Why In The World Would You Want To Be A CISO? Mark Weatherford On Leading Change

Informing your decisions with intelligence analysis and insight brought to you by the team@ooda loop.com.

Hello, I'm Bob Gourley and welcome to the Oodacast. Today on the Oodacast, Mark Weatherford. Mark, how you doing today?

Hi Bob. I'm doing great, thank you.

Well, thanks for joining us. And Mark, before we get into this, I wanted to give people a little bit of your bio from my perspective because I've known you for so many years. When I first met you, you were in the Navy. You were a Navy cryptologist and you had a career in the Navy that lasted about 25 years. 26 years, yep. Retired from the Navy and worked for Raytheon as a while in the security domain. And from there you were the CISO of two of our greatest states. You were the security officer for Colorado. Beautiful state, wonderful place, wonderful people. And then you were also the Chief Security officer for the state of California, an incredibly large and technical state with many security issues. I know. Then you were brought into the NERC from there, the North America Electronic Reliability Council or something like that where you help protect the power grid. You were drafted to go back into government at the Department of Homeland Security during their formative years. You were a deputy undersecretary for cybersecurity, the first as they were maturing their cybersecurity effort. After you left Department of Homeland Security, you worked at places like Chertoff Group. You did a lot of work with startups and you returned to an operational CISO role also. Did I get the essence of that about right, Mark?

Pretty much, yeah. Pretty much. Right. Cool.

So what are you doing now?

That's a good question, Bob. What am I doing now? So I actually left full time employment in, in April. It was a planned, planned exit and my goal was I am, as you said, I work with a lot of startup companies right now, both as an investor and as an advisor. And my goal was to simply, you know, spend time helping these startups, you know, mature and become big companies. And so that was my goal. It didn't work out quite that way. There's a lot of opportunities out there and many of them came, came with, with arm twisting fashion and encouraged me to do other things. So I'm actually working. I am the Chief Strategy officer at the National Cybersecurity center right now, which is, it's a, not a full time, 100% job, but it's, it's where I'm spending a lot of my time now. We have a number of major kind of missions and Pillars for the National Cybersecurity center, probably the biggest is we were designated last year as the executive director for the space isac. So we're growing the space isac. We're bringing all of the players in the space community into this information sharing organization. And it's maybe one of the most, the greatest opportunities I've ever had to work with with a variety of very technical companies. I mean, all of the defense contractors, all of the, the other companies that are putting, you know, ships in space these days, people that are developing the technologies that are going on these and are going into satellites and how, how, you know, how are we securing all that stuff? So one of the things that I'm working right now on right now, very, very exciting. And that's, that's pretty much it. I mean, but that's, that's, that's kind of taking 110% of my time these days.

Yeah, man, this sounds cool. That's really exciting. And I want to get back to that in a minute. But first I wanted to return to your foundational story. So you joined the Navy 1975. 77, around there. What possessed you to join the Navy and enter this technical career path the way you did? I mean, the 70s, that's the disco era. I can imagine a young Mark Weatherford with long hair and these big collards and you joined the Navy.

Well, so interestingly, I actually grew up in Northern California in the farming community up there. So I was about this far on the opposite side of disco as you could possibly get. And in, you know, when I joined the Navy, I wanted to be a CB. You know, CBs, you know, they build roads and build bridges and drive heavy equipment and, and that was my goal. And, but the Navy had other ideas. You know, the Navy at the time you had to take this, this entrance exam that kind of assessed your abilities. The asvab. And my ASVAB said I was, I was qualified and should go into this advanced electronics area. So, so I did, I became a cryptologist, actually became a cryptologic technician, a maintenance guy working on electronic equipment. And at the time I worked on what was the first large communications computer in the, in the Navy, A land based system, not, didn't go shipboard. And so that's where, you know, in 1977, I was learning about, you know, assembly code and building computers. And it was a, it was just a marvelous time to be a young guy learning technology because it was, it was literally growing up around us at the time. So that's how I Ended up in the Navy. I mean, that's how I ended up getting in this advanced kind of technology arena.

Yeah. And then cryptography as a career field. Cryptologist, you guys study how to learn adversary secrets through technology and how to protect our secrets through technology. So. Must have been just positioned you very well as the world transitioned to a digital age, helping the Navy protect its secrets.

