EP247 The Evolving CISO: From Security Cop to Cloud & AI Champion

Security.

Hi there. Welcome to the Cloud Security Podcast by Google. Thanks for joining us today. Your hosts here are myself, Timothy Peacock, the Senior PM for Detection, UEBA, and Risk in Google SecOps, and of course, Anton Chuvakin, a reformed analyst and senior staff in Google Cloud's Office of the CISO. You can find and subscribe to this podcast wherever you get your podcasts, as well as at our website, cloud.withgoogle.com/cloudsecurity/podcast. If you enjoy our content and want it delivered to you piping hot every Monday, please do hit that subscribe button. You can follow the show, argue with us, and the rest of our Cloud Security Podcast listeners on the Google Cloud Security Community page. Anton, we have a guest today whose message in many ways boils down to, I think, evolve or die.

I think it is... a very useful discussion on kind of higher matters. We're not discussing Cloud IAM or RAG or AI in a SOC.

No.

It is actually on the leadership transformation, transition, difficult periods type of episode, which I think to me is very useful to balance off some of our more technical coverage. And instead of agonizing about the parsing rules, decoupled SIEM, We can agonize about organizations in transition, arrival of cloud in a highly audited environment, that type of stuff.

And what I love about this episode that kind of uplevels our conversation is we even talk about a CISO who needed to uplevel the conversation they were having with their board. I think it's so interesting when you see people talking at the wrong level and asking for the wrong kind of help at the wrong place. So, this episode, listener, has a ton of gems, not just for the CISOs in the room, but for anybody Who's trying to communicate up and down ladders of responsibility, shall we say.

Yes. And I think there was one moment when I briefly felt like I'm going to disagree with the guest, but he actually didn't go there. It's about CISO background. Remember, he pointed out something about technical background. Ultimately, I am very nervous if a CISO does not have any technical background, but I'm also very nervous if CISO only has technical background. So, I'm kind of in one of those quintessential it depends guys, maybe former analysts perhaps. Who is thinking in this case that the truth is in the middle and either of the extremes are bad.

Ah, yes. Anton famously, listeners, wants us to have the Goldilocks of CISOs. Do you know the story about Harry Truman wanting a one-armed economist?

Yes, I've read about it. I forgot the punchline, but yes, I read the story.

Well, Harry Truman famously asked somebody to bring him a one-armed economist and they said, why? And Harry Truman said, So that they can't say, on the other hand. So, you know, in a quest for more clarity in life, let's turn things over to today's guest. Today we are joined by the one and only David Gee, a former CISO, a board risk advisor, an author, many, many things. David, it is a delight to finally be doing this episode. And listeners, this is a fun episode because it's, it's a book episode. And book episodes make me feel like a real talk show host. And so, that always amuses me. So, you've got 2 books we want to talk about, but let's start with the Aspiring CIO and CISO book. What are the skills and behaviors of a CISO that have evolved? Because you've been around CISOing for a long time. How has this changed and how has this evolved?

Yeah, thanks, Tim. Look, firstly, I'd say that if you're in the C-suite, then You're always transforming yourself. If you don't, then you're gonna be, you know, left behind. And I think, you know, even today's age of the AI, I'm often encouraging the people who are CEOs and CISOs to think about, you know, what's your competitive advantage now, given AI can remember more than you can and can do these other things. So, there are certain things that the C-suite can do to protect their roles in terms of their soft skills because, you know, strategic thinking, you know, risk management, stakeholder management, All these things actually, you know, the AI can't do at the moment. So that's your only competitive advantage. So how do you go and fine-tune those areas? So to me, you know, I think many of us come through different avenues to get to the C-suite and we bring with us what we have. And then we then say, actually, this other part I have is not so great. You know, I need to go and work on that piece. And so in my first book, I've got a copy here, but look, it was all about then trying to figure out Not everyone wants to be at the summit. Okay. At the summit of the mountain, the air is kind of thin. It's not very nice. It's kind of sharp rocks and cold. And, but actually, people like to be up the summit. So, how do you get up the summit? How do you climb that mountain? And how do you figure out to be the best version of yourself? And the best version of yourself means that you need to be to the point of being uncomfortable. If you're comfortable, actually, you're not going to grow. So, the whole premise of the book is how do you get yourself uncomfortable and identify things that make you uncomfortable and be comfortable being uncomfortable, one of the— only chapter 3. And then try to work out, okay, across skills, knowledge, experience, and behavior, where are you uncomfortable? And how do you then think about, okay, the person 2 jobs ahead of me does these things really, really well. How do I start to copy that, mimic that, role model that behavior? You know, it doesn't matter if you're an analyst or you're a senior manager, there are 2 jobs ahead of you that you can think of a person. Let's look at Anton here. Anton's an amazing architect, right? I'm an analyst. I wanna be Anton. How do I actually think like Anton? How do I, you know, volunteer? Anton, can I work on your task force and help you with your strategy update or architecture roadmap update, even though it's not my job? If you talk, have a coffee with Anton, he might actually agree to do that. So, how do you then get experience and exposure to take you beyond what you're used to doing in your day-to-day job?

