The Cybersecurity Vault - Loops and Angles of Cybersecurity Compliance with Ian Thornton Trump

Welcome to the Cybersecurity Vault. I'm your host, Matthew Rosenquist, CISO, industry cybersecurity strategist and advisor. And today we're going to talk about the challenges, maneuverings, and ugly surprises when it comes to cybersecurity compliance. And I'm going to be talking with Ian Thornton-Trump. Ian is the Chief Information Security Officer at Cyjax Limited. And the Chief Technology Officer at Octopi Managed Services. His career that spans more than 14 years, he's developed strategies, led security teams, and been a vocal advocate of proper security practices. Welcome, Ian. Thank you for coming and talking with me today.

Hey, man, I'm, I'm glad to be here. This is going to be a great one because, you know, just in the preamble, we talked a lot about some interesting topic. So yeah, go for it. Let's, let's kick it off.

All right. You know, cybersecurity, I mean, our industry plays and interacts with the world of regulatory compliance, and we're seeing that more and more come in with different regulations and rules. SEC comes to mind and so forth. What do you see as we're moving into kind of 2024 and beyond? What do you see as the compliance challenging that's kind of unfolding upon us?

Yeah, so it's a great question. I think, you know, it really hinges on a couple of things. But first of all, let's call it the way it is. We're chasing the dragon. We're trying to put compliance road down, you know, with the train engine of economic growth, especially in cybersecurity. You know, right up against the backs. And as we know, you can introduce a new piece of regulation, and it will take a lot of time to get it all drafted and signed and then move through the government to make it real. And then, of course, there'll be the first transgressors, which will end up in the court system. So there's some legal precedents to set down. So what is going on right now is going to mature, possibly like a fine wine or whiskey in its casks for a while before it really becomes a reality on the ground. And, you know, we've seen this time and time again with, you know, questionable moves on the regulators trying to, you know, especially in the UK, embarrass themselves with like end-to-end encryption and that whole ridiculous debate about, you know, we want to outlaw it in the UK because, quote, it's for the children. So, so we've seen all of these sort of very knee-jerk reactions, you know, big, big questions around AI. You know, I hate to say it, that at least in the United States, I feel it's already been politicized. It's already become this boogie monster. And, you know, to show a strong, you know, presidency, you're signing a bunch of regulation into existence, which, you know, is going to be very, very difficult to implement, if at all, you know, impossible. So, so we continually find ourselves in a situation where because it takes so long for a regulation to be real,, right? We're faced with old regulation that either can't keep up or is completely irrelevant. And I like to tell a story about a tech company that took all of their service tickets and threw them into an AI learning model, right? And what did the AI learning model tell people to do? Well, reconnect their dial-up modem to gain access to the internet. And the reason that happened was that was the most frequent troubleshooting tip that the AI model identified as solving the customer's problems. Well, obviously, we don't reboot the modem very often anymore to fix internet problems.

So, so— In your Windows 95 or Windows 3.11 system, yes.

Exactly. So, so we're in an awkward position now. And what's interesting is the regulations that we had, the laws that we had, are only now— the detail and the cases are starting to come out, and it's starting to go pretty, I would say, unbusiness-friendly. I think, you know, with the latest SEC case that Tim Brown is facing, Unprecedented territory. The, the area with Joe Sullivan succumbing to criminal charges, unprecedented territory. The awkwardness of the what seems to be this new game plan that is being unleashed by regulatory agencies is to sit back and watch the class action lawsuit go forward and see what companies do with that, which then allows for an easier investigation because a lot of the evidence would be gathered in the course of the class action for an investigation to take place, and an investigation then at the governmental level to lay charges. So, we're seeing this new playbook unleashed and we're seeing companies struggle busing it. And maybe it's because the customer, because those companies has overstated the robustness of their solution. And in a lot of cases, this solution that they've been offering in the marketplace has not changed very much from when it was first introduced. You know, I, I like to say one thing is really easy in cybersecurity is to do a risk assessment based on color. If it's beige, it's a problem. Okay, and, and, and And more to the point, if it supports things like FTP and HTTP, it's also a problem. And right now, we can at least say in some cases, it completely violates the requirement for encryption of data in transit. But we know, I can guarantee you, it does not have any encryption at rest.

