloud. And if we were going to do cloud, well, let's do it all. And it's been a journey over the last 36 months. Scary at times, but I have to admit, I've learned a lot. I've loved it.

Scary at times is also very much a theme, right? We hear it from pretty much everybody who is in a security leadership role and who encountered cloud or even who was cloud native. The scary at times does come up. And that's probably one not surprising part of the journey. How about what was the hardest for you in your current role? Like, what's the hardest cloud migration, cloud evolution task or activity, or however you want to phrase it?

One of the biggest things for us is we're 100% SaaS. You know, so you go from having your own servers and data centers, and you've got some SaaS apps, and then all of a sudden you have no data centers, you have no servers, and you've got 360 SaaS apps. And it becomes a really interesting data security puzzle where you're spending a lot of time working with the network team and with the IT team. Thank God all of us are all embedded together in one department, so we work extremely close together. But it's all a discussion of authentication and access and data protection. And now all of a sudden, my team is extremely focused on the endpoint because that's where the touchpoint is. That's where the security is now at. And I think one of the hardest things for us to understand was, with 368 SaaS apps, IT can't own them all, which means that you have to inventory them and you have to have business owners for them. And departments have to champion which ones are theirs, and you have to audit them and manage them. And I've got 6 different international regulators. Sometimes when they come in here, they've never seen an environment like this. And, you know, what do you mean you've got business owners that own each of them? And how do you audit? And can you prove that? Well, how do you back these up? And I'm like, well, they're not my apps. These things belong to a third party. We've got SLAs, and it's in contracts and everything, but I'm not calling up Box and asking them, hey, what's your backup schedule? Can you prove it to me?

So, that means auditors, you deal with a lot of auditors with their minds blown.

And I have to admit, it's interesting because we actually go into a teaching phase sometimes with a lot of our auditors because they've just never seen environments like this. And they're like, okay, shoot, you got your policies. All right, we see the procedures. Okay, we see the logs. What the— when they see the rest of this, and then we start having discussions about how we— and a lot of it is just proving how we manage risk and the whole data protection piece and how we know that data is being accessed by whom, and yes, they have the right permissions, and it's not being shared by anybody else. And that's A lot of these are big questions when you're in a large SaaS environment like this.

368 SaaS applications. That's just a frightening number.

When I originally did it, it was like we had the spreadsheet from hell, and I'm trying to figure out who has what, and we're trying to do it all manual. Now, it's like, you know, you're using Okta Flows and everything for single sign-on, and you're using Jira and automated tickets that go out to each of the business owners, and they know when the audits are coming. And it's just me tracking which ones are critical for audit purposes, and then which ones are non-critical so they have a longer lead time to be able to do their audits. 3 years in, it's a lot smoother than, you know, the first year when we were panicking and I'm like, what have I walked into?

I was resisting because this is so fun and exciting and useful for our audience. So I was resisting to changing the topic to tools. But when I hear 380 SaaS apps, I immediately think of CASB.

Oh yeah.

And so is CASB central to your thinking? Is it a useful tool or is it something that's on the list but not like your primary way of doing things? Just curious.

Yeah. I mean, what we ended up finding out was we needed 2 CASBs.

2? 2 only?

Yeah. Well, because what's interesting is that we're leveraging with it being an Office 365 shop. When we're doing Office 365, we found out Microsoft's CASB works really good for Microsoft-related stuff. Not for everybody else, but for that, pretty good. So we're like, okay, well, we've got that covered. That covers all of the Windows documents and spreadsheets and everything else. and the stuff that they're doing. But now, the other 90% of the SaaS apps and stuff, what we found was it just happened to be the email security platform that we're using also had a CASB that did reverse proxy and everything. And it's been just an amazing tool, and we've been able to integrate it into our single sign-on, and we've been able to integrate it into so that when you not only authenticate and you authenticate as a person, you also authenticate to your apps that you're allowed, and you also authenticate your device, your laptop.

Mm-hmm.

So yeah, what we found was that we had to be more open to the fact that with an environment like this, just because of the tools that we're using to be able to communicate and run the business, we needed 2. And then of course, you put it all into your SIEM so you can have a better view of it, but it just worked for us.

That's very interesting, and perhaps it's surprising to me that you'd end up with 2 CASBs. What else has been surprising for you in this journey?

Well, I mean, some of the other things that we found was that now you're gonna need a tool for SaaS creep.

SaaS creep.

