Fireside Chat w/Sara Hall, Deputy CISO and Head of SecOps & Engineering at MassMutual

[00:00:00] What's up, Dave? [00:00:13] Hey, how's it going? [00:00:15] It's going all right, man. [00:00:16] It's going okay. [00:00:18] Just trying to get this room set up this evening. [00:00:21] No worries. [00:00:22] I will be concurrently grading papers at the same time. [00:00:25] No, I hear you. [00:00:27] I literally just walked in the door of my house. [00:00:30] I want to say maybe about 10 minutes. [00:00:39] So how are you doing, man? [00:00:45] Dude, crazy. [00:00:46] Crazy, crazy, crazy. [00:00:49] Yeah. [00:00:50] It's been a busy week. [00:00:52] I'm getting my dates all confused. [00:00:54] I can tell you that much. [00:00:56] I thought this week was the 20th. [00:00:58] I thought this was the 25th was today. [00:01:01] I don't know why I was thinking that. [00:01:03] Yeah. [00:01:04] Wishful thinking. [00:01:06] I guess so. [00:01:07] Yeah. [00:01:07] I guess. [00:01:09] I guess. [00:01:10] All right. [00:01:10] Let me pin the link. [00:01:12] Okay. [00:01:14] Okay. [00:01:15] So what are we talking about today? [00:01:17] Let's see. [00:01:19] What are the options? [00:01:20] Stay mobile. [00:01:22] Topics. [00:01:22] Here we go. [00:01:23] We'll do some networking. [00:01:24] I'm sure we'll have some mentorship going on. [00:01:34] Maybe some leadership. [00:01:35] How's that? [00:01:36] That's not like the topics. [00:01:37] Sounds like a good start. [00:01:40] All right. [00:01:41] Did that work? [00:01:42] Yes, it did. [00:01:43] Hey, Sarah. [00:01:43] How are you? [00:01:44] Those are great. [00:01:44] Those are great hashtags. [00:01:45] Hey. [00:01:46] I'm doing well. [00:01:47] How are you? [00:01:48] I'm doing all right. [00:01:49] I'm Tomas. [00:01:50] It's nice to virtually meet you. [00:01:53] Nice to meet you too. [00:01:55] I'm going to make you a moderator. [00:01:58] So we'll get started in about three minutes or so. [00:02:03] So I put up your link there. [00:02:05] I don't think I'm actually linked with you. [00:02:09] Let's fix that. [00:02:11] Let's fix that. [00:02:12] Here we go. [00:02:13] All right. [00:02:13] I just sent you a request. [00:02:17] Mass Mutual. [00:02:18] Awesome. [00:02:19] Awesome. [00:02:19] Jim Ruff. [00:02:20] Did you work during that time period with Jim? [00:02:24] I did, actually. [00:02:25] I know Jim well. [00:02:28] I've known him for a long time. [00:02:29] And he announced his retirement on my first day. [00:02:34] So we didn't really need to stop much. [00:02:37] So as much as I've worked near Jim, [00:02:41] I don't know that I can say I officially worked with him. [00:02:44] Got it. [00:02:45] Got it. [00:02:45] I used to work with Jim when I was at J.P. Morgan many, many moons ago. [00:02:49] So. [00:02:51] All right. [00:02:52] Hey, Lisa Buff, how are you? [00:02:54] Russell? [00:02:56] Hey, hey. [00:02:57] Happy evening. [00:02:59] Happy evening, indeed. [00:03:01] Russell, quick microphone check for you. [00:03:03] There we go. [00:03:03] Loud and clear. [00:03:04] Great to see and hear everybody. [00:03:06] That's good. [00:03:07] That's good. [00:03:08] Octavia, how's it going? [00:03:10] Quick microphone check for you. [00:03:12] That's 1212. [00:03:15] 1212. [00:03:16] Who is this? [00:03:18] Right. [00:03:18] And Katie, I heard you. [00:03:20] And David is grading papers. [00:03:23] Everybody's busy. [00:03:24] But we will dedicate our time to chat with Sarah. [00:03:28] So, Sarah, we're just going to go through some, I'll call it a pre-show sort of guardrails as we get the room warmed up and ready for you. [00:03:36] We do have some folks in the audience. [00:03:38] Good to see everybody's icons. [00:03:41] I'm sure we will hear from them in a little while. [00:03:46] So, this is our weekly fireside chat. [00:03:48] Thank you all for taking time out of your day and out of your week to join us. [00:03:53] This is the middle of the week. [00:03:54] So, let's have a good time. [00:03:55] Let's have fun. [00:03:56] This should be a very good and fun conversation. [00:03:59] We'll run to about 9.30 p.m. Eastern time. [00:04:02] So, about 90 minutes, an hour and a half, give or take a minute here or there. [00:04:10] If you are a first-time listener, which I don't see many, but there might be one or two. [00:04:16] If you're a first-time listener to our fireside chat, there's a little green house on the top left of your screen where it's right next to what says fireside chat. [00:04:22] It looks like a little monopoly house. [00:04:24] It doesn't actually give you money, but it does allow you to see who our upcoming guests are and also listen to the recordings and the playbacks. [00:04:32] So, if you'd be so kind to click that little greenhouse and join the fireside chat group, we would appreciate that because we'd love to have you part of the community. [00:04:44] Our opinions, at least for most of us, I don't know, David, does it still apply to you? [00:04:48] We'll get to that in a second. [00:04:49] But our opinions and comments are mostly our own and do not represent our current or prior employer. [00:04:55] So, please be mindful of that. [00:04:57] Please keep that at top of mind and under consideration. [00:05:03] If you do pop up on stage and join us to ask a question, we do ask that you please, if you are a vendor, please don't solicit us. [00:05:10] This is not the time or the place to actually sell us on your greatest idea, your product, your solution. [00:05:15] I'm sure it's fantabulous, but save that for another time period. [00:05:22] You can probably find us through the usual social media channels if you wanted to sell us on that and solve our world hunger problems. [00:05:30] World hunger being security problems in our or whatever problems we might have in our companies. [00:05:35] But again, this is a moment in time to really get to know Sarah, really get to learn about her and her experience. [00:05:43] So, let's use that as an opportunity for that. [00:05:46] So, I will go around the room. [00:05:48] Sarah, we'll leave you for last. [00:05:50] I'm Tomas Maldonado. [00:05:52] I'm the CISO for the NFL. [00:05:54] David, over to you. [00:05:56] Yeah, I'm David Kass. [00:05:57] I'm the global CISO for GSR.io. [00:06:00] We are a crypto market making company. [00:06:04] So, we are a little bit crazy right now. [00:06:07] But yeah, as Tomas alluded still, any opinion is my own. [00:06:10] I am a former federal appointee. [00:06:12] So, any opinion I express is mine and doesn't express that of my current employer or past employers. [00:06:18] So, Tomas, back to you. [00:06:21] Or over to me even. [00:06:23] Over to you, Katie. [00:06:24] Go ahead. [00:06:24] Hi, good evening, everybody. [00:06:27] I'm Katie Hannahan. [00:06:28] I'm the vice president of cybersecurity strategy for IT Savvy, a boutique SI out of Chicago. [00:06:33] Also, head their VCSO program and am a VCSO myself. [00:06:37] Over to you, Lisa Beth. [00:06:39] Hello. [00:06:40] Hello, everyone. [00:06:41] It's Lisa Beth Lentini-Walker. [00:06:43] I am the CEO of Lumen Worldwide Endeavors, which is a compliance ethics and corporate governance [00:06:49] consulting firm. [00:06:51] And I'm living my portfolio career best life as an author, law school professor, and business owner. [00:06:59] And my views tonight do reflect my own views. [00:07:03] But, you know, I'll keep with the trend here and turn it over to Russell. [00:07:10] Lisa Beth, you make me smile every time. [00:07:12] I, too, am living my best life as running my own company, founder and CEO of my company, Security Ever After, where I get to help people get promoted to CISO, get to do a lot of virtual CISO, teach with SANS, do stuff with Heinz, just all kinds of busy, cool things. [00:07:25] But the most important thing is to be able to have space like this every Wednesday night at 8 p.m. Eastern time. [00:07:31] And so much looking forward to learning from and being inspired by Sarah. [00:07:36] But most important, I have the privilege of handing it over to my dear friend, Octavia. [00:07:43] See, Russell and Lisa Beth are so articulate. [00:07:46] I'm a member of the CEO of the CEO of Equifax Canada, which is the regional CEO of the Equifax Global Program. [00:07:58] And my opinions represent my own and not of my employer or my future employers or past employers. [00:08:04] I'm also the founder of Equifax, a certified organization that supports, nurture and elevates black women in cybersecurity into leadership. [00:08:15] And I do a lot of other things, but I'm going to hand it over to Neil. [00:08:21] Thanks, Octavia. [00:08:22] This is Neil Varghese, virtual CISO, also the co-author of the CISO Mentor. [00:08:28] Back to you, Tomas. [00:08:30] Sounds good. [00:08:31] Thanks. [00:08:31] Thanks, team. [00:08:33] Thanks, moderators. [00:08:33] And welcome again to those who have joined us this evening. [00:08:37] So, Sarah, we're honored and privileged and happy to have you as part of our weekly fireside chat and our guest in the hot seat. [00:08:47] So I will ask you the first question that I typically ask our guests just to open up the event. [00:08:53] And that's, why don't you take a moment and tell us a little bit about yourself by way of an introduction. [00:08:59] And while you're doing that, why don't you tell us a bit more about you and your origin story? [00:09:06] Because we're all superheroes here. [00:09:08] And I'm curious, you know, at least I would hope we're all curious as to how you kind of got your start. [00:09:14] Where did you start from? [00:09:15] What motivates you? [00:09:16] What drives you? [00:09:17] What drives you? [00:09:18] And what sort of keeps you going every day? [00:09:21] So if you can start maybe with an intro and then bleed into your origin story, that'd be great. [00:09:25] Happy to have you go through that. [00:09:28] Thank you. [00:09:29] Sure. [00:09:29] Awesome. [00:09:30] I have a question first, though. [00:09:32] How many people answer that question with being bit by a radioactive spider? [00:09:38] Not as many. [00:09:40] A lot. [00:09:40] Not as well. [00:09:41] A lot. [00:09:41] A lot? [00:09:42] I would say not as many as you can. [00:09:43] I'm going to say a lot. [00:09:45] Totally a lot in this profession. [00:09:47] Yeah. [00:09:48] Well, I should have thought up a better origin story then. [00:09:52] But yeah, so I'm Sarah Hall and I'm the deputy CISO and the head of DevSecOps and security operations at MassMutual. [00:10:03] I've been there about a year and a half. [00:10:06] And I've spent, this is actually, I was in healthcare for most of my career. [00:10:12] So this is kind of my first foray into the financial services sector. [00:10:17] So it's been fun to get to know this space, though I do miss healthcare quite a bit. [00:10:22] Yeah. [00:10:24] Yeah. [00:10:24] So I think I might need you to go back through the questions one by one so I can sort of address them. [00:10:33] What did you ask first? [00:10:35] No, no. [00:10:35] No. [00:10:36] So it's really just tell us a bit about your origin story. [00:10:40] Like what motivates you, what drives you, what brings, what, you know, just walk us through kind of your, you know, as young as you would like. [00:10:49] You know, you can go back as young as you would like. [00:10:52] But really what our guests usually, sorry, not what our guests, what our audience members usually take away in that sort of origin story journey or path, if you will, are really key pieces of information that helped you get to where you are today. [00:11:05] Because I think, you know, you're a deputy CISO and we've had other folks who have either been CISOs or CEOs or lawyers. [00:11:14] And what I've found, and I'm sure others have found this as well, is there's not really a direct path to you getting to where you are. [00:11:21] And it's always some sort of windy route. [00:11:24] So that's really what we're after because I'm sure that'll resonate with a lot of people. [00:11:29] Sure. [00:11:29] Okay. [00:11:30] Go ahead. [00:11:31] Yeah, no, that sounds great. [00:11:32] And I guess some of my, actually starts with my mother. [00:11:37] She was a computer science major, certainly at a point where, you know, she was the only woman in her program. [00:11:44] And so I think she was definitely, you know, an inspiration in that way because I certainly saw her and I saw her working in a technology field. [00:11:56] And that was an option for me, right? [00:11:58] Because I had that as a role model. [00:12:02] But I also saw myself as different from her. [00:12:06] She's very analytical, though those of you who know me in this room know that I am also very analytical, but I'm not sure I saw myself that way at that time. [00:12:14] So I went to undergrad as an art major and I was majoring in painting. [00:12:20] And I really just, you know, wasn't really sure what I wanted to do with my life. [00:12:26] And I took a few computer classes and ended up just shifting to a degree in information systems. [00:12:34] And, but, you know, I never really, I didn't have a plan. [00:12:37] And I kind of just, you know, went into a job in IT, some database work. [00:12:46] And in probably 2003, I guess, that's when a lot of us were getting repurposed into cybersecurity. [00:12:55] And once I kind of moved over there, I felt like that was the first time I felt like I really had a passion for what I was doing. [00:13:02] And I cared about the mission of the, the, of cybersecurity. [00:13:07] And, and I really just kind of got into it. [00:13:10] And of course, there was so much space back then because nobody, you know, you didn't go to college and major in cybersecurity like you can now. [00:13:18] So, so, but I was working for