A Conversation with Cameron Over on Cybersecurity, Privacy, and Cyber Risk Management

Informing your decisions with intelligence analysis and insight brought to you by the team@oodaloop.com.

Welcome to today's Oodacast. Today we have Cameron over. Hello, Cameron.

Hello.

Hey, Cameron, before we get started, I wanted to introduce you to more of our community. Cameron leads the cybersecurity practice at Cross Country Consulting. I should say cyber and privacy as a practice. So, Cameron, you bring a deep wealth of experience to this and I want to talk about some of that. But I wanted to underscore that here you lead a line of business and you're a practitioner and that delivers the kind of experience and lessons learned and past performance that we love talking about. So thanks for coming on today.

Thanks for having me.

And Cameron, there's a lot going on in cybersecurity today and I have some several questions I want to ask you. Lessons learned that others can benefit from. But a key one I want to start with is how did you get your start in the cybersecurity field?

Yeah, it's probably an interesting story and not one that I know many people can tell. I grew up as an army brat. I was a kid growing up all over the world at various army bases. And actually my dad worked at an agency, disa, Defense Information Systems Agency. And I had the opportunity in 10th grade to actually start with the agency. And so I was one of the few 10th graders probably that I've ever heard of that had a security clearance and learned some early network discovery techniques before there were a lot of tools on the market for that. So I'd say right around 1996 was when I got my start in the field. And I'm one of those people, once I get into the groove of something, I don't like to let it go. And so I just followed that career through college, did computer science in college. And then right on the other side of school, I went to Electronic Data Systems and supported DISA again as a field Security operations Cross domain and UNIX security engineer.

So at your internship was that in the DISA headquarters building near the Pentagon?

Actually it was at the Park Ridge facility in Reston before they moved into Arlington. And so when I answered the phones, that was actually one of my roles. In high school, it was the Information Transport Engineering Systems Operations ite. And I worked with a lot of computer engineers and electrical engineers that taught me a lot about the ATM backbone network protocols. I used a lot of DOS command line commands over the summers and learned a lot about network security at the time.

That's great. It's got to be A fantastic way to start a career. So it's a neat foundational story and I'm glad we hit on it because it also kind of tells this subtext of the importance of STEM education and STEM training and internship programs like that even today.

Absolutely. And I think one thing I've seen that's really positive in my own children who are now 8 and 11, is keyboarding and coding very early on, even things like the games they like to play, like Minecraft and Roblox, the ability for them to use code versus just kind of clicking their way through a game. And so at home, I actually really stress for the kids to get in deeper and ask questions and watch videos on how to do more than just sort of play the interface, but actually get behind it and be able to make changes to the games.

Oh, that's cool. So Minecraft modding, where you can get in and create different things using code.

Yeah. And there's also, in Python, there's a really cool app you can download on a number of different types of devices called pythonista. And within that set of applications, you can go into existing games and make modifications, things like color and size of blocks, if you're doing Brick Breaker. And it's really fun for the kids to get in and kind of see how they can affect and change the game on the fly. That's cool.

It sounds like it's fun for adults too.

Yeah, I have more fun. My husband teases me a little bit, but I'm learning too, alongside them, so trying to give them the bug.

Yeah, I have noticed. I mean, you can use. You use the same real developer environments that you'll use in the enterprise if you want to do some Minecraft modding. So it's a great way to teach these ides.

Yep, absolutely.

So, Cameron, let me ask some other questions because you do have significant past performance in cybersecurity and leading teams and leading engagements with customers in multiple sectors of the economy. And there's a lot of discussion these days about things like education, training, certifications. I was just asked the other day by a very senior person who's in a career transition, which certification should I get? And people ask that question, and usually I respond with something like, you know, experience is far more important than certifications. But I noticed you have it all. You have education, you have training, and you have certifications. What importance should somebody place on those? And the reason I'm asking is I do get asked this question all the time. Should I get a certification? Should I be a cissp? Should I be a Sanskrit, and if I do that, will it help me get the job I want or transition into the cybersecurity world? Do you have any context on that?

