Essential CISO Skills and Strategies with Dr. Sly Cotton

Get ready to discover some of the most actionable DevOps techniques and tooling, including performance and reliability for some of the world's smartest engineers. Hey, I'm Joe Colantonio, host of the DevOps Toolchain podcast, and my goal is to help you create DevOps toolchain awesomeness. Hey, imagine waking up to find your organization's data compromise. What could you have done to prevent it? Well, joining us, we have Sly Cotton, who reveals the secret to robust cybersecurity and the indispensable role of the Chief Information Security Officer. Today, we'll be talking with Dr. Sly all about essential CISO skills and strategies, which are all covered in his book, Cyberspace Guardians, a comprehensive guide for choosing the right ciso. Really excited about this episode. You don't want to miss it. Check it out. Hey, if your app is slow, it could be worse than an error. It could be frustrating. And one thing I've Learned over my 25 years in industry is that frustrated users don't last long. But since slow performance isn't sudden, it's hard for standard error monitoring tools to catch. That's why I think you should check out bugsnag, an all in one observability solution that has a way to automatically watch for these issues. Real user monitoring. It checks and reports real user performance data in real time so you can quickly identify lags. Plus, you can get the context of where the lags are and how to fix them. Don't rely on frustrated user feedback. Find out for yourself. Go to bugsnag.com and try it for free. No credit card required. Check it out. Let me know what you think.

Hey, Sly, welcome to the guild.

Hey, great. Thanks a lot for having me there. Jill.

Yeah. Awesome to have you. I think you have a really cool background. So I thought before we jump into it, maybe you give us a little more info, like, how did you get into cybersecurity?

So, Joe, that's a great question. So I've been working cybersecurity now for roughly 30 years. You know, I started out in the military, and it was all about protecting the network from the enemy, making sure they don't get access to our information that could cause grave damage to the US or to the operation that we were executing. And then from there, it just. It just fascinated me how we could protect the most critical assets of the organization and the units. And then from there, it just blossomed into something I just couldn't get enough of, you know, especially with the proliferation of everything going to the Internet and AI it just became one of those topics that was critical for organizations and individuals.

Absolutely. So now I'm already off script. So with your background with cybersecurity intelligence, how critical is it nowadays, especially with an election? Do we have foreign actors actually still trying to break into things in the US all the time? Is that something that a normal company needs to worry about? That like they could be being hacked by another country?

Oh, yes. Even more so now than ever before. If you remember the last election, there were screams of voter fraud. Someone had hacked the voting machine and they kept voting over and over and over. And it was coming from, you know, an outside adversary. So with the protection of this election, you have to have those networks and infrastructure that are using those automated voting machine. It has to be 100% secure, where even the supply chain, the people that provide the computer chips, all of those have to be protected and ensure it is 100% safeguarded from vulnerability from the outside source.

How likely is that then? That's like something we should be concerned about because like you said, you don't even know. Maybe the chip could be design somewhere that actually has code in it. That can kind of be like a backdoor for folks, I guess. Yes.

So I think, is it highly unlikely? Primarily because we have this thing called a supply chain risk management, which means every chip that goes into a voting machine or every chip that goes into a piece of the network infrastructure, every hardware part that goes into that whole infrastructure, it's been ran through a security check at some point in time. It takes more than just hardware, so you got to protect the software that runs on that hardware as well. That's all part of the network infrastructure.

All right, so how likely is it that someone is an expert in both hardware and software then when it comes to security, is that a dual role?

It is, but I think I would tell you the only safe network is one that's not connected to the network. So, yeah, it is very likely. Every time you come up with a defense mechanism that will protect against the hardware or the software, the threat actors, they're coming up with a new way to get into that network to get around those secure areas that you just basically barricaded.

Great. So I'm sure there's some best practices. So what are one of the reasons inspired you to write then? Cyberspace Guardians?

It was primarily because a lot of organizations would get hit and they were getting hacked and they were getting exposed to ransomware. It was primarily because they had, I won't say the incorrect individual, but an individual that didn't have all the skills and capabilities to protect that network. A lot of time, what organization will do you have a great technician understand cyber security. The individual has been working with the organization 15, 20 years, and someone will go, hey, let's make this guy part of the C suite. So they make him the CISO or the chief Data Privacy officer or whatever you want to label the individual. But the individual may have been great at the technical proficiencies, but he didn't have the right skill set to be a visionary to think over the hill to see what's next that the adversary could be presenting for that. For that organization. So that's kind of what drove me to go, well, we got to make sure we're hiring the right people. And here's some of the characteristics of those right people that should be looking at this stuff from an organization perspective.

