Episode 14 (Video): Live with Stitch Hindle on Leadership & Success

Welcome to the Leadership and Success Podcast with your host, Coach Beezy. If you need to develop into a better leader, this podcast is for you. You. If you want to achieve a greater level of success, this podcast is for you. His mentor, Dr. John C. Maxwell, said it best: everything rises and falls on leadership. We hope to inspire you today and provide you with an insight that has the potential to positively impact the trajectory of your life. Welcome to the Leadership and Success Podcast.

All right everyone, please ask, add all of your questions for my guest on the comment. And thank you so much for being here. And first and foremost, Happy Thanksgiving. I can't believe the holidays are already upon us. I'm so excited. Today I'm going to be talking to a global CISO, Seiji Iyaindol from Sykes, and I am very, very excited about what we're going to be talking about. As you know, cybersecurity is becoming quite preeminent across all industries in the 21st century. And today we have a man who may have a lot of the answers on how you can keep your business safe online and keep your organization safe and secure so you can kind of focus on making profit and accomplishing all of the mission of your organization. So without further ado, I'm gonna bring to the screen Stig. Here we go. Good morning, Stig. Thank you so much for taking time out of your very, very, very busy schedule to be here. We're gonna have almost an hour, and I'm very, very glad to have you here. I believe you are the very first cybersecurity professional on the podcast. Again, we're focusing on leadership and success, and we definitely need to learn more about cybersecurity leadership. Good morning.

Morning, morning. Thanks, Bob. I appreciate it. I appreciate the opportunity to be here. I'm I'm stunned that I'm the first cybersecurity guy because everybody seems to be talking about cyber these days, whether you like it or not. You meet somebody in the pub or a bar and they're talking about cyber. It is a weird world.

Weird world. Yeah, I think it's just the signs of the time, right? And I am really glad that the cybersecurity profession is truly a profession today because I think when I first got started, it was more like a hobby, right? People would do it on the side, but now it's a full profession. People go to school for it and everything. So it's pretty, pretty exciting time. And I think for people like you and me, in a way, I think we kind of have job security. There is always going to be work for people like, like us, and there is not enough people certified or qualified to do the job, which is another thing I am quite concerned about and seeing what we can do to get more people qualified and kind of get into this growing field, really a field of the future. But if you can start by letting us know about your leadership journey. So you are the global CISO for Sykes. How did all of this kind of start for you?

Sure, that's a great question. I can honestly sum it up in two words: by accident. How does that sound? So I'm the head of security for what was Sykes Enterprises and is now the, the Citel Group. We've just gone through an M&A activity. And that's been the story of my life and my career, actually. It's about recognizing those forks in the road, right? Recognizing where your path splits between one thing and another. I have an intelligence, I've worked for both the British and, excuse me, Oh, I'm terribly sorry. Um, let me mute for a second.

Please take your time.

Oh sure, no worries. Um, I've worked for the British and Scottish governments, and, uh, and a lot of, a lot of what, uh, what I've done in my career has been very much, uh, data-driven. I've worked with intelligence communities and law enforcement agencies around the world. Working with the London Stock Exchange and the Royal Bank of Scotland, leading the way through, through IT developments and disruption at the time. I was part of one of the first online banking programs that was launched in the UK with RBS, and I had a great mentor at the time, a gentleman called Stan Durham. And then I transitioned out of that into a small Scottish-owned company called McQueen, and McQueen was based out of Edinburgh in Scotland, and we pioneered and built the first contact center offshore in the Philippines. Now it's one of the Philippines' highest GDP, and everybody outsources there because the language capabilities, qualities, customer service is excellent. So I've been part of an industry-leading community for some time. And then Sykes in 1997, back when I was working in emulation software running Windows on Mac and doing this weird new thing which was called Multi-User NT. Now I'm dating myself terribly now, based on the NT 3.51 platform before it was really ever Windows or Microsoft Azure operating system. It was just servers in racks and serving things out to these these new pieces of equipment called WinTerms or thin clients. And now of course we're in 2021, almost in 2022, and everybody's talking about VDI, virtual desktop, and VTI, virtual telephony, and everything else. And it's all thin client technology, all virtual. And that's where I cut my teeth back in the 1990s. Um, I built the, uh, the reseller program and training materials selling this newfangled technology called WinFrame for Citrix back when the logos were orange because it was a Florida company and everything's about the oranges here. My God, I'm sounding more and more ancient by the minute. And so I transitioned in that to working in IT and building Sykes infrastructure, moving us away from Novell networking and Pegasus Mail and a lot of other things into this new technology called Microsoft Exchange. And at that point in my career, I got a knock on the door for a couple of people in law enforcement, a couple of bobbies, cops. And they said, "Hey, we need your help. We need you to see if you can tell us some information about somebody that we believe is working for your company. Just tell us if you see anything unusual." So I did what any good upstanding citizen would do. I helped them out. I dug into data, being a very data-driven person, again, working through intelligence. And it turns out that that was Scotland's most recent and most prolific serial killer. And the strength of my evidence, I became what they call an expert witness or star witness in the EU. I became a star witness on the trial that ended up putting the gentleman away.

Wow.

And then at that point, the executives of the company approached me and said, have you considered a career in security? You might be good at this. Recognizing that fork in the road, I said, sure, I'm up for a challenge. And, and I've never looked back since. Um, I went from a team of 3 people, myself and a couple of others around the world, um, who are still with us today, uh, and I built a global security operations center, um, hired a young lady called, uh, called Carol Dowson. Carol runs my GSOC today. She's the, she's the senior manager in charge of my global security operations center. That was 25 years ago that I started that career. Um, and now here I am. And I think if I can sum it all up in one word, it's about recognizing those forks in the road, recognizing those new challenges and new opportunities that come to you and playing on your strengths. That's, that's the biggest thing that, that I think has made a difference to me in my career. Um, it's about recognizing opportunities and playing on those strengths. And it hasn't always been a story of success. But that's how I've gone from this, this little guy working with, uh, with Royal Bank of Scotland, um, building this newfangled thing called online banking, which was through 288 modems at the time. Um, and now working in global cybersecurity. The threats are the same. The technology's the same. The labels and the names have changed. Um, but not a lot has, not a lot has changed about, you know, what we do. It's— but what has changed is how we do it. And I think that's the biggest changes that I've seen, you know, from your background, you know, working in naval intelligence. So, you know, you can— I'm sure you can relate to that, Bob, in that, you know, it's the same basis, right? It's the tools, the technologies, or the pieces that we use to support our effort that's changed. But the data always is the key piece. The key piece that's driven it all.

