The Cybersecurity Vault - SEC Case Against SolarWinds with Ed Amoroso

Welcome to Cybersecurity Vault. I'm your host, Matthew Rosenquist, CISO, industry cybersecurity strategist and advisor. And today we are going to talk about, well, different aspects and strategic ramifications of the SEC case against SolarWinds and their CISO. And we're going to look at this from various viewpoints. So get ready. And I'm going to be talking with Ed Aramoso. Ed is the founder and CEO of Tagging Infosphere. He's an author, research professor at New York University, and a highly respected, longstanding member of the cybersecurity community. He's been around forever. Not to say that you're old, Ed, not to say that you're old.

That's okay. I think that's the right adjective.

Okay, okay, good, good. I don't want to offend you this early, right? So, you know, thank you for joining and weighing in and providing some perspectives on this? It's been a controversial kind of case, don't you think?

I do think so. Yeah, it's a lot of different perspectives here. I think everybody has the same end goal. We'd like to see our infrastructure more secure, like see businesses more secure. So we're all paddling in the same direction. It's just there's a lot of different paths there. And, you know, there's different opinions about the right way to get there. I hope eventually we reach a common goal. But right now there's I think there's a little bit of confusion about the best way to proceed.

I think you're underst— I think there's a lot of confusion, right? I mean, just in our world normally, there's a tremendous amount of ambiguity and chaos that causes confusion. And then we start getting some of the regulators coming in, right? And the SEC and this particular complaint against SolarWinds and their CISO, right? It's a 68-page complaint, very, very articulate in that., and they're calling out, okay, fraud has occurred, and this is what we're, we're going down the path. And when we're talking about fraud in the SEC context, right, it's, it's about knowingly misrepresenting or attesting to some, something, uh, specifically on SEC forms that go to shareholders or stockholders or, or people that are looking to invest. Um, what's your read overall for this case? Where do you see the direction and their intent on this, do you think?

I think you, hopefully you'd agree that the first thing you want to do is factor out things that don't have a lot to do with, say, the CISO position or industry, like if there was stock bought or sold, stuff like that. Those are kind of separate. Like, that's not really a cyber thing so much as a very specific to the case. So in my mind, it's more about kind of the SEC's points that they're trying to make and the kinds of things that they've been pushing pushing with their recent ruling, you know, around the 4-day reporting, around—

ah, which just went active yesterday, you know. I heard a lot of tears hitting buckets out there, you know, yesterday.

But, but I think— let me— I wanted to ask you, because I, I have a lot of respect for you, and you and I in some sense came out slightly different, uh, positions on this. Here's what I wanted to ask you, like I think, and I'm not the greatest investor in the world, I can barely balance a checkbook. I'm pretty good with networks, but terrible with money. But I think the idea here, if I'm getting it right, is that if you and I were lawyers at the SEC, we're there to protect investors. That's why we get up every day. And you and I are glad they do that. I'm for that.

Yeah. And the idea is that's our tax money, by the way. So we better be glad about that.

Here's the— here's the— what I think they have in their mind. Let's say you have ACME Industries over here and Consolidated Manufacturing over there. Okay, similar companies. And you and I might decide to invest in one or the other, both public companies, they do something similar. And we would ingest information from the internet, from whatever, from our advisors to decide whether I'm going to buy stock in this guy or that guy. Yes. Then let's say that ACME has a cyber breach that they don't tell me about, and then I decide, you know, I buy their stock and it goes down, but I could have bought the other guy. And if I had known that they had this breach, then I go, hold on a second here, you know, I'm not going to buy from them because they have a breach. If they had just told me, then I would have bought this other thing. I'd have made money. And hey, SEC, I'm mad. Make sure that they tell me. In the future. That way I have more information and I'm likely to buy the stock that's going to go up more. Is that— I mean, I just want to make sure I'm sort of boiling it.

Yeah, yeah.

So that's sort of the basic— well, like, the lawyers, they're probably thinking that. Do I have that right?

Yeah. Let's take a step back and go, okay, well, why was the SEC ever even created? Yeah, right. The SEC was created in 1934 and it was kind coming off the heels of the, the 1929 stock disaster, right? And in 1933 and 1934, a couple of legislations were passed that basically said, hey, shareholders actually have rights. They have the right to be informed of important things in companies they either may invest in or currently invest in. So coming out of those rules in '33 and '34, you had Public companies had to report quarterly numbers, which they still do, right? They had to report, um, certain material events, right? The, uh, 8-K form, right? They still do. Um, they have to report if, if they're going to release more stock or do something like that, they have to release a whole bunch of other financials, right, for prospective investors. Okay, great. The whole idea is there is investors have certain rights. They have the rights to be informed. Otherwise, what you get is you get a small group of people that have insider information, better information than the shareholder or prospective shareholder, and therefore they can make trades on that, and you get this market manipulation. Now, after these rulings were created, the SEC was formed to say, hey, not everybody is going to actually abide by these, so we need an institution that's going to keep the rules up and then go investigate and prosecute these things.

Those are problems.