Absolutely. I will also think that with this particular role, you need to constantly be informed and constantly learning, relearning. So, I mean, I'm older, so I'm just curious to know if someone my age, how. If I had a CISO role, how has it evolved over the years, and how do people keep up with the evolution as it goes along?

Oh, that's. That's a great question, because I would tell you the role of the CISO has evolved over the years because protecting the network used to be, okay, you're in the C suite. That's not my problem. Give that to the IT department. And that's what it is. But now the IT strategy has to align with the organization strategy. The IT guys can't be in a corner somewhere doing their own thing, protecting the network, and then the C suite guys are near their corner doing the business strategy. Those two have to align. And so today, the CISO is part of that mesh where in the past, okay, IT department, go, protect us, make sure nobody gets into our network or get access to our proprietary data. So that's where the role of the CISO has, has emerged. The big thing is, if you're not the old school, they use the term lifelong learner. If you're not continuously learning about the threat and then where AI is going and things like that, you might get left behind, and you may not be up to date on the best practices for protecting the network and infrastructure for an organization. So you have to continuously study this stuff.

Absolutely. So, I mean, I guess just in case people don't know, why is it critical to protect data and systems now more than ever? We had one example of, you know, the elections are coming up. And I'm sure there's more common examples that are probably around now, especially with all the countries passing new regulations about data. Is that another reason why maybe protecting your data would be more important now than before?

Oh, yes. And I would tell you some of the big thing is your reputation for an organization. If you don't protect the data, it could be PII data on an individual or proprietary information for the organization. The first time you get hit with a security threat incident or whatever, if your customer base lose, lose faith in your organization to protect their private data, they're going to walk away. Once you lose the trust and confidence in your customer base, whether it be businesses or individuals, that your organization is going to have a tough time trying to rebuild. But so if you don't protect that data, it's not only the reputation, you're subject to financial laws. And you got to understand, if you don't protect it, you may be violating laws that you may not even know you're violating. Like things like hipaa, the Health Insurance Portability act, or the gdrp, like the General Data Protection Regulation. If you don't protect it, you could be violating those regulations and that could be reason for the government to come in and shut you down based on whatever operation you're running.

So I would think it's a hard gig because you can only set, I guess, standards. Right. Like how do you know the people that actually doing, you know, the developers and testers in your organization are not leaking data or releasing passwords to GitHub and all that? Like how do you get it in place that you're accountable, yet you also have everyone underneath you informed of what they need to do.

Yeah, so that's a continuous thing also because that insider threat thing is real. So if I'm developing a piece of software for you and if I'm putting backdoor channels in there, so if something happened, if I want to get into that network after you kickbooted me or something like that, you have to defend against vulnerabilities like, like that. So inside of threat actions, that's a real thing. But the way you get around that is you just have to continuously train the workforce. Here's the things you got to look out for. Here are the vulnerabilities that could potentially increase the risk of us getting an attack. And you got to make sure that the people that are developing the software, the hardware and installing your infrastructure, they're people that you can trust for one. And two, it has to be individual that you know that they're putting in the right stuff. And once the right stuff goes in the network, you have to test it. You got to validate, and you got to run it through security. What we call key performance parameters, KPPs and indicators. But that's how you get around the. I don't like the term insider threat, because any end user can be an insider threat, you know, but that's how you protect yourself against those guys.

That's a good point. When I read books on, like, real big hacks, a lot of times it's just someone talking to a real person and gaining that trust. It's not even like a technical thing. And I don't even know how you overcome that a lot of times.

Oh, yeah, because, I mean, there's ways. The big threat to organization now is still phishing opportunities. You get an individual that, hey, look, I know this is my bank. You know, I bank with those guys all the time. But as soon as you click that link, they got access to your. Inside your network. But again, you got to train the individual. And the way you do that, you know, you have those fishing exercises after you train people, you sit down and you do those lunch and learn and say, hey, look, here's what a bad URL look like. You see something like this and it's broken or bad English in the phishing link. Those are the kind of things you do not want to click on at a link from places and things that. And items that look just like that, you know. And I would tell you, especially with. In the age of social media, anybody see things that, hey, I'm familiar with this link, and they'll click on it in a heartbeat. And that's what the adversary want them to do. You know, as soon as they click on it, they got access to what they need.

