Cybersecurity Vault - Cybersecurity Efficiency & Maximizing Value with Roger Sels

Welcome to the Cybersecurity Vault. I'm your host, Matthew Rosenquist, cybersecurity strategist and CISO at Eclipse. Today, we're going to talk about cyber resource efficiency and really how to maximize value. And I'm going to be talking with Roger Sells. Roger, well, Roger's been around forever, and he's the co-founder and chief vision officer at a stealth startup as well as a board-qualified technology expert. Now, today's podcast is created in part by Eclipse, securing data in transit through any cloud, network, or device. Welcome, Roger. Thank you for coming and talking with me today.

Thank you, Matthew, for giving me the opportunity. We finally get to do this. Finally.

We've been trying to have a conversation for some time now, so I'm glad it's all come to fruition and we're here to chat about it. And the topic itself is really interesting to me because security, you know, for the longest time has really been seen as a cost sink. So making sure that you're not overspending is just as much of a problem as underspending because it can be as much of a problem. You don't want to overspend, you don't want to underspend, and there tends to be a lot of scrutiny. Well, especially in economic times like this where companies are trying to cut costs and trying to really make cybersecurity as lean and yet still maintain the effectiveness. So, you know, what do you see in today's climate? What are the big problems around cybersecurity inefficiency?

I think it stems from the fragmented vendor landscape that we all have now. Organizations have to patch together a number of solutions to actually start addressing their risks. But as they do that, a lot of people start looking for best-of-breed solutions, but then they never actually come back and look like, well, I acquired the capability A, but I already had a solution B that I acquired for a completely different purpose, but actually it offers some good capability in terms of B as well. I did that exercise with my teams back when I was in Dark Matter, because at some point they requested some budget for some controls. I said, can you look across the stack? Do we have nothing that covers that? And I don't want somebody to come up and tell me like, yeah, but this thing is much better, much more efficient. I'm like, can we get there like 70% of the way, 80% of the way, 90% of the way? And we built a mapping of all of the utilization of our controls And I was actually quite shocked that most of the controls were used at 30 to 45%. So we built a plan to say, okay, before we add anything in, we're going to use the capabilities that we have that we're already paying for. To give you an example, I'm just going to make stuff up, but your antivirus might have a DLP module and you might be in the market for DLP. Well, let's just start with this one and see what the limitations are. And then we can always go back to the vendor, give them some feedback because we already they have a relation. So they might actually be able to improve the product to our use case. And meanwhile, we don't have to go and redeploy anything. So that saves a bunch of time. So I think that's one aspect. Of course, the second aspect is also in how security solutions are built. Everybody is very, very wary of actually taking a decision on your behalf. So we're all inundating the teams with alerts, with look at this, And it starts getting fun when your Check Point— sorry, not mentioning names— when your firewall module, when your antivirus, when your EDR and other tools all give you a different overview, because then you really don't know and you're chasing all these ghosts. So I think it was in 2022 that I saw a report by Panacea that said that So in a large enterprise, for instance, they use up to 76 different technologies, but, and this was for me the more salient point, 52% of enterprise CISO teams' time goes into deriving actionable intelligence from these tools. So actually you think you're getting a solution, but you're adding to the problem when you're not optimizing your control landscape.

Yeah, and I want to tear this apart a little bit, right? Because you started with the problem of, you know, we used to call it vendor sprawl. And, you know, when I was at Intel and I oversaw the security for all the IT clients all over the globe, you know, I asked them going into the role, well, how many solutions, how many security products and solutions and software do we have? And I was assured, oh, not that many, you know, and some people said 6 or 7, another person said, ah, definitely under, under 12, and I started to look. And I stopped looking at 146. It was amazing. It was security vendors. It was internally developed software. It was other software that just had a security function that was also feeding into the mass. And you think, oh, more tools, the better you are, the more capable, the more insight, the more things you can do. When in fact, it just means you have to look at 146 different dashboards and interpret what each one is saying, and they're saying something different, of course.

Exactly.

And you get inundated with those alerts, as you said, the, you know, the different viewpoints of the same issue. And even if you resolve the issue, now you have to go back to all those tools and resolve it in each of those tools. And I know there was a big push many years ago for integration, single dashboard, right? That was a huge selling point for a while. So everybody had a single dashboard that everybody else was supposed to integrate with, and that didn't work so well, right? Vendors wanted to keep you in their tool and not the others' tools. So there was just, there's just a lot of thrash. I know CISOs at this point, when they're looking for to bring in a new capability, you know, one that they don't have, they'll look at the vendor landscape and they will step away from even the best product if it can't smoothly integrate with the current products they're using, right? They don't want another product to have to go into and manage and another dashboard. They're willing to take a lesser capable solution, but one that is more tightly integrated. Because, you know, as you said, especially in security operations, you're spending an inordinate amount of time in so many different tools and dealing with duplicate type of alerts and issues, and not enough on actually fixing and recognizing what the real problems, gathering the right intelligence, and then going and fixing it. So, you know, what are you thinking as we see the evolution of our industry? We still have a problem with vendor sprawl. We still have a problem with lack of integration, even when everything is, you know, moved to the cloud. What is kind of that next phase that we need to be aspiring to when we're talking about all these problems?

