Cybersecurity Value and Metrics with Gavin Grounds – Part 2

Welcome to Cybersecurity Vault. I'm your host, Matthew Rosenquist, cybersecurity strategist and CISO at Eclipse. Today we're going to talk again. This is a follow-on conversation about how CISOs can showcase cybersecurity value and benefit from those metrics. And I'm going to be talking with Gavin Grounds, who is the executive director of cybersecurity strategy and information risk management at Verizon. And was formerly the Global Delivery CISO of Enterprise Services at HP. And he also holds an interesting patent, Systems and Methods for Automated Quantitative Risk and Threat Calculation and Remediation. And that ties into everything we're going to be talking about. Now, in the previous episode, we touched base and discussed why cybersecurity metrics are so important to, to organizations. And why they're difficult, why it really hasn't been completely figured out yet. So there's still ground that's being broken here, and it's really, really difficult for most CISOs. In fact, it's difficult for all CISOs. It's just some of them have made a few more steps ahead in the journey than others. And today what we're going to talk about is what should a CISO be thinking about in their mind? What are those first steps, if they're bought into the fact that yes, I have to get out of the firefight mode and I need to be able to have metrics so that I can prioritize, so that I can measure and improve, so that I can communicate with my organization where we are, where we need to go, what our goals should be from a risk appetite perspective. And, you know, that's valuable all the way up to the board and CISO level, but it's also important all the way down to the organization. As you're trying to get people to change their behaviors. So it's hugely important. But where do we, where do we start? How do we start implementing this? And so, Gavin, thank you very much for coming back and having this conversation. We really appreciate you showing up.

Hey, Matthew, last one was a blast, so I'm looking forward to it. Thanks for having me back.

Okay, so let's jump into it. Right. New CISO. Or a CISO that has been just so focused in the firefight, the day-to-day, you know, tackling of issues, hasn't, you know, gone off and figured out any good metrics. We know there's some best practices and probably many more bad paths to go down, pitfalls to avoid. Where should they start?

Yeah, so I think the first thing is don't stop the firefight. I mean, that's critical, right? So, we want to say, "Oh, well, I'm going to do it a different way." "Hey, we need to sign this. The building will be burned down by the time we're finished." So, obviously it's important to keep up with the firefight. But I think one of the things that I found really to be a kind of successful play, Matthew, is really just to focus on getting everybody, first of all, speaking a common language. You know, in cybersecurity, we talk about risk and we talk about risk appetite. You mentioned it before. And, you know, from one individual sometimes to the next in the same organization, they could be speaking to or thinking or meaning totally different things when it comes to risk, when they say risk. And then especially from one organization to another. I'm talking specifically of cyber risk. So, you know, one of the things that I've observed, Matthew, I'm sure you and many of our listeners have seen this or heard the same thing, is we tend to kind of jumble terminology together. So for example, we'll say we have a non-compliance and so therefore we need a risk exception. So just think about what I just said. We have non-compliance, so we need a risk exception. Well, first of all, there's no such thing as a risk exception, right? So we may say we want a risk acceptance, or there's an exception to the policy, therefore the non-compliance. So we kind of, even just with some of the vernacular, we kind of blur those things together. But then even there, there's still a kind of foundational challenge that we have, and that is that we automatically kind of assume that there's a one-to-one relationship between noncompliance, that that is the risk. And it's really not. It could be with a vulnerability. We could say, well, you know, the vulnerability is the risk. Vulnerability isn't the risk. You know, recently I was on a conversation and I saw this statement that said, "High-risk vulnerabilities." And I said, "There's no such thing as a high-risk vulnerability." You have a vulnerability, and depending on where that vulnerability shows up, it may or may not contribute to a high risk. And so, you know, sometimes you can feel like, well, that's just an academic debate over wording, but it actually forms the foundation for how to manage risk. I use an example, Matthew. When the pandemic first, you know, was really getting a grip on the States in March 2020, At the time, I was in New Jersey, so I decided I was going to drive, you know, my car to Texas. So imagine the scenario, you know, and that is the scenario. My car, me, the driver, driving from New Jersey to Texas. Now, what if I had a slow puncture? So now I have an issue. So if that was in our, you know, cybersecurity GRC world, that would show up as an issue. And someone said, well, that's a risk. But in reality, the slow puncture is contributing to the risk because the scenario is me driving. So I might just say, well, you know what, I'm just going to stop at gas— I've got to stop at gas stations along the way anyway. I'll just reinflate the tyre every time I stop at the gas station. However, it was the pandemic and certain cities were having a much harder time than others. So now I have a second issue, but still the same scenario. My journey hasn't changed. My objective hasn't changed. But now I've got two scenarios or two issues rather side by side. So I might look at that and say, all right, well, I'm going to take a different route. Now, that might put me on a stretch of highway where I go 100 miles before I see a gas station. So now, those two issues in the same scenario are forming a very different kind of decision matrix. And then finally, my fuel injector starts cutting out every time the engine gets hot. So now, I've got—