Okay, okay. So really it's about investor information, making sure they have the right information in a timely manner. Okay, that's fair and that's their right, right? If you're— it's your money and your shares and all that. So when we talk about cyber issues and this one in particular, when I'm reading through the case, the 68 pages, they make a couple of points saying, hey, there were these material issues, significant issues in their major products, and they didn't report them on time. And when they did report them on time, or did report them, they didn't give the entire picture, a picture that the shareholders should really know because they're entrusting this management, right, with their money, with their assets. And they're saying, hey, fraud. Right. This is a deceit and it doesn't align with even our normal rules. Now we've got the new one that just hit, right? Just hit yesterday. You've got a 4-day rule. You have to file. You have to use the same form everyone has to use anyway, right? The 8-K form. But the 8-K has been around forever, right? Since '34 when the rulings were created for fraud. So, okay. You know, in my mind, you know, you gave 2 examples. And, you know, I love the ACME example because I'm a big fan of Wile E. Coyote. So, you know, you've got one company and if the management is providing accurate information on the SEC forms, the 1-K, the 8-K— I'm sorry, the S-1, the S-8, and the 8-K, which are your quarterly reports and all these other things. If it's accurate, no matter what the information is, maybe it looks the company bad, maybe it makes the company look good, doesn't matter. If it's accurate, they say you're following the rules. Everybody's got the same level of information. We're good. If, however, you don't, if you are deceitful in it, then you're actually breaking the law. It's PC 532 under the Uniform Penal Code. 532, subsection specifically talks about, you know, officers in a company being deceitful or misleading in those SEC forms that are intended to inform investors. So I think that's really what it comes down to. I know there's a lot of talk about, well, wait, no, it's about whether they had certain security controls or not. No, it's about whether you were honest, because that other company, if they file those forms and they're deceitful, even if they have the best security in the world, they're still breaking the law if they're being deceitful about it. So to me, it's not what their security posture was. It's whether they were honest in those SEC, very formal, very longstanding forms that are intended to even the playing field with investors?

So again, I don't want to be deceitful. You know, that's not a good thing.

Yeah, bad. That's a bad checkbox.

That's not reasonable. But let's take the example earlier between Acme and Consolidated. The presumption is that Consolidated doesn't have the same problem that Acme has. And I think that's wrong. I say 100% of companies And that's what James Comey said, the guy who ran the FBI, said there's only two kinds of companies, ones that know they're getting hacked or ones that are getting hacked and they don't realize it. And that's consolidated. So the SEC is creating a perverse incentive for CISOs to automate the 8 process and just say, I'm always under attack. I'll give you an example. I made a joke one time when I was working in telecom. You'll like this one. I thought it was a joke and then I think the lawyers thought I was serious, but I said, hey, I have an idea.

They don't have much of a sense of humor in the telecom industry.

I thought this was funny, that they've taken it seriously. I said, why don't we, when we hire people, why don't we just tell them, hey, listen, we didn't lose your identity yet, but we probably will. So just sign here. And I'm just telling you now that I'm probably going to do something stupid later.

It's the stupidity clause. You want them to sign a stupidity clause that you understand that me as your employer, I'm stupid. And you recognize that. You missed your calling. You should have been an attorney. I would have hired you.

But I mean, I'm just saying that the sort of simple solution to the reporting exercise is simply go into workflow, and as your SOC generates problems and they mark them as potentially SEV 1 or something, start workflow, get it all reviewed. And if the lawyers don't have the time, if it happens on a Thursday night and everybody's away for the weekend, then the workflow just goes right through to the SEC and says, look, our— in our SOC, we detected this problem. It could be an issue. We didn't have 4 days to figure it out. So we're just telling you now that this could look serious. And if you're like a CISO and you've got, you're sick with the flu or something for 2 weeks, or you're away, or you've done a lot of traveling, I just think it's creating an incentive for people like me who automate everything to automate the process. And I think you would agree that it, in a weird sort of way, it makes me maybe not want my team sending texts around saying this could be bad because that's what security teams do.

Yeah.

I've spent 4 years at this. And it's my job as the CISO to let my SOC team go, oh my God, this is horrible. The whole place falling apart. And then you go, wait a minute. No, it's not. And a week later, they realize, you realize, hey, this isn't such a big deal. But in 4 days, I would have no choice but to go to the SEC and say, hey, listen, we're still hashing this out, but this could be bad. So I'm telling you now, and I think what's going to happen is that this will create volume. Now maybe they want that. Maybe the idea is that you build like an SEC 8K SIM catcher. You know, there's going to be this SIM that sits and all the 8Ks come in and then they build a big dashboard. That'd be a cool thing. You and I should go, Pit. We should start a company like Sell to the SEC.

We can have heat maps. We can have all sorts of metrics and cool things.

AI and machine learning. Machine learning to go parse. I'm being silly now, but I think—

no, no, no, no.