Well, in my view, it's, it's looking at it from the end user perspective and how do you build solutions that are usable out of the gate. Another point that came to mind listening to, to your points that I wholeheartedly agree with is that a lot of these solutions and tools come with very inelegant processes. So for a bunch of smart people in the industry, we build really dumb processes. Like, take vulnerability management. It, it never ends. You're never done. Um, you can keep scanning your network, you're always running behind, you never have the latest status. You get all that information, you, if you're somewhat mature, you have kind of a web portal that you can distribute it to all the asset owners or the, the business security teams, and they then have to follow the policy and do testing and, and feedback their information to you., but that's not a great approach. And then people have now realized that, well, there are too many vulnerabilities and we're already actually cherry-picking them to go, well, we'll only do the criticals and the highs, but you don't even know what the vendors put in there, so you might actually be missing some interesting bug fixes and others that we just ignore. But then somebody came up and said, and conceptually it sounds fine, like let's have a threat-informed approach. We will build a threat intel team, we will scan the entire internet, we will find malicious actors out there, we will study them, and then we will mimic their approach, or we will actually ensure that our detection and response capability is engineered towards that. That's, that's fine, but then it gets pushed further and we— and somebody said, well, we can actually have intelligence baked in on which of the patches are being abused. So we have exploitability. Is it exploitable? Okay, fine. Or is it being exploited? Now the second one I have a huge problem with because now you again have to scan the entire known and unknown dark web for a state change that's going to upset your risk calculation dynamically in real time. And the premise is you cannot miss anything on the internet or your information is inaccurate. Is that really the best that we can come up with?

So again, I mean, it sounds great in principle, but, you know, I think it falters so many times in execution. And, you know, as you're talking, right, it's a great conversation because there's a difference between data and information, right? Data is typically— it can be structured or unstructured, But you need to get it, you need to distill it down so it's relevant to you and your operations, timely, accurate, and so forth. And then it turns into information, and information is something you can use to actually make decisions. And again, if you've got too many tools flooding you with data, it's really tough to be able to analyze and derive that information, that small little piece that you need. And that information might be, okay, what is the most salient vulnerability because it's being exploited, because I have it on my critical systems, because it's not currently patched, or it's in the process of being patched and I'm only 60% there, right? What are the potential cascading failures if it does, right? All those kinds of things become very, very difficult And if you've got too many tools flooding you with information and you're spending all your time just trying to derive the intelligence, you are undermining your efficiency of what you can actually accomplish with your teams. So tools are great, but too many tools can crush you, especially with the data that they generate.

And I would add to that that We, we spent too much time focused on analysis. For a bunch of these things, it's actually your find-to-fix vulnerability velocity that needs to increase, and you just need to think of it in terms of like a CI/CD pipeline, and you want to run faster and faster, but you don't always need to spend so much time on the analysis if your throughput is high and and you can just deal with a higher volume. And I think we need to start thinking in this way and optimizing towards that goal.