Booz Allen at the time. [00:13:22] And that was also a great place because there was just so much work to be done and so many different clients to support and different unique problems to solve. [00:13:31] And that's, for me, that's, that is one of the big drivers for me is I love solving problems. [00:13:37] And I also love being able to tie the importance of what we do into the mission. [00:13:45] And I think that's part of why I loved working in healthcare for so long too, because that's a, it's a mission that touches everyone's lives. [00:13:53] I mean, you, you have your own health to care about, you have your family's health, and it's just something that's very personally relatable. [00:14:01] And so it always very much felt like, you know, what we were doing helped support a mission that mattered. [00:14:09] So I love doing that. [00:14:11] I love inspiring teams around the mission and how we play a role in the purpose of the company. [00:14:16] And, you know, and, and then working with the business. [00:14:19] That's the other thing. [00:14:20] I think it's interesting to see how the cybersecurity industry has evolved over the last 20 plus years. [00:14:28] Because I think at that time it was, you know, there was a lot of compliance coming into place and trying to convince people that security needed to be done. [00:14:38] And it really was an uphill battle. [00:14:41] And not that it isn't anymore, but it's at least people acknowledge that, you know, we need to protect our business. [00:14:49] But I've always loved being able to have those conversations, try to understand what the business is doing, hear what they're trying to do, and how we can work with them to partner towards a mutually beneficial outcome. [00:15:01] And try to educate them on security, you know, at the right time, in the right ways to be able to influence them and, and help them invite us to the table early on. [00:15:11] So, I, you know, and I think some of those skills I learned, well, honestly, my mom, these are the conversations my mom and I would have in the car on the way to a softball game. [00:15:23] She'd be talking to me about something that was going on at work and how she, you know, how she was handling the situation. [00:15:29] So, I feel like I had an executive coach when I was, when I was very young. [00:15:35] But Booz Allen was definitely about investing in their people and training. [00:15:40] And so, I, I was certainly lucky to be there at a very formative time in my career. [00:15:44] And I learned how to, you know, just talk to people and talk about the business and, and the why behind the things we were, we were doing. [00:15:53] So, after that, I left there and I went to work for the federal government for one of my clients at the Department of Health and Human Services. [00:16:04] And actually spent six years at HHS and ended up as the CISO at HHS. [00:16:12] And it was, that was an interesting, I, I was the deputy CISO before I was the CISO. [00:16:19] And I think I enjoyed being the deputy more than I enjoyed being the CISO. [00:16:25] As you know, the CISO job is certainly, you know, it's, it's, well, I guess I would say it's different everywhere. [00:16:34] Because I, after I left HHS, I went to a biotech called Human Longevity. [00:16:40] And we did a lot of really fascinating genomics work and researching and sequencing a whole, the whole genome. [00:16:50] And it was a fascinating company to work for. [00:16:52] And that was probably my favorite job that I've ever had. [00:16:55] So, I was the CISO there as well. [00:16:58] And, and those two CISO jobs couldn't have been more different. [00:17:01] I really felt like at the biotech, I was able to have a lot of flexibility and shape the program and, and truly do risk management, you know, risk, risk-based security and work with the business and figure out what was the right level of security for the products we were trying to deliver. [00:17:24] And, and, and really had the right kind of positioning and, and influence there. [00:17:32] And then after the biotech, I went to, I actually went to the Health ISAC and I was the chief operating officer at the Health ISAC. [00:17:41] And the ISACs, I think most of the folks here probably know what an ISAC is, but there is an ISAC for every critical infrastructure sector and a few other sectors as well. [00:17:54] But they're primarily based around threat intelligence sharing within that sector. [00:17:59] So threat intelligence that's specific to threats to that sector, but most of them provide a lot of other services. [00:18:06] And I think one of the greatest things about the ISACs is that it's a community. [00:18:10] It's a community of people in your industry, a community of your peers and a great way just to, to network and share information. [00:18:19] So I was already very passionate about the ISACs and had been a member. [00:18:24] I was on the board of directors of the ISAC when I was at the biotech and we were actually doing a strategic planning session and decided the next thing for the ISAC would be to bring on a chief operating officer to help us be able to scale with the growth that we were experiencing. [00:18:42] So I went and did that for three really amazing years. [00:18:46] But the pandemic was challenging for everyone. [00:18:51] And I had moved out to San Diego for the biotech job. [00:18:55] So decided it was time to move back to the Northeast. [00:18:59] And so I started job searching for an opportunity that would actually move me back. [00:19:04] And that's how I ended up at Mass Mutual. [00:19:06] And I've been here about a year and a half now. [00:19:08] And it's a fantastic company. [00:19:11] It's definitely a company that cares, cares very much about its people and its, its policyholders. [00:19:19] And I guess that's the theme that's kind of gone through this is like the, the mission matters quite a bit to me. [00:19:25] And, you know, it's what helps me stay very passionate about the work that we do and being able to, to strategically tie what we do into the mission of the organization. [00:19:39] So I guess that's my origin story. [00:19:46] That's awesome. [00:19:47] David, I'll pass it over to you. [00:19:48] Oh, sure. [00:19:49] Thanks. [00:19:49] Yeah, no, that, that's a great background. [00:19:51] And, and, and, you know, should you ever decide you want to come over to the dark side with crypto is actually higher. [00:20:00] Yeah. [00:20:00] DevSecOps like yesterday, but, you know, that's great. [00:20:04] And especially, you know, with your background in DevSecOps, could you speak to, I guess, you know, what are the, like the key challenges to how you get that right in organizations, especially, you know, from that security perspective, because it's much easier said than done. [00:20:18] Yeah. [00:20:20] Yeah. [00:20:22] That, yes, that is absolutely true. [00:20:25] And I think it's a challenge. [00:20:27] One, one thing that we're kind of focused on right now is also just getting a consistent definition. [00:20:33] So people use the term DevSecOps, but when you actually get down to asking people, okay, well, what, what is that to you? [00:20:41] You ask 10 different people, you're going to get 10 different definitions. [00:20:45] So where we are right now is really kind of trying to just scope and define not only what we mean by it, but what we can realistically accomplish in the organization. [00:20:56] And I have a fantastic leader who works for me, who has, her name is Susan Jackson. [00:21:02] She has a lot of depth of experience in this space and has been a great thought leader. [00:21:10] And together we're just shaping, you know, where do we want to go both from an automation standpoint in how we focus on leveraging the technologies to make development easier and, and to add security and, you know, shifting left and trying to. [00:21:33] You know, get security built into the DevOps process overall, but then also focusing on the cultural aspects of it. [00:21:42] Right. [00:21:43] Because a lot of it is just about. [00:21:45] The mindset and, and not only bringing security to the table, but that ownership of it's not just the responsibility of the security team, but everybody needs to be a part of it. [00:21:57] So we're doing a lot of things very much in, in that part of the work focused on our software security group, focused on the development teams. [00:22:07] We've got some great training programs. [00:22:09] Of course we've got, you know, a security champion program. [00:22:13] We've got the champions out in all of the different development communities, but also just, you know, figuring out how we best support them. [00:22:21] But engaging them too, so letting them know what we're trying to accomplish and why and getting their feedback on how we can best do that. [00:22:31] So we're rolling out different tools to help, you know, look for secure coding, look for, or look for errors in secure coding, looking for vulnerabilities and things like that. [00:22:46] You know, they're bought in before we're at the point of actually implementing the tools that we're going to use to support them. [00:22:52] So it's, I mean, it's a, you know, it's a, it's a marathon. [00:22:57] Definitely. [00:22:59] Everybody's got a lot going on. [00:23:00] And of course the development teams have got products they've got to produce, but I think I'm very fortunate here at Mass Mutual because we've got a lot of, you know, support for doing the right things. [00:23:09] And I think that's, that's something that's really important in the company is you've got to have, you know, you've got to have understanding up through the top leadership of the importance of doing this, because there are always going to be those decision points. [00:23:25] And you need to know that the right people are going to be informed about the actual business risk that security introduces. [00:23:39] There's some great points. [00:23:41] Thank you for sharing those insights. [00:23:43] Katie, over to you. [00:23:45] Well, thank you. [00:23:46] I just feel like full disclosure. [00:23:48] I have to say that, you know, Sarah and I are friends and we, actually, I was trying to figure out who was the first one who got onto Clubhouse and I looked at your profile. [00:23:58] I think it was me who convinced you. [00:24:00] Yeah. [00:24:01] Yeah. [00:24:01] And then we ended up, we started our own room maybe in April of last year and we had three people in it and it was a fun experiment. [00:24:09] And it was a great night actually. [00:24:11] I think we had four. [00:24:12] I think there were four. [00:24:13] You know, we did. [00:24:14] And I know who, I know who every one of them are actually. [00:24:17] It was great. [00:24:18] And it was great. [00:24:18] And so, yeah, so Sarah and I have known each other for a while too. [00:24:21] And, you know, in your origin story, you talked about, you know, being a part of HHS and being a part of the, you know, Health ISAC. [00:24:29] That is exactly where, you know, you and I met. [00:24:32] And I have to say, you know, too, I didn't know that as much as I, when you mentioned your mother earlier, you know, it's helpful because for someone like me, when I had a seat at the table with you, [00:24:44] and since we're with Tomas and with the community of people who know the New York CISO community, you know, where I was sat, you know, literally between Jim Routh and Steve Katz. [00:24:53] And then you were across from me and I was thinking, how did I get a seat at this table? [00:24:57] But you had the seat at the table and you were confident and you're in it. [00:25:01] And I thought, so can I. [00:25:03] So, you know, you being a few years ahead of me in your career, that actually was a huge moment for me. [00:25:08] So I just wanted to call that out even kind of publicly because I think it's so important that, you know, we're given those seats. [00:25:16] And mine was at a literal table when I met you. [00:25:20] But, you know, it's just a really important thing to, you know, as we traverse this cybersecurity landscape that we're in. [00:25:28] So, but how far we've come though, huh, Sarah, from our first room. [00:25:31] This is so much better. [00:25:33] All these amazing moderators on the stage were wondering, well, what question are you going to ask, Katie? [00:25:37] Well, so what I was going to ask is, you're kind of back to the mission. [00:25:44] And one of the hardest things that I find, you know, both as now a practitioner as a VC, so, and then also, you know, working for an SI and you have the background at Booz Allen. [00:25:54] You know, how do you really, really marry the mission with the business? [00:26:00] I've witnessed you do this so well within the healthcare community. [00:26:03] I, you know, know you're doing it at Mass Mutual, you know, now. [00:26:08] But how do you get everybody involved from a cultural perspective? [00:26:13] That's the hardest part that I've found in, you know, going into organizations and trying to figure out how do I marry the mission to the business and then create a culture? [00:26:23] And I would love to know some insights that you have around that. [00:26:29] Yeah, that's a great question. [00:26:31] I mean, I honestly, I think listening is key, right? [00:26:35] Especially when you're working with the business. [00:26:37] If you're walking in there intent on accomplishing, communicating something to them by the time you walk out of the room, you're really, you know, you're going to distract yourself on, have I just made them understand the thing I want them to understand? [00:26:55] But if you're focused on hearing from them and really trying to understand what their priorities are and what a, you know, a day in