All I'm saying is you and I and everybody want good information. The problem is, here's where it comes down to for me, Matthew. I fundamentally believe— I spent my life on this— I believe that cybersecurity resilience and, and achieving a high state of protection posture is still a research question. I don't think it's a matter of doing the risk management better being organized better, doing this, doing that. I don't think CISOs right now know how to stop a nation state. So my advice has been, this is still research. We don't have— you could yell at me all you want. I can't do it better than I'm doing it now. So therefore, like for the SEC to say, we're going to put a hammer down, you got to tell us. I think that the right thing would be for 100% of the Fortune 500 to report every Friday that they've got material.

So I'm gonna challenge you on this because I think there is a healthy amount of tension in the system. The 8-K is really designed to say that there is a material event, and let's delineate here, right? The 4-day— The SEC case has nothing to do with the 4-day requirement that just came into effect now. This is something that happened back in 2000. So 3 years ago, essentially. So there's a delineation, but let's stick with that because—

Different world then, by the way.

I'm sorry, what?

It was a different world then with different issues.

Oh, it absolutely was. And I think that should be taken into account in that space too. But it still has to be within the boundaries. And first, before I go into this about the healthy tension, we do have to recognize our form of justice means everyone is innocent until proven guilty. So I want to make sure no matter what you and I say here, we're not determining guilt. That's something for a judge or a jury in this particular case. We can talk about the things, but I am presuming that, you know, the people at SolarWinds and the CISO is innocent until proven in a court of law by a jury of their peers or a judge, right? That's just kind of the way it needs to be. But when it comes to filing that 8-K, and I don't think there's going to be a flood of them, If— and companies file them all the time. They tend to need to be timely and they need to be something that is material. And there's materiality thresholds. Every big company has materiality thresholds, right? If you go to finance, they'll tell you what it is.

Yeah, but it's a funnel, Matthew. And like, for example, in a larger company, there might be several hundred things per day that pop up that could be material.

Right. But they've got a process to deal with that because even before the cyber rules—

I'm just saying it takes, like, I'm just saying that there's an awful lot of companies where you don't know inside 4 days, so I have to report it now.

For, yeah, but we're talking, we're talking about the, the SolarWinds one, right? Where there was not a 4-day requirement.

I'm trying to generalize it because—

Okay, okay, well then let's generalize it.

Watching the fear is Let's say you and I— let's say you're the CSO, I'm the deputy CSO for some bank. You and I are working together. And we're like watching you and I talk and we're thinking, oh boy, what's the deal here? I'm just saying the consequence of all this is that I understand that the SEC would like you and I, because we work for a public bank, to make sure if there's something an investor should know, they should know. All I'm saying is that when it comes to cybersecurity, it's a different game because Even if you and I think that we're fine right now, I'm telling you that we're not fine. It's just a matter of digging.

Yeah, and I don't think—

Have you ever hired a pen tester that didn't find something horrible?

No, they always find something.

So why would I hire a pen tester then? I'd rather not know.

Because there are different thresholds, right? There are things that happen in an organization every single day that may cause pennies of issues, right?

I'm not talking about the simple stuff. I'm talking about—

Right, we're talking about the major things. And the way the rule is currently written is once you realize it is a material. So let's just take a real, you know, an ACME example. If we go to finance an ACME company and go, hey CFO, what's your materiality threshold that you have to file 8-Ks? And they go, oh, well, for our company size of revenue, it's a certain percentage. It's $1 million, right? If it's $1 million, I got to write an 8-K. So if we lose a major client that was giving us $1 million in revenue, I got to write an 8-K. Oh, okay, cool. I'm gonna go back to cyber and now I'm going to write out and say, okay, our threshold, our impacts that we believe with a high degree of confidence, it'll be $8K. Okay, so we've got so many customers, we think loss. All right, if we lose data for 20% of our customers, we believe that's a one—

Matthew Rosenquist.

The threshold, right?

The person that you're talking about going, Who is this person who's saying, if we do this, we do— like, who's realizing this? Who in the company?

So the CFO has their numbers, right, of what they— because they have to file 8-Ks all the time.

This is the CFO realizing materiality.

CFO does have materiality, right, because they have to work day to day on the chief financial officer, not the CISO, right? But for the company, for the company, the materiality that's impacting to the stockholders, right? The CFO understands because they've been in this role for a while. What is the materiality?

And CFOs don't work. They're not real-time. That's not a real-time position. They could go 3 days to their daughter's wedding and not be available.

Right.

What happens if they're not available when there's a potentially material issue and I don't have the CFO available to help?

No, you don't need to. Right. This is a process, right? If you understand your company's materiality per the CFO is $1 million of impact.

No, I'm just saying, who is it? Like, I work in a— let's go through an example. Okay, we're in SOC. Oh my God, there's S3 buckets open. Holy crap, there's customer data in there. Yes, this could be a disaster. Yes, you call the CISO. You don't know, you go, oh my gosh, activate your incident response team. I'm not sure, I'm saying before then, I don't know, I haven't realized, but it might be bad. So I have to report, correct? I don't have to report if I'm not— I mean, if I'm pretty sure this is a problem, but then later on I realize I was wrong.