Which is one of the big things I— and it's just very similar when you think about it, it's just very similar like if you have an on-prem environment too, is that you're going to have applications that even when you go ahead and you take away admin permissions, no one has local admin and everything, there's still apps out there that people can sneak onto their laptop or use because they're being used via their browser. And you need tools to watch for that, to be able to see sanctioned and non-sanctioned apps. And then if you see non-sanctioned apps, obviously, whatever tools you're using, you want to integrate them into your security platform so you can block them. And so, it was something that we had to go ahead and watch. There is going to be a creep issue because SaaS is so easy to use. You can whip out a personal credit card real quick and boom, you've got a fun little app on your laptop that you can use to go ahead and help you be more productive at work. However, The data in that app is pretty sensitive, and now it's being stored in somebody else's servers. And that whole contract and all this stuff never even went through legal. No one's even aware of it. I don't even know that there's data over there. But now that we've got tools, we scan for this, we look for it. Our employees are trained on the proper method. We're not saying, no, you can't use specific apps, but we have a process where you bring it through technical review. We take a look at it. There's 3 or 4 different business groups that weigh in on it. And then if it's So if it's good to go, it gets approved and they're able to do their thing. It's all about protecting data and protecting the firm.

And do you have a method for detecting when an employee starts using SaaS in the browser that they haven't gone through this process on?

Well, yeah, one of the tools we use—

But CASB does it, right? A good CASB would do some of it.

Yep, a very good CASB does it, and then we have a security tool that does it as well. And the good thing is we actually integrate them together so we can compare.

Oh, nice.

Perfect. So, I want to shift gears a tiny bit to some of the other lessons useful for other CISOs who are kind of encountering cloud. And while I'm dying to ask you about your data security practice, because across that many apps, your data security must be super exciting, I want to ask maybe before that about the overall control. Like, how did you think about security controls in this environment?

Yeah, that's—

Fluffy question a little bit, but okay.

Yeah, that's just not fluffy. That's, like, that's Big for us.

Yeah.

And I have to admit, I mean, the team that we have here, and this is what I was saying, the IT and the security team, we're all integrated into really one large team, and we work extensively back and forth with each other's projects. Just the guy that leads our network team, he's probably one of the most brilliant people I've ever met for IAM. He just loves just the whole authentication piece, and he was one that actually had us go ahead and look at Okta, but he had a lot of other ideas on how that could be integrated into a full cloud platform that we were doing and how we were going to integrate it for the various SaaS apps. So it was right away we knew we were going to have people that were in 20+ countries around the world. And we knew that the data, everything's going to be really focused on the endpoint, on the laptop, on the corporate-issued laptop. And so we wanted to go ahead and make sure that immediately you come in in the morning, maybe you're working from home, you're at a Starbucks in Singapore, whatever, if you open up that laptop, you're immediately in an encrypted box. So you're immediately in an encrypted VPN, and then the network connection goes into a cloud that belongs to SoftBank, and then from there you access your apps. And so from start to finish, you're within our area that's encrypted with the tools that we go ahead and use, from the SASE-generated VPN to the cloud firewalls and everything that you're running through, to when you open up your laptop and you do your single sign-on. You've got your nice little dashboard with the apps that have been assigned to you, and it's just for you. It's a nice seamless, hey, I've gone ahead and opened up my browser, I've logged in, I've authenticated myself, I see my apps, I select the icon, and I go to work. And everything's encrypted on the backend. So whether you work at home, whether you decide to work at that Starbucks, or whether you come into the office, we wanted it to be one seamless experience. And that's what we've done. That's what we've focused on is to make it to where The whole authentication piece, the whole 2FA piece is very quick and easy, but we're constantly looking at what we can automate, what reports I can pull. So, how users are able to contact tech support 24/7, whether you're in the Shanghai office or whether you're in the UAE or you're in the EU or here in the States. And then pulling all of that together with being able to do the security blanket on the backend to where it's not disrupting business, you're still able to do your work, but we have the mechanisms in place to where I can tell, hey, there's an issue with this asset. They've downloaded malware in the browser. It's been isolated, but we need to clean that up real quick. It's been a long kind of a road as we've put these pieces together. The good thing is that we've had people here who are extremely intelligent and we all come together and work the problem and we troubleshoot, we work it again, we constantly are testing. There's nothing that's kind of sacred that we can't touch. We're always looking at how can we make it better for our employees? How can we make it seamless for them so they can do their job and we're running in the background and we handle all of the issues for them?

You know, I had a strange thought as you were talking. It reminds me about how some of the stuff happens here at Google, right? So, you mentioned some of your security team is ex-Google, right? And it's sort of like some of it definitely is reminiscent of our kind of like how it feels here.

I was saying my boss—

you don't get the same vibe?

No, no, I'm getting very Google vibes. And I'm also getting a little bit of your ASO thinking coming through here as well.

No, what I was saying was my boss who started this whole picture is ex-Google. That's where— that's the reason why you're probably thinking, oh, this sounds like— well, that's the reason why. That's where he came from.