their life is like, then you start to find some common ground. [00:27:10] And you will absolutely be able to find some common ground to connect on and say, wow, yeah, we deal with, you know, that kind of thing, too. [00:27:19] It just looks a little different here. [00:27:22] I see how you care about the thing that you're doing, right? [00:27:25] And you'll find those ways to weave the security in. [00:27:32] And we had a great conversation at a Health ISAC event once there was a woman who has really become active in that community. [00:27:41] She's a former nurse. [00:27:43] And she just got really passionate about cybersecurity because she saw the cybersecurity folks at the hospital where she worked making the same mistake over and over again. [00:27:55] You know, they were just the, they were the no people, right? [00:27:58] They kept telling people, you can't do that. [00:28:00] And, and she realized, I don't, I don't remember exactly how she came to this conclusion, but she just realized, wow, what they're saying is really important. [00:28:09] How they're doing it is totally wrong. [00:28:11] They're not speaking doctor and nurse. [00:28:14] And so she actually now goes around and talks to all of these cybersecurity teams and talking to them about how to talk to doctors and nurses and start with, [00:28:22] I, I, I have a, a patient safety concern that I think you might've overlooked. [00:28:31] Would you be willing to hear me out? [00:28:33] And that was her advice. [00:28:34] And it was so simple, but it turned it back into putting it into their terms, you know, putting yourself into their world instead of coming to force your world on them. [00:28:46] And, and, and I just, I think that that goes a long way, right. [00:28:50] In trying to, for, for the communication piece that you asked, as far as building the culture, you know, I think you, you have to start with, you know, a team of people who are willing to do that. [00:29:02] And so that is something that, you know, is, is always important for me and modeling that. [00:29:10] And then also, you know, making sure that, you know, the, the teams who support me understand that that is, you know, that's, that's how I expect us to operate and that I'm only one person. [00:29:22] Right. [00:29:23] So the entire team needs to be trying to model that approach and understand why, why that's important because every one of us is representing the team as we go out there for the various things that, that we do. [00:29:35] So, you know, I think it, it's, it's also just, it doesn't even matter if it's security, right. [00:29:41] This is something that lets us all get along in the workplace, right. [00:29:44] When we're building relationships, we're listening to other people. [00:29:48] We're not just trying to push our own agendas. [00:29:50] That does not mean don't be efficient. [00:29:54] I'm definitely a fan of being very efficient and, [00:29:58] and getting to the point and getting things solved, [00:30:01] but there's a time and place for the relationship building and you know, [00:30:05] and, and, and listening to what's happening in a conversation and trying to you know, [00:30:12] identify whether somebody is just not, [00:30:15] It's not that they're not willing to buy into what you're talking about, but they aren't feeling like their situation is understood or that they're not heard. [00:30:26] And they need to feel heard before they are going to, you know, invite you into their world or let your needs be part of their world. [00:30:36] Yeah, I really appreciated what you said, particularly around the no people, because every organization has those no people who are perceived as no people. [00:30:45] But they're not. They're really just there trying to do the best for the mission and to stay centric to the mission for the most part. [00:30:53] And so, yeah, being able to somehow figure out the function and understanding and make sure that those people are heard. [00:31:02] Yeah, that's something that I struggle with. And I think everyone on this stage, I'm sure, struggles with is figuring out where no is someone needs to be heard and not an obstacle because it can be frustrating sometimes. [00:31:14] But, you know, there is a process and there is a way that, you know, within a culture, within a company that things need to be done. [00:31:21] And so I appreciate that. So with that, I'm going to hand this over to my colleague, Lisa Beth, who is one of the best communicators that I know. [00:31:30] Aw, you're making me blush. [00:31:34] Thank you very much. It's so nice to meet you, Sarah and Katie. [00:31:38] Thank you for the compliment. One of the things that I'm really interested in is I loved the story about how there was a literal table that Katie was looking for a seat at and that you had a seat at. [00:31:56] So one of my questions for you is, you know, as we continue to progress on our career journey, whatever that may be, how do you bring people along and mentor people along the way so that they can find their voices and their seats at the table wherever they go? [00:32:18] That's a great question. That seems like it's been a theme this spring for me. [00:32:24] I was actually on a panel at FSISAC and we talked about mentorship quite a bit. [00:32:31] So I think it's really important because, you know, there are not enough people in cybersecurity and we need to bring the next generation along. [00:32:43] So I think about mentorship, it doesn't need to be a formal thing, whether it's just a conversation because somebody needs advice on a topic or whether it is a full-fledged formal mentorship. [00:32:56] We actually are doing an early career rotation program in MassMutual that's kicking off in a couple weeks. [00:33:02] And so we have the set of our interns who worked for us last summer who came on board are doing these eight-month rotations through very different disciplines within the cybersecurity program so that they get to try out different things and work for different leaders and learn different types of things. [00:33:21] So I'm really excited about that for them. [00:33:24] But then they've each been assigned a mentor who will follow them throughout their entire rotation so that they've got some consistency there, despite whoever their direct supervisor is for eight months. [00:33:40] So I am getting to mentor somebody through that. [00:33:45] And it's a pretty fun, you know, especially to see someone who's just out of college. [00:33:52] And I don't feel like I'm that old, but now I'm suddenly feeling much older. [00:33:59] One of the things that I have, though, I started doing because so many people had asked me throughout my career to mentor them. [00:34:04] And whether it's just one discussion or a more formal thing, I heard myself saying the same things over and over again, talking about the same topics. [00:34:13] And sometimes I would say something in passing that I didn't think was that big a deal. [00:34:17] And then the person would say, wow, that was so profound. [00:34:21] Or I've had people come back to me and say, that thing you said, I don't even remember saying it. [00:34:26] So I started a deck, I actually put together a mentor deck where I just some of them are just slides with a title and others are more built out than others. [00:34:37] But so I've just put together a collection of my thoughts. [00:34:40] And so a lot of times if someone asks me to mentor them, I'll just send them the deck and say, what of these topics or something else is interesting to you? [00:34:50] So that's been helpful. [00:34:53] But I think, you know, as far as getting a seat at the table, I, you know, for me, I fought it very hard when I was at, well, actually a couple times in my career at Booz Allen. [00:35:08] I was promoted into executive leadership when I was 29 years old and I didn't think I was ready. [00:35:17] I definitely thought it was just a fluke. [00:35:21] And somehow I did that job for three years and just the whole time I just felt like an imposter. [00:35:28] But I kept, kept, just kept doing it. [00:35:30] And, you know, it, but, but similarly when I was at HHS, you know, the, the CISO left and I really wasn't sure whether I wanted to apply for the job or not. [00:35:46] And I just kept thinking, I'm not qualified. [00:35:49] I'm not qualified. [00:35:50] Right. [00:35:50] And I had a mentor who, are we allowed to swear in this room or should I, should I bleep myself? [00:35:58] I don't know that there's a requirement not to. [00:36:02] Yep. [00:36:02] Yep. [00:36:02] 100%. [00:36:03] All right. [00:36:06] So my, I had been kind of going on this, I don't know. [00:36:09] I don't know. [00:36:10] And he finally said to me, Sarah, would you rather work for the asshole or be the asshole? [00:36:19] And I don't know if somehow I was like, oh, okay. [00:36:23] Yeah, I guess, I guess I'll be the asshole. [00:36:25] And so I applied and I got the job and, you know, and then, but one of the things that happened, because the other thing that he had, the other piece of advice he had given me was, you know, even if you hate the job and you don't end up staying there, take the job. [00:36:43] Because once you're in the role, he said, it, it shouldn't matter, but it does that you'll get invited. [00:36:50] You'll just, you'll get invited to other, to CISO events and you'll meet other CISOs and you'll start to learn what they're thinking about. [00:36:57] And he was exactly right. [00:36:59] And Tomas, you mentioned Jim Routh earlier. [00:37:03] He was one of those folks I had met around that time and he, you know, I had just become a CISO. [00:37:09] And so he said, oh, well, let me introduce you to all these other CISOs as Jim does. [00:37:14] And suddenly I started talking to these people and I started realizing, oh, they're not any different than me. [00:37:22] You know, they have had a lot of similar experiences and they're thinking about a lot of similar things. [00:37:28] And so I, for me, that's always been that, that was really a, a career changing moment. [00:37:37] And that mentor of mine, I'll always be grateful that he pushed me. [00:37:41] And so when I'm mentoring others who are doing that same kind of waffling, that's one thing I'm always looking for is, are they holding themselves back in a way that they don't need to? [00:37:53] And do they need that push? [00:37:54] And I love to get people connected with other people because they just start, you know, and you just start having conversations with more people and you start realizing I can be at this table. [00:38:06] And in the case of the table that Katie and I were at, there might have been some wine on that table as well. [00:38:13] Wine is always a good thing, right, Katie? [00:38:15] Always. [00:38:16] Yeah, I always recommend it when in San Francisco or even on a fireside jet. [00:38:21] Like, and when you're, and when you're surrounded by a bunch of other seesaws, it's definitely some more wine. [00:38:27] Yes. [00:38:27] Well, and we all know, I mean, Mr. Ralph, I mean, come on. [00:38:30] I used to think that I knew what good wine was until I met him. [00:38:34] Oh, no. [00:38:35] Yeah. [00:38:35] Well, it's all over. [00:38:41] I love it. [00:38:42] And I love the quote, like, are you going to be the asshole or are you going to follow the asshole? [00:38:49] I think that's a wonderful one. [00:38:51] Yeah. [00:38:52] So, Tomas, do you want to read? [00:38:54] Yeah, I was just going to either ask you to do it or I would do it. [00:38:59] But since I've got the mic, just a very, very, very quick room reset. [00:39:03] If you are new to our fireside chat, we do this every single Wednesday between 8 p.m. Eastern time and 9.30 p.m. Eastern time. [00:39:10] We're going to ask Sarah questions to maybe about another 10 more minutes or so. [00:39:14] So, I do see some folks that did raise their hand. [00:39:16] We'll bring you up on stage in a few minutes and just bear with us. [00:39:19] I'll pass it over. [00:39:20] Lisa, were you next? [00:39:21] If you were, go right ahead. [00:39:23] Just ask the question. [00:39:24] So, I think it's Russell's turn. [00:39:26] There it is. [00:39:27] That's what happens when I start. [00:39:28] My old age is kicking in there, Lisa. [00:39:30] Go ahead, Russell. [00:39:32] Yeah, those words get in a way sometimes, Tomas. [00:39:34] Hey, no worries. [00:39:35] We got you. [00:39:35] Sarah, just loved what you shared with us the last 35 minutes. [00:39:39] What a diverse career you've had, health care. [00:39:41] I miss financial services. [00:39:43] I'm cheering for you in financial services. [00:39:44] It's just so cool. [00:39:46] But my question is, you know, out of your career, the things that you've done, can you [00:39:49] tell us what's been the best advice, not that you listened to from someone, but that you [00:39:54] listened to some advice and you actually took action and kind of what the impact was of [00:39:58] that for us and the audience today? [00:40:02] Oh, gosh. [00:40:03] Huh. [00:40:07] Huh. [00:40:07] That's a great. [00:40:11] That's a great question. [00:40:13] Let's see. [00:40:14] So, I think, you know, one of the, I don't know if this is the best piece of advice. [00:40:24] This is just kind of what comes to mind. [00:40:26] But early on, when I was at Booz Allen, I was on a great team, really great team dynamics. [00:40:39] I liked the people. [00:40:41] I liked my manager. [00:40:43] But I was supporting a manager for the client project that I was on. [00:40:48] And he was newer into his role at the level that my manager was. [00:40:57] And he was really building his team. [00:41:00] And one of the pieces of advice, because I was trying to decide, he was asking me to basically [00:41:04] move