Enterprise Cybersecurity

Hello and welcome to Leading Digital Transformation with Rob Llewellyn and the Digital Transformation people. In this podcast series, Rob interviews experienced practitioners, authors and thought leaders whose stories and experiences provide valuable insights for digital transformation success.

Hi and welcome back to another episode of Leading Digital Transformation. In this episode, we delve into cybersecurity. And help us do that, I'm joined by Chris Hodgson from the uk. Chris is an information security, data privacy and risk management leader with a background in strategy, architecture and design. He's got 18 years of experience under his belt in financial, retail, energy and media sectors. And back in 2016, he made the move from being an end user into the vendor space with Zscaler. Over the past two and a half years, Chris has been operating as Zscaler's Chief Information Security Officer for EMEA Europe, Middle east and Africa and Data Protection Officer. As a ciso, he's a trusted advisor to executives, board members and other stakeholders, helping them define well balanced strategies for managing risk and improving business outcomes. Let's jump into the interview with Chris. Chris, welcome.

Thanks, Rob. Thanks for having me.

Chris, I noticed that you published a book and just a little over a month ago, and I'm looking at Amazon's page right now and the title of it is Cyber Risk Management. Prioritize Threats, Identify Vulnerabilities and Apply Controls. Tell us why you wrote the book and a little bit about the book, of course.

Yeah. Well, firstly, it's great to be here. I know that the title is somewhat of a rather long winded title. There's a lot of words in there, but that's for a reason and that's kind of how I'll start my explanation of the book. So I think in information and cyber risk management we have a tendency, I think the broader populace, not just the cybersecurity community, of kind of potentially misappropriating risk. And I'll explain what I mean by that. We sometimes talk about threats when we mean vulnerabilities. We sometimes talk about risk when we mean threats. And the challenge that that brings about for either the layman or the C suite or even some people within our own community, is that we're not in a position to qualify and accept or mitigate risk in our environment. I've been in our industry for 18 years, like directly or indirectly now, and this seems to me to be a systemic challenge. It's a challenge in all industry verticals, to be perfectly honest. So I thought to myself, I thought, right, what are some of the frameworks that I've used for Cyber and information risk management before, which have worked well, which elements of different frameworks do I think you could take and combine to make something that's relevant and contextualized for your environment? So I thought about this and I thought, why don't I write a book where we take the constituent parts of a risk equation? And for me, ruining the book, you know, that's essentially that you have actors. Those actors may be nefariously inclined, it may be accidental actions of an actor. They essentially have some form of event that they would conduct. Again, we hear about them in our industry. It may be some form of application vulnerability that they exploit via, let's say, SQL injection. I don't want to get too technical here, but SQL injection, it may be a denial of service attack and as I touched on there, that exploits some form of vulnerability. We hear a lot in our industry about vulnerabilities. You know, are these vulnerabilities in technology, are they in the operating system of the application? Perhaps their vulnerabilities in people? You know, people make mistakes, people are tired, people are stressed, etc, etc. And once those vulnerabilities are exploited, they cause business impact. And business impact, again is something that I think a lot of organizations struggle with, you know, understanding the assets in their environment that are important to them. Do they have structured processes for understanding what they are and who's responsible for kind of defining those categories of impact? So I basically take each of those, I suppose, components of a risk equation and I break them down chapter by chapter. And I suppose the denouement of the book is bringing that together in a chapter on kind of risk management frameworks. So, yeah, it's been quite a humbling experience, Rob, to be perfectly honest, the book's been very well received. And yeah, I suppose watch this space for something else because there's a lot of content that I put in there that just didn't make the cut, just through words count. And my publishers keeping that under a tight control. So it's been great so far.

Chris, one thing I noticed you did in a blog post which talked about your book was refer to the six Ds of an exponential organization. Now, I'm a big fan of Peter Diamandez, who of course wrote about the 6DS a number of years ago in his book Bold. Those six Ds are digitalization, deception, disruption, demonetization, dematerialization, and democratization. Tell us about the 6Ds from a cyber risk management perspective.