You have car problems. That's what I'm getting from this analogy.

Okay, just get a different car. But you see the point it's making. So in cybersecurity, we might have a, you know, a non-compliance. It's like, it could be anything, you know, password complexity policy or something like that. We say, okay, well, you know, some of our operations delivery organizations might view, well, I need an exception to that, and here's the reason why. They kind of view the exception as the solution. But even that, the exception isn't necessarily the risk, you know, it contributes to the risk scenario. And that's why the lexicon, if you like, the words matter. And so, you know, as a CISO, this is kind of the journey that we're embarking on. I'd say, you know, it's start there. It's make sure that the whole organization understands that when we talk about risk, we're talking about a scenario made up of multiple elements. And then by the way, when we start saying, what's our treatment decision? Do we accept the risk? Do we transfer the risk? And you see the phrase, do we accept the risk? In reality, think about the example I gave of driving the car from New Jersey. You know, do I accept the issue of— I might accept the issue of the slow puncture, but I might not accept the issue of the fuel injector cutting out. I might say, I'm going to get that resolved, that issue.

Different factors there, yes.

But the risk scenario stays the same. So even things like that, we say, do we mitigate the risk? No, we need to say which elements that contribute to the risk scenario are we going to mitigate and/or accept and/or transfer? And what I found is once you kind of landed on that, it was like clarity. It's like, "Oh, okay, right now." And it completely changes the operational play, you know?

Oh, you know, I would agree. We don't have enough words in our lexicon when it comes there. And unfortunately, risk is probably the most overused and misused word in the cybersecurity industry. So, you know, as part of the steps of building a metrics program, you got to get everybody involved right, on that same playing field where you're communicating. Because if you can't, you just won't get anything done. And the different perceptions, and, and it, you just go round and round in circles. It's like a maze. So, okay, so, uh, defining terms, right? Gathering all the right people together, defining terms so that you can communicate and collaborate. What's the next step?

So this is kind of going to sound almost elementary, but it's, um, I think about like a child, toddler learning to speak and there's always a big debate if they say the word mum first or dad. And then they learn no. It's kind of weird. They learn no before they learn yes in general. But I think it's always interesting when they learn why, because they'll just keep asking why, why, why until you get to the point where as a parent you say, because I said so. But when they reach a certain age, that doesn't work anymore either. But tying that back to this situation, I think it's saying, good, so once we've got the kind of the correct framework of we're speaking about risk and issues and mitigation and all of that, we're speaking out in all the consistent and standard and correct terms, then we can look at it and start to answer the question, why? So what? I actually use "so what." So example, we have a non-compliance with password complexity. We'll stick with that one. So when that's brought to my attention, you could just say, "So what? Why does it matter?" "Well, you know, when internal audit come along and they'll see this, they're going to call us out because this is the non-compliance." "So what?" So like that child that keeps asking, "Why? Why? Why?" You just keep asking, "So what? So what?" And ultimately, where you land is why it matters to the business, or in fact, why it doesn't matter to the business. Because, you know, just the password complexity as an example, as a policy, in certain business contexts and in certain processes and certain applications and certain architectures, it matters incredibly that we hit that password complexity requirement. But in other scenarios, it matters less. And that's where we start to get to, you know, by asking, "So what? So what? Why? Why does it matter?" And what we land on is why it matters to the business. And the quicker we can get to answering why it matters to the business, we'll stop irritating ourselves or each other with the "So what?" you know.