Absolutely. And one big difference too, you know, between working for the government and then in the industry I have seen is industry seems to be really driven by profit, which is perfectly, perfectly fine. And usually, you know, if you get breached or there is some type of cyber incident, really the worst that could happen is, you know, your reputation gets tarnished a little bit and you lose some money, right? But in the Navy, anything happens, sometimes, you know, people might actually die. So It's a completely different priorities. And I also say, you know, it looks like in the Navy we pretty much have, it seems, unlimited budget. Whatever we need, we pretty much get it from Congress, right? They just have to print more money or something. We are in the industry.

My goodness, I wish it could have been that. I couldn't have said the same working with the intelligence communities in the UK and with Europol and Interpol. It was everything was on a shoestring. You'd be amazed what we could do without funding.

Yeah, but look, looking at your background, how did you get into the Forbes Technology Council, which is how we are connected, which to me really is one of the most exclusive councils out there for tech executives? How did that happen for you?

Yeah, I knew people who worked with the Forbes Technology Council in the past, but Most recently, I've gone through an exercise of rebranding, if you will. And I think we all have to do that once we reach a certain point in our careers. And it's through that rebranding exercise that I realized that there were so many ways and means above just attending conferences, you know, and you stand up as a keynote speaker. I was a keynote speaker last week at the Florida Technology Summit. But there's more ways to do that and reach more people and give back the experiences you've learned, the things that you've shared with the community. And that's what's always driven me is that need to help. And that's what's driven me throughout my entire career, whether it's been in IT consulting or training or whatever I've done, it's that need to help. And then with increasing or upping my game on that need to help, you know, through mediums like LinkedIn and, you know, everything that we do right now with, uh, with Clubhouse and Fireside Chat and all these other, all these other things. I mean, it's like Twitter, you name it. There's so many ways that you can get the message out there. Um, and I was approached by Forbes Technology Council to say, you know, why aren't you a member of this, of, of this, of this one? Why aren't you a member of our group? And I was like, I don't know, why, why am I not a member of this group? Uh, and we had those conversations and, uh, and there's several opportunities which I hope to share very soon with the community where I can use the Technology Council and the way of sharing that thought leadership, providing that input into those meaningful conversations because pointless conversations, you know, it doesn't add any value. It's about adding value and helping. And I think Forest Technology Council drives the way with that because they're leading those meaningful conversations just like yourself, which is the reason we're here. As soon as I got onto the Technology Council and I'm like, oh my goodness, I need to talk to this guy. He sounds fascinating. And I'm sure we're trying to make a difference, Bob, right?

That's what drives us. Yes, absolutely. Giving back and adding value. I think that is really, really, really key. Like I said prior to the call, I think a substantial member of my audience, they're kind of new into this. They want to get into cybersecurity or IT, whatnot. And some of them are dreaming of one day becoming an IT executive. What would you tell them? Listening right now, uh, kind of what is— what you think kind of a mix of experience, formal education and training, certification, somebody just getting started, what do they need to do to get into our field?

Sure, no, that's, that's a great question. It's really about being open to new experiences because experience will get you a whole lot further than, than a certification will. And but unfortunately, where the industry is driven, not everybody thinks alike. The industry is often driven with, you know, they'll look for entry-level positions. I see this cropping up on LinkedIn all the time, people bemoaning this fact that where they're searching for an entry-level security analyst, you know, if you're just out of college or whatever, come and be a security analyst. Requirements are CISSP or a master's in cybersecurity. And I'm looking at this stuff going, my goodness, what on earth is driving that? Right? No, none of the bad guys care about that. I guarantee there's no threat actors out there that are breaching multinational organizations that are CISSP qualified. It's a valuable certification, but it requires you to have spent at least 5 years in the field. The, the examinations— I've been a CISSP since 2007, but the examinations that you have to go through now and the depth of knowledge that you require is quite significant. And for an entry-level position, I feel it's unreasonable. For people to start asking for CISSP level stuff. There's much better things out there, Security+, much better things to dip your toe into, into the water. So that, you know, it's about experience. Go and get yourself experience. And that doesn't mean go and get yourself a job so you can put that experience on your, on your resume or your CV. It means get involved in your community. Look around you. Here in, I mean, here in Tampa, Florida, there are 5 security-level communities, technology-level communities, and CISO groups just in this area alone. This is a burgeoning tech hub, is what, is what Tampa is on the, on the East Coast now. Um, but it— but get involved in the community, join the groups on LinkedIn, look up things on Clubhouse, right? Get onto Twitter. You'll find there's a wealth of experience there. You can learn penetration testing, you can learn whatever it may be. Just from sitting into those meetings and getting onto Twitter and working through those, those different pieces. Right. But the community will give you the knowledge and experience for free. They won't give you a certificate to wave. Right. But if you get involved, you'll get that knowledge. And I think getting involved is the biggest takeaway. I think any, any of your listeners and any of our viewers can have, get involved. You'll find it so much more worthwhile. Follow people like Chris Roberts or Alissa Miller, right? Follow people like that on LinkedIn. My God, you'll learn so much in like 5 LinkedIn posts and you'll be like, my God, I can go out and I'll be the next guy that discovers the next SolarWinds, you know, that kind of thing.

No, that is so true. I couldn't agree more. And something you mentioned about the CSSP, I got mine, I think I actually got certified in 2009 and now I am on the little board that kind of helps, you know, decide what the next questions are going to be on the exam. But I must tell you, today in 2021, after all—

it's all your fault, it's all your fault that it's so hard now.

Yeah, 22 years of experience, I think I might fail the test if I took it today. I just might fail. So, uh, for sure I'm never gonna take that test ever, ever, ever again, right? So I'm paying my dues, I'm doing all of my, uh, CEUs, right? Continuing education credits.

Of course, of course, because nobody wants to redo the exam again.

