Building Trust in the Age of Data Breaches | Tugboat Logic Chief Diversity Officer Sydney Archer

Hi everyone. Welcome to Saster Annual 2021. We're thrilled to have Sydney Archer, Chief Diversity Officer at Tugboat Logic, here to join us for this session. Today she'll be discussing building trust in the age of data breaches and there will be time for Q and A at the end, so please make sure to drop your questions throughout the session using the Q and A button in the bottom menu toolbar. Join me in welcoming Sydney. Take it away.

Thank you very much. I'm excited to be here and especially excited to be talking about this topic about Trust Business trust incidents are on the rise and becoming increasingly visible to everyone, making trust an inescapable issue for companies. Tech Jury notes that globally, 30,000 websites are hacked daily and 64% of companies worldwide have experienced at least one form of a cyber attack. So in our digital age, it's no longer a question of if a company will experience a breach or a trust incident, but when. Prospects, candidates, VCs, they all need to know that you are trustworthy before they sign on the dotted line. Because once they do, you become a steward of one of their most valued assets, their data and their customers data. Without trust, even your bottom line is at risk. Accenture's Competitive Agility Index noted that of 4,000 companies that reported a drop in trust, the revenues at stake equated to at least $180 billion. Contrary to popular belief, cultivating trust isn't some nice to have or soft skill. It's a hard necessity. What is? Trust. It's a powerful force. There's been a lot of research into it because it's integral to all human relationships, whether personal or professional. Telling potential customers or investors or employees that you can be trusted isn't enough. It has to be demonstrated earned. But how? I like the way Kent Grayson, an associate professor at the Kellogg School, breaks trust down into three pillars or key competence, honesty, and benevolence. Now, competence seems pretty straightforward, but honesty and benevolence, those are a little trickier. They're tightly intertwined and people make judgments about them in milliseconds. So how do you cultivate trust quickly and effectively so you can acquire new customers, stand out with investors, and attract top notch talent? How do you prove objectively that you're trustworthy? Today, I'm going to show you how you can differentiate yourself by focusing on two key initiatives for your organization that will systematically build trust across all three pillars. The first is building a solid information security program. You'll hear me refer to it as an infosec or infosec program. The second is cultivating a diverse and inclusive company culture. So let's start with customers. How do you build trust quickly and effectively in the marketplace? How do you build that credibility? Credibility is the belief that your organization can do what it promises and that builds trust. It feeds into building your brand's reputation and cementing customer loyalty. Your credibility though, needs to extend beyond the boundaries of the features of your product that your product can do what you say it can do. You must address your credibility in protecting your customers assets. By demonstrating that your business has the right security measures in place, you're demonstrating that you recognize the trust that your customers have to place in you and you take responsibility for protecting that investment. This is where your infosec program comes in. Your information security program is a documented set of policies, controls and procedures that you have in place to protect your business processes, your IT assets and data. Now, a really good infosec program addresses all aspects of your commitment to your customers. It should show that you've looked at the greatest areas of risk and you have plans in place to mitigate those risks. For example, you make sure that you patch your systems regularly. All data is encrypted, whether it's in transit or at rest. Your infosec should show that you're prepared to act quickly if one of your safeguards fails. You have an incident response program. You have backup and recovery procedures that you test regularly. And your infosec program should show that you've got measures in place to meet your SLAs and not just for product uptime, but in responding to customer inquiries or requests for help. And it should show that you keep your employees aware of your security policies, that you keep them trained in recognizing phishing, emails and social engineering tactics. Now, because your infosec program is documented, it facilitates transparency so you can be transparent with your prospects early in the sales cycle. So arm your salespeople with all of these artifacts. Offer it up proactively. Share your infosec policies, your incident response plan, your data collection practices, your cooking notices. It establishes that your business has a security first culture and that demonstrates your competence, integrity and goodwill. So don't wait for them to ask you to complete a security questionnaire. After all, the most requested items in security questionnaires are for your infosec policies and procedures. So get a leg up. Get ahead of your competition and have it ready. Now, if you really want to get ahead of your competition, try complying with more formal security standards such as SOC2 or ISO 27001. And even if you don't have an established security program today, working towards one of these standards can help accelerate the process. Frameworks like SoC2 can highlight where you may have gaps, and they have you create documentation and establish processes that other organizations understand and quickly recognize. Attestations are a lot of work, but it's why they're the gold standard and signifiers of trust. Now, SOC2, particularly SOC2 type 2, is a real differentiator for organizations that want to show they not only have standards in place but but they've had them tested by an independent third party. That goes a long way to establishing credibility. And as a bonus, attestations often replace security questionnaires or at least the bulk of the questions in them. And that saves your team considerable time. Now let's look at investors. How do you cultivate trust with investors? Well, the same principles apply. In fact, your infosec program is even more important to your investors because it addresses risk head on and it facilitates the necessary transparency that's part of their evaluation process. Let's start with risk. Fundera reported that approximately 20% of small businesses fail in their first year. By the second year, that goes up to 30%. By the end of five it's about half. And at the end of a decade only 30% remain. That's a 70% failure rate. A serious breach can take down an early stage company in a moment. I've worked with quite a few companies in the last two years that started building out their infosec program or working towards an attestation solely because they were starting a funding round and they recognized investors weren't going to give them a second look when they without having a program in place. Red Canary found that although most organizations do follow best practices, there's room for improvement. For example, as many as two in five organizations