How Do You Convince the Board to Fund Security?

Max Clark: [00:00] You know, the, the Mediar television, you know, movies has definitely created like this, this, this like lore and like presentation of, you know, what a hacker is and what security is and like, you know, and like there’s like this perception of like, you know, Mr. Robot, of course, it’s probably the latest one that really like, drove this home.

And that’s pretty disconnected from reality of like, you know, how people actually are, whether they’re on the, you know, like if you’re on the side for good, let’s say a blue team or red team, or if you’re actually, you know, doing nefarious stuff like this is a, a real job, a real profession. It’s not like people in a dungeon anymore.

Alejandro Ziegenhirt: Yeah, definitely true. So the day to day is, is more akin to receiving alerts, investigating them going through. Logs and writing rules in various tool sets to either stop that activity from happening again or improving your alerting. So it’s definitely not just four people on the same keyboard stopping IP address in the five hundreds, things like this.[01:00]

Max Clark: I, I mean, surely the job is way more glamorous and like reviewing logs all day long and like, just like staring at a computer screen.

Alejandro Ziegenhirt: Yeah, of course. You know, we’re basically taking a look at all the alerts, right? So protecting the cloud environment, protecting the software that’s going through the pipeline, you know, making sure that people don’t get phished if they do get phished, we respond to that.

I think probably the most entertaining part of the job is of course, incident response, where you’ll get the most sort of TV-like scenario going.

Max Clark: Okay.

Alejandro Ziegenhirt: Um, so, you know, an event comes in, it turns into an incident, there’s a response. Uh, you have to get everyone all hands on deck. You get to the bottom of the issue, you stop the bleeding.

So on that side of the house, the incident response side, I would definitely say it’s pretty close to the, the movies, but especially as a enterprise practitioner for just one corporation and you’re protecting [02:00] just their data. It’s not, if you’re doing your job correctly, you’re not having an incident very often, hopefully,

Max Clark: right?

Alejandro Ziegenhirt: Yeah. You’re having many security events, but not every event turns into an incident. But I’ll be honest with you, the day-to-day, the proactive piece, a lot of going through logs, a lot of gathering requirements, a lot of writing your rule sets, tuning and testing, that’s, that’s more of what Blue Team security looks like.

It’s,

Max Clark: oh boy. I mean, I’ve got like already like want to ask you like 30 questions. So I’m gonna try to actually make this make sense and be cohesive. Yeah. There is a. I find security, especially from the enterprise side, it always feels a little disjointed from the organization. And, you know, I talk about this with a lot of people and, and a lot of it I think just comes from like, perceptions and, and expectations and, you know, um, I won’t, I won’t offer like specific, you know, like ideas just yet what my, my [03:00] perception is.

But y you know, it, it really does feel like for a lot of enterprises, they mature into a point where they decide, okay, we need to have a, a security team inhouse. We’re gonna bring SecOps in house, which is my, i, I hate that term more than anything else. Planet or Secas. Secas is number one. SecOps is probably number two now.

So they bring it in-house, but then there becomes this kind of like this friction. ’cause now you have a security team whose job is to protect the, you know, the enterprise, but the enterprise doesn’t necessarily always listen to the security team, what the security team does. And so you’re kind of always like, you know, trying to negotiate of like, you want me to do my job, but at the same time you don’t want me to do my job.

And I feel like that soft skill becomes, you know, like that, that becomes a lot of the job, right? Like how you Yeah. How do you deal with this?

Alejandro Ziegenhirt: Yeah. What you just mentioned there is, is the, the most important part about being an InfoSec leader. You are not the product. Generally, if you’re working on an MSSP, then luckily you’re blessed and you are the product and everyone listens to you.

But [04:00] for example, a lot of my career has been spent in the software delivery space, like software as a service, and I’m not the product, right? So that triage and negotiation skills between leadership and then the, the management teams, that’s key, right? And it’s all about. We start with what we have to lose, right?

Are we regulated? If we lose this data, what happens to the company? Right? With that sort of risk profile, I am able to go back to the C-level and the board and tell them, Hey, this is why this matters. Because if we were to lose X data because we’re launching X feature too fast, without the right due diligence, this could cost us this X dollars in, in sort of that risk profile, right?

And I’m dealing a lot, I’m dealing with a lot of explaining risk in dollars to C level and [05:00] you know, executive management. And with that, I’m able to gain buy-in for fixing things, right? And we set up SLAs and we make sure everyone agrees to them. And if there’s something absolutely critical that could be devastating for us, it’s fixed right away.

And if it’s. You know, something less severe but still needs to be fixed. You get a different SLA, and we’re sort of doing this constant juggling between SEC and the business mm-hmm. To make everything more secure over time. And then as we can, we start shifting security left, right. Very popular term, but simplified.

I’m just not letting them check in that code. Right. In in the terms of software delivery security. Right. They just don’t get to check it in. Right. I have a piece of software that’s running a suite of testing and if they attempt to check in something that’s insecure, has a known vulnerability, just won’t let them do that.

[06:00] Right. And with that buy-in, you save so much tech debt in the future. So these are the two strategies.

Max Clark: So I mean, when you say shifting left, you’re talking about using, you know, DS and asked as a strategy. You know, and, and in incorporating that into your ci slash cd pipeline, so now you’ve got something else that’s also running and saying, Hey, this doesn’t look so good.

Like,

Alejandro Ziegenhirt: yeah. And this will help you against, of course, attack signatures, profiles and vulnerabilities, right? For a zero day, this is what you have the incident response program for a threat, intel threat research, red teaming. But SAST will get you really nice chunk of the way through, right? Your, your engineers are just not checking in egregious code any longer.

They just can’t do it. So that’s, that’s a nice feature.

Max Clark: Quantifying risk and, and talking about it in terms of, I think a big problem that a lot of people have with security comes down to money and then also perceived headache, right? Like, it’s gonna be harder for us to do certain things. We’ve cre we’ve created this [07:00] barrier for our employees to work.

Or like, I don’t want, you know, like, like MFA is a drag. I don’t want to have to pull out my thing and plug into the computer and then do something to authenticate what, as you’re, as you’re working through and trying to actually quantify risk and explain it, you say, okay. You know, there isn’t like a a, an exact like dollar quantification that comes out of this.

You can’t say, Hey, you know, we’ve got a, uh, A-C-V-S-S score of like six on this thing, and so therefore, like, or we’re trying to adhere to NIST whatever CSF, and we’re, we’re, you know, we, we’ve only at 60% compliance, so therefore we’ve got a, you know, x dollar overhang on us. Like, how do you, how do you actually take that and go from, you know, we’re, we’re, we have big gaps here in our program and, you know, and, and adherence into this is what this actually risk means and what we think this means in terms of, you know, exposure and, and then bringing that into, we need program dollars, we need budget dollars, or we need to slow a, a rollout down.

Like, like that’s, ’cause that’s like, that’s the competing thing that you’re, [08:00] you’re pushing out against.

Alejandro Ziegenhirt: Yeah. Well, you’ll have to help me unpack the question. It’s, uh, okay. That was a very long question. We phrasing it again.

Max Clark: Um, you know, okay. Depending on the enterprise. Um. Okay, let’s just, let’s just stick with like a, we’ll use like a SaaS company.

A software company as the model, right? Yeah. So in this case, there’s a CTO that’s a leader. Maybe there’s a CPO, but usually like the C-T-O-C-P-O roles are kind of like quasi together, right? And, and the CTO has to deliver product and innovation for the business. That is the product like to, to go up the stack.

And then as you’re looking that environment and you’re talking about like, uh, is our cloud platform secure? Are we running, you know, proper secrets manager, you know, on the thing, do we need to rotate keys? You know, whatever the actual thing is. That all impacts engineering time, right? Like you have to take resources off of doing something to go address this other thing.

And so now you’ve got, we want to implement something which probably costs money, right? We need, we [09:00] want, we want to implement something, but we also need the time with the engineering to then actually get this implemented, which means you have to spend money and you also have to use time. Which, so, so now you have two resources you have to reallocate.

And in order to do that, you have to, uh, you know, create this story of like, this is why this is important. Right? Yeah. You know? And how, how, because it, I’ve never found this really like directly correlate, like, so how do you, how do you like paint that picture for an executive who then has to either, you have to sell it to the executive, you have to sell it to the CTO in this case, and they have to sell it to the rest of the C-suite, or they have to sell it to the board, right?