Well, okay, so you covered a lot here. Let's kind of break some of this down. And I want to start with, the genesis of regulations, right? They don't appear out of thin air. Typically, it's some kind of expectation that has risen. You know, people say, hey, I don't want my data breached. Many years ago, they didn't care. Now it seems, hey, we kind of care about this. Hey, we don't want critical infrastructure to go down. Right. And that, at least in my mind, those expectations of the government or of customers or of suppliers or of insurance are saying, hey, we have a higher expectation, you're not meeting it. If the, if the marketplace can't attune itself and satisfy those, then people get mad and congressmen and everybody get involved and regulators start getting up and go, okay, well, we need to write, we need to codify requirements, right? Minimum requirements. And that's where this whole process begins, where they're going to draft it and review it, then they're going to institute institute it and everybody's going to be up in arms and then there's going to have to be cases in litigation and, you know, and eventually somewhere down the line somebody has to be made an example of and everything that you were talking about. But the origins are really with the shift of expectations. If our expectations over the past 10 years didn't change, right, we probably wouldn't have many more regulations. So, how do you see the expectations of businesses and partners and insurance and consumers and go, how do you see that have, you know, pushed regulations forward?

I would love to lay it all at the feet of probably Comrade Colonel Wang Dong and APT-1 when Mandiant's report basically kicked off the whole cybersecurity industry. To be fair, they did us a favor because it was really the first time it was revealed publicly about the issues surrounding advanced persistent threat actors, but cybersecurity in general, and how weak organizations in the US supply chain was against espionage and APT-style attacks, right? You know, before that, you know, and it was funny because just today online Bushido Token threw up this really nice post around, you know, current RATs and Trojans, and I noticed that Poison Ivy was still on that. Poison Ivy dates back to 2006 hackings, you know. So, so the fact that it still works, it's got to be probably one of the best written programs ever. It's backward compatible all the way to Windows NT. But, but I think what happened is loss and embarrassment, maybe even embarrassment more than loss, was starting to become a real thing. Especially in the early part of, I would say, the 2010s. And this is where, you know, the genesis of things like NIST and ISO became important. PCI DSS as well, to a lesser extent, became this really important thing. I mean, no one really cared about PCI DSS until you could start putting your credit card into a computer online, right? And so, as that kind of came into fruition, the economic disincentives provided by the companies themselves weren't really in balance with the commercial opportunity. And so, fast forward to where we are today is we're barely trying to hold giant megacorps accountable by handing them, you know, in the non-majority of cases, what appears to be a speeding ticket in terms of cybersecurity. Right. There have been a few interesting sort of eyebrow-raising things. But what's interesting is, with the exception of sort of like issues around data sharing and privacy fines— and I'm looking at you, Meta, for Instagram— and, you know, antitrust issues— and I'm looking at you, Microsoft, for bundling a browser to try and push Netscape Navigator out of the marketplace. The big fines that have happened in tech have been more about like the market and the personal data processing than they have been for this set of bad guys breached this company and took all of their intellectual property. What's really interesting is a lot of people probably know how voracious China has been for espionage type of attacks, right? But when they lifted all of the Cisco Intellectual property and Nortel Networks' intellectual property. Barely a whisper from the governments at the time about that because the global supply chain was so more important because of the billions and billions of dollars of trade going through the systems. It didn't even really ripple anybody's feathers. But when a government department or the US military got the hackings, my God, all of a sudden you saw a lot more activity and a lot more concern. So, you know, our frenemy China will continue to plague us. And, you know, although the rhetoric is sort of, I would say, against it, there were concerns raised about Huawei, et cetera, et cetera. The idea that you can sort of regulate your way out from the global realities of it's the largest trading partner of the United States, the United States, you can't sort of get beyond it. And I think this is where regulation is running up against raw commercial opportunity. And there's not really a good balance right now. A great example is sort of the view that I have is that the United States' lack of understanding of the European rules with regards to data privacy, i.e., the GDPR, are not embraced, understood, feared, or otherwise a concern.

