S2:E8 🎙️Bob Fabien Zinga Interview with Aphinia

Welcome to the Leadership and Success Podcast with your host, Coach BZ. If you need to develop into a better leader, this podcast is for you. If you want to achieve a greater level of success, this podcast is for you. His mentor, Dr. John C. Maxwell, said it best: everything rises and falls on leadership. We hope to inspire you today and provide you with an insight that has the potential to positively impact the trajectory of your life. Welcome to the Leadership and Success Podcast.

Well, Bob, thank you so much for taking time for this. I really appreciate it.

Hi, Michel, thank you.

Absolutely. As we start, just a quick question. Can you talk a little bit about your title and your current role at your company?

Yes, so I am the head of cybersecurity for Directly, but I am also an information warfare commander, a commanding officer in the US Navy Reserve. So at Directly, I think for the longest, we really have been a leading company in customer support automation. And so using artificial intelligence and also for providing a gig economy to people we call experts. And in the Navy, I am the commanding officer of about 72 members. Team. We pretty much manage the Navy Global Network Operations Support Center. It's a pretty big job, but yeah, that's, that's what I do once, once a weekend a month and 2 weeks out of the year.

It's amazing. So it's interesting that actually quite a few, a few members that we interviewed, most of them kind of transitioned, but they had military background, but they transitioned to kind of corporate world. It's interesting that you still kind of straddle both worlds. It's pretty impressive. And as the CISO of Directly, what's within your purview?

Yes, so basically it's everything that's related to information security. Now, prior to the pandemic, that included physical security as well, but I think we're going to be losing our building soon because For the last 2 years, as you know, everybody has been working from home. As long as they have an internet connection, they can do their work. But yeah, it's pretty much the entire spectrum of information security.

I understand. I understand. And how did you get— can you talk a little bit about some of the previous roles? I just want to get a sense of your career arc. How did you get in the space?

Absolutely. Yeah, so I think for me it started in August 1997, and that's a long time ago. I kind of started in IT support, so I was a computer tech, and then I wanted to get into networking, so I became a network analyst and then network engineer. And I was studying back then, early 2000, Microsoft Certified Systems Engineer certification was a pretty big deal back then. And around that time, I think it was in 2001, Microsoft introduced a security concentration for that. So MCSC security. So I got into it and that's when I realized I really love security above everything else. So I kind of climbed up the ladder. That was at the University of Alabama. And in 2005, I think it was, I had the opportunity, even though I was already IT director, I pretty much took a demotion in order to do security full-time. So I became an information security engineer for the very first CISO of the University of Alabama. And 20 years later, he's still there. He's still the one and only CISO of the university. But, and then also a year prior to that, so that was in 2004, so 18 years ago in October, I joined the US Navy Reserve. I was at the very bottom of the career ladder of the chain of command, right? I was a seaman recruit. E-1. So pretty much everybody outranked me back then. But when I went to boot camp, that was in Great Lakes, Chicago, Illinois, that's when I made up my mind. I was either going to become a senior enlisted person, E-7 or above, or a senior officer, commander or above. And that dream was realized for me last year when I became a commander in the US Navy Reserve.

Congrats.

It's been quite a journey, but what I really love about it is what I do for the Navy is the same exact thing I do for the industry. But of course, we don't have the same priorities and we don't have the same budget, right? Security for the Navy is extremely crucial because it's not just losing your reputation or money, but if we don't do it right, people are going to die, right? You can say that in the industry. And also, we tend to have unlimited budget. I believe last year, the budget for the US Navy was like $200 billion, if I'm not mistaken. I think if we run out of money, Congress just prints out more money for us, right? But in the real world, in the industry, your budget resources are usually very limited and you have to do the very best you can with whatever resources that are available to you.