Yeah. You know, and I, in my mind, I think you have to do both, right? You have to have the resources and the efficiency to do both. You need to be able to determine out of the huge vast number of vulnerabilities that are constantly being released, right? I think on average now we're at 6 vulnerabilities a day. That get released into the industry. And you can have cascading effects of that as well. So we do need to figure out, okay, out of those, what really should be our priority? I was recently talking with Wade Baker, and, you know, he had done a lot of research, him and his firm, about all the vulnerabilities out there. And I think he said it was 2% get actively exploited in the industry. Great. If your vulnerability plan is, I'm just gonna go fast, I'm gonna try and patch everything, you're gonna lose because 98% of your effort is really pointless, right? You're not getting any return on that. So being able to quickly prioritize and cherry pick, and then on the other hand, have the operational excellence to have that velocity you're talking about, to go out quickly and to do it in ways that you're confident of, You know, I've seen companies and organizations have a terrible operational excellence when it comes to patching. So when they go off and do a patch, I actually had one where we did an audit afterwards and the IT folks came back and said, hey, we're 98% patched, relax, we're good. And they were telling the executives this. And I had the audit. Because I had asked for it and I was in there and I said, well, that's not exactly true. And I, you know, the IT executive looked at me, you know, with just evil eyes and I said, they pushed the patch to 98% or whatever it was. However, when we actually did a query to see how many of those systems the patch actually installed properly, and were rebooted because it needed a reboot, now you're down to 40%. So just pushing the patch, that's the wrong metric, right? You need to make sure the system has benefited from it. And the executives, you know, looked at me and looked at the IT and told the IT guy, no, go fix this. This is a problem. Don't tell me that this is resolved. And don't ever come back with just how many patches you've pushed. But again, that is the difference between data and information. The data is, oh, I pushed 90, you know, patches to 98% of the pool. But the real information is, yeah, only 40% of them are actually protected. And that holds true in every phase of what cybersecurity operations do. Right? When you look at the alerts for all sorts of different things, you know, you need to be able to distill that down. When you're looking at patches, when you're looking at threats, same thing, right? And it's just, it's a problem. So how do we improve that efficiency? I've seen metrics play a big role because in almost all cases when I'm seeing huge inefficiencies, their measures and metrics really are substandard, right? And if you can't measure something, you're not going to hold yourself accountable, and nobody else is going to hold yourself accountable until, oops, something happens. Well, the metrics look good, so it's an anomaly. No, it's not, right? I've seen operational excellence efficiency people come in for those processes you've talked about, which I agree security We lack those, right? But where do you think we really need to move? Because our industry is still where it's at. I think it's better than 20 years ago, but we're missing, we're still missing the boat. What's next? What do we need to focus on?

I think you shared a couple of key insights, and before I come to your question, I think also the metric itself of 98% can be very interesting depending on the scale that you're working on. I was in an environment where I took on an interim CISO role, where we had a pretty large estate, hundreds of thousands of endpoints, and the green dashboard reported 95% patching. And I looked at that, I'm Belgian, like, well, the 5% gap is larger than most companies in my country, all of their estate. So that's the first problem with it. The second one is when I started to look in the, in deeper into the numbers is that it didn't have like an even distribution. So the 5% were actually in the critical business lines, the ones that you want to protect. But I think we are afraid of saying like we need to hit 100%. Sometimes to be efficient or effective, you actually need to hit 100%. It's figuring out which 100% is crucial and where to put that effort. That is the key, I think. Yeah, and then in terms of your next question, where and how do we need to evolve to? Look, I think it needs to become less cumbersome to operate all of these things. From my perspective, it makes zero sense that when you have a certain maturity state, let's say in a bank, Bank A, I'm at this maturity state. To go to another maturity level, might take me 12 months of effort, 18 months of effort, whatever. If you take that same team, drop it in Bank B that is at the same maturity level, guess what happens? It will take them 12 to 18 months to push up the maturity level. That happens everywhere. And the key thing is also you can drop that same team that had results in that new environment and they could spectacularly fail. So I think we need to improve the outcomes but also shift our focus. Before, when you said, okay, with Wade Baker, he analyzed that it was 2% where you need to focus the effort, I kind of disagree. All the effort that we have to spend on essentially our estate is lost effort. It should be the easiest to control, and we have hard challenges ahead of us that we haven't even tackled. What's happening with my data at my critical parties? And sure, now we see more with third-party risk assessments, and, but essentially in the past it was all questionnaire-based. Shouldn't we focus more there? If we have change management processes and your trusted vendor comes and walks up and drops a binary on your server and you test it out functionally, a couple of clicks later it's in production. Is that really not where we should focus more? So from my view, I think we need a more industrialized, robust approach that doesn't require to reinvent the wheel for every different organization. I'll put it in terms of a SOC. How many people in the audience listening to us now will say, okay, I've built a SOC from scratch, or I took it from a low level of maturity to high level of maturity? You have design choices, you have to enable certain logs and audits and all that. Depending on which technology you have, you then have to build your use cases in specific ways. Why can't I just download a use case library? Like, this stops 80% or 90% of the ongoing attacks. It's good enough to start with. I guess the answer is the way that cyber is being monetized. So from the vendor perspective, as we discussed before, there's a lot of VC money floating around, people are pushed to quick exits. Yeah, let's prove that we can do this in a lab and then we pass the Lego box over to the client, you design your castle, whether it has two towers, a moat. People spend inordinate amounts of time doing that. Some people really suck at it as well. Instead of building a castle, they build an igloo that's not fit for purpose. Or the castle just falls apart and isn't maintained. But then the second concept, I think, is we have all of these consultancies sucking up the talent and then reinventing the wheel, and they charge you 300-400% of the cost of the wheel, and then they can claim to other clients, hey, we've invented a wheel, we can come and do it again. We're not actually selling you the same wheel, but we can send you some of the same people that have seen somebody build a wheel and for the pleasure you'll pay 300-400% again. I'm looking at that from a distance and I'm just wondering like, have we gone nuts? And I really do understand the disconnect that we have with CEOs, CFOs that just look at this all-consuming, ever-growing InfoSec capability that requires more people, more money, but in my view we're focused on the wrong challenges. The challenges ahead of us and the ones that we've been discussing, they're not that hard to fix, but we have to fix them and think about fixing them in a different way.