We don't even have a common privacy, you know, set of rules set. We've got 52 of them for the different states and, you know, outlying areas, provinces, and so forth.

But let's be fair too, the United States isn't a country that takes well to being told by another country what to do.

That's true, but if there's a need, we should at least figure something out, even if it's our own version.

Figure it out and implement it and make it to where people can instead of having to know all 52 rules, which is mental because really then when I put on the conspiracy theory hat, I think this is an entire, entirely led by lawyers in order to make sure their pockets are well lined well into the 21st, 26th century. All right.

So let's talk about some specific regulations that, you know, in the next year may may cause some friction. And the one that comes to mind first is the US SEC requirements. And I've had all sorts of conversations with peers, you know, about the 4-day rule materiality. And I mean, this, you know, as you had mentioned, this has ruffled a lot of feathers. Personally, I like it. I mean, I like the visibility. I like the accountability. I think it's going to kick people in the teeth. But this is a— it's a new regulation. It hasn't been tested yet. Nobody's been on the hook or, you know, fined or anything like that. It just came into existence in late December. Finally, you know, people had to comply. Organizations had to comply. What's your take in 2024? What do you think's going to happen with this? And how much are people going to just revolt or vilify or the reverse? Do you think they're going to go, ah, it's a nonstarter? Yeah, we should have been doing this anyway. What do you think?

Well, I think, I, I think firstly, if you, if you, if we zoom in and we look at New York State Financial Services and their requirements that they've asked all banks in, in, uh, working in the state of New York, which is, well, pretty much every bank in the known universe, uh, to be compliant with, and you look at CCPA in California, um, I, I kind of feel like the idea of consumer protection and the idea of of a data security event, whatever we want to call it, ransomware, whatever, is detrimental to the company and also detrimental to the customers of that company and shareholders, right?

Because that's what the SEC is worried about, is the shareholders and their right to be informed, right?

Absolutely. And so I think it's valuable because the other sticks that we have are not really working. And I think the SEC, along with the US government, is really been embarrassed by a lot of folks that have come along and promised a whole bunch of things. And it's not so much maybe not even coming close to the mark, but not even having a plan to execute those things. See, I see it's like, hey, we tried. We did have a security certification. We did have an audit and a pen test, and we were working towards fixing these things is like one category, right? But the idea that you rock into a major company that's a public company and, you know, the regulator's looking to talk to someone that's head of cybersecurity and they can't find anyone, they haven't hired anyone. Puts you in the other category. And I think this SEC regulation is going to draw a line and say, hey, we're not looking for all of your— and this was one of the SolarWinds defenses that they're raising, is that, oh, it's gonna, it's going to, you know, reveal, um, you know, uh, a bunch of, uh, a bunch of important trade secrets. Well, if your trade secret is you're running Kaspersky antivirus or something like that. Well, you know, that's not the thing that they're after, right? And so, I think there was a lot of like, "Hey, we don't like change. Change can be expensive." You know, and then there's a bit of a, "Well, how dare the government tell us what we can do?" Well, the government is there to try and equal the playing field. And I know that's a difficult argument. You go down that and you're seeing lobbying and you're seeing all of this other ugliness that's there. But at the end of the day, if you're protecting the shareholders, you should be protecting the customers, and ultimately you should be, um, protecting the value stream of that company. And what I think they want in the market is they want some, you know, maneuverability. They want some dynast— dynamic, to a point. They don't want, you know, a company to be able to crush the entire, you know, ecosystem that we've built. I mean, this is capitalism that we're talking about. They don't want a single point of failure. And what I think they're seeing out there from a regulatory perspective is time and time again, the amount of people that are, you know, getting in trouble are because of systemic problems in the way that the business is organized, or lack thereof. Or if it's outright criminal. And what they want to try and do is draw a line in that and say, you know what, you're dangerously close to being a Ponzi scheme as opposed to being, okay, I see what you're doing. I've got some visibility on those activities. You know, the predictions that are— that the analysts and that the bond underwriters are going with seems to be on the surface somewhat accurate. Right. And I think they're just trying to normalize the process a little bit and at the same time protect the consumer supply chain.

