Speaker 1: Welcome to the deep dive. Today. We're jumping into a
Speaker 1: subject that's well, it's really moved beyond the server room.
Speaker 1: We're talking cybersecurity for business, right and it's not just
Speaker 1: about tech anymore, is it. It's really fundamental to how
Speaker 1: businesses work today, how they compete, even our national security
Speaker 1: in some ways.
Speaker 2: That's spot on. And our guide for this is a
Speaker 2: really fascinating book, Cybersecurity for Business. It pulls together insights
Speaker 2: from some real heavy hitters.
Speaker 1: Yeah, like who, Well.
Speaker 2: You've got contributions from a former head of US Cyber Command,
Speaker 2: a former Deputy Undersecretary for cybersecurity. People who've really seen
Speaker 2: this from the top down.
Speaker 1: Wow. Okay, so serious expertise.
Speaker 2: Definitely.
Speaker 1: So for you the learner, our mission here is to
Speaker 1: kind of boil this down, pull out the absolute must
Speaker 1: know insights from this comprehensive guide.
Speaker 2: Yeah, give you a shortcut basically, help you understand this
Speaker 2: complex cybersecurity world in a business context without you know,
Speaker 2: getting totally bogged down in technical details.
Speaker 1: Oka things off. The book apparently starts with a pretty
Speaker 1: powerful quote it.
Speaker 2: Does from General retired Keith Alexander. He says, very bluntly,
Speaker 2: cybersecurity is national security. The only way to effectively protect
Speaker 2: ourselves is through a collective defense model.
Speaker 1: Hmmm, collective defense. That sets a high bar. What does
Speaker 1: that mean for a typical company.
Speaker 2: It means it's not just the IT department's problem anymore.
Speaker 2: That's the core message. Really. The book stresses that protection
Speaker 2: today needs everyone involved, the whole organization.
Speaker 1: From the board down to well everyone exactly.
Speaker 2: Yeah, and they don't pull any punches. The very first
Speaker 2: chapter title is cybersecurity is not an IT issue.
Speaker 1: Okay, that's pretty direct.
Speaker 2: It signals a really big shift in thinking, doesn't it.
Speaker 1: It does. It seems like we went through a phase
Speaker 1: where people tried to teach boards of directors all the
Speaker 1: IT specifics.
Speaker 2: Yeah, and the book points out that often didn't Well,
Speaker 2: it didn't really work.
Speaker 1: Why not too technical?
Speaker 2: Exactly? Two technical? Too disconnected from what bores actually focus
Speaker 2: on the business side of things. They mentioned the whole
Speaker 2: y two K bug era as an example. It was
Speaker 2: focused on the code the fixes, but a lot of
Speaker 2: board members they struggled to see how that translated into
Speaker 2: real business risk or opportunity. The communication just wasn't there.
Speaker 1: So what changed? How do you get the board engaged now?
Speaker 2: You talk their language business language, things like innovation, growth, profitability,
Speaker 2: pe ratios, bottom line stuff. Precisely. So now it's about
Speaker 2: enabling boards to ask the right questions, business focus questions about.
Speaker 1: Cyber risk, like if we're launching a new product, what
Speaker 1: are the cyber implications exactly?
Speaker 2: Or if we're acquiring another company, what's their cybersecurity situation?
Speaker 2: Really like it has to be part of that core
Speaker 2: business discussion, not an afterthought.
Speaker 1: Makes sense? And is this linking into those broader corporate
Speaker 1: responsibility frameworks too like ESG?
Speaker 2: It is. Yeah. The book definitely highlights that embedding cybersecurity
Speaker 2: into the Environmental, Social and Governance ESG framework is becoming
Speaker 2: more important. Interesting Larry Fink at Blackrock, for instance, has
Speaker 2: been quite vocal about this, saying, you know, digital resilience
Speaker 2: is a key part of long term value, just like
Speaker 2: environmental factors.
Speaker 1: Okay, so it's a whole company issue. Let's roll down
Speaker 1: on the board of directors. Then chapter two seems to
Speaker 1: lay out their specific responsibilities.