Yeah, and you brought up some great points there, right? Kind of vilifying to a little bit, and I'm not saying, you know, all vendors are bad or anything like that, but they're in it for the money. And whether it's an innovation organization that's, you know, building new software, they're really looking for minimal viable product to get it out there. They're looking for investment or to get bought out. And they tend to lack all the processes, right? And they may even lack internal security on their own product. We've seen that. We've seen the consultancy side. Many are ethical, others are just really trying to push billable hours and they're not adding a whole lot for what you're paying for. And so that's a problem. And, you know, you had mentioned that, you know, why can't we come up with a standard? And I think we actually should have standards, but I also believe that certain sectors— healthcare or finance or manufacturing or transportation or communications— I think there need to be sector-level standards because what's important to healthcare, right, which is really about privacy regulations and, you know, keeping things confidential is a little bit different. It's different enough than let's say the finance industry who really wants integrity, right? Don't move the decimal point. Don't let anybody take over the financial transactions. But having some of those canned starting points. So if you're starting your SOC in the financial sector, you should be able to download and institute a baseline, you know, alerting system, what alerts you need, what rules you're going to run, your prioritizing matrix, all those kinds of things, and even automation around those and be able to bootstrap yourself very quickly. And I think that moves you up the ranks, the ladder of that maturity level as you were talking about. And it definitely gets you to a more efficient state much faster. So I don't think there will ever be a common framework that fits everybody's needs, but I do believe in kind of that sector configuration. And once you're able to install or bootstrap that, that's where you build off of, that's where you tune. But if you can get 80% you know, all of a sudden and, you know, in place quickly, that's a huge efficiency gain. Huge.

Huge.

And again, as you said, I'm not sure if the vendors necessarily want that because there's money to be made in configuring it for you and making sure there are innumerable numbers of configuration options that they're willing to explain to you and have as part of their continuing licenses that they're going to charge you. But—

Yeah, but it's also— sorry to interrupt. No, no. It's also a challenge of like educating the users. Look, I think there are a lot of analogues between cyber and let's say life sciences. And if you look at the immunity system, you have two immunity systems in the body. The one is the— the first one is the innate immunity system, which stops 80 to 90% of attacks. And the second one is the advanced. Now, the advanced is the one that gets all the focus because it's sexy, it's innovative, it's the, the realm of the vaccines, the pills, all of that, right? And we're really good at pushing pills because it really is damn hard to teach people to lead a healthy lifestyle, to get them to quit smoking, to not drink, to exercise. Um, so there is user involvement required, and Some people don't want to go through the effort. So, I think now I've actually vilified and pissed off all groups equally.

Well, it's good that you're at least being equal about it. Go after everybody. Yes. Exactly.

No, but I think that's maybe one of the challenges that the industry is trying to overcome where you have an unsophisticated user or an uncooperative user and how do you get them there. So I don't want to be blind to that challenge, which is a challenge. Coming back to your point on the standards, while you were saying that, I was both agreeing and disagreeing, and I'll tell you why I disagreed with it. I think the idea is very sound, I agree with it, but when you look at certain functions across different entities, They are the same and they get attacked the same. Like backend services, HR, finance, IT, even the security department, procurement, all of those works the same or similarly in a nuclear plant, manufacturing company, and the government entity. So actually, now that I said that, I think what we need to do is we need to lower our scope, and that's going to drive up efficiency. If you can say, well, I have one standard for these back office functions, and this is the one that we implement across all of them, and then you get a sectoral standard like you said, this is for finance, and you specialize it in trading applications and wealth management platforms and all that, then we could be on to something.

It's interesting because there does need to be simplification just to be able to manage, especially multiple tools, multiple fields, multiple priorities, and be able to deliver on multiple goals. I'm also concerned if we oversimplify. If we do that, we're squeezing the bubble. We may put more requirements on the people and the behaviors if we take away from technology, or we may create more cost if we try and reduce both the friction, you know, and the risk. So there's always give and take there. And, you know, when we look at risk assessments and going, okay, What's the goal? It's never perfect, you know, you're impervious to all attacks. That doesn't work. We know that. It's really about managing to an acceptable level. And if we don't have those goals, we don't know the target we're trying to hit. Once we know the target, then we can have that mix of how do we blend tools? How do we blend processes for consistency and sustainability? How do we weave in that human element? Because the human element is there, right? And it's often attacked or a weak spot, but how do we blend that technology process people so that we do wring out the highest level of efficiency? I mean, where do we go from there? How do we look at it? How do we, for any organization or sector or for the entire industry, What do we need to change about that?

