Today on our Tech for Business podcast, Nate,
our Director of Cybersecurity, and Todd, our
COO and CISO, are joining us to talk about building
your security culture. And so Nate, this came
up in a podcast earlier. Actually, we recorded
it this week, but it came up in a podcast earlier.
So I would like you to explain why this topic
is important. Yeah, so... What we're talking
about today is really building a culture of security
and why that's so important, right? So if you
go listen to many of the podcasts that we've
talked about in the past is like, what's the
top recommendation? It's drive the culture of
security, right? And because if you don't build
a security culture, it will not adhere and it
will not stick and you will face frustrations
and resistance. in the initiatives you're trying
to do. So I'm sure we'll get into it a little
bit deeper, but you know, it's like your executives,
they expect an organization to be operational
and secure. But your end users are usually the
ones that will face most of that resistance.
Things like, well, I don't want multi -factor.
I don't want this, right? It's the inefficiencies
that I have to kind of jump through the hurdles
and it slows me down. while sometimes again,
your business leaders, that is the expectation.
And so it's okay to be slightly sometimes inefficient
in the sake of the global, the broader mission
essentially at place. So it oftentimes feels
like there's a disconnect between the business
owners and their employees when trying to approach.
Cybersecurity. Yeah, I'd agree. In the role that
I am, we help consult with a lot of organizations.
And I do have the opportunity to talk to business
leaders. So your C suites, your upper management,
board members, et cetera. And it is often well
understood that cybersecurity is a risk. It's
something that wants to be handled and managed
and so forth. I do find it interesting that there's
so many stories that we could tell, if you will,
that Level of urgency does not trickle all the
way into the organization. And so that kind of
brings us to what we're talking about today is
Why does security matter? How do you build the
culture? I am assuming that there's at least
somebody saying there's a need for the culture
to begin with So we'll just skip that layer and
somebody has already bought in and we're going
forward But when you're looking top -down most
organizations care a lot That's they they don't
wake up in the morning going boy. I sure hope
we have a bad day today yeah, and there's a lot
of cybersecurity professionals that obviously
know this is important. So we're kind of talking
to those people that this is not their day to
day, this isn't what they're doing, they're kind
of those non -security professionals. So Todd,
when we're speaking about those, that group of
people, what are some misconceptions right off
the bat that they have about cybersecurity? It's
funny. I literally was just listening to a podcast.
It was unrelated to cybersecurity, but they were
talking about just general IT architecture. And
the comment came up and he said, I don't really
care. That's what I have a VP of architecture
for. So I'm going to make the analogy of that's
what I have a cybersecurity person for. That's
why I have IT. And they're just going to take
care of it for me. And we've done other podcasts
in the past. And I've mentioned, in my opinion,
a lot of people day to day kind of go. My team's
taking care of me. I know there's fishing, and
I know there's this and that, and they've made
me paranoid because of the fishing simulations
and all that. I said, I don't need to worry about
it. I took my training or I didn't because there's
plenty of organizations out there where we've
got people that are tardy on completing their
cybersecurity training for the month. The reality
is, is somebody's taking care of it for me. I
don't need to worry about it. And I think that
perpetuates through organizations. And it's a
little unfortunate as I was looking at my agenda
for today and I saw this podcast was on there.
I was reflecting on CIT and I'm going, I'm extremely
lucky we're in the business that we are because
our team cares. And maybe it's not 100 % adoption
throughout the rest of the organization. But
when it comes to the culture of cybersecurity,
we talk about it in leadership meetings. We talk
about it in the lower breakout meetings. It comes
up all the time. And again, when I say we're
lucky for being in the industry, we see it. We
see our customer base struggle with it. And we're
like, boy, that stinks. We hate that for them.
And so we kind of have internalized that for
ourselves and do the right thing, if you will.
Yeah, I'm curious. And maybe we don't know the
answer, because CIT has been around for a while.
But was it always like that? Or was that kind
of a culture you had to grow into or get to?
We'd say we had to grow into it. So I joined
the organization nine years ago. And at that
time, we really didn't have a security program.
We offered a couple of things that were kind
of like that. So we did some trainings, and we
did some fishing. So it was pretty lightweight,
though. That time, we were kind of looking at
the world going I think this is going to get
kind of bad and it's gotten significantly worse
than I would have ever imagined unfortunately.
