Cybersecurity is Adversarial – Our Failures are Attackers Opportunities

Welcome to the Cybersecurity Vault. I'm your host, Matthew Rosenquist, CISO, industry cybersecurity strategist and advisor. And today, well, we're going to talk about big mistakes in our industry and how attackers see those as opportunities and how they will maneuver to take advantage of, well, our shortcomings. And I get the pleasure of talking with Chase Cunningham. Chase is the Vice President of Security Market Research at G2, is known in the cybersecurity circles as Dr. Zero Trust, and is one of the most, how should we say, larger than life, openly direct and opinionated people in the industry. Welcome, Chase. You're one of my favorite people to always chat with.

Well, thanks, man. I appreciate you letting me on this thing. It's always interesting when there's smart people to talk to, 'cause Lord knows I spend a lot of time talking to morons that don't know what they're doing. So anytime I get an invite from you, I'll be there.

Well, then I'm going to have to fake it. So, but I can do that. I can try and sound intelligent. Let's do that. But before we get into this topic of slamming bad cybersecurity discussions or decisions in our industry, I wanted to ask you if this is really a picture of you dressed as a pro wrestler, Randy Macho Man Savage, at the 2024 RSA conference.

Yeah, that's me. I mean, I, I'm one of those people that, uh, if I make a bet, by God, I'll live up to it if I do. And I lost. So hey, if I gotta run around in, uh, tights in front of 40,000 people, then so what?

I think it's a good look for you. I mean, you're a sizable guy, you can pull this off. I think you represent the That's the actual man right there.

Well, thank you. You know, I'm sure he's rolling over in his grave right now like, oh gosh, some nerd is dressed up as me, but it is what it is.

Uh, it's, it's starting to turn into Comic-Con. Okay, no, that works. You're, you're just out in front of the pack. You're leading. You're showcasing where our industry is gonna go. No, I like this. I like this.

Head of the curve. Ahead of the curve. Yeah.

All right. All right. So back to more serious issues, right? I mean, our industry is, well, it's adversarial in nature. I mean, we face off with, against intelligent adversaries and, you know, they love to take advantage of mistakes. And when we make a mistake, there is no shortage of people that, you know, really want to capitalize on that to maneuver to take advantage of it. So, what are you seeing? And I'm sure there's a few out there. What are you seeing as some of the biggest mistakes our industry is currently making?

I mean, to me, the one that continues to stick out, and I can't for the life of me understand why this is the way that it is. We've got decades of research. We have entire organizations built around this that tell us literally what is going to happen and how the avenues of compromise work. And people still wonder, how do we address this problem? It's like, let me, let me break it down for you, dude. If you go look at the Verizon DIBR and the Mandiant M-Trends and CISA and all these other organizations that have published research on attack vectors and how this works, you don't do what they say is going to be the problem. And that's pretty much how you start to avoid the issue. I, I, I can't wrap my head around the issue that we still have with bad passwords and phishing. Because, God, it's such a solvable problem. And we're still sitting here in 2024 wondering, like, how do we deal with this? It just is mind-boggling. There's, there's a lot of issues, but this is one that should have been buried and burned a long time ago.

So, you know, I agree. Being an easy victim. Well, that's just— that's insane, right? I mean, you're setting yourself up. So what's the root cause of that? Right. I mean, I can't imagine people sitting around a conference room going, hey, let's be the easiest victim in our in our sector. You know what, let's do that. Let's make an objective and do that. How do we do that, right? I mean, what is the root cause here of some of this? Yeah, I won't say dumb, but it's, you know, it's what— almost wanting to be a victim here. What's the root cause?