I got a strange sub-question to this question, and it starts from what you mentioned about being in a On a C-level. I've met some CISOs with a C in the title, obviously, because they're CISOs, but who were clearly not part of the C-suite, which is really interesting. And I think that it's kind of hard to explain because people who take a shallow view of this, they say, oh, you're a CISO, your first letter is a C, so you're in the C-suite, but they were actually not. So, do you have any advice or any thoughts based on your book or based on your experience to people who are kind of Halfway in the C-suite, if it makes sense.

And often, Anton, it's, you know, the— I don't want to say this characterizing this, everybody's like the same way. But if people come through a technology background and, you know, I coded way, way back, right? But I learned early on that actually, to me, my competitive advantage actually is change management, transformation management, driving change, getting people to come with me. And then, the ones who actually struggle some with boards and with management are not actually— they're not thinking the same you know, both technology and business, and understanding that actually, I'm here to translate those needs to both sides and make sure that I can bring them on the journey. So, I think that's the secret sauce, Anton, is that how do you understand the business needs to make money? How do you understand the business needs to, you know, drive efficiency changes and be supportive of that, but also be supportive of security? So, you're not compromising yourself, but you're saying, actually, if we take this risk and make these and know, for making changes to legacy things because we want to do this transformation. That's a risk acceptance we're taking on for X period of months or years. What can I do to contain that? What can I do to segment the network or do something different to help me be comfortable with that? However, you know, we're kind of probably telling the board we're probably out of risk appetite. We're probably, you know, taking some chances here that we hope nothing's going to happen for the time being. And we're going to do some things that are going to improve the organization, grow the business. blah, blah, blah, but actually, we are taking this risk right now. That sort of language is important, I think, to have explained.

I think that part makes sense. And I think you mentioned trust, and I think you also highlighted rebuilding after a breach as kind of a trust exercise, a trust-related element. So, can you share some of the lessons for CISOs or maybe people who are 2 jobs away from a CISO, as you pointed out, in terms of leadership and resilience? During this critical recovery period after a breach. I think we've had some episodes on our show of somebody who rebuilt his IT infrastructure after a breach, and he got the title of a Chief Secure Technology Officer, which is stuck in my head ever since. But you also have lessons from these types of, I'm trying to be very polite, critical elements, critical recovery periods.

Yeah, it's interesting. I was just talking to Darryl Pieri yesterday about this in preparation for our session next week, and we're doing this keynote. fireside chat. It's actually my first book launch event. And we're talking about how the fact that, you know, you've had this incident happen, people are afraid, management's afraid, the board's afraid. You're trying to restore confidences, but you also don't want to be too overconfident because you don't know what you don't know.

Yeah.

And then, you know, presume— assume breach. Now, it's assumed breach because you've been breached. And then, how do you start to, you know, build the defenses back, re-architect that? own team's confidences have been a bit shattered by this all because, you know, a lot of pride involved in this job. And, you know, that sort of shell around yourself to have resilience, right? You're trying really hard to not let all the things happen to you. So, look, it all goes down to, you know, to me about prioritization, right? How do you help prioritize? How do we make the first step, second step? How do we get the right steps going? Because this never ends. But if we get very good clarity in our own brain, our management and boards around, here's what we need to do in this sequence. And yes, there's also steps 7, 8, 9, and 10, but we'll get to that. We just can't do it all at once. And that's a very mature view that we need to take forward. And there's just time required, right? There's time and a bit of luck to say, actually, during this period, we know, you know, it's a little bit like a house being burgled, right? The house has been burgled once. Guess what? It gets burgled again. And I go back to my first job, actually, working for an insurance company where we did inspections, you know, as little graders going out with the guys inspecting houses that had been burgled. And then, and they explained how, you know, we take extra measures, extra locks, extra precautions. But however, they came back again because they knew that insurance company would pay for that new television set. So, it's the same principle, right?