So that's why we keep our CEUs up That is exactly right. But, but yeah, you are absolutely correct. People have to get there and really get engaged and find a way, right? Because I've seen there are so many paths to becoming a security professional, not just one path. Like mine was, I kind of started in IT and I have a STEM background. I did biology, chemistry, and microbiology at the PhD level. But, but really, I mean, I see people from finance, lawyers, they get into Security, privacy, it's really unlimited, it seems. And I agree with you, experience is most important than anything else, more important than education and definitely certification. Although I feel like at the beginning of my career, certification like Security+ helped a little bit.

Of course, of course, yeah, definitely there is a place for it. I just don't believe that, you know, master's in cybersecurity is required for a for a Level 1 analyst.

Yes, yes.

If you've got one, great, amazing, good on you, but holy cow, just to put that into an entry-level or a job description, I think is just outrageous.

Yes, there's definitely a disconnect between the industry and the HR, right? And usually people from HR are kind of like the gatekeepers. They have their list of requirements and they won't even give you an interview unless you have everything that is listed in their silly job description, which many times, just doesn't make any sense at all, which is something we definitely need to change in this industry or we're going to get in serious trouble, right? Was it last year, ICSquared said it was like 2.3 million more cybersecurity experts are needed across the globe because there are so many jobs but not enough people to actually work them. But when you have an entry-level position job posting and you're asking someone to have 5-year experience for an entry-level, that just doesn't make any sense at all.

No, absolutely, absolutely. I have to be careful because one of my best friends is the chief HR officer for a company. And so while I may talk like I disparage HR, it's important they have a role to protect the organizations that we're with. And there's always things— ATSs— I've learned recently about ATS, applicant tracking systems, and how if your resume isn't written a certain way, you won't even get past the computer. I mean, we're in an AI and ML-based world now, and HR is not you know, HR is leading the charge on a lot of that. So what I would recommend to anybody who's seeking to get into cybersecurity or any career now is don't just write your CV because you're, you're thinking that a human's going to read it, right? Your resume, your CV, your resume has to be written to get past a machine.

Yes.

Before it then catches the eye of an HR person, before it then catches the eye of the CIO or CSO that is hiring you. I mean, it is a new world. So there's ways and means, right? Ways and means.

Yes, and talking about ATS, another thing I have noticed, because I'm helping a couple of mentees kind of get entry-level job into security, like I say, it's really, in my opinion, the best profession out there today. I think security and privacy. But anyway, a lot of these ATS systems, like, they would ask you for your 2-page, 4-page resume or whatnot. And then they're gonna ask you to type in everything that's in your resume, like your job title, your description, what you do. Again, and if you have a lot of experience, it takes you like, like an hour just, just to, to let them know what you've already told them, which again, I think is just silly. That's just stupid. That's making people not even want to apply for, for those jobs. But, uh, anyway, but generally speaking, though, as a, uh, cybersecurity executive, what do you think we need to do as an industry to kind of make, make this better, kind of streamline the hiring process and try to give people as much experience and opportunity to get on and start having hands-on experience in security.

No, that's great. And I think it starts with us, right? As the— not just the hiring managers, but the tone from the top. You've got to set a culture across your organization as leaders. You know, you have directors and managers and VPs and everybody that reports to you all the way down to whoever it may be down in the field. But they're all going to hire and look for and seek out people based on what your culture is, the messaging that you've driven across your organization. And so what I've tried to do is I've tried to drive a culture of inclusion and diversity, but not just within race, color, creed, LGBTQ. All of that's important, right? And we need to increase and improve more of that regardless. But look at it from a diversity of skill set as well, right? We need as many different perspectives being brought to the table. Uh, my— I'm a martial arts guy. My sifu, my teacher, um, and Tom Muncy, who is a professor of Old Man's Kung Fu, taught me something called players to the game. Bring as many players to the game as you can, simplifying always, and then you'll win the fight. So if we're talking the fight is now hiring and recruiting and retaining the best cybersecurity talent you can get, seek out new opinions, seek out diverse perspectives, right? I've hired people into my organization not just from an IT background. I've got a lady who works in our, in our North America cybersecurity region, if you will, And she comes from HR. She was previously HR director, but she brings a human element to the game, right? I have an individual that's worked for me for many years, and he was a trainer. He runs my Asia Pacific security organization, Tim Siner. I'll mention names. Jenna Hinson, the lady who's joined our North America HR organization. And then we've got other facets to that. Callan, Callan Webb. I met Callan at a friend's party introduced to this guy, and he has a— he had a really incredibly sharp mind. And he was formerly a Disney cast member, you know, the guys that put on suits and entertain everybody. And he went teaching English in Korea. He'd just come back to the United States. He was looking for a new career, new job, new opportunities. And he just mentioned that he'd actually gone out on his own back and gotten a certification in interview and interrogation techniques. Understanding people, reading body language. And I was like, I can absolutely use that, I can totally use that, I need to increase my skills. He— I took him on, and I took him on to kind of gain more insight. I say I took him on, we took him on, the organization took him on to gain more insight and gain more perspectives. And he ended up being one of the best investigators we've ever had. And brought an entirely new perspective to developing our security awareness training materials.

Yes.

Disney cast member, folks. Right. Let's just put that in context. How do you want to break into security? Disney cast member. Go explore the world. Come back. Bring your, bring your experiences to the table. And, and, and he's now, he's now working in cybersecurity, right? Never would have imagined that. He doesn't have an IT background, doesn't have a lot of deep technical knowledge. But there's always a human at every part of the cybersecurity kill chain. There's always a human from the best and first defense as the human firewall, all the way through to the instigator, all the way through to the guys that have to fix the problems at the end of the day, always a human. So you need that human perspective as much as you need an IT perspective.

That is so true, especially since the great majority of breaches now are done through social engineering these days.

And, uh, first way in.

Yes. Wow. That is quite fascinating. And I like what you said about diversity. When I first got into this field back then, for the most part, it was mostly white male that I saw. And since then, I think I've seen a lot of improvement, definitely more female in the cybersecurity field. And I think that is good. They definitely bring a different perspective, but I also feel like— Yes, it's just not enough. We need to add more diversity to cybersecurity security, and like you said, not just ethnic origin or male, female, and all of that, but also, you know, educational background, perspective, and all of that. But kind of what are the challenges in the 21st century? How can we really do this better? One way I have seen at my company now, because we are now 100% remote company because of the pandemic, so we are not limited to the very expensive market of Silicon Valley. Now we can hire people from pretty much, you know, all across America, and I think That does help to give us exposure to people who we would not have considered 2 years ago. What do you think about some other ways we may be able to do that?