Yeah. So I do think that it's a balance. I do think, you know, when I look for someone that I think would be a fit for my team, I look for a balance of both the discipline to have studied for and obtained certifications, as well as maintain those through continuous learning. But I do sometimes question or shy away from individuals that have, you know, 15 or more certifications. You know, sometimes you have someone that's really good at taking tests and adding lots of letters to their resume, which doesn't necessarily translate into the ability to take that knowledge and actually perform on the job. So I think it is all about balance. And I think we all know that within the cyber field, there are so many facets to it. And so whether someone comes from more a governance or a policy perspective, we might look for something on that side of the house, and there's a variety of them, including the ISC Squared Suite, CompTIA and a number of others. And if they're more technical, I might look for something like a certified ethical Hacker or similar certification there. OWASP certs those sorts of things. But I think what I look for is a healthy balance. For example, you know, having worked in both compliance and the more technical side, I always look to find, teach, or identify ways for folks to balance out their knowledge. So if they have worked more on the governance side, I want to give them exposure and understanding as to what implementing that or operationalizing a requirement or policy means. When you're a systems administrator or network administrator or you're trying to have things operating on a machine, you know, as soon as you go in and make changes to ports protocols or services based on a policy, you know, you could be rendering a system inoperable, you know, or changing the mission method of that system. And so I think for folks to understand that balance, it can come through a certification, it can certainly come through traditional education. But in some ways, you know, it's just the school of hard knocks. It's getting in there, making mistakes, learning on the job, always being curious and ready to learn more. One of my favorite interview questions is, what's the book you're reading? Or what podcast series do you listen to? How are you staying current? Because I also look for a degree of creativity and continuous learning, and I really think that's, you know, there's just a couple of key points that really make a resilient and well rounded professional. So Certs are great but I certainly don't look just Certs. I think it is a balance.

Yeah, that's good context. That helps a lot. And it does lead to the next series of questions I wanted to ask you which is so you have this extensive past performance you've delivered and improved and raised people's cybersecurity posture and their privacy posture for years. And I wanted to ask you a few questions aimed at other lessons that you've extracted from this time doing cybersecurity and privacy. Any lessons learned we ought to talk about or think through here.

So I think, you know, it's interesting. I spent 10 years at Booz Allen leading a lot of large initiatives for DISA and other agencies. And then the last five years I moved into the commercial space leading a practice across country. I'm also the chief information security officer of the cross country firm. And you know, I've learned a lot, I think both from being internal to an organization as well as serving other companies as whether it's augmenting an existing team, whether it's an engineering or architecture team or whether it's the more governance side. And I think what's important is there is no one size fits all approach. You have to really understand each organization and what their risk tolerance and risk position is. And certainly there's some really cool things you can bring into that. And we're doing this with a number of clients is looking at threat informed risk assessments, you know, looking at open source and other types of intelligence to identify, you know, the true threats that are facing an individual organization. And I hear this all the time because we work with middle market companies, we work with very large global organizations and every one of them says look, I don't want you to treat me like I'm X company or I'm Y company. We are our own company. We have our own unique risks, we have our own unique objectives. And so something that I've learned over time is yes, it's well and good to pull out NIST or ISO or something that has very rigorous requirements or, or control families for you to follow. But from there it really needs to be tailored and you need to consider the organization and what's best fit. And then how do you augment that with more specialized data and information like threat intelligence? How can you bring things like red teaming and attack simulations into that as well to educate and sort of upskill the organization as well as the maturity of their security and privacy programs. Great.

And this just, it flows from something else I've heard you say before in the past about compliance and security, whereas compliance is so critically important, but it does not equal security. Because just as you said, every company is different and these threat actors continue to change and they certainly understand the compliance regimes. So people talk a lot about threat models. What's the threat model to the enterprise based upon your unique mission needs?

Yeah, absolutely. So, you know, we do operate from, you know, if we're coming in through more of a governance or compliance lens, we try to ensure that we're really looking for holistic coverage to make sure that the organization doesn't have gaps. So for example, if it is more of a current checkbox exercise for the organization, if the spend around security is specific to compliance, we try to open their eyes a little bit to say, look, you know, you're following a checklist, you're following a guideline, but let's look a little bit deeper here and identify what maturity it is you're trying to achieve. And then how are you, and how is the, you know, commensurate team on the other end of that, the front line or the first line, if you're in a financial services space, how are they able to operationalize that and continuously monitor that? And do they have the right tools and technologies? And so one thing that we're bringing into conversations, if they're not already there, are utilizing things like the mitre, ATT and CK framework to really upskill or upgrade the current structure for how they're looking at compliance. And then from the security side, again, it is possible to over engineer a solution. So it's important to look at the roi. Where are you spending and where are you focusing your tools and technologies and your people and processes relative to your risk tolerance? What is your risk appetite in this space? And how do you want to have your systems and your people aligned commensurate with the risk that you're willing to take? And so to me, it's not, it should never be a check the box exercise. But should compliance be the main driver for spend? I think there's a lot of value that can be added there by looking deeper and trying to bring the deeper security side to it.