I mean, it's the nature of some of the stuff in this industry where they massage the numbers to really say that they have a solution to the problem. And I hate to break it to people, but people are going to be people. It doesn't matter how much you train them or those types of things. Like, it just is. And we can't put people that aren't technologists in a technology space and expect them to actually keep up with all the many different things that can go wrong here. So like, that's where it goes wrong, is we've got this misconception of, you know what, if I pay for this really good training program and I make sure that my people go through it, then we're going to get down to like a 3% level of phishing success. 3% for 100,000 people is a lot of people, you know what I mean? So it's, it's just that the, the massage of the numbers, massaging of the numbers is what causes the kind of buy-in on things that don't actually fix the problem. And then the other one that stands out to me too is the, the misconception of friction from security controls. Uh, if it was 5 years ago, I would agree with you. Like security controls were pretty miserable. They made you want to jump off a building, but now in general, you should be able to put controls in place that are relatively frictionless and you don't have the valid argument anymore, in my opinion, of like, oh, I can't do MFA. If you can't do MFA, then don't buckle your seatbelt. I mean, it's the same thing. Like, it's a technical control that will keep you from flying through the windshield. It takes 2 seconds to do it. Just do it.

So you've mentioned a whole bunch of things here. Let's unpack a few of them.

Yeah, sorry, I ranted a bit there.

No, no, this is all good. This is— I love this. This is like a rant. It makes me look good when I My rant, you know, there's technology issues, right? There are obviously behavioral issues. We see that in the data. There is technology that can help that simply isn't being used or utilized, right? You've got a seatbelt, why not use it? And that sounds like it's a leadership issue. And then, you know, what you started off with was, hey, why aren't you taking the readily available industry information, right? Here's your top 10 best practices. Why aren't you starting there? Right? So it sounds like we've got leadership problems. There are still challenges in technology and certainly behaviors. Right. And then the processes that wrap all that up. You're painting a pretty grim picture here. I mean, is this persistent among everybody that you're seeing? You know, how, how prolific are these mistakes?

I mean, it's one of those things where we're playing with giant numbers. I mean, we're talking about national level and in some cases like global type problems. So it's, it's, it's a big issue. But the funny thing is, when you really look at this and take a step back and aren't intimidated by the, the technology speak that we have, these problems are pretty solvable in general. Like you're never going to be perfect and you're never going to be bulletproof or hack-proof or whatever that term is, but you can, like you said, you can be not the slow gazelle, not the, you know, the person at the back of the pack. And that's what you're trying to get to. This, unfortunately, there's like to the leadership side, there's a realization here that a rising tide in cyber does not lift all ships. And I living at my house, if my neighbor down the street gets robbed, it sucks for them. But I didn't get robbed because I have Dobermans and German Shepherds and signs that I have guns and whatever else in front of my house. Like, it's deterrence. And I think that that's part of the realization that has to happen here too, is too many people are looking for technical perfection. It doesn't exist in cyber. It's deterrence and good defense and blocking and tackling and those things. And that's what you're trying to get to.

So first, mental note, don't visit your house uninvited. Okay, that's good. That's good. Good to know. Good to know for everyone watching as well. Well, um, but the second thing I'm hearing is, you know, you almost have to take a holistic approach, right? It isn't just I need to install this number one tool and then wash my hands, I'm done. But you do have to understand, okay, I've got my internal defense, but I should also understand, you know, does that make me ahead of the pack? Does that still make me that weak gazelle that's limping in the back saying come get me? I've got to understand how strong the particular attackers that would come after me are, right? If I'm a critical infrastructure, I'm in the critical infrastructure sectors, right? And I hold, you know, keys to the kingdom or something really important, that's probably a lot different than a mom-and-pop shop making nuts and bolts or sugar cookies. Right? So do you think that is one of the major issues that we're not looking at the problem holistically and we're just hoping that there is, oh, just install this tool. Oh, just buy this service. Where's, where's that easy button? Right?

Mm-hmm.

Mm-hmm. Do you think that is one of the major screw-ups that we're making? Yeah.

I mean, it's what we, what we don't have here. And I think it's because of just the kind of evolution of technology in general, right? Is we've got folks, where we're all used to, I have a problem, I go find an app or a piece of software and it solves my problem and I go on about my day. That, that happens to us 100 times a day. We're so used to it. We're geared for it. That just is what it is. In this space particularly, this is one of the only spaces where you've got this kind of perfect confluence of geopolitical issues and human problems and technology side and fiduciary response. Like, All of the things as a person in, you know, on planet Earth that you could imagine could be issues are all present in cyber. It's not like everywhere else where you can go, you know, I need a piece of budgeting software. Cool. Here's a piece of budgeting software. Go on about your day. There's no geopolitical risk to buying QuickBooks.

