Cybersecurity Vault - Board Lessons of the MGM & Caesars Ransomware Attacks with Andrzej Cetnarski

Welcome to the Cybersecurity Vault. And today we're going to talk about the recent MGM and Caesar breaches and the board lessons of these ransomware attacks. And I'm your host, Matthew Rosenquist, CISO, cybersecurity strategist and advisor. And my guest today is Andrei Setnarski. Andrei is a national security and cybersecurity strategist named CEO of the Year by CEO Monthly magazine and founder of Cyber Nation Central, a global cybersecurity training and advisory firm for boards and C-suites. Welcome, Andrei. Thank you for coming and talking with us.

It's great to be here, Matthew. Always great to reunite.

Yes, yes, yes. And we've got a wonderful topic today because if you've been in Vegas, which I'm sure we all have, right? MGM and Caesars, those are the two big powerhouses houses there. They own so many of the different casinos and venues and everything else. And both of them got attacked recently, right? A couple of weeks ago, they got— they both got hit with ransomware attacks, possibly, and it's not confirmed, but possibly even by the same threat agent. And yet, they approach these, right? Their response were quite different. Caesars paid millions to the extortionists. Well, MGM chose not to give in, and it took them about 10 days to get back up and running. And the totals I've seen ranges from $50 to $80 million impact. But what's your take on this situation and the direction each of these big players, right, decided to take?

Where do we start? So let's start with what the board decided to do, pay or not pay. Obviously, one of the pieces of calculus is if we pay, where does it end? Right? So from that perspective, any board should think twice before paying. Secondly, any responsible board is going to take a look at and say, well, wait a minute, there is a regulatory hurdle that we've got. As far as if we pay, are we in trouble with regulators? Okay, so take that aside for a second. So I wouldn't blame one company versus the other for doing what they did, what they each did. It is down to each individual company. So let's actually talk a little bit about what the board makeup and why they did what they did is, right? So MGM and Caesars. One of the things that, Matthew, you might not know about my background is that I was actually a global real estate lodging and leisure investment banker for UBS for a number of years out of New York, and the casino industry was one of my biggest clients globally, but certainly out of Vegas as well. And unfortunately, when you look at real estate lodging leisure casino operators, they are not what I would call cyber ready. Their boards are not ready to deal with the strategic calculus of including cyber adversaries, let's call them broadly, in the strategic corporate strategy of the organization. That is one of the biggest areas that boards have to fix, and that also includes MGM and Caesars board going forward. Now, here's an interesting point to your question. MGM paid. They took— they swallowed the pill.

Caesars paid.

Oh, sorry. Caesars paid. They swallowed the pill. That probably is a very painful but great lesson for Caesars to step back and say, never again. MGM, right, didn't pay. Paid in terms of 10 days' worth of operations being down and therefore translates into way more than the ransom that was being asked. I understand that was $30 million. The actual cost of the operation is going to be multitudes of that. That's a different pill to swallow. Would I have done it? I'll save that for individual board conversations that you and I have. But that's something that a board needs to take up. Do we pay?

Do you think there's ethical considerations here? I mean, we're talking dollars and cents and obviously boards have a fiduciary duty, right? To protect their shareholders and whatnot. But when it comes to ransomware, is there ethical considerations? I mean, you're funding the enemy, you're funding the next attack. And, you know, stats show that, you know, a good chunk of this, in some cases 70% of ransomware overall, not specifically talking about these two victims, you know, tends to go overseas to very aggressive nation states that don't like the United States. Some that are building nuclear weapons, right? Some that are, you know, currently in and waging war. Is there an ethical consideration we should take a look at here?

Yes, we should. But if I'm sitting on a board, my first and foremost stakeholder is the shareholder. And so therefore, you've got a dilemma, right? Am I going to go the ethical route, or am I going to save my company's skin? And therein lies the possibility for government to play a role. Okay, now, that said, Our government is currently screwing that up. I've been very public in my comments about the recent SEC regulations that have come out. The cyber rule that forces boards to disclose their management process, not yet the board process for cybersecurity, but management. What is management doing? How is management preparing, etc. On the one hand, and on the other hand, forcing management to disclose issues of how the breach came about, what has happened in the breach, et cetera, without going as far as having the board and management team to describe the nitty-gritty of the breach, the attack vectors, et cetera. But we've already seen from this Caesars and MGM breaches, from these MGM and Caesars breaches, that the amount of disclosure both companies came out with have given at least a little bit of a playbook to wannabe followers, right? Follow-ons, if you will, cyber attackers against other casinos, real estate operators, et cetera, right? In other words, what has been disclosed in Caesar's disclosures and MGM's disclosures provides a bit of a playbook for, mm, that's how these breaches succeeded, cool. We can learn from this as attackers and attack others that might not be as prepared as MGM and Caesars might be going forward. That's a problem. And yet our regulators are forcing this. That's a problem.

