Episode 1. The Future of Security: Integrating Physical and Cybersecurity

Well, hello and welcome to our first episode of Executive Checkpoint. This is a security professional podcast, and I'm your host, Tino Urbina. Today I have the great honor to have Pierre Bourjacks, a seasoned veteran of 30 years in the industry. Pierre is the CEO of ESI Converge, and he's leading the gap between physical security, cybersecurity, and governance. Through his career, Pierre has held influential positions in renowned organizations such as ADT Tyco, Hi-Security, Secure Estate, the RAND Corporation, and has been driven forces— one of the driven forces in developing advanced security governance programs and has played pivotal roles in designing comprehensive enterprise security systems. As a recognized thought leader, Pierre has been at the forefront of integration of IT, OT, and physical security and is currently working on innovative models that push the boundaries of predictive analytics in the security space. So today, Pierre will share his journey, insights on the evolving landscape in the security industry, and his vision for the future in the industry. Pierre, it's a true honor to have you. Welcome to the show.

Well, thank you, Tino. I'm actually very excited about being the first person on your, on your podcast. So I think that You know, I've known you for quite a while and I've seen your evolution in our industry as much as, you know, the fact that the industry itself has evolved very quickly in the last 10 years. So a lot to talk about, a lot of things to really cut through.

Yeah, and, you know, likewise, Perry, thanks so much. I always enjoy our conversations. So this time we can make it a little more in-depth because, you know, as long as I've known you, I've never actually asked you what sparked the interest in the security industry, how you got started, What's your inclination to be in the security space?

Wow, that's actually a loaded question. So I don't think anybody really thinks that they're going to get into security unless, you know, they end up being in a position where security becomes a part of what they do. And that's really the transition of, you know, really career choice, but also, you know, really at the end of the day, what your capabilities and comprehensive understanding of things lead you towards, right? You know, I initially, when I first thought of going into practice, I thought about law. You know, actually law was the first thing on my mind. But instead, you know, I passed the Foreign Service exam and decided to go into, you know, thinking that I was going to go into diplomatic service. Worked with the RAND Corporation. That's kind of where I ended up initially because really honestly, it was just, it was a career day at our university at Loyola and I ended up choosing that as an interesting topic and obviously speaking multiple languages in Arabic and French and a little bit of Russian at the time and a few other little dialects of other languages. You know, it was definitely very interesting for them to look at and say, hey, you know, you could help us. So spending some time there and then Department of State Security Services and working overseas in operations and environments that were very interesting using technology. to really move the pendulum in regards to how we operated. And I think technology was first and foremost on my mind in terms of how we could leverage technology to do our job, right, at the end of the day. And that's really what everybody wants to do. Security is only a byproduct of that technology use, right? I mean, we all talk about how security is really the first thing on people's minds, and no, it's not. It's really, how do I do business? How do I operate? And, you know, when I operate, I use technology. When I use technology, I need to be secure. So that's kind of how it usually works, right? And I always think—

huh? Going back to those early days, what were the challenges at the time that you recall in your earlier part of your career? What's something that you recall being one of the biggest challenges at the time?

Well, communication, connectivity, the ability to actually process. Data to store information. So these were all things that were complicated. You know, the use of technology to, you know, to be able to transmit data, oh my God, that was almost impossible. We were dial-up in the '90s. So the reality is, you know, when I, you know, basically cut my teeth in the technology world, you know, we were PLC-driven, we were analog-driven, barely analog. I would almost call that barely analog. And then going into to the fact that we had early compute and it was not easy. So a lot of that was very complicated. And I think, you know, like I said, communication capability, you take communication, you take, you know, how you use that to transmit and how do you actually work on, you know, retaining and delivering the right information. So all of that was like, we were archaic at that time. I mean, and the physical security industry wasn't even on the roadmap. I mean, they thought, were nuts. Anybody who's saying, well, you know, we want security, we want ensuring IT is involved, and, you know, we were going to transmit, and they were like, no, no, no, I want to keep this completely off the network. There's nothing— whatever that network was, they didn't even understand it anyway in the '90s. So yeah, we've come a long way. I mean, you know, I mean, all the way up into dark fiber and all this wonderful stuff that really changed the industry. And I think that the real, I guess you call, you know, the watermark was 9/11, right? I mean, everything changed after 9/11. Before that, everybody was very happy with being cavemen.

Yeah, there was another priority in security. Is there a particular project that you can think back and go, that was a specific and very challenging, of course?