I think it's our approach on how we collaborate. As you were saying that, I was just thinking you can go around the world to conferences, pick up great presentations, either corporately sponsored, people pitching their wares. I've been one of them, so I have no problem with that. People pitching their research. But what I do miss is like a common research goal and project where we actually determine whether the advice that we're still sticking to is still sound in 2023. Like defense in depth as a concept, I read about that, I think the first time, I want to be generous, when I was 16 years old or something. I'm turning 41. Is that still the best approach? Is it even still true if across multiple layers you have different, well, similar weaknesses? Malcolm Harkins always refers to it as expense in depth. So I think we have some of these ingrained beliefs about our defensive landscape that we haven't dared to change, that we haven't critically assessed, and we need to come together as a community to have that dialogue. Like, what is the next generation cybersecurity architecture and environment going to look like? I think between the two of us, we came up with some really good ideas already, like let's create a standard that already ticks the box for a part of the environment, focus on the other parts. Like you said, it's not about securing everything maximally at the same point in time, How many organizations have Exchange? How many people are breaking their heads about how do I best secure my Exchange? Can't we as a group come up with like, this is the one approach that mostly works in all configurations, job done, move on to something else. So I think there's a lot of inherent risk that is still there because we haven't critically reassessed effectiveness. And we keep coming back to assessing effectiveness of controls and countermeasures and all of that.

So, you know, two points here. First off, I think you bring up a great aspect here that security evolves over time because the threats evolve over time. And if we even today put in a perfect security system, it starts to erode over time. It's not gonna be perfect tomorrow, next week, or next year. So we are constantly adapting. We have to because the bad guys adapt and they're smart. They, you know, we put up a wall, they figure out how to get over it, through it, under it, or around it. And then we have to figure out a different type of wall or structure or something else. So we do have to continually care and feed for our security programs. And we have to not only adapt to the bad guys and their new tactics and what they're doing, We also have to be cognizant that there are different types of demands on the other side, the expectations of the executives or the shareholders or the customers or business partners. So we have to balance this wire act and not fall over and move at the same time. And it is really, really difficult. And you had mentioned, so for example, email, right? Everybody has email. And I get there are, there's baseline best practices, there are. But on top of that, as we go through this adaptation, we start to realize, okay, we need to put in other controls, right? Years ago for email, you could attach anything you wanted. We realized that the bad guys were using executables, right? And just putting the virus executable there and saying, click on this, and people would. Okay, wait. Wait, let's now restrict executables. Okay, that makes a lot of sense. So they moved on to other things, right? COM files, HTML files, that's a great one. Instead of putting the executable, I'll put an HTML file in, it'll open your browser, go to my site and launch something or attack you from there. Okay, great. Well then some company said, well, we're just gonna block HTML files. Well, wait a second, wait a second. That can impact the business. You know, we saw Office documents. We use email to send Office documents. We love it, right? The world loves it. But the attackers realized, hey, wait a second, I can use macros in those Office documents. And as soon as they open them, again, it does something that does something else that eventually downloads something or, you know, attacks you. So people started thinking, oh, well, I'll just block Office documents. Now you're severely impacting the industry. Is it a best practice? Yes. If you can block Office documents as attachments, please do so, right? You eliminate a whole vector of threats. But in most organizations, they would go, no, that is too much friction, security. You are inhibiting our business functions. You can't do that. So every organization now at that point has to start to decide, well, we never use PowerPoint, so we can block that, but we use Excel 'cause everybody runs Excel for everything and Word, so we're gonna allow those. And that's where I think you get into the nuances of there is best practice, If you can do it, but you also have to understand walking that balance that you may not be able to do all of those. So if you can't block Word documents, what do you put in place of that? Because you still have to manage to a risk goal. How do you mitigate that risk in some other way? And there are ways, right? But again, the complexity of, well, what's best practice really starts to change for every different organization. So there is customization that is required. And I don't think we're ever gonna get away from that as long as the attackers are intelligent and are adapting their attacks to specific sectors or even specific targets. We can do baseline stuff, But there's a lot above that as well. So how do you, the baseline stuff is easy, right? Everybody should have a strong password. Okay, fine, right? But that really is becoming less and less effective. We really want people to use at least second factor, really multi-factor, and maybe for some higher end stuff, multi-factor that you're using a hardware token or something. That's a little bit more difficult to put in a baseline standard. Now that comes in customization. It's still possible to get efficiency throughout a sector or throughout the industry, but how do you communicate and set those types of efficiency gains when everything's changing over time?