You know, the argument against that is saying specifically for the SEC findings is, or the SEC requirements, is when a public company, right, has a material impact, that company has to notify the shareholders, which is true for other things as well. It has to be done in a timely manner, of course, because there's people in the company, executives and a whole bunch of people, that are going to know bad things are happening. They may short the stock, right? They may divest, and, and the normal investors won't get that information in a timely manner, and that's unfair to them. So I can definitely see why that transparency is a requirement coming out of SEC, and I don't always like everything SEC does, but that transparency seems to be a, a good position to protect those shareholders. If I'm a shareholder, and maybe you and I— let's come back to ethics as well, because if you don't share this, I as a shareholder, if I own stocks of MGM or Caesars, which I do not, But if I did, I might be not so happy with Caesar's board if they're paying Russia or North Korea or some other nation state. And I don't agree with that from a humanitarian, from an ethical perspective.

But Matthew, we're on the same page there.

But without the SEC, they may be able to hide that.

We're on the same page there.

Okay.

This is not about not disclosing that a breach has happened. But it is about disclosing, or as in this case, not disclosing how it happened, what specifically happened.

So that kind of disclosure, the details, potential details that could be used to the advantage of the attacker. Okay. And I don't think anybody would say, yeah, tell them what vulnerability they exploited and everything else.

And not just that. Not just that. Right. The SEC has a dual role and it is a double-edged sword role. They have to go as close as possible to the kind of disclosure that's necessary in order for shareholders to have the knowledge that you're talking about, but on the other hand, not go far enough so that that knowledge to the shareholder also becomes helpful knowledge to a potential other adversary that then can use that knowledge and go after the company again, thereby hurting the very shareholder interest that the SEC was trying to protect to begin with. That's the problem.

Okay, okay, I, I see what you're saying. Let's take it up a, a higher level from a strategic point of view. Let's talk about the sector itself. Yeah, um, how can— right, this, this transparency, this transparency may hurt or hinder, and I think in the long run it's actually going to help Right. But if, for example, Caesars gets hit and I'm making this up, right? Caesar gets hit, notifies the world and their shareholders, we got hit by ransomware. We're not paying. MGM gets hit, notifies their shareholders. We're not paying. What message does that send to those financially motivated threat agents? Is that saying, hey, you know, maybe this sector is not a good sector to attack? We put all this effort and time into trying getting a big return, and one after another are not paying. We're still doing the effort, it's not working. Maybe it's time to move on to another sector. Let's go back to healthcare, they love to pay, right? Let's go back somewhere else, right, to easier targets. Can deterrence Can this breach notification actually help entire sectors if they bind together, number one, and two, obviously they need to invest in the security controls to either prevent or rapidly respond and being able to recover, right? That's part of it. We don't want multiples of losses. That's just bad business. But if you're lost to this $15 million, you know, ransom is only $2 million because you're on it. It's an easy decision. But again, if you hide it and go, oh well, I've got insurance, the stockholders don't need to know. I mean, is there an opportunity here for these sectors? Yeah, to bind together and go, not us, not today, we won't play your game. Go find someone else, go find another sector that wants to play your game. Is that an opportunity here?

OK, so first things first. You should never hide the fact that you've been breached. Learn from Uber, where the CISO almost went to jail. And the judge flat out said, the next CISO is not going to be so lucky. And the only reason why you're not going to jail is because this is the first case of its kind. Again, the next CISO is not going to be so lucky. So do not hide the fact. The fact that you've been breached. How much you disclose and how fast has a little bit of a leeway, so this is where your board has to play a very careful, strategic game of what do we disclose in order to make regulators and investors happy and healthy from an investor perspective, But secondly, how little can we disclose in order for us to not become a victim again or fuel attackers? So let's just leave all of this in one little bucket and off to the side now.

Okay.