So I'm going to say something that's going to get me in trouble, and I totally want to bring you down with me. So I'm just trying to set expectations. You know, what you're talking about is I have a problem, bam, here's your solution, move on. That sounds a lot like engineering, right? The engineering mindset. Are you saying, and now I'm putting words in your mouth, are you saying that one of the mistakes that we make is potentially only looking at cybersecurity? As a technological engineering problem, and therefore we're going to create a solution, buy a solution, whatever, slap it on, and now life is good. That problem is solved. I'm going to go move on to the next one.

1,000%. I mean, that's as clear as it could possibly be. And that is the nature of what we're building here. The other one, just to throw a little gas on the fire that really stands out to me. Yeah. That really stands out to me is we've also got a market that's been created around this where it is pretty much infinite pot of money. You're never going to fix this problem, you know, whole hog. And there are a lot of folks, VCs and others, that have realized like people continue to dump money into cyber, so let's just make this a continuing thing. And that's why you have this crazy sort of foot-to-the-floor place of innovation and acquisition that continues to go on. Because I mean, I talk with CISOs all the time. They'll have problems kind of solved, and then whoever they had used to solve said problem gets acquired by a bigger vendor, and oh shit, they're back to square zero. And then they have to go through that again. And it's just like, how much money do I scream into the void here, or throw into the void, until I finally get to the next step?

Would you go as far as to say the industry, and I'm specifically talking about the vendors and service providers, the industry has financial incentives backwards where the financial incentives are really geared towards, hey, bad things happening here, you have to throw more money at it versus I really want to make you to where you don't have bad things. Do you know what I'm saying without me saying it?

Oh yeah. Oh no. I'm like, I'm, I'm real big into like, I guess you'd call it like fitness and holistic healthcare. And cyber to me is kind of like the regular medical industry, right? Of I have a sickness or an ouchie and I need medications. So I go talk to the doctor and wherever they can get me the pill to get that they've been provided, that's what they prescribe me and I get it and it treats the symptom. Whereas in a lot of times if people would step back and go, Why do my knees hurt? Well, I'm 100 pounds overweight. Okay, so how can I deal with knocking off 100 pounds of overweightness? My knees will get better, but that sucks because I got to work out and change my diet and whatever else. But over the long term, that strategic change, that lifestyle change will benefit me more. And I'm not dumping more money into this pill factory that's going to not solve the problem. Like the, like you were saying, the temporary relief by a financial means. Is a very real thing and change sucks. But strategy, if done correctly, has proven itself across all of history that it is valuable for bigger problems.

So shifting from that emergent care, right? If, if you get hurt or, you know, you've got rushing to the emergency room, triage, giving that pill, they're doing a couple of sutures and sending you on your way and not necessarily solving the root cause or addressing the root cause. I think that's a great analogy for our industry. And again, I'm trying to tell, well, what's the root cause of that? It's probably senior and executive management going, well, security is an overhead. What do I just have to invest to get rid of it, no longer make it a problem so I can continue on my business, you know, path and goals? Is it the fact that the security leadership is doing a poor job? Of communicating that this isn't a one-time thing, that this is a holistic systemic problem when we do have to invest in change and it doesn't necessarily go away, but I can reduce a lot of those, you know, costs and impacts down the road and talk the strategy, right? Versus the tactics. Is it—

I mean, it's— Us? Yeah, you're on point there. I think where we're wrong, and I include myself in this, right? Because I'm a security wonk, like, I wish that I had gone to school more for like an MBA instead of a doctorate because I think it would have been way more valuable and then kind of the career level I'm at now. We security people aren't doing a great job of translating the stuff that matters to these business folks and these operational people about why they should do this. Like the days of us being able to scare them into giving us a blank check, those are over because all those blank checks didn't provide defense, unfortunately. Like they were the, well, why the hell did I give you a million dollars and we just got breached? You know, you said we would never get breached. Like, that's, that's part of where we went wrong. So to your point, we need to be— I need to be better at translating, and I'm working hard at this, translating the business side of this, the operational side, the value proposition of security. And what's funny too, um, like I do workshops with people on zero trust, I have a slide that I show them and they— I say, look, let's look at the cyber slide. And the cyber slide is the Lockheed Martin kill chain, right? Business people and operational people, they go brain dead when they see that slide. But what I do is I take that slide and I invert it and I say, look, if I change the words here and I put it to a sales strategy, it's the same thing. Same thing. And all of a sudden they go, oh, it's like, yes, there, that's it. So now all I'm saying, business people, is this cyber stuff is a strategy. You just have to wrap your head around inverting what you do in sales and operations into the context of a threat action.