Yeah, well, you know, as we used to say, you know, intelligence officers can tell you what happened, cryptologists can tell you what's going to happen. And, and that's really, you know, we were. That's what we did. We, you know, we were in the signals intelligence space and we were exploiting, you know, the ether. And, and it was an exciting time is all I can say. You know, it's just a very, very exciting time.

And, you know, for. For those now currently in the Navy in that kind of field who are transitioning out, any thoughts for them or advice, your path was to go to one of the major integrators and help them out for a while. Any other advice you would have for folks transitioning?

Well, yeah, I mean, you know, I think it's different for everybody, but I think there's some foundational things, you know, and, and whether you stay for an entire career, like I did in the, in the Navy, or whether you do a tour and get out, I think, you know, kind of thinking really far in advance about what you want to do, what you enjoy is. And that doesn't matter. I think if you're. If you're a civilian or in the military, you know, doing what you enjoy. And I always looked at the Navy as, you know, they kept sending me to these cool places. They kept sending me to. To these interesting schools where I was learning all kinds of new stuff. I mean, I went to the Naval postgraduate school in 1992, and as I was kind of fishing around for ideas on what to write my thesis about, somebody suggested that I should write about Information Assurance. And I don't know if you remember back in 1994, at the time then there was not much being written about Information Assurance, information security. So I was. There was a. There was a, you know, doing research was. Was really a challenge. There were only a handful of people, literally a handful of people, you know, in the. In that I had access to that could help me with. With my research on Information Security. And. But, you know, I wrote my thesis and, you know, at the time, it got a little bit of exposure and interested, you know, people in the Navy said, hey, this might be this is an interesting idea. What's this guy doing? I ended up going to a job, and I became a network security officer at a Navy software support facility. And so, you know, again, thinking forward to the future, you know, my last job was, as you know, was down to Fleet Information Warfare center, where I was running defensive operations for the Navy. And. And it kind of. It was. It was a good kind of a transition for me to get out of the Navy. So I spent. I don't know, I probably spent the last 10 years of my career maybe. Yeah, 10 years of my career kind of thinking about, okay, what would life after the Navy be like? And I really worked hard on seeking out those really hard jobs in the Navy that would transition me. Well, cool.

That's good. Yeah. And now, related to that, I just imagine all of that background must have served you well, because you're in positions where you have to deal with a lot of information, a lot of it very chaotic, complex, or even deceptive information, and you have to sort that out and figure out what's important and then what's important to make decisions on. And it just seems so relevant to a field. As a security officer in the commercial industry, would you agree? Like, as a security officer, did that come in handy?

Yeah, I think, you know, being a ciso, my first CISO job was for the state of Colorado. And, you know, there in a state government organization, and I would say it's similar in any organization, but you have various components of the organization. You know, whether they're, you know, like in a state government, you have your transportation department, you have your health care department, you have, you know, all these different, you know, finance all these different government agencies and trying to bring them together and create some synergy around security across this very diverse organization. Of course, back in, you know, 2004, when I took the state of Colorado job, even the term CISO was relatively new then. So people were trying to figure out, you know, what do we. How do we do this? What do we do this? And I can remember, you know, going in front of the legislature, state legislature, and people just looked at me like, who are you? What are you doing? Why are we spending time with you? And, you know, and then there started to be a few kind of security incidents that kind of got people together. But, you know, to your point, about. About collecting information. Yeah, you're right. I think, you know, any. Anything you can do in a career that helps you to manage multiple projects, missions at the same time can help. And, you know, in the cyberspace today, and you know, I tell people this often. In 2004, you know, I could, I could reasonably call myself a security expert because the domain was fairly well bounded. And even though there was a lot of information, it was, you know, it was, it was things that we felt we could handle. You know, when some, when people, you know, want to be called a security expert today, especially a ciso, I think that's a little bit of a stretch because there's just so much to know. I mean, you can't be, you can have domain knowledge in one or two areas, but there's no way to have domain knowledge across the entire spectrum of information security these days.

Yeah. All right, that leads to my next question because, I mean, that is so prescient. And I want to ask a question about careers.

And.

