Cybersecurity Leadership in a Dangerous World with Bob Zinga

Welcome to Cybersecurity Vault. I'm your host, Matthew Rosenquist, CISO, industry cybersecurity strategist and advisor. And today we're going to talk about the challenges and opportunities of cybersecurity leadership in a world that is becoming much more dangerous. And I get the pleasure of talking with Bob Zinga. Bob is the head of information security, information warfare commander, US Navy Reserve. He's also the former chief information security officer at Santa Clara University. He's a podcast host, a mentor, keynote speaker, and board advisor. Bob has an illustrious career in cybersecurity leadership, and we are very lucky in chatting with him today. Welcome, Bob. Thank you for coming.

Thank you. I appreciate that. I'm really, really glad to be here.

So given your depth of experience, How are you seeing the security of our digital world changing?

I see that in this century, right? The 21st century, the way things are going, I kind of had, I don't know if it was a premonition or what, but when I was 17 years old, just came to America originally to be a doctor, but eventually I became a cybersecurity engineer. Professional, but back then at 17, I kind of knew, I don't know where that came from, but I knew that in the future, 3 things would be important for me or anyone else in America and the world who want to be successful and thrive in this next century. Number 1 was technology. That's when mid-'90s, the internet just blew up. So I knew that wasn't gonna stop. It would just get more and more advanced, which it is. And then number 2, I felt like leadership, you need to be able to lead people because by yourself, you can only do so much, right? In order to go far, you need to have a team and you need to be able to deal with people. Like even as a commanding officer in the Navy, it's like people are your greatest asset, but also sometimes they're like the greatest pain in the rear end you've ever had, right? Depending on who they are. So you need to have the ability to work with people who are easy to work with, but also with those who are not easy to work with. The ability to work with people who are from the same generation as you, who have the same background. And those who also are much older or much, much younger. So it's a big, big difference. They have different motivation and being able to, and also in America being the melting pot that we are working with, no white, blacks, no diverse people, men, women, and all of that. So you really have to become an expert in dealing with people if you are going to make it in the 21st century. That's really what I felt like. And then the very last, last thing was business. You also have to have the basics for business. Part of the reason why I eventually got my master in business administration. So to answer your question, the way the digital world is evolving now, especially now with AI and quantum computing, which is just around the corner, which might maybe accelerate AI into AGI potentially, I don't know. We will see a super intelligence or maybe that's just a dream, but The way I see that as a security professional, number one, you need to be more than a technical leader, right? That's a given. But you really have to be able to help lead the organization, not just be impacted by the culture, but actually impact the culture of your organization where security becomes everybody's business. Security awareness is not just for the cybersecurity team, but it's for people in HR or people in finance, people across the entire organization. And also, kind of turn the security function in such a way that it enables business. It becomes a partner to all of the other functions across the entire organization. I think we need to do that more and more and more because I'm sure that has been your experiences too. Except for the Navy, everywhere else I have been, resources are always a problem. There is a constraint. We don't have enough money for you to do whatever you need. So you need to do a lot more with less. Right? And that's where I think your leadership skills are really going to come in and your ability to influence other people from other departments where you may need to borrow a budget from HR or from engineering or IT in order to do things in security that's going to benefit the entire organization. You need to be a better communicator, right? So people need to understand what you mean and how your security program is going to help them, right? What's in it for me type of thing. So you need to show how security adds a competitive advantage to all of the other business functions working together to accomplish the end goal and the mission of your organization. So I think in the 21st century, security leaders have to be much, much more than just a technical expert. They definitely need to be more business-minded.

So, you know, you had mentioned those 3 things: technology, leadership, and then business knowledge. If we look over the past 15 or 20 years, right, people coming up through the leadership in security, cybersecurity and whatnot, what area do you think has been kind of the strongest suit of those leaders and what areas are kind of the weakest for the leaders we currently have in place?

Yeah, I think in the industry it's been technical. We have a lot of very, very strong technician. And sometimes some of the CISOs I've had, they still want to be hands-on for some reason. I don't understand that. They shouldn't have time to do it. But I think even me, when I became a manager, it was very, very difficult for me, right? Because usually when you are selected for management, it's because you are good at what you do. You're an outstanding individual contributor. So you're doing it so well. Now the business thinks, okay, we need to promote you so you can help other people do it. But then you're like, These are people that don't do it as well as I do, and they're going to mess up and they're going to need time to learn. Let me just do it. So that is one thing I really, really had to learn as a leader, to really delegate and let go. Even if they make mistakes, that is okay. They need to learn through their mistakes and they need to learn how to do it to the quality, the standard of the organization, but then also not tell them exactly how to do it. Do it, but allow them to use their own mind and imagination. And they may actually surprise you. I've been surprised a couple of times, by the way, some of my direct reports went about doing things to get to the same result. So I guess you need to focus on outcome and also empowering people to do it because that also gives them kind of skin in the game, right? I'm not just like a robot, but I actually have agency and I want to do something. This is my part of the puzzle, right? I take ownership. Of this, I think it gives people some pride as well. They wake up on Monday morning and they want to go to work because they have a project, the team depends on them, and they feel like they are the only one who can do it. I think that really helps out with, again, the cultures that you are building for the security organization, but also the entire organization. So I really believe by doing those things, not only you improve the morale of the security team, but you also impact the create a, uh, culture within whatever organization and industry you are leading. Okay.