I'm actually seeing more and more CISOs go the MBA route because they realize I have to translate. I have to be able to have an organization that aligns towards the corporate value. If I don't do that, it's just not going to last. I can't keep coming and asking for a 20% year-over-year increase on my budget for an overhead group, right, where the business by definition says if you're an overhead group, we're going to make you more efficient and shrink your budget over time. You can't go against that current forever. Fear runs out. So yeah, I think you're right. I think there's a new set of disciplines that will set CISOs apart here in a very short period of time. And the ones that have that business acumen that can communicate that and talk about the strategy and long-term benefits and align to deliver those and contribute, they're going to be around. Everyone else is just not, right? Yeah.

And I mean, now that you've got the SEC and the IRS and the government getting involved here and speaking in terms like 8-K filings and those things, all of a sudden all the muckety-mucks that don't understand cyber, by God, they understand an SEC filing.

They do. That's a motivator. And if you don't have a security leader that can come in and speak to that and address that and understand what that is and everything else, the confidence level from the board. And I've talked to many, many, many boards. You know, their confidence in their CISO starts to go down. And then I start getting the calls saying, hey, can you come in and let us know, should we keep this CISO? Is it time for us to move on to a different CISO? You know, help us understand, right? Yeah.

So that's a hard conversation to have because, you know, you're like, they know their stuff, but they're not going to be the business people you need to do business things.

Yeah, and if that's what it takes, then that's now the evolution of the role. And if CISOs don't evolve, just like everything else, right? Darwinism takes over. Those people that aren't wearing the seat belts, Darwinism is going to take over. It just will eventually. Sooner or later.

Yeah, right? I mean, you can only dodge the specter for so long.

Yes, yes. Okay, so I want to get back to the attackers and making mistakes taking advantage of it. I want to do a little role-playing here for a moment, and I'm going to give you a persona of a malicious attacker, and I want to know from your evil perspective— this is evil Chase now, this is not good Chase with the halo and the wings coming to help, this is the evil Chase— who would you target and how would you go about that attack? So first persona, you're a cyber criminal. All everything is just about personal financial gain. Who are you going to attack? How are you going to do it?

I'm going to go after a business leader in an organization, but I'm going to go after their family. I'm going to put together some deepfake material that's their kids or someone's voice, and I'm going to target them and basically figure out a way to kind of cyber kidnap and say, look, you know, you've got X number of hours to give me access to your system or whatever, or give me some money or something, or bad things are going to happen to your kid. And I'll send you a call or a voicemail from your kid that's faked. And you'll respond to that. I think that, you know, what I remind people when I've done like those type of activities in the past is don't think that your family is not part of this game.

That's dark. I like it. Boy, you went dark and deep quick. Okay. Again, no, that makes sense with the dogs and the guns in the house. No, no, okay, that makes sense, that makes sense. Okay, all right, next persona, aggressive nation state. You're that China, Iran, North Korea, Russia, right? So you've got immense resources at your disposal and you're probably trying to do some type of geopolitical influence of some kind. How are you gonna do it? What are you going to go after?

So someone pretty high level within probably local government organization that has connections into other areas of networking. My, my plan would be probably to do a lot of looking on the dark web and see what I could find out that as far as a breach that was affiliated or tied to them, especially if like a medical record or healthcare system and there's something in there that they wouldn't want the world to know. Extortion would probably be the number one avenue for me. And then the part of the extortion follow-on would be, look, I'm going to send you a USB stick or a file or something like that that's got a dropper or download or keylogger or whatever, and you're going to install it everywhere I tell you to install it. And if you don't, then stand by for this to go public.