Yeah, the 6Ds of an exponential organization really Rob. So I too have read Bold by Peter Diamandis and latterly Exponential Organizations by Salim Ismail, and both books really resonated with me. You look at, you know, the transformation, the digital transformation that most organizations, if dare I say all organizations, are going on these days. You look at the success of organizations who are adopting the Ds, the six principles that are talked about in the book and digitized is kind of obviously one of those core tenets. And I looked across all of them and I thought to myself, how prevalent and how relevant are these for cybercrime? And obviously the yang to the ying of that being cyber security. And you look at digital crime, you look at, you know, the exponential growth of crime that we're seeing being carried out via digital means. You look at the democratization of what has essentially been nation state cyber weapons. You know, the shadow brokers breach was a great example of this. The releasing of tooling, which was previously reserved for, you know, purportedly nation states and very sophisticated actors, now being put in the hands of maybe cyber criminals and script kiddies who don't have the sophistication and the money to spend on cyber weapons. And there were various other areas of the six Ds that really stood out to me and democratized and dematerialized. The advent of cloud computing and SAS has meant that you're having criminals out there now who can essentially spin up hacking infrastructure in a matter of minutes, which would have previously required them to have physical servers in their garage and spend lots of money and time. So I think the six Ds of a contemporary organization, a successful organization in this modern world, they're so applicable to cybercrime. And I think the real reason for that is cybercrime these days is a business like any other. So I'm glad you enjoyed it. That particular article is actually on my blog, Cybersecurity Matters blog. Shameless plug there. But yeah, anyone who's interested can check out my thoughts on the 60s via that website.

Chris, you know, myself and a lot of people listening, we all have our notions about the role of the cybersecurity function in an organization. But you know, in these times that we're living in now, what's your view of what the role of the cybersecurity function should consist of?

Fantastic question there, Rob. I'm going to start by what it shouldn't consist of or possibly the challenges that we've had historically. Right. So what's happened, I think over the last 10 years is we've seen a shift from the way that projects are delivered in the modern organization. And I'm sure you've spoken to people before Rob, who talk about waterfall versus DevOps and agile projects but that's had a profound impact on cybersecurity. So rewind. Maybe 10, 15 years ago the way the security function worked was very kind of waterfall and stage gate orientated. A project in an organization would be initialized, the security function would hopefully be engaged. We'd be given a week, maybe two weeks to write some non functional security requirements, some build infrastructure would be commissioned and there's you know, generally speaking, or maybe invariably there'd be a pen test and then a week after that we'd get some findings. It was a drawn out process. Security took a lot of time and there was this perception potentially that we were a blocker, we weren't, we were a stage gate process but we added time and expense projects but we could do that because projects were being delivered via, you know, framework such as Prince 2. They were waterfall based and you know, people society accepted that, you know, racking and stacking infrastructure took months. As someone who's worked on user side for a long time, that was accepted within an organization. Now we fast forward to where we are today and we've already touched on kind of the six Ds of an exponential organization. Well, those organizations are expecting infrastructure and applications to be deployed in the blink of an eye. They have developers and coders who are writing new lines of code on a minute by minute basis. They're looking to deploy virtualized infrastructure via containers in a matter of minutes and hours rather than days and weeks. The security functions had to pivot. Those ways of working that we had 10, 15 years ago of, I don't know, a pen test taking a week or defining security requirements taking two weeks. That's just unacceptable for the modern business. So the security function today has to be one that's working with these cross functional businesses. I suppose the most progressive and successful security functions that I deal with today have a very flat horizontal structure. They have most of them or some of them, they're moving towards this in most have really embraced this concept of the be so or, or the business Information Security Officer. Now that BSO would actually embed themselves within a particular business unit of an organization. So let's take financial services. You may have a BSO who would sit in investment banking, in retail banking, in wholesale banking. And that BSO then gets to know intimately the critical business functions of that unit. They get to know the coders and developers who are working they get to know the senior business stakeholders and help them classify and identify critical assets. I talked about my book and I talked about the right hand side of a risk equation being causes business impact. Well, you need to understand the assets that are important to your company if you're going to be able to accurately qualify business impact. So the security function needs to be one that's embedded. Maybe slightly trite of me to say so, but it's true, you know, embedded within these specific business units. And we have to become, I think the role of the CISO and the role of the security function is misunderstood in a lot of organizations. I think people think that we're there to stop cyber attacks or we're there to, you know, ensure 100% availability of services. I'm going to, you know, dispel a few myths here. We're there, in my opinion, to reduce risk, but the definition of risk is one which has to be given by business stakeholders. And a statement I use in many an interview is we're there to design controls that are commensurate with the classification of information. Now, if people don't give us that classification, we can't protect all data, all systems, all assets with the same level of security for two reasons. It's quite expensive to do that and also it increases friction potentially with the use of applications and infrastructure that kind of doesn't need to be there. So to wrap up the modern CSAR and the modern security function needs to be working cross functionally in their organization. They need to be consultative and pragmatic. Yeah, they need to be working in an agile fashion because that's how most modern businesses are being run today.