Let's make it a clear process because that's part of what they're going to look for, right? If you're going to say, no, I thought it was, it wasn't materiality, they're going to have to— what's your process? Oh, well, I threw a dart. We've got a dartboard and a material or not material.

That's not it. I advise 120 companies and I spent my life on this. This is complicated stuff.

It is, it is. And you know, from Intel, I spent 24 years and I was their first incident commander. You know, and so I was brought in on every major issue that occurred.

I think this is a research issue as well.

Well, you know, there were situations, right, where something is coming in and you think, okay, let's say it's a data breach. Okay, the tripwires have been fired. We know somebody inappropriately went into an area. We don't necessarily know if the data has been compromised, if the confidentiality or integrity, it could have been tampered with. We don't know yet. Okay, let's start doing our investigation. And one of the first things is how important is that data? It's not important at all. You mean we could lose it all and it wouldn't be a material impact to the investors? Okay, I know I'm not gonna be reporting to the investors. Oh wait, this is the core code to Microsoft Windows or to Intel's chips. Okay, that's a little bit more important.

But I'm saying that—

Now, let's go through, and the moment we realize, hey, that's now been exfiltrated out, that's what I'm sitting down—

And I'm saying 100% of companies are in that state right now for everything.

But you need to have proof, right, to say that it's actually occurring.

I'm saying I can just tell any investor, I'm probably really hosed up by a nation state. I'm pretty sure, like if my life can—

and if they ask you, well, what's your evidence, right? Are you really sure? Is this just learning work in general?

And I can predict that I'm probably hacked.

Prediction is for the future. That's different. The AK isn't about, I believe something in the future is going to happen. It's something has happened. You need to know. So it's not predictive in nature and it needs to be tangible. It needs to be something you can justify, especially if you're going to give bad news to your investor.

Here's what I mean. And by the way, you're right. You lay out a very reasonable point. Look, I'm also— I mean, I'm not a good investor, but I am an investor. I'm for the SEC doing this. You and I both want more security. We're all there.

Oh, yes. Yes.

I'm just saying that right now, it's a question. It's sort of A or B. It's either this is something that the government can jump into and start driving good behavior, or it's premature for them. I feel like it's premature. I think you're more on the side of they should do something now.

I think they're late. Honestly, I think they're late.

Right?

Down forever, why wasn't cyber automatically embedded in them?

Yeah, but here's the depressing part that I believe that I think freaks a lot of people out when I say this. I, I really fundamentally believe that if we threw a dart at the Fortune 500 and hit some company, I would guarantee you that they have dozens of material weaknesses, serious breaches, and just a matter of going and looking. And the fact that—

right there, wait, wait, right there, right there. You just said going and looking. And let's go back to what the SEC is about. It's making sure everybody has the same level of information. So if a company does not know that they are breached, let's say China, Russia, Iran, North Korea, they all own them, right? But they don't know. Well, the executives and the investors had the same amount of information. There's no difference.

I'm saying every company—

the executives know They need to share that.

Matthew, you and I, if we're investing our money, just assume every company is hosed.

You can, which may, you know, make you only invest in commodities.

But it's true. It's true. Like every single—

it's true. But as an investor, the moment the executives know something significant and I don't tell the executives Don't tell the executives. So don't tell anybody in the corporation about it.

It creates a weird perverse incentive to not tell the execs.

I think the incentive is the execs do want to know so they can get ahead of it.

No, because the instant they know, by your— once they realize, they got to go tell. So don't tell me.

Absolutely. If they're informed, you know, I mean, you could, you could get executives going, hey, don't send me any email at all. I don't want to know of any bad news. You could have executives, but they're probably not going to be in business very long. They're not going to be adaptive to the industry. They're going to be outcompeted.

I agree with that. I think like you and I both, we have a lot of experience. We can think of cases. I know you can, where there's a bad thing happens A and a bad thing happens B, and they both have their life cycle. And one role unravels, the other unravels. Both of them can look just horrible, but one turns out to be nothing. One turns out to be a really terrible thing. Yes. And what you're saying is the SEC would say, well, don't tell me until you're really sure that it's this terrible thing. Then you got 4 days. And I'm saying I have control over that and it creates perverse incentive to not get to that point for a very long time.

I would say it creates a positive incentive for the organizations to drive their process procedures to be able to come to a determination faster, better, and more confident. And if not, then they have to, right? The disincentive is if I don't do that, I then have to report it and that's going to go to my shareholders.

That means my price is going to be— Here's another analogy. Let's say you and I are both human beings and let's say we're working—

Let's go with that. Yes.

We are. I mean, you never know, we could be simulations. But let's say some government agency says, you need to report if you've got a serious health issue. And we go, and I decide the way I'm going to do that is I'm just going to listen to my body and not go to the doctor. And if something really bad happens, then I guess I have no choice. But another person, maybe you would say, well, I'm going to hook myself up constantly. And every little thing that pops up, and there could be some bad things we both have, it might be a problem, might not be, but if it could be a problem, you're going to be reporting a lot more. You're going to be reporting more than me for sure. Yes.