Yeah, as a leader, I mean, I've always enjoyed the position of being the least competent in the room. I love surrounding myself with hugely competent people, and I'm there to give the strategic direction, but they're the ones that figure out those tactical issues, right, in achieving that particular mission or objective. And I'm just kind of the orchestrator. I'm going to pull it all together. I'm not the smartest one. Oh no, far from it. But I'm organizing all these really smart and creative individuals. And then I get to learn, right? I get to see the magic that they can do. And I appreciate that. And I think, you know, they appreciate that. They appreciate being given challenging problems that they have to use their skills and their talents. And they feel accomplishment when they do.

Yes.

And being part of a community that recognizes that and embraces that. And even if you make a mistake, that's okay. You're still the smartest guy doing this, right? None of us could do any better. How can we help you? You know, that's a great environment for a leader to foster and for people to work in. That's the kind of team people want to work here.

Absolutely. So one thing about leadership is you really want your direct report to want to come to work. And then once they get there, you want them to want to do the very, very best that they can. General Powell, one of my great leaders, is not with us anymore, but he used to say, right, with management, you can only get to 100%. That's it. That's the math. You can go over it. However, with leadership, you can get people to go to 110%. Why is that? It's because of the motivation and the will. Because some people will do just enough not to get fired, just enough to do exactly what their job describes. Have you ever gone to someone and they say, oh, that's not my job. Description. And I think that's not the right attitude to have. If you are in security, yes, security is what we are here for, but you're supposed to be impacting finance, HR, and all of those other departments too. So having the mindset, I want to help, I want to add value, makes a huge, huge change. So the first question you asked me, yes, I think technical skills is really where we've been stuck for a long time. And I really believe we need to move into leadership. We need to move into business now more than ever. Before, right? Because the truth is security, IT, even the legal team, for the most part, we are kind of like cost centers to any organization. We cost a whole bunch of money, but we never bring in any revenue, right? So when I was CISO here in Silicon Valley for an AI startup, one of my main goals was to prove to the leadership that yes, security can at least help bring money, right? So being on those business calls, talking to prospective customers, saying, hey, you guys would not have got this deal if I wasn't around. It's because I convinced them that they could trust us. That's why they were able to sign in. Or like one KPI I was using there, it used to take them at least 3 to 4 months from the time someone was interested in the deal. And many times the reason why people wouldn't sign on the deal is because they wanted to make sure that their information remains secure and private. And then when I got on board, I was able to show that we went from 3 to 4 months to only about 30 days. And that's what I I was tracking and that really showed to the leadership of the organization, yes, security is important. We need to put more money there because it's actually helping us bring in more revenue. But that may not be like, for example, when I was CISO at Santa Clara University, we don't sell products or there wasn't really anything I could do there. But whatever organization you work for, try to find a way, how can I bring value? How can I get all of the other business functions to trust and support and partner with security to help them do their job more securely and easier. I think that's really the mindset you need to have. Starting to think as an entrepreneur in a way, but really being business-minded and using leadership skills, influence to affect all of the other people. Because the truth is, as you know, as a CISO, you have a lot of responsibility on paper, but you usually don't have any control over things that you are responsible for. And you really have to rely on the other folks to do the the right thing. And I think it's kind of where we are now.

Yeah. And I love that perspective of value, right? Providing more value. Yes. Avoiding bad things, you know, attacks and impacts and so forth. That's definitely important. Regulatory compliance also very, very important. But there is more to that story. And I love your KPI, right? The time to close the deal. That's a great KPI, right? Because you're contributing to that. And time is money and getting revenue on the books and all these things. And that's important to that business group. That's important to the C-suite. And that's important to the board and the investors they represent. So you're talking their language.

Mm-hmm. Yes. And we really need to get out of speaking technical jargon that nobody understands. I think, again, that's another reason why I felt like I needed to go get a MBA so I could speak the language of business because I think sometimes senior management don't really understand what security does. It's like they put money there, it goes into a black box, they're doing something trying to keep us safe, but they really don't see the value. And in some of the jobs I've had as the head of security or CISO, I really had to prove to the leadership that yes, I need to be here and this is why, this is what I bring. And now we had the discussion when you were on my podcast where security is kind of like a losing proposition. Sometimes it's not very easy to prove something that didn't happen, right? What is the value if you're saying, okay, we didn't have any cybersecurity incident this year and it's because of me, but how are you able to prove it? Now, when I was at the Defense Language Institute, I was the EDU for their EDU network, right? They've been on the DATML network for a very long time. But as you know, DATML, a lot of it is classified. But even if it's not, they have a whole lot of security controls that they have to put in place, which made it impossible to learn languages like Russian, like Arabic, Chinese. So they couldn't go to any other site. I mean, they just, the teachers could not do their job. So that's why they brought me in. They said, we want a good dad, Edu. However, because we are Army, we are DOD, we still need to make sure we put those security things in place.

Right.

When I was there, I kid you not, we were being attacked hundreds of thousands of times, almost a million times every single day. So what we were able to do to show to the commandant of the Base there is, okay, look, we get attacked this much and this is only what came through. But look at what our technology is able to stop. And I was able to prove that by going through the logs of our IPS. And then we updated our whitelist often and we did a lot of things to prevent exploitation of our crown jewel of our data. But what I'm saying is try to think outside of the box and think of ways where you can prove that yes, the budget you are spending in the security program, it is adding a lot of value, and this is the value it is adding. I think that makes a huge, huge difference.

Relevance and value, right? Yes. And it's not just for security. It's for any organization in the business.

Absolutely.

You have to be able to show that. We are not immune from that. We can't just use fear. Oh, there's bad things going to happen. We actually have to show it over time if we want to be sustainable.