No, I think you kind of hit the nail on the head. It's really about attracting people from all walks of life, all areas of talent. And we need to be more diverse as an industry. Like you said, I'm coming from a very untenable position. I'm in a leadership position and I am a— I am a white male, um, regardless of, of my, my, my inclusion in the LGBTQ community. Um, it, it doesn't matter. People, people look at me and they, they hear me and they see me talking, and, and here I am. I'm a, I'm a, I'm a white male. I'm coming from a position that is very untenable when I start speaking about diversity and inclusion. But you can't make a difference from the outside.

Yes.

And so you have to make a difference on the inside. That's why I have 60 people across my cybersecurity organization and security operations. I handle both physical and cyber. Um, so my security organization is about 60 people all around the globe. 33% of those are women. Um, and realistically there's, there's 46% of my entire organization. These are, these are numbers and statistics I'll throw out just to, just to give you a rough idea. Um, but almost half of my organization is, is minorities, ethnic or otherwise. We have significant representation across the LGBTQ community as well. And that's not just because, just because of my personal beliefs or standpoints, but it's something that you have to drive. It's something you have to push. We are no longer— I hire, I also hire a lot of ex-military veterans, and I'm a big supporter of the veteran community and ex-law enforcement. But it's no longer just an industry of white male ex-cops, ex, ex hitters out there in the world, right? It's not just— we're not just bringing that perspective to the table because that is an important perspective, but then spreading all of that out, bringing in all of those other pieces all around the globe, it's, it's critical. It's critical to our survival. We can't stay ahead of the threat actors. The threat actors are everywhere, so we, we can't stay ahead of them without really truly understanding the different facets of, of the world and bringing as many players to the game, as many viewpoints as we can to the table. Every opportunity I can, I'll shout that from the rooftops.

Absolutely, and I think you definitely have to do this by design because it's just not going to happen all by itself, which is great. Let's change gears.

Yeah, make a conscious effort.

Yes, let's change gears just a little bit. I think since last year, right, and this year too with the Colonial Pipeline, we've seen how something that happened in cyber actually has a physical impact, right, in our environment. Like last year in Germany, a woman died on her way to the hospital because of ransomware. So they, uh, that was I think the first time in the world that someone actually died, uh, indirectly because of a cyber attack. And then this year, people were paying $7, $10 a gallon because of the Colonial Pipeline ransomware. What do you think as an industry What can we do better to take care of what I call the ABCs of cybersecurity, to really ensure that we are at least doing the minimum what is required to keep our company safe and secure?

Wow, yeah, oh, that's a— I don't think we've got enough time, Bob. Look at it Look at it this way, cybersecurity is incredibly complex. Cyber, right? It's cyber everything now, right? Chris Roberts coined a hashtag which I loved called #CyberBloodyEverything, 'cause that's what it is. We are the department of everything and cyber covers so much now. It's too complex and that's the problem. When we look at defending against the next breach or defending against all of those pieces that are out there, we can't get ahead of the game unless we go all the way back to basics.

Yes.

Émile Coué, a French psychologist, the Beatles actually, he brought a lot of things to the Beatles if we put it into pop culture. And he said, simplify always. Do not complicate. That's how we get ahead of the cybersecurity game. We need to take a back-to-basics approach because goodness me, there's a gazillion— don't even know if that's a number— there's a gazillion different tools and technologies out there that are all incredibly complex and incredibly expensive. Everybody is trying to rebrand themselves into the MSSP, the managed security services provider, kind of remit. You would go out and you'd see a company that would that would have a particular technology that was very niche, did a really good job at what it did, but now they're trying to do a million and one other things as well. Companies are buying up other companies to build as much into their security portfolio as they can, to turn themselves into a one-stop shop, to give that fabled single pane of glass view into your, your security environment that will never exist. It is a unicorn. We're chasing unicorns, people. Um, So what we really need to do is, if you, if you're going to make a difference in cybersecurity as a leader or as a practitioner, focus on a back-to-basics approach, because really that's what's going to make the biggest difference. You've got to focus on the things that are going to matter to prevent a breach, because the prevention, right, an ounce of prevention is better than a cure. So are your basics in line before you start looking at getting incredibly complex with all these millions of technology pieces, which you do need? But are your basics in line?

Are you—

do you have an asset inventory? Do you know where your assets are, whether it be servers, endpoints, or people? Because now, virtual world, COVID-19, everybody working remotely, the perimeter is no longer your firewalls at the edge of your network. It's wherever your people are touching your infrastructure and touching your data. It's not work from home, it's work from anywhere. So do you know where your assets are? That's something that's becoming key because all of these cybersecurity breaches, ransomware, everything that's impacting our, our infrastructure, our lives all around the world is happening because you don't really have a handle on your assets. You can't adequately patch and fix the vulnerabilities which the bad guys are using to get into your network unless you know where your assets are that you've got to patch. Start with your asset inventory. Entry, right? And then patch, patch, patch, patch, patch. Close those vulnerabilities, close those loopholes, keep your stuff up to date. Patching, patching, patching. By the way, did I mention patching, right? And then everybody knows that the bad guys get in through social engineering. How do you social engineer your employees? Email. So what do you have in place for email security? How are you preventing the bad guys getting into your employees' inboxes? And then how are you training and educating your people to stop being your weakest link. And I hate it when security practitioners call people their weakest link. Humans are not the weakest link. Humans are our best and our first line of defense. That goes the same for intelligence warfare, and it's the same for our employees in our companies. Humans are what makes the difference. The Doors, Jim Morrison said, you know, they've got the guns, but we've got the numbers, right? It's the same thing for cybersecurity. And then, so we've now expanded out asset inventory, patching, and now we're on people, email, right? Security awareness training. Make sure people can recognize the threats when they come in. The threats are so sophisticated, they will always get past people. But you can't take a stick approach, you have to take a carrot approach. Be the security organization that cares. I, I'm a leader that I will have anybody pick up my phone and call me and say, holy crap, I just clicked on something. I would rather have that, and for me to then mobilize a response to that incident, than have somebody go, I can't tell anybody about this, maybe if I ignore it, it'll go away, because I know that if I tell somebody, I'm going to get yelled at, I'm going to have to sit through 3 hours of security training, and then HR is going to come knocking on my door, so I'll just stay quiet. Don't be that kind of security people. So identify your systems, patch your systems, secure your email, train your end users, right? Give them a way and means of authenticating, multi-factor authentication. Use your phones, use a token, use the text, but whatever it may be, it's better than nothing. That way, when you log in from Tampa at 9 AM in the morning and then all of a sudden you get a login from the middle of Africa or Russia from 2 o'clock in the afternoon, right? It's like, well, it's unlikely, right? That that's probably the same person. So let's just block it and pretend it never existed.