over to his team. [00:41:06] And I was trying to decide, well, you know, I'm on this great team. [00:41:09] We've got a great team dynamic. [00:41:10] He doesn't really have a team, but there's opportunity there. [00:41:13] And a piece of advice that I got was to go where the opportunity was. [00:41:20] And that was the best decision that I made. [00:41:22] Because my manager at the time, like, she and I are great friends to this day. [00:41:28] And, but she had her, she had her people, right? [00:41:31] She had her second team. [00:41:33] She had her go-to folks. [00:41:35] And I was just one of many. [00:41:38] Whereas this new manager was building. [00:41:42] He needed his people, you know, that he was going to rely on. [00:41:46] And so I ultimately, I made, because of that advice to follow where the opportunity was, [00:41:51] I made the move and I went over to his team. [00:41:54] And I, you know, I was thrown into so many different situations where I really, [00:42:00] I didn't know what I was doing going in, but I figured it out. [00:42:03] And there was just, there was so much opportunity just to fill need that was there. [00:42:09] And I grew faster in my career than I ever had before. [00:42:14] And so I thought it was a great piece of advice. [00:42:16] And that's actually one of the pieces of advice in my mentor tech, right? [00:42:21] Is to follow the opportunity. [00:42:24] Yeah. [00:42:25] So I think that was, it may have been the best advice I've gotten. [00:42:29] Oh my God, Sarah, I literally was writing it down. [00:42:33] I see some folks have shared that in the halls of Clubhouse Go where the opportunity was. [00:42:39] And then the impact you said there was, and I grew faster. [00:42:42] I'm like, oh my God, I'm so glad I asked that question. [00:42:45] I'm so glad you shared with me and everyone here in the room and on the replays as well. [00:42:49] That was my drop moment. [00:42:51] I'm grateful. [00:42:52] And I thank you. [00:42:53] And all I can do is hand it over to my friend, Octavia. [00:42:55] Octavia, it's all yours. [00:42:59] Thanks, Russell. [00:43:00] Hey, Sarah, it's super nice to meet you. [00:43:03] I'm excited about your story. [00:43:04] I think I want to click down a little bit on the advice, but kind of from a different situation. [00:43:12] We all, you know, all of our parents give us advice all the time. [00:43:15] And sometimes we listen and sometimes we don't. [00:43:18] But it seems as if your mother kind of, you know, was in a position where she can actually be your first mentor. [00:43:26] And so I know how I am with my mom. [00:43:29] And so I'm wondering, what is some advice that your mother gave you early on in your career that you thought you could not use or you thought you was going to get in trouble about? [00:43:40] Or you just thought that that's just not how these things work. [00:43:44] But then when you went into leadership, you realized that you can actually use that advice. [00:43:50] Hmm. [00:43:53] Well, that's an interesting question. [00:43:55] I, for me, and I think my relationship with my mother, and I'll be open here because my mom's not on Clubhouse. [00:44:07] And she won't, she won't hear this. [00:44:11] But she, you know, she was a great mentor. [00:44:17] She's not the most nurturing person in the world. [00:44:20] So we had, I mean, my mom, I have a great relationship with my mom. [00:44:23] I'm definitely not saying I don't. [00:44:26] But she, I think she gave some good career advice. [00:44:31] But I would say actually the converse happened because a lot of times she would give me more situational advice. [00:44:37] I wasn't sure how to deal with this situation. [00:44:39] She would help me think about it. [00:44:41] And what I really appreciated was how much she taught me how to think through a situation. [00:44:48] And she would certainly give me advice on how to handle it. [00:44:51] But I think that was probably the most useful thing that she did. [00:44:57] But one piece, and if, so if you don't mind, because I'm going to change up what you asked a little bit, because I'm going to go the other direction and say the thing that she had kind of conveyed to me that I decided later wasn't useful. [00:45:12] You know, she was in this generation of, you know, she was the only woman the majority of the time. [00:45:24] And I think in order to survive that, she definitely assimilated into the culture of where she was. [00:45:33] And she had a bit of an attitude of other women are the problem. [00:45:39] Right? [00:45:39] And so I came to, I went through my own journey with this. [00:45:45] And, you know, at first I kind of just didn't think much about it. [00:45:50] And then I had a great friend who pointed out to me that I was basically doing that in some situation. [00:45:59] I was saying, well, that person should just, you know, kind of adapt their behavior basically to kind of fit in with the culture. [00:46:09] And my friend said to me, really? [00:46:12] I mean, don't you think maybe the culture is wrong? [00:46:15] And it was like this eye-opening moment for me when I realized, wow, I'm just kind of doing the same thing that my mom did. [00:46:25] I'm just trying to assimilate into the culture rather than sort of calling out if there's an issue. [00:46:32] And I realized at first, so then I kind of went through this phase of like being frustrated that she had that attitude. [00:46:41] And then I came to the realization that that was how she survived. [00:46:45] Right? [00:46:45] Is she was definitely giving off the, it's okay to accept me here because I'm not one of those women. [00:46:53] Right? [00:46:53] I'm not going to be emotional in the workplace. [00:46:56] I'm not going to bring up women's rights. [00:46:58] I'm going to, you know, just focus on the work and not that there's anything wrong with focusing on the work. [00:47:04] That's definitely good. [00:47:06] But I didn't, you know, that's the one thing that I've, you know, I've still to this day, I've had a hard time talking to her about because I understand that it was a very different experience for her than it was for me. [00:47:18] And it's a different experience for younger women today than it was for me. [00:47:24] Right? [00:47:25] And we keep making a lot of progress and that's great. [00:47:29] So I certainly understand, you know, the things that she did to her servant. [00:47:33] But once I had, you know, I'm so grateful to that friend who called out my own perspective on it and made me take a tough look at myself. [00:47:42] And it opened my eyes and I'm just much more conscious of it. [00:47:49] And before that, I also, I didn't want to participate in women in technology events and things like that. [00:47:56] I just wanted to focus on the work. [00:47:58] And so now, you know, I've become much more of an advocate for that. [00:48:05] And that's been, you know, much more fulfilling for me as well. [00:48:10] So I realized I didn't, I kind of went the other direction there. [00:48:13] I didn't really answer your question, but hopefully. [00:48:15] Hopefully. [00:48:16] No, it's great. [00:48:17] Either way. [00:48:19] Right? [00:48:19] Like I said, I remember when my mom gave me advice when I was initially coming up in the industry. [00:48:27] And I'm like, Ma, you know, we can't, we can't really do that. [00:48:30] Right? [00:48:31] Like, you don't understand. [00:48:32] And then as I got older, I was like, huh, maybe, you know, maybe I can't say it the same way. [00:48:38] But, you know, we can do it. [00:48:39] But yeah, definitely even things that, that might've worked for you early on. [00:48:44] When you get into leadership, you realize you have more of an influence. [00:48:48] Absolutely. [00:48:48] And that carries a big weight. [00:48:50] So thank goodness for friends, right? [00:48:52] Yeah. [00:48:52] Yes. [00:48:53] Keeping us accountable. [00:48:55] Absolutely. [00:48:57] No, thank you for that. [00:48:58] Anil, over to you. [00:49:01] Thanks, Xavier. [00:49:03] Sarah, definitely appreciate you sharing insights and story to background. [00:49:07] You know, one of the things that, you know, helps mold and shape our career paths are some of the challenges we faced or those challenging environments that, by the crucible that we come out of. [00:49:20] Can you share, convey some of those lessons learned from some of those harder or tougher experiences through the course of your career? [00:49:28] Oh, my goodness. [00:49:29] Where do I start? [00:49:32] So, yeah, I think it's, oh, God. [00:49:37] Oh, gosh. [00:49:38] Actually, some of the best examples I don't think I can talk about publicly. [00:49:41] But I will say some of them have to do with some of the politics of working in government, right? [00:49:54] But some of the things I learned through that translate through many jobs where one of the things, and this actually got a slide in my mentor deck, but is looking for where the real power is in an organization. [00:50:16] So there's a couple of things. [00:50:18] One, you know, where does the money come from? [00:50:20] One, you know, is locally as how is the cybersecurity program funded? [00:50:28] What are the funding sources? [00:50:29] And understanding who is making those decisions? [00:50:33] And how do you need to be ahead of that to be able to influence to have the money that you need for the cyber program? [00:50:40] But where is the power, right? [00:50:42] Who's making the decisions? [00:50:44] And when I was at the biotech company, one of the things that I was paying attention to was there was leadership team. [00:50:52] And then there were the people who, when the leadership meeting ended, didn't leave the CEO's office. [00:51:00] That's where the power was, right? [00:51:02] Those were the people who were the true influencers who were staying behind to recap what had just happened in the leadership meeting. [00:51:08] And so I've seen this happen in some high profile things where, from a cybersecurity perspective, that one time I got called in actually to overhaul something because the prior leader had basically been putting a chart in front of the leadership that was just green. [00:51:33] It was green across the board. [00:51:34] And, you know, and it wasn't accurate, right? [00:51:38] It was a depiction of what, you know, he wanted them to see. [00:51:44] And so they knew things were wrong, but they didn't, you know, they were not cybersecurity folks. [00:51:49] So we had to go in there and really, you know, dig in and start figuring out what was wrong with the program, where things weren't going well. [00:52:02] And so I've taken that away. [00:52:04] Then also when I was at HHS and this, maybe I can tell this story. [00:52:12] I don't know. [00:52:13] We're just going to say my opinions on this are my own. [00:52:16] The situation is certainly real. [00:52:20] But we had a new deputy secretary come in and they were bringing each of the programs in front of the deputy secretary to talk about what was going on, how the program stood. [00:52:39] And a lot of people did that, right? [00:52:41] They showed up with these charts and they talked about how great their programs were. [00:52:45] And she was she was a tough cookie and she was not hearing it. [00:52:51] And she was really holding people accountable. [00:52:53] And unfortunately, we were not. [00:52:57] There's several groups went ahead of us first. [00:52:59] So we were hearing all kinds of rumors about how these meetings were going. [00:53:02] So I went in there to give my update. [00:53:06] And, you know, I was really I was very nervous because I had just become the CISO. [00:53:13] And so I knew there were parts of the program that weren't great and probably not wisely. [00:53:19] I started with those areas and I was definitely nervous at the beginning of that. [00:53:23] But, you know, I got into a groove and I started going through it and I was totally honest with her. [00:53:27] And I said, you know, these are the things that are wrong. [00:53:31] We've got some real problems over here. [00:53:34] And this is that, you know, these are our metrics, right? [00:53:37] This is where it stands. [00:53:38] But here's what I'm doing about it. [00:53:40] But here's where I could use your help. [00:53:43] And I thought because quite honestly, like I was nervous at the beginning of that meeting. [00:53:49] And I certainly was not my confident self that met Katie at that table that night. [00:53:55] So all I had heard was this woman was tearing people apart. [00:53:58] And she was perfectly calm. [00:54:00] She asked me a few questions, clarifying questions. [00:54:02] And then she, you know, thanked me for my time. [00:54:07] And I, over the next several months, I ended up being in her office every week because we had, it was during the Obama's, it was the election year. [00:54:22] And so he was on his way out of office. [00:54:25] And so they basically, they don't do a ton of controversial stuff during that time. [00:54:30] And so they basically had picked cybersecurity as a bipartisan topic that they could move forward in the last year of his administration. [00:54:37] And so there were a whole lot of things that they were pushing out of the White House and they were asking the deputy secretaries to be directly responsible for. [00:54:45] So I ended up spending a ton of time with her. [00:54:47] And I really became the person she trusted. [00:54:50] And because I was the only one who walked in there and didn't lie to her, right? [00:54:55] I didn't try to tell her my program was great. [00:54:57] And I didn't really necessarily do that intentionally other than to be transparent. [00:55:02] But I think a lot of times we try to put a glossier face on