Speaker 1: Helping leaders motivate their people to a higher level of
Speaker 1: performance through strong human relations, team building and GOLA GV.
Speaker 1: This is the seven Minute Leadership Podcast with your host
Speaker 1: Paul Fellavaliedo.
Speaker 2: Hello everyone, and welcome to the Seven Minute Leadership Podcast.
Speaker 2: It's episode five eighty three. Today we're talking about cybersecurity,
Speaker 2: not from the IT department chair, not from a vendor
Speaker 2: trying to sell you software, but from the leader seat.
Speaker 2: Because cybersecurity is no longer a technical issue. It is
Speaker 2: a leadership issue. It lives in your decisions, your habits,
Speaker 2: your discipline, and in your blind spots. If you think
Speaker 2: this is something you can delegate away completely, you are
Speaker 2: already exposed. So today I want to give you a
Speaker 2: practical cybersecurity checklist for leaders, not theory, not corporate bs,
Speaker 2: a real world checklist that you can mentally run through
Speaker 2: the same way a pilot runs a pre flight or
Speaker 2: a paramedic checks their ambulance before a call. And for
Speaker 2: this episode, I have brought back into the studio probably
Speaker 2: the most listened to and requested guest in seven Minute
Speaker 2: Leadership history. He is a cybersecurity subject matter expert, a
Speaker 2: nationally recognized cybersecurity educator Josh Gelman, Welcome back to the
Speaker 2: seven Minute Leadership Podcast.
Speaker 3: It's quite the introduction, thank you.
Speaker 2: Yeah, I know here, you've got a lot to unpack
Speaker 2: with that. You ready to go. Yeah, let's do it
Speaker 2: all right. So the first item on the checklist is ownership.
Speaker 2: Every breach story starts the same way. No one owned it.
Speaker 2: It was it's problem, it was outsource, it was assumed
Speaker 2: to be handled. Leadership never asked the question who owns
Speaker 2: cybersecurity here? And if you cannot name the person responsible,
Speaker 2: including yourself, then you have a gap. Ownership doesn't mean
Speaker 2: that you're the one configuring fire walls. It means you're
Speaker 2: accountable for the outcome. Leaders own outcomes even when others
Speaker 2: own tasks.
Speaker 4: Yeah, and it's ultimately all about accountability, as you said,
Speaker 4: because anytime there's a cyber incident, you always get people
Speaker 4: pointing fingers at each other who's responsible. And sometimes it's
Speaker 4: not even just isolated to the organization itself.
Speaker 3: They'll say, oh, the.
Speaker 4: Insurance company is responsible, or a third party managed service
Speaker 4: providers responsible. So that's not something you want to be
Speaker 4: dealing with during or even after a cyber incident.
Speaker 3: You need to have it.
Speaker 4: Very clearly written, very clearly established, who is being held
Speaker 4: accountable for cybersecurity in the organization prior to anything actually
Speaker 4: ever happening.
Speaker 2: The second I them is access discipline. Who has access
Speaker 2: to what and why? Former employees, vendors, contractors, temporary staff,
Speaker 2: shared passwords, generic logins. This is where organizations bleed without
Speaker 2: realizing it. If someone leaves your organization today, how long
Speaker 2: before their access is shut off? Is it minutes, hours, days?
Speaker 2: If you don't know the answer, that's the problem. And
Speaker 2: access is like I think of it as like keys
Speaker 2: to the building. Leaders would never say, well, we think
Speaker 2: the keys are probably back. Digital keys deserve the same respect.
Speaker 4: And I think with the topic of access, there's two
Speaker 4: quick things that people should be aware of. One is
Speaker 4: least privileged, So if you have access to a system,
Speaker 4: you should only have access to that system if you
Speaker 4: need it to do your job. So everybody shouldn't be administrators.
Speaker 4: You should only have the minimum access necessary to do
Speaker 4: your job. And then the other thing is after you
Speaker 4: leave the organization, you don't necessarily want to go in
Speaker 4: there and delete or wipe out the account altogether, but
Speaker 4: you want to disable it because you still may need
Speaker 4: to get access to whatever that person was doing, especially
Speaker 4: if they didn't leave on good terms, You may need
Speaker 4: to get access to their storage. So you want to
Speaker 4: disable the account initially. You don't want to just wipe
Speaker 4: it out right away.