So the answer is we did have to build that and
Nate joined shortly after I did and one of the
things that we kind of started to do almost right
away was again we were looking at our customer
base and we're going this sucks and maybe I shouldn't
say suck but I did. This is bad, right? We hate
this and we don't want to see this anymore. And
so we got super proactive. And as we started
getting more and more proactive, we were internalizing
it, right? So almost everything we do, we tend
to test on ourselves first. Like, does this work?
Is this good? Et cetera. And because we did that,
we started to build what was going on. But like
I said, I think the biggest tipping point for
us was so many of the individuals inside the
organization see what's happening around us.
And it just makes it a little bit easier for
us to push the culture forward. Yeah, I totally
agree. CIT has really been what we, I mean, we
have to, we had to change our own internal culture
along the way, right? And, and to Todd's point
is we looked at our customers and everything
like that. Oh, for lack of better terms right
now, I'll use the same thing. Todd got called
out for saying, oh crap, but is that boiled frog
approach or turning up the heat, right? Is here
at CIT, right? So most organizations. However
long ago you typically didn't require multi -factor
inside of your office, right? We still see Customers
try and do that today say well, it's just inside
the office Why do I need multi -factor right
maybe outside of my walls? I need multi -factor
and we know that There's token theft and all
of this type of stuff that happens no matter
where you're sitting, right and so I remember
here at CIT we didn't have multi -factor internally.
It was only externally at the time. And then
I was like, well, hold on. I disagree with that.
Let's put it internally as well. And there was
resistance even on that at the time, right? And
so I had to do some creative stuff of like, well,
hold on. We'll do not the password. We'll do
just the multi -factor push and kind of getting
to that password -less feel. And that was like
in seven, six or seven years ago or so when we
started down that I want to be passwordless,
you know, feel you're at CIT. And so it was some
of that creative approaching, you know, to be
able to continue to drive it forward. And then
it was, well, hold on. Now I'm going to start
challenging the frequency of it. Now I'm going
to start, you know, maybe looking at the device
that you're looking on, looking at again. We
have podcasts in the past about you know zero
trust and the maturity models of continuous evaluation
But so I'm making changes on the back end to
increase the security ever so slightly and maybe
every month or two I'll turn something up or
maybe every quarter, you know But if you slowly
turn it up it starts to become the norm and if
you do it slow enough and strategic enough people
don't really ever notice the big changes and
then I do want to come back to one of the misconceptions
because I do believe it aligns with this conversation
is security is only there to become more complicated
and slow me down. With the journey of things
like single sign -on and passwordless, the reason
why I love identity so much is that it is taking
security increasing its effectiveness while also
reducing the complexity and the resistance of
the end user, right? Hey, if I just take, I think
I have one on me, if I just take my YubiKey or
my fingerprint or my face or anything like that,
and I just touch the fingerprint sensor, I'm
logged in. So it's super easy to get into myself.
And now I can get into all my different applications
because they're all interconnected. with single
sign on, we are able to evaluate that in a very,
very strong security posture. But to the end
user, I'm logged into my computer, logged into
my systems within 10 seconds based off of just
who I am and the device I'm coming from. Right.
So that is, I think, a big misconception is security
is only there to make your life harder. Definitely.
So if we're talking to the people, I mean, the
slow rollout is a good idea. But if we're talking
to people who don't have control over that and
we still want to kind of empower them, how do
we take someone who is not the cybersecurity
professional and allow them to still be like
a leader in the culture of the business around
this topic that they don't know a lot about?
Yeah, it's a really good question. I am a little
concerned that Nate tipped our cards and told
everybody how we're doing this. They're getting
noticed now. None of our employees look into
this. This is just where Todd and I ran. I will,
just for clarity's sake, I will say that we do
make some rather things that may be a little
uncomfortable. I'll use an analogy that way.
When we did cybersecurity phishing simulations,
when I first started, we rarely did them. I think
it was like once a year, and then we moved them
to quarterly, and then we moved them to monthly.
And we got to a point where we were doing them
every single week. We don't do that anymore.
We've got the culture we're looking for. We've
got the behavior set the way we want. And so
we've backed it off. So that does happen too.
And that's kind of where Nate was going with
is eventually you'll get to a point where it's
not completely in your face. We aren't here to
make your lives miserable. We're just trying
to get to the behavior we're looking for. So
the reason, well, I guess there is no reason
that I want to throw in there. Anyways, going
back to the... How do you get other people in
it? I think I would go back to the culture in
general, how that typically works. And in most
culture changes, it is kind of a leadership thing.