That's a good story. So, I want to pick at something about cloud and something you said earlier about change management and transformation. We see orgs still migrating to the cloud. You know, 80% of workloads are still on-prem. From your perspective and experience, what's the role of a CISO in a cloud transformation, and how can they be an enabler, not a roadblock?

Yeah, that's a good question, Tim. I think there's, you know, you want to make sure that you're moving, not just lifting and shifting. Okay. So, you know, I've been a CIO for 20 years too, right? So, I know there's an incentive for CIOs to move things digitally, change fast, transform fast, because they're rewarded and their stakeholders like them for for being fast, but also being fast and secure. So, how do you do this in a manner that's actually, you know, DevSecOps, not just DevOps? And it's interesting for me, you know, having been a CIO, going to being a CISO, and then having to argue with my colleagues to say, sorry, we can't do this because it's, you know, you don't have MFA enabled, or, oh no, David, it's all custom experience, it's important. I said, no, no, no, I agree, but it's also a bad experience when you're hacked.

Right.

But I've, you know, and I've said this many times is that, you know, and sometimes when I was working with, as a CISO, I'd find that the COO were actually much more supportive of my role versus the CIO, where the CIO would be split and trying to keep everybody else happy. The COO would actually come to the meetings, come to the non-governance session meetings to get briefed and understand what they need to do and be much more morally supportive and physically supportive. Which was shocking to me, I think, to start off with, because I thought, hey, they should care about this. And actually, they don't, because it's, you know, for the CIO, there's often just downside. There's no upside for them. And so, they see this as being bad. If it happens, I'll get fired as well. Yeah. So, it was a little surprising for me because I was one of the, you know, one of the CIOs who went to the dark side. But I really wanted to go to the dark side. I did it on purpose. And I was kind of shocked my peers didn't care about it as much as I did.

Did they genuinely say they don't care, or is it something that they kind of de facto happened? Because to me, this is a peculiar one, right?

Presumably, you're sure.

Yeah.

So, Anton, working in an organization that had mobile banking apps that were hacked in one country, and then I'll go back to the CIOs and say, by the way, that organization, that large country has been hacked with your mobile application. You have the same version that they do. So, I want to see your timeline to put MFA in. And they say, no, no, I refuse to. I'll say, no, no. I'm not negotiating with you. I'm telling you, you need to do it because you're being hacked and actually customers can't get onto their application at all, right? Putting in some new bots, whatever. But however, give me your timeline. And the answer is not no, the answer is when. But I was shocked that I had 3 CIOs telling me, we're not doing this because, you know, we're too busy, the customers won't like it. And I said, I don't care. And we're not putting MFA across everything, it's across these more complex transactions. And so, that shocked me. I was really taken aback by that, that they would say no, given that there's other large organizations that, you know, has the same problem and being hacked and in the front pages. And so, that just to me is wrong.

Hmm. So, in light of that, I'm kind of trying to figure out, is there a type of a CISO who is not just an enabler, but who is kind of a champion for cloud? Back when Phil Venables was my boss, we had this discussion, about organizations where a CISO was actually the one who brought them to the cloud. Now, at first glance, it sounds incredible, but I've learned a few such cases from various sources where the CISO, the CISO or CISO of the organization was the cloud champion, the person who pointed out that cloud's more secure, cloud is better, cloud's more agile. Have you ever seen those? Have you ever seen CISO being a cloud champion, maybe even the cloud champion?