Speaker 2: Great point. Third item is backup reality. Everyone says they
Speaker 2: have backups. I think few have tested their backups. Backups
Speaker 2: that can't be restored are not backups. They are a
Speaker 2: false sense of security. So I think you can ask
Speaker 2: one simple question, when was the last time we restored
Speaker 2: from backup fully, successfully and under pressure? If the answer
Speaker 2: is never or no one is sure, you are gambling
Speaker 2: and hope is not a strategy, especially when ransomware does
Speaker 2: not care about your budget or your mission.
Speaker 4: The other question is always going to be how do
Speaker 4: you know it's a good backup? How do you know
Speaker 4: your back hasn't been compromised?
Speaker 3: As well?
Speaker 4: You might be restoring to a backup that's already compromised.
Speaker 4: So how far back are you taking backups? And absolutely,
Speaker 4: like you said, are you testing them? Are you trying
Speaker 4: to restore them and see if you're actually able to
Speaker 4: do it?
Speaker 3: Excellent?
Speaker 2: Fourth item is training that sticks. Most cybersecurity training is forgettable.
Speaker 2: Josh I've traveled across the country to support you and
Speaker 2: attend your trainings. They are unforgettable, which is why you're
Speaker 2: here again. But people just click through the slides, They
Speaker 2: do the annual box checking, no real retention. Your people
Speaker 2: are your biggest vulnerability and your strongest defense. Leaders must
Speaker 2: demand training that actually changes behavior, things like do your
Speaker 2: people know how phishing works? Do they know what a
Speaker 2: suspicious login looks like? They know what to do if
Speaker 2: something feels off? And more importantly, do they feel safe
Speaker 2: reporting this miss stakes quickly? Or do they hide out
Speaker 2: of fear and silence? Is how these small issues become
Speaker 2: catastrophic ones.
Speaker 4: You could do a whole podcast just on training. I
Speaker 4: think the only things I would add to that are
Speaker 4: number One, it's always good to do some level of
Speaker 4: in person training because the online stuff, some of it's good,
Speaker 4: some of it's bad, but people will always find ways
Speaker 4: to just go through the motions and not actually retain
Speaker 4: or learn anything. So in person training from a reputable
Speaker 4: trainer is always good. And then if you can incentivize
Speaker 4: it in any way, and I don't mean negative reinforcement,
Speaker 4: I don't mean like you fail so many phishing emails
Speaker 4: and you get fired, but some way to incentivize it
Speaker 4: in a positive way, to motivate people to actually want
Speaker 4: to complete the trainings and do well and the look
Speaker 4: out for themselves. I always try to put things in
Speaker 4: terms that how it's going to protect the individual and
Speaker 4: not just protect the organization, because most people don't. Frankly,
Speaker 4: if you're an employee, you don't really care so much
Speaker 4: about the organization, but you care about yourself, So how
Speaker 4: is it going to affect you?
Speaker 2: The fifth item device control What devices are touching your network?
Speaker 2: Is it personal phones, home laptops, tablets, USB drives, public
Speaker 2: Wi Fi? If you allow remote access, bring your own
Speaker 2: device or cloud tools. You need clear rules, not suggestions.
Speaker 2: You need real rules because leaders set standards. Standards protect
Speaker 2: people and systems. Ambiguity creates gaps and attackers live in gaps.
Speaker 4: And don't forget to scan your networks regularly and look
Speaker 4: for any shadow it too. Those are devices that people
Speaker 4: within your organization might add without you knowing it or
Speaker 4: without your authorization.
Speaker 2: Yeah, I forgot about that.
Speaker 3: Thanks, That's why I'm here.
Speaker 2: I know. The sixth item is vendor trust. Every organization
Speaker 2: now depends on third parties. Software platforms, billing companies, eduling tools,
Speaker 2: cloud storage. Leaders I think have to stop assuming that
Speaker 2: vendors are secure and start asking questions like how do
Speaker 2: they protect data? And what happens if they are breached?
Speaker 2: How fast do they notify you? Because right trust is
Speaker 2: earned through verification and this applies to people and technology.
Speaker 4: And there are services out there that will do third
Speaker 4: party risk management or third party risk assessments to assess
Speaker 4: your vendors. And some of the services that are out
Speaker 4: there are free. I mean, if you do a Google
Speaker 4: search for a vendor, third party risk management, third party
Speaker 4: risk assessment, you'll find different thing, different services that might
Speaker 4: be able to help with that. If you don't have
Speaker 4: a department or a person devoted to performing those tasks internally.