And as you were saying that, I was just thinking because Maybe that is a role for some kind of regulatory body that says, wait, wait, wait, wait, everybody is knee-deep in these issues dealing with fires. We will go and figure out what are the emerging best practices, and we will feed that back into the industry and go, well, maybe blocking attachments, like you said, is a bit medieval. Like, let's, let's cut out this cancer here. Well, we still do that. We do, we do.

Yeah, we do, we do. But that's surgery with an axe. Sure, exactly.

That's still, I think, not the preferred solution in some cases, but I think that would be an efficiency gain to have like an independent body to study that, but to pass that back into the industry. Because as you were saying, that the advantage is always going to skew towards the attacker. First of all, like you said, they have only one objective. They're not really running a business that can be impacted by a lack of security or by having too much security. They have one objective, that's to be successful in their campaign, whether it's espionage, data exfiltration, ransomware, you name it, but that's the goal. So they can study the defenses. Like you said, these guys put up a wall. How do I climb over, around, go under it? And we don't match that innovation speed, but even when we do innovate, our adoption speed of innovation, even awareness in, in the innovation landscape, is pretty low. One example that came to mind is when you were discussing that is, for instance, you have CDR technology, content disarm and reconstruct. You can say, hey, I check the syntax of the this PDF document, I see some Java code that should not be there, I rewrite a clean PDF that I know is syntactically correct, I put the content in there, strip all of the links, for instance, and then I pass that to the user. You have now not, let's say, changed their workflow too much. You've not impacted the user too much. Okay, sure, maybe they need to copy a link, but it's still better than, hey, I can't get my document from external people. So I do think that in, in, in these emerging best practices, we have some, some better approaches to certain challenges, but it's getting the market aware of them and changing fast enough and saying, okay, this stuff that we've been doing is too crude. Let's not invest money in that. Because it's just ineffective. It ticks a box on my regulator's checklist, but that's about it.

Security by— yeah, okay, that doesn't work. Okay, so what I'm hearing, and I like this direction, right? For any environment and even in sectors, there is a baseline, right? There's not an organization out there that should allow 4-character passwords, right? So, you know, there is a baseline. But then there is a— and that's not going to change very often. But then above that, there are these best practices that do have to change. And again, they can be more complex, right? Block .exe files and Office docs. Okay, if you can't do that, block Office docs. If you can't do that, block some of them and institute these other controls, right? Creating that complex set, which I think does take a community. I know of no single government, no single company, no group that can maintain that at pace because, you know, as you said, we have to keep pace with the attackers. I think it takes a greater community effort that right now isn't there. It's not organized. We're not leveraging all the resources we should be across our communities. But when we have that, then we have these best practices. And then I think above that, that's where you get into, you know, kind of true innovation and leadership within individual companies or even maybe sectors where, you know, a company may go above and beyond even the best practices because of what I do, because of our risk tolerance, because of what the board is holding me to. We need even extra security above that. But in that kind of structure, it's really easy to implement that first part of the pyramid. And then it's not as easy, but it's still really efficient to do that middle part. And then the, you know, the very, very top, that should be the least effort overall. Well, it may be the toughest to do, but it's the smallest overall amount of changes that you should have to make. And maybe when we do go to that kind of pyramid model, we can bump up the efficiency, you know, or I'm thinking orders of magnitude, especially if an organization says, okay, I'm gonna build a security organization and I have to start from scratch and let me figure all this stuff out myself. You're gonna lose, right? It's gonna take you forever or you're gonna spend a fortune on a whole bunch of different tools and process people and consultants and everything else. And then you're still going to have to sustain that customized environment, which also is not really efficient. So I like where we're kind of going here.

Me too. And as you were saying that, I was thinking I'm already ready to sign for the building of the MVP. You got me convinced. But the real point I wanted to share is that absolutely we need to start thinking in this way. And I lost my point. Sorry.

Okay, well, all right. My brilliance dazzled you.

Good night.

I like where you're going, right? You said, hey, I'm ready to write a check. So, you know, the last kind of question that I have for you is for the audience, for the cybersecurity professionals and executives out there, for those leaders, what should be that next step, right? Should it be an assessment of their products? Should it be a review of all the processes and try and fill in those gaps? Should it look at those end outcomes that you had, you know, mentioned and backtrack from that to find out what's critical path? Is it maybe, oh, we don't even really have goals. We don't have tangible goals. Let's go get those from the board. So at least I know what I'm going to be, you know, shooting towards, you know, or maybe let's review our measures and metrics program so we can start measuring all of these. What are the recommendations you would have for the leaders out there to say, take a moment, I know you're fighting a fire every day, you are, but take a moment. If you want to get more efficient, what are the next 3 things they need to do?

The first one I would say is to get a really deep understanding of how your team is spending its time.

Okay, time utilization, right? Okay, I love that. Yes.

