Episode 26: Cybersecurity Communication and Leadership

Welcome to the Leadership and Success Podcast with your host, Coach BZ. If you need to develop into a better leader, this podcast is for you. If you want to achieve a greater level of success, this podcast is for you. His mentor, Dr. John C. Maxwell, said it best: everything rises and falls on leadership. We hope to inspire you today and provide you with an insight that has the potential to positively impact the trajectory of your life. Welcome to the Leadership and Success Podcast.

Welcome to The New Cyber Frontier, bringing you the latest news and initiatives that focus on the development of cybersecurity economics. You don't have to be a computer or cybersecurity expert to get plugged in. Your host brings it straightforward, asks the tough questions, and brings the cyber world to a level of understanding for everyone. You can find us on the web at www.newcyberfrontier.com. Now join our host as he introduces the topic for today's New Cyber Frontier.

Hello everyone, welcome back to another edition of the New Cyber Frontier. Today I have a special guest all the way from San Francisco. Bob Zinga is the director of information security at Directly, and he's also an information warfare officer for the US Navy Reserve. Welcome, Bob.

Hi, I am very glad to be here, Sean. Thank you.

Excellent. Well, welcome to the show. We're glad you're contributing. Uh, would love to see, uh, you know, what, what's going on with you over at Directly. Um, we, we hear some great things from out of the AI, uh, some machine learning. Hopefully you can shed some light on that. And then, um, like to hit, uh, some of the, the stuff you're doing with the U.S. Navy, uh, especially for information warfare, uh, as it continues to evolve. But, you know, Why don't you give us a little bit about your background? Where are you from and what are you doing today?

Yeah, so like you say, so I'm a cybersecurity executive here in Silicon Valley, the head of information security at Directly, and information warfare officer in the US Navy Reserve. So I've got about 20+ years or so experience working in complex IT environment. And since 2005, I've been working full-time to establish, lead, and manage cybersecurity programs within higher education, state, federal government, Department of Defense, and since 2014, the tech industry here in Silicon Valley. And also, very recently, I became an official member of the Forbes Technology Council, which is pretty cool.

Yeah, that's a great accolade to have. So, with your background in information Security, we rebranded it now, it's called cybersecurity, right? So us old war dogs who have been around for a while, it's still about protecting information, right? Physical security.

Yeah, I remember it as information assurance actually in the Navy, but yeah. Back in the day, right?

The Rainbow Series, the Orange Book, you know, and then TCSEC and then DITSCAP and then DIACAP. Yeah, bringing back old memories or maybe nightmares, I don't know. Back up your dump truck and let's load all the paperwork in there.

That's right.

Yeah, but so, I mean, you've been around for quite a while. You've seen the evolution of technology, the evolution of security as a discipline in information technology, and we're at a point now where they are separate disciplines, right? So you have to deliver capabilities, and then you also have to protect the capabilities that you deliver for everyone. 80% of our business processes are automated in any given industry. So how do we protect the user? How do we protect the information? Why don't you tell us what your role is over at Directly as the Director of Information Security? What do you do on a day-to-day basis? What does your program and your portfolio look like?

Basically, I head the cybersecurity function. I am the highest-ranked executive at Directly for cybersecurity, currently reporting to the general counsel. I pretty much manage the entire cybersecurity program, the entire spectrum. At Directly, we are an emerging leader in customer experience automation. That's what we do. We help companies deliver better customer service at scale while creating an economic opportunity for people in artificial intelligence, AI. So I think one big differentiator between us and our competition is we don't just use artificial intelligence and machine learning, but in addition to that, we also add human experts. So we use human beings who are experts in their field to actually teach the AI to be smarter. So that's— I think that's one competitive advantage we have.

Excellent. So when we look at your portfolio, for example, those things that you're responsible for on a day-to-day basis, is that directly with the product? Is that with your business, with the users, working with other business unit managers as well?