Second, to your question of will attackers move away? Well, yes and no. It depends on what the motivation of attackers was to breach you to begin with. Was it really for you and only you to pay ransom? Okay, if that was the only motivation, then yes, collusion amongst industry companies and organizations would help thwart that kind of an attacker. But I would purport to say that that isn't, and most of the time probably isn't, the only motivation for an attack. Why? Cybercrime is organized crime, right? It's a $7.9 trillion economy, third largest economy in the world, growing at 15% per year. So this isn't your garage geek anymore, right? Quote unquote garage geek anymore breaching organizations. This is organized crime. Think companies with CEOs of cybercriminal networks, et cetera, et cetera. And so when you think of it from that perspective, those companies have multiple customers. So one customer of data that was breached in a Caesars or MGM attack is indeed the breached company themselves, who would buy back that data from the attackers by paying ransom. But that data can also be sold to other stakeholders, other customers, be it competitors, be it on the dark web to somebody else that has a whatever reason to purchase that data, et cetera. And so this isn't so simple as just saying, oh, we as an industry are going to bind together and just say no. Is that the right thing to do? Well, yes, but only if we are so damn ready from a breach deterrence and posture of deterrence perspective that indeed we do not fear being breached and therefore pay the financial, operational, legal, regulatory, and other costs that are associated with a breach. If you're not ready for that, then yeah, the easier thing to do is to pay, which is why hospitals whose boards, administrative teams, CEOs have not been ready, they have been paying because it is the more swallowable pill. Once our breach deterrence and cultures of cybersecurity pick up steam, That's when we can indeed have the kind of conversation that you're talking about, Matthew, where now we're fairly confident we're not gonna get breached and therefore we don't give a hoot who tries to breach us. We're just gonna say no.

Okay, so then let's bring this back to the board, right? If I'm consulting to a board, you and I just get thrown onto the MGM board and they go, "Okay, what are we supposed to do moving forward?" Right? You know, I think one of the directions I would take is to give that strategic direction to the CISO and their organization to say, the goal I want you to achieve, because I know you can't prevent every attack, but I want you to make sure that we are in a risk position that we are preventing as much as possible, but in the event that it does happen, I want recovery, right, to be less than $2 million impact or $3 million impact or whatever it is, right? But put a dollar figure on it and say, this is a success criteria. This is your goal. Because when they come back and say, we wanna have some ransom, the board wants to do the ethical thing. We want to represent our shareholders and we want to showcase how we're better than everybody else. And we want to turn that down with confidence because we're going to be set up. We're still going to take a hit, but we're going to be set up to a manageable one. And I'm going to hold the CISO to a certain bar, a certain goal, X million dollars, recovery time, X amount of time, whatever it is. Is that the way you would approach it or would you recommend something different?

So first, I would say that's good, not great. There's a great book by that title. Second, I come at it from a chairman and CEO perspective. I am not a CISO. Okay. I come at it from the perspective of having seen breaches firsthand, how they've unfolded, and what a great CISO would have or would have not been able to do, accomplish, etc. And I therefore come at the issue of cybersecurity, and really more broadly cyber, very differently than the entire industry generally does. What does that mean? When you think about some of the motivations of attackers, you've got to start saying to yourself as a CEO, and certainly from a governance perspective as chairman, I am now in charge of growing the cyber profile of my organization. OK. If that doesn't ring different bells than a physical organization, then let's just think about it for a second. Most boards and C-suites have been built to manage a physical organization— manufacturing plant, hospital, whatever. It's a physical organization. And we've been going and growing gangbusters on digitalizing and digitizing the entire footprint of that very physical organization. However, as we all know, probably most of the digitalization and digitization of our processes and institutions has not been cyber secured on a one-to-one basis, right? With every step of digitalization, we're not cyber securing it at a one-for-one ratio. Okay, well, we could go and have another podcast on why that is, but The nitty-gritty, the big picture of it is internet was built as a house without doors and windows. We're gonna be paying for it for a long time, et cetera, et cetera. So we're trying to approximate cybersecurity to the digitalized footprint as closely as possible. Okay, but within all of that, therefore, if I'm the CEO of the company, I am no longer the CEO of just the physical organization. I'm the CEO of a digital footprint of that organization and the cyber secure rendition of that organization. So what that means really is I've gotta think through all three lenses. And that's something very different. Why? Because when I'm developing a corporate strategy for my entire company, for my HR organization, for my financial organization, for my operations. And then the CISO is developing theirs, and the CFO is developing theirs, etc. We are currently botching the issue of how do I, a CEO, think of my duties, my duties, not the CISO's duties, my duties in the physical organization and how they translate or don't translate and there are both, into the cyber replica of the organization. So for example, if I'm the CFO, frankly, before I even go there, every part of the organization now has an additional stakeholder that they have to be including in their cyber, in their corporate strategy, and that's the cyber adversary. That is one of the biggest failures of the MGM and Caesars board and C-suite. They have not paid attention enough to that stakeholder in their corporate strategy. And regardless of how amazing their CISO was, wasn't, etc., and how amazing their technology was or wasn't, there were clearly governance processes that a typical board director would normally be thinking through from a— for a physical organization that didn't translate over into that cyber equation for that board director, for that CEO, etc. And so therefore, if I'm the CFO and I'm not looking currently at the financial statements from an adversary's perspective, I am botching my responsibility over protecting the financials of the organization from hackers. This is not the CISO's job. A CISO is not a CFO. And so therefore you've got to, as an organization, enable every executive to know just enough of what they need to know to discharge their cyber roles. They've got 'em. Most don't know that and are therefore leaving the organization open to vulnerabilities within their area, not the CISO's area. The CISO may be doing an amazing job on IT, OT security, et cetera, infosec security, so on and so forth. But if the CFO isn't doing what I just said, if the chief HR officer isn't thinking through how do we bring on board people that are cyber ready, cyber trained, they have cyber acuity, and therefore we're not hiring people that are exposing our organization to their professional, personal, family cyber risks. And instead are bringing those risks into the organization, then I, as a CHRO, am not doing what I should be doing and my CISO cannot be doing for the HR area. That's a different dynamic than what is currently happening in the industry. Right now we are treating the CISO as the de facto CEO of an organization for whom it is impossible to manage the entire organization. We're putting a major role on top of one person's shoulders and saying, go fight, win, setting them up for failure.