things. [00:55:07] And sometimes they are just what they are. [00:55:10] And, you know, same thing with working incidents. [00:55:14] I mean, back to your question, I immediately thought of like five different major incidents throughout time that just, you know, kind of you get all encompassed in incident response. [00:55:26] And it consumes your life for a while. [00:55:28] But I think those things, right, sometimes when the program is failing, something isn't going well. [00:55:35] And you just think it's such a long road ahead. [00:55:38] And really, to me, being honest about that and asking for help and putting a plan in place and prioritizing the right things to dig back out of that hole is what's important. [00:55:51] And keeping your eye on the ball of the mission of doing the most important things that will impact the risk to your program the most. [00:56:02] Oh, that's great perspective, Sarah. [00:56:04] Appreciate that. [00:56:05] But again, and part of that, too, is, you know, understanding that dynamic organizationally of where power lies, but also that key to transparency, right? [00:56:16] You know, that exists, you know, across the leadership team, but also the board. [00:56:21] But also that helps you build that bridge towards that executive team. [00:56:26] So appreciate you sharing that insight. [00:56:27] Also want to share, I do miss San Diego as well. [00:56:32] Back to you, Tomas. [00:56:33] San Diego is the most amazing place on earth. [00:56:35] Sounds good. [00:56:40] Actually, I think Puerto Rico is probably one of the most amazing places on earth, but I'm a little biased, but I will digress. [00:56:49] Thanks. [00:56:49] Thanks, Mads. [00:56:50] If you do have a question and you want to jump up on stage, feel free to raise your hand and we'll bring you up to ask Sarah a question. [00:56:56] At risk of not being able to pronounce this name correctly. [00:57:01] Can I just say T? [00:57:05] Can you unmute yourself and help me say your name? [00:57:10] T-A-H-J-A-R? [00:57:12] And if you're looking for the mute button, it's on the bottom right of your screen. [00:57:17] And if you can't find it, we'll come back to you. [00:57:24] George, why don't you unmute yourself and ask Sarah a question? [00:57:28] Hey. [00:57:28] Yeah. [00:57:29] Thanks for sharing your experiences. [00:57:32] Sarah, I wanted to return to where you were talking about mission-driven organizations, which is very serendipitous because I just posted about mission today. [00:57:44] I was hoping you could talk about mission kind of going up and going down. [00:57:50] So what I mean by that is in the roles that you've shifted between, what are the things you look for to sort of understand does this organization have a clear sense of mission? [00:58:04] Is that something you look for when transitioning to a new job? [00:58:08] And then from a leadership perspective, looking toward hiring, are you looking for, you know, evidence of a mission-driven individual? [00:58:17] How do you suss out those soft skills and traits? [00:58:23] Yeah, absolutely. [00:58:24] Great question. [00:58:26] So I definitely look for that as I'm interviewing because that's something that matters quite a bit to me. [00:58:31] And also making sure that not only the mission, but is there a culture that is accepting of the importance of security, right? [00:58:40] And that's something that I definitely was I was interviewing at MassMutual. [00:58:44] They've made a lot of decisions, things like pausing the migration to the cloud. [00:58:50] They actually paused the migration to the cloud to say, hey, no, we've got to get a better and more secure way of doing this before we let more applications go there. [00:59:01] And that was something that really impressed me because most companies talk about caring, but they don't necessarily make those difficult decisions that that can interrupt some of the business efforts. [00:59:13] So there are certain things that I think you can can look for that speak to that. [00:59:19] But really just I mean, even asking the question of the people with whom you're interviewing, you know, what is the mission of the company? [00:59:27] What is the mission of the team and their ability to answer that? [00:59:31] And and what they say, you know, definitely reveals a lot. [00:59:37] I think when I'm interviewing folks to just I'm usually looking for, you know, what what inspires them? [00:59:45] I just interviewed somebody a couple of weeks ago and I asked them, you know, what makes you get out of bed in the morning and come into work? [00:59:50] You know, what gets you excited about your job and, you know, what are the kinds of things that you're looking for to support your success in this role if you were to get the job? [01:00:01] And it's really interesting how people answer those questions. [01:00:05] You know, and I think you can tell a lot. [01:00:07] I mean, most people have pretty good answers to those questions, but you can certainly tell a lot about whether or not belief in the mission is something that's driven, something that drives them. [01:00:19] But I also think even if it's not a belief in the mission, you know, we sell life insurance and annuities, which is great. [01:00:27] That's an important thing. [01:00:28] But, you know, if I'm being honest, like I was much more excited when I was in health care, you know, as far as as the mission itself. [01:00:37] But, you know, we have people on our team who their mission is cybersecurity. [01:00:43] Right. [01:00:43] They're so passionate about the field that it's not so much that they're they're caring necessarily about our policyholders. [01:00:52] But what they care about is that we have a program that allows them a lot of flexibility to be creative, to grow in what they're doing, to have the tools and technologies available to them, the support and the program to to do really strong security, to get out there and and search for the adversary and those kinds of things. [01:01:15] So everybody's mission may be different. [01:01:18] And I think that that that also is one of the things that I look to do, too, is help people tie their mission into the mission of the team and ultimately the mission of the company. [01:01:28] So. [01:01:30] Yeah, it's it's absolutely something that I look for when I'm job searching. [01:01:34] Great. [01:01:35] Thank you so much. [01:01:41] Thanks for that, George. [01:01:42] Thanks for jumping up on stage and asking your question. [01:01:44] Ryan, over to you. [01:01:48] Hi, Sarah. [01:01:49] Nice to meet you. [01:01:50] My name is Ryan Rosato. [01:01:52] I come in here every week and I try to ask the most interesting questions. [01:01:58] No, really, I think you actually kind of have answered the question. [01:02:02] I was thinking about going with with with advice and such. [01:02:06] And so I kind of was really first of all, I'm 29. [01:02:09] I really hugged at the fact that you kind of stepped into being a CISO at 29, [01:02:13] even though you said you felt like you weren't ready. [01:02:16] And since I usually have I've asked a few times on here, it's been a while, though, is I usually ask, like, when did someone figure out or realize they wanted to be CISO? [01:02:26] And how long did it take them to get there? [01:02:29] Actually, a little more so, like, you don't mind me asking. [01:02:33] In your first chapter, too, of being a CISO, was there ever something that you really did say, oh, I wasn't ready for this? [01:02:42] And then maybe how did you navigate something that you really may have been like, oh, how do I do this? [01:02:47] What is what is this? [01:02:49] Or is it different than I ever expected it to be? [01:02:52] And of course, they say this as someone who wants to be you sooner than later, right? [01:02:58] Yeah. [01:02:59] Yeah. [01:03:00] Yeah. [01:03:01] No, that's a great question. [01:03:02] I definitely I think I knew I wanted to be a CISO the second time I was a CISO. [01:03:10] Oh, my gosh. [01:03:11] I love that. [01:03:12] And I'm totally serious about it. [01:03:17] It's funny because my boss now, she always knew she wanted to be a CISO. [01:03:21] And I almost envy that, right? [01:03:23] Because she had a destination. [01:03:25] She knew where she was going. [01:03:26] And it's great. [01:03:27] And she's a fantastic CISO. [01:03:29] I, you know, I didn't know what I wanted to do with my life. [01:03:33] And I think that's OK, too. [01:03:36] So, yes, I had. [01:03:38] And also to clarify, so I moved when I was 29. [01:03:41] I got promoted into executive leadership at Booz Allen. [01:03:44] So I was how old was I when I became CISO? [01:03:48] That was I was maybe 35, I guess. [01:03:53] I'm not sure. [01:03:54] I'm 44 now. [01:03:55] And I'm disclosing that because I'm turning 45 soon. [01:03:58] And I'm definitely not looking forward to that. [01:04:02] So I think that the sorry, my cat is climbing the screen right now. [01:04:09] And I'm going to kill her. [01:04:11] She's trying to distract me. [01:04:16] So, yeah, there were certainly things that I didn't feel prepared for. [01:04:21] But, you know, I think the most key thing is having the people to rely on, especially as a CISO. [01:04:30] And it's funny because when I was at HHS and I was a CISO, you know, I had a team of 150 people. [01:04:37] When I was a CISO at the biotech, I had a team of 12 people. [01:04:42] And I had to build some of that team as well. [01:04:46] But I honestly was less concerned about having a gap when I was there because I was really driving the direction and I was able to shape it. [01:04:59] I think in the government that can be challenging just because you have so much, you know, compliance driven things that you have to adhere to. [01:05:06] So I would say there were a few spaces where I definitely felt out of my depth technically. [01:05:13] And we had a team, for example, that did reverse engineering of malware. [01:05:21] And they came in and were talking to me about what they were doing. [01:05:28] And they were talking so fast, right? [01:05:29] And I was like, hang on. [01:05:30] I've never had any experience with reverse engineering malware. [01:05:34] And, you know, one of the pieces of advice that somebody gave me at that time, because somebody else jumped in and kind of helped me out there and basically said, [01:05:46] OK, so are you saying and kind of broke it down. [01:05:48] But I had this moment of, oh, my God, see, I don't understand what they're saying about this. [01:05:53] I'm not qualified. [01:05:54] Right. [01:05:54] And that's what was going through my head right at that moment. [01:05:57] And but then the person later who had jumped in was like, well, I mean, I'm adjacent to this stuff, but I've never reverse engineered malware either. [01:06:07] Like, are you supposed to go do their job for them? [01:06:10] Like, why would you think you would need to know how to reverse engineer malware to be the CISO? [01:06:14] Like, you understand how it fits into the program. [01:06:16] And that's the important thing. [01:06:17] And so I think that that's the you know, I was getting in my own head about that. [01:06:24] And so what I have learned over time is to stop getting in my own way. [01:06:28] And if I don't if there's someplace that I haven't had experience to go ask questions. [01:06:33] Right. [01:06:34] Just say, hey, teach me about what you know. [01:06:36] Teach me about what you do. [01:06:37] I love this early career rotation program that we are doing at Mass Mutual because we are giving people exposure to different things. [01:06:45] Right. [01:06:46] Like, I think a lot of people get pigeonholed early in their careers. [01:06:51] And then it can be hard because you have even even if you have a strong technical depth, it's hard to have the breadth of all of the different disciplines that fall into what we do. [01:07:05] So it is really important to, you know, have some humility about that. [01:07:12] Right. And be able to admit what you don't know, ask the right questions and and people love talking about what they know about. [01:07:19] Right. So when once I shifted that dialogue off of my own internal voice being I don't know that to. [01:07:26] Wow. They have so much to share. [01:07:29] I got out of my own way. Right. [01:07:31] And started, you know, and started learning more. [01:07:33] So I would say the things that I really needed to know to be successful as a CISO, I already knew. [01:07:41] And I just didn't put enough appreciation on. [01:07:45] And that was really about, you know, talking to people in the right way and driving the conversations. [01:07:54] And and finding common ground. [01:07:57] You know, a lot of these things that we consider sort of soft skills, I started realizing were, especially in that role, a lot more important than the the technical skill. [01:08:09] I mean, of course, you have to understand, you know, the technical disciplines within cybersecurity and how they fit together and the impact. [01:08:17] And you need to understand the threat. Right. [01:08:18] You need to understand the threat that's facing your industry, your organization and what's realistic so that you can focus your efforts. [01:08:27] But your ability to be successful, the higher you go also starts relying on a lot of other things, your ability to influence people and influence outcomes and make things happen. [01:08:39] you see you see you see you see you see you see you see you see you see you see you see you see you see you see you see you see you see you see you see you see you see you see you see you see you see you see you see you see you see you see you see you see you see you see you see you see you see you see you see you see you see you see you see you see you