Well, okay. So, I mean, you took that SEC regulation kind of down an interesting path because— and my question is going to be, do you think it will evolve to that? Because the current 4-day SEC regulations, the rules, is really just a clarification of the original rules that came out in 1932 that basically said, hey, companies, public companies, if something material happens, maybe a hurricane knocks down your factory, right? Something like that. That's— the investors have a right to know because your executives know, and that's insider information. They may trade shares, they may manipulate the stock on that. So if something bad happens, you have to notify, right? And that's what the 8-K form is about. Hey, we're going to notify our shareholders or potential investors something material happened. Nowhere in that rule does it say you have to have a certain care of duty for security controls. Nowhere in there. You can say, as you can say, hey, we have zero security. That's fine. But you still have to report if something bad happened. We don't care whether you have zero or a million, whatever you— however you want to quantify it. Right. That's your business. But you have to be transparent to your shareholders if something bad happens, something major, right? So I mean, that's what the requirement is now. It sounds like you have a belief that that's going to morph in the next year or two years where there will be a certain minimum standard like, you know, a FedRAMP or a NIST, you know, ISO or some other kind of, you know, minimum baseline to say you've got a certain care and diligence not just to your shareholders, but to our economy to be a player, right, in the financial field or in the healthcare field or wherever. Is that where you see those requirements that you think are going to go?

Yeah, definitely. And we see that with CMMC, the requirement for the United States government/military purchase ecosystem, because I think what the government is tired of is looking stupid because it bought product X, right? Or it bought product Y. And then they've actually had to spend billions of dollars on Einstein to try and secure all of these things that the vendors have said, "Oh, they're secure." Right, dude?

Trust us.

And I think they're tired of it. You know, just like, you know, in contemporary realities, it appears that we might get sucked back into a conflict in the Middle East. And the last time Western nations showed up in the Middle East, let's be fair, since Roman times, it's never ended good ever. You know, and so, it's what goes around comes around. But I think we're tired of that circle. And I think another thing is that this is the antidote to this is to start re-examining the way businesses are constructed for, and you're going to love this word because it's a big buzzword in the industry, resiliency. And the only way you can be resilient is if you have factual understanding of the current state. If you have constructed a model of the current state for customers and you're not prepared to admit that that is constructed for customers and not the real truth, then how are we going to get anywhere?

Don't believe the marketing. Don't believe the marketing.

But don't believe the hype. But, but I, but I feel like the SEC is, is really now going to kind of combine its requirements with FTC and also with consumer protection. I think that's going to be a big play in, in 2024 to start building realistic ways of dealing with these problems in like by 2028 when it's cleared the courts and, and whatnot. The genesis of these things takes so long. And regulatory fact-finding takes an even longer process.

So do you think companies will eventually be held accountable to what they're saying on their webpage, in their brochure, saying, oh, well, we follow, you know, the common term is we follow best industry security practices. Really?

Yeah.

And that's, you know, is that potentially deceitful? Are you defrauding somebody if you know you're not following those and yet you're saying that as a commitment in your marketing materials or something else? Do you think eventually that's going to come around either from a regulatory perspective or from simply a lawsuit, right? A class action lawsuit potentially.