So you mentioned roi. That's a tough one, isn't it? How do you measure where you should spend your next dollar to mitigate risk? I'd love your thoughts on that. And in the context of compliance, sometimes one thing compliance can do for you is break through, break free some spending to help drive some security practice that, you know, you need to do. Do you have any comments or thoughts on either end of that, the ROI or the, you know, using compliance to get funding for a project?

Yeah, a couple. And I think you actually asked part of your question from before, I don't know that I fully got to. You asked about kind of threat modeling and threat frameworks. And so I think that's certainly one way, you know, if an organization is at the maturity or the appetite where a threat model is appropriate. And we're actually doing some work right now in the threat modeling space for a few clients, that's one way. So if you're looking at across sort of the pillars within a security program and you're trying to identify sort of the various threat actors and threat vectors to that organization, it helps identify priorities of where you want to spend based upon the identified gaps. Right. So that's one way. Another would be, let's say your CISO has a roadmap or a strategic plan and you want to kind of look across and see what technologies might be necessary there in order to achieve their vision and mission. And a third is to use something like mitre, ATT and ck. And we've done this with a number of organizations actually looking at the tech and security stacks as they are and comparing those against MITRE and looking where there might be gaps. And so a lot of times a client already has the tools in place, but they don't necessarily have the configurations or the interconnectivity between the systems to really fully achieve the mesh they're looking to get right from a visibility perspective as well as from a value perspective. A lot of times they're already spending or they have tech sprawl or shadow it. They don't even always know exactly what they have and what's being used. Or they have different groups disparately using the same technology, but they're not doing it in a way that's giving them the full picture. So I think as you're able to identify the technologies you have and how to best use them to achieve the right level of visibility and understanding of what's occurring on your network, I think that's where you're able to achieve more roi.

Awesome. That's very helpful. And it brings up another point too, which is, and I don't want to ask you to put any one organization on report, but have you ever seen an organization where everybody thinks the all digital risk belongs to the IT guy? It's a CISO only problem. Do you still see that today?

Yeah, you know, it's Interesting. We as a firm, our firm is just under 500 people and my team is right now at about 20. And we've grown quite quickly. But even in the five years I've been on the commercial side, it's still incredibly common to see the CISO only in their role for about 24 months or so. And what that means is typically as they change roles, you know, we kind of go along with them as a trusted partner, advisor to that practice. And so what you're seeing is the continued sort of scapegoating or, you know, CISOs being seen as the one that carry and hold and are responsible for the problem. When most of us know that a lot of times they're neither not given the funding or they're not given the seat at the table in the conversations, they're seen as, oh, you know, if you change the CISO or you change the IT leader, you're fixing the problem. And I think really that just goes further to a more systemic issue where organizations see it as something that only lives in those spaces and is not endemic to the organization as a whole.

So if you could offer advice to, let's say, members of a board or the CEO or COO of a large firm on how to change that dynamic, what would you say?

Yeah, I would say it starts with culture. You know, they say culture eats strategy for breakfast. And I truly believe that if you have a risk or a security based culture where organizations understand that it's important and hopefully it's at the core of every critical process you think about operational resilience. And you know, as an organization, like the top three processes that we have as a business are, you know, A, B and C, then they should be baking security as a cultural element into everything that they do. Otherwise there's a saying, people respect what you inspect. Right. If people know that you care as the board or as the C executive that is the one that speaks across the organization, then they're going to respect it too. And I think there's some also some really cool products out there from a training and awareness perspective that are also changing the way that we look at that from more of a cultural perspective and one that's more ingrained into the tech and security stack. So I think there's some really interesting and cool things happening there and I look forward to that, hopefully continuing to change the conversation as well.

Cool, that's great. That's very helpful. I think a couple other questions on that. Have you ever advised, I know you do this, you advise organizations when they need it on how to either stand up a security team or improve their current security team or even stand up a fully functioning security operations center. Do you have any best practices or lessons learned there that you could briefly give us that organizations should consider?

Yeah, you know, we're actually about to begin a new large project for a client where they have a great existing team that's been there for a long time. And I think coming in as a consulting group, it's easy, depending upon how we enter into the group to be considered. Oh, here they're, they're coming in to give us sort of the best case scenario, but it may not fit with our culture or, you know, they might see it as a threat to what they're already doing for their team. And I think while it may seem a little bit less, Maybe not, the first thing on your mind is to understand the culture of the team and make sure they see us as a trusted partner, not as someone that's going to come in and try to shake things up or impose on them something rigid and different from everything they've been doing. Because chances are there are things they're doing that are already effective. Right. It might just be tuning it in a way that is bringing greater visibility and greater roi. So I think the first thing is ensuring that there's the right message around what it is you're trying to change and messaging that in multiple forms. Because we all know people communicate in different ways. So making sure that the team members that are already there see you as additive, you know, and there to help them. You want to listen to what their thoughts are and everything that they've done and take that into account and not just come in and make massive sweeping changes right away. Unless that's the sort of the vision or the edict of the client that says, hey, everything's got to go right. But even then, for us to be successful, we need to be seen as a trusted partner and not someone that's going to come in and not listen or understand the benefits of the work that the team has already done.

