Ryerson’s Joe Mariscal on Building a Resilient Cybersecurity Culture

As I came up through my career, I had both good and bad leaders. And so typically what I've seen as people have that experience is they can take one of two paths. They can either take the bad path, in my opinion, the bad path, where they say, hey, this is how I was treated. I was treated poorly. This is how I'm going to manage, or they can take the good path and they can say, you know what, that was wrong, or I think I can do better, and then they go on some sort of leadership path.

Welcome to the Ahead of the Breach podcast, where we are dedicated to empowering security experts and practitioners with the knowledge, insights and actionable strategies to lead the future of cybersecurity. Here's your host, Casey Camilleri, CEO and founder of Sprocket Security. Now let's dive into today's episode.

Welcome to the Heather Breach podcast. I'm your host, Case Camilleri. This is a podcast where we talk a lot about cyber security and specifically proactive security. I'm joined with Joe Mariskell, Director of cybersecurity compliance, with over 20 years of experience in cyber security and security operations. He leads a team of security professionals and has deep understanding of compliance and frameworks such as pci, nist, and cis. Joe, thanks for joining us.

Thank you. It's great having me. Yeah, appreciate that.

Yeah. So how did you get your start in cybersecurity?

It was pretty traditional. I started in the Marines actually in the mid-90s, where I learned leadership, teamwork, getting the job done. I got out in the late 90s, decided to go to school, got my first degree, got an entry level job, and it was really kind of a jack of all trades, infrastructure and security. So we were rebuilding networks from ground up, building servers, sometimes literally building servers, endpoint email firewalls. Worked my way up into my current position. Along the way I got a couple more degrees, some certifications, and I was fortunate enough to be offered to build the cybersecurity program from the ground up. At my current company, they had a lot of smart people doing a lot of smart things, but they didn't have the overarching cybersecurity umbrella. So that's what I was brought in to do. And so we've built that up to a team of approximately 12. And of course, it expands more across the company as we, you know, use, we can extend out into the various disciplines of IT to bring in specialty knowledge.

Nice. What part of your background that you use today, you know, coming from building servers, I'm guessing by hand, literally building servers. And things like that. What do you use from your past today in your current leadership?

Yeah, that is a great question. So building the servers and the computers and equipment, it was all about uptime. And so part of that uptime is to make sure that they are hardened, they're defensible, they're not going down for any particular reason, whether it's an insider person doing something stupid or somebody trying to attack those. As I came up through my career, I had both good and bad leaders. And so typically, what I've seen as people have that experience is they can take one of two paths. They can either take the bad path, in my opinion, the bad path, where they say, hey, this is how I was treated. I was treated poorly. This is how I'm going to manage. Or they can take the good path and they can say, you know what, that was wrong, or I think I can do better. And then they go on some sort of leadership path.

What do you think makes a bad leader? Like, what are the things you've seen.

Specifically, that in some of my experiences in the past, bad leadership consisted of somebody that wasn't really concerned about the stress that they were causing or they just wanted to get the job done. Right. There was a goal, there was a means to an end, and if they burned through people, then that was fine. Right. And so they weren't concerned about the person's personal life. They weren't concerned about their stress level. They were expected to be on 24 7, you know, reading emails, on vacation, after hours, on the weekends. And if something was supposed to happen, they were expected to know because they were constantly monitoring it. To me, that's bad leadership. That's not caring for the individual. That's not building a resilient individual or resilient team, that when things happen, they can operate at 100% efficiency. In general, there should be some sort of escalation path, some sort of monitoring path. So if you have overnight MSP or overnight help desk, there should be a known path to be able to escalate up and contact the teams. Again, we're staying away from those. Teams are expected to be on all the time.

Yeah, burnout's a real thing.

Burnout's definitely a real thing. Yeah.

So how do you prevent burnout?

