Episode 24: Mark Weatherford On Leading Change As a CISO

Informing your decisions with intelligence analysis and insight brought to you by the team@ooda loop.com welcome Mark Weatherford to the Oodacast. Mark, good seeing you again.

Good morning, Bob.

Hey, Mark, before we get started, I think most of our listeners and viewers will have heard of you before and met you. You're such an icon in the cybersecurity community. But for those who haven't, let me give my version of your biography. You were in the Navy, and that's where I first met you. You were a Navy cryptologist and I was a Navy intelligence officer. Of course, those two disciplines work so closely together. There's no way I could do my function of intelligence without this great cryptologic community. And to summarize that, you guys would. You would protect our deepest secrets and you would attempt to glean adversaries secrets through their. When they used communications and technologies. So a critical career field, and I want to talk more about that later, but after the Navy, you worked for one of the large integrators for a while, and then you worked for a couple states as CISOs, Colorado and California. You also helped protect the nation's electric power generation and distribution system by doing security with the nerc. You were then drafted back into government service to.

That's a good way to put it.

That's right. To help kickstart and lead the DHS cybersecurity activities. And since then, you then did a lot of very strategic consulting, helping firms become more secure. And you served as a CISO leader in several startups and are now advising several companies. You also worked as the CISO for a very large company in the travel industry. And so a wide spectrum of experience in cybersecurity. Did I get that about right?

I think you're the only one that ever got that exactly right. You hit. You've hit literally everything that I've done in my adult life in five minutes or less. Great.

That's because I'm ahead of your fan club, Mark. So I track that stuff closely.

You're an intel officer. I get it. Yeah.

Well, Mark, I want to extract some lessons for people today, but I wanted to go back and start at the beginning for context. You joined the Navy and you joined a very technical discipline. And can you tell us why you did that, Mark? Why did you join the Navy and why did you select a technical career field like you did?

Yeah, well, as I tell people, you know, my. Everyone in my family had been in the military. You know, no one had done a career. Everyone had just done kind of their, you know, their one tour in the, in the war or whatever. And, and I just kind of always knew that I was going to go in the military. I expected to do just one tour and get out and go back. But, you know, I grew up in Northern California, north of Sacramento in the farming and ranching area up there. And when I went in the Navy, I wanted to be a Seabee. I wanted to drive trucks, I wanted to drive tractors, build bridges, build roads. And the Navy and their infinite wisdom said, hey, we think you should go into this advanced electronics business. So, so I went to ET school, electronics technician school, and then I went to cryptologic maintenance training on, as you know, some more specialized electronics equipment. And that's kind of how I got in the Navy, and that's how I got in this technology business. And in fact, in 1976, my first, what they call a C school in the Navy, which was the actual equipment I was going to work on, was a GTE IS1000 computer, which was as big as a room. And so I, you know, I learned how to code and learn how to maintain a computer back in 1976, and that kind of started me, you know, in this computer industry.

That's cool. Thanks, Mark. Awesome. Yeah, it's great getting that foundational story. And then as you departed the Navy, you went to work for integrator and was it Raytheon?

Raytheon, yeah, yeah.

And that kick started your career as an enterprise technologist. And, you know, through that, you know, the transition from the Navy is another point I wanted to dwell on just for a minute because there's a lot of guys today going through that same kind of transition that you and I both did. And I was wondering if you had any lessons learned or insights that would be relevant for people going through that transition today.

Well, I think, yeah, I mean, I think, you know, you have to be, you know, I've been kind of a mentor and advisor to dozens, maybe hundreds of people transitioning out of the military. And, and I think you have to be open minded a little bit. You know, I was a little bit better prepared perhaps than a lot of people getting out. You know, I had, I went to Naval Postgraduate school, I wrote my thesis, and this is in 1994, wrote my thesis on information security, which, you know, in 1994 there was not very many people even talking about information security. So I kind of established a good glide path out. And then, as you know, where we met, I was at the Fleet Information Warfare center in Norfolk and I was running the computer network, Defense operations there. And that's where we met. You were up at jtfcnd. And. And so that was a, you know, that was a perfect glide path for me to get out of the Navy. You know, it was 2001. You know, cyber Information security, Information Assurance at the time, you know, was the buzzword. And fortunately, we were in the middle of something. You remember very clearly the Navy Marine Corps Intranet transition. And Raytheon was building the security component of NMCI for eds. And so Raytheon hired me to. To go to San Diego and build the security operations center there. But I think, you know, back to your point, you know, I think, you know, prepare early to get out. Start thinking about what you want to do when you get out. A lot of people end up being, and nothing wrong with it, but end up being very generous when they get out of the military. And there's a lot of great jobs for being a generalist. I was very focused, though, on staying in the cybersecurity information security arena and building a second career there. Great.