Yeah. And when you talk about fear, right? There is a thing, F.E.A.R. Fear, uncertainty, and what is the—

Doubt.

Doubt. Yeah. So, and no, the sky is falling. The sky, like, remember Y2K, the world was supposed to come to an end. Oh yeah.

All the code programming. Yes.

And planes were going to fall off of the sky and all of that. But come to find out, no, none of that happened. So again, as a security leader, I think You have to be honest, right? You have to be frank. You really need to be in a position where people in the enterprise can trust you, all of the other business leaders and senior management. So don't overhype things. Like right now, I think AI is completely overhyped. It doesn't make sense. But eventually, I think what we think AI can do is going to be able to do in time, but we are not there. Right now. And of course, every vendor's now, anything they did, like even back in the day, we used to do heuristic, right? With some of the security thing. Now everything is just labeled AI. So much machine learning. Now it's AI. Like everything they can think of, AI, AI, just because they can sell it. And some companies now are evaluated way above their actual value. They don't even bring any money just because it's AI. Oh, look at that. It is worth more than a billion dollars. When in reality it's not even worth $100 million. So we really need to stop doing that because in the long term, that's not going to help us, right? We need to stay grounded, but we need to be frank and, and, you know, work with our teams and management to get the budget that we need in order to do the jobs that we can do. I think that's really where it comes down to.

You know, it's a great point. And I want to come back to the value. Of specifically leadership in cybersecurity, right? Leadership tends to have a much greater value in situations where you're dealing with chaos or unpredictability, ambiguity, intelligent adversaries, and so forth. And cybersecurity seems to fit that bill because we do have those things that we have to deal with. We've got people and technology and processes and adversaries. But if we look at the adversaries, and I kind of want your viewpoint here, what are the biggest areas around those adversaries or threats that makes them more dangerous in this cyber world? And you'd mentioned AI, right? They're using AI tools. But what is it about those adversaries? It's, this is not an IT challenge where we're trying to fix a server or network bandwidth or something we know how to do. You don't need leadership for that.

Yes, I think there are a couple of things. So AI, which we mentioned for sure, because with AI now, it's becoming very, very difficult. I don't know about you, but I would say maybe 5 years ago, if you showed me a deepfake, I could tell you this is not real, this is just trash. But today it's extremely difficult to tell the difference. Like even now with AI, I am building an AI twin. Coach Bizzy AI is what I call him. Looks just like me. But sometimes when you look at the picture of a photo, it's like, this is me. Like, I can tell the difference between this generated picture and reality. And if a cybersecurity professional cannot tell the difference, what chance does the average guy out there have? Like, I have to have special tools in order to tell for sure that this is fake and this isn't. So it is getting better and better. Like, I just remember When it first started, when they would make representation of people, they would have 4 fingers, 6 fingers, and it was just so easy to tell. But today it's just not possible. And also they use AI to weaponize targeted phishing, misinformation campaign, and this deception and all of those things that people are doing right now. And I think with the traditional cybersecurity team and tools and capacity we've had up to this point, it's going to be impossible to fight against this. There is just no comparison. So we are going to need to use AI tools in order to build security and our defenses. Now, the other one is supply chain and third-party risk. Everybody remembers SolarWinds. So now instead of going downstream, they go upstream, and then from there, they infiltrate dozens of downstream victims. And for SolarWinds, they were there for what, almost a year? And nobody even knew about it. So that's very, very, very scary. And there is so much interdependence right now, right? Tools that you use for managing your infrastructure, all of your vendor, but not just your vendor, but their vendors, and then the vendors of those vendors. So it's very, very, very complex, but there's definitely something I am quite concerned about. And then also, of course, identity and access. Exploitation. And like, I'm sure you heard about, um, those people mostly from, uh, North Korea, they've been getting some IT remote jobs and pretending to, to be things that they, they, they are not. And even facing interviews, there is now AI software you can use that's gonna change your face. So now people are asking them to stand up, to turn around, to make sure they are real.

Do a little dance. Yeah.

It's, it's just crazy. I mean, would, would have you imagined?

No.

It's like everything that was science fiction just a few years ago is becoming reality right in front of our eyes. So the risk isn't just data loss, I think, is really eroding that trust and the customer, the partner, even the employees, right? They will abandon companies that they just cannot trust with their data. Now, unfortunately, in America, we don't have a good privacy law. I don't know why that is. Maybe it's because of political reasons. Europe is much, much better than we are. Now we have the 1978 Privacy Act, but that's really an outdated law that's not relevant for today's age. But I guess Congress doesn't have the will to do the right thing. At least in California, we are trying CCPA and all of that. But yeah, but we're going to get to a point where people are just not going to be trusting companies that cannot keep their data secure. Because it's just too much at stake.

So are you concerned about quantum computing moving forward? Do you think there's going to need to be leadership in trying to manage that potential, you know, freight train?