’cause we’re realigning, you know, resource allocation.

Alejandro Ziegenhirt: Yeah. The, the way that I’ve seen it, uh, the way that I’ve executed it is you take a look at how much the breaches, you just need to look in the last six months to see the dollar amount breaches that these companies are suffering the loss in, in reputation, customer confidence, et cetera.

It really arms me with the ammunition to be able to go [10:00] back. And explain that to the executives. An example, I worked at a place where it was a trusted marketplace. Mm-hmm. Their entire business model was based off of this is a safe, trusted place to conduct business. And so explaining to the C-level and the board that we do not want to be in the news for losing their data through an egregious, uh, security incident.

Right. This would tarnish the trust that our customers have in using our product, which will lead to then not using the product. Mm-hmm. Which is the most important metric at a software as a service company. Right. The ability to paint that sort of story to to pin back security incidents into lost customer trust and reputation is the.

Is the most important way to drive security, specifically at a SaaS company For sure. When you’re [11:00] regulated, this becomes much easier, I feel.

Mm-hmm.

I’ve not had the pleasure of working at a extremely regulated industry just yet. My whole career has been e-comm and SaaS, so I think it’s much harder in this space, but that’s generally how I would do it, is to tie it back to brand reputation and trust.

Max Clark: Okay. So I see this a lot with supply chain, right? You talk about regulated. So regulated could be, um, you know, uh, government, state, federal or state entity, some, some sort of something that said you have to do X, Y, and Z. And even in those frameworks, uh, they’re not as explicit as you would think. It’s not like saying that you must have an EDR, right?

Like it talks about how you have to protect your data more than anything else. Yeah. Some, some supply chains, you know, and, and in B2B you have, you could have pressure from a, a customer saying. What’s your EDR? What’s your sat, what’s your, this, what’s your that like, and, and you know, are you ISO 27,001? Are you SOC two, type two?

You know, and like doing this kind of exploration with you, but in the consumer market, like you don’t get that kind of evaluation. You just really get [12:00] like, you had a breach, it was in the news. I don’t trust you anymore. I’m not gonna use your platform. Like we’re out. Right? Like, so it’s hard to, it’s, it becomes really hard and tricky to scale and say, Hey, we need to go out and spend a million dollars on this thing because if we don’t, we increase our risk of this happening to us.

But you know, even within that, you’re gonna get some pushback that says, well how does spending this million dollars guarantee that we’re not gonna have this breach and have this exposure?

Alejandro Ziegenhirt: Yeah, man, that’s a really tough question, man. We’re gonna have to do some thought on that one and then you’re gonna have to ask that one again, right?

We’ll, we’ll come back to it. That’s the eternal question. We can only bring in so much security and tune it. The attacker given infinite time, infinite resources, and this is just between me and you Max. Like they will find a way to. Get through, right? So how do we answer these que this question for your, for your viewers, right?

It’s like we’re, we’re setting up the defense as best as we can, but that’s not really a great answer. [13:00] So I’m happy to think through that with you.

Max Clark: I’ll give you some other prompts here. Yeah,

Alejandro Ziegenhirt: because that one’s, that one’s insanely hard, right? So yes, I had a $10 million budget at this place and I brought in every piece of tech in the world, and we have it all instrumented and we’ve got the sock and we have it all going.

But yes, you can still be breached 100%. Um. And so that, that’s tough.

Max Clark: I have, okay, so I have this fundamental thing here that I’ve been, I’ve been churning on for years now. And, and I think it, a lot of it stems back into how it is traditionally bought, where, you know, we got into this position decades ago where people talk about TCO and ROI, and it’s like really this, trying to create a business metric around a software tech purchase.

We’re gonna, you know, buy a new server and so that server is gonna process our, our data this much faster. So therefore spending, you know, a hundred thousand dollars on this server means that over the course of three years, we’re gonna process more transactions. And so our return [14:00] on investment becomes wide.

And I feel like almost everything in it gets shoehorned into this idea around like, well, what’s the RI like, what happens if we get a faster internet connection? Like, what, what do we do? You know, if we get an SD WAN deployment, like what’s, what’s the return on our investment in this technology marketing?

You know, you spend, you spend $10 in a marketing, what do you get out of it? Sales, you spend, you know, hire some sales people, what do you get out of it? Right. And it got forced into this conformity, and I feel like security has been pushed into this position as well, but it’s like, it’s not, or we, we need an EDR because we have to have this.

It’s like, but what’s the ROI on having an EDR at this point of saying, you know, for, you know, we’re gonna spend $6 a seat on our EDR times 5,000 people. You know, like what’s our, you know, like if I find that to be the hardest conversation to have Yeah. If you’re dealing with that, you know, mentality around buying this stuff.

Alejandro Ziegenhirt: Yeah. So I deal with that in two ways. So the, the first way [15:00] is back to what we talked about earlier, that risk loss of CU customer trust brand, et cetera, and equating that back into the loss of a user, right? Mm-hmm. Let’s say we receive a breach and it’s, you know, egregious and we lose 10% of our users.

Right, which I think is completely reasonable. The dollar per, per user metric is something closely kept, usually by business analytics. And then you’re able to translate that into a dollar amount, a real dollar amount, saying if we suffer this breach because we did not have X tool and we lose 10% Dow, which is daily active users, we would suffer this many, sometimes very often, millions of dollars a month.

Right? And you sort of compare that back to the cost of the tool and maybe even a professional to manage the tool for you tool. [16:00] And these things are often extremely discounted, right? So that’s the argument that I would take there. And then, uh, the other one is some industries and, and some information types are much easier to quantify back into a dollar amount if you lose a credit card number.

I believe the current rate right now is $20 in entry. Right. So you, it could be even more now, I’d have to check on this, but it’s a known dollar amount fine per entry. And then let’s say you lose a million records now, you know, a $20 million fine on your hands for losing this data. Right? So, you know, quantifying that, num those numbers back to the business.

Especially if, if your business is holding data, right, then the need to explain the importance of protecting that data to the C and the board is, is paramount.

Max Clark: You talk about like a targeted, focused attacker versus, but I mean, the reality of that is, [17:00] that’s not, like, that’s not the norm in, in, you know, that we’re dealing with, you know?

Okay. If, if you’re running, if you’re a bank, maybe, I mean, you, you, like, you have a different perception of target against you, but this expectation of like, oh, we don’t have anything that’s valuable, so nobody’s gonna try to hack us. It’s not like the real world, right? I mean, it’s a little different what’s happening?

Alejandro Ziegenhirt: There’s generally not even a person behind the attack at all. Most of these campaigns are just set and they start attacking extremely broad swaths of IP addresses industries. Any computer on the receiving end is just going to become a target. They’ll perform their suite of attacks against that system and sometimes they get an alert, Hey, uh, our script worked on this one, and that would trigger maybe a deeper dive by the actor.

But yeah, I would say with the banks, they are for sure receiving targeted, mm-hmm. Nation [18:00] state sort style attacks at a constant level. And at the start of my career, this was the whole career, was protecting financial institutions from targeted attack. And it’s something in, it’s all day. It’s just all day every day.

Because the value there for the theft being successful is quite obvious, right?

Max Clark: People have been robbing banks since the beginning of banks, right? So like, banks just probably relate to this a little differently. It’s like, yeah, you know, like, tell somebody’s gonna try to rob us. Let’s protect ourselves, right?

Yeah.

Alejandro Ziegenhirt: But when you’re more of like a e-commerce or a SaaS, et cetera, generally you’re just being caught in a web. And if your controls are not up to snuff, then you become a highlighted target, right? So they have their scripts probing the internet and, oh, I picked something up here. This is not protected.

Or it looks like my, uh, exploit worked. I have [19:00] access, I have a foothold into X environment. And, and this is how eventually the breach grows and grows.

Max Clark: Verizon publishes the DBIR every year. It’s a fascinating read. It’s a thick document. A few years ago, dwell time was, you know, pushing a year. It was 200 and something days and, and counting up, which you read that number and it’s terrifying.