Well, and you bring up a good point, right? Because we can have metrics about everything, anything and everything, but there's only a certain subset that are important. And often I see junior-level CISOs go out there and they want to fix everything and everything is a priority, right? Peter the Great said, when you try and secure everything, right, protect, you're basically protecting nothing. And so you have to have that. And so drilling down to figure out what is important, that so what is that test, it's that litmus test to say, is it really important? Does it really tie to decisions that have to be made? Is it something that goes to the business objective? The corporate objectives, or contribute to achieving that, you know, risk appetite, that accepted level. So if we don't weed all that out, we're gonna be overwhelmed. Okay, so we've got the people together, we've got the— we're talking the same language, we've identified core components, right, core factors as part of a risk program that are important to the industry. How do we take it to the next step? How are we looking at doing measures and rolling those up into metrics? And I know every organization's a little bit different, so kind of at a high-level broad strokes, you know, what is your kind of direction to start gathering those measures and translating to metrics?

Yeah, so it's a little bit of kind of what we touched on last time we spoke, Matthew, is starting with where you are and what you do know already. And there's a lot as a CISO and a CISO organization, there's a lot that we do know that we actually don't realize that we know. And I'll give you a very specific example. So, you know, we've established the common lexicon. We've now got everyone speaking a common language around risk and compliance and so on. And clearly we've got a ton of data that we're trying to turn into meaningful information. But then one of the big elements that we do have that we oftentimes don't take enough advantage of, and that is then, and you touched on it, touched on it last time as well, is that kind of top-down view that says, okay, so which business processes matter most to the business? So, you know, we can start there and say, well, all right, where's our revenue being generated? You know, and by the way, I want to just put a caveat where we say matters most to the business, because it depends on which business executive it is. If I'm an incubator, you know, if I'm running an incubator business, then my, you know, double-digit millions are massively important to me, you know, as if I'm running a big chunk of the business, then those triple-digit, hundreds of millions, you know, matter most to me. So obviously you do have that context, but the point being is saying, you know, which processes deliver revenue? Which processes protect margin, profitability? Which processes deliver cash? Where's the treasury, you know, being taken care of? Because from those processes, then we start to identify which systems and even third-party service providers that we're dependent on. And so we're actually starting then to build a prioritization list. So then, when I use the example of, you know, password complexity, as you know, it's probably just a very simple, basic example, but then that password complexity issue matters more in the context of those revenue-generating and/or margin protection and/or cash collection processes and systems than they do in some of the other systems. So it's really connecting those dots. It's not just about why do we care about this particular control, one of 300-plus, But why do we care about this particular control in this particular business context? And the great thing about that, Matthew, is a lot of that work has already been done for us. You know, if we, you know, we look at, for example, a business continuity plan, a good business continuity plan, you know, that would have already been, you know, documented based on which processes must continue to run no matter what, you know, and they've already got the business impact analysis and we can just kind of ingest that information. And then it's a case of mapping those processes and those BIA results. It's already— the work's already been done. Mapping that to the services and the platforms and the technology that deliver to those processes, and then mapping what we know about the risks and the operating risks associated with those processes. And then to your point, you know, we can't go around and fix absolutely everything overnight, and maybe we'll never fix absolutely everything ever, absolutely anything and everything ever. But what it does allow us to do is say the things that matter most to the business have got the attention that they need, and then the others will kind of, you know, will get the rest. And again, as I mentioned last week, I know, you know, some people might think, well, your east-west movement, we're just going to factor that in that, you know, if a platform has got some way allowing east-west movement into one of those areas that we care about, then that also becomes, you know, of of a higher interest, you might say.