Mark, I also want to talk a little bit about, I mean, from there, you made the transition, you established a second career, but that really, it was more than just a second career. You became, to me, one of the most successful CISOs out there. You were making big changes and improving things in both the public sector and private sector. Meaning. I want to ask you a similar question about people who want to become a ciso. And it may be people who don't have your background from the military. Maybe they're a technologist in an enterprise or a line of business leader or some other executive that wants to help improve the security posture of an organization. Do you have any advice for people in the career path of security on, you know, what to do to become a ciso?

Yeah. Well, interestingly, I think, you know, when I first became a ciso, it was possible to be considered an expert in security. Today, I cringe when people say you're an expert in security because there's so many facets of security today that it's really hard to be considered an expert. I guess the first thing that I tell people, and I think this is really important, is be sure that you want to be a ciso, that you want to be a CISO and you want the responsibility of being a ciso, that you just don't want to have the CISO title. Because there are a lot of people, you know, I think that they just think that, you know, once they get the title, then they will have reached, you know, the peak of their, their apex of their career. You know, being a CISO today is an incredibly hard job. There are a lot of sacrifices to being a CISO. You know, I mean, you're, you're literally on 24, 7, 365. There are no days off because stuff is happening all the time. But I think if people really want to do that and there's legitimate reasons for it, you have to be willing to make some sacrifices in your life. You have to be willing. If you think about it, not every company has a ciso. Not every company can afford or needs a ciso. So you're probably looking at, you know, larger, medium to large sized companies that have a, somebody with actually has the CISO title. And, you know, a lot of those companies are in, you know, geographic areas that you may require to move to. So, you know, that was, you know, honestly was probably one of the keys to my success, is that when good jobs became available, I was ready, you know, my wife and I were ready to pick up and move wherever that job needed to be, wherever I needed to be. A lot of people simply cannot do that. And I, and I get it. But I really do think that that's important, you know, to be willing to sacrifice to be a ciso. You know, I, you know, I will tell you, if I had to do, if I had the, if I have had the opportunity, I wouldn't take another CISO job today. You know, I'm just not at a point in my life where I want to devote that much time and that much energy to doing it. You know, building a team is incredibly fun and it's rewarding. You know, mentoring the next generation is very fulfilling, but it's a heck of a lot of work.

Right. Mark, another observation is so many CISOs today, their number one job is incident response. They become incident responders. And they want to think strategically, they want to mentor the next generation, but they're sucked into the day to day knife fight, the combat in the networks. And it. Do you agree, are CISOs becoming incident response managers and that's it. Is that dominating?

Yeah, yeah, yeah. You know, and I talk about this a lot and that is, you know, we all go into a job like this thinking that we, we want to be strategic and we want to think strategically. We want to build, you know, strategic plans. But it is so hard to stay out of the daily knife fights because it just, I mean, it's just the nature of the beast is that every single day, you know, you know, you're going in and something is going to happen that's going to divert your attention away from, you know, from being strategic. So. But that's where building a good team can help you. You know, where you can delegate responsibilities to people that can handle some of that stuff. Because, you know, the other part of it is the strategic stuff doesn't go away. You still have to report to the board once a quarter or once every six months. You still have to make sure your CEO is up to date on your budgeting, on the legal implications of things that are going on. So it's not like you can't not do that other stuff. You really do have to be good people. To delegate some of those responsibilities, too, is really the most important thing.

Cool, Mark. That leads to kind of my next question. But first, to summarize all that, I think that's great advice for anybody in the security domain that's looking up and wants a career and to move into the executive ranks. I think it's good that they think through all of that kind of stuff to make sure that they really are going to do it for the right reason and to understand how tough it's going to be. But it kind of leads to the next question, which is you do have to interact a lot with boards and CEOs, and I was wondering if you had any advice for that kind of person. For example, someone on the board of directors of a large corporation, what do they really need to know about cybersecurity?

Yeah, well, you know, boards want one thing more than anything else. They want confidence that the CISO knows what they're doing. If you have, you know, if you can convince your board to be confident in you, there's a lot of. It eases the way for a lot of other things. But I think, you know, board members, they understand risk, and the board is there really to help manage and mitigate risk for the company. And most board members, in my experience are pretty good at understanding risks. I mean, they understand competitive risk, they understand compliance risk, legal risk, geographic risk. They understand risk really well. Where I think we have done, we, the security community have done perhaps not as good a job as we could have is, you know, we've kind of lived behind this. This, ooh, you know, cyber is scary and spooky and, you know, and you don't need to understand it. We'll take care of it. And unfortunately, you know, that's kind of perpetuated itself where people believe that now. But I. The way, you know, and I've told every board that I've ever talked to is that, listen, cyber is just another risk. You've hired me to manage that risk. Just like you've hired the general counsel to manage legal risk. You hired the CFO to manage the financial risk. I'll take care of this. You know I will. You know, I will tell you the questions you should be asking me. I'll give you enough resources that you can, you can be, become smart enough to hold me accountable. So, you know, I think, and if you can do that and be as honest and open with your board as you can, and that sounds a lot easier than it is, managing a board is not for the faint of heart. I will tell you I've had really good experiences with my board and I've had really bad experiences with my board. I have one friend who, he said it's in his board. And I, and then I said, I'm surprised you lasted that long. You know, most boards wouldn't tolerate, you know, for four years. And so I, you know, but, but managing a board is, I mean, it's not just something you just show up every quarter and talk to them. It really is a relationship. I mean, my last board, I had three or four of the board members that I cultivated, I intentionally cultivated a relationship with them. I would call them between board meetings, I would send them emails on different things that, events that had happened that they might be interested in. So they kind of had a perspective of where I was coming from. We had a little bit of a relationship. I don't, I wouldn't say that they were my champions but, but they did understand, you know, what I was trying to accomplish. And I think that gave them confidence in what I was trying to do.