Yeah, So a lot of the things that I do with my team, I. I am very big on off time is off time. When my team leaves for the end of the day, they should not be checking email. They should not be checking their phone for messages. I'll call them or somebody will call them if things need to happen. Same with vacation. I have literally turned off people's email when they're on vacation and to ensure that they are getting that relaxation, that refresh time, doing what they need to do. Other things that we've dealt with and worked with is the way I lead and the way that I train my team is, you know, you are compensated for 40, 45 hours roughly, and you're expected to work that and give me 40, 45 hours. Good work. It's not a wink wink. You're going to really work 60, 70 hours. You know, at the 40, 45 hour mark, I am sending people home because I need them to refresh. I need them to come in the next day and understand, you know, how they're going to be doing their job at 100% efficiency. So there's going to be those days that there's those 70, 80, 90 hour weeks. Right. But those should be outliers. That should not be once a month. That should be, wow, let's never do that again. Let's do the after action reports, let's figure out what went wrong and move forward. But again, making sure that people and their families and their personal lives are in line with what they needed to be. Because again, if somebody comes in and says, hey, my child is sick, I need to take care of that. Right. The bad thing is to say, too bad you got to work today. Right now, he or she is stressed out, they're not working efficiently. And ultimately it raises the risk profile for the company because there's a very large chance that they're going to miss something or they're not going to handle it efficiently. So, okay, well, everybody's going to have to bite the bullet, right? That 40, 45 hours or I have to step in or bring somebody in, let that person deal with that family member.

Yeah, that's actually really refreshing to hear because, you know, sometimes hours in a week or butts in seats, you know, it's more or less about the output and the quality that you're getting. And we're humans, you're not going to get like a full productive 40 hours anyways. Right. Like our browsing history will, you know, prove that. That's refreshing to hear. Now, how do you progress your team through their career? How do you start them from early career, progress them to wherever they want to go and maybe eventually. That's leadership management.

Yeah, that is leadership management. And that's something that I myself am trying to work as I go along. So myself and my I have a very good manager myself, and then my second command, senior manager of cybersecurity. We spend usually the beginning of every year and we look at our skills gaps and we say, okay, well, here's the skills gaps that we have as an organization, but let's also have those conversations with the employees and make sure that we understand where do you want to head? Right? Because sometimes you could be saying, oh, there's a skill gap here. We'll put employee one here. Well, maybe employee three actually wants that. Employee one doesn't. So what fits the context, right? And putting that extra effort, again, that's part of the leadership. Part of it is putting that extra effort in to make sure that you're meeting the needs of the person. Ultimately you want them to stay. Right. But ultimately, if they succeed in life, you as a leader are succeeding.

How do you identify that skills gap? How do you assess that and figure that out? I find that really interesting.

Typically, it's ongoing conversations throughout the year, understanding what are current threats that are emerging, having security audits and understanding where you fit in that security audit, and having a scoring system so you can prioritize. Okay, we're not dealing with this or we're seeing a rise and in attacks or successes here. And again, paying attention, going to things like Black Hat or other conferences and understanding what the emerging threats are and saying, okay, well, we're going to need to fill a gap there, or we're going to need to add a tool here, but we're going to need a person to run that tool. That's typically how we do it.

Nice, nice. So speaking of emerging threats, you work currently, right now in the manufacturing space. Is there anything specific that you're seeing to manufacturing or just anything specific that's emerging for the threats that you're facing?

There's a number of things in the manufacturing space across all industries, you know, and that's around OT, IoT and IoT. Right? Industrial Internet of things. And so it's funny because I will talk with peers or I'll talk with other leaders, and they're like, well, we don't have any ot. Or it. It's like, yes, you do. Let's talk about that. And suddenly they realize they have OT or Iot. Now, in a manufacturing, you have an oversized amount. You can have anything from, at least in ours, you know, CNC machines, laser machines, cutting machines, something like that. But of course, you're going to have all the other things from camera systems, alarm systems, vending machines with hardware, vending machines with Candy also, all of those things. So a lot of times you can't put agents on them. Right. They can be hard to log, extremely difficult to patch, if at all. And so how do you understand and manage those? Do you physically segment them? Do you logically segment them? Do any kind of, you know, firewalling? How do you access, especially in the case of remote support? So there's a lot of companies that need to come in and remote support through contracts. So how do you make sure that you're monitoring log and understanding the support that they're giving and not doing something either malicious, accidentally or on purpose?

Yeah, and the OT is a really interesting thing. We had a customer one time that said, don't be like our last pen testers where they accidentally hit this OT thing. It was an actual crane and it robbed its whole payload. And if someone was staying underneath there, they would have been killed. Right?