Certainly. It's amazing. And again, congrats on achieving your goals that you set quite a while back. And kind of in this vein, I I guess cybersecurity as a concept, as an area, has evolved so much over the last decade. Even recently, it seems it's top of mind for so many people, from board of directors to government, federal, state, local, to educational institutions, healthcare. I think it's more top of mind of what the implications are, and as the world gets more interconnected, and more our lives, we live within the kind of confines of the internet, and I think that amplifies some of those risks. And I think more as a result, more and more people are looking to make a career in cybersecurity. And kind of with this, from your perspective and from your vantage point, what will be your advice for someone who maybe is more junior? As you mentioned, they're starting, everyone is outranking them. They're looking to make this career, or maybe even students in, uh, in college, or someone in IT who's looking over cybersecurity and considering a transition, what, from your vantage point, what do you, would you recommend they do? What they, what should they focus on to, um, I guess to, uh, to stack the deck their way a little bit and, and be more strategic about how they use their time?

Yes, actually that's a very important question, and I get asked that quite a lot. That's the reason why I think it was October or November of 2020, I actually wrote an article for Forbes. I am part of the Forbes Technology Council, and the article I wrote was my expert advice on becoming a cybersecurity professional. So right off the gate, I think everybody will have their own unique experience, right? It looks like no matter what you're doing now, you can definitely end up in cybersecurity, and like you say, It's becoming more and more important. And one thing that is true, I think it was in the beginning of 2000, the early 2000s, ISC², they are the one who maintain and give the CISSP security certification, which I think is kind of the gold standard for security professionals. They said that there were about 2.8 million professionals in the cybersecurity workforce, but however, there were more than 4 million jobs needed. So basically there are more jobs than there are more people, right? So we definitely need more people into this field. And I also believe cybersecurity needs to be a lot more diverse, right? When I got into cybersecurity full-time back in 2005, it was mostly white and male. And I think we are seeing more and more diversity now. I've almost always been the one and only Black or person of color in the room, but I think we are seeing more, women and more minorities as well. That's part of the reason why today I actually serve on a couple of boards to kind of help diversify IT and cybersecurity in particular. But coming back to your question, at the high level, when I started hiring people, when I was an IT professional, I feel like there are really 3 things you need to look at. Number 1, most important I think is experience, right? If you already know how to do whatever job we are hiring to, I think you have a leg up over the competition. Forget about all of the certification or even formal education. If you know how to do the job, that's really the skills we are trying to hire for. That's why for those who are just getting started, I highly recommend they just get any type of entry-level cybersecurity job so that they have experience, right? The best person I've, I've seen do this is when I was a consultant a few years back in Silicon Valley. We hired somebody right out of college. She did like a 2-year— she went to a community college but did a bunch of certs. So she had the certification, she had the education, but not quite the experience. But within a couple of years of the experience she got, she was able to triple, quadruple her salary in Silicon Valley. So I have seen it done. So I think it's very important. I think experience trumps everything else, even if it's unpaid or isn't even as an intern or something, but some type of experience getting into the field I think is gonna help you long, long term. And then the second most important thing I discussed in the article is formal education, right? I feel like in 2021, it's very important to have at least a bachelor. And I think for the most part, people in cyber come from the STEM side of the education. World, like science, technology, engineering, math, although you could do art and business and something completely outside of STEM and still get into cyber. Like even if you are a lawyer, we do need lawyers in cybersecurity industry as well. But for the most part, I think a great majority, they come out of science and technology. So having at least a bachelor's, I believe, is pretty important, especially if you want to become a manager or an executive or really kind of climb, climb up the professional ladder in this field. And then finally, I think all of the certification. I think if I count back, I probably have more than 28 certifications so far, IT certs. But out of all of my certifications today, really, there are only one or maybe two that really matter. CISSP for sure, because I never want to take that test again ever. And maybe the PMP, but all of the other stuff, they can expire. I don't need them anymore. But I must say, when I first started back in 1997, certifications were quite important because I didn't have any experience. I didn't have the education yet, and certifications were a way for me to kind of get into the door. But I believe anyone who already has previous experience, will trump anybody with certification without experience, in my humble opinion.

