S2:E14 The Powerful Role Of Security Champions With Bob Zinga

Hi, I'm John Maxwell. When the top companies in the world are looking for trainers, speakers, and coaches, there's one name that stands above the rest, and that's Maxwell Leadership. Our certified team members have gotten proven results for companies all over the globe, and our reputation, I'm proud to say, is second to none. Some of our members have risen to the top of their profession, including the one you're going to meet today. I proudly introduce you to my friend, Bob Fabien Zinga.

Welcome to the Leadership and Success Podcast with your host, Coach BZ. If you need to develop into a better leader, this podcast is for you. If you want to achieve a greater level of success, this podcast is for you. His mentor, Dr. John C. Maxwell, said it best: everything rises and falls on leadership. We hope to inspire you today and provide you with an insight that has the potential to positively impact the trajectory of your life. Welcome to the Leadership and Success Podcast.

All right. So here am I with Bob, Bob Fabien Zinga, and I'm Nitin Drana. And today we're going to talk about setting up Security Champion Program for success. This is the first series of the podcast that, you know, we are sharing with you all. So welcome, Bob. Do you want to please introduce yourself to the audience?

Yes, Nathan, thank you so much for setting this up today. I am Bob Fabien Zinga. I go by BZ, and I've been in the security industry full-time since about 2005. So I started my career back in '97 at the University of Alabama. So that's higher education working for the state. And then in 2011, I moved to California. I did some work for the US Army, and then in 2014 is when I moved to Silicon Valley working for small, medium-sized, and large technology high-tech organization here. And the other thing about me that's a little different is I've been in the US Navy Reserve since 2004, first as an IT technician, and, uh, later on I became an officer, an information professional officer, and today I am an information warfare commander. So I pretty much do security for the US Navy, pretty much the same job I do as a civilian for the industry.

Excellent, Bob.

This is—

it is really an honor to connect with you. I think the kind of balance you bring in with the duty that you do for defense, like for Navy, and what you're doing as a civilian. So kudos to you. Hats off to you.

Thank you.

And I know it's not easy, but we are glad to have you, Bob. And I'll introduce myself as the host for this podcast. So my name is Nitin Raina. I am with ThoughtWorks Inc. I am the Vice President Cyber and InfoSec. For ThoughtWorks, been with them for almost 12 years now. It's been a journey. And I have close to 25 years of industry experience. And I'm super, super excited to present the podcast today. And we are starting with Bob. So let me start with this, Bob, right? When you look at the security champion role, right? And based on your broad experience, whether it is in defense or it's in the general industry, What does this role of security champion at any organization? So if you want to maybe take a few minutes, Bob.

Well, I think a lot of things are changing in this industry. I think it all depends on a lot of things, right? The size of the organization, the industry, and also what is the priority of security, I think, within the culture, right? For example, In the US Navy, we take security extremely, extremely seriously. Very different than the way we do security in the industry, right? I think part of the reason is, in the Navy, if we don't do security, people may actually die, right? That's not the case in the industry. Worst case scenario in the industry, we probably just lose money, or maybe your brand is negatively impacted for a while, but it's not really as drastic as, using the life of a human being. So I think depending on all of that and also the risk appetite of the organization, that makes a big difference too. Because like I say, in Silicon Valley, I've worked for very small company and of course some pretty big companies too. And they usually look at risk very, very differently, right? Sure. So especially when a company is very small, agile, and they want to be first to go to a market, many times they take a lot of risk because greater risk, greater reward, and that's that kind of thing. So I don't think you can just have a single answer for—

Okay.