So forcing them to own the responsibility without empowering them to actually manifest the necessary controls and strategy. It goes back to the old question, whose responsibility is cybersecurity? It's everyone's. It's everyone's. And if that CFO and CHO and CEO— don't have that in their mind, then there's going to be gaps and there's probably even going to be friction between the CISO and the CISO may go, hey, we need to make sure all our customer service reps in IT are very well trained in cybersecurity. And the IT guy, no, no, we outsource this. Don't worry about it. I don't have time. I need them on the phones. And then we get a situation where MGM, the attacker, goes through the help desk, gets a password reset because they spoof, basically impersonate somebody, and everybody goes, "Oh no," and they may turn around and go back to the CISO and go, "You failed." Well, wait a second. I wasn't as a CISO empowered to close that. I tried to get that happen, and it was, you know, zibibid, it was put under the budgetary line. So, you know, I completely agree with you. We have to empower the organization.

Have to. And that's not a nice to have anymore. It's a must have that adversaries are exploiting. So your question as a CEO and chairman of the board is, am I actually aware enough of what my role is to be able to drive that kind of awareness across the entire organization? And 99 times out of 100, that is absolutely not the case. Most CEOs and chairs have no idea what I just said is true, much less that they have a role in it, much less of how to execute on that role. And so therefore, we've got this cacophony in the market of, oh my God, let's get a qualified technical expert on a board and drive cybersecurity on the board. OK, great. Let's assume we get the best CISO who's a phenomenal governance person onto our board. And then the company gets breached because each individual board director didn't know that actually adversaries can very easily get into the organization through them and their cyber insecurity, not just professional, but at home because they're working on whatever from home from cyber insecure networks at home. That are not being managed by the organization and never will be nor should be because of privacy reasons. And so therefore an individual board director serves as a patsy into the organization. How in the world can a qualified technical expert or anybody in that realm of expertise be able to prevent that unless we've empowered individual board directors and executives to not only know their roles but then empower that kind of a culture of cybersecurity and breach deterrence from their role down through their part of the organization. You can't. And so therefore—

Key word.

A CISO and a cyber governance person on a board cannot be the only two people in the organization that speak cyber. Everybody has to. And I'm not saying everybody has to be a cyber expert. This is not what this is about. But everybody has to be aware of what they uniquely in their own role as— pick your title— have to be aware of about cybersecurity in order to drive their role and their part of the organization through that lens. That's it.