Yeah. I mean, systems nowadays in organizations, they're never standalone, right? There are always dependencies and hooks and things that are connected. So, you know, the example you used, that password complexity, yeah, you can look at it as a standalone issue. "Hey, we're not compliant." But if you're not asking that "so what?" and you're not mapping it to the different potential risks or vulnerabilities or exploited, you know, all that, you're not seeing how it actually ties and affects many different types of risks. And having that viewpoint, because if you see that and you're able to cross that one off the list, that now changes those risk metrics across, you know, all those different assets. And that can be a, you know, it's, it's, it's a game changer, it's a force multiplier if you can see those opportunities. And again, it all ties back into what's important to the business, right? What systems, what processes, what, in some cases, what people, right? And that's all got to be tied in. And a lot of the work is already done, as you said. People know in an organization what systems are critical. And as the risk expert, you can now overlay the risk factors on top of that. And again, we're using the word risk so much. Let me put a pause in it for a second. And, you know, there are several different definitions of risk, and I've seen probably at least half a dozen. The most common, you know, in our industry, risk is the threat times the consequence times the likelihood, or the vulnerability times the consequence. Or the likelihood times the impact. I mean, there's lots of different ones and some of them, you know, are taken from, again, like the insurance industry. One of my favorites is really around the threat. Risk equals the threat, right? Who's coming after you and why? What their capabilities are times what are the likelihood, right? What controls and mechanisms do you have to mitigate that times what's the bad thing that happens if they're successful? And that kind of calculates up into a figure that you can use to say, okay, our risk in this area might be X dollars over a year, right? Just like insurance can say you've got X amount of risk of an earthquake in California, right? And so, you know, every year, although it may not happen for 10 years, right? But you can calculate that. So, you know, in your mind, when you say the word risk, what do you think of? What are those contributing factors that you think of that constitute whatever number or color or whatever that risk is derived as?

Yeah, so—

What do you think of this?

It's interesting, Matthew, the way, you know, the way you frame that, because again, I think as cybersecurity professionals, we can very quickly try to get to the algorithm. You know, what does the calculation need to look like? You know, what's the, How do we put the math together? But what we need to do is peel that back just to the first level because you asked the question, what do we mean by risk? And the way I think about risk is risk is any scenario that can impede the business outcome. And so when we think about it that way, then what we can start to land on is that it may not necessarily be one single calculation or one single algorithm we apply in every particular scenario. Because if you think, well, what is the risk scenario that is going to impede the business outcome? Well, if the business outcome is to collect cash, for example. So we think about our payment collection systems. So maybe we have platforms that are processing credit cards. So in that scenario, what is the threat that could impede our ability to collect credit card payments? Well, the threat might actually be a QSA, you know, that's going to come and do our PCI assessment. Because depending on how that goes, right, if you think what's the business outcome, the business outcome is we need to be able to collect cash, we need to be able to collect cash cost, cash cost, effectively. So now we're not thinking about some state-sponsored threat actor. We're not thinking about some organized crime outfit. Now we're thinking that the actual risk that impedes the business is, will we get our ROC for that particular platform? Because if we don't, the business outcome is either we can't process credit cards, then we've got the cost of cash by the hour, by the day. When we're not collecting the cash, it's hours already. Or it could be that we have to pay higher processing fees. So now we got margin erosion, you know, or we might even pay—

Or regulatory penalties or lawsuits or all sorts of stuff.

Yeah. For me, I've always found, Matthew, starting there and saying, you know, anything that can impede our ability for the business to get the business outcome that we need and therefore our revenue generation systems will have a different play, if you like, a different view, because the impact to the business is going to be different. We talked about cash collection as an example. It could be systems that work around optimization to make sure we optimize it, whether it's, again, in treasury, optimizing cash flows, or it could be optimizing actual operations so we get efficiency, so we drive margin. So the reason I say that is that way we don't quickly run down and say, what's the best algorithm? Is it X times Y plus P? You know, whatever it is. It's like, if we identify what the risk actually is that we're trying to address, in other words, what is the thing threat and therefore the business outcome, the adverse business outcome. From there, then we can look at all of the elements that would make up that risk scenario, and we could say, now, what is the best way to calculate that? And last time, Matthew, there's one thing that you and I talked about, and that is that when we think about risk management, again, as cybersecurity professionals, we often almost exclusively think about driving risk down. And in every other aspect of business, what we look to do is optimize risk. So there might be certain risks that we want to actually accept. So our risk profile might elevate, but the business result might elevate threefold, fourfold, fivefold to the way our risk posture is elevated. So again, they become business decisions. So I know it doesn't answer the question as what is the best algorithm. Sorry, everyone that was waiting there saying, what is the best algorithm to use?