You’re like, okay, somebody’s in a network for almost a year before they’re detected. That’s scary. Now, dwell time is really short. We see dwell times, you know, like breach to events like almost instantly, which I’m actually not sure, which is more terrifying to me at this point of, you know, a long dwell time or a short dwell time.

But the dynamic of that has changed a lot with the profile as well as to what’s happening with this. And, and I’m curious, I think that shifts a little bit of what the expectation from a security team is of trying to like, respond to a little bit too, right? Like, like how, I mean as how do you think about your job differently and what you’re trying to actually like do, I guess day to day, right?[20:00]

Alejandro Ziegenhirt: Yeah. Uh, automation just becomes much more important, right? The time that you have to respond to the event or incident is, as you’re saying, shorter, becoming shorter and shorter, and so preventing the foothold right away becomes paramount. Mm-hmm. So it, it’s no longer in the past where I received an alert, I send the alert to one of my analysts.

They do a deep dive, they take a look, takes them a couple business days. If the attack comes in on a Saturday, they get to it on a Monday. Mm-hmm. You know, this sort of security environment, it’s not the one we’re living in today. The eternal goal of this, of the security program now is malicious activity comes in, malicious activity is stopped, and then an alert is brought to the analyst and then the analyst will see what happened.

But that is now the goal, [21:00] right? And get, getting your security program to such a, a place requires lots of investment, energy, time, and resource. For sure.

Max Clark: Well, and you’ve got an acronym soup, right? And then, you know, there’s different frameworks and it’s like, what’s your security maturation model? Like, where are you in maturity?

How do you even define maturity? And then, and then you start throwing all these acronyms at it and, and trying to explain and say, you know, an EDR is foundationally important to us, but then in addition to that EDR, we also need a SIM tool. And we also want to have some sort of threat intelligence because now you start talking about automation and like, how fast can you respond to events?

And, and I kind of feel like, um, like watching in the enterprise, it’s like some of these things are slowly being pulled forward where it’s now becoming like, yeah, we just know we just have to run an EDR. But there’s still a whole bunch of tooling, you know, DAST and asked. You see, in software companies, they eventually get there because somebody kind of forces ’em into it.

But like secure web gateways, RBI [22:00] Cs, BDLP tools, ZTNA, like these, these kind of things are still, you know, I feel like they’re accepted but not really prevalent yet.

Alejandro Ziegenhirt: Yeah. So SAS I think is much easier to implement than da, right? Mm-hmm. So sas these days you can generally purchase an off the shelf solution, inject it into your pipeline, set up quality control gates, and now you have some basic static testing on your, your code das.

You need to write the attack scripts to customize based on your application workflow. This is much harder to implement, uh, I’ve noticed. And then. It requires resources from engineering to set up the tests with InfoSec oversight to make sure that we’re testing the right things. You gotta bring in these das specific toolings, much harder to implement das program.

Usually you won’t see it unless there’s some sort of review regulation that requires it. I’ll be quite honest with [23:00] you. Yeah, the ZTNA thing anecdotally has been quite easy to push through. I won’t lie, the legacy VPN, you know, it’s, it’s not super convenient, especially if you’re on MFA, right? You need to log into the system and then you need to, if you have an UBI key or some other text, you need to log in your two FA.

You need to do this every single time you come to work. And then from the security side of things, it’s not very secure. You just get access to the entire network. Whatever that may be, the slash 16 or 24 or what have you, you just have access to all of it. I can’t really segment what you have access to when you explain ZTNA to the executives and the board and the 10,000 mile view, which is if you’re a junior engineer, I can give you access to staging and if you’re a senior engineer, I can give you access to pro.

And if you’re a manager, I give you access to nothing. [24:00] This, this becomes extremely attractive actually. And then on the convenience side of the tools that I’ve been using these days, you install a certificate, we set up the RAC on info InfoSec, does all of that heavy lifting together, usually with HR and then and management team.

And the engineer just clicks a button and they’re in and that’s it. Yeah. And they have access, segmented access to exactly what they needed access to. And a lot of vendors these days, the cost is agreeable. You at least similar to the VPN solution that you were using. So on the ZTNA side, I would say it’s better than ever to switch your corporation over to ZTNA.

Max Clark: I found h HR HRIS systems to be, I don’t, I don’t wanna say like Trojan Horse, like I, I, it’s the wrong, it’s the wrong terminology here, but I found it to HRIS systems are these fantastic gateways to a lot of InfoSec for an [25:00] organization, right? Because now you’ve got a tool that’s coming in, you wanna have centralized, you know, profiles, right?

So now you have an identity, you know, a, a source of truth for identity that you want to push out. HR wants to be able to onboard and offboard people without talking to anybody else, right. You know, so speed of deployment and like, it, it, it feels like it plugs in really well. It’s like, oh, you know, you know, we can plug, you know, we can do this tool, put this in, and it kind of all feed in together.

And of course the vision isn’t really. Necessarily like, we’re gonna give you better security. It’s just gonna be like, Hey, we’re gonna enable you to move faster without talking to anybody else. And as a byproduct, we get all the stuff we want as well.

Alejandro Ziegenhirt: Yeah, I, I love it. You know, you, you pick your right vendor, right?

So you do your third party due diligence. This is important data that this system is gonna be covering, right? It’s gonna have socials, it’s gonna have names, addresses, pay information, vacation. Sometimes people put where they went on vacation in their HR request. You know, this is important data, right? So picking the right [26:00] HIRS, uh, sorry, HRIS is extremely important.

And then, as you’re saying, it really helps me perform rvac on my side. I can, uh, download the list of titles that we have. I can assign what access should be given to that title when they’re reporting into a certain department. And then I can configure my ZTNA tool to grant. Most appropriate sort of separation of duties access to those people in real time.

This, this was done manually before, you know, or access was given carte blanche. Here you go. You have access to absolutely everything. And now in the remote age where you could have a worker working in a internet cafe, of course my InfoSec policy says that they’re not allowed to do that, but they can do that.

You know, I can’t be, the team can’t be everywhere at once. Yeah. And they will, it will be safe if that laptop ends up in the wrong [27:00] hands. Right. The. The amount of access that that laptop will have can just be cut instantly, remotely from InfoSec and they won’t have access to absolutely everything in your network.

So it sort of diminishes your attack surface.

Max Clark: When I read, uh, when you, when you hear about these like really big breaches and events that actually hit like mainstream news and like the, the general awareness, right? Mm-hmm. And you dig into details behind the breach and the actual attack. Like the more I read, the more depressed I am about what actually happened.

And, and what’s amazing about it is most of these things are very, it’s, it’s like a colonial pipeline, okay? You had, um, a, a breach through the VPN system for an account that had been, you know, associated with a person who had departed the company a year earlier, right? And you like unpack that whole train for a second and you’re like, there’s like four opportunities within that train to prevent that from happening.

Um, I’ll, I’ll, I’ve been picking on them late lately, but it, it keeps coming up. Um, there was a, a continuous [28:00] integration and deployment. Tool that had a pretty big breach. And, um, I’ll be gentle, I won’t say their name, but you know, you read through, you read through their like, like, and, and props to them for actually saying what happened, but like a customer caught their breach.

They didn’t catch it. Yeah. And then they, they talk about, they post this thing about like, our antivirus didn’t catch it. Um, we had users connecting from a VPN from Eastern Europe that we didn’t notice. Um, you know, this happened, this happened, this happened. And you’re like, read through this thing and you’re like, like, like everything that just happened here is, is known to be a problem and is solved.

Like, you know, but there’s an organization that didn’t think there was important to solve. And that’s, I think, like this foundational disconnect I come back to, which is, you know, what does it really take before organizations if they haven’t been forced to by regulation or forced you by a customer? Like what, what forces them to finally level up and take some of this stuff seriously?

Alejandro Ziegenhirt: Yeah, I think very often this. We’re all human. And I think it comes down to having [29:00] the correct team, right? Having a, a wide breadth of, of people that are thinking of these things is so important, right? Having someone say, Hey, we should set up a access, user access review with the IAM team or HR on a two week or a monthly basis could have stopped this breach.

Not allowing the business to purchase a vendor that doesn’t integrate into an SSO solution where access can be closely monitored and controlled, could have stopped the breach, having, having an engineer say, just brainstorm, uh, that threat hunting model. So important, right? I see that we have, I’m getting an alert that our employees are logging in from Eastern Europe.