Yeah.

You know, so here we are trying to proactively identify vulnerabilities in the network. But, you know, we could actually literally kill someone in the attempt of doing so. So how do you guys combat, like identifying vulnerabilities in ot? How does that play into your vulnerability management program?

Yeah, that is actually through a number of tools that will actually read passively or slightly actively read through the traffic that they're seeing and being able to identify. Okay, well, it's this device with this OS or firmware that's known to have this one. It's talking these protocols. And so that presents a picture of the vulnerability status for that device. And then you can address that and score that as far as a risk rating and go. Okay, well, we need to address that now. We need to work with the vendor, we need to work with support or, you know, okay, it's a low risk. We can do this particular mitigation control or somewhere in between. We may not be able to patch it. Support may not be able to do something. Some of this equipment can. Half a million dollars for an HMI. Right. Or $100,000 for a PLC. So replacing it is not just trivial, but they can be out of date. So doing some sort of mitigation, some sort of security mitigation to ensure that they're safe.

Yeah. And you mentioned kind of progressing your team throughout. You mentioned skills gaps and whatnot. How do you continually train your team, train your soc, you know, how do you make them stay sharp?

Yeah, that's a really good question. Again, having the support from executive leadership is absolutely key because you're going to be dedicating resources Whether it's money, it's time, it's having to pull additional resources in because so and so is at a conference and we can't pull them out because their training is important. So we want to make sure that we are offering a number of avenues that fit that person's lifestyle. This could be certification paths, this can be education paths, formal education like a degree, a formal certification like SANS or an ISD2. This can be web based, so things like cybery or some of the other tools that are out there. And then of course, you know, everyday training. So we work a lot with red teams and purple teams to make sure that our teams are constantly seeing the new traffic. Right. Do they understand what the newest threats are? Do they understand how it will present itself in the network? Have you seen that? No. Why are we not seeing it? Is it because we missed a training opportunity for that person or are we missing a tooling or a process opportunity and then filling those gaps?

So you're actively doing pen testing and red teaming engagements then? Yeah, yeah. Okay. How frequently do you do that?

Typically it's regulatory based, so at least a year, but it will be more often if we have particular application or system that has come up and we don't have full confidence that it's been hard and it can't wait. If it's externally exposed, then it almost always gets pen test right away. So there's a level of risk that you're looking at from that. And then we also recently adopted a automated purple teaming software application. And so that way we can now ad hoc test email servers, endpoints, active directory and all the other different things. So, you know, here's a new attack, okay. We go to our software vendor. Can you guys add that to your repertoire? Great. We attack it. We didn't see it. Why didn't we see it? Let's figure out, let's take it apart. And then, okay guys, here we're going to do it. And then we do ad hoc tests, right? We just press the button and things happen. And all of a sudden you see a bunch of heads pop up, bunch.

Of alerts go off, right? Yes. Except those are advocation because they have those alerts. When you're transforming security in an organization, right. And really enabling it, what are some of the things that you do as a leader to help implement the things that you've identified, the gaps you've identified?

Well, cybersecurity exists at the pleasure, in my particular opinion, exists at the pleasure of the company. Right. The whole reason that cybersecurity is there is to make sure that the company can oper rate and be force multiplied with whatever they're doing, whether it's just existing and meeting the status quo or entering new markets. How do we add a cybersecurity shield around whatever that is that they're trying to do to reduce that risk for the company? The other part is once you've identified those risks, you place them in some sort of risk register. So you want to score them and you want to understand where they are. This could be, you know, industry scores, this could be threat enabled scores, the CVSS scores, anything, whatever it takes to say, hey, confidently, we think this is external, it's internal, it's segmented. Here's our priorities, here's our top three or five priorities. And then you build out the mitigation plan and then you present that to executive leadership. Typically you try to use a business speak, convert that into business speak and then say, okay, this is the resources. And ultimately it becomes a business decision. Whether cybersecurity likes it or not, it's a part of the business that helps the company conduct business, not the other way around.

Yeah, very true, very true. Wayne, you mentioned CBSs and other frameworks for scoring. Do you use a combination of them or do you pick a certain one based on the certain types of assets or vulnerability classifications or mash it up into a hybrid?