see you see you see you see you see you see you see you see you see you see you see you see you see you see you see you see you see you see you see you see you see you see you see you see you see you see you see you see you see you see you see you see you see you see you see you see you see you see you see you see you see you see you see you see you see you see you see you see you see you see you see you see you see you see you see you see you see you see you see you see you see you see you see you see you see you see you [01:09:09] to you guys um but again thanks so much nice to meet you at this stage as i'll probably be back [01:09:14] i'm sure i'll ask you another question if not i look forward to hopefully connecting with you and [01:09:19] or meeting you um and and in the conversation there so thanks again for coming on and answering [01:09:25] my question absolutely thanks try and thanks for popping up on stage and asking your question [01:09:31] i was going to say why don't you just stay on stage because i'm sure you will have another [01:09:35] question but we'll bring you back up uh i was actually just reverse engineering malware right [01:09:39] now so um i missed everything that you said sarah except for the part that you reversed [01:09:49] maybe you can teach me how to do that later oh man trust me i i can tell you that i'm probably not [01:09:56] the one that will be teaching anyone how to do that um i'm gonna try i'm gonna try to pronounce the name [01:10:03] tajar um did i hear me now it's tahar hello can you hear me now yep yes can you hear me now perfect [01:10:14] can you hear me now great i i'm i'm reaching you from uh san diego so i was going by the water anyway [01:10:24] i'm in del mar so the water the mountains it makes sense but anyway um sarah you really spoke to my my [01:10:31] heartstrings on two intersections i'm a veteran and so in the veteran space by you being um a contractor [01:10:39] under booze allen continuing to help our mission of the war fighters thank you because you're serving [01:10:44] outside of uniformers part is that ecosystem and the second part was children um i'm passionate about [01:10:52] higher education and i sit on trustees here in tori pines with higher education focus on veterans and so [01:11:00] feeding that pipeline there's over 420 something thousand cyber security jobs that are not filled [01:11:06] and i'm curious to when we want to solve three serious problems the talent um we want to solve [01:11:17] diversity because we know within that diversity of culture and solutions it just brings a better [01:11:23] product to market and the third one is merging the culture the culture of veteran culture um folks who [01:11:33] are from and and i don't like that word um people of color because we're all colored something but diverse [01:11:41] cultures i'm curious on where have you seen success where we could wash and repeat that and where have you [01:11:48] seen some struggles so maybe we can brainstorm and improve that oh my goodness i love i love this [01:11:54] question um so first of all i lived just east of del mar um between carmel valley and rancho penasquitos [01:12:02] i'm bringing my son from surf soccer so what you're saying is party at my house [01:12:08] yeah i'm actually going to be there this weekend finally coming up is it [01:12:13] so um so to answer your question though so this is this is such a fun topic this is something that [01:12:22] i'm definitely very passionate about um one of the things that i got involved in in massachusetts [01:12:29] they've actually um there's a a group here in massachusetts that does a um mentor program for um [01:12:42] i i think it's so it's it's a bit of a combination of underprivileged and um [01:12:50] different diversity populations i believe um it uh of students both in high school and in college and [01:12:58] matching them up with mentors and part of what they're trying to do is not only feed the cyber [01:13:04] security pipeline um and not but also help um just within the state of massachusetts and particularly in [01:13:12] some of the areas of massachusetts where there isn't a ton of industry and kids don't necessarily have [01:13:20] exposure to other types of jobs um so just getting out there and you know exposing them to this is an [01:13:28] option and then helping them get coaching and one of the things that i found that was really interesting [01:13:33] so so i joined up as a mentor for this program and it's been a lot of fun um my mentee needed a lot more [01:13:40] coaching in some some more basic things too like how to how to interact professionally right how to um [01:13:51] you know how to ask questions the right way how to structure some of the work for the the project that [01:13:57] uh she worked on and um it's just been it's been an outstanding um an outstanding experience and um [01:14:08] i've also been a part of several other um groups there's so many great groups out there um that are [01:14:14] focused on this but i think that um you know whichever ones that you work with really getting in front of [01:14:21] um and i think that's one of the places because there's so many non-profits right that focus on this [01:14:38] and then the people who care about it end up going to the next level and i think that's one of the [01:14:43] the things that i think to answer your question about what we're maybe not doing quite as well that [01:14:57] we could shift is having different businesses put more of a focus on it having different cyber security [01:15:04] teams really thinking purposefully about how do we feed uh the next generation of cyber security talent [01:15:13] how do we bring more diversity into that and you know i think that representation matters significantly [01:15:20] right so um you know as many folks are willing right um whoever wants to but can spend the time [01:15:31] saying hey this is my origin story this is how i got into cyber security here's the thing i was doing [01:15:37] and so yes i actually was fortunate that i had a mom who was a computer science major but i mean i went [01:15:42] to college as an art major right so so i didn't necessarily think um this is where i would land so [01:15:50] just you know finding those opportunities being purposeful and it's actually a timely question i i just [01:15:57] had my leadership huddle this afternoon and was talking to my direct reports about our responsibility to [01:16:04] support this early career rotation program that we have and that it's something that i feel very [01:16:10] passionate about because we need to nurture junior talent and we are really um you know trying to [01:16:19] proactively go out there so we have a number of groups that we work with um we work with um [01:16:28] cyber city which used to be uh the international consortium of minority cyber security professionals and [01:16:34] i see a few folks from there uh in the room and also minorities and cyber security and um oh goodness [01:16:44] a few of the other groups are escaping me but but we actually have formal um arrangements with a lot of [01:16:51] these groups and so anytime we have job postings um definitely getting ahead of the cycle of the intern [01:16:58] candidates um where we're very proactive and trying to reach out oh and we also have the um the uh hbcus [01:17:09] that we have a bunch of partnerships with and trying to um you know just advertise what we have available [01:17:15] um so i think there's a lot of great stuff to take advantage of but i also think that the more that we can [01:17:22] socialize just with our our peers and our friends even if you're at a you know a vendor networking [01:17:29] event or something like that bring up the topic you know and ask your peers who are at other organizations [01:17:34] what they're doing or if they've thought about it or if they've you know if they're thinking about the [01:17:38] ways that they bring on interns um and and give opportunities so thank you so much yeah that has been super [01:17:47] helpful and i'm going to follow up and and find out how together we can do more and now i'm on mommy [01:17:54] duty i just got i'm so sucker and he's looking at me crazy i'm so honored thank you david my friend [01:18:02] i will join again but i have to i have to get on mommy duty now he's hungry yeah that's important [01:18:10] hey listen there are a number of other moms on this stage and believe me we understand when kids need to [01:18:16] be fed it's it's totally so much for that thanks for joining us tonight thank you so much for creating this space [01:18:24] thank you so much bye-bye thank you thanks for popping up on stage and uh let's not forget the dad [01:18:30] who had daddy duty as well 100 basically it's children need to be fed children need to i mean [01:18:39] sometimes they do i don't know i don't know why but sometimes they do even my 20 year old who came [01:18:44] from home from college he he needs to be fed yes i don't understand it's like they're always hungry [01:18:51] though like they didn't eat the day before i've got my 19 year old uh home and yeah he eats way way [01:19:00] too much um but anyways why don't we uh why don't we pivot folks and uh pass it over to jenny jenny [01:19:08] get to uh hear from you again anything you want sarah nice to see everybody um hi sarah i'm in the [01:19:15] state government realm and uh also in massachusetts and my question is um what are your strategies for [01:19:23] approaching leadership that really are not as focused on cyber security i mean they're moving their [01:19:30] resources around and the resources are limited and they just don't see the value of putting money [01:19:37] investing into cyber either from a technology or a training point of view how do you approach that [01:19:42] type of situation yeah that's a great question um because that that is always a challenge um and [01:19:50] it's interesting because there can be sometimes it's it's pockets of people sometimes it's an individual [01:19:57] and sometimes it's the culture of the organization and when it's the culture of the organization i think [01:20:01] that's probably the hardest right so um in those situations then i think you have to focus on what [01:20:08] are the wins you know what are the wins you can get um and but i you know to the earlier question about [01:20:18] um you know asking about the mission uh when interviewing that's something now that i i certainly look [01:20:25] for because um while it can be great to fight that fight um it is definitely a fight right so um you [01:20:36] know how much how much progress you can make i i think one of the things is is speaking to them in the [01:20:43] terms that they're looking for so what has what have you seen other people be successful or what have [01:20:49] they chosen to do right what are some of their pet projects or the things that trigger for them and [01:20:56] then is there a way that you can translate their priorities uh what you're doing into their priorities [01:21:03] so um you know sometimes it's protection of the business right so maybe there's um you know maybe [01:21:10] there's some uh anecdotes about incidents that have happened that are actually feasible things that that [01:21:17] could happen um those kinds of things sometimes but it can also be hard to just get an audience to even [01:21:24] talk about that um so finding the people who are the trusted folks can also work finding um others who [01:21:35] are have it have a seat at the right or different tables right um where they may be able to weave [01:21:41] something into a conversation and advocate for you that that can help too but i think so [01:21:47] one story that i have told quite a bit um is when i was at the biotech um we had had a lot of [01:21:58] changing you know it was a startup company um which is why i ultimately left because um as much as that [01:22:07] was my favorite job i ever had you know it was a startup and um you know the this the long-term [01:22:14] stability of the company didn't necessarily align to my own personal risk tolerance so i ultimately left [01:22:21] but i really loved that job um but we had a new ceo at one point and um she was bringing everybody in [01:22:32] we also had a new cfo now the ceo was very much supportive of cyber security and understood its [01:22:41] importance she had come from um general dynamics or no maybe ge i don't know one of those one of the [01:22:49] companies one of the big ones um and um anyway so she she knew it was important and um you know we had [01:22:58] a great relationship and a great dialogue but they were trying to cut costs across the board the cfo on the [01:23:04] other hand uh was the exact opposite he um he definitely said to me uh i mean he one of the [01:23:11] things i loved about him was he was so direct and so blunt like you you always knew where you stood with [01:23:17] him i mean he quite literally said to me i'm i think security is a waste of money and i look at the [01:23:25] security budget and you're the single biggest line item i mean he said that to my face yeah yeah but but [01:23:33] i i mean he wasn't trying to be a jerk he was just being factual right and and he we were having a [01:23:40] conversation so i i actually appreciated that directness most people aren't that direct but [01:23:48] we were in her office and um and he was putting on a show for her and he said you know [01:23:55] so here's one of these ways of your your flagrant spending of money on on wasted things we don't [01:24:04] need your team is telling me i've got to spend x amount of money on this waaf thing i'm gonna for [01:24:13] for this application that there are only two people using and has no potential to drive roi for the [01:24:20] company and now you want us to spend x amount of money to secure this thing and that is a waste of [01:24:27] money and you're being irresponsible and so you know i said this is i love this thank you so much [01:24:34] for bringing it up because you are exactly right and this is and i'd actually been bringing up a total [01:24:40] cost of ownership conversation um prior to this and i said this is exactly why i've been talking about [01:24:47] trying to put together a total cost of ownership model for technology overall because the reality is [01:24:53] we have 10 internet facing applications at this company and every one of them introduces the same [01:24:59] amount of risk to the organization regardless of the number of people who are using it or its potential [01:25:06] to give us roi so i this is such an important conversation and you know i would love for us to [01:25:13] have the conversation with the business owner of if there's only two people using it and has no potential [01:25:20] to return roi why do we have it why aren't we sunsetting it because the other cost that um you you [01:25:28] might not have gotten a new request for but we're paying it to support that application so you'll also be [01:25:34] saving money if you just decommission it and then the security risk goes away and i don't need the waaf [01:25:41] and um and he was not pleased um but the ceo was like yes yes this is great you know this is okay yeah [01:25:51] we need to talk about this total cost of ownership thing and wait wait wait wait wait sorry why wasn't [01:25:57] he pleased i love why wasn't he pleased when you said we can reduce the cost that i don't understand i'm [01:26:02] i'm sorry octavia i apologize i didn't mean to speak over oh yeah he was just mad because i was [01:26:07] right oh that's a totally different topic okay my bad yeah yeah yeah yeah well he was ready to he he [01:26:14] was right you know we sparred in the hallways and stuff but he was ready to like win in front of our boss [01:26:22] right and um so and and i definitely won that one but um but part of this is you know i certainly don't [01:26:31] recommend taking that approach with everybody the only reason i knew i could do that was because of [01:26:38] the because i knew him like he told me i was the single biggest line item on the budget you know i'm i am [01:26:44] happy to to spar with him in front of the ceo if he wants right but she i also had a relationship with [01:26:52] her and and if i hadn't had a relationship with her i'm not sure that that's exactly the approach i would [01:26:58] have taken so i think a big part of it is knowing the audience right and knowing where the line is and [01:27:03] how much political capital you have and what their influencers and drivers are most people i come from a [01:27:10] see you see you see you see you see you see you see you see you see you see you see you see you see [01:27:17] see you see you see you see you see you see you see you see you see you see you see you see you see [01:27:23] see you see you see you see you see you see you see you see you see you see you see you see you see [01:27:27] see you see you see you see you see you see you see you see you see you see you see you see you see [01:27:33] see you see you see you see you see you see you see you see you see you see you see you see you see [01:27:37] see you see you see you see you see you see you see you see you see you see you see you see you see you see you see [01:27:40] things that they care about and they're not their priority is not going to be your priority [01:27:44] so figuring out what their priorities are and how to tee that up so um and and i think actually in [01:27:52] mass mutual it's different because we actually our leadership uh in the technology organization [01:27:57] cares very much about security so i almost feel i'm in the other direction where i have to be [01:28:02] careful not to abuse that right and um and and make sure that i spend my political capital in [01:28:10] the place that really is not just because i have everybody's ear on every topic if i want it but [01:28:16] um and that's probably an exaggeration but but doing it in the places that um will still continue [01:28:23] to be the right balance because what the business is doing is very important and that's why we're [01:28:27] there we're not there just to do security we're there to enable the business to operate effectively [01:28:34] i don't know no no that was that was awesome thank you sarah thanks thanks for that thanks for that [01:28:41] uh sarah and thanks jennifer jumping up on stage and asking your question look it is uh 9 24 p.m eastern [01:28:47] time so we'll probably get to a couple more questions uh so joshua uh thanks for jumping up on stage why [01:28:53] don't you ask your question sure i'd love to um sarah i've i've taken on the the the burden of trying to [01:29:01] build a risk quantification system past the fair institutes um and i'm actually building a continuous [01:29:09] risk quantification system for dynamic risk pricing for such an institution just like yourself just like [01:29:15] your institution and i'm curious uh about your opinion and thoughts and anything else you know in the [01:29:20] marketplace well that is um we are trying to do risk quantification as we speak um i don't know about [01:29:31] the marketplace we're doing we actually have an in-house data science team um that we're leveraging [01:29:38] who are working with us to figure that out it's interesting though because one of the very first [01:29:45] projects i worked on in 2003 when i first uh moved over into cyber security out of it was an attempt to [01:29:55] try to quantify risk and um i'll say that project and of itself was a a big failure um but i think at that [01:30:06] time um a lot of people were just trying to they wanted to push a button and make it go away now you [01:30:15] know it was right like for those of you who've worked in government it was right after fisma had gotten [01:30:21] passed for the first time and it was all of these business owners one of them said to me so you're [01:30:28] telling me you want us to give you the stick to beat us with yep i've literally heard exactly that before [01:30:38] yeah yeah yeah and i well we've come a long way since then but um but yeah i mean we were really like the [01:30:48] the client had hired us they wanted us to create a tool where they could just push stuff in push a [01:30:54] button and it would give them the answer coming out and then they'd be done and they'd be compliant and [01:30:58] it wouldn't be a problem anymore and i don't know we put a lot of brain power into this and um you know [01:31:05] we built a little access database and it was a nightmare it didn't work so i've i've built a [01:31:10] non-profit uh an isao and i've pulled together some serious brain trust to build this system i've got [01:31:17] people that have designed risk quantification systems not using questionnaires let's be clear [01:31:22] because they drive you nuts exactly um but uh yeah i'd love to chat with you about that anybody else [01:31:28] that's interested we're holding uh every two week meetings to actually design this system out and uh build [01:31:34] out a real risk quantification platform hey josh that sounds great man and i really appreciate [01:31:40] you popping up on stage but let's uh let's keep that no no i apologize i apologize my bad i'm sorry sir [01:31:47] well i will say um along those lines though one of the key things that we've really focused on too [01:31:52] is making sure that um we're really talking about residual risk um and some of that through this process [01:32:00] has been an education to people who haven't had as much exposure uh to to risk and how you quantify [01:32:06] risk right so so educating the team um and other stakeholders who are reporting this information out [01:32:12] to that you know inherent risk is is just the starting point right so this is where we're assessing what is [01:32:20] you know what is that threat coming at us what is you know what is the potential risk and then you know [01:32:27] sort of the basic math is inherent risk subtracting compensating control or the controls that we [01:32:34] have in place mitigating controls leaving us with residual risk right so just we've actually got a slide [01:32:41] that we reuse in a ton of presentations to talk about um so people understand inherent risk you know [01:32:48] mitigating controls leaving residual risk and that that residual risk is the piece that we're focusing on and [01:32:54] that we're we're trying to really quantify and address and um we uh so so we have a an amazing woman um [01:33:04] susan whittemore she is the head of the cyber risk program um she's a peer of mine um at mass mutual and [01:33:13] she's just fantastic and what she's built out is absolutely incredible so that group falls uh within [01:33:18] her but the other thing that she has built out is a mitigation management program so we we [01:33:24] obviously we did a ton around mitigation management but um the the having those things coupled um she's [01:33:33] got a whole bunch of other stuff uh under her as well the third party risk program um just a ton of stuff [01:33:40] but having those things coupled closely together is really um has been incredibly beneficial because we're [01:33:48] we're we're able to better um prioritize the mitigations that we're facing and that is a central place that [01:33:57] now we have findings that come from all types of different uh places we've got you know the offensive [01:34:04] security team um you know that are doing a lot of this doing a ton of red team activity and pen testing [01:34:11] we've even our software security group is doing pen testing we've got audits we've got compliance things [01:34:17] we've got self-identified issues we've got you know um second the second line um the enterprise risk [01:34:26] management team um does stuff and it just any time that we're finding things that need to be fixed [01:34:33] they're funneling through a centralized process now so that we're able to take these things triage them [01:34:41] figure out who's responsible for mitigation right because one of the challenges we're having is [01:34:45] sometimes you know the offensive security team is out there and they're they're doing amazing work [01:34:51] right they're doing incredible work and they're finding all this stuff but then you know they're [01:34:55] coming up and saying well who's gonna fix it right and it's it's not their job to go around and chase [01:35:00] everybody to figure out who's who's gonna go and mitigate that is not a good use of their skills or [01:35:05] their time and so now we have this process and and then the beauty of it too is that it can tie into [01:35:11] our risk quantification it ties into our overall risk picture and um and feeds in we have feeds in all of [01:35:21] that from the threat intelligence team as well um so that we're constantly understanding the threat [01:35:28] landscape and um just adjusting how we're focusing our resources um not only on you know operating and [01:35:38] maintaining the program and uh investing in new grow projects but also on the mitigation of the existing [01:35:45] things and that also helps from the perspective of working with the it operations folks um so one before [01:35:54] we had all of these different teams who would be coming at them from different parts of the [01:35:59] cyber security program and they're going whoa hang on i don't i've got like five different people making a request of me today i don't [01:36:06] which is more important and those people are like i don't know what other requests did you get [01:36:11] so it's been a great place for us to be so we're doing the prioritization and then handing that over [01:36:17] and it's helped significantly improve our relationship with the it operations team as well [01:36:22] um because they're able to better prioritize their work and they've been much more willing to be [01:36:28] you know to actually partner with us and so then that just helps our security posture overall [01:36:33] um so anyway i i i would love to talk we're doing a lot of great stuff in in that space um as well as [01:36:43] we have a daily um uh we call it tva the threat and vulnerability um assessment it's a like a daily [01:36:50] stand-up call when we go through um incidents major threats and um just as uh i'll throw this out there is [01:36:58] a i was really impressed when i came in um with the model of how this works so in that meeting the [01:37:05] first five minutes or so the team recaps an article a cyber security article for the day [01:37:12] and that does a couple things we're very open and transparent and we have a lot of people who join this [01:37:17] meeting a lot of people from it operations and some of our um uh we have a lot of field agents um for [01:37:24] insurance and so we have technology support people so we we get a lot of we get usually around 50 to 60 [01:37:31] people in any one given meeting um and then several hundred over the course of a week who attend this [01:37:38] meeting and we go through open incidents and talk about things or you know zero days and things like [01:37:43] that so you always have in a meeting you know you've got the first few minutes when people are [01:37:47] sort of straggling in and so having that article covered in the first few minutes takes that time [01:37:56] in a valuable way because you're you're recapping an important article um that you think people should [01:38:03] know about it's it's also educational for the people who aren't in cyber security and maybe not [01:38:07] reading cyber