Should we allow this Right. Get that conversation going with the sea level and the board, right? Uh. Having users log in from China, et cetera, right? Mm-hmm. [30:00] So it’s all about having the right technology to stop, to limit that attack surface. It’s about having the right processes so you get an alert that strange access happened, or anomalous access occurred, and then having the people in place to think about these attack scenarios, these sort of common sense things, and sort of secure them from the lowest hanging fruit to those very fancy zero days that we see in the movies.

Right? But very often securing this most like basic low hanging fruit, it ends up being the brunt of your, the, of your security program.

Max Clark: Mm-hmm. Years ago I was talking to, I was talking about the CISO of a multi, you know, the company. At operations in multiple countries, I’ll just, I’ll kind of try to keep this as vague as possible.

And like most traditional enterprises, the IT team reported up into the CFO. I mean, there was a [31:00] CIO, but it reported to the CFO and the CISO also reported up through the CFO. And this is a over $1 billion year revenue generating company. And, um, the CISOs entire budget for people and technology was, um, I, I’ll never forget the number, it was $11 million for their entire program.

And what really stood out for me in this conversation and, and talking with them was, um, they viewed their role really as we just have to see something happening and then figure out how to disconnect it from our network. And then like the IT team has to then go figure it out. Like, we don’t have the, we can’t, like, there it was, it was this kind of like, um, you could, you could get this sense of like, I don’t wanna say like defeatism, but like.

I can do so little with what I have available to me with how big this environment actually is. In order to actually be effective at anything, I have to be really restrictive in what we are even trying to do in the [32:00] first place. And, and what’s what I, I, we, I come back to this because I think about this a lot with people trying to allocate budget or trying to educate and say, you know, we do need MFA, we do need a real, IM and Pam policy.

We need SSO, we need EDR. And it’s like, well, why do you need EDR? We’ve got antivirus. Or, you know, we need Z tma. Oh, our v VPN works fine. You know, like, we need to prevent people from connecting from China. Ah, that’s not happening. You know, like, like, you know, is there, is there a better approach to take with that conversation that’s like, you know, hey, like, hey, you know, like our.

Our sister, you know, like our competitor, you know, our industry. Like this is the stats of what’s going on like this. I guess, I guess the point is, is like, is there a different tactic take to try to like impress on people like yes we, we need this EDR tool and we have to spend money on it and you know, it’s even better if we have an MDM or UEM that helps us like manage and actually push stuff out to our end points.

Or do you just get to a point where you just say like, yeah, this isn’t a good place and you know, people are in that position. Maybe they should be looking for alternate [33:00] employment and not being there when whatever hits the wall.

Alejandro Ziegenhirt: Yeah. It’s a tough question, but I’ll answer it as honestly as I can. Yeah.

As an InfoSec practitioner, you are going to do your absolute maximum best to make sure that the company is doing the right thing, that they have the right tooling in place, that their risk mitigation is appropriate to their risk. Not everything needs to be Fort Knox. Having absolutely no protection is very often not acceptable either.

So you, especially to C-level board business folk, you need to be able to tell, explain InfoSec risk with stories, right? Make it, uh, make it understandable for them that they understand that this is gonna directly impact the business or the shareholders and do it in the most quantitative way possible is [34:00] generally the strategy that I like to take.

’cause dollars and cents is, is the most important thing for the business, and this is what you can do, right? If you explain it to the C level and the board that this is, this is a $15 million breach waiting to occur with 300 grand, I will fix it, or my tooling needs automated access. It is not tenable. For me to receive a breach and just ship it to an IT team that works Monday through Friday, nine to five for the fix, leaving three days of dwell time for the attacker.

This is also not an acceptable risk because of this breach. And if you look at this breach, it costs that company X million dollars. Right? And you know, definitely there’s fight you as an InfoSec leader, you need to have some scrappiness, right? You’re definitely not gonna succeed at the, you know, taking the first no as an answer, right?

But there [35:00] does come a point where if the business just doesn’t want to do it and they are willing to accept the risk, we have an official term for this. It’s called risk acceptance, then that’s what you purchase cyber insurance for, I guess. But that’s not really my approach. If I worked at such an organization, I would.

Almost certainly not work there anymore after very long because part of the fulfillment in the job is securing the thing. You know, that’s, that’s, that’s the mastery component of the job. You know, you work for compensation, you work for mastery, you know, all of this. You took the same HR training I did.

Right? All of this. And if they’re not letting you secure the environment and everything is just, no, we don’t need that. No, that’s not happening. No, that risk doesn’t apply to us then, you know, it’s, you know, you did your best and it’s time to move on. For sure.

Max Clark: I, I came up from the IT side of the house network and IT systems and the risk acceptance [36:00] is really Rick’s risk acceptance.

I dunno, I can’t say that right now. Risk acceptance. It was, it took me a long time to actually understand, because in our case, you know, uh, you know, it was a SoCal, right? So it was always like we had to plan for the 10 earthquake. You know, this wasn’t like Florida where a hurricane went through every two years and people actually maybe like, yeah, we maybe should have a hurricane plan.

But it took me a few years and like a lot of different Dr. BCDR plans before I realized like the board’s responsibility was to evaluate it and then say, okay, we looked at it, it’s not worth it. And then like that was the decision. Like, but they, they met the responsibility of the board. Like you couldn’t, you would, you know, the, their, um, you know, the directors and officers insurance would cover that.

Like, no, no. We had a board meeting. We evaluated it, we decided it wasn’t the risk profile. It was too expensive and we’ve moved on and, you know, I, I made a lot of peace with life after that. But, you know, the risk acceptance, I, I wonder if it’s also just [37:00] people not having personal experience or like their neighbor losing their job because of something that hasn’t, you know, spread out wide enough for people to really understand what risk are they really accepting with these things.

Alejandro Ziegenhirt: Yeah. This is the human condition, right, is uh, it’s not a problem until it is. And so we run into that a lot with security. As an effective leader, it is your job to paint the picture, right? Try to put that individual or team into the seat, right? Explaining the full risk profile, what exactly will happen to the business.

It can’t just be, this will be bad for business, right? Uh, I say this a lot, all of my answers have been like this, but I really try to tie back risk into dollars whenever possible. Sometimes it’s not possible, but often it can be. If you really, uh, you know, noodle through it, you can bring it back to a dollar amount and [38:00] explain it to them that this has a 5% chance of occurring based on industry standard data.

That’s, that’s data out there. There’s a certain number of companies, they suffer a number of breaches per year. This is statistically available data that you can then tie back into a breach cost times the percentage amounts. Amount, and this is your risk profile in dollars. And then that’s the decision point.

Right? As a sec, uh, security practitioner though, especially operating at the executive level, I do understand that sometimes you just can’t afford it. Right? If the BC uh, you know, if the DR plan is to purchase another, uh, warm swap data center and it’s gonna cost X dollars and the revenue is just not there to support mm-hmm.

Then you just can’t do it. And finding that compensating control will be key in that place, right? We don’t just throw up our hands and say, okay, risk accepted cyber insurance. [39:00] Okay, we put the noodle together, we can’t have a full hot swap. What can we do? What controls can we put into place to stop the disaster from occurring in, in the first place?

Maybe that is much cheaper, right? So. Explain the risk in dollar amounts, and if all else fails, try to uh, put in a compensating control.

Max Clark: Okay. That, that triggers a thought. Here,

Alejandro Ziegenhirt: lemme take a sip of coffee before you Oh, of course. Question course. Take a sip and lemme take a short moment. ’cause I’m aller horrifically.

One moment I’m gonna camera off for this one. I’m so happy you’re able to edit this.

Max Clark: Oh yeah. Don’t worry. We’ll edit. We’ll, we’ll keep this all in. This will be in the outtakes.

Alejandro Ziegenhirt: Oh no.

Max Clark: We’re, I’m gonna start doing this Rogan style. We just don’t stop. You just, you need to get up and take care of something.

Just get up and go.

Alejandro Ziegenhirt: Honestly, I’ve never done anything like this before. It’s cool. Definitely. I’m trusting you to take out a bit of the, you know, the fluff for sure. Alright, here we go. Big.