No, I like where you're going. Because you just outlined a couple of important steps, and the first one— and correct me if I'm wrong— is, is really to sit down, the CISO and their team and, and, you know, business partners within the company, and list out those risks. What are risks to, to the success of the company? You got to list those out. And then you said, okay, now once you have those, start looking at the contributing factors to each one of those to see, you know, what, what makes up those risks. And that starts giving you the insights. And then, you know, you said, okay, from a mindset perspective, because again, CISO, we're always thinking, how do I eliminate risk or get it down to nothing, which is unrealistic, but that's the way we think, is to force a mind shift change in the CISO to go, you know what, in some cases it's going to be about reducing risk, but there are other options in dealing with risk. You can accept it, you can transfer it, you can do other things instead of just mitigating it. And so the metrics that you're developing should also have those aspects within it as well, because that— if, if executives are making well-informed decisions and they choose to accept the risk, then that's the right decision. As long as it's well-informed, they're the leaders. That's why they're at the helm driving the ship. So, making sure the metrics, the framework of the metrics can support many different potential outcomes. I think that's also, I think you're absolutely right. It has to be built into that framework.

Yeah, you're spot on, Matthew. And again, that ties back then to the whole view that part of the, it's almost like a, you know, a foundational shift that we need to make as a community in cybersecurity is really truly recognizing it as a business problem. Now, what do we mean by as a business problem? Well, we could start talking about, you know, well, we're trying to avoid loss and so on and so forth. But really, when we think about it at the business, the strategy level of the business, you know, we talked last time a little bit about, you know, return on capital and, you know, return on equity and so on. And of course, one of the factors for that return is it's a percentage. It's like, okay, if we're going to go spend X thousand dollars or X million dollars, you know, there's an R factor that takes in multiple things. It could be, you know, exchange risk or, you know, fiscal risk or, you know, so all of the factors that make up the R that, you know, that tells, okay, so for our weighted average cost of capital, we need to get this kind of return out of everything that we do in order for us to be basically meeting our obligations to our, you know, owners and shareholders and so on. That's the business. That is literally the business objective. So as a CISO, where we need to be driving to is what is the R factor that we're contributing? In other words, if we've got the, for the business unit or for the company, the cost of capital rate, that rate, the minimum rate of return for everything that we do as a business, that rate should have a contributing number from cybersecurity. And that's why we need to be doing quantification because in every other aspect of our risk domains or any of the risk domains, there are contributing factors to that R factor, you know, in other words, the return factor to calculate essentially the required return on your cost of capital. And so I think as, you know, as CISOs, literally thinking about how can we use the metrics to not only measure the effectiveness of our operations, because that's the other thing, Matthew, I think there's kind of two aspects to the metrics, isn't there? There are metrics that really measure how well we are performing our functions, and those are important. Those are our operational metrics. But the other flavor of metrics is a need to roll up to that, that overall business top line. Literally, what is the dollar value, or what is the factor of that risk factor, the corporate risk factor, and therefore the corporate return factor? And therefore, when our business leaders are making decisions on, yes, we're going to invest in this, in program and no, we're not going to invest in that one. It's really, you know, business programs are looking to invest in because we've already factored in the return that would be needed to essentially fund the controls that we're putting in place as a CSO or CSO organization. When we can— Exactly, exactly. Yeah. And when we can complete that story, if you like, with facts and figures and dollars and cents and pounds and pence and euros and centimos, And then we've got a business-led cybersecurity function.

And that becomes hugely powerful. Again, that just simply empowers the CISO, right, to be able to show we have different paths. There's different opportunities for investments with different types of returns. It's not just black or white. It's not just the on or off switch. We turn security on or it's off, right? It isn't total dismal failure or total impervious to attack. It's describing and being able to communicate the trade-offs across that spectrum. And I think that is one of the most important things that, again, junior CISOs that come in that are only looking at the firefight, right? What do I got to get done today? They're missing that opportunity. They're missing that narrative. And if their executives aren't informed and well-educated and have that data, it's very tough for them to invest the proper amount and still have the expectations. It's too easy to have really high expectations and say, I'm just going to invest a little, right? I'll give you a few pence and now I expect to be completely—