Yeah, Cameron, that's great. And that also, that leads just directly to my next question because throughout this conversation we've talked about the importance of trust and you've earned trust personally because you have this past performance you've built up and people know you know what you're talking about. And professionally you have a great team that's built up trust as well. But I also want to mention that Cross Country Consulting is famous for their audit practice. And audit is another area where you Reach out to firms like cross country because of trust. And that organization continues to build trust. It's just the nature of the business. And it made me think how logical it is that you are operating in that organization cross Country. Even though audit and cybersecurity seem to be different things, they both require foundational trust. Is that the magic of why it works so well there?

Yeah, you know, that's a good question. I'd say 90% of the work that we do is not related to audit whatsoever. It could be in some cases that there are audit issues that have been raised where our team is coming in to help remediate or mitigate those findings or issues. I do think it's really important, you know, having worked in organizations where audit is not an element that the team understands to understand. So in financial service, it's just the three lines of defense. So you have your first line, which is typically your first line business, like often IT and security live there, finance lives there, HR, etc. Second line is oversight and governance. And then third line is audit, which reports directly to the board and the audit committee as a fully separate entity to the business. And I think to understand the structure of that and how it works, especially in public companies, is incredibly important because, you know, you cannot be the cowboy group that comes in and roughs everything up to get your objective done without understanding kind of the equal but opposite needs of audit. And for them to understand and for you to understand that there are risks and controls that need to be identified, that need to be often written or rewritten in order to cover from a compliance perspective. And so I think there needs to be a healthy understanding on both sides to do that. Typically we do work for the CISO organization or the IT operations if the CISO is not part of part of the organization. But we work very closely with audit teams. And actually something that's somewhat unique, over the last 18 months we've been seeing and doing some work. It's actually for the chief audit executive or VP of IT Audit and larger organizations where they're really advancing their maturity. So we're using MITRE through audit, the MITRE ATT and CK framework. We're using threat intelligence and open source intelligence as information to a risk assessment to build a cyber audit plan. We're doing red team and attack simulations through audit. Not just a penetration test, but deeper. Think about your tabletop. And now you want to actually execute testing against the tabletop in a live scenario test. And so what I really love is audit is coming to the table. And they're doing true and real testing, you know, and so we work alongside the audit community, the internal audit society. I've spoken at the Security Industries and Financial Markets association audit events, sifma, and it's really great to see them diving deeper because there's a lot of value that audit can and should bring. And I think sometimes they get a bad rap, but there's so much more that the audit groups can do utilizing security teams. And so I think that's great. And then from there, it often gives the CISO a platform. So if the CISO doesn't typically have budget and audit identifies deeper problems that otherwise they would not have been able to identify, it sometimes gives the CISO a voice they didn't previously have because now they have their compliance partner saying there's a problem. And so the CISO can go and take that. And now they have budget. Now they have the ability to go after those problems, to inform those problems, first of all through the audit, but then also to adjust their plan and obtain the budget in order to fix those down the road. So I think there's a really fantastic way that we've seen a number of CISOs working alongside audit together as partners. And I think that's really. It's evidence that in really strong organizations with the right culture alignment that Audit and FirstLine can work together to achieve a common objective from a security and separately compliance perspective.

Awesome helpful insight, as was this entire discussion. I really, really appreciate it. I just have one final question, Cameron.

Sure.

What book are you reading now?

Oh, that's a great question. So I am in the middle of hunting LaRue.

Oh, okay.

Yep. And I'm reading. I'm listening to it actually on. On Audible. I used to be commuting while listening, but now I'm home a lot more. So it's a little, you know, but I need to. I need to keep it on my schedule. Yep.

It is a good book and of course, based on this true story that reads like a drama, like an action.

Movie, you know, that's very well written. I love the. The author's depiction of the story and how it unravels. It's been great. I'm about halfway through. Cool.

All right, well, thanks again, Cameron. I really appreciate it.

Absolutely. My pleasure. Happy to be here.

Thanks for listening to this Ooda Loop production. For the latest analysis on cybersecurity technology and global risks, please visit www.ooda loop.

Com sam.