So that's the first one. The second one we also touched on was the capability utilization. So across your solution landscape, how much are you actually using? Maybe you have a product that has like 5 different features. You selected it for the first one. Can you start leveraging the 4 other ones? You will not need to start deployment again because you already have it. Um, you will have the similar or the same console. It may not meet all of your use cases, but can it get you there 80% of the way? And Can you then deploy that 80% on your 30% most critical assets and start thinking this way? Do more with less, really.

Well, you know, so it really comes down to making sure you're taking advantage of the assets that you've already invested in, that you've already invested not only in the software or hardware or whatnot, but you've invested in the implementation costs and the usability and training and sustaining operations, you may have tools out there that are underutilized, and now you're just creating more problems for yourself going after more tools and starting the process over, and now creating more, you know, sprawl that is gonna come back and, and bite you later. So I like that, and I think it ties in with the first one you talked about, is, you know, understand how you're spending your time. Because I think there is a concern that you've got duplication of effort. And it can be with people, but it's typically also tied to the tools they're using. So if you're using 2 or 3 different tools to look at the same thing, and your poor people have to spend their time looking at those 3 tools instead of 1, maybe it's time to drop 2, make the 1, focus on it, and make sure that it's configured to get you what you want. Instead of just wasting your time. Okay, so 1 and 2 make a lot of sense. They tie together. What's your 3rd recommendation?

No pressure then.

No, no pressure. It needs to be stellar too. Applicable to everybody.

Let's see. Unplug everything? No.

That works, but we're back to doing surgery with an axe.

Yes, exactly. It's not going to be that efficient. So maybe We're dropping off a bit. No, I would also look at, look at your budget and how your budget has evolved and project your future headcount and try to steal that from the efficiency gains that you plan. So that's why you start looking at how is my time utilized. You go back to your vendors and say, hey, I got this lovely solution here. 'But my people are suffering.' So push them to drive up your efficiency. I think, of course, there's another last remaining group of people that I haven't pissed off yet, and that's recruiters. Because we are disincentivized as a community as well of building highly efficient environments. Imagine that you can do what somebody else does with 200 people, but you do it with 100. But then the recruiter calls you and says, like, what was the, the size of your last team? It's 100 people. Oh no, I'm looking for somebody that can manage 200 people. The person managing the 200 people is wasting 50% of the, of the effort, right?

So you want an inefficient person? Oh, okay, you're right, I'm not, I'm not that inefficient person you're looking for. But that's also important because you need to really be able to talk about goals. Yeah. I can achieve these goals with this number of people. So, I mean, that is in my mind a true measure. But I love where you were going with, you know, look at the trend of your headcount, of your budget, of all of these things, because a lot of leaders don't want to do that. They don't have time to do that. They don't know how to do that. And it can be an ugly story, right? Because we know we have to constantly evolve. And if you're going to slap on new tools and new processes, you need new people. So your team's just going to eventually grow and grow and grow. And if you start looking at the rates of that, do you— and you go out 5 years, you know, do you really want to go to the board and say, yeah, I need double the staff, double the budget in 5 years? They're going to look at you And again, use that ax to efficiently remove inefficiencies, which is you. You are the inefficiency. Exactly. So it's a good exercise for the security professional, for that leader to do that first in private to figure out, okay, how inefficient am I? Do I really need to double my in 5 years? Right? There's something not right there. And that might, motivate, you know, as well as help drive the understanding of what's creating that need. How do I do more with less? Because that really should be our motto in cybersecurity over time. You're going to have to do more probably with less, or at least relationally less. So you need to be more efficient. So effectiveness can't go down. Efficiency has to go up. And you're going to have to do more. That is, I think, a great exercise. It's an ugly exercise, but it's a telling one to show leaders that this really is important. You can't go into the board or the CISO or to the CEO and say, I need 2 more people today. I need 2 more people tomorrow. I need 20% budget increase.

Yes. And we see that. And I guarantee. And I guarantee you, if you're—

12, 20, in Europe one year it was 60% on average when COVID hit. They wanted a 60% on average budget increase for cybersecurity. That's not sustainable. So you better get your house in order.

Exactly. And I would say if you don't do the exercise, somebody else, like you said, is going to do it for you. And it will be the CFO, it will be the CEO, and somebody somewhere is going to wake up and say, doing things securely is a goal, but it's not our business. We're not trying to build a security organization here. So no, absolutely, absolutely.

Yeah, the cost has gone up, right? It's just too much. It's not tenable over time. And now you're becoming a liability, right? And if they're able to look out in their industry to their peers and go, wait a second, this other company is as secure as we are, but it has half the staff. That is very, very ugly, right? Because if you can't do it with half the staff, then it shows how inefficient you are. And that actually is one of the things that I recommend to boards. Look at your peers, see how they're doing it, what they're spending. Because if it's a lot less, you've got a leadership problem inside.

