Speaker 1: We have new intel. The threat has changed, probability has changed,
the impact has changed, and we still feel good about
our previous judgment of this.
Speaker 2: Welcome listeners to the Industrial Security Podcast. My name is
Date Nelson. I'm here with Andrew Ginter, the vice president
of Industrial Security at Waterfall Security Solutions, who's going to
introduce the subject and guests of our show today. Andrew,
how are you.
Speaker 3: I'm very well, Thank you, Nate. Our guest today is
Cain mcgladry here. He is the CISO in residence at Hyperproof,
and we're going to be talking about the wide variety
of risk that's out there, from you know, mundane ROI
calculations to you know, extremes, trying to figure out how
to avoid turning a city into a smoking crater and
everything in between.
Speaker 2: Then, without further Ado, let's get to your interview.
Speaker 3: Hell Okine, and welcome to the the podcast. Before we
get started, can I ask you please to say a
few words about yourself and your background for our listeners
and about the good work that you're doing at Hyperproof.
Speaker 1: Sure. Thanks for having me on the program, Andrew, I
really appreciated. I am a thirty year veteran of the
cybersecurity industry. I've done executive advisory on three separate continents
and am a senior I Triple E member. I'm a
second time SISO and currently is the CISO and residence
at Hyperproof. I am responsible for kind of being the
face of the company at events and on stage and presentations,
but also at private executive retreats and dinners and really
trying to emphasize thought leadership. And when I say that,
I don't mean marketing product placement, I actually mean trying
to contextualize the world that we live in from illegal,
from a regulatory, from a contractual, and from a cybersecurity perspective,
so that we have an informed view of the market.
Speaker 3: Thank you for that. And our topic is your new
book about risk. You know people new to the security
field that often think risk is boring. They're more interested
in the technology of attacks. People in my experience don't
get interested in risk until they've been a manager for
a half a decade and failed to get any funding
for their projects. So you know, to me, risk is
the language of business. Can you talk about your new book?
What you know? What are you writing about? How's that going?
Speaker 1: Yeah, that's in progress. I'm currently in talks with publisher
about getting the book published. I decided to not self
published because I want to know what it would be
like to go through the whole process to understand it.
The premise of the book is that cyber risk is
a myth and that it actually does not exist. And
that's base on kind of my experience as a CISO
in that when a CISO is talking to the board
about the consequences or about the impacts of a given risk,
CISOs who have longevity in the space, who succeed in
the space, really tie it back to business impacts and consequences.
And CISOs who find themselves popping jobs every two years
and changing their spending a lot of time on LinkedIn.
I think they talk about technical vulnerabilities or they talk
about technical capabilities that don't necessarily resonate. And my position
is that these days, smart CISOs really need to be
emphasizing the risks to the business, not necessarily risks because
of a technology. And that might sound like pedantry, but
it's not because if you look at the way that
laws and regulations and contractual obligations have been changing over time,
we've seen this mental shift from well you won't be
breached to well, you might be breached, but you you know,
you have to tell us that you were breached and
then go fix it to our current state of play,
where we know you're going to be breached. You have
to be resilient and you have to maintain the obligations
that you've said or that the market has defined for
your business. And I think that having that level of
understanding really helps CISOs to better frame their conversations, to
better communicate with business leaders, and also to introduce consistency
in that process. The other thing I've been doing related
to this is I've been workshopping a talk. I've presented
it at various ISOC two I TRIPOL Computer Society and
ISOKA chapters around the country, predominantly virtual, and it's the
message really does resonate. Occasionally somebody will will say, well,
a vulnerability is a risk because a bad thing could happen,
And then I think is that they start listening to
themselves talk they start realizing, well, a bad thing could happen,
but you didn't find what the bad thing was, and
you didn't find it why anyone would care about the
bad thing and that's the problem we have in cybersecurity
often is the inability to communicate that if the bad
thing happens, what was the bad thing? And then qualitatively,
why should anybody care? From a business perspective. Now, some
people might say quantitative is great. I know some folks
on the fair board, they are very reasonable people who
have a nuanced view of quantitative versus qualitative metrics. But
I think overall we need to pivot our language because
right now I've watched boards and ciso's talk past one
another on three continents, and it's kind of tiresome. And
I'd like to see that change by fundamentally attacking the
language problem that underpins all of this misunderstanding.
Speaker 3: I have to agree that, you know, it can be
challenging to find the language of business and vulnerabilities. You know,
a vulnerability assessment that comes back and says eurot system
has twenty thousand unpatched vulnerabilities is not really useful. That
confuses things more than anything else. So you know, I
very much agree with that. The question is, though, if
we're not going to talk technical, what do we talk?
I mean, you've said tie it back to business impacts?
Do we just talk about consequences? Do we talk about
attack scenarios that could bring up about the consequences? Attack
scenarios that we sort of believe we can defeat with
a high degree of confidence, So we don't need to
spend a lot of time on versus ones that we
don't defeat with a high degree of confidence. And you're
going to have to give me a budget of ten
or twenty or fifty million dollars to solve that problem.
You know, if we're not talking about the technical vulnerabilities,
what are we talking about? Is it a tax? Is
it something else.