Well, great, good advice. And I want to circle back now because we talked about your time in the Navy as a cryptologist, very information intensive field, including the need to present information up to leadership and work with a lot of others. And I just wanted to see if that how that helped you in your later career as a ciso, working with boards, your background in the Navy as a professional in an information rich environment.

Yeah, you know, this is going to sound a little trivial and I don't mean it to be at all, but you know, when you've been in an intense environment, when you know the mission is on the line, perhaps lives are on the line and it's dependent on you getting your job done. It's like everything is downhill after that. And that's not really true because, you know, when you're in a You're in a Fortune 500 and, you know, and you have a security incident ongoing. You know, that's a big deal. But I have a Marine friend who always says, hell, nobody's shooting at you. How bad can it be? And, you know, and I always remember that. And I think, you know, you know, perspective is an important thing for a CISO to have. You know, these incidents always resolve themselves, and I just try to take a mature approach that, okay, the world's not going to end over this. Hopefully not. You know, we may, we may have a problem with it, but I don't know, my time in the Navy really is. I would say that more than anything, it gave me perspective on how bad things really can be. Yeah. Great.

Mark, a couple of final questions. Love to know your sources of information, what you use to stay current, what you would advise, Siso's use to stay current, perhaps what book you're reading now or what you would recommend that. That we read.

Well, this kind of goes back to the thing we talked about earlier by being strategic and tactical and trying to figure out the right amount of time to do both. And, you know, in this, in our business today, you. You have to read a lot. I mean, I subscribe to. To probably a dozen different daily feeds, information intelligence feeds. I read a lot of, you know, a lot of the mainstream media news and validate it. You know, I think one of the, One of the big problems we have today is that anybody can become a reporter and anybody can post anything in social media. Yeah. The next thing you know, it's become gospel. But, you know, so, you know, I probably spend. Well, today, you know, I'm, I'm, I'm embarking on a new career now, and I have a lot of time on my hands. But I, But I always. I've always spent probably two, three, four hours a day just reading what's going on because it's important to stay in touch with, you know, what's happening in the world, especially with security, you know, when, when there's a lot, you know, the threatened vulnerability, environment changes on a daily basis. And that really influences how you, as a CISO or as a security professional are be able to do your job. Reading. Oh, my gosh. You know, it drives my wife crazy. But I always have probably at least three books going at any one time. You know, I always have some kind of professional reading. Yeah, I always have some kind of professional reading. I always have some kind of, you know, raunchy novel and then, you know, some kind of fiction or Nonfiction stuff. And I'm reading the last line right now about Winston Churchill, which is, it's really interesting. What a guy, what a guy he was. I'm reading another book called how to measure anything in cybersecurity Risk by Doug Hubbard. And this is really interesting because I heard him speak at an event in January. But one thing he said he didn't coin are wrong. But some models are useful. And when you think about what's happening with COVID 19 right now, every day you see a new model and the next day those models are proven wrong. But there is a little bit of good data in them. I'm reading a Ben Horowitz book. You know Ben Horowitz from, from Andreessen Horowitz. His latest book is what you do is who you are. And he's just, he's a. Just a kind of a plain vanilla. I shouldn't say plain vanilla because it's much more than that. But he's a down to earth writer. He's a guy that's just like having a. Reading his book is like having a conversation. But anyway, so those are the, you know, I think maybe the, the most interesting book I've ever read in my life, but also the most difficult book I ever read in my life was John McPhee. And he's an incredible writer. But he wrote a book called Annals of a formal World, which is a compilation of some other books he read. But essentially it's a walk through, a geologic walk through history how you know, how geology has evolved and you know, how geologists and archaeologists look at things. But it really changed my perspective on life when you realize. I think one of his quotes is something like in a thousand years I can't grow feathers on a bird, but in a million years I can grow feathers and fur. You know, just kind of a perspective on how time is so relevant or irrelevant in our short lifetime. Perspective.

Yeah. Fascinating. Thanks, Mark, for your time today. That was fantastic context for all of our listeners. We really appreciate it.

Thanks, Bob.

All right, see you.

Goodbye.

Thanks for listening to this Ooda Loop production. For the latest analysis on cybersecurity, technology and global risks, please visit www.ooda loop.