Yeah, that's one thing that really keeps me awake at night, right? Because when you talk about security, talking about confidentiality, integrity, and availability, we've always relied on confidentiality because of all of the encryption and things, especially in the Navy Department of Defense. Now we go to war, we don't want the enemy to see what we are doing. And we really rely on encryption hardware and sometimes software. So with quantum computing, if you can break the encryption in like 2 seconds and you get access to everything, that's a real problem. Even this is out there and this is not classified. It is open source now, but China has a whole lot of our information that's encrypted. They cannot get to it. But data storage is extremely cheap, so they're just hanging onto it. Once they are able to break into the encryption, they're going to get access to everything. So it is really crazy. Just know the horrible things that could happen. It's really funny. I grew up a Christian, and when I was a kid, sometimes when you go to church, they would scare you, the end of the world and all of that. But it's like I didn't see a way this world could end. I couldn't see a possibility. But now I can tell you of 100 ways we can end this world. Right now with all of the technology we have. Actually, a few weeks ago, I was very, very scared with the conflict in Iran. I was extremely scared. And thank God nothing happened. But just like that, though, that could have started World War III, right? And it's just amazing how this world is so fragile. Even our democracy is so fragile. Like, at any point in, at any time, things could just explode and get to a point of no return where life wouldn't be the same as we've come to know it. So it's, uh, we, I guess we are living in very exciting time. I think there is a lot of challenges and a lot of threats, but there are a lot of opportunity as well. So I want to make sure I say that too, because I am so glad I was born in this period of time in history. Right. I don't think I would have made it, you know, when my grandparents, especially my great grandparents were alive, but right now it's very exciting. There are opportunity and there are things that you can do to improve yourself and to position yourself in such a way that you become a problem solver and you become a part of the solution and not a part of the problem, right?

So, so you deal with a lot of people in leadership position and help grooming them and helping them either move into a position or elevate as part of that. So tell me, in the cybersecurity world, what does it look like when you don't have good cybersecurity leadership?

Hmm.

Now don't mention any names here.

Yeah, yeah.

But what kind of characteristics do you see? What kind of problems manifest with poor leadership in cybersecurity?

I think it's really in any field, but now cybersecurity specifically, when it comes to leadership, the definition I love is what my primary mentor tells me, Dr. John C. Maxwell. He taught me that leadership is influence. Nothing more, nothing less. And I think that is so true. The ability to influence other people where they want to do the right thing, they want to collaborate with you. And they do not push back, especially when they see the value that it would add to themselves and their function. So when it comes to leadership too, I think another part of that in exercising influence is really emotional intelligence, right? Not just being self-aware, but being aware of other people, how you treat other people, your direct report, your supervisor, all of your peers, all of the other business function across the enterprise. I think that makes a huge, huge, huge difference, right? I think Maya Angelou, I believe, was the first one who says, people will forget anything you said, but they will never forget how you made them feel. That's really the thing that sticks with them. So you want to be the type of person, the type of leader that people want around. Oh, here is Bob Zinga. I'm so glad you are here. You're going to help me solve a problem. You are a solution. Not going to be complaining and bringing me more problem. I already have enough problem. Don't bring me more problem. Try to help me find solutions, right? So that attitude of collaboration and treating people right, I think is going to make a huge, huge difference. Some of the worst CISOs I have ever seen, they really didn't care about their folks. And I think people know it, right? One example on a podcast this morning, I was saying one of the worst boss I've ever worked for, like after the weekend you say, oh, Bob Zingale, whatever, how are you doing? You start telling them, oh, this is what happened. It's like, okay, whatever. Okay, you are a workhorse, these are the priority. You got, it's like work, work, work, work. We don't care about your personal life. We don't care if your wife almost died, whatever. You are at work. We want you to work. And that is not good because basically what that's going to do, your people are going to do just enough not to get fired, just enough to do exactly what you say, but no more. Right. But, um, when they, uh, that's why I really love the Navy because I can tell you for sure, the person to my right, the person to my left, if they need to, they are willing to take a bullet for me. I'm not related to them. I don't, I don't know them, but they are willing to do that. And I'm willing to do that for them as well. So how do you get a bunch of people to be willing to die for one another? I don't see that in Silicon Valley. Ah, where do you see it? Where people are willing to sacrifice for a much greater cause, for love of country, love of God, and the national, uh, it's like, there's gotta be a way to lead people so that they value something much higher than themselves because everybody is selfish. That is our nature. But, but how do you get them to really, really value people and want to add value and go above and beyond and do it voluntarily? That is really, really the key. Now, even in the Navy, when I got in 20 years ago, I think it was very much, you know, I guess let's say male toxicity. I know I am the boss. I'm the alpha man. And, you know, I say you jump, you say how high, and that kind of thing. But really the truth, one of the best skippers I've had actually have been women. But the truth is, if you are really in charge, if you are a leader, you don't have to say much. You don't have to raise your voice because people know that you are already a leader. And then when you open your mouth, when you speak, they listen to every single word that you say, and it makes a huge, huge impact. So I think definitely knowing your people, loving your people, caring about them, but really, really caring about them. I think that's really what makes the biggest difference. Because even when you do that, when you go through hard time, and everybody from time to time, you're going to go through a lot of challenges, people are going to be willing to stay longer. To work harder in order to help the company and their leader and their function. But if they are mercenary, they're just there for the paycheck. As soon as somebody else gives them $2 more per hour, goodbye. Right? So there is absolutely no loyalty or trust or anything like that. And that's really not what you want. And even like in the Navy, for the most part, people in the industry with the same skill set make a lot more money, sometimes even double, especially in Silicon Valley. But those people are willing to stay. And do that work because it matters, right? So you really have to get to what motivates people, how to bring them in and get them to buy into your vision. It's simpler to say than to do it, but I think that's really the challenge of leadership. And those leaders, they can really do great and wonderful things with smaller and fewer resources because they they got the key that unlocked almost unlimited potential, especially when people absolutely want to and not have to just because they get paid to do the job. So I think that's it.

Those are powerful concepts, right? Loyalty and trust and sacrifice. Do you think that is part of the evolving expectations that organizations have for leaders?