Absolutely. I mean, this isn't related. I saw something on TikTok where someone booked a cruise a year in advance, and they kept talking about it on social media and they posted a picture and they didn't know in that picture had their. Their number, their number for the cruise. And someone was able to go in and cancel the trip without them knowing because they didn't know. They actually gave the information to someone to kind of hack them.

It happens all the time. The other thing that people don't get is they'll post a picture on TikTok and they don't look, they don't understand all the data around that picture. You know, the location it was taken at the time it was taken. All of that stuff is because they want to get that information and data onto the, the TikTok platform instantly, you know, without thinking through all the ramification of all the other strapped on data and information that's attached to that video or to that picture.

Absolutely. So I guess we've already determined you definitely need someone to be in charge of this. So I guess I should have started off with this question. How do you define what is a Chief Information Security Officer?

So the Chief Information Security officer, that's an individual, is all about threat mitigation, protecting the data. Things like, they have to understand things like regulatory compliance, reputation management, and they have to be able to work with a security team. But again, I go back to the whole thing about you can develop the strategy and vision for information and technology protection, the security of the organization, but if it's not linked to the operational goals and objective of the organization, you're building an expensive network that's not going to protect anybody. So that individual has to be someone that's passionate about protecting the data. Threat mitigation, looking forward and forward thinking about what could be the next potential threat to that organization. So that's kind of the role of the CISO and what they do on a day to day basis.

So what do you mean by the goal of the organization then? It's not like a cookie cutter approach then I assume it's like each organization would have their own potential risk areas. I guess, I mean, I guess it's a assume. That's true, but I'm not sure what are the goals that they need? Alignment.

So if a standard civilian organization, their goal is to grow the business, for example, they want to turn a 15% year over year profit. Here's our strategic goals and objective. Okay, Mr. Security Guy, what network and infrastructure do you think we need to have in place to reach these goals and objectives? First thing this guy might say, hey look, let's get rid of these big data centers that we have at the basement of our building. Let's put all this stuff in the cloud. And you go from that perspective, if you're a DoD or Department of Defense organization, it's totally separate in what I just described it is you got to have a security clearance, either secret, top secret or whatever. Some of them is TSSCI to just to access the network that you're going to be operating on. If you're in a medical field, you got to understand all those HIPAA regulations, you know, and your network may be structured, have to be structured where everything that you do has to be super high definition Cameras and all of that good stuff, because you may have to operate via Teladoc on an individual and they need a network that is super high def to do that. Where standard organization means, nah, we don't need all of that stuff. I just need voice capability. So the role of the SISU is he has to understand the operational environment he's operating in in order to build a network and infrastructure that's going to design, that is designed to support that specific type of business.

All right, so nowadays does everyone have this role, a ciso, or is this something that you think companies are just starting to realize, oh boy, we better get a competent CISO here.

They are now coming to that realization because, you know, like I said, most of the organization, like I have an IT department, you know, it consists of five or six guys, but those five or six guys in the IT department, they're concerned with, with making sure you can connect to the network, all the software is operating properly, you forget your password, you can reset the password. They're not thinking about how the business is going to grow and what do we need to help that business achieve its goals and objective. So the realization that you need a ciso, IT is definitely coming to fruition in this day and time, especially with the proliferation of AI and all the other things that are moving to the network and to the cloud.

It's a good point about AI. How do you pivot then? Like you said, you have an attack and then you have a way to get around it and someone comes up with a new attack constantly. Now, AI, do you see AI helping then with security to help kind of avoid these in the future, or is it just going to be like it is now, just quicker and faster now.