Nice. I like the spy angle of that, creating an insider. Again, insidious. Definitely insidious. Nice. All right. What about a data miner? Someone going out there looking for all sorts of records that they can leverage for their benefit or sell. What do you think? Who would you go after?

I mean, I think now with, with LLMs, you basically, the best thing to do would be to create your own LLM that did the mining for you to pull back that target information and then putting that in place where you could leverage it for the purposes of follow-on activity. This, this would be one where I wouldn't be concerned about like a one-and-done. This would be something I'd want to have long-term access to. Somebody that is like an admin on a system, in charge of a network, maybe they're a data center person, provider, something like that, so that I could get bigger access to bigger systems and stay there. And it's, you know, it's going to be prolific from that end. And then with all the data that's available from all the breaches that we've had, your ability to put something together that's a pretty valuable target package is through the roof.

Got it. So when you're seeing in the news, and there's always systems getting hacked or breached or poor architecture or terrible follow-up or didn't notify victims, all those kinds of things that we see in the news, is there anything egregious recently where you can look at it and go, wow, the mistake was this, right? The security or the executive team really failed to do X or they did Y in such a poor, you know, passion, it created a vulnerability that was exploitable. Is there anything that comes in your mind?

Snowflake was one just because of the way that the configuration was the problem there. And I mean, you're thinking of Snowflake that's, you know, billion-dollar valuation, raised all this money, whatever else, but the configuration for things they had connected into their systems were, I would call them kindergarten level and nobody was really, you know, taking care of that as Katie barred the door on how things were set up and run. And that's the part of the problem with a company that grows really fast and, you know, is getting crazy funding because the whole goal is grow, grow, grow, not fix, fix, fix. And it just leaves you in a bad place. And then the other one, not to, you know, beat the dead horse, but this whole Microsoft thing that's been continuing to fall out, like it's, it's just been a slow bleed of 1,000 cuts. And I, I'm really perplexed to that the federal government has issued some edicts about like, well, we're going to be all Microsoft. And it's going, well, wait a second, you guys are literally bringing the dude in front of Congress today and somebody's saying we're going to be all Microsoft tomorrow. Like, hang on a second.

Yeah, that's, um, that raises some questions. It, you know, it, it really does. So if we go back to the first one, Snowflake, right? And, and it's, it's not just that company. There's lots of companies, right? I mean, let's grow, grow, grow, and we see that all over the place. And yet engineering debt may start to grow on the cybersecurity space, or they haven't really been hit, so they're not really investing. They have the money to, but their focus is elsewhere, and they're simply not even considering, you know, the fact that, hey, something bad could happen. Um, do you think The real mistake there is at that board level, at the executive level? Do you think if they've got a security engineer architect, they're not being loud enough? I mean, where do you think the failure really should start to sit? Whose shoulders does this fall on?

So I'm going to go way up the chain. I'm going to say the failure actually lies with the federal government on those instances. And the reason I say that is none of the things that have been put in place have actual teeth. They're just words and sort of, you know, lipstick on a pig. So, there's no real reason for anyone to do anything. I mean, if you, even if somebody says, oh, well, PCI and HIPAA and HITRUST and all, find me one company that's had a major HIPAA or HITRUST or PCI validation or issue that's gone out of business. It hasn't happened. Even when you've seen the GDPR stuff, like Facebook just shenanigans their way around the GDPR issues. So, I lay the fault at the feet of the federal government where If, if we built airplanes the way that we allow people to build cyber infrastructure, I'd have 3 737s on my front lawn right now. And I mean, this affects every man, woman, and child in the country. And what the other thing that I think is worth pointing out too is last year in the United States, we know for a fact about 87 Americans died because of cyber-related issues at hospitals. 87 Americans died. And those are human beings that are no longer on planet Earth. But guess what? Every one of those purple people, because of the compromises that occurred, they had violations that took place along the current standard best practices and whatever else. There's no teeth. So until the federal government comes down with requirements for things like negligence and fraud and et cetera, et cetera, starts putting people in orange jumpsuits, it doesn't make a lick of difference. Like, I mean, the golden parachute for the CISOs and whatever else, By all means, if you want to fire me and give me $7 million, fire me today. I'm fine with that. Like, I will take your $7 million and be good. I, I just, I think that to me, that's the, the line that has to happen because organizations will do what they're trying to do. I don't think that there's malevolence in most of these organizations. They're not sitting around like Mr. Burns scheming about how not to get, you know, how to hack things or whatever, but there's no stick. There's lots of carrots. There's plenty of carrots, but there is no stick.