Speaker 2: It does. Yeah, five key ideas for boards. First one
Speaker 2: is pretty fundamental. They need to actively work with the
Speaker 2: executive team. Oh so to build a culture of security
Speaker 2: and also to provide real effective oversight. It's not just
Speaker 2: signing off on budgets. It's about collaboration and informed guidance.
Speaker 1: So not passive acceptance, active engagement.
Speaker 2: Right. And the second point builds on that cybersecurity has
Speaker 2: to be integrated into all business decisions enterprise wide.
Speaker 1: No more silos, absolutely not.
Speaker 2: It can't be treated as this separate thing over in
Speaker 2: the corner.
Speaker 1: Which logically brings up the legal side. I guess boards
Speaker 1: must worry about the fallout from a breach.
Speaker 2: They certainly should. The third point is exactly that directors
Speaker 2: need a solid grasp of the legal implications, like what specifically,
Speaker 2: things like public disclosure rules if there's a breach, privacy laws,
Speaker 2: data protection regulations GDPR, or CCPA, you name it, information
Speaker 2: sharing requirements protecting critical infrastructure if that applies.
Speaker 1: That's a lot to track.
Speaker 2: It is. And interestingly, the book sites a twenty twenty
Speaker 2: survey only about what was it fourteen point eight percent
Speaker 2: of US board members fell deeply informed about these legal bits.
Speaker 1: Wow, less than fifteen percent. That's quite a gap.
Speaker 2: It really is shows there's work to be done.
Speaker 1: Okay, what's the fourth principle for boards?
Speaker 2: Insuring management sets up an effective enterprise risk management process
Speaker 2: specifically for cybersecurity ERM but with a cyber lens.
Speaker 1: A structured way to handle the risks exactly.
Speaker 2: And this isn't just a US thing. The book mentions
Speaker 2: international principles being developed based on global focus groups, so
Speaker 2: there's a worldwide push for this kind of structured oversite.
Speaker 2: And the fifth point, it comes back to culture. Boards
Speaker 2: play a crucial role in actively promoting a security aware
Speaker 2: culture throughout the entire organization. It reinforces that it's not
Speaker 2: just tech, it's people. And PWC's Global Information Security Survey
Speaker 2: apparently shows there's a growing expectation for executives to actually
Speaker 2: meet these kinds of principles.
Speaker 1: So the pressure is mounting from multiple directions. This really
Speaker 1: drives home the point about breaking down silos.
Speaker 2: It has to happen. The old way of keeping departments
Speaker 2: separate just doesn't work in today's interconnected digital world. You
Speaker 2: need collaboration.
Speaker 1: The book mentions a governance, risk and reputation triangle. What's
Speaker 1: that about?
Speaker 2: Ah? Yeah, that model. It basically highlights the need for
Speaker 2: the board, the top leadership, CEO, c suite, and top
Speaker 2: management to all be well synchronized on the same page
Speaker 2: about strategy and risk, especially cyber risk.
Speaker 1: So alignment is key.
Speaker 2: Absolutely, and cyber risks can't be this standalone item. It
Speaker 2: must be part of the overall risk management plan for
Speaker 2: the whole company.
Speaker 1: It sounds like communication breakdowns could be a major problem here.
Speaker 2: Huge problem, and the book points to a twenty twenty
Speaker 2: EY survey that found a sort of a systemic failure
Speaker 2: in communication between the cybersecurity team and other parts of
Speaker 2: the business who like marketing, hr R, and D finance.
Speaker 2: Basically everyone except it generally reported low trust in collaboration
Speaker 2: with the cyber folks. Ouch.
Speaker 1: That's not good.
Speaker 2: No, it creates massive blind spots. If marketing is launching
Speaker 2: a new campaign using customer data and they haven't talked
Speaker 2: to security about the risks, well you see the problem.
Speaker 1: Yeah, leaving the door wide open exactly.
Speaker 2: It's a major weakness. On a related note, though the
Speaker 2: book does mention a positive trend CISOs, the chief information
Speaker 2: security officers are increasingly reporting higher ups, sometimes directly to
Speaker 2: the CEO.
Speaker 1: Which signals it's importance right right.
Speaker 2: It shows cyber risk as being seen finally as a
Speaker 2: top level business concern, not just a tech issue.