Absolutely.

And of course we can talk around, you know, technologies and I can throw as many acronyms out there as you like. EDR, SIEM, IAM, PAM, zero trust.

Yes.

Let's go back to basics.

No, that is fantastic. Yes. That's definitely where everybody should start. And for the most part, especially in the industry sometimes, right, the security budget is always quite limited. You have so much to do, but not enough people, resources, money, budgets to get it done. What has kind of worked for you to kind of get more budget out of senior management for your program?

4 words. I'm so glad the camera's up here because nobody could see me going, Like this. So, 4 words: security is everyone's responsibility.

Yes.

So I hope that's still forward. Yeah, so there you go. So that, that's really what drives it, right? Because again, simplify, simplify, simplify. Make— drive a security culture. Make security everyone's responsibility. It doesn't matter whether you're a receptionist, a janitor, a cleaner, an associate answering a call or answering an email, or an executive in the company, your chief legal officer, whoever it may be. Make security everybody's responsibility. Make everybody feel like they've got skin in the game to protect your revenues, your jobs, your environment, your people. But it doesn't know— it doesn't just mean at work. Give people the tools to secure themselves in their private lives. Talk about how they can secure their mobile banking. Talk about how they can help keep their kids safe and secure online when they're playing Call of Duty and exposed to the horrors of the internet. Right? But Bo Burnham, a comedian, he's got a Netflix special. The internet, he said, is like anything and everything all of the time. That's one of the songs he sings. And that resonated with me. It's like, teach people just how to be secure people.

Yes, right.

That's, that's, I guess, is the piece. That's how, that's how I've driven a security culture, right? And start those security conversations as far left in the lifecycle as you can. Make security the first thing you talk about, not the last thing you talk about. And I realize I'm coming at this from a Western perspective, left to right, but make it as early and as often as possible that you're talking about security, because security used to be the way you could prevent sales or restrict or limit business growth. Flip the script on that. Make it security as the business enabler. It's going to enable secure, scalable growth across the company because we're going to get in front of our clients and our customers and we're going to tell them how secure we are.

Yes.

By our people.

Wow. That's, that's, that's really interesting.

I'm going to get on my soapbox now, Bob. I'm a little bit too high.

That is fantastic. I think people are really I'm loving everything you are saying, and I think that is really the key, right? Impacting the culture. And I think security as an enabler of a business of being, like what I used to see when I first started, as a blocker for everything. No, no, can't do, can't do, being the department of no. But trying to find out, okay, how can we do it but do it securely? And, and, you know, because for almost every organization I've been to, security, IT, we don't bring in any money, right? Basically what we do is being a cost center. We cost so much money, but we don't bring in any revenue. I mean, sometimes we are in the way of engineering or sales that's actually trying to bring in money to the organization. So I think kind of from learning how to— I guess you do have to become a leader, right? Being able to influence people who may not directly—

We have to market ourselves better. We have to market ourselves better to our stakeholders in the company and also to the street, to our customers, to our clients. As a BPO, as a business process outsourcer, we secure 700 different brand names that you all know all around the world, whether it's your phone— and I discreetly covered up the label here— but whether it's your phone, whether it's your carrier, your bank, whether it's your console, whatever it may be, you know, even your insurance, your health, your diabetes testing, all this kind of stuff. Those are the clients that I service. So those are the customers and people that I interact with, which is all of you. Um, and so I'm building infrastructure and securing infrastructure that keeps your customer interaction and your data and your PII, PCI, PHI, all those acronyms, right? All that alphabet soup keeps all of that secure in that customer interaction. So why shouldn't that security be a selling point? Why shouldn't it drive more revenue and more business to the company's bottom line? It should. But we need to help educate our sales teams to be able to sell security. How can a sales guy pitch it to a client or a customer and say, you know, oh yeah, we're really secure? Oh really, how secure? Uh, we've got these, uh, we've got these, uh, EDR and, uh, and these Sims, we have plenty of Sims. Educate them, educate them to be able to talk eloquently about how secure you are, why you're secure, how you manage and maintain that security. Sell that security, make it something that's an offering, a differentiator. I think as leaders we can all do that, right? But again, it starts at the top. Drive that culture of security across your organization.

So well said, Stig. And As a cybersecurity executive, what keeps you awake at night?

The bad guys are going after everything, right? You said this earlier. I'm not a doom-and-gloom merchant. I'm not a Sandra Bullock, our brand is crisis, or I'm not trying to sell things by fear. That's not me. I'm generally an upbeat, positive kind of guy. What keeps me up at night? The bad guys are going after our comic books now. I'm a nerd. We got War Machine over in my corner here, and my friends refer to me as Iron Man. I have Iron Man Lego up in my office at home, right? I'm a nerd. The bad guys are going after our comics, right? A massive comic book provider was hit by ransomware the other day, okay? There is no discrimination. I wouldn't say it keeps me up at night. I do sleep pretty well knowing that I I've got a good team around me and I'm part of a good community that shares knowledge and shares, shares the things that we all need to do to be better openly. Share it freely, share it transparently. Your legal teams and your organizations will, will hate you for this when you start talking about it in this way, but we all need to share things transparently and honestly. We, um, we went through cybersecurity incidents, two cybersecurity incidents last year. It's in our SEC filings, there's no big secret here. But as part of that, we shared and communicated quickly, often, and more than anything else, we shared openly with our clients and our customers and our threat response teams in those organizations in partnership. In collaboration throughout the entire incident. We came out of those incidents with more business, not less, because our clients said to us that we handled the response better than some of our competition. And that's not me badmouthing my, my competition, our competition. That's, that's not the case. This is direct feedback from our clients, say, because we communicated transparently, we shared as much as we could when we knew it we had people dedicated to responding and we had people that were dedicated to working with our clients and nothing else. Mark McCulloch is an individual that, that worked for my team over here, and while we were responding and controlling the incident through our threat response teams, Mark was handling the communications with the client. He has an IT background, he has security background. His, his operations focus meant that he kept our clients up to date, kept them engaged working with, with incident response compatriots in the various companies all the way through the process. And so we came out of that in a good, a good position because in the world of customer service, you don't find out the true measure of an organization that you're working for, whether it be the phone that you've bought or the console that your kids play on or whatever it may be. You don't find out the true measure of a company until something goes wrong and you need support and you need help. And it's during those moments of crisis, look for the helpers, because a company that can respond well, that can show you that they stand up side by side, shoulder to shoulder with you in times of trouble, that's a company that you can rely on in the good times.