Interesting, interesting. I think it's a very unique perspective because you've seen it kind of from both from the corporate world and from the Navy standpoint. I think it's unique. So focusing on formal education, experience, and certs It's— thank you. I think a lot of people kind of tune into the content that we post, and I think a lot of them find valuable to, in the absence of mentors, I guess formal mentors, to hear from someone with experience who's achieved your career goals. I think it's super, super valuable. Switching gears a little bit, I know there are so many things that kind of keep CISOs up at night these days. There's no shortage of— there is a new exploits that are coming on board. But I think if kind of broadly, if you look at the buckets, kind of the big, the big themes, I'll probably imagine ransomware is one, cloud security, lack of, lack of talent. You mentioned the shortage of the mismatch between the number of jobs and number of qualified people. This kind of identity and access management, this is kind of just top of mind, third-party vendors and and figuring out how to secure the supply chains. So this is what's going on now, but kind of from your position, from your vantage point, let's say you have a crystal ball, you can see into the future, you know exactly what's gonna happen 6 months from now, 12 months from now. In your view, what do you think will be top 3 themes or challenges? It could be the same, could be different, but like 12 months from now, what everyone will be talking about, you think?

Yeah, I think we tend to do that a lot at the Forbes Technology counsel, right? Trying to look into the future, kind of see what the trends are going to be. I, I must say, for me personally, what really scares me a lot is quantum computing, uh, because it's going to make encryption completely obsolete. Uh, that's already been proven. Uh, so very soon all of the encryption we have— HTTPS, SSL— all of that's going to be completely nothing. In less than 20 seconds, they're going to be able to break into it then pretty much— because in security we have confidentiality, integrity, and availability. So the confidentiality piece is completely going to be wide open. So however, I am a little bit hopeful. Like even this morning I attended a seminar. I think it was— let me see, what was the name of the company? Just one second. I will tell you exactly which company that is. They are doing a lot of interesting work. And I am very interested in finding out about what the solution might be quantum cybersecurity for federal and DOD agency. I went to their meeting this morning. Qualcomm, right? Q-Secure is one company that is focusing on this because this is going to be a real problem and nightmare very, very soon. But the good thing I really love about security is, yes, it's a cat and mouse game. Sometimes we have the upper hand, we have the good guys, but the bad guys don't just know. We retire and give up, right? They come up and they find out ways around our control. So I think what's gonna happen now is we're gonna need to catch up with them. So I am hopeful people much smarter than I am are going to come up with a solution that's actually going to work. But if you think about it, like, you know, I've been in the government for 18 years now. All of the algorithms that NSA had chosen and blessed in the past, pretty much all of them, have been broken, DES, triple DES, all of them are completely useless today. We can find another algorithm right now that's pretty good, but how long is it going to stay good? Right now we're saying it will probably take billions of years for somebody to break into SSL or HTTPS with the technology we have now. But with quantum computing, like I said, 20 seconds, game over. I am confident, very confident we are going to come up with a countermeasure. I don't know what that is yet, but Smart people at Q-Secure, Qualcomm, and some more of the other companies there are thinking about it. I'm going to make sure to get informed. And I think that's another thing I love about what I do, right? In cybersecurity, it's not like when my grandparents went to school, they learned a trade or something, and for the rest of their life, that's all they did for 20 years, retire with a gold watch or something. In 2021, this is really the information age, right? You have to be a leader and you have to be a student for life, really, because everything I've learned, especially In Silicon Valley, we have technology innovation every 3 to 6 months, something brand new. You just have to keep up with technology and with the knowledge. You are always learning, like Socrates, all I know is that I don't know anything. For sure, quantum computing is something that scares me. I know ransomware has made a lot of noise lately, it's probably going to stay in the near future. Of course, the cloud, is really taking off, especially after this pandemic. Those people who are thinking about the transformation journey to going from on-premise to the cloud, many of them, the pandemic pretty much forced them to do just that so they could just remain in business. So I think that's the future. And in a way, that kind of gives people like me job security, right? Because I know corporations will always need people with my skill set. So I think there is a silver lining there.