Exactly. Yeah. And just made me think, so when you're saying about that, Matthew Rosenquist as well, because that can, and it is a, it is a, you know, what I just described, it is a kind of a foundational shift and those are hard to do, you know. And you mentioned about, especially if, you know, if a CISO is kind of new to the role and/or new to the company, whichever it might be. Because obviously if you're new to the company, then you've got a whole different kind of revenue play and risk play and all that kind of thing. But exactly, but priorities and everything else, I think a really effective approach though is to start to be able to talk about— we talked about last week, last time, about the, you know, cyber controls and the cost of controls, but to be able to put that in the, in, in the business context. So I'll give you a very specific example. I alluded to, you know, PCI as an example, a control framework, you know, you've got to meet it, otherwise you've got penalties. But then when we look at the cost of the controls associated with delivering on that, when we put that in business terms and then we literally roll them up to the return on that cost and that capital, we might have a business unit that says, "Why on earth are we running our own payment platform? We're spending more than the cash is worth." I don't mean they get that cash value. I mean, the time, time, money, the, the time, money, time, time value of money, you know. Um, so that, that would then— the CISO would then be allowing the, the business unit to make a decision, say, would we better off be buying this as a service? Because it's definitely not worth the, the, uh, the expense of all of these controls that we have from in place. Conversely, you might say, hey, this is like awesome, we should actually do more card processing. But we're not just kind of waving the FUD flag, fear, uncertainty, and doubt, saying, "Hey, you got to do this because otherwise we're going to fail the ROC on PCI." So I think that's like a very simple example to show how we can drive from control, cost of control, to business value. And then it's kind of just repeat that same methodology across the board.

You bring up a great— you just said waving the FUD flag, the fear, uncertainty, and doubt flag. Which unfortunately a lot of organizations, security organizations, that's what they're always waving. And you get the sky is falling kind of syndrome and people start getting desensitized to it because you're just throwing out fearful things. And again, when you start having a good metrics program and by the way, it'll never be perfect out of the gate. Never. Right. It's a matter of iteration. But as that develops and matures, You can step away from that. This is the only thing in my arsenal is just fear, uncertainty, and doubt. And you can start providing data. And again, very, very powerful. Even if the data isn't flattering, it's still data that decisions can be made on. And executives like making decisions based on data. Making it based on fear, that may work once or twice, but Yeah, that's not the way to run a sustainable security program. So again, it's a way to get away from that FUD for CISOs. Okay, so now I want to ask you, give me like your top 3 or 4 metrics that you like to see, that you like CISOs to publish or have at their disposal. What are some 3 good examples of metrics you like? And then I'm going to ask you the reverse. I'm going to want some of the ugly ones that are terrible, but what are 3 that you like to see?

Yeah, so I think that, you know, for me, the 3— and it could be a little bit different from one business unit to another, one organization to another— but it's the kind of priority is really the 3 that have the most relevance to the business objectives of of whatever the business unit is. You know, we talked a little bit about how, you know, certain processes and certain applications are far more value to the business than others. You know, if it's revenue generating, if it's cash collection versus running the menu cafeteria or whatever, you know, menu of the cafeteria. So metrics that show, you know, how well are we protecting that, asset, and I don't mean by asset, I don't mean the server or the database. I mean the asset is that revenue generation function, you know, exactly how well are we defending, how well are we protecting that for sustainability. And therefore there's a whole plethora of metrics that will roll up to that, answering that kind of one view. But what we're doing by taking that approach is we're focusing on the actual business outcome. So that, you know, that thing is really good. And it's not a singular metric. It's a kind of singular way of looking at multiple metrics. You bring them all together. So this is how well we are protecting, or this is how well we're not protecting. And therefore, here's the plan to go do more on that particular, you know, business asset. And that's one of the things, Matthew, I think as well, you know, differentiating between assets that provide access to the business value asset or assets that create the business value asset versus the actual business value asset itself. So when we think about metrics, so it's those kind of metrics that really drive that. So that might be one metric, it could be two metrics or, well, actually it'd be multiple metrics to feed that, but we might put, you know, one or two different kind of views and perspectives on it. And then the other, biasedly, is risk.

It all comes back to that word.

Yes.

All roads lead to that That word. word.