And I think the key word that you mentioned there is culture. That's what you're really getting to, is the culture has to be open and aware and reinforced, especially from the board down, that cybersecurity is everybody's responsibility. And the CFO and product managers and everything else need to be working with the CISO as a partner, which in my mind says, okay, you also have to have joint goals that you're working towards and you're jointly owning the success of those goals. Exactly. In keeping that product secure, in keeping IT up and running, in making sure we've got the proper security training and background checks of people that we're hiring. And that then becomes that teamwork effort. And it's not the isolated CISO that we will, you know, demand they fix everything without empowering or just use as a scapegoat when something does happen. It's got to come from the board down, culture change and shift to embrace the value propositions of cybersecurity And it helps every department. It helps finance make sure the attackers don't move that decimal point. It makes sure that the confidentiality of the HR records and the availability of the IT infrastructure, the IT and OT world. So yeah, hey, everybody should be on board, right?

Exactly right. You couldn't have summarized my lot in life better. That is what I focus on day in and day out. But let's push that even further.

OK.

So our new White House National Cybersecurity Strategy has come out and is very big on cybersecurity by design technologies and scoring companies on how well the technologies that they produce come towards being cybersecurity by design. And again, good, not great. Why? Because the whole issue of cybersecurity by design technologies is something that was already true 20 years ago. OK, so we're catching up very slowly to what I like to tell boards and C-suites they have to be compliant with, which is the hacker innovation curve. You should not look at cybersecurity regulations out of any government, even the United States, which is ahead of the curve in front of most peers around the globe. You should not be looking at being compliant with regulations of the United States government. You should be looking at being compliant with the hacker innovation curve. What does that mean? Cybercrime is growing at 15% per year. Cybersecurity is growing at 9.7%. So clearly hackers are growing faster and for a lot of reasons that we can get into, right? It's lucrative, it's easy to perpetrate, et cetera, et cetera. But from a technology perspective, our cybersecurity market isn't growing as fast. Okay, great. So let's say we close that gap. Still, when you look at cyber breaches and you look at whatever statistics you want to look at, whether it's the Verizon breach report or the IBM breach report, somewhere between 3% to 30% of cyber breaches are caused by insufficiencies of technology, right? So cyber insecure technology and CISO weaknesses. The remainder, right, is caused— so the remaining, call it 70% to 97% is caused by social engineering, which really is a form of cyber insecure behaviors, cyber insecure strategy, both of which emanate from where? Now this is so board and C-suite. Board chair and CEO. And so again, unless you're elevating cybersecurity to the cyber acuity of the CEO and chair, who are the culture drivers of the organization, unless the CEO is also the share, in which case that one person either drives or doesn't drive, empower or not empower individual executives to do what they need to be doing in cybersecurity. That's where you're starting to fall apart. And so while I respect and tout the White House National Cybersecurity Strategy as a step forward, what we need to be talking about is Cyber Secure by Design boards, C-suites and cultures that indeed include cybersecurity by design technologies but are much more broadly focused on how do we create, okay, nations if you're a president of a country and then institutions if you're the CEO of an institution and citizens if you're just an individual person, right? How do we create cybersecurity by design nations, institutions, and citizens that actually retain sovereignty in cyberspace because they have a breach deterrence posture, and not just a posture, a culture of cybersecurity that is impermeable. And right now we are fighting against a trend in boards that is not okay. And not just boards, our government, which is, "Oh, we'll just get breached." Well, that's a wrong approach if we're trying to stay ahead of hackers. So I get it. It's, it's the de facto. That's where we are. But if I'm sitting in front of a senator, congressman, president of a country, CEO, board chair, I am not saying you're going to take this lying down. You need to do something to fight. So, okay, great. You've got a number of tools at your disposal. Your company is one. So you've got to be doing what you need to be doing in order to protect your company. Secondly, at a, right, let's call it collusion for fun, from a fun perspective. You should be colluding in a good way with other companies, like you said earlier, to make sure that we as an industry are doing something that increases our posture of deterrence, our culture of cybersecurity, etc., etc., fill in the blank.

Can we call that collaboration versus colluding? Well, I think criminal nature when colluding here.

I like to be contrarian sometimes because it registers better than, oh, let's gladhandle each other. And so yeah, let's call it what it is. Let's bloody collude for good against cyber adversaries because that is what's necessary. And so this is where a comparison between the financial services sector— and the healthcare sector is an interesting one, right? So financial services is the second highest cost of average breach industry in the world after healthcare. But what's interesting is, right, so financial services has been at this breach deterrence issue, breach prevention issue for quite some time and has gotten pretty okay with it, but obviously breaching a financial services institution is very lucrative and so therefore it's still there and it's and it's going to be there.

It's always going to be a target. That's where the money is, right?