Speaker 1: Okay, So if it's a business concern, how should leaders
Speaker 1: think about cyber risk? It feels like it could be overwhelming.
Speaker 2: That's a fair point. The book offers a really helpful
Speaker 2: way to frame it. Don't think of cyber risk as
Speaker 2: just a category of risk. Think of it as a quantity.
Speaker 2: A quantity, how so as a measure of potential harm,
Speaker 2: specifically in financial terms related to your business mission. What's
Speaker 2: the potential dollar impact if this system goes down or
Speaker 2: that data gets breached.
Speaker 1: Ah, putting a price tag on it. That definitely gets
Speaker 1: attention exactly.
Speaker 2: So, business leaders need basically three things. First, a way
Speaker 2: to quantify that risk financially. Second, clear options for dealing
Speaker 2: with it, remediation, risk transfer like insurance, maybe even accepting
Speaker 2: some level of risk. And third, integrating that cyber risk
Speaker 2: assessment with all the other business.
Speaker 1: Risks so you can make informed trade offs about resources. Precisely,
Speaker 1: how do you actually calculate that financial risk? Though it
Speaker 1: seems tricky, the.
Speaker 2: Modern approach, as the book lays it out, combines three things. First,
Speaker 2: is your exposure profile, basically mapping out what you have
Speaker 2: that's valuevaluable, or critical. Your annual revenue where you operate,
Speaker 2: key suppliers, what kind of data you hold? How much
Speaker 2: the value of your intellectual property? Understanding your footprint?
Speaker 1: Okay, what do we need to protect? What's next?
Speaker 2: Second, technical metrics. This is the data from your actual
Speaker 2: security tools, vulnerability scans, compliance checks, security event logs, incident reports,
Speaker 2: what your tech is telling you about your current state.
Speaker 1: Got it? Technical reality.
Speaker 2: And the third piece empirical data. And the book stresses
Speaker 2: this is the real backbone. It means looking at real
Speaker 2: world incidents. What's happening out there, what attack patterns are common,
Speaker 2: what are the actual financial damages other similar organizations have suffered.
Speaker 1: So combining your specific situation, your tech posture, and real
Speaker 1: world incident.
Speaker 2: Costs exactly that empirical data provides the financial grounding. It
Speaker 2: helps turn abstract threats into potential dollar figures, and.
Speaker 1: That financial view helps prioritize absolutely.
Speaker 2: Leaders can then focus spending and effort where it actually
Speaker 2: reduces the biggest potential financial hit. It helps make those
Speaker 2: tough resource allocation decisions much clearer.
Speaker 1: This sounds like something you'd need to do regularly, not
Speaker 1: just once.
Speaker 2: Oh definitely. The book emphasizes needing a standard, repeatable evaluation
Speaker 2: process like financial reporting, right so you can track trends
Speaker 2: over time see if your risk posture is improving or moistening.
Speaker 2: An adjust strategy, you need consistent data collection, a reliable
Speaker 2: model or algorithm integrity in the process so the results
Speaker 2: are comparable and clear reports for leadership.
Speaker 1: Let's shish gears a bit to the human side of this.
Speaker 1: Seems like people are often the weak link.
Speaker 2: Unfortunately, that's a major theme. Yeah, malicious actors know this.
Speaker 2: They're increasingly targeting the human element because frankly, it's often
Speaker 2: easier than breaking through complex technical defenses.
Speaker 1: And the book talks about different types of insider threats.
Speaker 2: Right. It distinguishes between malicious insiders people intentionally causing harm,
Speaker 2: maybe for revenge or espionage, ok eglision insiders. These are
Speaker 2: the people who make honest mistakes, click on phishing links,
Speaker 2: use week passwords, lose laptops, basically poor security hygiene.
Speaker 1: Any examples come to mind.
Speaker 2: The book mentions a couple of dark ones. A VA
Speaker 2: analyst's unencrypted laptop with stolen had data for over twenty
Speaker 2: six million veterans on it wow, and a Facebook employees'
Speaker 2: laptop theft contromised info for thousands of colleagues. Often it's
Speaker 2: negligence rather than malice, but the impact could be just
Speaker 2: as bad.
Speaker 1: And that statistic about phishing emails is just mind blowing.