Exactly. But, you know, how effectively are we managing our overall risk profile? And notice I didn't say how effectively are we reducing the risk. It's how effectively are we managing our overall risk profile. And obviously there's multiple metrics that go into that. There will be, you know, how effective are we at, you know, when we do decide that we're going to mitigate something or we're going to transfer something, you know, How effective are we actually completing those and verifying that those actions took place and that we got the result from them? So, you know, how effective we are essentially measuring the entire lifecycle of risk management as opposed to saying, yeah, we want to see the risk score go down. It's we want to see that the risk score is optimized. So I know you asked for 3, but for me, those are probably the 2 biggest. And then depending on, you know, because I think those 2 apply to pretty much any business type of operation. And then, there'll be others that are more, you know, person-specific businesses.

If I had to answer that question, you know, and again, top-level metrics, metrics that I would be bringing to a CISO or to a CEO or to a board, it normally falls into 3 things. One, metrics around spending, right? How much you're spending on security. The second one would be how much you're impacting the organization, right? If you're forcing them to log in with 3 passwords and everything, it's taking time. How much training are you giving? Okay, that's taking time. And again, that's, that's a cost, right? But in this case, it's impact. It could be to the customers, could be to the organization. And then lastly, what you were talking about, that one word that we keep saying, risk. Where are we from a risk perspective? How close are we to the currently, uh, or current target? And when you look at the cost and you look at the impacts, right, or, or the friction that you create, and then you look at where you are from a risk perspective, that gives leaders an understanding that, hey, these are all tied together. If I increase the budget right, I may be able to reduce the risk. If I want to really reduce the friction, I may have to increase the budget and accept more risk, right? And so because they're all connected and you can kind of turn those dials, that empowers management to kind of take charge to say, no, CISO, I want lower risk, but I'm okay with the friction going up. I'm okay with spending more time training the employees. Okay. I can write an objective and a goal to that, and I can deliver to that. Right? And the reverse might be, you know, might come up. I want less friction with our customers. The customers are complaining they have to log in with a 47-character password. What are we thinking? Great. We will reduce the friction, but it may increase the cost. I'm going to go through a third-party vendor that can do biometrics or something like that. Right? Or maybe we accept a higher risk. And those are the conversations that make or break a security organization, the longevity of it. So those are 3 that I like.

Hey, Matthew, I just wanted to make a comment on the friction one. As you said that, it made me think of, I think, a really important point to share as well. And that is we can oftentimes fall foul of kind of going down one-size-fits-all. And the reason I was thinking that when you said about the friction and how difficult it is to get access to a system or whatever,. And I often think about the scenario, I have my garden with a garden shed, I've got the house and I've got the safe. So for things that are going to go in the safe, there's a lot of friction to get in that safe. You've got to come through the garden, you've got to get into the garden gate, you've got to come in through the door, you've got to— and then you've got to have whatever, a combination lock or whatever. Now you're in the safe. But I'm not going to put the wheelbarrow in the safe. But I'm not going to put my grandmother's wedding ring in the shed. And so I think that's an interesting, you know, observation that you made that I just wanted to kind of make that observation back as well, that, you know, when we think about those 3 levels that you would, or 3 measures that you were describing there, that I think they equally need to be in the context of specific asset value and specific businesses.

Yeah, absolutely, absolutely. Whatever those business goals are, and it's not just that one asset, as you said, it's the capability of whatever that goal is. If it's generating revenues or closing deals or or getting engineering product out on time or whatever, whatever the goals are, there's a complex system that makes that happen and you got to look at it holistically, right? And not just, I'm just worried about the one firewall or the one server. It's all connected. Okay. Real quick now, just give me 3 ugly metrics that you think are absolutely pointless or counterproductive for a CISO.

And then again, back to the whole kind of thought of, you know, depends on who the audience is. So again, if you, you know, if it's kind of almost like well, not almost, it is board-level kind of conversation. I think also, so, you know, the number of training campaigns that we did or the number of, you know, the number of our click rates. I mean, click rates are an important operational metric. You know, they can give us, they can be indicative of what we might need to do. And then the other thing, by the way, kind of the antipathy of click rates, I think one of the things that we actually should pay attention to is, you know, has our program oversensitized people So they keep reporting, "This is phishing, this is phishing, this is phishing," because somebody's now got to go deal with that, as well. So I think those metrics are great for kind of operational efficiency, but again, it's just down to audience, Matthew. I think it depends, you know, who you're talking to and what really is the message you're trying to convey.