And so to me, that is not just cybersecurity.
It's not cybersecurity team. It's not cybersecurity
leadership. It's the leadership of the organization.
And usually, as you're working through these
kinds of things, this is going to be some pretty
broad strokes. But you're usually looking for
those early adopters of who are the people that
can quickly grasp what I'm going for, why we're
doing it, and then help start to matriculate
that through the rest of the organization. And
that's typically how it starts. But when you're
a non -technical leader, what that means to me
is it's listening, understanding that the security
team is not trying to make your or your employee's
life miserable. It's there to help mitigate the
risks that are associated with various types
of security events and organizations. And so
working with them to understand what's going
on. And in case you don't know this, your security
leaders do care about what's going on inside
of the organization. So if we've made a security
control that is overly complicated or creates
too much friction, we do want to hear about it.
There are almost always ways that we can make
that. less friction -based, if you will, or we
can find some additional compensating controls
to get to where we want to go that aren't quite
so in -your -face. That would be my first place
to start, is just working with and understanding
and communicating back to your security team
and leaders on what you're seeing and feeling.
You know, the thing I'd also say is, if you are
concerned about some of the security controls,
or, you know, I'll pick on an employee, he's
retired now, so he's probably not listening to
this, is... There was an individual here at CIT
that for a little bit him and I were oil and
water. It was I was trying to improve the security
posture of the organization and he was vehemently
opposed to many much of that because it slowed
him down and as a How the relationship was restored
and turned into a strong collaboration when it
came to security was every time that I would
do something and it impacted any of his daily
flow I would get a complaint about that right
or a concern maybe complaint is not the best
because that this is approaching me from I think
it's a complaint don't work through it and we
talked with each other right and eventually it
got to the point of I think that thing that clicked
was I started calling him my Bug bounty finder
right or am I my my bug tester is when I screwed
up He would tell me about it and then we'd start
working together and it all of a sudden it became
one of these things of like hey Can I use you
first to test instead of you know him wanting
to be the last one? Was let me test with you
first We'll figure it out make sure it works
successfully and then we'll roll it out and he
loved that he wanted to be engaged in the process
and so If you are one of those individuals that
is very resistant to security, try and get involved,
right? You know, voice those concerns. Say, hey,
there's other considerations that you should
put into the plan. They may not always be widely
adopted, right? But at least you are part of
that process. So I think that's something really,
really critical for those that are opposed to
security, right? And then I think there's another
layer in here is There's the IT leaders that
want to drive security, but aren't getting the
executive buy -in from the business for some
reason or another. I think that's another layer
that we often see because they'll say, hey, we
need to go implement the security control, but
they can't relate why that is. Right. So there's
a whole topic about that as well as how do you
translate business need to tech need and security
and risk. So we could have a whole talk ass on
that, but I think there's a little bit of a sometimes
driving that security to non tech leaders right
you know and so kind of bridging each gap along
the way yeah you know I think kind of just condensing
what we both said is I think what we're trying
to get at from from being the security leaders
and how we work with non IT leader I'm sorry
my 90 year security leaders is we're looking
for advocates to work with us. And there is a
bit of understanding that, again, what we're
trying to do is find ways that we're helping
the operation of the business. We're trying to
make sure there isn't disruptions and losses,
reputational damages, all those risks that are
associated with businesses. And so we're looking
for advocates to work with us on them and partner
with us to get through it. Ultimately, as Lee
had a great example for us, what he was talking
about is he created an environment that was very
safe for this individual to give them feedback
and escalate and saying, here's what I'm experiencing,
how can we work through that? And those are great
examples of how we can kind of continue to move
forward and move the culture to the rest of the
organization. Yeah, I wanted to touch a little
bit, and I think it fits into what we're talking
about right now is there's, we've talked about
having this maturity model. in other things and
I think it applies to this culture as well. How
can you transition from on that scale of just
having a company that complies because you have
to and a company in a culture that's actually
committed? I mean, what does that transition
look like? Can you see it even happen? What's
the difference between the two? What's that like?