Speaker 1: When a CISO is talking to people, I think they
need to be a master communicator and be aware of
the audience that they're speaking to. So if CISO is
talking to other executives or their board members that they're
briefing about something, we need to be respectful and mindful
of their intellectual background. Because most of these folks have
got an MBA. And this isn't a clarion call for
every CISO out there to go get an MBA. It's
an understanding that intellectually they may not have had a
great deal of exposure to cybersecurity terminology and some of
the things that we take for granted that the assumptions
that everyone knows this stuff, whatever it might be, they
probably don't and that's not their fault, that's not their responsibility.
Our responsibility is to educate them enough so that we
can have a meaningful conversation and to bridge that communications gap.
When talking to other executives, I will say I occasionally
push for MBA programs to have more include of cybersecurity
to the college and the university I work with here,
But beyond that, it's still a fundamental understanding difference of
where folks are coming from educationally, and then when we're
talking to our technical teams, folks who did not come
up through an NBA program but may have a computer
science background or a technology background, a cybersecurity background, it's
very necessary to talk in technical terms because we can
have that conversation. But I think all CSOs at this
point should be encouraging their staff or demanding their staff
also learn the language of business and start to communicate
in the language of business. And in case that sounds abstract,
let me give you a worked example. Every business has systems,
and systems are a collection of stuff that components of
piece parts that do a thing for business that's vague.
So let's say about accounts payable and accounts receivable. Now,
accounts pay that's money going out the door. Accounts receivable
is money coming in the door. Most companies negotiate contractually.
This is important for CISOs and other folks to know
that for accounts payable, you've got about ninety days contractually
to pay a supplier or to pay somebody. But if
you look at accounts receivable by comparison, it's about two weeks,
about fourteen days. So that's money that's coming in the door.
And something that I've seen consistently happen is when your
lead red teamer comes to you or your lead Blue
teamer comes to you, whatever their title might be, and say, hey,
we found this vulnerability. Okay, cool, which system does it
affect again? And if they say accounts receivable, right, that's
that money that's coming in the door. Then we know
we've got about fourteen days to go fix it. And
it might be a higher impact vulnerability then something that
affects accounts payable, because in accounts payable, that's that ninety days,
that's three months. The worst thing that happens is your CFO,
your chief financial officer has to wait a little longer
to pay a bill. Most CFOs really don't get anxious
about having to wait a little longer with cash in
the bank to go pay somebody. And I think that
as we encourage our technology teams to frame in systems,
that's the first part of it, so we can understand, like,
which of these systems does it materially affect, and then
what's the level of impact again, if it's we can't
get any money coming in the door, which is something
we saw happened with Change Healthcare, where there was a
hospital somewhere in the middle of the country of the
United States that basically couldn't get any money for reimbursement
for medical procedures, and they consequently went out of business
because of a third party data breach. Now that data
breach affected their accounts receivable process. I think we need
to have that conversation of so, what's the material risk
here is that we can't do this anymore, we can't
do this for a little while, And then finally, what's
the risk of that are we losing money? Are we
not able to pay our bills? And then taking that
framing and extending it to other spaces. We need to
understand what is this risk and do we care about it.
When I was at a CISO at an industrial design
and manufacturing company, our number one risk on our risk
register was turning a city into an uninhabitable crater. And
it's an interesting thing for the top of your risk
register to say, well, we could just you know, remove
an entire city out of the United States, and that's
an unacceptable risk. And then we have the secondary risk
of well only part like, you know, we have mass
loss of human life. And then our third risk was,
you know, we have an individual loss of human life.
All those are obviously not great things, and we prioritize
those accordingly in the risk register. I think that most
companies don't have that as being a regular thing that
by taking a contract you could accidentally, you know, remove
a city or cause mass human casualties. Interesting thing of
working at the defense industrial base, right, But I think
a lot of companies do have things like, well, we're
going to lose intellectual property. Okay, Well, what's your risk
tolerance for that? And what's the risk associated with a
loss of your intellectual property? Does that mean your customers
won't buy your thing anymore? Does that mean you have
contractual violations? Does that mean that you're going to be
called up on Capitol Hill, which is never a good time.
I think that we need to get to that level
of granularity. So when we hear there's a vulnerability or
a cyber incident that it has occurred, we need to
be able to contextualize it very quickly. Is this a
risk that the business found to be tolerable or intolerable?
And then strategize accordingly because we can't. It's impossible. No
one has enough money or time or resources to fix
all the things, whether those are vulnerabilities, or whether those
are risks, or whether those are software patches, or there's
just not enough time in the day and there's not
enough will of the business to go do those things.
So we need to be thoughtful and always be framing
to what is the risk, what would happen if the
risk will materialize? And then did the business accept that?
And I think that last part just to emphasize that
it's something that junior security personnel frequently miss. They frequently
think we have to fix all the things. We can't
have this risk to this system because it would be
bad because shrug reasons. I guess if the business has
said this is an acceptable risk, or we're going to
take insurance to mitigate this risk. Okay, cool, that's not
our remit to say that it's good or bad. That's
just what the business chowse.