Well, in the industry, I don't know if you are going to expect that from everyone, but this is one thing I would say though. I think it's important to have the right culture. Like in Silicon Valley, all of the startup and all of even publicly traded company I have worked for, they would have flyers about these are company core values and all of that, but that's nonsense. They don't believe any of it because when push comes to shove, they just do whatever, and it's not aligned with the core value they said the organization believes in. Actually, even for most people outside of the military, just ask them, what is the mission of your organization? You're gonna get— you ask 10 people, you're gonna get 10 different answers. How's that possible? What are the core values of your organization? You're gonna get completely different answer. But in the Navy, like this morning, I talked to someone who's been retired for more than 10 years. I say, what are the core values of a sailor? Honor, courage, commitment. It's like, ingrained into our brain, like at the molecular level. I could be sleeping at night, you wake me up, my core values, honor, courage, commitment. Ooh, yeah. So, but in the corporate world, we don't do that. I know exactly what the mission of the Navy is, what the mission of my unit is, and what my portion of it is, what I need to do, what my team relies on me to do in order for the units to be successful. So I think that has a lot to do with the culture. And I think companies that do extremely well, they they just have a much better culture. And they don't order, but they encourage people to act the right way. And when they do, they get rewarded accordingly. Now, one simple example I'm going to give you. How many times have you seen someone get promoted, get rewarded, just because they did one thing the company wanted as part of a mission, bringing in revenue. They are horrible to their staff, but still they bring in too much money. We are not going to fire them. In our core value, or even the HR handbook, we said this is not acceptable, but still we are going to promote them and not promote somebody else who is completely aligned with what you say are your core values. So I think what needs to happen is the company needs to really be authentic and have integrity and really do what they say they do. It doesn't matter who you are, even if you are the CEO of the company, these are the rules, this is what everybody needs to abide with. So you have to lead by example. And the minute you stop doing that, I think what's going to happen is your best people are going to be looking for a job somewhere else. They're not going to complain, they're not going to say anything, they're just going to get another offer and get out of it. So I think integrity is extremely important. If you have core value, really think about what those core values are and what what is the culture that represents your organization, and then you have to stick with it no matter what, no exception. And I think that's going to allow a lot of organizations to improve significantly. I think that's kind of what happened at Microsoft when Satya became their CEO. Microsoft came from way, way, way back to now becoming again, you know, one of the most valuable companies in the world. I talk with a lot of the executives just just the changes that went through with his leadership, it was just like night and day. Nothing wrong with Steve Ballmer, who was president before, but definitely the leadership style completely different. Many of them were very scared to go to work and to do the right thing, but now it's become a learning organization. It's okay to make mistakes as long as you learn from those mistakes, right? Kind of like we do in Silicon Valley where you have psychological safety. You can ask questions. Just because I'm your boss doesn't mean that all of my ideas are correct and I need to be challenged now, respectfully, professionally, but I do need to be challenged at times. So building that environment where people can speak up when they need to, where they don't feel threatened, where they feel they are being cared for, I think that really goes a long way into making everyone productive. But again, that's not a technical thing. That has nothing to do with setting up firewall rules or anything like that. But it's really dealing with people. And like we say, people are the most important resources, asset of the organization. But guess what? The very first time that an organization goes through some financial difficulty, first thing we're going to do is lay off half of the team. It's like, okay, then you didn't mean any of that, you know? And like one company I work for, one of the core values, I'm telling you on paper, I'm not kidding, dinner at home with your family. I'm like, wow, I've never seen that for— I'm sorry, that's wonderful. But guess what? Most people stay at work at 7, 8 PM still working and nobody ever— and then the day you start to go home to have dinner with your family, people look at you like cross-eyed. Like even they have things like, okay, in this company, this is so wonderful. We don't have vacation days. You take as much vacation as you need. As long as your supervisor is okay with it, you can even go for a year if your boss agrees. But the minute you take 2 weeks vacation, like, what's wrong with you? Where have you been? We need you here. So it's like what they're saying. Doesn't match with what they are doing. And I think as a leader for your security function and for your organization, you need to start doing, mean what you say and live by it. I think that's going to attract a lot of people who want to add value and encourage others.

Well, that kind of organizational level cultural change, completely powerful, right? Do you think the cybersecurity leader, do you think they're in a good position to drive that kind of change across the organization?