For sure. Interesting. So you think ransomware and cloud security, that kind of 12 months from now, they'll still be kind of top of mind for a lot of people?

Yes.

Interesting. That's, that's great. And so kind of again, switching gears, I— you mentioned you've been with kind of Athenia for a while, and our intent is really, uh, is to provide a free and kind of safe— so meaning gated environment for cybersecurity executives to connect, to network, to learn together, and to keep respective organizations secure, but doing so not an intrusive way, not bombarding members with emails. So it's kind of like, think of it as an ambient network that's there when you need it, but it's not in your face when you don't. So this was kind of our original intent, and I know in certain ways we've succeeded because certain things seems to be working and members appreciate it, like the weekly CSO Wire update, these interviews. It seems like we're getting a lot of positive response. But always, to your point, we always try to learn, um, and, and to ask for feedback. And we're kind of with this in mind, what, in your view, what do you think is that what we do that you value, that we should do more of maybe? And what are some of the things that we're not yet doing that we should maybe, uh, can focus on to make it more more effective, more valuable for members.

No, I think it's really a great organization. I really like that a lot, the CSOW update. Now looks like recently you've added the interviews like this one, always very, very nice, so we can meet all of the other members, kind of get their point of view, right? This is something I really value since I was at the University of Alabama. As you know, higher education, they really like to collaborate, right? So back then, I remember I was a member of Educause and also the SANS EDU Advisory Board, and we would meet with people in the region, all of the other schools, kind of see what they're doing, what we're doing, and kind of learn from one another. I think that's really the best way to learn, looking at your peers and trying to really keep up with the time, see what works, what doesn't work, and improve. That way. And also, like, you have those mastermind calls as well. Like, I think in April you had like 5 or 6 of those, and I like, like, they are different date and time, so whenever we can, we jump on those. And it's also a great place for networking. And the thing I always love, this has always been part of the newsletter, but you always have some events or the newly appointed CISO across the industry and also whatever CISO jobs might be available. So I think you really provide a great service. I don't think I would change anything. So I'm really proud to be a member of the community. It's awesome.

And is there anything that— because the reason I'm kind of very curious about it, some of the members say, well, COVID is kind of over for the most part. I mean, some flare-ups here and there, but I would really like the opportunity to meet face-to-face, maybe in small groups, maybe not like a large conference, or maybe, I know, dinner-type meetings that are more local, whether it's, you know, New York, Chicago, San Francisco. But, uh, and something, something we're seriously considering. But kind of along those lines, um, are there things that you think— different format of interaction? Because I think networking is a big reason why a lot of people join, uh, maybe different format of connecting, maybe, uh, some of the features on the website for people to connect. Or maybe someone suggested, uh, it would be awesome to— though, if we could provide rate vendors and then other members could see. But then again, it's not something that's indexed by Google and, and, and for everyone to see, but it's really for, for the benefit of members so they can get more, um, direct and more not paid for kind of feedback. And also they have like a name and a face so that if they have a question, let's say they shortlisted 2, 3 vendors, and then they can see feedback from other members who recently had experience with them. And they can say, hey, Bob, I saw that you dealt with Qualcomm recently, um, it's one of the organizations we're considering right now, do you mind if we talk for 5 minutes? So those kind of things. It's, it's, it's a long list of things, but, but again, we don't want to create something that will be too much, or we want to make sure that it's worthwhile our effort to put it together, but also it will resonate with the membership. That's why we're kind of curious about feedback on those lines. What are some of the— whether around networking or vendors or, or the format of interaction? I mean, Masterminds, they're by industry, but they're not by location, and we're thinking maybe doing something about location where it's CISOs who maybe for more diverse backgrounds and meet face-to-face is because they're in the same, I know they're in Atlanta or Miami.