Yes.

And I'm saying that's what I mean by volume.

And I get that, but we have to overlay that bigger picture because it's not just we want you to report if something's bad. We want you to be transparent the moment or within 4 days.

No, I agree.

You know something is bad, your investors know something is bad.

Not opposed to that, but I'm just saying that, look, I mean, we could make that database, right?

And with all the graphics and everything, it could flood. But I think there is a disincentive in that, and the incentive is get better at this, and that's going to kick downstream issues to make, I think, cyber risk management have to get better. And I think there's going to have to be more investment in it in order for it to get better.

I hope— I mean, I'm rooting for you to be right because you're telling a positive story. I've got this—

yeah, but who knows how this crazy world is going to end up. I mean, that's the thing.

Let's hope that I'm all wet and what you're saying is— and the SEC's, uh, activity does drive better goals? Because that would be a— you're describing a more positive and a more, I think, a future where we make more progress. And I'm describing one where, you know, everything's already gone to hell in a handbasket. Which, if you look at our industry, probably it's closer towards yours than the idealistic viewpoint of where I want it to For people watching, I think the right thing here is that the correct approach here is, you know, to do what's right. There's a red face test that we all, you know, we hold the mirror up. And I think, Matthew, what you're saying makes perfect sense. There are times when you realize that there is a big problem. And the SEC is saying, for God's sakes, when you hit that point, tell me. It's just, I'm not sure who the you is.

Well, tell the investor. That's really what the SEC is saying. Tell the investors.

What if it's the deputy CISO who realizes it but can't find the CISO and is afraid to call the CFO?

And then I think there just has to be a process, right? Because people are going on vacation. There's coverage. We're going to go through this process. These 5 people come into the room. We've got our different materiality. We say yes, we say no. We document the heck out of that conversation. Otherwise, there may be a legal case in calling you out specifically as the CISO or deputy CISO, but you better document it and show what process you used and in good faith when you think that, you know, just don't lie, right? I mean, that would be the other thing. Don't lie on the forms. If you are filing one, don't lie.

I think so. But I don't, again, I don't think people are lying. I think that things can be screwed up for sure. But I'm not convinced that there's a lot of intentional, I'm not going to tell, but again, that's just my observation.

Well, okay, so let's go back to the SolarWinds case and let's take a very specific example. Then I'm going to ask you 3 questions, right? If we look at the complaint and if you go to paragraph 14 through 17 and it basically says, and again, this is the claims of SEC. SEC still has burden of proof. They still have to prove this. Innocent until proven guilty. But paragraphs 14 through 17, basically it says that the SolarWinds and the CISO knew that there were 3 different customers in May 2020, in October 2020, and in December 2020, all that were attacked.

Okay.

And these companies came to them and said, hey, we were attacked by your product. Here's the issue. Now, in the December one, This was when Kevin Mandia basically called them up on the phone, and this was FireEye going, and I knew their CISO at the time, they had grabbed the code and grabbed the binaries and reverse engineered it, actually went to Microsoft as well and helped reverse engineer it and came back with definitive proof, SolarWinds, this is exactly the problem in your product. And at that point, they filed an 8-K. And in that 8-K, they said, as of December, we have an attack. They didn't mention the fact that they knew these attacks were going on with two other customers, one which was a government agency dating back 6 months. They didn't state any of that. Right. And again, this form is to inform the shareholders. Right. And so I'm thinking the shareholders would probably—

You worry about it informing the adversary as well?

No. So the requirement is—

Doesn't it bother you at all?

I'm sorry, what?

It doesn't bother you that when you're in the middle of a situation, you're telling the adversary exactly what you know?

Well, you're not telling them exactly what you know. You're telling them that I've detected you. And if they don't already know it by that point, you have an advantage.

I'm asking you, do you worry about the transparency on the defense?

Actually, I don't, because I think there's sane minds that say you don't have to give logs, you don't have to say exactly what you found, you don't have to give binaries. All you have to say is, hey, we were attacked in one of our major products 6 months ago.

Okay.

And, you know, oh, okay, because that's all the shareholders need to know. They're not security experts. They do want to know when their investment has been compromised in their primary product. That would be important, just as if their major manufacturing hub went down and was gonna be down for 2 months. They should probably know that, right? Okay, so 3 questions in this situation.

Yikes, am I gonna get graded on these?

You are, you are. I've got a grading sheet over here, right? That is if you're human. We haven't determined that yet. You could be a civilian.

No, I could be a deepfake here.

That's right. Okay, so if you were a CISO in this case, right, would you fill out that 8K form and choose to omit the fact that you knew, right, and your team knew that several customers dating back 6 months had actually been attacked? Would you have omitted that?

I would have never gone anywhere near the 8K because there isn't a CISO on planet that even knows what the hell it is.

Okay, so I'm going to say you don't want to answer that.

Let me finish.

Okay.

If I had gone mucking around with 8-Ks, I'd have been fired in 1 second as a CISO. That's what the lawyers do.