So the role of the CISO and the responsibilities and how that function works within an organization has changed a lot from what it was a decade ago now. Chris with that, of course, comes a lot of new challenges, a lot of new expectations. So what does it take to be a Chief Information Security Officer in a world of digital transformation?

That's a great question. The modern CISO is something that's hotly debated in magazines, on LinkedIn, industry conferences, and there's many schools of thought as to what makes a good quote, unquote ciso. I think there has to be kind of, it's a hybrid role these days. I think people talk about these two kind of core career paths that you see. You get the CISO and maybe I fall into this camp, so slightly biased maybe, but who's come from a very technical background, maybe they've worked as an engineer, they've worked as an architect, designer. They started to progress through to management responsibilities and, you know, they become the CISO via that route. And the other CISO that's commonly, I suppose, experienced in organizations is one that's been in a leadership role within the business somewhere else in that company. So I see some organizations where it's the incumbent CISO's first CISO role. They may have spent 10 years in finance or in HR or operations. And the school of thought there is they intimately understand their business. So consequently, security, which sometimes can create friction. You know, we do have to sometimes say, no, you can't do that, or we would suggest you don't do that. So they have that political acumen within a company. But for me, the CISO needs to have a technical grounding. Now, I think people misappropriate what technical means. I'm not suggesting that they could, for example, deconstruct the AES crypto algorithm and understand how S boxes work. But for me, technical is a mindset. It's having a passion for how things work. If you're curious about how something works and possible ways to abuse that, I think that's technical enough to be a ciso. But this person certainly has to be comfortable with taking very technical concepts and translating them for an audience who isn't technical. I think the worst thing that the security function can do by proxy of the CISO is go to your executive board and talk to them in language that they don't understand. You know, going to your CFO and CEO and saying to them, we blocked 2 million potential malware threats this month. I've had CISOs who've done that. You know, a board's turning around and saying, is that good? Is that bad? How many, you know, potential incidents did we have last month? You know, what threats were we looking at protecting against six months ago? It's certainly got to be something that resonates in business language. So the CISO has to be somebody who's interested, in my opinion, in technology and the inner workings of it. That doesn't have to be low level. It just has to be a holistic understanding. They have to have an understanding of the business in which they're operating. So have good relationships with leaders of these business units and also get to grips with what your company does. Right. I think that's something we overlook in the security function. As I mentioned earlier on this interview, we design controls that are appropriate for an environment. So do we know what our company strategy is? Do we know what the priorities are? And Once we understand those, we can start to identify these, what I call key risk indicators. So things that could have a material impact on the company achieving its objectives. And that for me, is what the security function and the CISO specifically is there to do. And, you know, I don't want to get lots of comments back saying, oh, I'm a CISO who isn't technical. I think we need to better qualify what technical means, because unfortunately, you know, the security function, like I said, we design controls with protecting assets. Assets in the model and business are overwhelmingly digital. So we need to have a grounding in the digitized world in which we work.

Chris, you touched on something which I think is really important, and that's the ability for the CISO to communicate to those C level business executives because they know security is important. They don't understand the nuts and bolts of it. You know, when you're going in and out of organizations, what kind of evidence do you see of CISOs actually engaging well, communicating well with these senior business executives?