Yes, it's pretty much all of the above. So I direct a cross-functional team, and one of my priorities is to help enable sales, right? We have this great software, we have a lot of clients, Microsoft is one of them, and we want to make sure that trust is preeminent in everything we do, right? Privacy and Security, making sure all of the controls are in place to protect the information no matter where it might be, information we care about or our customers care about. I work with our vendor management team, with engineering, all of our developers, making sure that the code we are developing is really secure from the get-go. I've been working with engineering-centric organizations since 2014 when I moved to Silicon Valley. It was a pretty tough transition going from working for the government to working for a corporation. They don't take security as— maybe not the same way. Let me just put it that way. In the Navy, we don't do security, people die. In Silicon Valley, The worst that can happen, they just lose money and then they make some more. Priorities are not exactly the same. It took me a while, but I kind of learned to conform and work within an infrastructure where security may not be the number one priority, maybe not even the second priority for the organization, but working across the entire organization with all of the business leaders in order to ensure that everything we are doing, we are doing it in a safe and secure way. I really feel like, as the head of security, I am not just a technologist, right? I think that is important. You need to be technical, but more importantly, I think you need to have soft skills, be able to work with people, and just use all of the leadership training I've learned in the Navy, put them to good use. I think understanding the business of the organization and then being able to lead people into doing the right thing for the company is really, really key in being successful here.

Yeah, as an executive, that is a key point. To be successful as a security leader within your organization, you need to understand the business and you need to have great social skills. Excuse me, that kind of snuck up on me there. So to be able to understand the business, to be able to have a great relationship with all of the other business unit leaders, communicate In the language of business, to your point, it's not the same language or culture that we have in the military that we do on the business side. We communicate in risk on the business side, right? We talk about how things that key decision makers on the board or business unit managers, we present them with courses of action based on risk decisions. We're gonna come right back with Bob Fabien Zinga. He's the director of the information security at Directly. Also an information warfare officer for US Navy Reserve. Right after this, right after this short announcement.

Cyber Resilience Institute helps build strong cyber communities designed to prevent members from attack. Like building a neighborhood watch, it takes coordination and a sharing community to protect our identities and valuables in the virtual world. Typically, we hear that organizations Many organizations know they need to do something to protect their cyber assets, but don't know where to begin. Let Cyber Resilience Institute help your community create an action plan. Cyber Resilience Institute will build your community or business marketplace so that it is designed to support a collective cyber defense. Contact them for more information at cyberresilienceinstitute.org.

Welcome back to The New Cyber Frontier. My name is Shawn Murray. We have a special guest today all the way out from San Francisco, Bob Zinga, Director of Information Security at Directly, Information Warfare Officer, US Navy Reserve as well. So Bob, we were talking about, you know, the importance of understanding the customer, right? Understanding your audience. Different cultures between, you know, the military, the government side, and then in corporate. Back on the business side, so we needed to articulate things in language of business, like risk. What is it going to cost? What is it going to cost if I'm non-compliant? In a lot of instances, depending on where you're placed as a CISO, or executive for information security, in the organization, will make it either challenging or less challenging to be able to communicate. You said, I think you report directly to legal and compliance in your organization. How has that placement helped you be successful for Directly?

Well, I think that is a good place to be. Now, in the military, most CISOs would report to the CIO, and many organizations in Silicon Valley do. Actually, prior to reporting to legal, I used to report to the VP of engineering. I don't know. I feel like security needs to report to the most senior executive in the organization that cares the most about security. I think that's how you become successful. So kind of like in the Navy, they can kind of COVID you and making sure that your priorities become the priority of senior management and the board. Otherwise, it's just a lot of yapping and making a lot of noise, but really not getting anything done. So, directly, I am very, very lucky that a lot of the members at the senior leadership level really, really get security. And some of them, they kind of add to, right? Because when you have a huge customer like Microsoft who really cares a whole bunch about security, they kind of make you want to care about security and privacy too. And especially if you get some type of data breach incident or whatever, you kind of learn from that. It is great to really be in an organization where senior management really sees the point because I've worked for some organizations before where they only really paid lip service to security. But when you look at the budget, there is no love there. I really feel personally, I feel like it's almost like a waste of time to have a security program when you don't really have the support from senior management because then it's not really sure what you are doing and you won't be able to accomplish much.

So, go ahead. Yeah, and so when we talk about— there's a little bit of delay there. When we go back and we have those conversations, and it's supported at the board level, back to your point, now you have a sound culture that can be expressed throughout the rest of the organization as well. So the rest of the employees, the lower managers and the employees, if they see it being demonstrated and cared for and cultivated at the senior level, then it makes your job easier as well. You think so?