That would be the same across the entire industry. But when I think about a security championship, there's really only two organizations I've worked for where they actually had like a security evangelist role. That was actually the official title. To me, a security champion is someone somebody who really pushes the security program forward, right? They don't have to be a part of the official security team. Even something I tell my people when we do information assurance training or information security awareness is, in a way, every single employee and every single contractor of my company is a security champion because they are really our eyes and our ears, right? I have a— pretty small team, about what, a dozen people also, and that's not really enough for every decision we kind of make, right, across the company. So another thing which, you know, being VP of InfoSec, in many ways we are only as strong as our weakest link, right? So I think it is really up to us to make sure that everybody in the enterprise as basic information security knowledge. And it's not just, you know, getting some information so they can check the box, we did security training this year, but it's actually understanding it and living it, applying it not just at work but at home also. Especially with this dynamic with people now working remotely 100% of the time, it's very important that they really gain the security skills and they apply them everywhere. They go. So in a, in a way, I think everybody in the enterprise should be a security champion, but then in some organizations they actually have specific people who have that role and function. But, but really, from my experience, it's really making sure that the members of a security team have— they may not have reporting duty, right? People may not report to them, like engineering, product, and marketing that they don't usually, they don't report to security, but we should be able to influence all of them, right? So I think it's really about security leadership, having those soft skills where, you know, you can use data and build relationship and really influence the people both at the senior management level, your peers, and the entry-level position across the entire organization to really be open to security, embrace it, and really apply the security principle day to day. That's probably the best answer I would get you.

No, no, no. Thank you very much. I think that's a very well-rounded response, right? I think you've touched on some very awesome points. There is one that the weakest link is the human. You talked about people who can develop those connected relationships, right? You know, will a marketing function leader listen to Bob, or will a marketing function leader listen to another marketing exec in the team who can tell them that what you're doing in this process is not right, this is how you have to do it in a secure way. So influence those people, influence those individuals who are closer to the problem, closer to the business process, will actually get you better results rather than saying, you know, these are the 10 steps, Mr. Marketing Exec, that you need to follow. And some of it might get lost in our technical jargons because not everybody will understand what we are trying to say. I think that's a very, very good point, Bob, and I agree with you. I want to take it to the next level, right? So if you can share with us, like you talked about the role, you talked about the role of advocate, you talked about the role where you have to influence at all the levels. So that sort of broadly touches on responsibilities of a security champion and a security advocate. So I think that's pretty much clear to our audience, but if we have to talk about, you know, how does this individual work, you know, if you want to give an example, right? If you take an example of a product team or a function or a business process team, if you can maybe tell us a little bit more on how you have seen security champions work in a successful way with a function, with a department, with a team. So maybe you can maybe take a few minutes, Bob, and share us some of your insights.

Yes, and before I, I answer that, based on what you said, I, I would like to highlight two, two other things. In my experience, especially in the industry, uh, sometimes I've seen it where it's very challenging for the security team to actually be taken seriously and to really be considered as a member of the broader team, right? Because when I was growing up in this industry, especially early on, I'm sure that has been your experience too, the security team has almost always been known as the department of no, right? Engineering or business wants to do something and security is like, no, can't do that. It is not secure. There is just no way. No, no, no, no, no. And also just generally speaking, security, IT, those function, No, we are cost centers, right? We cost a whole bunch of money and we don't really bring in any income. Sales, marketing does, right? Engineering does, but security usually doesn't. So I think that is a problem. So when we talk about security championship, I think it's really critical for the security team to be able to really affect the culture of the entire organization. I think sales, marketing, product, engineering, all of those should see security as a partner, not as an obstacle to them doing their job, but as a partner, us working together in order to accomplish the mission of the organization. And I believe being in security, you know, when I first started, you know, technical skills were extremely high. That's really all people were hiring and firing for. Do you know how to set up, configure a firewall and things like that, which is fine and those things are needed, but But I think today, in addition to technical skills, I think the security leader needs to also have business skills and also soft skills, leadership skills, being able to influence people. Part of the reason why I have an MBA also. But so I believe when you talk about security championship, I think there is also a psychological aspect to that because people, they, I think they need to respect you and if possible, like you as well, because Somebody who's in engineering or marketing or whatever, they will do something for a friend that they will not do for somebody who kind of gets on their nerve or they don't have any relationship with. Sure. As an example, when I first moved to Silicon Valley, right, I was working for a company called Pivotal at the time. And initially engineering pretty much ignored security at all. It seems like we didn't matter, right? But one thing I did back then, The engineering function was mostly based in our San Francisco location, and the security team was with the corporate team in Palo Alto, our global headquarters at the time. So one thing I did was to actually drive to the San Francisco office once a week, like every Thursday, so they could actually put a face to a name and we could actually develop relationships so they would understand, no, we are on the same team, we are working on this together. It's not me telling you what to do. Like I said earlier, usually all of the other departments do not report to security, but security has to be able to engage with all of the other functions within the organization. So in a way, I am answering your question on how to better influence all of the other departments and functions within the enterprise so that whatever we do as a company, we are doing it in a safe and secure way. I think it is high time that the organization sees security as a competitive advantage, right? Like, even as the head of information security at my company, I spend about 20-25% of my time talking with prospective customers and that kind of thing, right? When I first got here, it would take us a very long time to close many of those deals. And part of the reason was because our prospective customer just didn't really trust our security program, right? But now being ahead of that and talking to them from the get-go and showing them how we take security and privacy very seriously, all of the controls we have in place to ensure the confidentiality, integrity, and availability of their precious personal information on our platform, that really helped us go a very long way. And I think Once the business side sees that security is a partner and actually helping us close deals, that's a big, big change from not being a department of no, no, no, no, actually helping the company accomplish whatever strategic vision or goals of the companies are. Seeing security as an equal, but most importantly, as a problem solver. I think that is quite—