I don't know if I've seen them overtly driving it. They obviously get it. I mean, I talked to a CISO recently where I was asked to advise them about— they've got a board paper going forward about resilience. Okay, now we know resilience gets complicated because it's business resilience, cyber resilience, tech resilience. And to me, they're all the same thing, right? Because the board and management and the regulators consider this to be bad. When something bad happens, it doesn't matter. It's just the resilience. But I was actually asked around, hey, David, should we be asking the board about 3 nines or 4 nines, you know, 999? And I was like, well, let me think. That's that many hours, that many, you know, it doesn't matter. That's the wrong question to ask. It sounds like if I ask you this question, which is, tell us about your cloud migration, actually, how many of your crown jewels, you've got 80 crown jewels, how many crown jewels actually are in the cloud? And he said, none. I said, well, okay, there's your problem. So, you want to get to 3 nines or 4 nines, but you've actually not architected it. So, forget talking about that availability because you need to be thinking about migrating yourself from legacy that you admit actually is not secure, not patchable. That's your problem, not the 3 nines or 4 nines, okay? If you do that, you'll get that by default rather than trying to give the board some sort of story, which is just BS. Now, let's just get to the problem, which is, board, we need to help migrate these things because these widgets aren't secured. And they want me to— we spend 2 or 3 years to do that. Let's go and do that first. That's about the, you know, trying to redirect this conversation. CISO was a little surprised, I think, when I said that, but I said, no, go and get your help from the other colleagues, right? Your CIO and others to say, this is what we need to do to fund this rather than putting band-aids on.

I really like that answer. And I think the idea of asking a board about how many nines we need is a scary thought. I'm trying to picture even that conversation, but I'm curious. We're the Cloud Security Podcast by Google, so I can't help but keep picking on this cloud thread. Do you have advice for a CISO who's new to cloud?

I mean, we think of it as CISO meets cloud for the first time, and he may be a champion, he may be a laggard, he may be like, drag me there over my dead body. I mean, there are many scenarios we've seen over the years, right? But, like, what's your advice to somebody whose company was all on-prem and suddenly cloud landed in his lap or her lap?

Yeah. I've seen so many people change. From being all on-prem, when we, you know, talk about virtualization, moving from virtualization internal, then to go to cloud. I've seen people switch from, you know, 190 degrees, 180 degrees, their position. And there's always a reason behind that, but you've got to dig into that and understand, you know, what's the rationale? Is it about control, perceived control? But I have, I've seen people take very strong positions versus actually saying, hey, what are the facts here? What's the advantage or disadvantages? And if I go to cloud, what are the disadvantages? What's the concerns I have around concentration? How do I then manage that concentration risk? No different than I have concentration risk on-prem. There's different sorts of risks.

Sure.

So I think that needs to be thought through. And that's the part where I guess, unless you've got an architecture background and thinking around corners, then you're thinking maybe a little bit too tactical and superficial versus thinking, okay, well, actually, Maybe I'm wrong. You guys tell me. In the new world, right? Perhaps AI is more important. So therefore, should AI strategy be driving your data strategy, be driving your tech strategy versus the other way around where you've in the past just put in processing and then data and then AI? But I think that's just throwing it up there and say, actually, if I had to redesign it from green, from a green place, how would I start? How would I figure out my strategy? And I think, I don't know if CISOs think that way. Because they're not being asked. That's not their job, right? Their job is to go and protect something versus thinking, okay, if I can go start from scratch, how would I do that? And how would I rebuild this to be more safer?

So, in light of that, what's your advice for CISOs meeting AI for the first time? Like, imagine that you are a CISO who maybe does cloud, maybe doesn't. I think you made an excellent point that for some companies, they may actually skip cloud, at least in some regions, cloud may not be fans' favorite, right? So, they skip cloud, but then AI lands in their lap. So, what's your advice to a CISO who meets AI for the first time? Should they be afraid or—

And listeners, that sounds like a very natural transition. It was secretly the next question in our doc. David did not set himself up for that on purpose, but that was perfect.

No, no, no, no. I'm actually doing a talk in November for a conference in India about AI and CISOs. And so I'm thinking about this a bit. I think fundamentally, it's such a double-edged sword, right? I mean, you hold it, you can cut yourself, and you use it to hurt people. But Right now, I think we're not ready. Most organizations aren't ready for AI. We don't have all the right detection in place. We don't have all the right culture in place. Shadow AI is here, and people are adopting it. If you ask your average CISO, are you blacklisting everything that's coming in that you could be blacklisting from an AI standpoint, they probably wouldn't necessarily know the answer. And our tools and processes and playbooks, do they have thought through that? The answer is no. We're still working through it. So I think there's going to be what I fear, Anton and Tim, is there's going to be some car crashes happening before we get there. And the regulators are afraid of this thing too, right? So I'm positive about it in terms of long term, but in the short term, I worry what's going to happen. Probably more harm than good, unfortunately. So wait, wait.