Yes, absolutely. So I think senior management support is really, really critical. Critical, but in addition to that, one thing I've learned in the Navy is just leadership skills, being able to lead people. You may be able to influence your peers and even people who report to you or who are more junior to you within the organization to really take security more personally, kind of raise the awareness of security across the entire organization. As an example, we started last year. I started working at Dworkin. I think it was March of last year. 2019 came, it was National Cybersecurity Awareness Month. So I took that as a huge opportunity to really raise the level of security across the entire organization. We had all types of presentations every single week. And then I also worked with a lot of the vendors we had to give me a bunch of swag and things to give away, just make it very exciting, putting posters everywhere in the building and really getting people engaged, right? From the lowest level worker all the way up to the members of the board so they could see security everywhere. They are turning and giving away— I think, at the end, we gave away $500 Amazon gift cards. I didn't have the budget for that, but I was able to steal money from many of the department heads at the company. It really made it a lot of fun. I think, in the long run, things like that kind of help move the entire organization into the right direction.

Yeah. In some organizations, it might be a strategy that a portion of the CISO's budget actually comes from the other business units. Such as in your case. If you think of all your technology purchases, your information asset owners, your information owners, I mean, that is the relationship really between you and the business is through the business unit leaders. And sometimes we carve out things from their budgets. Let's go over to the Navy side. So what is your role as an information warfare officer for the US Naval Reserve?

So right now I am the executive officer for an information warfare unit here in Kampac. So pretty much we do cyber intel. Most, most of the officers under me are all intel. I'm the only information professional officer. So, but 38 people also report to me and our headquarters is in Hawaii, so we always go to Pearl Harbor for all of our annual training, which is nice. But most of the time we don't get to really see Hawaii because we are working on different type of shift, and it is, it is a lot, a lot of work including weekends. But, but yeah, it is, it is a, a great thing. Uh, I don't really know how to explain this. It's, it is really something when you work as a unit and you do something that is not just important for the unit but really for the Navy. And many times national security as well. Just thinking about me, I am originally from the Congo. I became a US citizen in 2006. Just thinking that I have a portion to play into the national security of the most powerful country in the world, that's really mind-boggling. And then many times when I come off my active duty time and I go back to a company like Druckly where I'm just the head of information security, it's like, why am I doing this? There is no comparison, right? Uh, Navarre may not pay us as well as industry does, but, but the commitment and, uh, really the impact you, you, you have, I feel like there's just nothing like it on Earth. It's very, very difficult to—

very different culture as well, right? So, uh, there's a chain of command, there's a line of command, an instant level of respect, usually based on experience, of course based on rank, uh, and then those contributions. Um, anybody working on the military having to do with information warfare, information security intelligence. It's pretty significant today. The contributions in those areas will help us in the evolving threats, nation-state actors and organized crime that as it continues to evolve, so do the attack vectors, you know, the skill sets of the adversary as well. And so those contributions, Did you, I was curious, did you or any of your sailors go to school down in Pensacola at the schoolhouse down there?

I actually did. I think it was back in 2008. That's where I went for my AP basic course. I spent like an entire month there. It was very nice. But yeah, one thing I really like about what I do for the Navy as a reservist and what I do as a civilian is There is so much overlap, right? Because I'm pretty much doing information security for both. So I kind of see the best of both worlds and what I learned in the Navy, I can— some of it I can apply to my civilian job and vice versa. So it's really been very rewarding for me.

That's great. Well, we're speaking with Bob Fabien Zinga. He is the Director of Information Security at Directly based out of San Francisco. He's also an information warfare officer for the US Navy Reserve. We're going to come back and finish things up with our discussion with Bob right after this message. Welcome back to The New Cyber Frontier. My name is Shawn Murray. We're speaking with Bob Fabien Zinga, who is the Director of Information Security at Directly. He's also an information warfare officer with the U.S. Navy Reserve. So, you know, we've been talking about the various roles, the two different hats you wear, you know, one with the Navy and and then one with the commercial sector with your role at Directly and the culture and the similarities, the differences. I'd like to focus now back on the commercial side. Directly, you guys do contributions related to artificial intelligence, machine learning. Why don't you tell us a little bit about the products and some of the things that you're doing over there at Directly?