Speaker 2: Yeah, very cool. The seventh item on the list is
Speaker 2: incident readiness, not if. When do you have a plan
Speaker 2: for a cyber incident? Who gets called, who speaks publicly,
Speaker 2: who shuts systems down? Who makes the call to pay
Speaker 2: or not pay? And if your answer is we'll figure
Speaker 2: it out, that's not leadership. That's improvising under stress and
Speaker 2: stress exposes weak systems fast, So run the scenario now, calmly.
Speaker 2: Instead of for the first time. When everything's on fire.
Speaker 4: Yeah, do a tabletop exercise at least to identify some
Speaker 4: of the gaps. One of the questions I ask students
Speaker 4: a lot in classes is at what point, if you
Speaker 4: have cyber insurance, at what point are you going to
Speaker 4: engage with your cyber insurance provider? And they often don't
Speaker 4: have an answer to that either, so that gives you
Speaker 4: the opportunity to ask and answer some of those questions
Speaker 4: prior to an ACTRO incident.
Speaker 2: The eighth item is leader behavior, and this one's a
Speaker 2: little bit uncomfortable. Leaders who bypass controls, reuse passwords, ignore updates,
Speaker 2: or demand shortcuts teach the organization that security doesn't matter.
Speaker 2: Your behavior sets the culture. If you treat cybersecurity as
Speaker 2: annoying friction, your team will too. But if you treat
Speaker 2: it like safety, discipline and professionalism, they will follow. This
Speaker 2: is like red key leadership territory, high consequence moments, small
Speaker 2: decisions with massive downstream impact.
Speaker 4: If your leaders have poor cyber hygiene, you can't expect
Speaker 4: your employees to have anything other than for cyber hygiene.
Speaker 4: It's just like any other characteristic. If your leaders walk
Speaker 4: into your organization, with a disgruntled attitude every day, then
Speaker 4: how can you expect your employees tacked any differently?
Speaker 2: Yeah, the ninth item is continuous attention. And Gealman, you're
Speaker 2: going to be so proud of me for saying this,
Speaker 2: because I wasn't always this guy before I stumbled into
Speaker 2: all of your education. But cybersecurity is not an annual conversation.
Speaker 2: It is a standing agenda item. Leaders revisit it the
Speaker 2: same way they revisit finances, staffing, scheduling, and risk regularly, calmly,
Speaker 2: and without ask better questions over time, what changed? What
Speaker 2: new threats exist? What are we exposed to today that
Speaker 2: we were not exposed to last quarter? Because this is
Speaker 2: leadership vigilance, not paranoia.
Speaker 4: Yeah, I mean just like any other security topic. If
Speaker 4: you think of physical security, for example, you know you
Speaker 4: don't just plan once for something. You're always revisiting it,
Speaker 4: always thinking what other threats might be out there. I mean,
Speaker 4: especially in today's world with cyber and artificial intelligence, and
Speaker 4: the threats are evolving faster than we can keep up
Speaker 4: with them. So it's something that needs to be a
Speaker 4: continual discussion, not just hey, we're going to revisit this annually.
Speaker 2: Thanks for drilling that into my head over all the years.
Speaker 3: Well, it's glad to see it stuck.
Speaker 2: Yeah it did. But here's a hard truth and a
Speaker 2: hard pill to swallow. A cyber incident doesn't care if
Speaker 2: you're a nonprofit, a public safety agency, a small business,
Speaker 2: or a global company. Doesn't care about your mission, statement
Speaker 2: or your intent. It only exploits gaps, and leaders reduce
Speaker 2: gaps through clarity, ownership, standards, and follow through. Cybersecurity is
Speaker 2: not about being perfect. It's about being prepared, disciplined, and
Speaker 2: honest about where you stand.
Speaker 4: I think the last thing I would add to to
Speaker 4: that is you get a lot of organizations that say,
Speaker 4: why would anyone attack me? Why would anyone hack me?
Speaker 4: And the answer is why not. You don't have to
Speaker 4: be a multi billion dollar corporation for attackers to come
Speaker 4: after you. You just have to be an easy enough target.
Speaker 2: So leadership today is not only about people in the room.
Speaker 2: It's about systems you cannot see, risks you cannot touch,
Speaker 2: and decisions that protect others long before they ever know
Speaker 2: they were at risk. So take this checklist seriously. Lead
Speaker 2: it from the front in your organization will be stronger
Speaker 2: for it Josh Gelman, thank you once again for coming
Speaker 2: into the studio for this episode.
Speaker 3: Ah, this was fun. I appreciate you having me.
Speaker 2: This has been the seven minute Leadership podcast, and I
Speaker 2: thank you for listening.
Speaker 1: For more Paul fell of Alito podcasts, visit paulfellowalito dot com.