So that data security question that I've been meaning to ask. So I know that in the past, back in my Gartner days, people with a lot of SaaS Maybe 70, 100, or 300, really suffered from the data governance fatigue or data governance gaps. Like, they really weren't sure where what goes. But you seem to feel pretty good about this. And I just want to know how you do it. Like, what's your data security practice, principles, or ideas? Like, share anything you can, given limited time.

Well, I mean, in a lot of ways, it's very similar to data protection when you're on-prem. You know where your data's at, you store it within particular areas. We've got one storage area that's accessible to external and internal so that we can deal with external customers. Then we've got one storage area that's internal just for employees internal. So, I mean, you know where those are at, you know what data is in them, who has access to them. It's locked down per person and per team. Any kind of changes is automatically a whole Jira process that gets logged and audited with approval. And again, on the endpoints, you have to authenticate to the particular data that you're going to. The data is tagged to where it's allowed to go. You get pop-ups saying, hey, do you want to go ahead and do this?

That sounds familiar.

Yeah. Exactly, yes.

Or, hey, this data is only supposed to be internal. You cannot send this external. And oh, by the way, we're also logging this. So, we see you, don't be stupid. It's like, that's what I'm saying is even though we're SaaS-based, We're still doing security. It's just, it changes a little bit. The dynamics change. You still have to do proper inventory. You still have to do proper classification. You still have to manage the flows of data and where it's going. And you still have to decide, almost in kind of a tiered process, what stays internal, what's allowed to be shared and for how long, and then what's just publicly acknowledged data and you're not worried about it. And that can go ahead and be shared. And I don't want that data back for some reason. You got to do that homework. You've got to go ahead and put that in place. And just as I've dealt with Gartner for years as well, there's no one tool that does that. And so you have to be comfortable with the fact that you're probably going to deal with several different tools that you're going to put together. So you got to make sure you're comfortable with API and integration. You got to be comfortable that the SIEM is going to be able to take those logs so you can get the particular views that you need so you can answer the questions when you get asked, hey, how did this happen? Or, hey, how can we make this more secure or maybe less secure? Because this is interfering with business. The big thing I go ahead and I tell CISOs, because I talk to a lot of them on the side, is that even when you put this in place, you're always looking at where you make changes because it's a continuous process.

That continuous process piece is so important. And I also love what you said about, is it too secure and interfering with business? That's great. A lot of CISOs don't seem to think that way, although I'm hearing more and more who do, especially ones who call themselves BISOs as opposed to CISOs.

Well, you know, BISO and CISOs are different.

Yeah, because it's regional, right? Regional or departmental, right?

Yeah, BISOs kind of COVID one area, CISOs cover the larger. But, you know, and I'm sure Anton can talk about this, a lot of CISOs now, especially those of us that deal with boards and deal with leadership teams and everything, we're looking at ourselves as being more of a secure— you know, we're basically a business executive that just manages technology and risk through using cybersecurity. You know, and that's the way I look at it. You know, I don't look at myself as being a technical executive. No, I'm a business executive that's just highly technical. But I can also speak business. I can also speak risk. Just tell me what audience and what you need.

You know, I'm getting a vibe that— I mean, maybe it's like an unscripted remark. Not that anything here is scripted, but like, why are we not more CISOs like you? I'm sorry, this is like wishful thinking. You don't need to answer it, but it's just interesting how it's just so enlightened yet common sense and then rare. Okay, fine. Enlightened, common sense, and rare triangle.

Well, I mean, you know, it's funny you say that because it's like, this is a lot of of what I've written on, books that I've published with my co-authors and articles and stuff. My background, I come from the military. A lot of us that come from that side of the house, we're used to doing multiple different jobs. And so, we bring a lot of these different skill sets and a lot of these different views to each one of our roles. And yeah, I mean, I honestly think that the role itself of CISO is maturing across business today, and many of us are now bringing these different skill sets and these different areas that we come from. And so, I do think the role is changing.

Oh, let's double-click on that because that's interesting. This is a CISO episode. How's the role changing? And is cloud making it change more?

I do think cloud accelerates it because the reason why I think cloud accelerates it is because the CISO role is becoming so intertwined with the business today because cybersecurity is in so many of the different departments and it is so many of the different operations, you know, and the things that businesses want to do to compete and to be able to excel. And cyber ties into a lot of that. And so, what's happening now is you're not 3 or 4 or 5 levels down, you're actually a lot closer up now to those people that are making decisions because of how cybersecurity impacts the business. And that is forcing the role to change because of the fact that you are now responsible for more things. Your remit is changing. The impact that you have on the business can be both positive and negative. substantially, obviously, if you screw it up. So, I do, I definitely do think that the role has changed quite a lot, and I'm excited about it. I mean, I did my MBA years ago because I kind of looked ahead, working with a lot of startups and stuff, that I felt like eventually this role was going to become a business executive role that would have all the fun technical stuff I like, but also would have a lot of the interesting strategic stuff that I freaking love doing as well. And that's where I see the role moving. And a lot of my peers are the same way. The interesting thing though is each one of us approaches it differently depending on what the business needs.