Basically, we have an application which we sell to our customers to really help them deliver better customer service at scale. That is really the bottom line, what we do. Many, many of our customers have had some issues handling and managing customer support with all of their end users, and we come in with our platform and pretty much take that problem completely away. And like I said earlier, in addition to the machine learning and artificial intelligence platform, we also have human beings, experts, we call them experts, who actually know the product and the services of our customer inside out. And then they help answer those questions at first and they help our artificial intelligence get— our bot get much, much smarter on the answer. And eventually it really helps everybody out, our customer and of course of course, our experts, also allowing them to participate in this gig economy. There are some people we have now who make more than a 6-figure income just doing this type of thing. It is really, really great to see how much of an impact a small or medium business could have across the world because it's all done online. We could have experts not just in the US but really all around. Vorong.

That's great. So one of the things that I heard you describe earlier was the software assurance aspect of product development. One of the things that you oversee is the engineering and the software development of your products. And so, as you know, especially on the government side and the military side, supply chain risk management, right? Yes. Making sure that we develop security into our program, our products to include software. If we think that number one most, you know, threat to any information system is the human, right? Number two, I have always advocated for decades, even before anybody admitted it, was software. Well, number one, software is developed by humans, right? So you've got an inherited threat. Tyler, talk to us a little bit about the software assurance, the oversight that you have on the products. That you guys develop?

Really, for me, that started when I first moved to San Francisco in 2014. Prior to that, working with the Navy and the US Army too. It takes us forever in the government to come up with, to deploy new software. And of course, security has always been paramount. That's definitely not the case in Silicon Valley. I got to learn how to really work with engineering. Most startups here in Silicon Valley, they're all engineering-centric. They want to publish code. They want to be first to market. They usually have a sprint cycle of 2 weeks or so where every 2 weeks they publish new code and they use the agile method methodology which I had to learn. I used to pretty much specialize in waterfall when I was doing work for the government. Even the government now, I understand we are changing a little bit. But anyway, going back to an engineering-centric organization, I learned that it's extremely important for security to be seen as a partner to engineering, right? Because the very, very first gig I had in Silicon Valley, the Engineering departments saw security as the department of no. They saw security as an obstacle. You are basically preventing me from doing my job. That took a while to change. Anyway, all of the lessons I learned there, I apply them everywhere I go now. Basically, security has to partner with engineering. Again, unlike the government where the information assurance manager says jump, everybody says how high, in Silicon Valley, when you say jump, they completely ignore you. Like you don't even exist. So that's where, again, I mentioned earlier, you really need to develop personal skills, soft skills. You need to be able to communicate and lead, right? And really have some type of relationship with those engineers. And in Silicon Valley, most engineers are kind of— joke sometimes, but we call them sometimes snowflakes, right? They're very, very tender, geniuses, and so forth. But yeah, they are important, but sometimes you really need to round the troop and kind of look at the big picture. What is the mission? What are we trying to do as a company? And how can security be of service? How can I help you do your job more securely? I think that is extremely important, but one of the first things I have done since moving to Silicon Valley is to first I guess, take care of the easy things that we can do quickly to actually get results, right? And some of it is, what can security do after the code has been published? I think you kind of have to start there. The code has been deployed to production, what can we do? I believe for an engineering-centric organization, it's extremely important, at least at first, to really have a great red team program, like adding pen test, bug bounty program, and things like that to really test the code as much as you can, as often as you can, to find those vulnerabilities, especially anything medium, high, or critical, and then kind of prioritize them into the sprint cycle for remediation. So, that is really, really great. I think you kind of have to start there. But then, with time, another thing we've done at Directly is to also increase the security knowledge of our developers, right? So at least once a year, they have to take application security training in the language that they use, whether it's Java, Python, or whatever. This way, it's going to ensure in the long term that they don't keep making the same mistakes and having the same vulnerability over and over again. Somebody just told me a couple of weeks ago, everybody knows about the blue screen of death with Microsoft. Suppose there's one engineer that kept making the same mistake over and over again, and they kept redeploying this code everywhere. But anyway, so I think Training the development team about how to securely develop code and also follow at least the top 10, top 20 OWASP vulnerabilities, trying to avoid those, I think this is huge. And then with time, this is kind of where we are with Doctly now. I'm trying to kind of shift securely left, bringing security closer to the developer. Pretty much in a DevOps cycle, really get the developer, as soon as they deploy the code, before the code is even merged into our central repository, for the developer himself or herself to actually scan it, find out whatever vulnerability might be, fix them, and then once he passes or she passes the test, then the code will be incorporated into our main branch. So, that's kind of what I am planning for next year, bringing security closer and closer to the developer. In Vanidi, we already say we don't We don't want security to be added on but to be baked in. It's really affecting the culture of the entire organization, of the engineering team for sure, and really working with people, human beings, and trying to lead and help all of us move into the right direction.