Speaker 3: So Nate Caane covered a lot of ground there. Let
me paraphrase real quick, just to sort of keep people
all on the same page. He did not use the
word credible, But I'm reminded of a recent episode with
Kenneth tittle Stuck where we talked about credible threats, credible attacks,
credible consequences. Not all consequences of cyber attacks that we
sort of on the front line looking at the nuts
and bolts of it. Not all of those consequences are credible.
Not all of them are reasonable to believe will come
after us. Theoretically possible. Yes, reasonable is a different judgment.
And even if you know we believe, we will argue
that a consequence is a credible threat given the threat environment.
Not all risks that are that pose credible threats that
are credible consequences. Not all of them are necessarily mitigated
or accepted or sorry, mitigated or transferred to insured. You know,
some of them we just accept. This is a business.
This decision has something to do with the whether the
consequence is acceptable or not. You know, is it is
it something we can live with? And you know, so
the bottom line is it's it's complicated. There's a question of,
you know, are these credible threats. There's a question of
you know, who's going to decide. That was an episode
with Tim McCrae. We on the front line should not
be deciding what risks to accept and what risks to
address and what risks to buy insurance for. That is
a business decision. And what's important here is communicating consequences
and credibility and you know, risk to the business in
words that make sense to the business, so that the
business decision makers, usually many layers up in the organization
from us frontline workers, can make an informed decision. And
sometimes we'll be surprised by that decision. You know, sometimes
we don't understand the business impacts and they do. Sometimes
the business might be in a hard place and might
have to accept certain risks so that they can spend
money addressing other even bigger risks to the business. So,
you know, communicating all this is important to the business
decision makers. The example is a scenario where in a sense,
we have a steady state, we've made decisions about what's
tolerable what's not. We have a new vulnerability. The vulnerability
that we've discovered, be it a software vulnerability or something else,
is exposing us in a way that you know, we
or at least the people reporting the vulnerability understand, is
sort of outside of our risk tolerance. It's something just broke.
We need to fix it. And you know, in a
sense to me, that's that's simple thing. If it broke
and it's outside the tolerance, well we do have to
fix it. It is a more challenging conversation, especially with
the people who control the budget. It's a more challenging
conversation when we have to talk about you know, look,
I think we've set our risk tolerance at the wrong place.
I think we need to, you know, be less tolerant
of these risks because of X, Y and Z, and
you know, often it generally has to do with a
discussion of the seriousness of the consequences. People kind of
understand what we're dealing with, unless it's a completely new
project or building and the changing threat environment or changing
expectations on a part of the government or the regulator
or whoever. In terms of addressing these consequences, when you
have to persuade people that they need to move the
needle instead of just, you know, fixing an a problem
that pomped up, How do you do that?
Speaker 1: I'd say it's at many companies it's an annual exercise.
I think at some companies it's a more frequent exercise.
And it's having a consistent risk assessment process where you know,
you can use NISTS Risk Management Framework, you can use
ISOs Risk Management Framework. Goodness knows there are other ones
in the world. But having a defined process really does help,
and having it written down really does help. And the
reason I say that is I don't like subjectivity in this,
and I don't really think there's there's a right or
a wrong gere. The only thing I could say that
could be wrong is not having a defined process that
you follow consistently. If I if I look at the
way that things are going right now across the market,
the cyberseecurity stance, the risk tolerance stance of a startup
is very different than the risk tolerance stance of an
established company is very different than the risk tolerance of
a publicly traded company, and again is very different than
the risk tolerance of a private equity backed company. All
of those have very different strategies that all tie back
to what their risk tolerance is. A startup that is
trying to make a name for themselves in the world,
trying to just ship a product and maybe make that
first million dollars probably will accept a lot of risks,
whether consciously or unconsciously. Most of it's probably unconsciously because
they haven't had the reason to write it down and
because if they just got seed funding, they probably don't
have the time. A company that's got an established reputation
by comparison, especially if they're a publicly traded company, have
both contractual and legal and regulatory requirements that they're obligated
to meet or to accept that yeah, actually we might
not meet those And again that's a conversation that has
to happen at the executive level to say this is
a tolerable risk. I have worked with clients over the
years who have said that the risk of a lawsuit
that has a seven figure or eight figure or nine
figure damages is fine. They'll just pay their way out
of it and move on and they don't really need
to go fix the risk and security professionals inevitably end
up in pearl clutching mode where they say, well, you know,
there was a known vulnerability and the company didn't fix
it and all of these terrible things happened, and somewhere
the company that had the bad thing happen made the
calculation of yep, that could happen. We're going to accept that,
we are not going to go fix that. And I
think that it's not really the rule of the CISO
to say this is right or this is wrong. It's
the role of the SISO to work with the other
business leaders, including chief counsel, the chief executive officer, the
chief risk officer, if you've got one, the internal audit committee,
the other, you know, the other standard participants, really to
figure out what is our risk tolerance, make sure that
that's okay with your board of directors, make sure that
they've had a chance to see it and comment, and
does that really gives some clear bright lines for what's
acceptable and what's unacceptable, and then to operate under those circumstances.