Just as context, a lot of people come to you, I know, and say they're looking for a position to be filled. And then you reach out to your network and email people like me and say, do you know anybody who's interested in this position? And you. And you're just that kind of connector. And so a lot of folks are already coming to you and asking for, can you help them find the right person? Other people come to you and ask for career advice. And that's kind of the question I wanted to ask you. Now, for someone who wants a successful career in the cybersecurity world, do you have any advice or tips to them? Let's say they want to be a chief security officer in a large company?

Well, you know, the first thing I try to do is I try to identify what it is they really want to do. You know, some people want the CISO title and, you know, and that's where I dig in and say, do you really want to be a ciso? Because, I mean, this is not, this is not a trivial job these days, you know, especially if you're in a large company where you have to report to the board on a quarterly basis, where you have to sign the, the 10K and the 10Q every quarter, you know, you're literally, your signature is, can be used against you at some point, you know, if you have made a misstatement. So I think, you know, you know, really digging into what people want to do is important. And, you know, so, I mean, there's a lot of factors in it. You know, I have many friends that their careers have been limited simply because they didn't, weren't able to. And this is not a criticism. They weren't able to take advantage of an opportunity. You Know, maybe they lived in, on the east coast and a great job came open on the west coast, but they just weren't at a point in their life where they could make that transition. And so, you know, I try to tease these kinds of things out early in a conversation to see how flexible somebody is. You know, would they be willing to work for a cio? Would they willing be willing to be a deputy ciso, you know, as a stepping stone to being a ciso? Would they be willing to be a cso, which includes, you know, may include a lot of physical security responsibilities as well as information security responsibilities? You know, they. Would they be willing to step out of their comfort zone and, and working for a software company and go work for an electric utility company somewhere? I can remember when I took the, you know, when I was the wrapping up with the Schwarzenegger administration in California and Mike Asante called me. Mike was the CISO at the, or the CSO, excuse me, @ the North American Electric Reliability Corporation. He said, hey, I'm getting ready to leave. I want you to be my relief, my replacement. And I said, Mike, I know, you know, all the only thing I know about electricity is what I learned in the Navy, you know, on, on component level. I have no idea what the grid is, you know, what the, the bulk electric system in the United States is all about. And he said, don't worry about it, we'll figure it out. And so for me, it was a, it was a huge stretch to go into a, an industry that I really didn't know a lot about. Ended up being fairly successful there. And I think a part of it was because of my Navy background and learning a lot of the fundamentals of electricity, you know, way back when. But so I, you know, I tried, I really do try to kind of tease out what I think are some of the critical decision making factors in where do they want to go with a career? Because there's a lot of jobs. I mean, I, I got announcement for a job the other day in Paris and I sent that around and I got zero interest in it. And I get it, you know, and at the same time I got, some guy from Switzerland called me and he said, hey, I'm interested in coming back to the States. Can you help me? And so I, you know, made him a couple connections, but, but that's the other thing I try to do too is, you know, is I have in the back of my head, you know, these four or five jobs that I know that are open or going to potential be open and as I'm, you know, and I have a whole list of people, you know, that I kind of keep my eye out for. And I'm trying to figure out, you know, which people would be good for different jobs. And sometimes, you know, you know, I may make a recommendation, say, listen, here's a good job, but I don't think it's right for you for these reasons. And you know, and you know, I don't, I'm never going to stop somebody from doing something. So if somebody wants to be introduced to a headhunter or to a hiring manager somewhere, I'm more than happy to do it. But, but you got to take my, my unvarnished advice if you want to get to that stage of the game. Cool.

I want to ask another question. You know, our OODA network has a lot of CEOs, board members, chief operating officers, senior people. And most of the people in our network, I think are pretty savvy when it comes to cybersecurity because they've learned from the school of hard knocks. But I frequently run into people at that level who could use a little advice and I, you know, what should they care about when it comes to cybersecurity? And I know you've worked with a lot of boards and senior people and just wanted to ask you that question. What, what do you say to board members to get them thinking right, about risk mitigation in the cyber domain?