fail to complete compliance audits of partners or vendors that they're using that are integral to their service or product offering. And 37% of companies lack an employee security awareness program having attestations like SoC2 or ISO 27001 that require those vendor risk assessments and employee security awareness programs reassure your investors that you're doing the right things and that you follow through. Now, your infosec program also facilitates transparency, which is a hard requirement for investors. Investors use models to help them differentiate between risky investments and stable ones. Proving you're a good investment is reflected in your company's practices, your books and your reputation. Now, having gone through a Series A funding round with Tugboat logic in early 2020 and most recently, what started as a Series B funding round that led to our acquisition by OneTrust last week. I can tell you from experience that complete transparency is required before any investor will sign on. They will open every drawer in your metaphorical dresser. Investors need to perform their due diligence so they'll dig deep into your books, into your policies, into your practices. They need to validate that you deliver on your promises. So take for example, let's say you've got a policy, a privacy policy in place, and it states that you don't sell information to third parties. Well, in that case, they are going to cut and run if they find a bill of sale somewhere else in your files that indicates otherwise. So you need to make sure your contracts are solid, you have strong policies, you follow them, and you haven't accepted any crazy red lines from clients. Now, trust goes beyond the books. And that brings me to the second initiative, valuing and cultivating a diverse and Inclusive company culture. Investors want to get involved with companies that align with their beliefs and their ethical values. The investor that led Tugboat Logic series A funding round. They're passionate about diversity and inclusion. In fact, a component of their diligence process involves getting diversity metrics from companies they are evaluating for investment. And they held us accountable. I was reporting on those initiatives at every quarterly board meeting. And they're not the only ones. The 2020 RIA Investor Opinion Survey found that 73% of respondents invest in organizations providing opportunities for women and diverse groups. So live your values, hire diverse talent and be proud of supporting them. Your integrity and values are key to your success and cultivating trust. Now, trust is equally crucial in the war on talent. As a company's reputation and actions become more important to job seekers, employees are actively looking for workplaces where they see an alignment between their values and a company's stated values. So how do you cultivate trust and attract and retain talent? Seven years ago, I didn't hear people asking me about diversity and inclusion in an interview or quizzing me about a company's position on charitable giving or community engagement. But today, that's part of almost every interview. I find Today's candidates are doing their research ahead of time. They've checked out our website. They've talked to colleagues on LinkedIn. They are proactively seeking out companies that align with their values. By 2025, 75% of the global workforce will be millennials. The Deloitte Global 2021 millennial and gen Z survey found that millennials believe in their individual power to drive change, they align their spending and career choices, and they are passionate about driving change on societal issues that matter most to them. You don't need to look very far to see that diversity, equity and inclusion in the workplace matters to them. So if you don't have a position on diversity and inclusion, I think you're going to find yourself really struggling to attract and retain talent. Now, if you cultivated an inclusive culture where employees feel accepted, valued and appreciated for who they are, the benefits are tremendous. They'll bring the best of themselves to work, they'll be happier. And studies show that happy employees are more productive, less likely to leave, and they attract other talent. The costs of both employee turnover and recruiting are significant. So driving a healthy company culture has a direct and positive impact on your bottom line. So what about InfoSec? Does it have any place with building trust with employees? Absolutely. Frameworks like SoC2 specifically address the foundations of trust. The first Koso principle in the SOC2 standard is to demonstrate a commitment to integrity and ethical values. A commitment to diversity and inclusion isn't enough to empower and build trust in your employees. A good InfoSec program addresses their needs, the risks and contributions of your employees. For example, if you don't already have an easy and fast way for your employees to report incidents or concerns of a breach, you should look into it. Your employees are your early warning system. They are also your greatest point of vulnerability. Our CISO regularly sends me articles about security trends and issues. He recently sent me the synopsis of a large telecom company's annual breach report. Not surprisingly, it found that most breaches are financially motivated and still require a human element to succeed. This puts a lot of pressure on our employees. According to Tech Jury, employee threats or unintentional errors increased from 3,200 incidents to 4,700 per year between 2018 and 2020. This increased frequency of insider attacks led to about 60% of organizations experiencing 30 or more insider attacks yearly. It's clear training your employees in cybersecurity is critical. Now many organizations have started to do that, but they're still only training their employees in cybersecurity once, when they're initially onboarded. But that's not enough. So why? Trustworthy companies do things differently. They provide all employees with ongoing security awareness training. It also gives you opportunity to inform your employees about fail safes you have in place to protect them. For example, if you've got an MDM solution that allows you to remotely disable or wipe a lost or stolen device, this shows your employees you've got their backs and they're more likely to report such an incident in a very timely manner. So remember, you need to empower your team. Appoint someone to head your infosec program like a ciso, and build a culture of openness through your policies and procedures. Make cybersecurity and awareness training an ongoing initiative. Your employees are the focus of the bad actors out there. You need to empower them. The 2021 Edelman Trust Barometer reminds us trust remains the most important currency in lasting relationships. The fact is, your company's culture and commitment to security assurance go hand in hand in building trust. If you haven't already started putting information security into practice, get going and don't wait to focus on your company culture. Empower your people. Make diversity and inclus an integral part of your company's lived values. Customers, investors and talent. They are all looking to affirm their values with the companies they choose to align with. So if trust is a critical component of your business strategy, you will find yourself genuinely competitive. Thank you.