articles um and and then you're you're not getting caught in that oh i'm sorry i just [01:38:14] joined two minutes late could you recap the topic right and then um we go through the content and [01:38:20] then they close the meeting with a joke of the day and they're usually bad puns or you know bad dad jokes [01:38:27] and but they're usually very funny and um so people who might have dropped kind of towards the end will [01:38:33] stay on for the joke and i thought it was it was so simple but brilliant just the structure of that meeting [01:38:39] um and i sort of went on a total rabbit hole there but i went there because we quantify risk around the [01:38:48] threat and vulnerability assessment as well honestly sarah when i was listening to you i was like yes yes [01:38:55] that's something we talk about all the time and one of the things i love about you the most [01:38:59] is that we can go down a rabbit hole and it not be that big of a rabbit hole yes um uh no you've been [01:39:06] an amazing guest and as we wrap up the evening we have one more question on stage ryan is a [01:39:13] person who comes on stage every single week at the fireside chat so we thought we'd give her one last [01:39:18] question um and thank you again for your time but we'll be wrapping up after this question and then we'll [01:39:24] we'll have one final question for you sarah but ryan do you have one one final question from the audience [01:39:30] um i do and i sometimes i get these questions and i wish i'm like man i wish i thought of this like six [01:39:37] months ago when i joined so so sarah you kind of inspired me here and i just love the enthusiasm love [01:39:43] the passion love the fire um i know you mentioned that something along the lines of like working at [01:39:48] the startup was your favorite for for the time that that lasted but i'm curious what has been maybe one of the [01:39:54] the number one favorite best uh just the memory that you love the most of your career whether it was [01:40:04] a moment you realized you could do something you didn't think you could or you realized you know [01:40:08] i think you said something early on that you know being with with healthcare you were saving lives or [01:40:15] um even someone you mentored and you realize you totally changed their path um i just just i mean [01:40:21] that's the romance in me everyone here i think it's because they really love cyber they're passionate [01:40:25] about what they do and you know i just love to hear kind of a maybe a nostalgic way that that what is [01:40:32] it that you love from what you realize in your career yeah um well i think that probably is at the [01:40:42] biotech although i would say the health isaac too i mean both of those were kind of um you know [01:40:52] i i guess from from the standpoint of answering your question and what made me really realize [01:40:57] um i and i think it was the biotech where i realized i did want to be a c so as i i realized in the [01:41:05] that i was good at it right where i i i'm not sure i had really embraced it when i was at hhs um and [01:41:14] i i could see the difference that i was directly making and um and and just building out that program [01:41:24] and really being able to influence that and all of the experiences that i had had leading up to that [01:41:30] and realizing how much i knew and um and that i could build something that was making a difference [01:41:40] for a company that was making a difference and um just also seeing the influence and actually here so [01:41:46] here maybe here's the story that i will close with um i one of the things that i did at the biotech is i [01:41:54] instituted a risk decision process and i for those of you who know me i'm very vocal on this that is [01:42:01] not a risk acceptance process because that implies that you're going to accept the risk it is a risk [01:42:06] decision process and i was pretty adamant that cso does not stand for chief information scapegoat officer [01:42:14] and that the people who were making the risk decisions needed to be the business owners [01:42:19] because cyber security risk is like legal risk or financial risk you know it's it's another type of [01:42:27] risk that business owners need to consider when they're balancing the business decisions that they have to make [01:42:33] and a lawyer will advise you all day long but at the end of the day you have to make the decision and [01:42:39] so that was one of the mindsets that i really focused on trying to get that organization to think [01:42:45] about differently and so i first checked to make sure that the ceo was going to be fully supportive of [01:42:51] this because i said you know the other thing is that what i will do is if they start making what we [01:42:57] believe to be the wrong decisions you need to be aware right so i'm going to give you [01:43:03] metrics on the decisions you know i'm going to give you information on the decisions that are being made [01:43:08] as we're sort of culturally shifting to this so when i first started there the chief medical officer [01:43:15] um did not i mean he just automatically didn't like me because i was the cyber security person and he [01:43:21] his interactions had had been with the cyber security people who said no and so he was very you [01:43:27] know he he didn't want to engage me in conversation um you know he tried to find ways around meeting with [01:43:34] me and things like that so i kind of took that as okay great you know challenge accepted i'm gonna win [01:43:39] win this guy over and and a year later um you know i had been working on that for working on that [01:43:47] relationship for a year and i put this process in place and he had some folks on his team who [01:43:53] essentially wanted to there was something really innovative um a company that was doing something [01:43:57] interesting in like uh radiology or imaging or something like that and but when we talked to this [01:44:04] company they i mean they we i was on the phone with them and i was like okay well can you give us some [01:44:11] kind of like real basic network architecture and so the guy drew something in a powerpoint and sent it over [01:44:17] and they're all the only security that they could point to was a firewall that was basically between [01:44:23] their employee laptops and the internet um but not between their business applications and the internet [01:44:30] and um so you know we and they said hey we're we're open to any kind of coaching you'd like to give us so [01:44:36] i said we cannot send because we we had protected health information we had phi and so anyway i made him [01:44:43] follow this risk decision process and so we wrote up what is the you know what is the business case [01:44:50] here what is the business trying to do what is the concern because we weren't doing this for everything [01:44:55] it was just things that fell outside of but you know sort of a reasonable level of risk tolerance and [01:45:01] um you know what is the concern and then what are a couple potential options to move forward and he um [01:45:10] um he the the head of radi radiology came up and was like why aren't you letting me move forward you [01:45:18] know you're holding this up and i said hey go talk to brad he's got the risk decision memo in his pocket [01:45:24] so he walked around the office with this in his pocket for three days and he finally came and plopped down [01:45:32] in my office and he said sarah i don't know what to i can't sign this this is an unacceptable risk to [01:45:38] our organization he said what do i do and i said well brad i'm i'm really glad that you came to talk [01:45:45] about it here's here's here's what i think we can do i think we can do that third option where you send [01:45:51] them some dummy data because what you want to do is you really want to try and see just does their thing [01:45:55] even work then we can give them a remediation plan of of things they would need to have in place in [01:46:01] order to move beyond a pilot and then you could think of different things like you know they they [01:46:07] had considered maybe acquiring the company and you know all these different things but so we got to a [01:46:13] solution where they didn't send phi but they sent dummy data right but just the fact so for me that was [01:46:20] a huge win like to me that was the thing i took away from that job i had like a great experience a lot of [01:46:27] wins but that was the one that to me was the biggest win because he considered me to be an adversary [01:46:34] when i started and then a year later you know just plopped himself down in my office very casually and [01:46:40] asked me what he was supposed to do because it was an unacceptable risk and and that was kind of a [01:46:47] you know i just feel like that was one of those kind of career defining moments for me well thank [01:46:52] you i really i can see why you know it sounds like you you fought the good fight and you won the right [01:46:59] way so it's nice to meet you again i look forward to hopefully maybe getting to meet you irl or or [01:47:05] connecting with you and uh i will uh well i guess i'll just stay here yeah just stay on stage right yeah [01:47:12] stay on stage yeah so so sarah this is your first time i think in the fireside chat um and thank you [01:47:17] so much for spending so much time with us this evening um the way that you closed that out was [01:47:23] perfect and i think it's a perfect transition and uh to tomas's last question that is is normally you [01:47:29] know the way we close out the evening so i'll transition over to tomas and thank you again sarah [01:47:34] thanks katie thank you for that and thanks sarah and ryan for for jumping up on stage and contributing [01:47:40] with your for your question uh so just before we uh before we conclude i just want to make one [01:47:47] very quick announcement so next week as i mentioned we do this every wednesday between 8 pm eastern time [01:47:52] and 9 30 or so pm eastern time sorry that we're a little bit over but we will be concluding soon [01:47:56] uh so next week we have tay lambo uh hopefully i got that right uh t lambo will be joining us next [01:48:02] week so please tune back in next week uh wednesday uh 8 pm eastern time but sarah i usually like to ask this [01:48:09] last question uh i'm not gonna put the spin on it like i like i did the last last week if you heard [01:48:14] that episode or actually the week before that i think when i was on uh but i will ask you if you [01:48:19] have one piece of advice for the younger sarah because you are going to be what do you say i think [01:48:24] you said you're going to be 45 by the way that's not old that is not okay some of us think some of us are [01:48:30] thank you some of us are a little bit older than that so 45 is not old okay um and you're welcome [01:48:38] and by the way there's nothing wrong with bad jokes right octavia uh all right so if you had one piece [01:48:44] of advice for the younger you sarah what would it be and what um i think i would honestly my advice to [01:48:53] myself would be what i said a little bit earlier on is stop worrying about all the things you don't know [01:48:59] and uh just focus on you know having you know be thirsty for learning like people want to share what [01:49:07] they know don't worry about the fact that you don't know it you can't possibly know everything [01:49:11] so just drink in what other people's what other people are willing to share [01:49:19] that's right be fearless don't worry about what you don't know well there you have it ladies and [01:49:25] gentlemen marge any any final thoughts before we kind of conclude well for me just yeah thank you [01:49:35] sarah for joining us tonight and um what a wonderful kind of clubhouse full circle moment of how we can [01:49:41] find these little um you know pockets and our industry and in our personal lives where we can spend [01:49:47] time with each other and learn from each other so thank you so much for coming in and being a part of [01:49:52] this tonight i really appreciate it thank you very much for having me [01:50:03] when people blink their microphones it means they're clapping so i think a few of us [01:50:06] us [01:50:11] thank you moderators thank you sarah i will leave you with the last word bring us home [01:50:22] sarah that's your cue bring us home sarah any final words i didn't i didn't hear what you i don't know if [01:50:28] my phone cut out i think i think he was just saying uh leaving you with the last word of wisdom oh god [01:50:34] alas i'm i'm i'm i'm empty um i i think uh i said something in a team meeting recently what did i [01:50:44] say i said something about uh be useful and have fun or something like that so say that be useful and have fun [01:50:52] i love that be useful and have fun that's actually pretty cool i'm gonna steal that [01:51:00] kids could tell my son that sorry i should not i i should leave him alone he's got to have knee surgery [01:51:06] tomorrow so i i will i will not be telling him that uh but look there you have it look sarah it's been a [01:51:12] pleasure it's you know on behalf of the uh moderators and myself thank you for taking the time out of your [01:51:17] busy schedule to join us and share uh your words of wisdom your origin story and your journey so far [01:51:25] and a little bit more around cyber security and risk management which were really good gems there so [01:51:30] if you uh tuned in just now you missed a good one uh so listen to the playback and uh we'll see you [01:51:36] all next week have a good rest of your week everybody cheers thanks thank you [01:51:41] thank you thank you thank you and good night bye everyone