I think they should. As a CISO, I think that is really part of my job. Now, again, of course, there are some things that are completely outside of your control, especially when it comes to budgeting and things like that. But one thing you can do, again, is use your soft skills, your influence to try to persuade people to do the right thing. Now, it's not always easy, but I think it is a must because we are, like in the Navy, for example, a lot of time we really are in a, not only a constrained environment, but we get attacked quite a lot, right? So there is not really a lot of room to make a lot of mistakes. So you really have to utilize the resources you have to the very best of your ability, because there is this, I guess, asymmetrical warfare now with technology. The price of technology is getting cheaper and cheaper, storage and hardware and all of that. So you don't even have to be a country, you don't have to be a nation state, you can just be one individual. You could spend maybe $5,000 or something and you can build something that is powerful enough where you can do a lot of damage. So we are living in a world now where I think with the advancement of AI, emerging technology and all of that, where it is becoming easier and easier for people to use the tools available to them to cause great harm. And the problem with being a CISO is you have to be right 100% of the time, but the bad guy only has to be right one time. If they can succeed just at one time, they could take the entire service down. So it is very, very challenging. It is not easy. But I think as a security leader, you need to do the very best you can to really influence your peers and senior management, senior leadership of your organization. You really need a true seat at the table. In many organizations I've been in, I would say the CISO is a an executive, the chief something, but in reality, it's not the C-level anything. It's just a director or a senior director in reality, because they, they're not even invited at some of the meetings that are critical for the strategic goals of the company, which doesn't make any sense. So, uh, I guess you have to bring in your own chair if you have to, but at least you have to be in the room. Even if you don't say anything, you at least need to know what the company is doing, where they are heading so that you can come up with the plan to have mitigation controls in place to safeguard the data of your company. So I think it's important if you are a CISO to be a real CISO and that C really needs to mean something. And I think it starts with influencing your peers and all of the other people across your organization, right? You have to be visible and you have to have a desire to be helpful. I don't know if I may have mentioned that earlier, but one of the first jobs I had here in Silicon Valley, it was impossible to find the security team. You couldn't find us anywhere. Because, you know, like in Silicon Valley, in most companies, it's almost like it was architected by the same architect. It's like open space. Everybody has those desks there and working together. Now, senior management, like the CEO, may have his own office or something. But even in many startups, the CEO is even out there with everybody else. But in this company, Security was nowhere to be found. You had to go far, far, far on the other side of a building on another floor in order to find the security team. But even when you took the time to take, you know, 10, 15 minutes to walk all the way there, you couldn't get in the room. You had to have a special key that only the security folks, geeks, had. So it was like we were telling them, we don't want you, we don't need you, go away. We are not here to help. We are our own silo doing our own thing. And then all they would see would be an email from senior security engineer Zynga telling them, "Hey, you are doing bad. You need to patch your system. What are you doing, engineer?" So, and then those people would just ignore me because they're like, "Okay, who are you? Oh, you have too many things to do. I'm not gonna add on to what I'm doing." So this is a real example that happened to me and I really had to learn from it. So what I ended up doing is, okay, most of the engineers, I was in Palo Alto where the HQ was, most of the engineers worked in San Francisco. So what I decided to do, every Thursday afternoon, I would leave Palo Alto, actually no, Thursday morning, actually I wouldn't even go to Palo Alto, I would go straight to San Francisco every Thursday. I would spend the day there, they got to know me. I got to know, as you know, Agile methodology, they do a lot of pairing and stuff. So they got to put a face to a name and see that I'm a real person and I really care about them and what they're doing. And also, no, feeling empathy, again, that emotional intelligence, being aware. Yes, I know it's tough and you have a lot of things to do, but listen, this is very important. What we are doing, if we don't do this, you know, we could get hacked and then, you know, especially this company, we were definitely going to go public and everybody was going to make a small fortune. And if this happened, that's not going to happen. So it's in your best interest to help me do that. So anyway, with time, they started trusting me. And then when I send those emails, it's like, okay, I know you and I know where you're coming from. And then we'll work together. In order to solve those problems. But so I guess in a small way, even as a security engineer, I was able to impact the culture of my world. Maybe not at the CEO level or the vice president of engineering, but they are engineers, the senior engineers, they knew me and I had definitely an impact on them and they had an impact on me. So I think no matter where you are at whatever level you are at, it doesn't cost much, right? To be kind, to reach out, and to try to help. Nobody is going to say, no, I don't want help from security. Actually, they're going to be glad if you offered some type of help and then vice versa. So it's that culture, I think, that really needs to be built. And as a security leader, I think you have to be in front of all of that.

Well, it sounds like you went out of your way to build the rapport and to be able to show and communicate that value of partnership. Yes. And that you're all in it together. It's teamwork. It's the opposite of getting a phone call from somebody behind a locked door that's just telling you no, or you're wrong, or go fix something. It's somebody that's with you and accessible and wants to help you and wants you to be successful, wants you to be protected against these other bad things. You're on the same team. Team.

Yes.

And you have that trust., and that, that's why, again, emphasizes that value to them, to their project, to their team, to the company, to the shareholders, investors, or whom, you know, whatever.

Absolutely.

Uh, hugely important.

And like, even when I, when I was enlisted in the Navy, right, when I became a commanding officer, my two leadership maxims, which, you know, I guess sometimes you don't even have to be sat down and taught, you know, you, you, you just, you just get it. I mean, it's like you just such an environment that's dynamic where it happens every day that you, you just become what your environment is. So two leadership maxims I've grown up with in the Navy is mission first, people always. You cannot accomplish a mission without your people. You take care of the people, the people will take care of the mission. Extremely, extremely important. And then the second one, I think that's just as important is one team, one fight. You alluded to that. It's not us against them, it's us together. How can we work together in order to do this? So it's like, you know, when there is an incident or problem, it's not blaming someone. Okay, this is the problem. How do we solve it? And then what can we learn from that? And whenever we have a lot of after-action report and all of that, we always go back. Like the X-Pilot I talked today, for every single mission they are given, when it's extremely successful, first there is a debrief and then they go to the execution. And then after that is the after action report, always. What went right, what went wrong, and what can we do better? So it's, I think that learning culture that really makes a huge, huge difference for any organization.

Continuous improvement cycles.

Yes, absolutely.

So cybersecurity is ambiguous. It's expensive. It creates friction to the business. So What messages do you communicate to those other C-suite officers and to boards to help them understand how they can help make cybersecurity successful, valuable, and sustainable over time? What messages do you give to them?