Okay, so if the lawyers say we have to file an 8-K, then let them figure out what to do.

I don't know why you— CISO here.

Well, you know, you as a CISO, you are the top dog when it comes to cybersecurity.

In this case, this is not top dog. This is little O officer, not big O officer.

But you are the top representative in that organization, the top expert for cybersecurity.

The lawyers have to determine how to fill out the 8-K, not the CISO.

Okay, but would you allow it? Right? Because you're a—

They outrank you by so much, it's not even funny. I'm just saying, you don't allow those things. I don't know about that.

I've had plenty of arguments with lawyers.

Just sitting there, the lawyer, chief counsel. If you want to, fundamentally, if you want to be pissed at somebody, it's the CEO and the chief counsel that should be held accountable, not the CISO.

If the CISO, I mean, you're bringing the CISO to the big table for a reason.

When did the CISO get to the big table? Here, I'll give you an example. I sat and looked at the Fortune 500 and looked at the fancy pictures they put, like that posed picture where it's the CEO the CISO, you know the one.

Oh yeah, there's no CISO in there.

They're not in the room. There's never happened. I've been on board of directors of Fortune 500 companies. I worked for a Fortune 10 company. There's no CISO that's at the table. The CISO's outside the room, brought in for 15 minutes, makes the delivery, gets kicked out, and then the real leadership team decides what to do.

And if— okay, so then let me turn that around. Let's say you as CISO, right? Your company decides in this case, we're not going to— in the 8-K we're going to file, we're not going to mention any of these other pertinent facts. Would you allow that to happen or would you take some action?

Well, then I'd either whistleblow, then I'd have to do this. No, no, no, no, no, no.

I'm not even saying whistleblow. Would you take an action as simple as sending an email to the attorney, to the CEO, and go, "I don't— this is not correct. This is not in the spirit of what this is.

As a shareholder, this is not accurate." In most companies, that email would get you fired. Now, maybe the SEC will change that. Maybe that's a good thing. But most CEOs would never send that. Never. You'd be fired in a sec. Who the hell is this guy telling me or gal telling me what to do. I would have never sent something like that, and I had a lot of stature. Now, if you're gonna change that, then let's change it. That's why I call this—

and I think we do. I think we need to, right?

So that's what I mean. Research means change and innovation and coming up with new, not going back 5 years and saying this is how something should have been. If you're saying the CISO should be at the table and should make the claim, then let's do it. But there isn't a damn one of them that's there. Now, if you're saying, would I allow it to happen? The only legal process I have right now, if I don't want it to happen, is to go whistle-blow. And I've been advising my clients to learn the whistleblower laws.

Yeah, whistle-blowing, making sure you've got an ethics board, things of that sort.

But with the law— And you can practice it. You can go to chief counsel, say, listen, it's my neck on the line, not yours. Here's what I'm going to do. If 4 days pass and I see you haven't you know, reported this thing, then I'm going to whistleblow. Here's how I'll do it. Here's the preloaded form. Here's the approach I'm going to do. I'm telling you now, and if you don't like it, fire me. Now I'm saying the minute you go tell a chief counsel you're going to go whistleblow, you've destroyed your career in 2023, '24. That we haven't changed the culture to the point where a lawyer would be comfortable with that. So you're asking people to go to their leadership and say, I'm going around you. And I'm going to whistleblow if you do something wrong, which I think there are other alternatives to me. I'm just saying that's where, that's where when the— I think it's premature because this hasn't been worked out yet. So you're putting the CISO in an impossible situation.

I don't agree. So I've been in similar situations and I won't get into—

When you were at Intel, you'd have gone around your CEO and leave counsel.

I'm not going to give particular details, but let's talk hypothetically, as vocal as I am. So in a situation where the attorneys or even a senior executive wants a certain statement to go out that is factually incorrect, having to do with my ownership of cybersecurity, the answer comes back, right, is I then communicate to them in email and say the following information is incorrect, or I am not behind this, I am not assuming this risk. If you want to make these statements fully knowing that I'm telling you that they're incorrect, that is your choice.

But I'm saying you tell your boss that.

But I'm keeping this, right? You need to own that, right?

You tell your boss that. Huh?

I've told my boss that. I've told my boss that.

But your boss is probably not the CFO, and your boss may or may not— so the boss should be the one who decides. Not CISO, because most CISOs report to a CIO or CTO or some—

But once they realize you are not that scapegoat, right, that they have to own it even though they're being told, then it's not the SEC against SolarWinds and the CISO, it's SEC, SolarWinds, and whatever that executive name is, because there's going to be that email that says, hey, the CISO told you that was false and you decided to file that report anyway. You signed off on it, right? That's where it's going to go. It comes back to transparency and accountability.

That's where it should go. I'm— I agree with you there. I think we're together. But I'm just saying that right now, as we go into 2024, there isn't a damn CISO that has that situation in a comfortable state. It's a mess. And now this SEC is putting the CISO in an impossible situation.

I think it— they are putting them in an uncomfortable situation. I will agree. I don't think it's impossible. Because I think we can get better and better and better over time. I think there is a small number of CISOs.