But that means that if you're a CISO, your advice is to stay up to date?

No, no, no, no, no.

You just check in. No, no, not at all. Not at all.

all over it. Get all over it. I actually did a keynote recently, Anton, where I kind of said the CIO should be thinking of themselves as the HR manager for the department, which I think someone else had said. The NVIDIA CEO had said that, Jensen. And I thought, actually, that's a really good thought. If I actually onboard the AI agents, if I train them, if I, you know, promote them, hire them, fire them, like HR agent organization does, then I'm, you control of that versus actually watching, you know, Tim buy this stuff and then say, why is Tim buying this stuff? He's got the wrong agent. He's not training it properly. He's not making sure that it's secure. So I've encouraged CIOs and CISOs to get all over it, you know, get in front of it and don't be a victim. Go and try to control this thing if they can. It's gonna be hard because everybody wants to do this thing fast.

Mm-hmm.

The business wants to go fast so that you're gonna be seen as the department of no again. It's not no, it's actually, okay, if you're doing these use cases, A, B, C, D, just go and do it. I don't care, right? If it's got these components of data or there's a, you know, business IP process that's, you know, sensitive, then go slow, but go carefully, have the right guardrails in place and approval processes. So I think it depends. You need that framework in place to make sure you can go fast and go slow.

I like that.

Yeah.

I like that too. One thing that's become very obvious to me throughout this conversation is how wide-ranging the CISO role is and how many different kinds of stressors, acute and chronic, you could be exposed to. And so one of the things you touch on in your, you know, Aspiring book and your Day in the Life book is this, you know, continuous self-improvement and balancing that with the pressures and day-to-day responsibilities. So how do you possibly do that? Like, the range of this conversation already is stressing me out, and I'm just talking about it. So, how do you balance that?

I retired a year ago, right? But I still wake up at 4 in the morning to read things and research. I think continuous learning and always trying to understand that you don't know that is a little scary, right? So, you kind of scare yourself in understanding things and talking about things you don't necessarily an expert about. And so, I think I did— it was a month ago, I was asked to do a talk for 1,000 Auditors on AI.

Oh, wow.

That's a scary talk. I'm shuddering even imagining AI for auditors.

Yeah.

Like, holy cow.

And that's okay. So, I was encouraging them to say, actually, get your hands on this thing, right? Because if you don't, you'll be disintermediated and no one needs you anymore. So, you need to get your hands on the tools, get your teams trained in this stuff, understand what it does do. And then how do you then, in the world of AI, how do you then, you know, start to make this to your advantage so that you can help the business? as a partner. Now, we'll have to really challenge ourselves, I think, in terms of where we are and how do we think the world's going to change too. And it's going to go faster than we think. Yeah. So, get over it.

To me, this is interesting. And I think I want to kind of expand from that to the balancing the CISO occupation, so to say. You also had some advice, at least you alluded to, of balancing the hard work and research and waking up at 4:00 AM to figure out the latest AI risk or latest cloud advantage No cloud risks, right? How do you approach the balance in this self-improvement and your day-to-day duties? We had a CISO episode a few months ago, and it was about long-term future for CISOs. And the CISO on the line basically joked, long-term, do you mean like evening? Like 5:00 PM would be long-term?

Yeah.

Because there's so much is spent on like fighting ransomware or dealing with immediate concerns. So, how do you balance? What's your secret to balancing longer-term stuff with immediate pressures?