It gives everyone very clear guidance and it gets us
out of this this you know, futile conversation that we're
going to go fix all the problems, are going to
go fix all the things that broke, because some of
those we might be okay with, maybe not personally. But
if the business says it's fine, then it's fine. We
don't really have that say to say, well, it's not
fine unless we can make a compelling argument that says
to everyone else on the risk management committee that this
is something where we need to change our risk tolerance
and here's your compelling evidence why, and here's your compelling
reason why. Because that's going to shift strategy, and it's
going to shift resources, and it's going to shift conscientious
of those effects of trying to decide that we're going
to change this now for CISOs who I mentioned this
in the book as well as in my talk, for
CISOs who think that they want that they have a
revolving door situation with their risk management process where the
business flags the risk that I don't know. Let's let's
work a risk. Let's say that the use of AI
may lead to lawsuits totally no more than a hundred
million dollars right, the use of AI with our intellectual
property lawsuits. One hundred million dollars. Right, that's the high
level risk. Now there's a lot of different ways that
that could go occur, but that's the basic risk idea.
If that's your risk, and you still have every executive saying, yay,
it's fine, hundred million dollars or whatever, that's that's no
big deal. We're not going to worry about that. For
CISOs who want to start changing that, what I've seen
my friends who are CUSOs due to some good effect here,
is to say, look, to accept a risk, first of all,
you have to sign off on it. Not already causes
some discomfort among executives because that means they have to
acknowledge that they said that it was okay and a
piece of discoverable evidence. And then the second thing that
I've seen CISOs do to great effect is to say, cool,
when you accept a risk, you have to buy insurance
against the risk on the open market for that quarter
that says that it's going to cover the breach. It's
going to cover the breach notification, it's going to cover
the litigation, it's going to cover setting up the call center,
it's going to cover the technical remediation, it's going to
cover the external forensics firm that you have to employ
if it's not a panel approved one from your insurer. Right,
you have to pay for all of that when you
go accept a risk, and in most cases not all cases,
having folks sign and then have to buy insurance against
the risk. Materializing changes the conversation, and it doesn't do
it in an obvious way. What it does is it
affects that business leader's P and L, their profit and
loss statement if they accept a risk and then they
have to go buy insurance, and that insurance costs I
don't know, a million dollars. Let's say make the math easy.
That means they're making a million dollars less that quarter.
That's the type of thing that shows up in their
KPIs or their OKRs or however their performance is being managed.
And that's where we can start to have a conversation
of cool, so the insurance costs a million dollars, If
we'd like to talk about fixinated costs one hundred thousand dollars.
They can then do the math in their head and say,
huh so for one tenth the cost I can maritilate
this risk and only take one hundred thousand dollars hit
to my p and L as opposed to a million
dollar hit on their P and L. Pretty Much everybody's
going to say, yeah, that sounds pretty good. But if
we can't phrase it that way, if we say, well,
if you accept the risk, you're accepting the risk and shrug,
don't know, that's where we get into trouble. That's where
there's a lot of challenges that happen. And that's where
i've CISOs get hung out to dry because if no
business leader accepted the risk and the CISO has been
established as the person who somehow magically owns all of
the business risks, which I still don't understand that one,
then I think that's where CISOs have a lot of
personal and professional liability that comes up that I think
CISOs with longevity are learning and they're learning how to.
Speaker 3: Avoid so Mate, I thought that was an interesting insight
on the insurance at using the insurance, you know, kind
of bucket when you're talking about accepting risk.
Speaker 2: Why did that stand out to you? His post to
anything else though you were talking about in this interview, what.
Speaker 3: He's saying, is that if if a business decision maker,
you know, Looksie in the eye and says, how much
would it cost to fix that, you know whatever, three
million dollars, twelve million dollars and says, well, you know,
what are my options? Well, it's risk. There's the standards,
you know, three or four options. You could change that
is sign of the system so that the risk vanishes,
it doesn't exist anymore. You could mitigate the risk, you know,
put security in place to reduce you could transfer the risk,
pay an insurance company. You could accept the risk and
do nothing. How much does doing nothing cost me nothing?
You're not doing anything? Okay, I'll do that, leave all
the money in my pocket. That's you know, that's a
trap that's easy to fall into. And he's saying, no, no,
if you do the accounting internally and say we're you know,
your division that you're responsible for that should address this risk,
or that's you know, responsible for the risk. If you
do nothing, we're going to go out to an insurer.
We're going to get a quote for insurance. Whatever that
money is, we're not going to spend it. You've decided
not to spend the money. You've decided we can tolerate
this risk. Great. But what we're going to do is
we're going to do in our bookkeep We're going to
deduct that amount of insurance even though we didn't pay it.
We're just going to take that off of your earnings
this year for your division because you've incurred this risk,
and this is how big a risk the insurance company
thinks you've just incurred. And this is a way to
sort of make the risk real. Accepting the risk makes
it real for the business decision maker. Accepting the risk
also costs you, and here's a way to keep track
of that cost. Is the insight that I've never heard
anyone suggest that before. I thought, that's clever.
Speaker 2: Yeah, I see what you mean. Do you find in
your experience that folks sometimes think about risk as like
a free hit, Like, Okay, I'll accept a certain amount
of risks and then just move on in the way
that you're sort of describing there.