And I, if I've got 3 kids in college and I need the money, I don't want to go throw my, I want, I've got to go to the legal counsel and say, that's wrong. You listen to me. What you said is wrong. I'm, who's, that's an impossible situation.

It's not.

And by the way, this CISO.

It's ethical, by the way.

This CISO could be wrong, by the way, because that's the problem. Most of the time in my career, as things unfold, they become clearer a month, 6 months, a year, even 2 years later. So you're afraid to say that's wrong because you're not sure that you know how this works.

Understood. But if you know it's factually incorrect, but how do you know the statement is intentionally misleading, right? Is insufficient to inform. Then you got to step up. I mean, come on, we should be ethical. We should be at the top of the ethical pile in organizations. There should be no question about our trust and ethics.

None for that.

So, you know, if you're saying, well, you know, you got kids in college and whatever, then you shouldn't be a CISO. If you're not willing to step up and do and make the hard decisions, you don't deserve a seat at the big table.

So I, I've had two CISO roles. One was little, one was CISO little o means CISO, but you're not an officer. No, you don't speak for the corporation. You know what that means, a legal definition of officer. And I've had that, but I also had CISO where you are an officer. They're very different. Very different.

Oh, agreed.

So that's the first problem that when we refer to a chief information security officer, there's two different states of that. And I don't think people understand that. That's a, there's a very big difference, a very, and it's not nuanced.— that's significant, the difference between an officer of the corporation and not. So that's right off the bat a problem. And then the second thing is, if you take everything the SEC has done and just put the word CEO in for CISO, then I have a lot less problem with it.

Fair enough. To the first point, whether you're a big O or a little o—

like, wouldn't that make more sense to you? If you're going to go after somebody, Hey, the freaking CEO is the one who should decide. What am I missing?

Okay, well, let's take that. But first, whether you're a big O or a little o, ethics still apply. No, I agree. And if you know there is a lie, if you know that there is a massive omission that leads to deception, you got to step up. It doesn't matter whether you're a big O or little o, you should step up. So, that's one.

What does step up mean?

Step up means you need to then be vocal, right? Like we talked about, right? Let them know, hey, I am informing you that I know that this is materially false.

That this is not the way America works. I'm informing you corporations don't work by incenting executives to be vocal, jump up and down and scream and yell. That's not how businesses work. You inform your boss.

No, no, no, you don't. You should be professional about this. And I have been. I've gotten great results from that.

Once you've informed your boss—

But it's not a threat. It's I'm informing you what you just said was materially false, and you did so on a federal form.

So why not?

If I ever get called to court, I'm going to let them know I informed you on this date and time. You're going to have to answer to that, right? So, you know, hey, I'm here for the company, but I'm duly informing you because maybe you didn't know.

I mean, you and I are very much in agreement on the transparency. No, those are all reasons.

Okay, okay.

I think we're both in agreement that the CEO is kind of— this seems a little weird that it's not that, don't you think?

Well, and you bring up a good point, right? You bring up a good point. But here's the example that I think about. If on your quarterly reports, right, your S-1 reports, your quarterly reports, somebody is fudging the numbers, right, and saying— putting in fake revenue numbers, right, inflating the value of the company. Who are you going to hold accountable? Who is the number one expert that should know those numbers?

Is the final—

the CFO?

No, but the CEO is where the buck stops with that sort of thing.

I agree, I agree. But if you, you were going to look at the CFO And from an investigatory perspective, if the CFO was lying to the CEO, right, then you're going to hold the CFO accountable, right? Because they don't, they don't have the plausible deniability. Oh, I don't know anything about finance. What do I know about revenue? I don't know. No, you're the CFO. Guess what? You have a fiduciary responsibility. You are the top dog right now. If the CFO and the CEO collude Okay, then you have a collusion case. Sure.

Matthew, let's back up here a minute.

Okay.

So is there any system that a CEO would not have access to in his own, his or her own company?

Oh, tons. In a lot of the companies I run, I don't let the CEO have access to systems. They're dangerous.

CEO can have access to everything.

They can have access to the information that they ask for. Yes. And typically, so if the CFO is—

Use your example. If the CFO is reading this stuff and then concluding A when it's really B, the CEO could have read it but chose not to.

True, true. But you need to then go, okay, who's accountable?

CEO has got to make sure that you have a leadership team you trust. And if there's somebody there lying, it's on you, not on them.

No, not necessarily. Fraud can be an individual actor, right? If somebody is an embezzler in their company, you don't also charge the CEO. Right. The embezzler is somebody who created the actions and went forth and created theft or fraud. Right. So yeah, maybe from an organizational leadership perspective, but not from a criminal prosecution.

I get that like a 4-star general might have somebody down 4 ranks down who does something awful. You don't blame the general. I get that. That makes good sense. But let's just— I think that my point is that if we really do believe that the CISO has posture and status and should be doing it, then let's make those changes. Let's get them the training. I agree. Let's start making changes. That's what I mean when I say this is a research issue.