That's true. Yeah, I couldn't have said it any better, Stig. This is really great. I mean, We could be talking for probably another hour or two. We quickly running out of time and people in the comments, whenever you get a chance to see, they really are responding well to what you are saying. And I think we need to see that more and more as a security practice really across the board. So let me go quickly into the 7 questions. I really love to ask my 7 favorite questions. Number 1 being, what is the greatest lessons you have learned?

Find your inspiration in unlikely places. Figure out who you are, right? And when you've done that, you'll end up with a north star, as I call it, or a moral compass, right? And that'll be unique to you. And be one of the good guys. There's far too many bad guys out there, right? I'm quoting Peter Preacher. I'm back to the comic books now. But be a gentleman and do the right thing. I idolized my grandfather. He was an RAF logistics commander in the Air Force during World War II. He traveled to North Africa. He traveled to Bombay at the time. And nobody else in my family did that. And I idolized him and looked up to him. He was a gentleman. He was a true British gent. But then, you know, do the right thing, not because it's easy, right? But because it's right. And give back at every opportunity like this, right? I developed and taught cyber safety to kids and parents in schools and fixed computers for my neighbors and stuff like that. And in doing so, with my next-door neighbor, you know, teach a man to fish, I taught him how to fix computers while I was fixing his computer and, and cleaning an infection from it. And in turn, he taught me how to play guitar, which actually helped me recover from nerve damage. And to this day, you know, he's back in just outside Manchester in the UK, and, and, and he's, he's still fixing people's computers today. And, and, you know, it's, it's that, you know, giving back, educating, empowering people. Winston Churchill, um, maybe a controversial figure now, but, but he said, you know, we make a living by what we get, right? But we make a life by what we give. And that's, that's what, that's what I feel like.

Wow, this is quite awesome. And what is, you think, the secret of your success?

Am I allowed? I'm a Scottish guy, right? So am I allowed to swear on this podcast? I'm gonna offend people because this is a quote, right? So it's— and I'm gonna try not to offend too many people, but 1988, there was a documentary, a rockumentary if you will, called The Metal Years, and it had Ozzy Osbourne in it. I'm giving you figures that you can all recognize. Ozzy Osbourne. Ozzy Osbourne said this, just remember one thing, you meet a lot of people on the way up, don't fuck them because you meet them on the way down as well. And I was a kid at the time when I heard Ozzy Osbourne say this, right? And he's not necessarily somebody that you should be idolizing or anything else, but when I heard him say that, As a kid, bear in mind, that stuck with me so much so that when you told me about what we'd be talking about here today and the kinds of questions, I went all the way back and that's the first thing that stood out in my mind, right? So you've got to do everything we said, bringing all those players to the game, bringing all those talents together. The secret of my success is, as I've progressed in my career and I've climbed the ladder, the corporate ladder, um, I've tried to build those relationships, put that emotional capital in the bank, because one day you might need to make a withdrawal and you're gonna need those relationships. So be good. Bill and Ted, Bill and Ted, right? Again, pop culture references. Bill and Ted, be excellent to one another. Yes, that's, that's what— that's all you can do going up the chain. And quote Ozzy Osbourne, Don't screw people over because you're going to need them. Everybody at every walk of life, even HR departments.

Yes, absolutely. And I really feel like as a cybersecurity leader, not only, you know, I guess it's a given you have AI IQ, you're pretty intelligent, but I feel like even here in Silicon Valley, what we are really missing is emotional intelligence, being able to empathize with people.

Yes, they're what we should be putting on those job descriptions. That's what we should be saying is a requirement for getting into the industry.

Definitely agree with you there. Okay, question number 2. Oh my goodness, I'm gonna need to have you back. This is, this is great. We're having too much fun here. What are you learning now?

So I noticed you've been, you've got a connection with the University of Maryland and the Harvard Business School. So I, I have a degree in Homeland Security, through St. Leo University here in Florida, which is, uh, very much a military community university. Um, and it led me to study UMD's, um, START program, the Study of Terrorism, Responses to Terrorism. Um, and, and that, that was phenomenal. Um, and I, I worked with Bill Braniff over at START and he's, he's an incredible thought leader. Um, and again, driven by that need to, to give back, driven by that need to make a difference. Um, so Harvard Business School has just gone into partnership with a, a an industry disrupting organization called the Power MBA. It's now the Power Business School. We just broke a world record last week for the, for the world's largest cheer, 2,500 people live in person through Zoom, you name it, all the way around the world saying cheers for the—

wow—

as an industry disruptor. So I'm going through that MBA program now. Don't stop learning. I'm a cybersecurity professional. But we need to be less security people and more business people. So I took it upon myself to, to go out and seek, uh, an MBA, but I had to squeeze that in with my work and my job, um, just like I did with the degree that I got, the— in, in home security. You've got to squeeze everything in. It's hard. You're balancing all your time and you're juggling all your time, and that's, that's a challenge. But don't stop. Don't stop learning at all. And I'm learning how to rebrand myself through a wonderful lady that I found online, another thought leader called Donna Sergioula. And I'll happily throw all the links to you so you can circulate them.

Absolutely.