Well, I mean, yeah, I would say that there's a couple, you know, kind of major projects, one of which was in Saudi Arabia. I won't go into the specifics, but it was a very large organization. They were attacked by a suicide bomber and effectively handicapped a part of their facility, and it changed a lot of things after that because they realized, well, wait a minute, You know, IT was sort of involved in this and it was an insider attack. And then all of a sudden people realized, wait a minute, we're not controlling this internally and we're allowing, you know, certain things to take place. Well, we need to have security to control and measure the network because basically there were things that were done that led, you know, led the responders astray and allowed— an attack to take place, which handicapped the facility. So, you know, like I said, I kind of didn't really give you the clear picture of who, but the reality is, is that that was a watermark or watershed moment for me. And that watershed moment led to me realizing that cyber and IT was very important. And in fact, I wrote a little paper many years ago, God, 20 years ago, I think. And it was about, you know, layered security, but basically tying IT to the conversation, right? So it was from the perimeter to the back office. And I remember, I can't remember who published it or if it was even published, to be honest with you. But what that did is it gave me the impetus to say, look, I've gotta really learn about cyber and I really have to understand about IT. 'Cause even though I was in communication, I then went into perimeter, a lot of perimeter stuff. And really that was just understanding gate control systems and all of that wonderful stuff. And then looking at how to— Positioning?

Mm-hmm.

Yeah, it was very— then it led to, of course, you know, hey, IT and cybersecurity is really important. And I think the mid-2000s, early 2000s, mid-2000s, I was very involved in cyber and IT. Now virtualized networks, I was learning all about that. I mean, which is now today's cloud, you know, with virtualization or virtualized networks was just cloud, but it became cloud, you know, Amazon came after that.

So do you feel you were one of the first few folks that kind of made the connection between physical security and the impact on cyber, or networks were interdependent with physical security?

Well, I think 20, 30 years ago, I think people that first understood the connection of a network infrastructure to a device started probably 10 years before I got interested. but it was very rudimentary, even maybe 10, 15 years before I even started looking at it. And it was very rudimentary and it was very, and they used the word convergence, convergence. And unfortunately, I think it was misused. It was also misunderstood because, you know, a one-dimensional infrastructure of connectivity between an IT or say network and a device is just rudimentary. Okay, that's first stage. And that's what everybody was talking about. the things that we talk about today are completely different. It's a whole different world in regards to what that means. And I think that—

There was, you know, I talked— had this conversation before, and to me the industry has evolved from being very siloed. You know, technologies were very much siloed and the connectivity was driven by the market, right? So yes, the market eventually were the ones that said, no, we want to simplify and start kind of packaging together some of these technologies. At what point, at what point did you understood the need in the market for someone with your expertise and decided to form ESI?

Well, SecureState, I guess at SecureState, we began building a physical practice. And it was a cyber company, cyber and IT company. And building that physical practice really just honed in the reality of, hey, you know, there's something missing here. I mean, I think that in 2012 or '13, we were still 5 years away at that point. It was still, you know, even though NIST had come about and built 800-171, 800-853, the reality is that there was still very lack— there was a lack of understanding of how this impacts a business from the standpoint of security and cybersecurity. And I think that that's where the challenge was. It was education, 'cause I remember speaking at ISC West in 2000, and I think '15 maybe, could have been '14, '13, I think it was '13. And I remember having 3 people or 4 people in the room because they were all trying to figure out why cybersecurity here? Why is this important? And I think that was the beginning of what we have to strengthen We have to strengthen our manufacturing posture. We have to strengthen our deployment posture. We have to strengthen our specification posture in how cybersecurity plays a role in terms of the physical controls world. And I call it controls because a camera is a physical control, right? It is an ingestion element for physical security. So all of those devices needed to be secure. There was no real way to get there back in 2010, '11, '12, '13, '14. But then all of a sudden, things began to shift. I think people started realizing that the low-hanging fruit for hackers was a technical device at the edge or a camera or an access control feature. At first, people would say, well, it's access control. Who cares? I haven't heard anybody hacking an access control. or access control and getting into a building. I'm like, no, no, that's not what— you're just the portal for access, meaning you're the easiest way to get into the network. They don't care about the door. They care about the access to the network where all the crown jewels are. So I think boiling it down, it's just a lot of education and there wasn't a lot of it at the time.

I tell you, I had a conversation, this was a few years ago, with cybersecurity consultancy group, and they had a client that was investing quite a bit of money on their IT and cybersecurity. And their question was, how do we guarantee that after all this investment, we will be 100% secure?

No way.

And so basically, it was strange that they were contacting me. I mean, you know, I was in the physical security side of things, and The question was, or the comment to the client was, you know what, if you can touch it, you can hack it. So we need to bring physical controls to be able to do that.

Correct.

Well, I hope you can agree with this, but I think the physical and cyber unified with the increased implementation of, you know, intranet, IoT, and OT elements, and there was no turning back. I remember being in a conference with oil and gas executives, and they have both sides, physical security, and they had their IT experts, and they were just talking about how they were going to communicate. Forget about collaborating.

Right.