Look, maybe I'll point to some of the lessons I learned from writing the second book, Anton, because getting 24 CISOs and a few others to contribute and ask these questions and talk about your passion, people always talk about stress management. People always talk about a day in the life of a CISO, right? And if I talk about the first few lines, I'll talk about how the sunrise is the first chapter. And then the sunrise happens, you wake up sort of fresh and you've You kind of, you know, suddenly go, oh, actually, that happened yesterday, didn't it? Oh, damn. Okay, I've got to fix that first. And you start through all your to-do lists, all your meetings, all that pressure points going to happen during the day, you know, the management, the board, the regulators. And you're thinking, okay, oh, damn it, I need to get A, B, and C done, and I'm good, and I can think about the other things. So, it gets down to your point, which is there's so much stuff being thrown at you during the day, it's hard to be thinking strategically unless you carve out time to think about strategic things and where you're going to and what you're not going to do. And so, there's a piece I talk about in the back of the book where it's called Sunset after 30 chapters. And I try to distinguish between priority and time management. And people often think about this as being the same. They're not the same thing, right? Priority management is the strategic piece around thinking what's really important. Time management is just trying to figure out how to use your time. And to me, the CISO needs to be thinking about priority management more than time management. You need to do both, and both are complementary. But if you get the priority management part done, then I think your job's easier because you're dealing with the most basic stuff first rather than worrying about what's sexy out there. And it's a very subtle difference.

No, I think that's a really important difference. And I think all of the product managers listening will appreciate it.

Yeah, I like that. It's also subtle but very valuable because I did see people mentally jump time management right away. But like, no, it's not about how you efficiently do useless stuff. It's more about how you decide what stuff is useful and then efficiently do that. So, it's almost like they're missing step 1 of the process and they jump straight to step 2. It's actually kind of— that to me is a good gem right there.

That is a good gem. I hate to do this, but I have to ask our traditional closing questions, David. One, Aside from your books, which we will link to in the show notes and all of that, do you have recommended reading for people? And then 2, do you have a single piece of advice to maybe help CISOs sleep better at night? Maybe let's go with that because I suspect they all struggle with that.

Yeah, please, no drugs.

Yeah, no, no. I sleep really well at night. I mean, I typically would go to sleep within 10 seconds of hitting the pillow. Okay.

Oh, exhaustion. That's a good tip.

Exhaustion is one thing. The other thing is, too, you have to trust, obviously, I don't know your circumstance, but trust your team. You have to trust your team, the team that's going to do the, the second shift. And we know that traditionally there's more attacks happening at nighttime, so which is something we talk about in the book. And so, you know, it's hard for you to be that chilled about going to sleep because you know there's going to be some bad stuff happening. So how do you just trust your team? How do you then, you know, to me it's all about the— I don't use the word balance because balance is the wrong word. How do you remain your own sense of balance where you actually can be satisfied what you've done today is what can be done. And what tomorrow you're going to do is A, B, and C. If you get that clarity in your head, you won't get frustrated. You won't feel as much tension because you've got clarity what needs to be done versus, you know, always thinking, oh my gosh, I'm behind. I should have done this yesterday. And that doesn't really help you. That doesn't help your team. And your team will feel that pressure. Now, they need to feel some pressure for sure. But if it's too much, it becomes stress. And that's You know, it becomes negative. And so, I'm not sure that helps anybody. I guess in terms of your question, Tim, in terms of reading, I read so much stuff. I watch YouTube for hours every day. There's so much good material to learn from. And then I, after reading about something obtuse, I'll go and then read documents about it. But I like to, if you want to call it browse, if you want to call it that, around different topics. And so, I don't know much about that, you know, and that could be very weird things, but— That satisfies my curiosity, I think, that I want to gain new knowledge. And, but then, you know, it's not unstructured, but I think that's worked for me to be unstructured in that regard versus being completely structured and thinking about, I need to learn these things sequentially because that's not the way my brain works.

Hmm.

I think that's really good advice. I often, I don't fall asleep right away when my head hits the pillow and I often find myself reading just the strangest corners of Wikipedia to fall asleep. Because it satisfies my curiosity. So, David, thank you so much for joining us today. This was a really interesting look at the challenges that CISOs face. Thank you.

Thank you.

And now we are out of time. Thank you very much for listening and of course for subscribing. Please subscribe so you can get new episodes piping hot. And if you love our content, please drop us a review on your platform of choice.

You can find this podcast on YouTube, Apple Podcasts, Spotify, or wherever you get your podcasts. Also, you can find us on our website, cloud.withgoogle.com/cloudsecurity/podcast. You can argue with us on the Google Cloud Security Community site, googlecloudcommunity.com.

You can follow us on X, x.com/cloudsecpodcast. Tweet at us, email us, argue with us. And if we like or hate what we hear, we can invite you to the next episode.

See you on the next episode of the Cloud Security Podcast by Google.

Secure running. Secure running.