Well, I think as the CISO, you definitely need to elevate security to the business level, I think that is a must, right? There's no if and but about it. You are a business leader, one who leads one of the other business functions within the enterprise, and you really have to integrate cyber into enterprise risk management. Because for most businesses, they understand financial management very, very well. And I think you can handle cyber risk, IT risk, the same way you do financial risk. It's really, you know, the same thing. And being able to talk in that way, in a language that your peers understand, that senior management understand, I think is a huge plus. I think the pro and the con, again, sometimes you don't always have the last say, but they should definitely listen to you and your recommendation. Okay, if this is what you want, the budget you've given me, I can give you that. But if you give me more budget, this is what I can give, and here are the risks. Now, one thing I've had to do, especially in Silicon Valley, because sometimes I'm afraid they would hire a CISO just so that you'd be the scapegoat when something goes bad. They don't give you the resources, they don't give you the people, they don't give you the budget, and then when anything goes wrong, oh, you did it, it's your responsibility. So what I started doing was, okay, I put it in writing. Hey guys, red flag here. This is an issue we really need to get to this. And then what I would do, I would say, this risk is moving from the cybersecurity function into the sales function or engineering or whoever actually owns the system and the responsibility to patch or whatever it might be. So I officially move the risk from cybersecurity to over there. So if anything goes wrong, don't come to me because I am telling you this is a problem and we need to do something about it. I used to meet with my board once a quarter and those things I would elevate to the level of the board, right? Because The board job is to oversee risk so that they can maintain the fiduciary duty to the stakeholder and all of that. But the thing is, if things are bad and the only person who knows, and in most organizations I've been in, cyber reports to IT and your CIO is like, okay, whatever. And then it just cut it off there. It never goes to the other C-level executive, definitely never goes to the board. So the only one who knows is the CIO is not going to do anything about it because he's your boss. Anyway, so they can shut down and go back doing whatever cyber trick you are doing. So that is a problem, right? So again, it's the culture, elevating cybersecurity to the business level, but really investing in the culture too, not just tools, right? Training employees and cybersecurity awareness, doing drills, tabletop exercises. Like one thing I love to do was phishing. Campaign. And some of them was a little bit risky, but that's what the bad guys do, right? I guess sometimes you may have to clear it up with legal. Like for example, this one time for this one company, I knew this was going to almost get me in trouble, but it was important that I did it. It was about bonuses and bonuses is huge, especially in Silicon Valley, because sometimes your bonus could be more than your annual salary. So, uh, I tricked them. I made it sound like it came from HR, that they were going to open this file about their upcoming bonus. And about half the people in the company did, which was wrong because if it was malware, we would be in big, big, big trouble. So that was a great learning exercise. HR didn't like me after that. But whatever you can use to kind of gamify cybersecurity, because sometimes cybersecurity privacy is kind of dry. You know, but kind of make it fun, make it where people want to be engaged and they are learning something. Like I have really never had a cybersecurity training where people would sleep on me, never, ever, because I try to really keep the energy very, very, very high and also get feedback from the audience. So it's not like going to a Colette lecture. I am the boss and I am in charge and I'm going to speak in this monotone voice for one hour and you, you my pupils take notes and learn from the master. No, no, no, no. It's like back and forth because I can still learn from from people, even people who just got started in their profession because they have experiences and viewpoints that I do not have and that could help. Anyway, making it very engaging, sometimes even funny, within reason, but just getting people engaged and interested. Like, why do I need to listen to you for 1 hour to talk to me about cybersecurity? Show them what's in it for them, not just at work, but their personal lives too, right? Some people, like for example, One thing that happened to me and that happened to a lot of people in the military, I'm sure you heard about OPM. OPM, yes. And anybody, everybody in the military at least has this secret clearance. So my Social Security number, all of my background investigations file are with somebody in China. So what can I do about that? So that impacted me very, very badly, even today. But now what's even worse now, I raised my hand. I wanted to sign up. I wanted to be enlisted and then an officer, but my wife didn't raise her hand. My daughter didn't raise their hand, but for them to do the investigation on me, they have to get the information on my spouse and family. So now even my daughter's social security number is on somebody's home computer in China. She, that's, that's just unacceptable, right? So when people understand how it could impact them, financially and personally, then they pay more attention. Yeah, this stuff is important because it is going to prevent me from going through this, uh, heartache. So I think that is, that is important. And then the other thing, you know, we kind of touch on too is to adopting a continuous intelligence-led, uh, learning, um, organization, right? Just moving beyond just, you know, the annual, uh, audit and this type of thing, but really paying, uh, um, attention in customer retention and market confidence. Because when you talk about customer, any C-level executive is going to be absolutely excited about that. When you talk about revenue, they're absolutely going to love you. So trying to find a way for cybersecurity to support that. And I think that's really what's going to make a difference going forward.

So you've covered so many different areas, so many different topics, and cybersecurity leaders already have a ton of things to do and things that are broken or need to be improved. So my last question to you, how should cybersecurity leaders, the ones that are listening to us right now, right? How should they act to take advantage of opportunities? How should they proactively manage risks right now? What's the one thing you would recommend them to do tomorrow morning?