Speaker 3: I actually hear people looking at the problem that way
fairly regularly, but they don't phrase it that way. Nobody
talks about it that way. I see this not so
much in the high frequency, low impact area, where you
can sort of easily do an ROI calculation. I see
it in the low frequency high impact area. You know,
when we say low frequency, it's things that may never
have happened. But we look at what's you know, what
the enemy's capabilities are, and we say, you know, this
could happen if they got it in their mind, they
could do it to us. Will they get it into
the mind or not? Is it we start having, you know,
and we're talking about things that have never happened yet.
And what I hear is, you know, business decision makers
saying things like, well, how about we wait till it
happens and then we'll know how often it happens instead
of spending money on it now. And they put the
money in, you know, figuratively speaking back into their pockets,
saying we're not going to do anything about this. We're
accepting the risk. If you know, again, if we dock
from that divisions that business decision maker's numbers for the
quarter or for the year, if we dot the money
that they would have had to pay to buy insurance,
saying well, you decided not to buy insurance. That's a
legitimate business decision. You have, you know, spending authority to
make those decisions. But by accepting the risk, you have
actually accepted a liability. Here's a way to quantify that liability.
Figure out what the insurance would have been caught that
money back. That's you know, to me, that's that's a
way to take what would otherwise be a very difficult
decision of a discussion about things that have never happened,
and turn it into an ROI discussion. Well, once you say,
makes sense when you know, it's great to use insurance
premiums when we're trying to do ROI discussions with business
decision makers. As you said, you know, the math is easy,
you can do it in your head. It gets trickier
for high consequence events. Now concrete example. You know, Deep
Horizon was not a cyber event, don't get me wrong,
but it was a really big safety incident in the
oil and gas industry. And I believe that when all
was said and done, all of the remediation was done,
all the lawsuits were over, British Petroleum announced that the
whole thing had cost sixty nine billion dollars, so you know,
sixty nine times ten to the ninth and they moved
on because they were big enough. BP is big enough
that they can pay sixty nine billion dollars and not
go anywhere near out of business. The question is, you know,
there's no way, as far as I know, correct me
if I'm wrong, there's no way to buy insurance for
a sixty nine billion dollars cyber impact. And so you know,
you have no choice either you mitigate this and reduce
the risk, or you accept the risk. Is it reasonable
to accept a risk that big just because you're big
enough to do it. I mean a lot of businesses
it would put them out of business. They would probably
say it's not reasonable.
Speaker 1: You know.
Speaker 3: Is it reasonable for a really big business to accept
a risk that big just because they can? Or is
that is that just setting you up for you know,
I don't know, a shareholder lawsuit or something because the
board is making decisions that are perceived by the public
as not reasonable. Can you talk about reasonability and the
really high end of consequence.
Speaker 1: When I think about that? Other than you know, he
made me think about Tony Hayward briefly as yet another
casualty of the deep water horizon because of him putting
his foot so firmly down his mouth. I think even
Harvard has a business school class just about Tony Hayward
super fun. I think that some businesses will accept those
risks as being very large because they are capable of
accepting the consequence of that risk, or at least they
believe themselves to be. Let's take an example here, a
commercial example that I think affected about half of your listeners.
So Equifax is a company that does stuff. They they
had a data breach, and stuff that they do is
they collect everybody's information, their personal identifiable information, financial data,
and so on, and they aggregated, bundle it all up
and say, hey, this person might be okay to give
a loan to or this person should get a better
credit card than somebody else. That's kind of their business model.
They had a bit of a problem and they lost
about the data of about half of all of Americans
living at the time. It's kind of a big problem.
They got in trouble with multi state litigation as well
as with GLBA, and there was about one hundred and
fifteen dollars one hundred and fifteen million dollars in settlements
if you add it all up from the legal fees
and from the multidistrict litigation and from the various federal investigations.
One hundred and fifteen million dollars is really something that
they could just shrug off and go, yep, that's a
that's a slap on them. I think the risk that
they did not adequately calculate, and I think that this
is one of those things that many businesses do not
adequately calculate. Equafax also had to put in one billion,
that's with a B on it, one billion dollars of
additional security controls over a decade as part of a
negotiated settlement, and I think that the insurance probably could
have paid some of that one hundred and fifteen million dollars,
but that billion dollars to cyber better to put in
adequate controls, to put in adequate processes, to put in
adequate tools. Insurance is not going to cover that. And
I think that as as risk leaders, and this is
not just ciso's I think chief risk officers have to
be aware of this. We've seen many recent incidents. If
you think about the Office for Civil Rights ocr their
enforcement of HIPPA based on companies having done inadequate risk assessments,
they often will first of all implement a fine, but
then there'll be negotiated settlement that says y'all have to
do better, and you're going to spend money to do better.
And I think that needs to be part of the
calculation for those companies to say, cool, so the insurance
is going to cover part of this. But if we
have been neglecting, if we have not been putting in
place the adequate controls and evidence of those controls being
adequately operated, then that becomes an additional calculation of hey,
we could have to spend money on this stuff again.