With AI, it is, but. But what I always tell people, with AI, you got to take the good pieces and you got to take the, and you got to be able to recognize the bad pieces of AI. AI can help you design a network, build a network, come up with the best optimal strategy to put in place. But the thing about with AI, when you start dealing with AI, there are so many bad things about AI, like deep fake AI, or you can take a sampling of my voice and take my picture and you can make my lips say whatever you wanted to say and you can post it and it looks just like I'm saying it, which. And I could be totally oblivious to what you're posting out there. So that's part of the bad side of AI. But the good part about it is you can ask AI to act as A cybersecurity expert and give us some context. Help me design this infrastructure, whatever, and it can assist you with doing it. But I always tell people you still need that human in the loop to go back, check what AI spit out and then you validate it. Because a lot of people will go, hey, AI did this. So it sounds great, but there are times when AI, because it uses open source information, it takes everything that's on the web. And if you're not validating it, you know, AI can spit some things out there that may not be 100% accurate.

So. Interesting. Use the case about deep fakes. How much does a CISO need to be care about that? Because I could assume someone could kind of generate a, a deep fake of a CEO saying something that could either tank their stock or do something that could be detrimental to the brand, or have them say something that is going to hurt the brand as well. Is that something they need to be aware of?

Oh, yes, that's. See, that's part of the whole skill validation of a ciso. They can't understand that, hey, if this is AI or this is real, and then there's tools that can help you do this stuff. That's part of that whole skill validation. That's why he says a CISO has to be a seasoned guy. Can't be an individual that just graduated college. You know, hey, I got this IT certification. No, but it's, it's someone with experience and knowledge that have kind of been around, that can understand what's real and what's fake and goes back to that whole validation process. If you think this is a little bit off, you have to validate it, you know.

All right, so that's a good point. This is actually a chapter in your book, I think required hard and soft skills for a ciso. So I guess what are some hard skills that are essential you see for a successful ciso?

So the hard skill, it kind of goes, goes to that thing about you're validating the knowledge of the individual in that position. If someone has something like a cissp, this, the Information Security Professional certification, that certification is globally recognized. When they see someone with that certification, this individual understand, has a deep understanding of security. So when they have the hard skills, that's a validation that this individual knows they're talking about those skills. Kind of give the individual the expertise they need to handle those incident and complex security challenges, if you will, when they happen. Because part of those hard skills is designed, what they're designed to do is when you have an Incident, it helps the individual understand here the priority for me to restore, I got to protect this data. I got to get this particular network back online. And then we worry about the rest of the stuff as we make time. But those hard skills prepare an individual to help bounce back from an incident response.

How about domain knowledge? I assume that, like you gave a few examples already, health care is completely different than if someone's in, yeah, I don't know, the Department of Defense or something.

Yeah, that domain knowledge is critical. You know, you got to understand the organization that you're working for, because if you don't, you'll go, you may apply a health care organization, you know, rules which doesn't apply to the organization that you're to see. So far, you manufacturing shoe heels, for lack of a better term. But you got to understand the organization, what the organization does, and what the vision of the organization is. And then you adapt. This your security infrastructure, your, your network, your defense of the network. All that based on the environment of the organization. It's not a cookie cutter approach. It is definitely based on the organization that you're supporting.

All right, how about soft skills? Everyone thinks all soft skills, just communication. Are there any specific soft skills you need?

So I tell people to look when they, when communication is a great one. But if you can't be a leader where you got to manage a security team, you're doomed to fail. You got to have some leadership qualities. You got to understand risk management. And I would tell you, when it comes to communication, funding drives everything. If you're a tech head and if you can't communicate your need to the C suite, you're not going to get anywhere as a leader because what, what will happen is the technical guy, the IT guy will go into the C suite boardroom meeting and go, he had four slides. And they'll go, hey, this is what we need. This is the security infrastructure we need to put in place. And that C suite team is sitting there going, if he has 40 slides, I'm not going to sit here and listen to this. So you got to be able to take a half a slide or one slide that I call and you get your point across. If you're a bad communication communicator, you're doomed to fail. If you're a poor leader, you're doomed to fail. If you don't understand the requirements of the individual you're supporting, you're doomed to fail. So I always tell people to take a look at those things that they call emotional intelligence and make sure you Build those into your leadership skills, the qualities it takes to really serve that position. Well, they would call them ciso.

Nice. So if someone wants to be a ciso, how do they develop some of these skills? I know for some reason this more than others, certifications really do matter. In some roles, not so much. So maybe like I know certification is probably one way or other. I know the ways that someone can develop these skills.