Well, class actions are way easier to get what you want out of a company and hold them somewhat accountable. Maybe not individual level accountability, especially if they're incorporated in the great state of Delaware, because it's nearly impossible. But what I will say is that at first, think of it this way. Everyone now is making people fill out— to fill out forms essentially stating what they have for security controls and their level of maturity. In an attempt, maybe vain attempt, by your purchasing department to protect the global supply chain, right?

Are you talking third-party vendor kind of contract? Okay, not necessarily the customer or consumer.

Right.

And going to AT&T and go, "Here, fill out my 800-question survey." Right.

Yeah.

Although, with AT&T, yeah, okay, never mind.

But I think what falls out of that is I haven't heard of litigation yet that is going after false statements, right? Not fraud. So fraud is so difficult to prove because you have to prove that the person went out, basically was of a mental state to defraud, and that's really tough to prove at a criminal standard. But you can certainly look at documents that come out that suggest, oh, you know, we might have exaggerated the state of our cybersecurity. Okay. It may not have been a criminal intent, right? But at the same time, you can— it's easier to hold somebody accountable in the class action tortious way of saying, on the balance of probabilities, it looks like you might have overstated that fact. Right.

Okay.

That's easy to do. But 'Hey, Mr. So-and-so, you actually committed fraud when you basically perpetrated that everything was okay under the hood, but actually, no, turns out you knowingly knew, you knowingly knew, um, that things were not good.' Yeah, the bar for criminal prosecution is always much, much higher than civil litigation, and it should be, but But, you know, what Joe Sullivan saw is he was so sure that there wasn't going to be, you know, he was going to be able to defeat the criminal proceedings that were in front of him to the point where he rejected a plea deal for that. And then boom, done, right?

Yeah.

And everybody—

former prosecutor as well.

And this is—

yeah.

And the same office that he used to work with prosecuted him.

Prosecuted him.

How could they not raise a standard of doubt there? Some doubt, right? Because it's supposed to be beyond reasonable doubt, right? So, so where are we right now? Well, there's really interesting thing, and I think the whole industry is going to change if one thing happens. It's called USC Code 18-1001. It basically says If you lie to the US government, there's jail, right? Period.

This is for government vendors, if I recall correctly.

Correct. Now, we don't have a mechanism, probably thank God, in the civilian marketplace that has a criminal statute attached to lying when it's a business-to-business relationship. Right.

Well, there is fraud. I mean, that's a theft.

That is so difficult to prove, you know. But it's sort of like that is to me a huge gap. And I feel like the way terms and conditions are written anyway, so that if you do find and you go through a process of arbitration, the finding is going to be, 'Okay, well, we're going to give you your year subscription back and we'll just call it a deal.' Not good enough. It won't drive change, right? So, I feel like there has to be some sort of reevaluation on how we're going to call how we're going to hold businesses accountable. The problem, I think, when you look at it from a mass scale, is that, you know, right now, you know, folks like Progress Software are getting beaten up over MoveIt, and there's a bunch of class actions out there, and they're moving to consolidate that, and the SEC has already announced an investigation to their goings-on, etc., etc. So this is all playing out again. And this is because I think in general what we're finding is the worst thing in the world, Matthew, is to feel like you've been ripped off. To think that you've done everything in your power to do your own due diligence when you purchase Solution X or Solution Y, only to find out that it's actually the reason why you got ransomware and had to spend millions of dollars repairing your infrastructure and bringing it back to life. And so, I think there is, there's got to be some place where we can balance it because we're out of balance right now and there's not enough transparency. You know, just as we file taxes every year, maybe you have to file a third-party audit every year or something like that.

I hope we don't get to that stage. But you know, you're talking really about assurance. So, how does the world of certifications, do you think that's going to shift and start to adapt to help with this type of compliance, do you think?