Well, that's so interesting. And listeners, we're going to ask, I think Anton's going to ask one more question, but I want to say, because people don't see how the sausage of a podcast gets made, the questions and things we talked about today with Gary, almost zero overlap with the questions in the document we prepared ahead of time. But it's been, I think, a really interesting, fun conversation. So Anton, why don't you ask our second-to-last question, then I'll do our closing.

Okay. So, here's the question that we kind of have to ask, and we've been kind of maybe trolling people a little bit with this question.

A little bit.

Can moving to cloud be a net risk reduction? Because we still see— I still see the less enlightened CISOs who see cloud as predominantly a new risk. And our CISO, Phil Venables, who is, of course, extremely enlightened, keeps reminding people that, hey, cloud can be, or almost automatically is, a risk reduction in the long term. So, what is your take on this? Like, is moving to the cloud a net risk reduction? Can it be? Is it always? However you wanna phrase it.

I mean, I think it is in that you remove some risks, and then the risks that you have left may be different or new. You know, I mean, for us, it was like, as we were moving to the cloud, it was, you know, some of the decisions we made were like, okay, we're not going to do this anymore. I don't have the manpower for it or the skills for it. In fact, I've got a third party that can do this better than us. So why not go ahead and give that to a third party? Instead, focus on these other things that are more important. And for me, case in point, I didn't need to be running a SOC. And so I looked at 5 different vendors. We found one we decided to partner with, and that third-party SOC is now integrated into my stack. They do an amazing job. I'm happy to let them do it, and I focus on other things that I need. So I do think that it does reduce risk. You still have risk, and some of the risks will be different, So, I mean, I'm not dealing with a lot of the hardware stuff that I had to manage and servers and a lot of the data center stuff that I had to manage. That's on somebody else. But I'm still dealing with data security. I'm still dealing with user access. I'm still dealing with physical security stuff as well that I'm doing. So, yeah, the risks will change, and I do think that they reduce in some areas. And then I also think that you get some new stuff, but it's just part of the game. It's part of going ahead and using new technologies. And as CISOs, we're flexible to that. We're flexible to new threats, so there's no reason to go ahead and not be flexible to new opportunities to up your game, to up your stack, you know, for your teams and things that you need to do to be successful.

So the game is the game. Yeah.

You know, cyber is cyber. You know, things may change, but cyber is cyber.

We're going to lose our security member cards for being so optimistic at the end. Like, how are we? You're also an optimistic CISO, which is another rare breed. So I'm kind of, I love this episode. So I appreciate it.

I've had a lot of coffee this morning.

A lot of coffee. Tim, go ask the final question. Otherwise we're gonna run out of time.

So recommended reading, and aside from lots of coffee, any tips for helping your fellow CISOs move to the cloud?

Ah, recommended reading. The best thing I would say—

Somebody said Dune, the book, the other episode. So you can go anywhere. You can go—

I don't like plugging my books. I guess the best thing I would say is, Just look at my LinkedIn profile. I've got 100+ articles attached to there. And a lot of my articles, I reference things like Phil's written, or I also reference other books and stuff like that. So, the best thing to do is take a look at that. That'll get you started. For other CISOs that are going to cloud, I think one of the first things you need to do, and I'll just leave it at this, inventory. Inventory. Know what you have very, very well. Data, process, procedures, know what you have very well. And from that, then pull in IT and the other business units and start making decisions as to what's going to stay and what's going to go. But you're not going to be able to do that effectively unless you have an inventory. I cannot— I mean, it's just, you have to have it.

I love that answer. I always tell customers, you can't secure what you can't see. You can't manage what you can't measure. That's a great answer.

Awesome.

Well, Gary, thank you so much for joining us today.

Oh, thank you very much for having me.

And now we are at time. Thank you very much for listening, and of course, for subscribing. You can find this podcast at Google Podcasts, Apple Podcasts, Spotify, or wherever else you get your podcasts. Also, you can find us at our website, cloud.withgoogle.com/cloudsecurity/podcast. Please subscribe so that you don't miss episodes. You can follow us on Twitter, twitter.com/cloudsecpodcast. Your hosts are also on Twitter, @Anton_Chuvakin and @anton_chuvakin. Tweet at us, email us, argue with us, and if you like or hate what we hear, we can invite you to the next episode. See you on the next Cloud Security Podcast episode.

Thank you, Roni.