I would say— sorry for that— I would say it's also a great tool for career growth. Let's say I'm a CISO in a $5 billion revenue organization. I've done my optimizations. I go to the CEO of a company that's $20 billion and I say, well, actually, The last 2 years I worked on efficiency. I was able in the last— let's make the timeline longer— on the last 3 years I've been able to keep my headcount stable. I've reduced my expenditure. I'm the right man to come and do it here, right woman, sorry, to come and do it here. And that might create a new opportunity for that person as well. So I think, yeah, hopefully this tip helps some of the audience out there as they go along. Either in their current organization or their future organization.

Yeah, everything we've talked about, and I'm glad we're kind of finishing up on this, efficiency is really important. Yes, putting out the fires every day when you wake up, that's important too. But you have to see the long game because there is not an infinite amount of resources cybersecurity can pull. There just isn't. And there is, you know, a wall at some point. So you have to drive efficiencies because the bad guys are getting better. The IT environment is getting more complex. So security has to adapt at that pace, the pace of the bad guys and the meeting the expectations of what those executives are. And that also includes how the environment needs to change, right, for the corporate goals. So efficiency is important. And I think every, every organization out there, every cybersecurity organization out there could be a lot more efficient. We have to get there and we have to get there as a community. Yeah. So now let's pivot a little bit here. I know that you are, have just recently left an organization and you are co-founding a new startup. You wanna talk a little bit about that? Maybe pull back the covers a little bit. I don't wanna pry, But hopefully it has something to do with efficiency as well.

It actually does. So that pyramid that you mentioned, that's actually what we want to build. So we want to focus initially on the cyber hygiene basics and help organizations achieve these faster with less overhead, make security almost turnkey usable as we discussed. But we recontextualize cyber as a process and business process issue. So the point is not to sell a technology but an integrated capability that comes with a tailor-made process that says, well, you're a large enterprise, this is kind of like the cyber car that you should drive for 80% of your problems, and then you can divert your resources into the other 20%. So we're a group of 5 lovers of exquisite levels of pain, and we think we can get this done.

Got it. So you're, you know, the— your clients really, they're gonna— you're gonna benefit them by showing the opportunities for efficiency gain and then be able to back that up with the tools, the processes, and whatnot to be able to seize on those gains. So maybe you can free up headcount, maybe you can free up budget. For that next initiative that you need to be able to adapt to the attackers? Where are you going to get your budget for zero trust or whatever? If you can make things more efficient in your environment, you may actually already have the resources you need to adopt that next architecture, those new capabilities, that more advanced process set to be able to manage risk better. So, no, that sounds great. I'm looking forward to it. When are we going to hear more about it?

Well, we're in a stage right now where we— so, let me back up a bit. We believe that, as I said in the beginning, a lot of problems come from coming up with a solution, going to the market too quickly, getting a lot of VC funding, and then pushing that out as the next holy grail. So we are bootstrapping and we are at this stage looking for design partners that say, hey, this challenge resonates with us and we want to help co-design a solution on a future promise that if this effectively works and helps me save whatever we agree on and helps me become more effective, I might buy at a discounted price. Because then from our perspective, that de-risks our investments as well. But then we are also born with a product-market fit, and we can also demonstrate to the market that in those particular environments, we've actually solved this challenge. I mean, we do our testing in our lab environments, and for instance, in terms of patching with one organization, it looks like we can achieve a 12,000 times efficiency gain Pushing them.

So you said 12,000 times?

12,000 times from 2-month patch cycles down to 7 minutes.

That's incredible. That's incredible. And you're of course going to publish a white paper about all of this eventually, yes?

You'll be the first one to get it.

Okay, I want to see that white paper. I want to know that because that kind of efficiency gains is is it's completely possible. I know it. I, you know, working with organizations out there, but it's tough to deliver it. And if you're able to deliver that, I can't imagine any leader that would go, no, I'm not interested in that level of efficiency gain for my organization. Right. It makes them look like a superhero, you know, with a cape flying in the wind to be able to do that. So that's awesome. That's awesome. I'm looking forward to hearing more about that. And I'd love to have you back on and kind of talk about especially the partnerships, right, within the industry that you're developing and how that's leading to better insights and better efficiency gain. But that's going to be in a future podcast. But exactly, thank you so much for coming in. It is again, efficiency is so important and I think it's something in our industry that we're not paying enough attention to and we're just I think we're just too focused on putting out the fires of the day and not looking at it long-term. And if we don't see what's coming and we're not prepared for it, we definitely lose. So thank you everybody for watching. Be sure to subscribe and catch all the Cybersecurity Vault episodes where we chat with industry leaders and dive into the most relevant and interesting cybersecurity challenges, perspectives, and best practices. We'll see you next time.

Thank you so much.