Yeah, I would agree with you, right? Going to a board meeting, and I hear this from board members, "My CISO came in, and they were talking about how many attacks were blocked at the firewall, how many millions," or, or how many tickets were generated. I don't care. That means nothing to me. I'm interested in revenue. Did it stop our revenue? Is it, you know, and yet the CISOs really think, hey, I'm gonna have this great graph. This is how many things we blocked on the firewall. That's great, but it doesn't actually tell you anything, right? Or the chart that says where the attacks came from. Nobody cares, right? I'm more interested. Did it actually have an impact? I'm more interested in how many didn't get blocked and what was the downtime? Did we lose IP? Right? So there are so many bad metrics out there that might look pretty, may sound cool. We had, you know, when I started Intel's first 24/7 security operations center and we turned it on, I had 4 million critical alerts coming a day. Who cares? Right? What matters is, you know, did it, how did that impact the company and how did we shift that over time? To not impacting the company. So, it's not the ability to say these big numbers. It's got to be meaningful to the audience and to board members. They don't know and they don't care, right, for that level of detail. So, absolutely. Absolutely. This has been fantastic. Now, Gavin, you're also doing a fundraising effort for UNICEF. So, we're changing gears here. I'm interested 'cause you've been in this industry. We've talked a couple times here. Tell me what's going on with UNICEF.

Yeah, so how it started out, well, you can see this is the New York City Marathon shirt and you've got all the things at the back. And so I started distance running, long distance running only about probably 4 or 5 years ago. And the reason I did it is because I actually hated running at the time. So it's not like I enjoyed it. I'm probably not even exaggerating with that. But just the work I was doing, I was like, 200+ nights in a hotel every year, traveling the globe. It sounds all exotic until it's painful and painful enough. And so I just figured, you know, I'm going to end up dying like young and painfully. I need to do something back to health, right? So I need to be proactive here. So, so I committed to a fitness regime and a regimen. And then I thought, well, I need a goal. So I signed up for a half marathon. I thought, well, that'll be my goal. It'd be nice to just do one half marathon. I can say, hey, I did a half marathon. But I still knew that, you know, I'd probably beg off and be like, oh, I'm jet-lagged, you know, I'm tired, you know, the night before I just got back from Asia or something. And so I thought I need a commitment. So I decided that I would do it as a fundraiser for UNICEF and particularly the End Violence campaign for children, End Violence Against Children. And so, and so, so I did that. And then I signed up for what was called the Distance Challenge. And that was to do, you know, a 5K followed by a 10K, followed by 10 miles, followed by a half marathon, half marathon, full marathon in Austin. So I did that and I thought, well, I need to—

It's painful just hearing you say that. My knees are already hurting just from you saying that escalation there.

But again, I thought, you know, so I just stuck with doing it for UNICEF because I thought then if I don't show up, then the kids don't get the help. So yeah, so that's it. So the benefit I get apart from some knee injury is it does force me to, you know, to stay focused on being physically healthy and so on. And it's just awesome. I mean, you think about children, they are the next generation of this planet. They are the future of our species. And so I figured something that's important to me is the physical and mental and emotional safety of our children. So yeah, that's it. And I get to run my legs off at the same time.

Well, that's fantastic. You're doing it for a good cause. And, you know, the simple fact that you realized, you know, and in our industry, whether it's just in technology or especially in cybersecurity, there are health issues, there are mental issues, there are emotional issues, right? CISOs don't sleep much. Actually, whole entire security teams typically get very little sleep and they're very stressed out and they're driving themselves. And if we don't take time to keep ourselves healthy physically, mentally, emotionally, right? It just— you start to burn out. You can— you just can't burn the candle at both ends and think everything's going to be fine. So, it's great that you had that forethought. And I would encourage everybody in the industry, and I do all sorts of— you got to have that me time. You got to have that time to keep yourself healthy, right? Otherwise, you're no good. And if you can do that at the same time as, you know, helping children and other things in the community, and the future of society, hey, that's a double win. So great, very inspiring. Thank you, Gavin. And Gavin, thank you for sharing all your insights here. I would encourage people to follow Gavin on LinkedIn, uh, and in social media to listen to what he's talking about and some of the activities that he's doing. I know he's doing something with Gartner here shortly as well. Thank you again, Gavin, for joining us here on, uh, on the program.

Absolutely my pleasure, Matthew. Appreciate it. Thanks so much.