I think 3 things. In the world we live in. So like you say, the bad guys are already using AI and it's almost like asymmetric warfare against us. So we need to use AI too in order to combat that. And I know a few CISOs and security professionals who just think AI is a fad and stuff. They don't want anything to do with it and they think it is too risky, and which it is, but I think you have to use it. You have to understand it and you have to play with it in a nice, safe way. Environment, I think there is a lot of control you can put in place to ensure that your data doesn't get out of your stores. Because the truth is your people are using AI right now. Right now they are. Whether you like it or not, whether you have a policy or not, they are. So you need to embrace it and help them do it in a safe and secure way. Yes, we can use AI. These are the tools we have approved and so on. So I think you have to lean into it. In this day and age, I don't think there is a way to go around that. So lean into AI. But the other thing that's extremely important, I think it's really raising cybersecurity to engage with the board, right? Above just senior management going to the board to translate threats into business terms, right? To align security with revenue, revenue, revenue, revenue. I think my job as the CISO is to help bring in more and more revenue. Don't be a friction to that, right? But do it in a safe and secure way and think, okay, maybe we cannot do it this way because this is way, way too dangerous. But I propose maybe we can do it this way. Risk are reduced and this is the acceptable level of risk for our organization. Again, you don't have the last word. If the board decides they still want to do it, make sure it's in writing. You told them, you know, whatever happened, they don't need to come here and fire you, right? You did your job, right? And I think executive sponsorship is very nice to like. We had a discussion on our podcast about where should the CISO report to? I think the true answer is to whoever is a senior executive in the organization who cares the most about security. If you have someone who cares about security, whether it's the CFO or legal or engineering, if they do, I think that's where the CISO should be reporting to because they're going to give you a lot of top cover, right? They are going to stand with you when you are against all of the other members on the board who don't want to do security because it's going to slow them down and reduce sales. Someone who can impact the culture and kind of like nudge the organization in the right direction. I think that is important. So when you start a job, first 90 days, try to figure out who those people are. And it doesn't always have to do with your title because you can be a director, you can be a vice president, you can be a C-level, anything, but nobody listens to you. Everybody ignores you. I mean, you can even just be an engineer or an analyst. I mean, everybody flocks to that person because of their personality, their influence. They don't have a title. They are not a leader in the organization, but because they impact people, and they make them feel a certain way, they listen to that person. So I think it's good to have what I call cybersecurity champion in all of the other function, right? Where it's not just you, but you have people in each one of those departments that are going to value and elevate security in finance, in HR, or whatever function they belong to. And then I think the last thing most important, we kind of talked about it throughout, but it's really investing in people, right? Mission first, people always. People are your greatest asset. We know that intellectually, but sometimes we don't know that in our heart. That's not how we live our life, right? So people need to upskill their skill, provide money for training where you're like, okay, AI isn't going to take your job, but we're going to teach you to use AI to be more productive. So you can be more strategic and let AI do most of this tactical stuff, especially things that are repetitive that you can use. Automation for. Like the first Silicon Valley company I worked for, we had a great saying there. We always try to eat our own dog food. But if we have a software, a tool or something that we do manage, or because we were part of a, I guess a conglomerate, our parent company owned a bunch of other software companies too. So if we didn't have it in-house, then we would look at our sister company if they had something. If they did, there is no way we're going to spend our money with Microsoft or with somebody outside of our ecosystem. So we eat our own dog food first. And I think that is a great thing to— a great mind to have tried to maximize the resources you have, not prevent people from doing what they want to do because they're going to get to do it anyway, but give them the tools that are approved, that have been vetted in order to do it. Yeah, you want to do this with this software. That one is not safe, but here's another one that is safe that's been vetted. You can use that. So you still get to get your outcome and we are supporting you into doing that, but just in a safe and secure way. So I think that is important. And for me, from my own personal experience, I think it's also still important to prioritize diversity. It's not just being Black, white, women, and disabled, gay, and all of that. That's important too, but definitely diversity of thought, right? Because one problem I've seen in a lot of Silicon Valley companies, they tend to hire people who have the same experience and background as themselves. Or sometimes even at one point, Facebook was only hiring people who came out of Stanford for some reason. I think that's a huge, huge, huge mistake because basically everybody that is coming on board into your organization, they all think the same way. So basically, if you have a blind spot, everybody on your team has the same exact blind spot. So you need somebody who thinks differently, who's going to tell you, hey, no, I see something that's not right here. We need to think about that. Diversity is extremely, extremely important. Also, you know, generation today, I think we have what, about 5 generations working in the office now. Old people don't want to retire. We have presidents who are about to die off in office because they just don't want to retire for whatever reason. So, and then you have brand new kids like my children, Gen Z, they're now starting to work in the industry. And it's like a bunch of people from different different motivation, different background. But I think that diversity definitely helps you make better decisions and ultimately be more—

Yeah, no, I absolutely agree. You have to break that echo chamber. So thank you, by the way, so much for sharing your cybersecurity insights today with us, especially around leadership. Very much appreciated.

Yeah, and I think the last word I would say is lead with humility. Especially when you become a CISO, sometimes, you know, it can get to your head. I'm at the top of the food chain. I am the man. But the truth is, no, you are not the man. You are the servant. But your role is to help and serve the people who are working with you, give them all of the tools, all of the opportunities that they need so that one day they too may become a cybersecurity chief. So I think being humble, knowing that you are not the smartest person and you don't have all of the answers. I think that is going to help you more than anything else when you are at that type of leadership position. Because my mentor, again, John C. Maxwell says, if you are the smartest person in the room, you are in the wrong room because you're not going to learn anything. You need to get to a room where you are not the smartest and where you listen more than you speak. So you have to be humble, but always willing to add value. So that's all I'm going to say. And thanks again for inviting me to your podcast. I've been trying to do this for a while, so it's really good that we're able to make it work today. So thank you.

Absolutely. And Bob is the Head of Information Security, Information Warfare Command for the U.S. Navy Reserve. And he has an incredible podcast as well, Leadership and Success Podcast with Coach BZ on LinkedIn. So be sure to check that out as well. And thank you all for watching. Be sure to subscribe and catch all the Cybersecurity Vault episodes where we chat with industry leaders to dive into the most relevant and interesting cybersecurity challenges, perspectives, and best practices. We'll see you next time.