I don't want to say we're pushing against an open door. That would be, that would be unfair. But what we have seen over the past, I would say it's probably three years. I would say 20, start 2017. I wrote in the book that, you know, 2017 was kind of this year of the data breach in that senior executives started to understand and appreciate that it could happen to them. I mean, how many times have we heard that, you know, a CIO or CEO would say, hey, why would a hacker really say hacker? Because hackers can be for good as well as nefarious purposes. But why would a cybercriminal want to come after my organization? We only sell tins of beans in toilet roll. And we've now got to a place, I think in 2019 where people are starting to understand the value of information. You know, it can be sold, it can be used to create false identities. There are many different ways now that you can monetize this. What was our data's the new oil. How many times have you heard that, Rob? You know, so I think we are in a better position now that senior executives quote, unquote, get it. Now, that does vary from organization to organization, but cyber attacks and also system availability, because we shouldn't forget about that. If you think of the core tenets of information protection, it's not just confidentiality and integrity. You've obviously got availability of data, and I think it's become newsworthy. Cybersecurity, information protection and business resilience. And now making the front pages of newspapers and mainstream websites rather than, you know, the corner articles in the middle pages. So board executives, maybe in the Financial Times, in the Times, in various other publications are seeing the impacts of WannaCry, Notpetcha, Bluekeep. They're seeing large multinational organizations being impacted by availability considerations. Now, a lot of those are accidental. You know, if you start to decompose some of these major system outages, you'll read fairly regularly that they've been caused by somebody typing the wrong command into a terminal. Or perhaps there'll be a system that they didn't know existed that went offline and caused systemic damage to a line of business application. And these executives, they're seeing that and they, they don't want that happening their business. And of course, another driver. And I promised myself I wouldn't talk about this in detail today, but you know, contemporary privacy regulations such as gdpr, we've seen in the last two or three weeks the potential, and I'll say potential, because there's a long way to go yet. Fines that have been issued to British Airways and to Marriott, for example, running into three figure millions. I believe the figures are maybe 189 million pounds and 99 million pounds ish, respectively for those organizations. For, you know, a purported, I say at this phase, you know, inability to protect information. So boards are seeing that $100 million or £100 million I should say, is a figure that's going to get any board executive to sit up and listen. So I think it's got easier for CISOs, but we're not there yet, we're not out of the woods. It's important that we are still talking to executives in language that they understand, also telling them about things that they want to hear about. I ran a talk yesterday for the iisp, the Institute of Information Security Professionals, and one of my speakers spoke very eloquently and succinctly about the challenge of a security leader telling their CEO about a patching problem. Now, patching is vitally important to the security and the operations function. It forms a core tenant of your ability to provide cyber security and IT hygiene. But an executive on your board isn't going to understand the importance of patching. What they care about is the importance of critical systems that are making their organization money, perhaps. And patching is a protection mechanism for those systems. So there are lenses, I think, and dimensions to how you articulate risk. And it's imperative that when we talk to our senior stakeholders, we're talking in terms of things that could impact their core business objectives. Rob?

Chris, you mentioned the fact that security is no longer, you know, a little corner in a newspaper. We've seen, as you mentioned, British Airways and Marriott and now these, these breaches of security, they're hitting prime time. You know, they're taking up time on the BBC. So from a public perspective, we are seeing, we're being made more aware of the security and security breaches. But tell us, from an organization's perspective, what is security awareness? What should it be and what shouldn't it be?