Oh yeah. So education is a big part. Most people now graduate college with a degree in cybersecurity, which didn't exist a few years ago. There were degrees in computer science is what that was the big sexy thing. But now you actually can get degrees in cybersecurity. So the of the bachelor's, the masters, and some PhDs in cybersecurity, that's a great start right there. So once you get that education, seek out the training and experience that, that's broad brush. Don't just stick to one field. The, the cybersecurity field is expensive. It's massive. So try to learn as much as you can about all the areas when it comes to protecting a network and infrastructure and don't pigeonhole yourself.

Love it. So, you know, you have a lot of experience. I know you must have some real world stories or examples of maybe where a CISO made a big impact on the organization's cybersecurity posture or something like that. You have any examples of that?

Yeah, so there's a few examples. And we at our current organization, we primarily support the Department of Defense. So most of the time the leadership, or the C suite as I typically call them, they have little faith in the IT department to protect a large network. So we went in, we kind of looked at the AS IS infrastructure on some of these organization. And then we talked to the C suite about their expectation. What do you want out of this? You know, out of your IT department. So we sit down with those guys and they were like, well, we have, we don't have the faith and confidence they can protect US because we CEOs talk to other CEOs and they go, hey, look, this is what I did, this is what I did. And whatever, they get together and then they go back and assess their own organization. But we went in and we talked to the CISOs and said, hey, this is what your CEO expect. And those guys, they kind of redefine their strategy. And at the end of that strategy, they went in and briefed the C suite on how the IT strategy aligned with the organizational strategy and the confidence that the CEO had in that IT department went through the roof and it was just the confident, that confidence that they knew these guys now understand the infrastructure because I've heard other CEOs that that is what they implement and they understand what the best practice is to protect our organization.

Love it. So, you know, it sounds like, you know what they are, you said is the good and bad. So a lot of times with certain careers, what they are, they're like, oh, this is going to be replaced, that's going to be replaced. What future trends do you see in the field of maybe cybersecurity and the role of a ciso? Is it going to be more and more tech heavy with AI or like, do you see it as a role that's going to be more in demand, less in demand, same?

Yeah. So be honest with you. AI is not designed to replace people. It is designed to help facilitate processes and procedures. It's designed to help people do their job more efficiently and more effectively. It's not designed to replace people so people will go, hey, I can reduce my workforce based on having these tool set and AI is one of them. So I personally think it's going to remain about the same. And if people take AI for what it was designed to do, to assist people in doing their job, you won't see a reduction in the requirements to have an individual sitting there at the terminal to validate threats and watch for vulnerabilities, attacks and things like that. So with the advent of AI, you won't see a huge reduction in the IT force.

Okay, Sly, before we go, is there one piece of actual advice you can give to someone to help them with their CISO cybersecurity efforts? And what's the best way to find contact? You will get our hands on your book on cybersecurity and ciso.

Okay, the one thing I would tell all those guys is continuously learn and improve yourself about all the ever changing challenges on the IT cybersecurity landscape. Got to be a lifelong learner. You just have to continuously stay on top of that thing. And I would tell you right now is a great time to get the book Cyberspace Guardian because it's on sale for 99 cents. For the audio audible version, the paperback is significantly discount. All you have to do to go to Amazon.com and search for Cyberspace Guardian or search for Dr. Sly Cotton and it'll pop up and you'll have the latest and greatest access to what we know as of today.

Remember, latency is the silent killer of your app. Don't rely on frustrated user feedback. You can know exactly what's happening and how to fix it with Bugsnag from SmartBear. See it for yourself. Go to Bugsnag.com and try for free. No credit card required. Check it out, let me know what you think.

And for links of everything of value we covered in this DevOps Toolchain show, head on over to test guild.com forward/p156 so that's it for this episode of the DevOps Toolchain Show. I'm Joe. My mission is to help you succeed creating end to end full stack DevOps toolchain awesomeness. As always, test everything and keep the good. Cheers. Hey, thanks again for listening. If you're not already part of our awesome community of 27,000 of the smartest testers, DevOps and automation professionals in the world, we'd love to have you join the fam@testguild.com and if you're in the DevOps automation software testing space or your test tool provider and want to offer real world value that can improve the skills or solve a problem for the Guild community, I'd love to hear from you. Head on over to testkill Info and let's make it happen.