But again, learning how to rebrand is something new for me, certainly. I'm not a sales guy.

Wow, that is really, really, really great. Actually, I always even tell my kids, one skill you need to learn is to become a salesperson. Person, being able to sell, no matter what you do in life, especially yourself. I think we are actually out of time, but if we can just go a little bit over, Stitch, please.

That's fine with me. My time is yours, Bob.

It's all good. I think this is going to be the longest podcast ever, but you've said so much and you still have so much to say. I need to bring you back. Okay. Question number 3: How has failure shaped your life?

Ah, see, the tough one. I was hoping we could avoid this. Yeah, I took it right to the wire, but here we are. Yeah, we don't learn from our successes, we learn from our mistakes, right? So I said I've got a degree. I have a Bachelor of Arts in Homeland Security and Criminology, Criminal Justice. But I initially went for a degree right from college in computer science. I went to Heriot-Watt University, a prominent engineering university in Scotland. And I didn't stick with it. Um, after, after a year or so, A, I needed money, uh, but B, it was incredibly challenging for me because it's all about programming development, uh, and I, I, I was really hands-on. I'm a hands-on learner, and I didn't get to touch a computer for 8 months of that first year of that degree, and it drove me crazy. And I didn't stick with it. I actually got my degree, my degree in criminology, because it was was something I was passionate about. I actually got that in 2017.

Wow.

So that was the first degree I got, not the second. And so that was my biggest failure. I gave up on that degree. I wish I'd stuck with it. George Santayana, Jorge Santayana, said, you know, he's the first person that coined the phrase, those who cannot remember the past are condemned to repeat it. I was determined I would not make that mistake again.. And I went out and I got myself a degree. I studied it part-time while I was working, but, uh, but it would have been so much easier if I'd have done it when I could have done it full-time when I was younger.

Yes.

Because juggling a degree and a career is, is, is a challenge. Um, so that's, that's one of the failures that shaped my life. Another one is in 1998, I interviewed for a job. I'd set up a consultancy organization. I became one of Scotland's first Microsoft Gold Certified Partners as a consultancy organization I built. And my former boss, a gentleman called David Skinner, he interviewed me for the job I had. It was the most challenging interview I'd ever had. And the recruitment agency that put me forward for that interview said to me, whatever you do, just be honest. We've put so many candidates in front of this guy and he's just, he's turned them all away. He's destroyed them. Just, you're our last best hope, Obi-Wan Kenobi. Please just, just be honest. So I went into there and I am an honest individual. I don't fib. And I sat down with Dave and he gave me the hardest interview of my life and it lasted for 6 hours.

Wow.

That sounds unreasonable. It's because after the first 30 minutes of that interview, he took me out, he took me right into the team and he said, here you go, sit down at this computer, listen to this guy, work with him. I didn't know. I thought that was still part of the interview process because, you know, I was terrified at that point. It wasn't. He'd wanted to hire me right there and then. He put me to work. So I call it a 6-hour interview, but that was it. However, when I, when I then went into consultancy, David had established the first office, Microsoft Scotland, in Edinburgh. David actually went working for Microsoft. He was so sharp, and that's another story. And I went to interview with Microsoft. Now I was a Microsoft partner, a consulting organization doing Microsoft work, so I thought I knew everything. I was way overconfident. I went to interview with David, David and this panel of Microsoft experts, and he was one of the sharpest minds I've ever known. And he asked me a question, and that whole, that mantra I have, simplify always, do not complicate. I talked way past the sale. I answered the question in the first sentence out my mouth, but I didn't see a reaction on their faces, so I just kept talking. Thinking, I'll get to it eventually, I'm going to get this answer. And I talked right away past my sale and talked myself out of my answer. So the failure there, I didn't get the job, which, you know, worked out for me eventually. But the failure lesson there was don't talk past the sale. So my first failure lesson I want to impart is don't wait too long to learn and don't talk past the sale. Keep it simple.

Wow, was that great, great lesson.

Thank you.

Number 4, who do you know? We should know who are your mentors, thought leaders you are following. You already mentioned quite a few.

Oh, well, if there's, if there's people still here at this point, it's not just you and I just talking. Um, one of the people that's made the biggest difference to me in my, in my leadership career, um, is a gentleman called Joe Carella. Again, I'll circulate all this information to you and I'll provide you all these links. Um, Joe is the sports psychology consultant, um, for the Tampa Bay Buccaneers football team. Super Bowl winners, Tampa Bay over here, and the Orlando Magic NBA basketball team. And Joe is— again, why would a cybersecurity leader seek out a mentor who is a sports psychology consultant? And Joe came to me through Eckerd College's leadership program. It was such an accident of fate, but he taught me— I am hard of hearing. I only have 50% hearing, which is why I only have one, one thing in my ear. But he taught me how to listen, and he taught me how to listen from a boardroom perspective. I've had my time on the stage and I've entertained people. I used to do a little bit of stand-up comedy back in the day, but he taught me how to really help through listening and not necessarily performing. And by redirecting, being the guy behind the spotlight, shining that spotlight on other people and amplifying their message and listening more actively. And I've tried to build an ecosystem of listening across my team because of that. Joe has made the most single significant impact to my entire career, hands down, compared to anybody. So that's, that's part one, but I want to I want to bring up a lady called, uh, Noreen Ngorje. She is the Director of Global Cybersecurity Threat Intelligence at Nike. She also handles a monthly global cybersecurity mentoring session where she brings people from all over the world into this group. Anybody can join and you can gain so many insights into that.

And she's also a member of the United States Security Alliance, just like you. Right? That's pretty cool.

And there's also organizations like the Women in Cybersecurity, WICYs, and the Diana Initiative. I'm a massive fan of the Diana Initiative. I thought about wearing their t-shirt today just to show people, which helps underrepresented genders, sexualities, and races get into information security. So those are the people that I'd amplify. I can't speak highly enough of Joe, but Noreen is doing incredible groundbreaking work across community just like yourself.

That is pretty, pretty amazing. Yeah, we definitely need to get all of those links and have people follow them, please. Thank you. And number 5, what have you read that we should read? What's one of the best books you've read recently?

All right, a two-part question. I'm sure you've read the first one. It's called Make Your Bed by Admiral William McRaven, retired US Navy.