That's a great question. How many conferences do I go to where we talk about security being everyone's responsibility and how awareness is vital? So it's a tough one. For me, awareness is about changing culture in an organization. Right. And the example I always fall back to is health and safety. So health and safety is everyone's responsibility. I passionately believe that. And it's something that seems to have been embedded into most organizations. You know, if somebody goes into the kitchen of your office and they see a wire that is trailing across, that could cause a trip hazard, or you see a wet floor that someone could slip on. I think we've almost been programmed now to go and report that to the relevant person in our organization. There's a protocol for that. People understand what to do. I think in the cyber security realm, I don't think we've reached that point yet in most organizations. And I think there's maybe some stigma and some, I suppose, maybe historically fair challenges with that. I think people from a cyber perspective, potentially, if they see something that looks suspicious or perhaps they did something that they weren't supposed to do, but it was an honest accident, I think maybe people think that they will be in some way punished for that action that they've taken. So for me, awareness in an organization has to be breeding a culture of openness and responsibility. Knowing who to talk to in the event of something, I don't know, suspicious landing in your inbox, or perhaps you've opened a file that you shouldn't have done, or perhaps this is a common one, you've sent an email to someone. And the modern email systems helping the end user will allow autocomplete of email addresses. You've sent it to Jenny when you meant to send something to Steve. Having a process and knowing who to speak to in those scenarios is important. I think awareness. There are some situations where security awareness needs to be tailored to particular teams. I think there's a general overarching awareness campaign that you would have as you would have with health and safety. But there are also specific programs of security awareness for different teams. And I'll give you two very quick examples. I think if you're working, let's say in a call center or a reception, for example, there are particular environments where you're susceptible to social engineering. By social engineering I mean somebody phoning up or maybe emailing in and trying to extract vital pieces of information through a pretext which isn't correct. So I don't know, saying they've got some vitally important documents that they need to send to someone. Can they have the email and phone number of your CEO or, or some kind of business email compromise which we're seeing is certainly prevalent these days where people will purport to be the CEO and say that they need some funds being transferred to a particular bank account. So specific training for those people is vitally important. And the other end of the spectrum would be awareness training for your coders. I mentioned earlier the importance of development in most digitized organizations. Well, a big cyber security challenge that I see is the security function historically gives developers these very large pen test reports that tells them to fix a million vulnerabilities in their code without really. That's the what, isn't it? That's the what you need to do. I don't think we've always been very good at the why sitting down and explaining why developing more secure code is of intrinsic benefit to your company. So their areas of awareness. Something else which I'm passionate about is making sure awareness is an iterative activity. You know, there's no end to security awareness. What I don't like it to be in an organization is biannual or even annual computer based training without any follow up. I think PR marketing teams, customer success teams in organizations, it's vitally important we work with those departments on an awareness campaign so that people, if something's everyone's responsibility, it needs to be naturally reinforced on a regular basis. So it's many things and it's also contextual. You will know the security function within and the HR function really should know what's going to work best in their company. But for me, most importantly, it's about, I suppose, a culture of kind of openness and knowing who to go to in the event of possibly something being suspicious or malicious.

Chris, every industry has its cliches and one in this space is it's not if it's when you'll be compromised. What's your take on that?

I mean there is a lot of truth in that, to be perfectly honest, I don't know of an organization who would say they've never had a security incident. But there are shades of gray, maybe not even gray on this one, Rob, in that there are downsides to that statement, in that I've had board members who've said to me, and some consultancy engagements or potentially events, they will say, well, if we're going to be compromised anyway, what's the point in spending millions of dollars on security controls? And that may sound a little flippant, but if you think about it, this comes back to the way that we engage with our boards. I assert that it's the CISO's responsibility to talk about risk minimization, to talk about mitigation, to talk about the requirements from regulators for cybersecurity controls. Could you imagine playing out a scenario whereby you had a requirement to talk to the Information Commissioner's office in the event of a data breach and your immediate response was, well, we didn't deploy any security controls because we thought we were going to be breached anyway, so what's the point? I think, again, that's me being slightly facetious there, but it's true. The reason that I think it's if not when you'll be compromised is, is a solid security principle is that it kind of plays to a requirement to have capability for detecting and responding to cyber attacks. You know, it's important that we can minimize the impact of something going wrong in an environment because it's inevitable that an organization will incur or experience some form of business disruption. Let's make sure that we can detect and respond to that disruption in as expedient a time frame as possible. So I appreciate that's a long winded answer to your question, but there are two sides to it. Some profoundly positive ones, but also some considerations. When you're going to espouse this, when you're going to say if not when you're going to be compromised, make sure you understand why you still need robust cybersecurity.