Max Clark: I find like misconceptions, [40:00] um, to be very dangerous. And a big one that I run into a lot is like, oh, we’re on the cloud, so now therefore we’re secure, or we’re protected, or we we’re backed up.

Um, you say compensating controls, which, which triggered this, which of course takes my brain immediately into like a soc two. You know, if you’ve ever been through one of those, you know what I’m talking about with that. But the wild thing about the SOC two also from a misconception is a lot of times you’re defining a control and then validating that you’re adhering to the control or an improving on that, not necessarily as the control proper in the first place, or if it actually gives you, you know, something talking with a client the other day and they have SOC two, type two and a bunch of other, you know, compliancies that they have to adhere to.

And we’re getting into, um, one of their environments and, and, and my initial reaction is like, your auditor has never asked you a question related to this environment. ’cause there is absolutely no way they would sign off, you know, on your, on the, on the attestation about [41:00] this. Right. I experienced this personally, uh, you know, a bunch of years ago when we had to do PCI compliance and it was like, it was a very creative response to, you know, the, the PCI questionnaire.

How do you, you know, soc two becomes a, like a supply chain thing, you know, we’re B2B, we have to have soc two type two in order to validate with, um, you know, with our customers. But that’s, but it, it, it kind of all like bubbles up to the same point again, which is like, oh, we’re on the cloud, we’re secure, we’re on Google workspace, we’re secure, we’re on Mac, we’re secure.

Like, you know, these kind of things that now, you know, aren’t necessarily like, you’re trying to, like, how do you explain away like this? I know you think that, but that’s actually not the way, the real world.

Alejandro Ziegenhirt: Yeah. Just, just do a quick search for cloud security vendors and you’ll know that the cloud is not secure by design without some extra help.

Right. So, uh, this gives you the ability to configure your environment wherever you [42:00] wish, right. You could, for example, S3 buckets. They can just be public and you can just put as matter. Of course, I’ve worked at many. Software as a service companies where S3 is used primarily for storage of important things, artifacts, data, uh, testing models, LLMs.

All of this now can be put in S3 that just takes the small misconfiguration of public on that S3. And now all of that data is now available for anyone

Max Clark: to forget. I stumbled across one and they were keeping their secrets in S3 and, and instead of using this, uh, like Secrets Manager or, or Vault or one of these things, they were actually stor.

I mean, like the apps started. They would connect with an S3 bucket. They download the file and then they would

Alejandro Ziegenhirt: like, you’re just like. Man, you’re laughing, but I’m, I’m, this is common practice. I know it’s common, but, but like practice this is it. This is how business is [43:00] conducted in 2024. You know?

Max Clark: I know, but I can, I can laugh because it’s the only response I have to it at this point because like the whole thing is like, of course this is what they’re doing.

Well,

Alejandro Ziegenhirt: when you don’t have an InfoSec program and you’re just trying to scrap, uh, most of my career has been in the startup space. Uh, I’ve spent 12 years now in startups. Late stage, early stage, mid stage. You’re just trying to get there. And you’ll do that however possible. It’s not until that Series D funding comes in where you hire your first InfoSec hire and they come in and they see the dumpster fire and they attempt to fix.

Right. And now they’re sitting on nine years of tech debt. Right. But this is extremely common explaining to developers that the right place for secrets in plain text is a privileged access manager. Which AWS offers, by the way, it’s called AWS Secrets Manager. Yeah. And you can just call the secret from your code, [44:00] and I provide them the snippet on how to do that.

And then now you start improving this. But this is actually extremely common, right? So definitely the cloud and, and your, even your repos and all of this. This is not secure by design. This definitely takes a professional, knowledgeable engineer to come in and make sure that you’re secure. And then once you have all of the configuration piece, which is actually one of the most common attack vectors, is just misconfiguration.

Now you start bringing in your tooling, your sas, your das, your firewalls, your uh, bot management, you know, to stop atos and things like this. Now you start layering this security onion. But, uh, for sure Cloud and Macintosh not secure, just by design. Definitely needs to put in the work.

Max Clark: Well, the, the example I’ve started using is, you know, delete is a valid operation on every [45:00] cloud platform.

And you know, like it doesn’t know that that delete wasn’t supposed to happen because it sees a delete and goes, yep, delete,

Alejandro Ziegenhirt: delete,

Max Clark: yeah,

Alejandro Ziegenhirt: delete. Quite as long as the right permissions are set, it’ll allow you to do whatever.

Max Clark: It’s a program design. You talk about automation, but really this is like people in process, right?

Like, you know, a, you have to sell it to people. People have to have buy-in on people. You have to have people to implement the program, right? And technology with automation is, is a, is a smaller and smaller piece of the puzzle because it does more for it, right? But you still need a lot of people, right? So now you have, you know, and, and we could talk about like, you need seven people for a 24 hour shift or, or 12 people.

And like, what’s your on call? Um, you know, going, going from like zero to like, we need 15 people in order to be a security team here. Like, that’s also a big lift for a companies. How do you find, how do you, how do you like approach that from a, you know, you’re the first hire into an InfoSec program, right?

[46:00] So now you’ve got like, you know what, what, what sort of like, evils from the old am I dealing with, and then who am I hiring? How many can I hire? What tooling are we putting in place? Like, kinda walk me through a little bit of that in a high level of like, how you attack this and decide, you know, what, what becomes like, we’re doing this this quarter and that next quarter and this in two years, and Yeah.

Building that roadmap. I

Alejandro Ziegenhirt: mean, it, it’s an excellent question. Uh, literally right in my wheelhouse as this was the exact scenario in my last two places. As I come in, there’s absolutely nothing. It needs to be fully built out. We did two different approaches at both different companies. So at the first company, very large, um, sort of pet retail, you would know the name if I said it.

Mm-hmm.

They had very small security program and no, 24 by seven monitoring, and they wanted to go public. The task was given to me to build a 24 7 monitoring operation [47:00] and go. And so eventually we do our due diligence, we do the gap analysis. We start with, okay, what do we have to protect? This is the very first question that I ask when I go anywhere is what are the valuable pieces of data that anyone would want to steal from us?

And then from there that establishes. How much protection we need to put in place, what kind of framework we’re gonna adopt, how many people we need to hire, can we take it internal? Should we build it external first and then build the internal later? And the decision here was we needed this quickly. We really wanted to IPO, so let’s bring in a managed services security provider to act as our soc.

And with this, we were able to, for the price of one engineer hire these days on security market, we had access to an entire team of over a hundred [48:00] analysts that the provider had built out for us already. And it was a question of just sending, collecting the right data sources, logs, you know, DNS firewall, cloud logs, et cetera.

And shipping it over to their environment, of course, doing a security review that they would keep it safe and then they would build out a rule set for us. And then now we have 24 by seven monitoring. Is it gonna be perfect? No, it’s, it’s an external security services provider. But were they able to raise the alarm for us at 3:00 AM on a Saturday?

Very often the answer here was, was yes. And then that got the sock started and sort of the people started thinking, seeing the value, right? Hey, look what this vendor found at 3:00 AM. Fortunately, we were not able to action the alert until our engineers came in Monday at 9:00 AM We should fix that, right?[49:00] And now this is how I got that next set of budget, which is now, I had an internal engineer, and this is how we started the internal soc. And then once that got into place, we started saying, how do we force multiply one person? So we brought in automation right before an alert would come in. Our engineer would then need to go into our log repo, do his scripts, search the data, gather six, seven different eight planes of data, bring it all back, and start doing analysis.

We started automating that, right? The data alert would come in, the data would get automatically pulled based on what we wrote is the data that we think we would need for the breach. This saved us, uh, an hour of investigation time before the investigation could even start, right? So that’s how that evolved from, it started external and then we were able to grow the security operation internally at the next business.

The decision was made right [50:00] away, full internal. They didn’t wanna go with an external. And so here we started with a couple of security architects. Because we didn’t even have log sources, we didn’t even have the data to secure. Then now with the data, we set up the security operation, started hiring the team, get that into a six, seven, um, person, 24 by seven monitoring operation.

And that’s how that evolved.

Max Clark: And then once you start collecting data and you can say, Hey, you know, this month we responded to 200,000 events, you know, then you have, now you have something that’s ified that people are like, go, holy shoot. You know, like, um,

Alejandro Ziegenhirt: yeah, you have a real incident that was stopped by your team.