But healthcare is an easy target because you've got lives at stake, etc. And most hospitals will again pay because right now they are not ready to not pay and suffer the consequences of operational shutdown, lives at risk, etc. And so the healthcare average cost of breach is 2 times the size of the average financial services, uh, cost of breach. And so when you're looking at best practices, yeah, the healthcare industry has something to learn from the financial services industry. An average hospital has something to learn as well. And yet an average hospital's board is nowhere near the level of expertise that they need in their own role, not cybersecurity expertise, but in their own role and its cyber readiness to be able to fulfill a breach deterrent posture from their perspective on their board. That has to change. And so these kinds of best practices have to permeate every industry. And I'll say one final thing on this point, which is if you are in, let's say, the communication industry, the transportation industry, the logistics industry, the marketing industry, whatever, pick it. And you're saying to yourself, oh, my average cost of breach is really low, therefore, for my industry. Therefore, I'm not so worried. Be very careful. That just means that hackers have not caught up to you yet.

That's all it is. The clock is ticking. Enjoy it while you can, because they will come for you.

And if you think that I'm exaggerating, I'll just give you one example. I was invited to one of the most prestigious institutions— I won't name which one, and certain conversations around the energy sector in 2017. And this is one of the preeminent energy policy institutions in the world, hands down. And I, of course, brought the cybersecurity or cyber insecurity of our energy sector up and our energy grid, et cetera. And the person that is at the height still of expertise in energy of that institution said, "We're not worried about cyber insecurity of our U.S. energy grid. We're very good, no one's going to come after it." Okay, and we know the history. So, that is a person that is literally forming policy for our country. Then history shows us the entire opposite of that. So think about it. The cyber awareness issue at government, typical company, board, C-suite level is still not there. Do not sit with your hands behind your back and not bring your organization's leadership up to speed because you either are deluding yourself or you think you don't have the time. If you think you don't have the time, let me tell you, you're gonna spend months responding to a breach and regulatory wrath and paying for the cost of breach. In fact, go to cybernationcentral.com/why-care. It'll show you a couple of statistics and graphs that will make you think twice about not caring if you're the CEO or the board chair. There are psychological costs on your company. On your employees, operational productivity loss for years, customer loss, customer revenue loss, reputational loss, IP loss. The list goes on. Make sure you're aware of what your vulnerabilities are. This is why I say cybersecurity is about corporate strategy. It is not about cyber risk. Cyber risk is just one component of cyber, right? Think about it. You've got a cyber replica of your organization. Risk within it is one thing, but how do you use cyber to grow your organization responsibly? Now we're getting into a much deeper topic that we don't have the time for today, but just sit in that, what is my cyber profile of this organization? Is it cyber secure? What are we individually doing or not doing? Start there. You're gonna start seeing holes in your governance strategy, in your execution strategy. Take it from there.

Got it. Okay, so a couple of key points here as we've been talking. You know, there is a disparity between the investment in cybersecurity and, you know, the pace basically of the attackers, right? And right now security is finding great difficulty in even just keeping pace, not even gaining ground, just keeping up with the attackers. So we have to have that in mind. And when we look at regulatory things, that's basement, right? That's the bottom that it's really just trying to raise all boats. Just because you're compliant with some regulation does not mean you're secure, does not mean you're impervious. In fact, you're probably a good distance from best practices, even just within your sector. So it's not the place to stop your focus and investment on security. That's the place you need to start investing. You need to get there first. That's table stakes. And then start figuring out where you want to be as you approach those best practices within your industry.

And Matthew, I'll throw one more thing in there for board chairs and CEOs. When you're interviewing board directors, you have to ask yourself, is that director cyber ready? If they're not, can they be relatively quickly? Otherwise, you're bringing in old world problems into a new world issue area, cybersecurity, cyber profile of your organization, et cetera. And unfortunately, most, I'm gonna be very unapologetic here, many boards still have directors on them that sit on them to collect a paycheck, do what is necessary of a board director because of fiduciary duties and regulations, rather than what's necessary of a board director because that's the right thing by shareholders. Okay, so let's, let's call a spade a spade. Even closer, as Matthew Rosenquist just said, there's a big difference between regulatory compliance and what I call tactical responsibilities that a CEO, every executive, board chair, every board director have. Just because you're fulfilling on your fiduciary cyber, even if cyber, right? So let's say you're the cyber governance person on a public board and you're happy because you're fulfilling your fiduciary role against all the SEC requirements regulatory required issue areas, right? You're fully compliant on the SEC regulation that just came out. Good for you. You're still completely and utterly breach-prone. And this is what we call an old CISO-centric approach where you over-rely on the CISO and cybersecurity technologies as the end-all be-all to save your organization. Versus the CEO method or the CEO-centric decentralized approach of empowering every one of your executives and board directors to own their area of expertise. And therefore, yes, you are regulatory compliant, but much more importantly, you are tactically fulfilling your tactical responsibilities and roles to keep your organization breach deterrent and a culture of cybersecurity intact. That's the gap that as a CEO and chair you need to bridge.