No, I think all of those ideas are great, but I must tell you one thing the pandemic I think has taught us is a lot of this can be done online. And I think for the most part, you can't really replace, you know, human face-to-face interaction, but I think technology is a pretty good second and definitely very convenient, right? Sometimes, like even now, it's starting little by little, not like it was prior to the pandemic, but I received an invitation for dinner in San Francisco or meeting with vendors. I've gone to a couple of them, but I must tell you, having to leave your home and drive for like 30 minutes to the city, trying to find parking and all of that, it's not really something I am excited about like I used to be. A couple of years ago, it's so much easier for me to do like we just did, get on my computer, click on Zoom, and stay in the comfort of my home office or whatever. So maybe there needs to be a mix of the two, but it does make sense for you to kind of network with people within your region. For example, the Forbes Technology Council, they do that too. They kind of have regional hubs, and we have kind of monthly calls where I can see the people within the San Francisco Bay Area. And if I need to, or if I want to, if we can meet in person as well, but it's not really pushy, it's more like organic, right?

And that's what we're trying to accomplish. We want to make something that's not something we force on members, but we want to make sure that we get the feedback and then we get consensus that, yeah, it makes sense because again, we don't want to waste your time and we don't want to waste resources. So you can choose, but thank you for your time.

Yeah, because I think time is definitely the most important resource in the world, period. But another thing I'm gonna add to, to end here is I still use about 10% of my time, my valuable time, to speak with vendors, right? Like Qualcomm, Q-Secure, people like that, because I don't know everything and people are coming up with innovative solutions. I'd like to be able to test them and see if something I might be able to use either at my company in the industry or in the US Navy, right? So I think, but then I guess I have to be a little bit careful because some vendors, they have salespeople who just push, sell, sell, sell. That's not really what I like. I'm just curious. I just wanted to know what you are doing and if it's even going to be applicable to what I am doing and if it can help us out. So I think if I'll, I think I'll start making available some of the industry leaders, kind of what they do. I think we can all definitely learn from that. I think that would be a great use of my time, as long as it doesn't turn into a sales harassment, right? Yeah, but definitely the knowledge and being able to compare vendor and what they offer and how you might be able to apply it at your specific Well, and, uh, and on this topic, um, I know every time I bring up vendors, it usually gets a very visceral reaction.

Um, if you're thinking back on your experience, right, in the last 6 months, maybe a year, um, without naming names, uh, what are some of the things that, uh, vendors, or specifically salespeople, do? Like, what are the top 3 things that is just the most horrible, horrible things? And on the flip side, just to be fair, Again, without naming names, what are some of the vendors that did something that really kind of resonated and impressed you and it was a good experience for you and it was worthwhile attempt that they did to kind of build a relationship and it was productive?

Yeah, I think the vendors that are like this are those who are kind of like in the teaching mode, right? Hey, we have this thing if you are interested, but don't really put a lot of pressure on you to do so. As a matter of fact, we recently had Eugene to go ahead and hire a different vendor than the one we've been using to execute a pen test, and I just went back to my email. I have at least 10 vendors trying to sell me pen testing services, so it was now my turn to get to them and say, hey, I did get your email, now I am interested, let's Let's, let's talk. Now, what I don't like is when a vendor sends you emails almost every single day. Like LinkedIn is my number one favorite social media platform, period. I've been using it almost every single day since 2005, maybe 2004. And pretty much all of the jobs I've had since then, all of them came through LinkedIn, right? So at the beginning, maybe the first 5 to 6 years, I would be getting job opportunities from executive recruiters on LinkedIn. But today, almost every day, I get the salesperson who's trying to sell me whatever it is they're selling that I I don't want to buy. And what really gets to me sometimes is they send me 3 or 4 or 5 messages and then they say, okay, this is the very last one, but still they send me another message after that. So it's just like you can't even trust what they say. So I wouldn't want to start a partnership with a vendor like that. So yeah, again, I understand they need to make a sale, they make a living, but I think It's better when they actually focus on developing a relationship. It's like, you know, I understand you, I kind of see what your needs are, and this is something that might help. No pressure, but kind of give us a chance. I think I tend to do better with vendors like that. They don't just want to sell me something, but they actually are solving a problem that maybe I didn't even know I had.