This is the most powerful thing in the entire InfoSec repertoire of explaining risk to executives. Right? Uh, we hate to see it, we don’t want it to occur. But when that malicious payload comes into your cloud environment and it gets [51:00] through your waf, so your first line of defense, it, it got through it through it, but then you get, hey, a, uh.

A role was set up at 2:00 AM in your environment. Mm-hmm. By this process from this ip. Huh? That shouldn’t have been like that. Let me investigate. And it ends up being a real, no one knows who did this right. And you stopped it. This now becomes one of the most, this is a story you need to preach from the actual heavens, because this is not a usual gift that that comes in for, uh, an InfoSec leader.

Uh, and this is how you continuously grow the program. But very often it’s, look at what we stopped, like you said.

Max Clark: Yeah. I, I, I see this a lot with people, um, with email gateways. You know, I hate these acronyms, but we’ll say secure email gateway, you know, the, the, you know, the Mimecast and Proofpoint being the big, big names, right?

Alejandro Ziegenhirt: Yep.

Max Clark: And it’s like, oh, we run Google Workspace, you know, we [52:00] we’re, we’re fine. And then you turn one of these tools on and you’re like, oh, you know, a 500 person company, you had 45,000 things that passed Google’s filters and went into, you know, that this other tool caught. And you start working down the numbers and it’s, it’s, it’s wild when you see it because, you know, I think a lot of times people just don’t expect it.

Like, oh, it’s not happening to us. And then you see it and you’re like, no, no, this is like, this is you.

Alejandro Ziegenhirt: Yeah. As, uh, I’ll tell you this, and this is probably extremely widely known info, but your employees are the number one way you get breached these days. So, so

Max Clark: let’s, let’s, let’s, let’s talk about this one for a second.

Okay. Because boy, I have some feelings about this one. Yep. You know, sands and ions. Right. You know, it was like the, the breach hierarchy, you know, accident acts, internal employee, malicious acts, internal employee, malicious acts, external. You know, you kind of come through these things and Yes. Like the number one source vector for everything now is an internal person.

Alejandro Ziegenhirt: Yep.

Max Clark: Which is why like security awareness training gets pushed so hard on people. But Absolutely. [53:00] I’ve gotten to the point where like, I don’t look at a breach that comes from an internal person as like a failure on them anymore because of like, it’s impossible to deal with this stuff. Like I know people in the crypto business that have been phished and you’re like, these are really smart people, and they got like, personally phished and, and, and I look at that as like, okay, now this is like a real failure of like company, like what the company implemented this program because like Yeah, your, your employees don’t stand a chance here, you know?

Alejandro Ziegenhirt: No, and I’ve got a, an extremely incredible story for this one that just occurred. Right. But this is, you can only do so much with training. It does come down to. Separation of duties. Those extremely basic SEC principles of not giving one person keys to the full kingdom become very important. Of course, I’ve worked at organizations that are 5, 600, 700 people, so this has been tenable.

Mm-hmm. At a 10,000 plus [54:00] place, this is probably extremely difficult, but while you’re growing your company in the startup space, it’s very important to ensure that one person alone without collusion can just disrupt your business. Right. You know, setting up that RAC, setting up, like especially in production, no one entity or role should have access to do something that would disrupt your business without it also requiring collusion.

Perhaps you have two leads. And in order to do certain commands in prod in the cloud environment, they both need to sign off on the permission, et cetera. Sort of establishing these gates are important.

Mm-hmm.

And then of course, though it, for the phishing emails and stuff like this, this is a very personal thing, right?

You have to explain to them all the possible scenarios. This, this can’t just be once per year [55:00] training. The training needs to be engaging too. It can’t just be like, here’s a phishing email, don’t click this. Right? Keeping, uh, keeping the engineering team engaged is sometimes, oh, an easier thing. Keeping marketing, accounting, sales engaged in a security training can be more difficult.

And so when you’re choosing the right program, you need to make it very entertaining, very relatable. And this is, this will get you 90% of the way there.

Max Clark: It’s so, um. I have seen this done in ways that are just like, make me cringe of like send out a simulated phishing attack to our employees of like, oh, thank you so much.

We’ve had a great quarter. Here’s a hundred dollars Starbucks gift card. You know, click the link. And of course, like,

Alejandro Ziegenhirt: no, it’s so bad. Yeah. So these sort of exercises should be done very sparingly and the attack should be as real as possible. The scenario you described there is [56:00] just straight up trapping your employees.

And, and that doesn’t, that doesn’t phish need, uh, at any business. But something that happens very often is, Hey, this is the CEOI need X report. Please send this to me. Sort of those style, more real life sort of attacks that happens every day. So if you wanna set your, your testing campaign just to see how effective your program is or who might need some additional training, et cetera.

Then it’s not necessarily a bad thing. And this is how I always frame those sort of exercises. It’s never like, oh, you clicked, you’re in big trouble. That is not the goal of the program. It’s definitely, Hey, we saw that you were vulnerable to this. Here’s this extremely engaging short training. Right? And, uh, you know, be more careful.

If you see something, say something. Here’s the team, this is what you do instead.

Mm-hmm. The next time you see something that looks [57:00] weird, you send it to the SEC team and we can bless it for you. Just put, put the responsibility of the decision on the SEC team, you know, and, uh, this is something that generally goes very well.

The story I wanted to share with you though, that’s, this is getting very scary. The AI deep fake. Phishing phone calls now mm-hmm. Are absolutely, I think, the most terrifying things in security right now. I recently saw an event where a phone call came in. It was an employee, it was their voice. They knew things that only certain people had access to, and they requested just strange things.

And the, the key, the clue was that the employee reported that the number came from not the usual number. Right. Part of our training is when you see something suspicious, hang up the call, call ’em back at the number you usually recognize, and lo and behold, it [58:00] was not the person, it was an AI deep fake This is representing significant security challenge and something that should go into most security awareness programs right away. Because most commercial off the shelf offerings are not including this vector yet by default

Max Clark: Apple. So this is personal. I’ll share a personal story ’cause I did not respond.

I, you know, like I will, I will, like, my reaction to this was not, not good. I was on an airplane coming home and my pregnant wife who’s at home gets a phone call from Apple computer. You know, ’cause it’s got the thing on her cell phone. And you know, like just everything like, like, you know, a lot of these things, what people don’t understand about it is it’s usually also situationally timing.

Like, like part of this attack factor is you just get somebody at the right time, you know, in order for there to be an, you know, successful thing and you know, a toddler. [59:00] I’m out of town, I’m coming in, something else is going in. Apple computer calls like some other stress at the house. Just all of it, you know, combining at the same time, creating the perfect scenario.

And, uh, and my poor wife is, you know, driving to the grocery store to buy Apple, iTunes gift cards, right. To like, deal with this thing. Wow. When it like, you know, and, and what it and what, and, and to her credit, she got a little bit of separation for it and something in her mind, you know, like, it, it clicked.

It was like, this is a little weird, you know, because, you know, she got a little bit of space and she stopped. And of course then, you know, I’m, I’m landing and I, you know, I turned my cell phone on and I’ve got like, I’m reading like this text message thread of like, oh, this has happened, don’t worry. I’m dealing with it.

I’ve, you know, talking to people from so and so, and I’m like, and I’m like reading through this novel as my texts are firing off on my phone and like com, like just again, did not, did not. I will, I will always need to like, apologize for like how my reaction was. ’cause it was [01:00:00] terrible. But like, my reaction to that of course, and what I learned from it, like other personal story, I hire an ea, you know, and, and as part of the onboarding, I was very explicit with her.

I will never call you email, you, text you and ask you to go do something for me related to money ever. Period. And you know, like sure enough, within like two or three weeks, like she gets now, it was a horrible email. Like it wasn’t coming from me. It wasn’t like they were on her email platform like it was, but she gets this thing where it’s like, oh, but you’re still in that phase where she’s, you know, uncomfortable of like new job power dynamic, like this whole thing.

And, and bless her because she said something about it and it was like, we need to take this and like embed this into our onboarding because. Like, look at this, you know? And, and I, and I told her, I was like, I want you to record and talk about this while you’re still thinking about it and it’s fresh for you.