Speaker 2: Over ninety percent of attacks starting with phishing. Yeah, yeah,
Speaker 2: it really hammers home how vital employee awareness training is.
Speaker 2: You can have the best tech, but one wrong click.
Speaker 1: And the whole COVID pandemic. The massive shift to remote
Speaker 1: work that must have just thrown gasoline on this fire.
Speaker 2: Oh absolutely, Suddenly you had this explosion of remote access points.
Speaker 2: The attack surface just ballooned overnight. The UN reported something
Speaker 2: like a six hundred percent increase in phishing attacks during
Speaker 2: that time. Were to scramble to update security policies for remote.
Speaker 1: Work, and HR's role became even more.
Speaker 2: Critical, hugely critical. Educating that dispersed workforce, trying to build
Speaker 2: and maintain a security conscious culture when people aren't even
Speaker 2: in the same building a massive challenge.
Speaker 1: Okay, let's dive into the technical operation side. The demands
Speaker 1: on those security teams must be immense.
Speaker 2: Now they really are. Threats are getting more sophisticated, businesses
Speaker 2: are digitizing everything. It's a constant battle. The Solar one's
Speaker 2: attack was a prime example of that complexity.
Speaker 1: Yeah, that was huge. What are the absolute basics the
Speaker 1: foundations for technical defense asset inventory?
Speaker 2: It sounds simple, but knowing exactly what hardware, software, and
Speaker 2: network addresses you have is critical. It's literally the first
Speaker 2: two controls in the CIS Top twenty framework.
Speaker 1: Can't protect what you don't know you have precisely.
Speaker 2: The book also argues for a central security operations team,
Speaker 2: ideally with some independence for efficiency and effective oversight across
Speaker 2: the board.
Speaker 1: What about industrial systems technology or OT? Is that different?
Speaker 2: It often is managed differently. Yeah. Even though OT systems,
Speaker 2: the tech controlling physical processes and factories, power grids, et cetera,
Speaker 2: are increasingly connected.
Speaker 1: To the main IT network, which sounds risky.
Speaker 2: It can be a huge gap. The book mentions breaches
Speaker 2: at Honda, nors Caedro even Target where OT vulnerabilities played
Speaker 2: a role. You really need the same security rigor applied
Speaker 2: to OT as to IT, and definitely network segmentation to
Speaker 2: isolate critical systems.
Speaker 1: So what does a strong technical prevention program look like?
Speaker 1: Layer by layer?
Speaker 2: Okay, several key parts. Network segmentation is crucial, using things
Speaker 2: like containers to wall off different areas. Then you need
Speaker 2: strong access control like bastion hosts acting as secure gateways,
Speaker 2: always with multi factor authentication FA, plus the usual network
Speaker 2: security tools, Intrusion detection and prevention systems IDSS, network access
Speaker 2: control NSC to keep unauthorized devices off, web proxies for filtering,
Speaker 2: and importantly, internal.
Speaker 1: Red teams that ethical hackers right.
Speaker 2: Testing your defenses like a real attacker would, finding weaknesses
Speaker 2: before the bad guys do.
Speaker 1: And protecting the actual computers the endpoint.
Speaker 2: Yeah, host layer prevention that includes data loss prevention DLP
Speaker 2: tools to stop sensitive data leaving and standard workstation protection,
Speaker 2: good anti virus, anti malware, full disk encryption, and crucially
Speaker 2: rigorous patch management. Keeping software up to date is non negotiable.
Speaker 1: Okay, that's prevention. What about detection? How do you spot
Speaker 1: something that gets through?
Speaker 2: Detection relies on things like those id SIP systems again,
Speaker 2: but also security information and event management SIM systems. Yeah,
Speaker 2: they pull in logs from all over the network and
Speaker 2: analyze them for suspicious patterns. FRED intelligence fees are also vital,
Speaker 2: keeping you updated on the latest attack techniques. But again
Speaker 2: the book stress is Detection isn't just tech, it's everyone's job.
Speaker 2: Training staff to spot and report phishing is a huge
Speaker 2: part of detection.
Speaker 1: Right that security is everyone's responsibility mantra. Again, it seems
Speaker 1: particularly relevant when things go wrong, which leads to incident response.