So then the next kind of follow-on key points is one, you have to act proactively, right? You can't just sit back and do things in the old way, old manner. We'll follow regulations because again, even just following the regulations doesn't mean you're secure, doesn't mean you have an optimal level of security to prevent as much as you should and then quickly respond and recovers to those things that get through, right? And those are business.

That's right.

And the second thing that I'm hearing is, unfortunately, these proactive kind of measures takes a certain level of expertise that the board may not have, the C-suite may not have, potentially even the CISO may not have. We have a lot of CISOs that grew up from a technical perspective and they're great at, you know, configuring ACLs on a firewall, but having those business discussions with that CFO and CEO and board, talking in terms that they understand, enabling and educating and helping them, right, be invested in protecting their environments and understanding what that means. Even the CISO may not have that expertise. So we need that expertise. And again, top level down at the boards, at the C-suites and at that CISO to help manifest this culture change to get to more of an optimal level of security.

And that is why, Matthew, I say the cybersecurity problem has to start with the CEO.

Yeah.

Because if the CEO does not say to everybody, guys and gals, you have to be vulnerable enough to not just say, Oh, my area is perfect, we don't need anything. We have to call out the warts. Know that we're not gonna see repercussions because of that and wrath from the CEO. Quite the opposite, we're gonna hear, I see, we've got these issues, we've gotta deal with that. Similarly with the CISO, a typical CISO, CTO certainly, even Chief Security Officer has not grown up in thinking about every corner of the organization from a functional perspective, executive perspective, governance perspective. And so how in the world would we possibly expect them to be the de facto CEO of a growing cyber profile of an organization and set us up for success? It's impossible. And so therefore, it has to be decentralized.

I would agree. You know, the, the CEO is Pivotal. If you don't have support from the CEO, you're dead in the water. You can be the best CISO in the world and it's not going to matter. You're going to have those barriers. And I would even take it a step further. It's not just, oh, I'm going to let you do what you need to do. It actually— you need a CEO to understand the relevance and value and get them to proactively be involved. They should be championing. They should be understanding this. They should be leading by example. Because if they're not, that sends that apathetic message to the rest of the C-suite and probably to the board as well.

That's absolutely—

So, the CISO is key, right? And that relationship between the CISO and CEO is crucially important. If you don't have that CEO advocacy, I think you're dead in the water. Okay, so last question for you because I know we're running out of time.

On this point, I'm just going to plug one thing. I have a paper, an 80— this is not for the faint of heart. It's for chairs, CEOs, right, chairs, CEOs, and CISOs. A paper coming out in the Cybersecurity Peer Review journal by Henry Stewart Publications on how do I as a CEO and board chair build a culture of cybersecurity from the board down. You will see that the CEO, it's not even a question, the CEO has to drive it. And as Matthew just said, has to drive it authentically. And so therefore it starts with, do I as the CEO understand my own risks? Professional, personal, family. Because as the CEO, I definitely am targeted across all three areas and I have no time to deal with them, no time to learn my risks, no time to learn mitigation strategies. And yet guess what? Again, you have to. Why?

The attackers don't care. They're gonna come after you either way. In fact, they want you to not have time.

That's exactly right. So I'll leave it at that for now.

Okay, okay. So last question for you, just really quick. Um, board members who are seeing this MGM and Caesars, and maybe they're in that industry, maybe they're in an adjacent sector, whatever, but they're, they're nervous, right? Long-tailed cat in a room full of rocking chairs. They're a little nervous. Real quick, what are the 3 pieces of advice that they need to do right now? What are the 3 things as board members?