So the, you know, Dr. Evil figuring out, okay, we're just going to ignore this and, you know, let our customers and suppliers and vendors suffer. So what do you think about also shifting the financial incentives? You know, I mean, we live in a capitalistic environment and economy. Money tends to really motivate these companies. Is there a path that you think where if we make security and safety and trust and privacy, if we make that more relevant as a purchase criteria, right? And we increase that savvy with the consumers and those partners and insurance and everything else to say, oh no, this, this is important. Do you think that will also contribute to benefits in our industry, or is that— would that just take too long? Is that too high of a mountain to climb? What do you think?

I don't think it's too high of a mountain to climb. It's funny you mention that because I actually worked with a working group here in D.C. and we submitted paperwork up to the federal government that looks at, you know, how buildings can get LEED certified for their energy efficiency and energy efficiency.

Yes, right.

They get a tax credit because of that. So our position was, well, if an organization can verify and validate their security controls, Why can't they get some sort of LEED thing for cyber and they get a tax credit because they have good protections in place? And if you ever want to see any business move fast on anything, give them a tax credit.

Yeah. Oh yeah. No, I think it's a great idea. Right. And that puts incentives for them.

Yeah, it's— I mean, it's been done before. People are familiar with LEED. People are familiar with jumping through a couple hoops to get the feds to go, okay, cool, here's a 3% tax break on whatever. And Honestly, I think that that would be way more motivating for businesses. And I think it would also help the insurance industry out as well because they could look at it and go, look, they're Cyber Lead Certified, they get a tax credit. Okay, cool. I know that I can insure them and I'm not going to get my ass handed to me when they get breached for admin admin on a public-facing web server.

That doesn't happen. Come on.

Come on.

Yeah. So you mentioned insurance. Insurance, right? Do you think insurance in this overall bad decision-making discussion, do you think they're a good party or a caustic party?

Ooh.

Yeah.

I think that insurance in general is the empire of evil. I, I, uh, in just in general terms.

Don't sugarcoat this. I really kind of want to know what your thoughts are here.

I mean, yeah, I think that insurance is one of the greatest scams man ever came up with to make people feel better about bad decision-making. But it's one of those kind of necessary evils that does have a lot of influence. So, you know, there's a reason that it's there. I don't think that it is— the bad part is when organizations, like, you know, like they'll think like, well, we're insured. Like, that's not your strategy.

And that happens far too often. We both know. Oh, I don't need to worry about security. We'll just get it. We have insurance. It's fine, right? It's that nice warm blanket. It's impervious. We're fine.

Yeah. No one's ever been screwed by an insurance provider, right?

No, no, not at all. Not at all. Interesting. Interesting. Do you think they could have a role in helping the industry mature and get better and take more responsibility? Or do you think that's financially against their interests?

No, I think it's in their interest to see the industry get to a better space. That's why I think if there was this kind of drive from on high from the Fed to say like, look, we're going to come up with this kind of certification, we'll issue tax credits, and then the insurers can go, okay, cool. It's very much like what we currently have in the airline industry and the automotive industry. And that's well established. It's well understood. The insurers see that there's a line to victory there. If we could do that in cyber, it would make things better all across the board. And, you know, it's not something that should take 10 years and 3 administrations to do. It's something that could happen relatively quickly. I mean, literally, you could have the president issue an executive order on this stuff and it could be done in like a quarter. So that type of thing would be very, very beneficial. And for the insurers, most of them, even though they, you know, do the flimflam insurance thing, they're still getting their ass handed to them when a company does have a breach because they're dealing with it and they issued the policy, whether they're going to weasel out of it or not. That still is a thing that they have to deal with.