Yeah, so this is maybe probably the question I get most often and probably any CISO gets this. And I think the challenge is you want to be honest and realistic, but you want to avoid fud. You know, if you get into the scary Dangerous Game kind of stories, you know, I think you can lose some credibility there. But at the same time you have, you have to try to convey a sense of urgency around security to non technical people. And a good example that I just read about today, you know, Anthem had a data breach in 2015 and they spent hundreds of millions of dollars cleaning that thing up. Cleaning up the data breach today, or I guess the last month, September, they were just fined an additional $39.5 million as the, the last piece of the lawsuit. And this is what I try to convey to. In fact, I sent a note to a bunch of my friends this morning saying this is the kind of thing your board needs to understand when you go to them is you may have a data breach, but it may be five years before you wrap this thing up. And that's five years of this thing hanging over your head. And then at the end, you get another $39.5 million fine to go along with it. So I think conveying that to not just to the board, but to the CEO and the cfo, that there are really kind of long term implications to some of the risk making decisions you make today. And one of the things that I tell my colleagues and you know, there's a lot of people that have way more experience dealing with boards than I do, but I have a little bit of experience dealing with boards and I. Some successful and some not so successful. I'm pretty honest about that. But I think the most important, important thing that a security professional needs to think about when dealing with the board is that most boards are not technologists. Most people, I mean, I say meet the board where they are because you may have a CFO on there, you may have, you know, an HR manager on there, you may have a venture capitalist on there. You know, boards are made up of these people from a variety of different backgrounds. And if you try to, try to treat all of the board members the same way, you will be unsuccessful, I guarantee it. So meet them where they are. You know, I always advise people, establish a relationship with the board, you know, reach out to your individual board members so you know a little bit more about them. So you can kind of tailor your conversations, tailor your briefings to, to make sure that everybody is getting what they need to get out of that.

Great advice.

Thanks.

Mark. I want to transition now and ask you a few other questions if that's okay. Like you mentioned earlier. Yeah, you're always good about letting me put you on the spot and I appreciate it. See, earlier in the conversation you mentioned space and the space ISAC and what an exciting domain. At OODA Loop we're writing a lot about space. We did a special report on the cyber threat to Project Artemis, for example. Artemis, this plan to get humans back to the moon, first women to the moon within five years and have a permanent presence. And Mark, when I was growing up, the moon was just a big rock, but now, you know, they have discovered or on the moon, which can be used for all sorts of further space exploration projects. They've discovered ice on the moon, which of course could be incredibly useful to other projects. So there's a lot of reasons to go back to the moon. And Artemis is so exciting. But as we did this research on the cyber threat to Artemis and looked at who would want to attack. There's a huge threat.

Oh my God.

And as we started asking about what are the views about defense There's a huge gap. The attitude that we kept running into is who would want to attack us. This is the brotherhood of man going to the moon. This is all of humanity who would want to attack us. And that's one example. Another thing we write about at OODA Loop is the overall commercialization of space. And there's stuff going on right now that is going to impact the future of humanity in very positive ways. You know, remote sensing and so much other collection and the launching of three different major communications platforms into space. Starlink, for example, which is going to give you fiber optic speeds from space anywhere in the world. So much excitement and there too very little attention being given to cybersecurity. So when I hear you say space isac, it gives me hope that you're going to be able to make a big improvement there. And with more improvement, we will see more and more innovation in space. So would you please give me your thoughts on any of that? What is the mission of the space ISAC and what's your view of the threat?