Yeah, definitely. We're seeing that in the UK for sure with something called Cybersecurity Essentials Plus, which was a third-party audited cybersecurity controls matrix, if you will. Like, do you have antivirus, etc.? Right. And that's the only way you can engage with the UK government and councils and municipalities is by being CSE+ certified. And so, it's sort of a little bit like what CMMC is designed to do is say, listen, you have to be this high to go on this ride with being part of supply chain. In critical infrastructure land, which we all love to talk about, right? OT, IT, everybody gets super excited. They're trying to do the same thing. They're basically saying, oh, by the way, if you're part of the national critical infrastructure, here's a bunch of requirements that you have to meet. We all know that, especially in that national critical infrastructure, we're dealing with stuff from the dawn of time. There are infrastructure out there that you're basically one router command away from exposing to the internet because it has a it has a hardcoded public IP address. Okay? So all of a sudden, you know, you could be on some weird-ass country subnet if that device was made public. And it has a bunch of insecure protocols that it's going to start broadcasting all over the place.

Yeah, some of these devices are 20, 30 years old.

Right. And they're running, you know, things that aren't important like train signaling.

Little things. Little things. Yes. When to raise bridges, you know.

So, I think one of the things that needs to occur is that we really need to incentivize the goals of compliance that generally were set out. And especially when you are in a position where you've got this massive legacy tech stack and it's just, you know, struggling every year and your GRC people are like shaking their heads I think the game needs to change. And whether or not that's a government lending program, I don't like the idea of just outright tax grants. I like the idea of a lending program that you can pay back over time specifically for cybersecurity improvements, right? I think that's measurable and demonstratable, and it would be a more— it would be a less adversarial situation than basically Here's your all red report, Matthew. Good luck. We'll be back next year. Because that's demoralizing.

Yeah.

And no one will want to be there. Interesting.

Okay. So last question here. So for the audience out there, those cybersecurity leaders who own either part of their security environment, or maybe it's a CISO that, you know, feet is at the fire and they own the entire thing. How should they, going into 2024, how should they approach the challenges of compliance? What should they either be looking at or acting on as a priority for this moving forward? Give me 1 or 2 or maybe 3 things that they should be doing.

High level, it's really pretty simple from my perspective, right? Protect, The crown jewels, the thing that makes you money in your company, right? Protect your customers' data and protect your employees' data. And what that actually really translates into is building your cybersecurity around those three pillars and making sure that when you're getting solutions from the marketplace, you know, you're addressing those three requirements. I think simplify how you're talking about this to your board so that you can get the funding. If you talk about, if you go into any boardroom now and you say we need a new firewall, wall. They'll say, "That's great, Ian. Good luck." Articulate the reason why a piece of technology is failing you and say, "Well, it's the 9th time that we've had to patch this thing. It doesn't seem to be really performing at a level that we need to support our new remote working environment. And it's beige. So, we need to get rid of it." Gotta get rid of it. Yeah, I mean, what? Yeah, it's older than you are, Mr. CEO. So, I think that sort of high-level tactical or high-level strategic view then goes down into that layer of we have to meet compliance goals. Well, what's compliance really look like? Well, it's the evidence of security rather than security itself. And that's the other thing to sort of think about there. It's like, okay, this is a really great solution, Matthew, but there's no reporting. I'm like, I need reporting to prove that it's a really great solution.

You need the metrics to be able to have the value discussion, one, to justify it, two, to be able to actively manage it. Just because you have security doesn't mean you are at the level of risk acceptance that you're targeting. So yeah, it makes, it makes a lot of sense. Hey, Ian, thank you so much. Appreciate it. It's a great, great discussion. And I know in 2024 and on, we're going to have lots more compliance and regulatory issues. Absolutely. Just come out of the woodwork, whether it's local, regional, national, or international. I know it's coming, so it should be interesting. And thank you all for watching. Be sure to subscribe and catch all the Cybersecurity Vault episodes where we chat with industry leaders like Ian here. To dive into the most relevant and interesting cybersecurity challenges, perspectives, and best practices. Thank you much. See you next time.