I want you to record a video and like explain this thing and, and like, what went [01:01:00] through for you with this. But, but that’s why I say like, caller IDs could be faked so easy to fake caller id. Yeah. Um,

Alejandro Ziegenhirt: the, it’s the law of large numbers. Oh geez. So, especially now, it’s automated. It’s a computer. It’s not a person in a call center anymore.

The not even talking email, right? Email is, as we know, just a billion emails will go out. Billion emails. Absolute. Robert

Max Clark: Joe.

Alejandro Ziegenhirt: And if they get, if they get 0.00, zero 1% engagement. They’ve met their, they’ve met their, what they want to do, right? Yeah. And with the AI deep fakes, this is not something that most people outside of cutting edge technology InfoSec space know about.

That is even a, a thing, right? This attack success percentage has to be very high, especially the fact that the, the data is collected, right? The, [01:02:00] it just knows things about you. It, it, it, it gets your name, it gets your voice. Somehow, it somehow, everybody records this stuff,

Max Clark: uploads this stuff to social media, like how you like, come on.

That’s true. You know,

Alejandro Ziegenhirt: it goes into your TikTok, it goes into Facebook and Instagram. It gets your voice and it knows, oh, this person really likes baseball. And then boom, they got the baseball in, and then 1% of the time the AI hits. Yeah. And most people are gonna do. Whatever is asked of them

Max Clark: to

Alejandro Ziegenhirt: do. For

Max Clark: sure.

I don’t wanna, I, I’ll get too depressed if we talk about this, this too much, but it’s, it’s, um,

Alejandro Ziegenhirt: yeah,

Max Clark: it’s, it’s also, you see it like, not even with business. Um, there’s been lots of cases where people get the phone call of like, I’m in jail, I’m in, I’m, I’m broken down the side of the road that the tow truck wants money right this second.

You know? And, and, and, and, and I know people personally that have had this happen to them now where they fortunately didn’t send, you know something, whatever, and they, they, they ended up hanging up and calling on a different phone number and yeah, yeah, I’m [01:03:00] fine, you know, but it’s scary. Um, you talked about like finding things like what’s valuable to the business and you were talking like metrics and DAUs and like all these different things that the business is doing, but you skip, you skipped one, right?

Which is. Employee productivity, right? Like, are you quantifying, you know, we’re 500 people and we’ve got a sprint to deliver X feature, and if we, you know, have to re-image, you know, 300 devices, like it’s gonna take us 12 days, and you know, like how, where does that rank in terms of the actual risk profile also, you know, in these conversations?

Alejandro Ziegenhirt: Yeah. No, it’s, it’s a good, it’s a good question, and this is why we talked earlier about shifting as much of the security left as possible, right? If I am able to stop the security flaws from going past development stage and having them fixed right away, as that code keeps getting edited and more features are put into it, et cetera, the tech debt [01:04:00] required to fix the compounding security flaws gets worse and worse over time.

So if you’re able to stop that right at the start of the chain. Just don’t allow it, then you are saving, like you say, X productivity, which can then be used to deliver feature and revenue generating, uh, feature sets.

Max Clark: You talk about going public as a trigger, series D is a trigger. What is it about that size that like, finally kicks off this, like, we have to address this now and let’s go after it?

Alejandro Ziegenhirt: Yeah, good question. So I think, like I said, in seed ab, you’re just looking to make a product that people think will make money, right? And then right around the sort of series C is probably when you’re like, okay, we’ve, we’ve got a market, we’ve got a product, it’s on the market and we’re, we’re creating revenue.

And right around that Series D is when your [01:05:00] investors are usually the trigger that start asking you, Hey, what are you doing about cyber? And your answer better be. I have a team and we’re working on it, and we have a framework because that a hundred million dollars in funding that you were looking to, to receive, that just won’t happen if you don’t have an InfoSec program.

Especially large investing firms now in VCs, they’re extremely sensitive to security events, tarnishing their brand, exposing them to risk and liability, and they have all the money to be liable for breaches. So they’re just not willing to accept that, that sort of risk profile, no matter how profitable your business may seemingly be unless you’ve got your security, uh, fundamentals in place.

Max Clark: So really you’re talking about like, it’s a shift from like creating a i i creating a market or product building the market or product to like, okay, now we have a market and a product and we’re generating revenue [01:06:00] from it.

Alejandro Ziegenhirt: Yep.

Max Clark: And once you actually have that, it becomes like, now we have to protect this revenue and protect this market and protect this product.

Alejandro Ziegenhirt: Yeah. And not just revenue, but data. Mm-hmm. Right? That, that seems to be even more powerful than revenue these days, is the data that your service or product is, is now collecting. And very often companies don’t wanna delete that data. They know the value. And so now the more data that you are hoarding, collecting, the more juicy you are as an attack target and the more egregious your breach will be if it happens to you.

So right around the time that we reached this critical mass of dollars coming in and customers and data, that’s, that’s usually the time where security starts becoming very important

Max Clark: and, and data warehouses and data lakes are now prime targets for people to actually go after and find because they’ve realized like what’s there is really valuable to a company and.

Yep. You know, it’s valuable to their [01:07:00] competitors, it’s valuable to other countries. It’s valuable to give us a bunch of money and we won’t disclose it.

Alejandro Ziegenhirt: Yeah, I can think of an infinite number of malicious usages for a giant database of names, phone numbers, addresses, emails and credit card numbers. Right?

What can I say? And the fact, you know, this latest breach here where we were storing these things in plain text, no encryption just really drives that home, that a scrappy product focused development team, you know, their, their goal is to go to market and make money. They sometimes are not gonna be thinking about the ramifications.

Of getting breached.

Max Clark: Show me the incentive, I’ll show you the outcome or show, you know, like what, what the phrase is. Yep. And I see this with cloud and cloud spend, where companies like all of a sudden start looking at what are we spending on our cloud platforms? And I remember one conversation and the director of engineering, we were in this, you know, there was push coming down from other sides of the organization and the, and the director of engineering just flat out said, it’s not my KPI, like, I don’t care how much this costs.

That’s not [01:08:00] how I’m judged. You know, and my, my deliverable is different. Like, I’m judged on these things. Yep. And, and it became this conversation of like, are you, is this a KPI that you’re actually pushing into the organization or not? ’cause if it’s not, nobody cares. You know, all of a sudden you kinda have to make ’em care a little bit.

Right? ’cause you’ve made them care about other things.

Alejandro Ziegenhirt: Yes. So at this sort of juncture, this would be where you have to get lead leadership, buy-in all the way from the top. I dislike very much skipping my peers. But sometimes when you know something is right, as a, as an InfoSec engineer, there’s an ethics component that has to be unshakeable and you can’t be afraid of ramifications sometimes on the politics.

You need to escape from the politics and do what is correct for the business and the users, primarily the users, right? And these [01:09:00] are often the same thing. What’s good for the users is good for the business and vice versa, and get that buy-in that, hey, security is very important. Just look what’s happening here and here.

This is the risk that I’ve identified. This is a real risk. It has temporal, uh, relevance. It’s an active breach, easy to do. And it’s gonna cost us X If we lose X data, things like this, this is the only way that you’re going to circumvent something like that, right? Because there is unfortunately a lot of politics in the corporate power structure and explaining the risk profile back to a dollar amount, you know, very important to the right people is very often how you can get these, uh, security initiatives through.

Max Clark: Well, it’s also, again, back to resources, right? You know, there’s limited pool of money and you wanna take some of that money that has to come from other places. And, you know, like going out and we, we [01:10:00] briefly mentioned insurance earlier, but like going out and getting an insurance policy, at some point, insurance is against revenue.

And you could say, you know, it’s gonna be X percent of your revenue is what your insurance policy is gonna be, right? Like, you know, how, what, what’s your assets? What’s the value of your assets? What’s your revenue? What’s the value of your revenue? You know, and you have an X percent, you know, track on that.

Alejandro Ziegenhirt: Yep. And.

Max Clark: I don’t, I don’t feel like I’ve seen any budgeting cycles yet where people were really associating security as a percentage of revenue, you know, yet where they’re like, yeah, we have to like account for like 1% of our revenue and our cyber program. Um, but it kind of feels like we’re almost, you know, gonna be in that conversation.