Such a different discipline. So your position in the industry and talking about the converged approach to security, to me, it's always been interesting.

And that's really the last 5 to 7 years, by the way. You know, the reality is when OT infrastructure became part of the conversation, it's because, well, and I'll be frank, the government was looking at gas pipeline infrastructure and realized that it needed to be connected, at least needed to be able to be monitored.

Mm-hmm.

The GAO report of 2017 clearly aligned that, and I wrote an article very clearly explaining that this is going to be a theater near you. And right after that, of course, the Colonial Pipeline breach took place, which was not a breach from the standpoint of IT perspective, but it was leveraging OT controls, which were PLC SCADA control systems, which inevitably led to a breach that affected the network, at least the operational network. So with respect to a lot of things, there's a lot to understand, right? A lot of these critical infrastructure organizations do not put everything onto their data network. They have an operational network. Those who do are always challenged and usually are the ones that get breached. But that's why you have to separate the operational and the data network. You don't try to connect the two, you try to separate the two. The reality is it's expensive, okay? And what it boils down to is cost becomes a challenge for organizations when it comes to that. So if you're a utility or you're a petrochemical facility or whatever the case may be, your goal is to align your infrastructure so that it's separated, especially physical controls to logical controls or the data infrastructure to the operational infrastructure. So these are all things that people have to consider. And this is all like the roadmap has already been established, right? If you look at the roadmap that's been given to us as a recommendation by NIST, you'll find it starts giving you that direction, but it's not the end-all be-all. We have to use our brains, we have to use critical thinking, and we have to understand policy procedures that are tied to your business operational environment. Everybody's different. Every regulation's different. Every vertical is different. And since we're moving very quickly into a verticalized conversation in the industry, we're no longer truly just a one-dimensional technology provider in manufacturing or end users. We really hone in on the vertical conversation, and we apply technology to people to ensure that processes and policies are effective. And I'll tell you right now, that's one of the biggest challenges because, you know as well as I, humans are the lowest common denominator. We are the problem.

And, you know, going back to the elements of security, right, always consider physical security. You have your IT and cybersecurity, and sometimes people forget the human element, which plays a huge role. And, you know, the evolution of technology then is almost to the point to, you know, removing that human element by the utilization of AI. So we've gone through internet, IoT, and now you're talking about the last 7, 8 years. I'm thinking in the next couple of years with introduction of AI and removing that. So that's a—

Well, it's a loaded question.

Sure.

Because people are still important and humans are still important in this equation. But the reality is, is that how much of the leveraging of AI will allow you to functionally do your business better? So at the end of the day, right, it's all about, and I'm just being blunt about it, but it is about making money, right? Organizations aren't just there unless you're a nonprofit that decides that, you know, you wanna be broke every single year, there's a part of you that says, well, we need to create revenue so that we can give if we're a nonprofit, or we need to make money so we can ensure that we're profitable. That's the first step. Second step is that, how does technology operate in a world that uses AI? Functionally, you have to do 2 things. You have to make sure that AI is built correctly or is given to you correctly and also can operate correctly to give you the information that's correct. So that means, you know, you don't have garbage in, garbage out. You have to have very good data and you have to understand what data means to you in your organization. Then you can apply metadata, data streams, information, because you have a lot of companies that have entered the market. I mean, obviously NVIDIA and Intel were leaders. Now you've got products like Halo and others, ADM, are all in the market to produce you know, faster processing speeds at the edge, that creates an ability to get critical and non-critical data so that it can apply itself to the use of it within the business environment. ChatGPT is on the data side and use of that to elicit better operational environments as well, or just say documentation and then development of documentation to provide good data as well as fast data. So the reality is this, right? It is an interesting world, but one thing I'm going to make it very clear, there is a place for humanity in this.

Sure.

I'm going to tell you one of the things that I would be very cautious about in developing solutions surrounding only AI is you must understand culture. You must understand how it's applied and how it affects the operational environment. If culture is strong enough, It trumps virtually everything. So we have to be very cautious in how we approach AI and how we use it to better the business environment as well as the security environment. So throwing AI just for the use of AI without a purpose is foolhardy.

Well, there's a lot of consequences if it's used improperly, and of course, acceptance of the end user, right? Ultimately, who's going to apply it? To me, what you're suggesting, Pierre, is that we need to reimagine how we are going to bring these new technologies and not just, you know, add to the initiative AI, right? It's saying if we are actually going to utilize AI properly and with ethics, right, how are we going to implement it internally and build a culture that is inclusive and respectful of of the companies and users, right, your customers. So in the last 5— in the next 5 to 10 years, let's not even go that far, in the next 5 years, where do you see this technology taking us, Pierre?