It's a little bit of a mash, it's a little bit of art, right. To understand. Okay, well, we have this one externally exposed, it's a 7.0. If we update that right now, we're going to cause a downstream effect to OT equipment to other equipment that'll be in the network. So what kind of software mitigations can we put a firewall rule and can we put a web application firewall or something else hardening on the device instead of patching? But ultimately it's one of the best defenses against the CBS score is not having it. Right. So the other part of that is knowing what's in your network. So a CBSS score comes out or something comes out at black hat, DEFCON, whatnot, you know, a 9.0. Well, do we have that device? Okay, we have that device. Are we subject to that? Okay, great. We're not. Let's just move on with something else.

Yeah. So do you have an asset inventory or something?

We do. We've recently this year was a big know all the things type of year and then start understanding and classing, classifying them. What we found is we were really Struggling again because the company's been around for so long, we really struggled with a lot of legacy things and understanding. Well, when something blipped or something in the company said, hey, we think that cybersecurity is causing an issue. In years past, it may have been. We don't even know what that is. Right. And I think a lot of cybersecurity groups are like that. It's hard to know all the things. So we really have put a lot of inroads into knowing and classifying, you know, whether something's an OT Iot, whether it's a printer, it's a computer, and being able to immediately pinpoint it's at this location. It does this. Here's what talks to it, here's what it's talking to elsewhere in the company or outside the baselining stuff and then being able to work faster and more efficiently to a response.

So is that some sort of software that's doing like Attack Surface management or is it.

Yeah, it's a cyber asset management tool.

Okay, so it's not spreadsheet.

It is not a spreadsheet. There are definitely plenty of spreadsheets. There are still definitely plenty of spreadsheets.

But spreadsheets, better than nothing, though, right?

Right, that is true. But we do spend a lot of time, in fact, there's been a lot of resources put into this tool because if you don't know it's there, it is extremely difficult to defend. Right. And especially the other side of that too is, well, the company wants to bring something in. Well, where does that fit into the current infrastructure and what else will it affect? And so where can you slot? And again, if you don't know what else is in the network or what may be talking on a particular protocol port, whatnot, it may be affected.

Yeah. I can't tell you how many times it happens pretty much daily that we discover something in our customers, Attack Surface, and they have no clue that it's even related to them. Right. So like you're insecure. The security department doesn't even know that the marketing company, just the marketing department, excuse me, just put up a new WordPress website full of vulnerabilities, Right. To promote some new product or some new thing. Right. And unfortunately, it's like you find out when we deliver a critical finding and it's like, that's not when you should find out.

No, no, definitely. I would remise if I didn't, at least in the past, you know, maybe five, six years ago, you'd be on calls, conference calls with the business. And they would mention something just out of hand and be like, wait, wait, stop the conversation. What did you just say? You know, what is that? Where is that? What is it doing? So we're working, that's all to say that we're working to avoid that?

Yeah, yeah. You have a lot of experience with compliance as well, right? What tips can you give someone to navigate compliance as it relates to cybersecurity?

Yeah, that's a hard one. PCI or the upcoming CMMC ones can be more or prescriptive. Right there. More you will do this or you fail it. Things like CIS or NIST are more advisory. Right. And so you want to make sure, again, where do you fit? Whether it's an industry, whether it's the type of company, whether it's your particular risk profile, where do you fit within that framework? And of course, scoring against that framework. So that's where that risk register comes in and says, okay, well, you know, according to nist, we should be doing X, Y or Z. It should be happening in such a manner. We are not. So we're going to elevate that risk score and bring that up to executive management to decide whether or not to remediate it. Nice.

Well, Joe, it's been a great conversation. If someone wants to follow you and your work, how should they reach out to you?

Thank you. A typical cybersecurity little tinfoil hat. I'm off of most social media, but I am on LinkedIn, so if anybody wants to reach out, they can reach out to LinkedIn.

Sounds good. Thanks for joining us, Joe.

Thank you. It's a pleasure. Appreciate it.

Thank you for listening to another episode of the Ahead of the Breach podcast. If you enjoyed today's episode, please leave us a review on Apple Podcasts or Spotify. If you're interested in exploring how Sprocket is shaping the future of offensive security, be sure to check out our website@sprocketsecurity.com thank you again for joining us. See you on the next episode.