Very good point. Very good point, Bob. I think I can't agree more with you, right? The focus on not being seen as a no team, the focus on being seen as a true partner who actually helps the company with scale, with growth, so that people come and discuss with you, right? Hey Bob, we are trying to do this new product offering. How can security help us to make sure we go in the market with the right product, which is not just working for our users, but secure as well. So having those conversations early on, and I think you're touching the topic very well as to how these people who are sort of part of someone else's organization, they don't report to Bob. They would report to, let's say, an engineering leader or a product manager or to, let's say, a marketing manager, but they will feel that because they are acting as a champion, they will be the one who will voice on our behalf, right, with, you know, in the right way so that we can actually get our work done through those individuals, right. What we want is not to have, you know, blockers in people or organizations' way. We want us to be seen as enablers, not as blockers. So I think you touched on a lot of these things. Thanks for doing that. I think one area which I really want to get your views on is around training, motivation, capability development, right? You know, when we look at a security expert, right, we have to invest in that person. And I look at a security advocate, a champion, we need to invest in them as well. So Bob, what have you tried as in your experience with the organizations? And you can also maybe talk about, you know, within, within US Navy, what have you tried, which would be something that our audience would learn from, from a training capability development standpoint?

Yeah, so I think training is extremely important. As an example, when I got here directly, we used to do information security awareness training only during onboarding. That's it. They do it one time and that's it. That's not enough. You really need to have rinse and repeat. You need to really learn more about security throughout the year. So at minimum now, we do it during onboarding and then we do it once a year across the entire company. But one thing I have also done is, as you know, October is National Cybersecurity Awareness Month, and it's been so at least, I think, since 2001 or so for the federal government. So that is one thing that I take very much advantage of, and we started about 3 and a half years ago. Every October, we have a lot of security training at least once every week. Of course, no, we cannot force everybody to come. It's completely optional. However, when we do those, it is really awareness training, right? It is not a lecture, right? It's not boring. It's very exciting, high energy. And we also work with many of our vendors to actually get a bunch of swag that we give away and also work with senior management to be able— I think the first time we did this, we gave away $100 Amazon card, so people could actually go buy whatever they wanted. But in order to earn that, you had to show up at all 4 trainings during the month of October 4th, for example. So I think you can kind of think outside of the box, really make it very exciting, and also make the training relate to people. As an example, identity theft, more than 25% of American citizens have been affected by that. So when you talk about things like that, they know exactly what you are talking about. And then they see how this training is important to them, not just at work, but at home and in their personal lives as well. And they can get very interactive. And another thing I felt like really was extremely cool was when we played games, right? Where we would play almost like Jeopardy. They would choose a category and then the amount of points, you know, the higher the points, the more difficult the question would be and divide them into teams, make it really, really fun and exciting. And they really felt like, okay, I've come out of this awareness training and I've really learned something, right? So I think the key in my experience is to really make the security training and the security aspect really a part of the culture across the entire organization. One very specific example I've seen in the Navy, which is a very old organization. Since the 1700s, we've been around. The chain of command in the Navy is something that not everybody pretty much respects. But one thing that they did in the Navy, at least I have seen it because I joined the Navy like 2004, I think it was around after 9/11, I've seen it more and more, but they are making the commanding officer You are responsible for security, meaning we are not going to promote you and, and you actually have a potential to lose your job if you don't do well in this area. So once it becomes the number one priority of a person who is in charge, guess what? It's gonna become the number one priority for everybody that reports to them, right? So it, it, it really, they no longer have a choice. It's not like something they do because prior to that, it was more like a collateral duty, something you do on the side, something you do if you have time, but now it's not, no, no. This is actually one of your primary duties. You are going to be, your performance is going to depend on that also. And I think kind of doing that makes a big, big difference. Now, I mentioned I came to Silicon Valley in 2014. In my experience, most companies here, at least at the time, they really focused more on the bottom line, right? The dollar, going to market first and making as much money as possible. Security is kind of like in in the back burner. However, with all of the changes we've had, everybody, when you listen about all of the data breaches happening and stuff, I think even now the FTC, right, is pushing it now so that even board directors are, I think, pretty soon going to be held personally liable for security breaches too. So I think with this type of changes happening, in many ways it's kind of like what happened— when was it? 2001, right? With Enron, for example. And that's when the FTC kind of pushed for every single board in America to have a financial expert on each board. And I feel like we are getting into a time where they're going to be pushing for cybersecurity or technology expert on every board too. But I think that type of pressure is going to make the board, makes the senior management really accountable. Hey, you guys, I'm not going to give you bonuses. You are not going to get promoted unless you get this security thing under control, right? So I really believe if we get pressure from the top down, but also from the bottom up, that is gonna make a very big difference in the long term. But if the senior management and the board could really take this seriously, where they even kind of like they did in the Navy, made it part of the people performance, right? The way they get their bonuses and, promotion, I think that it's gonna probably, uh, increase or advance the security function within the, uh, the, uh, organization much further than any— anything else I can think, think of. Just— yeah, that's—