It's a big question. There's the big question
and my mind instantly goes to that has to be
driven from the business side so the reason why
I say that and I just had conversations on both
ends of the spectrum is I want zero downtime
basically with however much money it takes to
do right and and so We can get you there. It's
gonna cost you a lot of money, right? And then
I've had conversations earlier, you know, even
this week about, Hey, I just signed up for three
years on my current antivirus. I just had ransomware
and. I don't want to implement any of the new
security controls I would replace and, you know,
improve the security posture of our organization
because I'm tied to this three year contract
that I just signed with this other vendor that,
you know, it really wasn't that big of a contract,
but I'm going to put. pause on my entire business,
you know, and improving the security of it because
I don't want to really deal with it and I am
tied to my decision that I made, maybe a little
prematurely. So if the business on both ends
says we need to drive security, you will drive
security and move away from the compliance to
secure, right? If the business says I don't want
to deal with that. And my risk appetite is massive.
That's the way that the business wants to operate,
right? They are willing to accept whatever those
risks are, compliance or not. My answer is...
I would say the organizations that adopt the
security fastest are the ones that do have compliance
requirements. They just do, right? It's not optional.
They have to come along the way. And most organizations
have at least some level of that due to the fact
that most are trying to get cybersecurity insurance.
And cybersecurity insurance dictates you must
do X, Y, and Z. However, if an organization is
committed, like Nate said, it typically starts
at the top, and you usually will hear extremely
strong lane that comes and matches with core
values and that type of stuff. So it's very strategic
of this is who we are. This is how we behave.
This is our expectations. Had touched on an item
that made me go back in my way back machine in
my mind of we were making changes at one of the
other organizations I worked at. And as we started
this, the feedback that came back from the leader
was understand that culture changes more often
than not. It's a multi -year process. And it
usually takes a couple of months, somewhere in
that 6 to 12 month range before the organization
starts to feel that change. So it's long, and
it takes a long time. So you can't just go, hey,
I did training once, and bang, we're there. It's
not like that, unfortunately. It's long. You
got to keep working at it. You got to keep pushing
on it. There's a flywheel analogy, if anybody
has ever... read the hedgehog concept that those
are kinds of things and you do it over and over
and over again, get super good at one thing and
then you'll eventually get the flywheel to continue
to move on its own. Typically how you start to
transition from compliance to committed, I am
definitely in and it's typically the leaders,
I'll say beaters that make that change happen.
It warms my heart when internally someone that's
in a non -compliance role says, well then I have
to create a tick and track that for our SOC 2
compliance, right? Yes. You sure do. You understand
the assignment. That's so great. Well, you know,
that kind of leads me in my next part and getting
back to kind of practical steps for those non
-IT people in the, I mean, what can they do that's
really helpful and really practical to support
what you guys are doing within the business,
you know? You say you're looking for advocates.
Okay, I'm here. But what do I do? Yeah, I think
what Nate just highlighted is incredibly powerful.
So as an organization, in theory, we don't have
a compliance requirement. We do. We're part of
the supply chain. So we want to make sure that
we're doing that. So we are compliant for those
reasons. But when we started, that was not the
case. We did it because we thought it was the
right thing. But as we're talking about culture
shift, I'll just use the example that Nate just
did of someone saying, hey, well, because we
have this requirement on our end for our SOC
2, Type 2 compliance, we have to do X, Y, and
Z. And his example is an employee did something.
As you're starting this out and you're trying
to get some traction on it, if your organization
has some sort of incentive program, that's a
behavior that you reinforce, right? That's a
bang, here's a thank you for doing that, whether
it's a $20 gift card. five bucks, a cup of coffee,
whatever it is that makes sense for your organization
and it drives behavior change. Those are the
things you want to focus on. And that's an easy
start. I kind of touched on a handful of other
things too, right, is listening and feedback.
But to me, the rubber hits the road stuff as
you're really pushing it down. Every leader has
the capability of reinforcing the behaviors they're
looking for. Yeah, I think public recognition
is a big one as well, right? It is one of the
things that we do here at CIT. recognition wall,
we do monthly summaries of those and you know
even on our all company you know like quarterly
updates and everything like that those get shared
out as thank you for whatever it is right this
is outside of your current job duties or you
know but you took the initiative to drive CIT
forward one step right and so if it is the hey
you know I noticed that there's possibly a risk
in the way that I am doing my job, who do I talk
to about that, right? And then as a leader, if
one of your employees brings that to you, make
sure it's well known, right? In your next, you
know, company meeting or your leadership meeting
or whatever it looks like, just, hey, I just
wanted to give kudos to Sally Sue in accounting
because she identified something that was a risk
to the business and wanted to bring it to our
attention, right? Make sure those things are
well known. Recognize your employees. Yeah. I'm
also thinking, you know, we've touched on a lot
of different types of people and businesses.