Speaker 2: Absolutely critical. You will have incidents, so having a well
Speaker 2: thought out, coordinated and regularly tested incident response plan and
Speaker 2: IRP is non negotiable. Solar winds drove that home too, and.
Speaker 1: The book says the process of building the plan is
Speaker 1: as important as the plan itself.
Speaker 2: Yeah, because it forces those conversations. Who needs to be involved,
Speaker 2: what are their roles? What defines an incident? Going through
Speaker 2: that process builds understanding and coordination before the crisis hits.
Speaker 1: What should be in that plan or the playbook?
Speaker 2: Key things include identifying all stakeholders, security, legal, the business units, communications,
Speaker 2: regulatory contacts, clear definitions of incident types, clear roles, responsibilities,
Speaker 2: and crucially, escalation paths, who calls, who win? In testing it,
Speaker 2: tabletop exercises are invaluable. Simulating an incident, walking through the
Speaker 2: plan under pressure, you find the gaps, refine the process,
Speaker 2: build muscle memory. It makes the real thing much less chaotic.
Speaker 1: Should companies connect with law enforcement or experts before hand?
Speaker 2: Definitely building relationships with the FBI DHS, external forensic firms,
Speaker 2: crisis comms experts, irrelevant regulators, SEC, FTC, industry bodies before
Speaker 2: you need them. That saves critical time during an actual incident.
Speaker 1: What about telling investors when do you have to disclose
Speaker 1: a breach?
Speaker 2: The SEC has rules about disclosing material cybersecurity risks and incidents.
Speaker 2: Understanding what crosses that materiality threshold and having a process
Speaker 2: for disclosure is a key part of the legal and
Speaker 2: commside of IR.
Speaker 1: Breach is sound expensive? What drives up the cost?
Speaker 2: Lots of things detecting and containing it, Notifying customers or
Speaker 2: regulators lost business due to downtime or reputational damage, Legal
Speaker 2: fees finds it heads up fast. Ponomont Institute and IBM
Speaker 2: do regular studies. The average breach cost is typically in.
Speaker 1: The millionsof Can anything bring that cost down?
Speaker 2: Yes? The data shows things that help include having that
Speaker 2: tested IR plan, solid business continuity plans, doing proactive red
Speaker 2: TA testing, using AI tools for faster response, and consistent
Speaker 2: employee training. Those investments pay off when an incident happens.
Speaker 1: How do you measure success in cybersecurity management?
Speaker 2: Key Performance Indicators KPIs. The book talks about using quantifiable
Speaker 2: metrics to track how well you're doing it against your security goals,
Speaker 2: whether they're strategic, financial, or operational. You need to measure
Speaker 2: to manage effectively.
Speaker 1: Okay, the incident is contained. What happens next? It's not over?
Speaker 1: Then is it not?
Speaker 2: At all? Post incident is crucial. First triage and containment confirmation,
Speaker 2: then deep forensic analysis what happened, how, what was compromised?
Speaker 2: Then securely regaining control and rebuilding systems, and perhaps the
Speaker 2: most important step the lessons learned the post mortem exactly,
Speaker 2: a thorough honest look at what went right, what went wrong,
Speaker 2: and how to improve the planet defenses. The GAO report
Speaker 2: on the Big ECHOFAX breach is cited as an example
Speaker 2: of that kind of essential analysis makes sense?
Speaker 1: Now, what about when companies merge or acquire others? MNA
Speaker 1: seems like a potential cyber suit security minefield.
Speaker 2: It really can be. You're essentially inheriting an other organization's
Speaker 2: entire risk profile. The book strongly advocates for proactive cyber
Speaker 2: assessment early in the m and a process.
Speaker 1: Not after the deal is done.
Speaker 2: Ideally know but an IBM report from twenty twenty found
Speaker 2: over half of companies were doing the cyber assessment after
Speaker 2: due diligence that's way too late.
Speaker 1: Why so early.
Speaker 2: Because it gives you leverage. You can understand the target's
Speaker 2: true cyber posture factor, potential remediation costs into the price,
Speaker 2: maybe even walk away if the risks are too high.
Speaker 2: Doing it early avoids nasty surprises later.