Interesting. So basically you're saying those who focus on— well, teaching is giving, really giving. You're giving something without asking anything in return. You're providing, yes, maybe a different insight, a different kind of view on an existing problem, or bringing up maybe a new emerging problem that maybe not top of mind for a lot of people. But you are, again, you're giving without an implicit buy now button versus something that—

absolutely.

Trying to take, which is give me your time, give me your money, right? So it certainly makes a lot of sense, especially now with technology. I mean, you can push a button and I mean, some of the sales tools, I would imagine you can push the button and send 10 emails to every person in the world, like 10 times a day.

So it's— Exactly. What's even more annoying is when I get the same exact email from 3 different people within an hour. I'm like, this is ridiculous. They don't even spend a little time or intellect or energy to customize the email to the same company. Uh, actually this was two different companies, but yeah, one of them was two salespeople from the same company in two separate areas, same exact email, word for word. It's unbelievable.

It's just sloppy. Bob, I know we're coming up on time. Last question. So this year, for whatever reason, and I know what the reason is, but 2 big events, one is RSA in San Francisco and another one is Gartner in National Harbor, I think, in Maryland, are happening the same time, early June, I think first or second week of June. So for you, is it gonna be RSA? Is it gonna be Gartner? Maybe neither? Like, where do you stand on that?

It's always been RSA, although to be frank with you, if I can speak freely, It's not the conference it used to be. Lately, I've seen too much sales, vendors selling stuff and not really teaching and learning. That's kind of a shame because I actually used to work for a company called Pivotal, which was a sister company to RSA. Both at the time were owned by EMC, which later was acquired by Dell. So I'm pretty sure RSA is a Dell company now. Yeah, I love RSA to death. They have a lot of great product and services. And for the longest, that conference was one of the very best conferences in the industry. But I think a lot of things have changed for a while now. That's actually where I met one of my most impactful cybersecurity mentors. It was in 2019. I met her by accident. She almost offered me a job, but we talk now like every single quarter. So I have a lot A lot of good things happening at ISA. You can definitely network with some of the best minds in the industry and so forth. But it's just becoming too much salesy lately, I think. I really would prefer if they went back to really teaching, educating, and kind of showing what is out there without so much pressure on sales.

Well, it's probably because all those venture-funded companies raise so much money that they need to show some results to their boards. So they're Yeah, and they, to your point, instead of hiring too many salespeople, they should push some of them into cybersecurity careers where there's a shortage.

I think they'll be—

I think so. They'll spend their time better there. Well, Bob, I know we're coming up on time. Thank you so much for being so generous with your time. I really, I really enjoyed the interview, and we're actually— we're still kind of on the fence whether it's RSA or Gartner. Most likely it's going to be RSA, so if you do end up going, uh, would love to meet face to face.

Absolutely. Thank you. Thanks so much, Misha. I appreciate the opportunity.

Thank you for listening to the Leadership and Success Podcast with your host, Coach Beezy. If you like what you heard, please subscribe to our channels and come back for more wisdom nuggets on how you may develop into a better leader and achieve greater levels of success. Leadership is the most critical skill. The world will always need leaders to lead others, deploy the next disruptive technology, or execute a business strategy. You may as well decide on counting yourself among the 21st century leaders. See you right here next time on the Leadership and Success Podcast with Coach BZ.