Some companies are going to say, and that's okay. They're
going to say, that's fine, we can put it off
because you know what, for not spending that dollar today,
we can do something else with that dollar. Other companies
are going to say, well, that's that's an unacceptable risk
for us, according to our board or according to the
legal requirements that we've decided, that are material risk to
our entity, and this consequence, they'll do something about it.
Does that make sense?
Speaker 3: It does to a degree, But let me dig deeper.
The U the billion dollars on security is that greater
than the business would naturally have paid by itself to
address the risk. I mean something happened, and you know,
the business was forced to pay a billion dollars to
beef up security. Is that money they should have spent
on their own anyway, or is that somehow materially greater
than what they would have had to do on their
own had they done it up front. I don't know.
You know, it sounds like if they had to spend
a billion dollars anyway, then delaying it as long as possible,
you know, is something that a spreadsheet would say is
a good idea. But if something, you know, if one
hundred million dollar upgrade turned into a billion dollar upgrade
because the government got involved and said, no, no, you
have to do way more than you would otherwise, you know,
can you talk about the difference there?
Speaker 1: Well? I think the part of that difference is just
the time spent reporting back that you're doing the thing
that you've negotiated as part of your legal segment that
you have to go do, right, That's part of the
cost calculation that's in that billion dollars or in similar settlements.
There's just a reporting obligation there that nobody gets excited about,
and it's a report to your regulator or to whoever
you've got the negotiated settlement with, none of which is
fun and a lot of which tends to be a
negative influence on morale, But it becomes a necessary obligation
that falls through not having done the adequate risk treatment
in the view of whoever you got in trouble with,
whether that was HIPPA or whether that was GLBA, or
whether it was the FDC, you name it right, depending
on who you've ultimately ended up having to settle with,
and that might sometimes be multiple parties. If you've got
multi district litigation going on again, it's going to drive
spending that has to happen. I think ultimately it's a
question of two things. First of all, was the SISO
able to make the compelling business argument and collaborate with
the other executives and business leaders that that was money
that they should have been spending right, and then writing
those decisions down is part of the risk assessment plan
that the CISO and the Chief Risk Officer proposed that
we spend this money on these controls, and after thorough discussion,
we decided we're going to accept the risk and not
implement those controls. And here are the signatories of everybody
who made that decision right, and that's what you look
for as a gold standard. And I say that because
it reduces the risk of blowback on everyone involved. The
CISO did a reasonable job of trying to present a case.
The chief risk officer in that example, perhaps counsel as
well made a reasonable attempt. The business chose to not
do something that's okay. What's not okay is not having
that written down, And what's not okay is not having
a collaborative process by which a business reaches that decision.
Speaker 3: Can I ask you a sort of a related question
we talked about the physical scenario. I mean, industrial security
is often about preventing physical consequences, not just financial consequences.
The physical scenario, you know, defense industrial base. You're doing
a project, you're inventing something new that, if it goes wrong,
would turn a large city into a crater. That's clearly
from pretty much everyone's perspective, and unacceptable consequence. But if
that consequence could be brought about by a cyber attack,
the question becomes how thoroughly should we protect that system?
I mean, the answer is really really thoroughly. The real
answer is what does that mean? Given that experts in
the field disagree as to what constitutes a credible cyber threat.
You know, for any cyber defensive posture, you can imagine
an attack that defeats it. Now your imagination might you know,
might have to stretch. The more thoroughly you defend something,
the more you got to wretch that imagination. But at
some point you have to decide, you know, this bizarre
thing I've just imagined is probably never going to happen.
It's just not reasonable to spend the extra ten twenty
fifty billion dollars to protect against that bizarre thing. At
some point you've got to draw the line and say
this is a credible threat. The rest of it is not.
When you have serious consequences, given that experts disagree about
what is credible, you know, how do you draw that line?
Do you do you use analog protections exclusively and say,
just wipe out the cyber threat entirely, or you know,
can you stay with cyber and accept certain risks because
it's not reasonable to believe they will ever come at you?
How do you deal with that? Again? In part just
period and when experts disagree as to what's credible.
Speaker 1: Something that I've learned from having hired folks out of
Fort Meade from the intelligence services in the United States
all wonderful people. Is if you get three intelligence analysts
in a room and if they're talking about something, if
they all agree, they know they need to redo it.
And I think that's something that we need to have
in cyber is that skepticism of our own analysis and
that we shouldn't all necessarily agree, but we should have
a defined process by which we make a determination. And
this is in the intelligence community. It's called the intelligence cycle,
where we can ingest facts. And in cybersecurity you'll hear
that SOULD is cyber intelligence. No it's not. It's not intelligence,
it's a product. You're buying some facts about what threat
actors might be doing. You need to contextualize that using
the intelligence cycle to figure out is this applicable to us?
And then how applicable is it to us? And then
what are we going to do about that based on
that information. So to your example of turning a city
into a crater, something that we've often seen in cyber
lately and in ot and is attacks on water systems,
whether it's oldsmar Florida, which turned out to be an
old goal, an own goal, or that thing that happened
up in New York where somebody from Russia allegedly got
in and was able to move a dial one way
or the other. I think that the question becomes, what's
the realistic threat here? What is the thread intelligence saying?