Speaker 1: What should you look for in that M and A
Speaker 1: due diligence?
Speaker 2: Key areas are understanding of their data, what types, how
Speaker 2: it's collected, stored, protected, your compliance status. Also assessing their
Speaker 2: technical security measures, their organizational policies and how they handle
Speaker 2: data disposal a deep dive.
Speaker 1: And then during the integration phase after the deal closes, focus.
Speaker 2: Is on closing identified security caps, prioritize or mediation based
Speaker 2: on risk, and critically getting the acquired employees trained on
Speaker 2: the parent company security policies and systems. You need a
Speaker 2: solid day one integration plan ready to go, extending your
Speaker 2: protections immediately.
Speaker 1: We've circled back to culture and process multiple times. It
Speaker 1: seems like building that strong cybersecurity culture is the ultimate goal.
Speaker 2: It really is foundational for sustainable security. A mature program
Speaker 2: isn't just about the latest tech. It's about embedding security
Speaker 2: thinking into everyday processes.
Speaker 1: And workflows and leadership access is key.
Speaker 2: Consistency OPSO access to the rest of the c suite
Speaker 2: and the board is vital, and building those relationships across functions, sales,
Speaker 2: HR or audit for our crisis, hits, mats collaboration much
Speaker 2: smoother when you need it.
Speaker 1: The book uses the Atlanta ransomware attack as an example
Speaker 1: of not having that culture.
Speaker 2: Yeah, that twenty eighteen attack was a stark reminder of
Speaker 2: the cost of neglecting basic cyber hygiene and not having
Speaker 2: that security mindset embedded. It crippled city services cost millions
Speaker 2: a very painful lesson.
Speaker 1: The book also pushes for more industry collaboration, sharing thread
Speaker 1: and FOE best practices.
Speaker 2: How do you actually build that culture day to day?
Speaker 1: It needs to be part of the whole employee life cycle,
Speaker 1: thinking about security during recruiting, making it core to onboarding,
Speaker 1: providing ongoing, engaging training.
Speaker 2: Engaging seems key. A lot of training is pretty dry.
Speaker 1: Right, and research suggests only a small fraction of companies
Speaker 1: feel their training is extremely successful, so effectiveness is an issue.
Speaker 1: The book also mentions habit formation it takes around sixty
Speaker 1: days apparently to form new habits, so reinforcement is crucial.
Speaker 2: What about those phishing tests companies sent out.
Speaker 1: They can be valuable if they're framed correctly as training exercises,
Speaker 1: learning opportunities, not gatcha moments or punitive measures used, well,
Speaker 1: they definitely raise awareness.
Speaker 2: Can you actually measure cybersecurity culture? People are trying? The
Speaker 2: NASI DASA Cybersecurity Handbook has metrics covering different aspects, and
Speaker 2: organizations like ic NECD the World of Economic Forum are
Speaker 2: working on measures looking at training effectiveness, risk management, adoption,
Speaker 2: incident rates, even employee sentiment about security. It's an evolving area.
Speaker 1: This has been incredibly comprehensive, our real deep dive into
Speaker 1: why cybersecurity is so much more than just an IT
Speaker 1: issue today. If you had to pick one core takeaway
Speaker 1: for our listeners, I think.
Speaker 2: It's that cybersecurity is a fundamental business issue, full stop.
Speaker 2: It needs a holistic, top down, bottom up approach from
Speaker 2: the board setting the tone to every single employee understanding
Speaker 2: their role. It's not optional anymore.
Speaker 1: Yeah, and the stakes are incredibly high, impacting national security,
Speaker 1: financial stability, just basic business success in this digital age exactly.
Speaker 2: It's about moving past just checking compliance boxes and building
Speaker 2: a truly proactive, risk aware, adaptive security strategy and culture.
Speaker 1: So a final thought for you, the learner to maybe
Speaker 1: all over with threats constantly changing, getting smarter, think about
Speaker 1: AI being potentially weaponized. How ready is your organization really?
Speaker 1: How deeply embedded is that could mature of security and
Speaker 1: collective defense we've been talking about, something to consider in
Speaker 1: your own context. Thanks for joining us for the steep
Speaker 1: dive