Well, I could tell you something, right? We are entering a world of high compute, right? High compute in machine— and we talk about Supercomputing is already here, right? And then we move into the age of quantum. So we're right around the corner from quantum, right? And people are not taking this seriously enough because, well, I just know they're not because they don't understand it. People who don't understand it are usually the ones just to relegate themselves to caveman mentality. The reality is, is that the world is moving to fast processing environments, faster processing environments that lead us to making decisions much, much faster. Which is also dangerous. So we have to really qualify and quantify our risk and our liability in each area that we use technology. So what I mean by that is this, right? You must assess your environment in a converged approach. You must understand the use of technology to ensure success, and you have to have outcomes that are very clear and precise. Using technology again for the sake of technology can get you into trouble. With perspective, the use of secured programs and secured technology and having programs that are much more organized than just a race to the bottom line, it's key to take technology and say, what are we doing to enhance the outcome? What are we doing to ensure that we can provide enough security in our products and our technology that that relies, and I'm not gonna say that anyone is quantum ready, so don't get me wrong, we're far away from that.

Right.

But I can tell you right now, we're no longer, you know, the archetypical, you know, from the Industrial Revolution to today, technology adoption is faster than it's ever been. We have moved so fast that no longer can we even keep up with the rate of growth of technology. So we have to really step back from a security posture Secure communication, secured identity, secured entry. These are paramount to the success of our industry. But without understanding that first as the legs of success for our security, then we fail miserably.

You know, and I think to your point, a lot of companies are still very reactionary to situations or technology in this case. A lot of people have a hard time comprehending going from classical computing to quantum computing, the gap or the huge leap. It's not even a gap, it's a huge leap between one and the other. It's hard, it's hard for most people to understand it, even if you are, if you have an idea. We can only assume what quantum computer can do.

Yeah.

You know, being that you are a veteran in the industry, it's always important to me to share? You said it earlier, nobody really expects to be in the security industry, right? But someone that is new in the security industry then wants to grow their career, wants to be relevant, but wants to become an expert such as yourself, what do you think, what would you recommend to that newcomer into the industry?

Well, I think first of all, Know your topic, know your, understand your topic, learn, read. And it's a hard thing to do, right? You must, you must really take a perspective that you be a sponge, learn as much as you can, be around people that know, at least you think know, get, get their advice, understand what and how you can be more precise in what you provide to the industry. Because I think what happens sometimes is we get lost in a mindset of, well, I— and trust me, the most important thing is I need to make money, I need to provide for my family. So that's the first thing people think of. The second thing that people should think about is, am I providing a service via my own capabilities that's going to do something good, that's gonna end up on the right side of right? Not the right side of wrong. So I would always say challenge yourself and learn as much as you can within those arenas. Now that's obvious. I think the rest of it is this: use your critical thinking skills, use your logic. Don't assume and don't just bloviate and speak to the marketplace without thinking and listening to what you're hearing. And then be able to stop reacting and just be proactive in terms of the conversation, but don't react emotionally. Part of the challenge is we live in an emotional world. We have emotions running wild. I think one thing that's prevented us from really learning is that the phone, the technology itself that we're using, all of us have base logic, everybody. Flawed or not, it's base logic. What I find happening is that we stop thinking rationally. We stop using deductive reasoning because we expect the phone or any object of technology to give us the answer. Instead, we move directly from logic, flawed or not, to emotion. That emotion is killing our ability to really think and really deduce what and how we get to the right choice. To make good decisions personally, especially in the security industry, to understand what's best is you have to listen. You have to think. You have to rationally think. You have to use deductive reasoning upon yourself so that you get to the answer that you're looking for, which is pretty much, this is the direction I should go in because I really thought about it, rather than just reacting and becoming emotional.

Right. I hear you. Master of your craft and focus and use reasoning, right? I think a lot of people will appreciate having access to your commentary and your wisdom. So what would you tell yourself, your earlier self, your younger self when you started your career? What will be the one thing, Pierre, that you will say, Pierre? This is what you should know with the experience that you have today.

Other than the personal challenges I've had in terms of marriage, but I would say that the main challenge for me would be to listen more, right? Also, tone down the ego. I mean, I definitely had a big ego and some people think I still do, which if you only knew me before, I think you'd freak out. But tone that down. Listen more. Be patient. I think one of the challenges I had was always, you know, not being patient. And I think that that if if I I could tell my my younger self patience, right? You know, easy easy as my grandfather would tell me. But I just didn't listen to him.

We can all relate to that. It's been a pleasure having you in the show as an inaugural. guest. And, uh, you know, we really appreciate that you've shared your insights in the industry. Looking forward to possibly do it again. Um, if this is a conversation that you folks enjoy, we welcome you to comment, uh, on underneath or in the comment area, comments area. And, uh, looking forward to see you guys again. Again, this is Executive Checkpoint. This is our inaugural podcast, Pierre. Once again, thank you. Like and share. Thank you so much.

You're welcome. Thank you.