Yeah, the insurance and the reinsurance industry is, is feeling that pressure. And I know they want a lot more confidence in their estimates, right? That's how they make their money is on the margins in understanding that. And without that, it becomes very chaotic. Okay, so what can cybersecurity leaders do to help them not make bad decisions, to help their organizations avoid those pitfalls, right? Practically speaking, what can our audience start to do or should start to do?

So I think the biggest thing is look at the volumes of research that tell you how compromises occur and then begin to plot your progress towards a strategy around that. If you know, historically speaking, bad passwords and people clicking on links on the internet cause compromise, Put something in place that will alleviate that issue and then work your way going forward. And then on top of that, I think most organizations would be wise to ask themselves the real question, like, are we going to do cyber? Is it going to be something that we are actively engaged in, or is cyber something that we have to do? And if the, if the answer is, well, we have to do it, outsource it. Get an MSP, MSSP, bring in people that this is what they do all day, every day. They live, eat, sleep, and breathe cyber. Because you can't kind of half-ass your way through this. It's not going to work out well for you. And on top of that, guaranteed you will see financial benefit by bringing in a provider that knows what they're doing because you're not going to be spending your time trying to solve problems that they know how to solve. I, I don't know. I mean, I'm okay with like plumbing and stuff, but if my water heater goes out, guess what? I call a plumber because I got other stuff to do. I'm not going to be a cyber guy that also does plumbing. And just moving your way forward to that. And then the last piece, like you and I talked about, I think is the leadership here really should spend a lot of time, I would say more than half of their time, thinking about how to translate stuff into business and operational context and forget the cyber jargon.

Yeah, I see the leadership, they have to be that catalyst, right? I mean, the board members and the CEOs, they've got their own jobs to do. They're not going to learn cyber. They're relying on you. You're supposed to be the expert, so you have to communicate in their terms. You have to help make them understand how it's relevant to their objectives, and you should be the one stepping up, and everybody in your organization should be supporting that leadership and alignment in there.

Well, and don't take that job if you, you know, like, I've been offered a couple of pretty nice CISO jobs that would have been career makers for me, I turned them both down because I knew I was going to be either the sacrificial lamb or I was going to be the person that they brought in and just kind of tolerated. So, you know, if you're in that position, I mean, I'm not telling anybody what to do with their career, but I'm just saying, like, think about what you're, what you're willing to live with there, because it is not fun to be paraded out and nailed to the cross when, you know, when you're not the person that did something wrong.

No, it's, it's, it's a great point. Okay, so last question here, and this is not for the advice towards the CISO, right, or the VP of cybersecurity. This is for the rank-and-file security folks, right? I mean, it's great advice to give to a CISO. Hey, you want to, you know, when you take that job, are you just going to be that sacrificial lamb? Are you going to just be shoved in the corner and told to be quiet and not included and you have no power? But what about the people in the rank and file, right? I mean, they have a career too. Is it important for them to understand whether they do have a good security leader, whether they are going to be represented? Will that enable them to get, you know, further progress on their skills and their career? You know, how good is the executive layer? Do they appreciate security? What is your advice? To those rank-and-file security folks in understanding, is this organization going to be making a lot of mistakes and do I want to be part of it?

Yeah, I mean, if you, if, if you don't feel like steel is sharpening steel, then you're probably in the wrong place. And if you feel like it's steel rubbing on a rubber ball, like your CISO is just somebody that causes friction and isn't actually executing on stuff and makes it harder for you to do your job, that's probably not where you want to be. And because we're in a space where there's a negative unemployment employment rate. I think people should also remember in cyber, like, you have a lot of opportunity to use some leverage. You know, if you're, if you're the person that knows where all the bodies are buried and you think that they're doing the wrong things, stand up and say something, have some, you know, integrity. And then if they're not willing to respond to it, use your leverage. Like, look, I, I want to be here, I want to help this company, I think we can do great things. However, you're doing stuff that's going to cause us to get pwned. So don't do those things or I won't be here and watch what happens. You know, you're a resource, you're valuable, you have a lot of influence and use it when you can. And, you know, it's okay to tell people what they don't want to hear. I think we, we just in a general sense, we live in a world where too many people spend their time trying to blow flowers and perfume in people's ear when sometimes you got to blow, you know, straight smoke.