And uniformly, if we go out and troll what's going on,
it's prepositioning there's not some adversary out there right now
who's saying cool, we're going to pop shells and start
popping off dams and just releasing chemicals into the water supply,
and we're going to start releasing all this floodwater into
these rivers or these municipal systems. Now, what they're trying
to do is just establish a foothold. That's what most
of the threat intelligence would tell us today about what
adversarial nation states are doing. And if you go look
at like the commercial threat intelligence about what the the
non espionage, non state based actors are doing. Your criminal gangs,
none of them aren't getting excited about ransom wearing a
dam and saying cool, nobody can have water anymore. Because
I think at some point you breach a level of
norms where you're going to get a more comprehensive response
from a government entity than we typically would associate with
cyber which would be like we'll sanction you. I think
if somebody were to shut off the water supply for
a major city, they'd probably have agents in country at
their various residences and businesses having a very stern talking
to with them, to put it mildly, and I think
that as leaders who are evaluating these risks, if we're
not looking at threat intelligence, if we're working at any
level of mature organization and we're not looking at facts
of what's going on in the world that are being
packaged up and then applying our own intelligence cycle to us,
I think that can lead to overreacting or underreacting if
you don't know what's going on. Like, think of it
this way. If you go out of your house. Now,
I'm not a person who I live in the Pacific Northwest,
so for me, taking an umbrella out isn't something that
we do here. So me, I look out the door
and I go, huh, it might not be raining right now.
I'm not going to take an umbrella. But I've traveled
in other parts of the world where umbrellas are very normal.
If you don't check the weather. If you're a person
who likes having an umbrella and you don't check the weather,
and you go out of the house and you're like, darn,
I don't have an umbrella and I wanted to have
one with me, it's pretty much the same process of
if you don't check cyber threat intelligence, you don't know
what the adversaries are up to on a given duration
of time they seem to have I don't know if
it's agile that they're following at this point or if
it's still on a quarterly sprint basis for targeting. But
if you aren't aware of what they're doing and then
later something bad happens, the perverbial it rains. You're gonna say, well, geez,
I wish I knew that was. And that's what we
get out of cyber threat intelligence is that perspective of
here's what's being seen at the telemetry level, here's how
we can apply that to our own organizations, and if
we learn something from that, then that's an opportunity to
use our risk assessment process and say we have new intel.
The threat has changed, the probability has changed, the impact
has changed, whatever it might be and then rerun the
exercise and say, do we still feel good about our
previous judgment of this, which could have been like, hey
we'll buy insurance, or hey we'll apply some controls, or hey,
that's an acceptable risk. But again we have to take
that and follow our process. We can't just make a
unilateral decision unless it's something where it's such a self
evident thing like hey, the city will turn into a crater.
That's one where you don't usually have to run the
whole process. You say, yeah, let's let's put it in
places defense and depth in order to emulate that problem
from materializing.
Speaker 3: So Nate I asked about that really high consequence event,
you know, turning a city into a crater with a
military industrial based development, and you know, he talked about
threat intel for a while, but he came back to
the creator example, and what I heard him say was, look,
when it's that consequential, ninety nine times out of one hundred,
you have to do something. You've got to put some
defense in depth in And this is what I see
in the industrial space. When you've got really serious physical consequences,
you have to do something. And you know, for lesser consequences,
what I heard him say was, you have to have
a process, and this makes sense. You have to have
a process. Use the process, use it consistently, document the results,
have the you know, the decision makers sign off on
the results. This might, you know, I'm guessing, might tend
to make the decision makers just a little bit more
cautious because it's their name going on the decision. But
you know, they make these decisions. This is this is
their business, this is their living. They make business decisions
for a living. But you know, it makes sense to
have a process and document the results.
Speaker 2: Although he was putting a lot of emphasis there on
beyond that, just keeping up with cyber threat intel. I
like to hear that. It's how I get my checks paid.
Sometimes I do wonder whether everybody needs to know about
the latest because defenses sometimes stay pretty sturdy. But in general,
keeping up to date important for most absolutely.
Speaker 3: You know, I read the publications. I read what the
government agencies produce in terms of threat intel. You know,
Waterfall puts together an annual threat report talking about the
threat environment. You have to keep up with what the
bad guys are capable of, and you have to keep
up with your best estimate of you know what today's
motivations are. You know, you've heard me say many times
experts disagree. We've talked about some of that in this episode.
Very often the big thing they disagree about is the adversary,
the capabilities of the adversary, the the motivations of the adversary.
They disagree about the meaning of the threat intel. So
but you know, without the raw data there, without the
threat intel, you've got nothing to argue about. So, yeah,
it is important, and as far as I know, everybody
follows it, lots of food for thought there. I will
be thinking about, you know what you said in this
episode before I let you go. You know, I'm also
an author. You're you're an author, You're working on your
latest book, you're negotiating with a publisher. How's that going?
Is there? You know, is there any advice you'd like
to give to other would be authors in the audience?
Speaker 1: Yeah? So I think that the two things that really
come to mind, possibly a third. First of all, go
get an overview of how to get a book published.