yeah, very, very good point. I think you touched on gamification, right, uh, to build on training. You, you know, you talked about, uh, competition, you talked about reward strategy, you talked about accountability, right, which is very crucial, right? You, and you touched on sponsorship. I think these are all very key criteria that we have today and which we have to define with our leadership, with our, with our board, with our product teams, because if we are able to do that, then it's not limited to those one individual or two individuals in the company who has to be responsible for security, but then security is seen as a business objective. That is what I think, Bob, you're leading to. And I really like the options and the suggestions that you shared around training and capability development as well. I know we are close on time. So any closing thoughts, if you want to leave with one or two, let's say sentences or words or whatever it is, Bob, which you would want to take the audience to take away from this podcast. So what would that be?

Good. And again, Nitin, thank you so much for making this possible. But I think probably the most important thing is the security function shouldn't only be the responsibility of the security team, right? I think in order to be successful going forward, every single person in the organization needs to really embrace security. I think I may have mentioned this earlier, but I think we are only as strong as our weakest link. And I believe within the organization, if we can really infuse security within the culture where— I don't even want it to be punitive because the way I've seen it done in some organizations, it's like they would even have like a phishing campaign or things like that. And then if you click on the link or something like that, then they make fun of you, they humiliate you, and they punish you. But I don't think people should be scared because error is human. We all make mistakes, even the best among us will make mistakes. But having a culture where we support one another, where we learn from one another, and we've got everybody's back, right? These are the policies. There is a reason why we have this type of policy. Let's all of us work together in order to really make a difference. I think if people who are listening to us can just get that one idea where they realize that they are the people who are going to make a difference in their respective organization. They don't have to have a security title. They don't have to be the CISO or security engineer. No matter who they are, in marketing, in HR, in the legal office, they can really make a difference by learning more about security and applying those principles and helping raise the security awareness within the culture of their organization.

Absolutely, Bob. Absolutely. And thanks for an excellent summary, the excellent key takeaway, Bob. I really appreciate it. I hope the audience, you know, learns and, you know, finds this podcast useful. So thank you very much, Bob, you know, and we'll be in touch.

So thank you. Thank you, Bob Fabien Zinga. Thanks so much. Until next time. Thank you. Bye-bye.

Thank you for listening to the Leadership Success Podcast with your host, Coach BZ. If you like what you heard, please subscribe to our channels and come back for for more wisdom nuggets on how you may develop into a better leader and achieve greater levels of success. Leadership is the most critical skill. The world will always need leaders to lead others, deploy the next disruptive technology, or execute a business strategy. You may as well decide on counting yourself among the 21st century leaders. See you right here next time on the Leadership and Success Podcast with Coach BZ.