Those are great tactics. Of building it in, the culture of building security in. I mean, now we're talking about developers, not just business unit leaders. And the security culture has to be administered and coddled at all levels to include the systems designers, software developers, IT personnel, sysadmins, netadmins, DBAs, right? So it's a great concept. When you can realize the benefits of socializing your soft skills, changing the culture at all levels of the organization. Bob, you know, I can't believe we've come to the end of our segment. Lots of great discussions here about the commercial side, the military side, or the government side, and extensive background that you've got. What parting words would you have for our audience today before we end the session?

Well, I think one thing I'd like to say specifically to those who are in the cybersecurity profession, technical skills is definitely extremely important, and many times when you get started, that's really what you need to focus on. But one thing I've learned since moving to Silicon Valley, it's really, really, really important to be aligned to the business of your organization. In the Navy, sometimes it seems like we have unlimited funding. We pretty much get whatever we need. It is national security after all. But in a business, there really needs to be a reason for a business to spend a penny. And whenever they spend money, they need to get a return on that. So learning the language of business, learning to position security as a risk area, the same way the board of any organization looks at financial risk and all of the other business risks,, they should consider security risk as well. And that's part of the reason why I decided when I moved here to earn an MBA, right? Just so that I would really get into the mindset of a business person. So I feel like, yeah, security, having technical skills is great, understanding the technology is really cool, but as a security expert, many times I feel like, it's almost as if I'm doing two jobs. One, I have to understand the technology itself as good or even better than the people who actually manage it. And then second, I need to be able to align the security controls on top of the technology to ensure the confidentiality, integrity, and availability of the data no matter where it is. The last thing is it's really, really important, especially when you come from a military background, not to be too rigid. In the Navy, we say, "Semper Gumby." You really, really have to be flexible. You have to align to the organization, to the culture, and to the strategic objective of the organization. The organization needs to see security as a partner and as not just a cost center costing so much money, but someone who actually sits at the table and adds value, helps the organization do whatever it is the priority of the organization is.

That's outstanding. Great contributions from Bob Fabien Zinga, Director of Information Security at Directly, also an Information Warfare Officer in the U.S. Navy Reserve out there in San Francisco. Bob, really appreciate your contributions to our program, and we wish you a great afternoon.

We hope you have enjoyed this episode of New Cyber Frontier. Remember to get involved Often we think that someone else will handle privacy and security in the virtual world, but you are the only one truly in command of your virtual fate. Join our mailing list so we can keep you informed of breaking news and new releases. If you have an idea, if you have a question that you would like to hear answered, or if you want to get involved with our efforts, reach out to us at newcyberfrontier.com. We also encourage encourage you to visit our sponsors' links, as they are the ones that really make this show possible. I want to thank each of you for supporting the show, and we look forward to seeing you back for the next episode of New Cyber Frontier.

Thank you for listening to the Leadership and Success Podcast with your host, Coach BZ. If you like what you heard, please subscribe to our channels and come back for more wisdom nuggets on how you may develop into a better leader and achieve greater levels of success. Leadership is the most critical skill. The world will always need leaders to lead others, deploy the next disruptive technology, or execute a business strategy. You may as well decide on counting yourself among the 21st century leaders. See you right here next time on the Leadership and Success Podcast with Coach BZ.