Go find an overview. Don't just ask an AI, hey
how do I get a book published? But actually go
figure out, like what is the overall process. And I
say that because when I launched in, I opened up
Notepad and I started writing, and I mean Notepad dot
Ex on Windows, because I really can't handle the red
squiggly underline that tells me that I made a typo.
I just figured, you know why, I'll get the words
out and then we'll deal with it. It turns out
that is not a great strategy for doing any kind
of large scale content like book length stuff. And the
second thing I'd say is choose a tool that's going
to meet your needs, but don't over rotate on that tool.
And the interesting thing on that is that in looking
at the book publishing market, there are a lot of
tools available. Now I'm just using bog standard Microsoft Word
because I am secretly boring, and also because it does
references quite well. It turns out I hadn't known that
when I started. But there are a lot of other
tools out there that you can spend money on and
that will help you write a book and that help
with formatting stuff. Here's the trick to it. All of
those would like to charge you money, and none of
them would like to guarantee that you're actually going to
get a book out of the end, and I think
that that's one of the things that we often see
in cybersecurity, where there are a lot of folks kind
of like the Alaskan gold Rush, the folks who were
making money were the people selling the pickaxes and shovels.
In cybersecurity, there are a lot of vendors that are
selling security solutions and not guaranteeing outcomes. And in the
book publishing world, pretty much the same thing. There are
a lot of different things you could use to write
your book. Pick one, work with it, and hope that
it's cost effective, because they're not guarantee that at any
time you'll ever actually get a book published. Rather, they're
just guaranteeing they're selling you a tool that you could
use to write some words down in a consistent format.
And again, don't don't use notepad because it was one
of my lessons learned. Well.
Speaker 3: Thank you Kane for joining us. This is certainly, as
I said, something I'm going to be thinking about before
I let you go. Can you sum up for us
what should we take away from this episode?
Speaker 1: I'd say there's two things really. The first is that
cyber risk is a myth, and that CISOs and other
senior security leaders really need to tie their security initiatives
to business risks and also business enablement, so that we're
actually helping the business to function in spite of being
in a elevated risk or threat environment. I think that's
the first thing, and then the other thing is we
need to stop doing security for security's sake. Like I
mentioned with the Alaskan gold Russian analogy, the folks who
are making money in here, those tools vendors, they're not
guaranteeing outcomes. We need to make sure that those tools
that we're selecting, those controls that we're selecting tie back
to either business enablement or to business risk. And if
you'd like to learn more about this, or alternatively, if
you have insomnia, please follow me on LinkedIn. I am
Kane mcglattery. Thanks Mom and dad for the unique name.
There is exactly one Kane gladtery on LinkedIn. And if
you'd like to find out what I'm doing at hyperproof
for intelligent risk and compliance management, check us out at
hyperproof dot io. And finally, I want to thank the
i Tripoli, the Institute of Electrical and Electronics Engineers for
this is the fantastic work that they're doing for creating
a lot of thoughtful standards around cyber risk management and
how to best address some of these new emerging risks.
Speaker 2: Andrew, that just concludes your interview with Cain. We have
talked a lot on the show about risk. Is is
there anything new for you to say about it to
close out our episode today?
Speaker 3: Absolutely. I mean, one thing I got from Cain here is,
you know, he's writing a book on risk, saying we
should all stop talking about risk. And I'm reminded that now.
I can't remember if it was Doug Lease or Tim
McCrae on an earlier episode, but you know they said, look,
most people talk about risk and they don't even know
what it is. What's the definition of risk. It's the
effect of uncertainty on the mission of the business or
of the organization in this case of business. And what
I hear Cain saying is, you know he's talking about
don't use the word risk one hundred times in a
twenty minute presentation. Talk about the mission of the business,
talk about the uncertainties that business faces, talk about the
effect of uncertainty on the business. That is going to
get you farther with business decision makers. So that makes
a lot of sense to me. Sort of, that's in
the abstract, in the concrete. I especially liked the idea
about getting a quote for insurance, using insurance as a
way to quantify risk, because everybody struggles with low frequency Okay,
it never happened before, or happened once before, once in
the world eight years ago, low frequency high impact events
you know, hole in the ground or or you know,
mass casualty event, low frequency high impact events. Nobody knows.
Everyone argues over these things. Here's a way to turn
that argument into an ROI calculation. Get a quote for insurance.
See how big that quote is. Take that number off
of your earnings for the the You know, even if
it's just a paper calculation, you know your bonus is
less by that much because what you would have paid
for in insurance, even if you're if the company is
big enough to self ensure, you should still be accounting
for the premium, the policy premium that an insurer would
have charged you, because you know, that's sort of a
liability the company is building up. It will bite them eventually,
and this is a way to account for that. And
that sort of makes uh that's a way to do
ROI in this very difficult space of low frequency, high
impact events. So I like that inside. I'm going to
use that in the future.
Speaker 2: Well, thank you to Cain for sharing that with us.
And Andrews always thank you for speaking.
Speaker 3: It's always a pleasure.
Speaker 1: Thank you.
Speaker 2: This has been the Industrial Security podcast from Waterfall. Thanks
to everyone out there listening.