I have only one. Oh, OK. Get trained. And out of that comes out maybe another one. Don't be complacent. I hear too many board directors say, well, I'm just an average board director. I'm not an audit committee chair. I'm not a this. I'm not a that. I'm just an ordinary board director. And as that board director, you should be pushing the envelope of are we doing what we need to be doing to protect our cyber profile of the organization? Not cybersecurity. Big difference, right? Cybersecurity, cool. Yep, CISO has a big role to play in the IT, OT area. But from an info security, information security, data security, patient security, right, that requires strategy that every board director, given they are privy to the corporate strategy of the organization, has a role in. You have to play that role. You have to push that envelope. And if you are on a board where you say, well, I can't bring that up because the, the audit committee chair is going to shoot me down, you're on the wrong board.

Yeah, yeah, you're— you shouldn't be on the board. If you can't speak out, you shouldn't be on the board.

100%. And if you're the audit committee chair And if you're more about power than actually empowering your organization, then in all honesty, if I'm the chair of your board, I would be looking to replace you. Now, I'm being contrarian here to drive a purpose, right? There are ways to deal with all of these issues from a cultural perspective that make everybody happy. But I'm driving this point because as an audit committee chair, if I'm really— looking at the, at the well-being of my organization, not just my well-being, that I'm saying first things first, audit is a backward-looking function. I was an auditor, that was my first job out of college. It's a backward-looking function. Cyber is not, it's an innovation-focused function. And therefore right there you've got a mismatch between cybersecurity and an audit committee handling that cybersecurity. And so the question becomes, should boards have a cyber committee? And I couldn't be a bigger proponent of that for many reasons. I agree, that's one. Two, because the cyber issue is dwarfing every other issue on a board. Why? Because it is so lucrative to, to hackers. And so therefore, if you're a CEO worried about making your quarterly financial statements, right? I'm gonna put my investment banker's hat on for a second. And so I'm looking at risks to my financial statements. I'm looking at my CFO, are they doing their job? My chief business development, are they bringing the revenue, et cetera? If I'm not looking at the cyber adversary and how they can take out most of that profit out of my organization with one shot, then I shouldn't be the CEO of this organization.. And I know that I should be the CEO of this organization and therefore it behooves me to have that strategy in place. That's what I'm saying. So I'm being contrarian to shake folks up, but right within your current contract of the board, you've got every tool available to you through individuals like, like myself, my company, Matthew Rosenquist, his company, etc., to fix some of these issues and really prepare your organization organization to develop a posture of breach deterrence, a culture of cybersecurity. Every single board director and C-suite executive behaving cybersecurity, conducting themselves and their culture cybersecurity, fulfilling their roles and responsibilities, etc.

Do it.

That is the first thing. Second, again, if you're whoever on an executive team or board, make sure that your pushing the envelope because that is what's necessary in order for us to, for you and your organization to win against hackers. Nothing short of that.

I love those two things, right? It's really recognizing cyber is a board issue. So it's part of your purview. So you better get empowered, which means that, that means education. And then the second thing is you better act purposefully, right? With that newfound empowerment and all the tools at your disposal, to be able to manage risk because, again, it is a board issue. It affects your bottom line or whatever your organization's goals are, right? And you need to be leading that. You, your CEO, and then down into your CISO and everyone else. So, I love that advice. I think that's great. So, let's kind of sum up here. You know, you are the CEO of Cyber Nation Central. You've been slinging great advice here. And you know, your company advises and educates boards regarding, you know, the management of cyber threats. So how should leaders engage your organization for advisement? What's the best way?

Two ways. Connect with us on cybernationcentral.com. You can go to /consultation and simply schedule a consultation. Reach out to me on LinkedIn. You've got my name up there. I'm probably the only Andrzej Cetnarski with that spelling in the world. Actually, I think I am, actually. So, so that makes it very easy. What could I say? My parents tried and succeeded including every letter of the alphabet they could in that name. So just connect with me on LinkedIn and, and we'll get you, uh, we'll get you all the information you need. But just go to our website. There's so much information on our website that helps empower your organization to just know what your issue areas are, how to tackle them, and from there, as you're building out or trying to build out your culture of cybersecurity, breach deterrence, empowering individual, not just collective, directors and executive teams to do what they individually and collectively need to be doing, that's where we shine. We're the only organization that actually does that, believe it or not. So reach out, happy to connect you with the knowledge that you need and take it from there.

Outstanding. Thank you, André. Always a wealth of information and great insights. And thank you all for watching. Be sure to subscribe and catch all the Cybersecurity Vault episodes where we chat with industry leaders like André to dive into the most relevant and interesting cybersecurity challenges, perspectives, and best practices. We'll see you next time.

Thank you all.