You know, like, Hey, you know, we just, we we’re gonna spend $6, $5 per user, you know, you’ve got 5,000 people. Like, it’s just gonna cost us much a year to have a security, you know, program for this environment.

Alejandro Ziegenhirt: Yeah, I mean, I, I don’t have much rebuttal to this. This sounds amazing, you know, but. What can I say?

You mean this is, this is fantastic. If I was able [01:11:00] to associate such a thing all the way to planning level, I’d be a genius for sure. Thank you for that.

Uh, I mean, this is one of the hardest things to possibly do, right? Is, you know, you’re turning something that’s so qualitative into something quantitative and Right. That’s, that’s, that’s the job. That’s I think why there’s a person hired in the position to be fair.

Max Clark: You know, fortunately, like some of these things, it’s like, um, enable.

You know, two factor authentication, like chances are your primary platforms have that supported anyways, and it’s just a feature and you can turn it on. Now you don’t get SSO out of that. You have to go invest in SSO and SAML and all these other tools. Like, you know, if anybody watching this, like, don’t be freaked out by numbers.

Like you have a lot of stuff that you can do if you haven’t done it yet, just to make yourself a lot more secure. And yeah,

Alejandro Ziegenhirt: there’s so much low hanging fruit that can be done at a relatively inexpensive, uh, [01:12:00] caliber, and you’ll be better than 90% of most corp corporations if you just have these things in place.

To be honest.

Max Clark: And going back to the earlier part, right, the majority of the, you know, attacks that are taking place that you’re gonna get ensnared in are just automated looking for. You know, looking for easy, easy things and just don’t be the easy thing, right? Like Yep. You know? Um, now if you’re a bank, obviously, you know, you have to, you know, do more, right, right.

Defense contractors, you have to do more. Right. Man, I, you know, we’ve kind of gone all the way around in a circle and back. Um, I know, I know where to leave. This being the product at an MSSP or in the security ecosystem versus being in-house, like trade-offs, right? Because for somebody that’s getting started, you know, and, and looking at and saying, Hey, I want to, you know, I’m fascinated with this.

I like InfoSec, you know, I wanna get into InfoSec as a career. Should they, should they try to get in-house, you know, at a, an enterprise and come up through like the InfoSec ranks [01:13:00] inside of an enterprise? Or do you think it’s valuable for them to start an MSSP or, you know, a tooling product, you know, or how would you, I

Alejandro Ziegenhirt: think there’s so much value in, in both, right?

The, the draw of the MSSP is you’re going to get the experience faster. Because you are seeing more attacks, more incidents, more incident response is gonna be happening for you. It’s gonna be constant. For example, at my MSSP role, we were fielding 30, 40 incidents per day. You know, thousands of customers globally located, they were in various sectors, finance, defense, military.

Mm-hmm. Retail, e-comm, all of this, right? You’re gonna get that exposure very fast, um, at such a place, but your ability to make an impact will be somewhat diminished because you do not have sort of that insider workflow, tribal knowledge of how the company operates, right? So for [01:14:00] example, if a DDoS came in, yes, we were well positioned to stop such a thing, and you’re getting so much network security.

Uh, experience from doing edge security, right? But then other things like how to configure a cloud environment correctly, or how to set up email security and how to set up, you know, how to set up that sort of internal corporate security. You’re not really going to get that sort of exposure working for an MSSP.

You’re going to get a very large amount of sample, uh, experience and a small subset of security skills, which is the security skillset that the MSSP is providing, right? As an internal practitioner, you’re gonna have much less security events and incidents, hopefully.

Yeah.

And you’re going to gain that wider breadth of.

Experience, right? You’re gonna learn corporate firewalls. If you’re [01:15:00] on-prem, you’re gonna learn on-prem security, not just cloud and edge. Uh, you’re going to learn maybe sometimes some physical security, you know, key badges, man traps, et cetera. You’re going to learn how to set up internal logs. You’re gonna set up internal alerting.

You bring in Datadog or Splunk or any of these vendors as a team, you’re gonna learn how to set all that up from scratch. You’re gonna have tribal knowledge on CICD pipelines. Mm-hmm. So, and this is gonna be the opposite. You’re going to gain wide set of skills, but less experience with those wide set of skills.

So it really just depends on what you want to do. Do you wanna be a security generalist? Then I would go into a more of a corporate side of the house and do internal sec. And if you want to be highly specialized. Threat hunting, pen testing blue team only. I would go with the MSSP.

Max Clark: Okay. And then it also probably depends what that MSSP [01:16:00] is doing, right?

Right. If you’re talking about a solution that’s a, you know, secure email gateway, right? You’ve got a really specific domain that you’re dealing with. But

Alejandro Ziegenhirt: Yep.

Max Clark: You know, now if you’re talking about an MDR vendor, an XDR vendor with a sock on top of it, you know, those companies, those providers have all branched out and they’ll do a lot more things, right?

So you’ve got the EDR, you’ve got the network endpoint, you’ve got the sim, you’ve got threat intel. You probably have Vcso as a component on top of it as well, right? Like there’s. You know, they’re doing more for more people. Um, yeah. And, uh, I go back and forth, you know, like there’s, it’s nice to be like a journalist, like you see a lot more, I think your, your value as a journalist is really interesting.

But then also it’s really nice to, you know, if you have like a really defined swim lane, like, you know, and you talk about like these classic like IC roles, like it’s nice to go in and do a job, you know,

Alejandro Ziegenhirt: I think as you get more senior in your career, it becomes extremely important to specialize. The job descriptions that I’m seeing out there are becoming more and more targeted.

They’re looking for not just [01:17:00] InfoSec engineer, they’re looking for Akamai WAF engineer specialist. Mm-hmm. Right. And this is a very specific skillset. Right. And as a security generalist, that that role may not be. Suitable for you. Right? Another one, uh, we’re looking for a firewall. Engineers, uh, must have Fortinet experience.

Mm-hmm. 10 years Fortinet. Right? So, you know, the specializing thing as you become more senior or mid-level senior as an IC is very important. I think if your goal is to become an InfoSec leader one day, it becomes extreme. The most important to be a generalist, have your SME areas, of course, be it network SEC AppSec, or Enterprise sec.

But stay a generalist because one day you’ll be responsible for the full function and that encompasses all of the things. And you need to be able to talk the lingo and [01:18:00] know what you’re, what you’re directing.

Max Clark: I could keep going. But I’ve got everything on my list crossed off.

Alejandro Ziegenhirt: I wanted to ask you about this one better than I, than I thought.

This is great. So we have a nice chat here for sure.

Max Clark: It’s, I, you know, I, I think, I think we’re all, we’re all stop and just, just kind of ask you for some feedback on, right? Like, you know, it’s making that transition of saying like, we wanna buy a tool versus we want to implement a process or a program is, is a pretty, it’s always like this, this, there is always conflict with that, with within technology and within IT teams and within.

And what I’m really happy to hear a lot from, from you in doing this, which just how much of like this is really comes back to like people and what’s the people and what are you trying to do and how do you have to express this to people and what do you do about people? Yeah, I’m like, and and um, and I think the big misconception I see with a lot like both from IT and security is, you know, you hire me to do a job and I really desperately want to do the job you hired me to do, so let me help.

The organization [01:19:00] by doing the job you’ve hired me for, but like somewhere along the line that gets a little disconnected. It’s, uh, it’s, it’s un it’s sad for me every time I see that happen and, you know, I always like hearing conversations with people kind of recenter back around that again of like, no, you know, there’s people involved here.

You have to like,

Alejandro Ziegenhirt: yeah. For me it’s people, process and technology and the people component I think is, is the most important. Right. But of course, bringing in technology to force multiply the people. Right? So this all depends on, uh, again, your security profile, what you have to protect, et cetera. What ultimately, I think people are the most important part of the program, uh, until AI replaces all of us, of course.

Max Clark: And we just have AI battling out AI and we’ll still need people to like figure out what’s going on.

Alejandro Ziegenhirt: Yeah. But in the meantime, we had a solid run for sure before Skynet starts protecting, uh, you know, bank of America, how can I say?

Max Clark: Appreciate the time. This is great. Thank [01:20:00] you.