Chris, you just mentioned that organizations are spending millions on cybersecurity. But you know, in light of what we already mentioned, the Marriott British Airways scandal recently, all the awareness, all the spend, why then does the plethora of high profile data breaches continue?

I can give a personal view on this. This isn't my employer's view or anyone else's, but my view is I don't think we're that good at doing the basics. You know, I'll give you an example. So I'm lucky Enough in my job to travel the world speaking at and attending in industry conferences and sitting on advisory boards for them. And if you walk the expo hall at any conference, here, the us mainland, Europe, wherever you go, you'll hear, it almost feels stereo. You'll hear the importance of machine learning and blockchain and user behavioral analytics and malware sandboxing, and the list goes on. And I'm not knocking any of those capabilities. They're vitally important as part of a layered set of cybersecurity defenses. But the layers, that's the pertinent point of my sentence there. It's important that we design good IT hygiene and cyber security from the bottom up. And I know that may sound slightly trite as well, but good foundations and for me, good foundations. And this is actually a takeaway that you can use potentially with board executives, is asking some, fairly simple to ask but very hard to answer questions. Things like, how many assets do I have in my estate? And by assets I mean laptops, desktops, servers, what data do you have? Do you know where it resides and who has access to it? Do you know what applications you're running? Do you know their software versions? If you had a bluekeep or a notpetu or a wannacry, how quickly could you deploy a patch? How efficient would it be to deploy that patch? Do you have statistics around the efficacy? Do you have the percentage of machines have had that patch deployed to them? Let's say you have a request from a government agency or a threat intelligence provider to look for a particular indicator of malware too low level today, but you know, a particular piece of malware in your environment, could you search for that? How quickly could you search for that? Can you trust the information that's coming back? These are questions that sound pretty simple, but they're often really difficult to answer in an organization because the breadth of stakeholders that need to be involved in that conversation. So I think we're still seeing this plethora of breaches because, you know, defence in depth or appropriate defence in depth isn't always applied. I've quite strong views on this. You hear this, everyone needs defence in depth, but you know, organizations maybe think they have it and don't, you know, back to back firewalls or two AV engines. Isn't defence in depth for me? You know, defence in depth is having a set of capabilities that allow you to prevent, detect and respond to attacks rather than putting all your eggs in one of those baskets. And my final point, that's a very long answer. I'M sorry, but my final point as well is you look at the likes of GDPR and you know we're going to be seeing this with the California Consumer Privacy act and various other regulations and legislations, there's now a legal requirement to report breaches as well. So that's obviously having an impact on the volume of breaches that we're seeing today.

Rob Chris, we could go on, or at least I know you could go on and on sharing some superb nuggets of information on this, but we've got to wrap it up there because of time. Of course people can go and buy your book, which is Cyber Risk Management, published by Kogan Page, and I can see it's available on Kindle Hard, hardback and paperback. Where else can people go to learn more about the kind of information you've been sharing with us today?

I would say the best place to go I recently put together a website or a blog site. I found myself distributing content to various different channels and mediums. I had some of it on LinkedIn, some of it on Peerless. I do lots of writing for the Comptia. There's various organizations that I'm involved in. So I put together a site as this kind of canonical source. So I would advise people, your listeners, to go to CybersecurityMatters blog, so www.cybersecuritymatters.blog. that's actually got a lot of my interviews. There's a lot of content that I've written that's specific for that site and you'll find lots of links to both the book and other bits and bobs that I'm involved with in the industry.

Chris we'll put a link to that in the show Notes. Listen, thank you so much for your time today. It's been a real pleasure, absolute pleasure.

Rob speak to you again soon.

We hope you enjoyed this episode of Leading Digital Transformation with Rob Llewellyn and the Digital transformation people. Visit thedigitaltransformationpeople.com to secure the knowledge, talent and services you need for Digital Transformation success. To continue your journey as a Certified Transformation professional, visit rob llewellyn.com be sure to subscribe to the podcast and follow us on Twitter hedigitaltp and obertlewellyn.