I haven't worked for him, but my former CEO did, and she's Completely crazy about him. The best, best leader she's ever worked for. Yes.

Right. And it's just a little book. Um, and it's based off a keynote speech that he gave at a university. Um, and, uh, and it, the, the takeaway from this, it's called Make Your Bed for a reason. Uh, and it's something that, that I've, I've, I've been very, very proud of is when you get up in the morning, make your bed. Why? Because that's, that's the first task of the day.. And if you can accomplish that first task of the day in making your bed, you'll have a sense of pride and encouragement, and you knock out another task after that, and then another and another, because the little things matter. And if you do them right, then you'll do bigger things right. So William McRaven, Admiral McRaven's Make Your Bed, little tiny book. I'd encourage everybody to get it. It was given to me by my last boss. I hadn't heard the speech, but I've heard the speech. It's incredibly empowering. Go look it up on YouTube. And find that book. And then the, the other book I— most recent book I've read was recommended to me by, by an executive recruiter that I met through another cybersecurity contact. And, and Jamie Cummings recommended that I read a book called Rites of Passage. It's an insider's guide to executive job and career progress. It was actually last published in 2014, which seems like a dog's age ago now. And the author, John Luked, he passed away in 2015, but before he passed away, he revised his book, made it as current as he possibly could before he passed on. And what that book taught me is understanding your value and your self-worth, being able to articulate your career achievements, focusing on people engagement to get to the next level, and not to underestimate the power of connections. And it may seem dated now to anyone who reads it, but if you read it with an open mind, you can take so many things away. A British comedian called Dame Joyce Grenfell— we're now going back into the 1930s and '40s now— but Joyce had this expression. She said, "My dears, we haven't touched upon the sordid topic of coin." And we haven't throughout this whole conversation, right? But that book, Rites of Passage, addressed the most important question you'll ever be asked in an interview. And it's the question that everybody hates, which is, what's your salary? What's your expectations? And that book teaches you how to answer that question more than anything else. I'm not going to give anybody any spoilers, but it teaches— because it's the question that everybody hates answering. What salary do you have? What's your salary expectations of the job you want? And people will undersell themselves or they'll avoid the question. But you need to be able to answer the question, otherwise the employer doesn't know if they can afford you. And if they don't know if they can afford you, they won't interview you because you'll be wasting the time of the hiring manager. And that book teaches you how to frame your salary expectations in a set of bookends that will appeal to any interviewer or employer. Rites of Passage, worthwhile book.

That is fantastic. Thank you so much. Number 6: What have you done that we should do? What is one action you've taken? That has positively impacted your life?

Okay, I'm going to go back to Churchill again. So what have I done that you should do? Bob, I think you've led a more full life than me. I think I should be asking you that question. Be honest, right? What have I done? What should other people do? Be honest, but be honest without compromise. Don't compromise your honesty and your integrity. Act based on facts. That rhymes. Now, I didn't realize that. Act based on facts, um, not opinion, um, because the data will speak for itself. And if you're coming from a position of fact and a position of data, and you're holding true to your North Star and your honesty and integrity, then that will serve you well at every point in your life, not just your career. Winston Churchill said, a lie gets halfway around the world before the truth has a chance to get its pants on. And I firmly agree with that. Be honest. Be honest with yourself. Be honest with those around you. And then never stop seeking out new experiences like this one, Bob. I mean, I'm so grateful that we had this chance through Forbes to meet and interact and become, I hope, fast friends. But find people to join your teams. Find coaches and mentors that can help you and empower you. And try and avoid echo chambers. Don't meet with people because you think they share the same opinion as you. Meet with people because you think they share a different opinion and listen. He says, pointing to his deaf ear, listen, right?

No, that is, that is so great. Everything you've talked about, really, you can apply in cybersecurity, but in life in general. Thank you, thanks so much. You've been so generous. Very, very last question. We already went like 11 minutes over, but, uh, what can we do for you? How can we add value? To you?

Um, I admire anybody that's still here. We all have very busy, very packed schedules. Um, the best way to add value is keep shining a light on the darkness. Um, keep shining a light on the challenges that we all face, how we can all learn from what other people have learned, right? There's always a new lesson, right? Shine a light on the darkness because the darkness can't understand the light. So keep shining the light on these, these new perspectives and these, these new opinions and these, these new challenges that the questions you ask. I loved them because it challenged me to think about how I was going to answer them. And that I thought was great, right? I do, I do the occasional interview and the occasional speaking and stuff like this. But these questions, the way you framed them, it challenged me to think, well, that— how does that apply? How can I make that resonate with, with other people? Because it's something that's quite personal to you. And I think the more you do this, and the more we can do this as a community— ask those challenging, difficult questions and be honest and keep your, your integrity and your North Star. I am shamelessly a nerd, and I am— I'm not a, you know, I'm not the 800-pound hulking gorilla in the room that you expect out of a lot of security professionals, but I'm uncompromisingly me. And if that appeals to you and if that works for you, then great, we'll become friends. And if not, then, well, how can I help and how can I frame the conversation differently?

That is fantastic. Shine the light in the darkness. Thank you. Thank you so much, Stig. I am so, so thankful you took the time. I know you're super, super busy, global CISO, member of FTC, and here you are in the flesh and giving us a lot of wisdom. I really, really appreciate it. I think Also, by the way, this is gonna be the longest podcast to date. I think this is number 14 or 15.

So not necessarily a record anybody wants, but yeah, there we go. Bob, it's been my pleasure and I'm, I'm here to help. People can hit me up on LinkedIn. We can, we can connect, we can talk, we can have these conversations and I'll be happy to come back. You throw some more difficult questions.

Definitely very, very passionate about cybersecurity and you're definitely advancing our profession. Thank you again. I really appreciate it.

Not at all. Thanks, Bob.

Thanks, everyone.

Thank you for listening to the Leadership and Success Podcast with your host, Coach BZ. If you like what you heard, please subscribe to our channels and come back for more wisdom nuggets on how you may develop into a better leader and achieve greater levels of success. Leadership is the most critical skill. The world will always need leaders to lead others, deploy the next disruptive technology or execute a business strategy. You may as well decide on counting yourself among the 21st century leaders. See you right here next time on the Leadership and Success Podcast with Coach BZ.