Yeah, well, I mean, so I would agree with everything you just said and I will say, you know, my real interest in space came probably five years ago. I really started, you know, kind of digging into a little more. I gave a talk at NASA on supply chain and in my research for this talk, I realized, you know, the implications of how the supply chain could be disrupted or diverted to, or, you know, to be, to do things to the supply chain that end up and a satellite goes up and the satellites going to be there for the next 30 or 40 years. You know, if you get components that go into that satellite that you don't have a good, you don't know the provenance of those products, it's a big deal. And to NASA it's a huge deal. So they track, and this is, this is what I learned and my research for this thing, they track, you know, the, literally the, the birth, the genesis of every single thing that goes on to a satellite. You know, whether it's a nut or a bolt or grease or electronic components or, you know, or gears, where everything is, is, is critical to the supply chain of what goes into a satellite. What so you think of what Elon Musk is doing with SpaceX. You know, it just, it's mind blowing. It's, I mean not just, not just the SpaceX, them putting the rockets up, but that's mind blowing to me. The Starlink, what he's doing, throwing you know, 60 satellites up in the air at the top, at the same Time, you know, several times a month to build Starlink. Holy. It just, you know, it brings out the science fiction nerd in me. You know, where we're going. So, but back to where you said what you said about security and that is people are still saying, well, why would somebody do that? I can literally remember hearing people say that 20 years ago. Why would somebody want to hack my computer? Why, why would somebody want my password? And you know, and the answer is the same. Because they can. Because bad guys are bad guys for a reason. So I think, you know, and I can remember having this conversation 10 years ago when we're talking about IoT and we're saying, okay, let's get security right with IoT. You know, we screwed the pooch earlier. We have an opportunity to get security right with iot. You know, I think the, the court's still out on that. But, but we're at that point now. We have the opportunity to get security right with space and you know, and with all of these companies that are developing components and, and, and parts that are going into this infrastructure that is mind blowing. So, so back to space, Isaac. You know, our mission is the same as every other ISAC and that is to share threat vulnerability, security related information amongst this big group of people involved. And you know, it's more than, it's more than just the big defense industrial based contractors, but all of them are participating. It's more than the SpaceX's and the Blue Origins, it's the universities that are doing research, it's the little companies that are developing one piece of, one component that goes in a satellite or goes on a rocket. And there are literally thousands of these people that are in the supply chain. So being able to share security information more broadly and getting the support of the big guys that helps us bring in the small guys I think is really, it's a huge opportunity for the nation and it's a huge opportunity for the space ISAC to bring all these companies together. We're getting, right now, we're getting tremendous response from the community to do exactly that. It's just, it's a, it's a very exciting time. I WISH I was 20 years younger.

Fascinating. Well, thanks for that Mark, and let me transition now and ask another question. You know, it's great having you part of the OODA Loop network and we like providing information to guys like you and hope it's of use. But I would love to ask about your other information sources. What other sites do you read? Also tell me about your reading habits. Do you have any favorite books, any books you would recommend to us?

Well, I think, you know, I just told. Said I'm a, you know, kind of a science fiction nerd. So, you know, I would say, yeah, anything. I love Orson Scott Card. I like Asimov, I like Herbert Heinlein, all of the traditionalists, you know, you know, and I. And anything. I literally always have at least one science fiction book, you know, in queue. But, you know, I. It's kind of like music. I have a pretty wide variety of interests. I mean, one of the things I'm doing right now, I'm restudying the. The for my ham radio license. So I'm reading that, you know, reading, going through that book again. I just started a book called T Minus AI, which was. Looks like it's going to be really, really interesting. You know, I think you've probably heard me say this before. John McPhee. He's not a. He's not a geologist, but he's written a number of books on the world and how the earth has come together. And his, his kind of compendium is called Annals of a Former World. And I think it's the most fascinating book I ever read in my life. And, and for a whole lot of reasons. One of the reasons is I had to keep, you know, I had to keep. Read it on my iPad and I had to keep my dictionary up at the same time because every page almost there was a word that I didn't know and I had to go look up. I don't know, you know, I, I really do kind of read a whole bunch of different things. You know, fiction, science fiction. I read, you know, you know, the, the spy novels, all, everything, all, all about that. And then, and then always, you know, I've got a few technical books or, you know, things like that in Q. Obviously I read the Oodaloo, you know, every day. A member of the community. Anybody who doesn't subscribe to Brian Krebs is crazy. You know, I remember reading one thing. I can't remember who said it, so I can't give a good attribution, but they said if Brian Krebs is your first source of incident response, you probably have bigger security problems. But Brian Krebs does a phenomenal job on reporting. And, you know, he's got sources that most journalists would dream to have. And then, you know, I read all of the magazines. I mean, I don't know, I probably spend two hours every morning just reading, you know, what's happened overnight from the various different things that I look at. Cool.

Well, thanks, Mark. I'm going to capture as much of that as I can for our show notes and make sure to give good recommendations to all of our readers and watchers. I appreciate it, and so thanks for sharing this time with us. It's just been a fantastic overview and I really appreciate it.

You're welcome, Bob. Thanks for having me.

All right, thanks for listening to this OODA Loop Production. For the latest analysis on cybersecurity technology and global risks, please visit www.ooda loop.com.