Okay, so let me throw a couple scenarios and you tell me, are they red flags, right, for the security staff or maybe even those partner groups, right, who are thinking, hey, we've got a security team, I don't know if they're good or not. A CISO or leader that was brought in from a different division, you know, HR, engineering, product group, finance, doesn't necessarily have a whole lot of security experience, but maybe a very sharp individual, right? Is that a red flag?

I don't think it's a red flag. I think it's like a yellowish flag just to kind of at least take the time and ask some questions because the majority of like people that we really need here in cyber, I don't think are hardcore cyber people. I think there are folks that understand the other side of the equation and HR and finance business and whatever else, they're great. I, on a project I'm on, I just brought in two people into cyber. One of them was working in a restaurant and the other person was a salesperson and they're kicking ass and taking names in cyber. So to me, it's really about like the, the proclivity and the interest and the willingness to do those things. However, if they're going to be in a leadership position for cyber, it's at least worth it to have that conversation and kind of go like, okay, well, you know, tell me what your thoughts are about disabling PowerShell on endpoint machines? Some simple questions. And if they go, uh, then you probably need to raise the flag a little higher.

Got it. What about an organization where the top cybersecurity person, the leader, is maybe several layers down in the organization, right? Doesn't report, have a direct line to the board, doesn't talk to the CEO. Maybe they report under a CIO or a CTO or even a layer beneath that. Is that a red flag?

I think that still is kind of a yellowish-orangey color because it's getting to that stage where, like, you need to move. That shouldn't be the way that it is. There should be a direct line between the CISO or security leader, whoever it is, and at least the CIO. I personally think I think in the best instance, the CEO talks directly to the security leader and gets around the kind of yes-man thing or yes-person thing that happens with other folks that aren't security people. You know, it can be, depending on the size and change in organizational and all the other structures that go on there, it can be a little bit difficult, but there should be some, some at least dotted line between leadership and security.

Okay, last one here. What about if an organization isn't vetting their products for vulnerabilities or doing pen tests? The, "Well, we've never been hacked before," or, "No, our code is fine. We don't need to look at that," or, you know, "Our engineers, they know what they're doing" kind of thing. Is that a red flag?

Oh, that's like red and plaid and, uh, on fire, like whatever kind of flag you could possibly imagine. So they should be doing regular testing, they should be accepting that they probably are compromised, they should not basically trust that their engineers are not doing engineering things, uh, you know, that people figure out ways around security controls, it's the nature. Like if you're a developer and your job is to ship code, guess what, you're gonna ship code however you can, whether or not security happens in is a different story. So yeah, I think that that is a giant flaming red flag of, you know, potential problems.

Okay. And to circle back around kind of where we started about the adversarial nature of our industry, um, do you respect the community of attackers out there?

Oh yeah. I mean, I, I, I think that the, that they are some very intelligent, some very potentially dangerous individuals. And I, I think about them like sharks and crocodiles or whatever. I want to be aware of them and I want to know that I need to stay away. I'm not afraid to get in the water with them, but if I can't see them and I don't know what they're doing, that's a different story.

That's awesome. I love that analogy, right? There's dangers everywhere, but if we understand it and we're aware and we take the proper measures, we can manage those risks. We can still live our lives, do our business, make, you know, the world a better place. But we have to understand, yeah, there's dangers out there. And those—

You know, my grandfather told me, yeah, when I was young, my grandfather told me once, because I said I was scared of the dark, and he said, you're not scared of the dark, you're scared of not being alone in the dark. And I was like, yes.

Well, none of us want to be alone in the dark when it comes to cybersecurity. Thank you, Chase, so much for all of your insights. Always a pleasure sir, chatting with you.

Thanks for having me on here. This is fun, man.

And thank you all for watching. Be sure to subscribe and catch all the Cybersecurity Vault episodes where we chat with industry leaders to dive into the most relevant and interesting cybersecurity challenges, perspectives, and best practices. We'll see you next time.