Okay, so then let's, 'cause I agree with you on that. I think the CISO, they should be at the big table number one.

I'm for all of that, but I don't—

They need to be competent, ethical. We need to make sure that they're empowered as well. Right? Because that makes things go smoothly. If they're not empowered, it's rough waters. They still need to be ethical.

They need to get training, but they don't get like—

I agree. I agree. Okay. So, we agree on that. How do you think this case will change that? Or do you think this case—

Yeah, I think it will. No, I— Again, how? Because like for what we're doing right now, you and I wouldn't be having this discussion. So, I love that. I think that people will talk about them. It gets the discussion going. The CISO does move a little closer to the executive room, the board realizes, hey, I better figure out who the hell my CISO is.

And if they're any good.

Or to think that I'm all for that. I'm just— if you had to boil my whole thing down to one little nub, it would be this, that I think there's a lot of work to be done before we start holding people accountable and calling them liars. I think there's just a lot of things that needs to be done before we get to that point. Because there's a lot of— like, for example, I have been involved in the preparation of materials that go out to investors. I've been a board member of a large company. There's last-minute changes all the time. Yes, all the time that a CISO would have no clue is being made. So are you saying the CISO needs that final readout on anything that goes out the minute before it goes out? I need to read it in case you say something wrong.

Honestly, I think if it has anything to do with cybersecurity or claims or issues or impacts or risks, yeah, I think that's part of their freaking job.

That's exactly what I'm talking about. That process is not in place for any company on the planet. So do it. If you're for that, then fine, then let's figure out how to do that. So what does that mean? That's what I'm saying. I'm saying There's a whole lot of stuff here that you better go change, fix, improve before we start going in a courtroom and having issue. Let's fix all these. So I'm— you and I are probably way more in agreement than disagreement.

Oh, yes, yes, absolutely. So it's the nuances though.

The nuance is, should they be aggressive now? Or is there still a lot of stuff we better work out before you start going after individuals? I'm more on the latter case, I think.

And see, I'm more on the former. And so again, part of my background, and I've been in security 35 years now, and the first part of it was actually doing internal investigations for theft, fraud, embezzlement, collusion, all those kinds of things.

I've done that work too.

So, you know, when I was dealing with an insider and they knew, I knew that they knew that what they were doing was wrong, right? Whether it was fraud, whether it was straight out theft, whatever it was. Right. They knew it. I'm like, prosecute. I mean, let's go. I'm going to build the case so we can take it to prosecution. And every single one we did, I had a great team. You know, my manager, she was awesome.

Matthew, you know that there are a lot of cases where somebody is accused of fraud and they didn't do it, or they were innocent, or they were confused. It's not that.

And right now, innocent until proven guilty. The burden of proof is on the SEC.

After the fact, the ones that in your mind are your canonical examples of escort this person out. But you, if you go back and think, there were hundreds of others that were really unclear and may have turned out that it was not fraud.

But we have to rely on the justice system. It's not up to me or you. It's up to a jury of peers or a judge.

But I'm just saying that in this case and in the context of the CISO, I just fundamentally believe that there's still a hell of a lot of work that needs to be done.

I don't disagree with you. Again, so let's go— we're in agreement on 90%. It's that fringe. As soon as I realized somebody knew and was an active party in that deceit, especially to shareholders, especially on SEC forms— this wasn't on a cocktail napkin, this was on freaking SEC forms that are going to the investors, right? These are quarterly reports as well. You know, wait a second. You do need to take a step back and go, all right, that really isn't truthful. I hope I'm going to get away with this. Okay, guess what? You've now— you're now deficient of the ethics necessary for the position, and the SEC should come after you. Right. You're— you are undermining that trust of the shareholders who have rights. They have rights to know. So, you know, you got to come after it. And I see your point. Yes, it should come after SolarWinds, and the CEO really should be that name right there. And maybe it should be. I think that the CISO is also, should also be held accountable though. I would not be opposed if they also put the CEO there and chief legal and whoever else knew at the time. I would be happy, right? Actually, I love collusion cases, by the way. I love it. It's a felony in of itself, right?

So if I get a parking ticket, you're my attorney.

Don't get a parking ticket. How about that? That's my advice.

But I do think— I enjoyed the discussion very much. Thank— by the way, thanks for inviting me.

Yeah, yeah, this is great. And I think you're right. I think having discussions like this help. So constructive discussions, different viewpoints. Um, thank you so much for, for, for having this. And, um, you know, you're the CEO, Tag Infosphere. You guys have great— one of the best newsletters out there. Um, how can viewers get a hold of you, get signed up for the newsletter? What's the best way?

If they come to our website, it's perfectly fine. They can sign up and they can read our materials.

Awesome, awesome. I will be sure to put that in the link in the description there. So, and thank everyone for watching. Be sure to subscribe and catch all the Cybersecurity Vault episodes where we chat with industry leaders to dive into, well, fun and juicy, right? The most relevant and interesting cybersecurity Challenges, Perspectives, and Best Practices. We'll see you next time. Thanks.