Thank you so much Sydney. Everyone please feel free to drop your questions in in the Q and A section down at the bottom. Kicking off with a question that came through. You mentioned ISO 27001 and SoC2 a lot. If you're a startup, which of the two would you recommend pursuing first to cultivate trust and why?

For a startup specifically in the SaaS space, I would say a SoC2 in particular. One it's a more cost effective standard to work towards. It can be very pragmatic. It's got different trust categories that you can work towards so you can use a crawl walk run. Also got the concept of a type 1 and a type 2, the type 1 being a point in time audit. So that's part of that crawl walk run approach. And then you can move yourself towards the type 2 that is testing the efficacy of your controls over time.

Great. And then another question that came in, if you make a mistake or there's a data breach, can trust be rebuilt after the incident? And how can an organization go about that?

Oh absolutely. As I said early on, it's no longer a question of if a company is going to experience a breach or some kind of incident, but when. So you need to be prepared and the first thing you do is don't hide from it. Get in front of it, be honest, be transparent, notify your customers and include in that notification details of what happened, how they are affected and what you are doing to rectify it. And in doing so you are demonstrating your competence Right. You have a plan, you're demonstrating your honesty and your goodwill and in telling them ahead of time. So. Absolutely. But the worst thing you can do is to try to hide it.

Great. And then one more question. How do you build trust in your role? And at Tugboat Logic, I have two roles.

So in my. I'll start with Tugboat Logic as a whole. Right. So we drink our own champagne. Early on in our process, when we were just getting going, we got our SoC2 and we've maintained that and then moved to our ISO 27001. We hired a CISO early on and really early on we hired. We. We designated myself to be the Chief Diversity and Inclusion Officer. So making diversity and inclusion an integral part of our company's lived values. And so both that security culture and the diversity and inclusion were part of our DNA even before we started funding rounds. And then I would say in the customer success role that I have, leading the customer success team, we live by those values of honesty, of integrity and authenticity. So we're honest with our customers. We're not going to tell them that it's going to take them a mere two weeks to complete a SOC 2 with minimal effort. We'll be honest about what's involved, where we can help them, how they can best move forward, and that authenticity, where we're super invested in our customer's success, that comes across. So of course that builds trust. On the diversity and inclusion side, I'm really proud to say that we, we were designated as one of the winners in The Startup Weekly's 2021 Diversity and Inclusion Award. And what I'm particularly proud of is when you submitted for it, you could, you know, give them a synopsis of your programs and everything you're doing, or you could have your employees anonymously and independently go and complete a survey that they had put out. It takes it all out of your hands and you put that trust out there to your employees. Our response rate was phenomenal and our ratings, we were in the 90% overall. So very proud of that. We live our values.

Great. Any last minute questions for Sydney? Awesome. Thank you so much, Sydney, for the wonderful session. Thank you so much for your questions and for tuning in. Lots of great content to follow this week, so hope to see you all later. Thank you so much.