What about companies we work with that are outsourcing
these services? So you don't have a dedicated,
their everyday person doing these things. Does
that change how they approach security and culture?
Does it make it better because they've got an
outside person yelling at them? What is that
like for you guys when you're working with companies?
Just to be clear, I'm not the one that would
be yelling at you. We do escalate, but we do
it very politely. I strongly recommend. No, I
mean, really, I don't think it's much different,
right? You may have a third party like CIT. driving
the tools, driving the recommendations, but building
the cultures relatively the same, right? Here
at CIT, again, we can strongly recommend things
and start working with the business owners on
stuff like that, but every organization we work
with has a different culture. Some of them, security
is sometimes a friction point, right? And we
have to try and work and solve around some of
those challenges, or sometimes it is. We got
to back tools off a little bit in order to make
sure that the business is operational, right?
But that goes back to the risk appetite and the
culture that's been driven internally in those
organizations. So I don't think it's wildly different
who is managing the security. Sometimes it's
easier when it's outsourced because now you're
contractually obligated to keep it around where
sometimes internal it's just I heard too many
complaints and it's getting ripped out. Yeah,
it's interesting. I feel like I could have thrown
in my phrase, but I'll find a different way to
go about it this week. We don't have a ton of
transparency into organizations, so how the adoption
of the tools is received isn't always directly
fed back to us. But what we do as our approach
is we tend to, I always use the analogy, it's
just included. So we go out of our way to just
include the core things that we think you absolutely
have to have, and we're just going to start doing
those. As we start to do this, this is getting
back to Nate's example very early, when we start
doing cybersecurity trainings, they tend to be
pretty easy. Frishing simulations tend to be
pretty easy. And then as we start to continue
to mature with an organization, things start
to get a lot more complicated and harder to recognize.
Again, the intent for us when we're doing these
things we've been through at enough times with
enough organizations is we have a direction we're
going. We also know that we're trying to make
a certain behavior happen. I don't usually get
feedback. There are some times when we've created
enough friction where an org typically says,
enough, we need you to pause or back off or something
along those lines. But most organizations, they
do tend to accept it. Again, back to the here's
the things that we need to do to meet our requirements
for compliance or insurance or whatever. Those
typically are the things that drive things forward.
I've also joked with a lot of organizations too
and said, Blame me if you need to I'll be whatever
you need you need me to be the hammer the fall
guy Whatever it is you need to do to get to where
we're going I'll be that for you. You need me
to come in and talk to your organization and
scare them I can do that prefer not to do it
that way, but we can if we need to I think that
being an outsource Can be very beneficial because
you can kind of it's those guys. They're making
us do it and they say we have to That's okay.
We'll take that Oh, man, I love it. That's a
great way. I want to make sure that we cover
anything, but we took a wide journey, and I think
we have a lot of practical advice, a lot of starting
points. Is there anything else you want to touch
on, or if you could kind of boil it down to one
thing, what that might be on today's topic? I'm
going to be communication. I mean, ultimately,
I kind of think we started there. Like anything,
when it comes to culture, the more you communicate
it, the better it's understood and adopted, right?
You can't, I mentioned it before, right, for
it takes you years to get where you're going.
You can't just say, I threw it out there, this
is the direction we're going. Hopefully that
just kicks in and happens. It doesn't work that
way. You do need to continuously remind people.
We use the terminology seven times, seven ways
when it comes to communication at CIT all the
time. And we communicate that much more frequently
than that because that is... clearly not enough,
but it gives you the context of how much you
need to do it and continue to do it. We like
using different voices, too. So, for example,
if I'm going insane, here's the guy idea, here's
the idea. As much as people join the podcast
to listen to me pontificate, it's great shipping
from Nate as well. So just getting those different
voices really does help with delivering the message.
We laugh because I've never once joined the podcast
to listen to you. I don't know what you're talking
about. I'm here to talk myself. So I think we
started the podcast with, you know, there's a
disconnect between the top and the bottom. So
Todd's comment about the deep collaboration and
trying to, you know, do the same thing in seven
ways is very much of that top down approach.
I guess I'll kind of conclude in trying to circle
it all back to, you know, what the recommendation
down at the general employees is. Kind of a common
saying I have is have grace and patience, right,
is when things are being pushed down, mistakes
may happen. Give the other person who is trying
to implement it some grace, right? And then also
the patience is most people are not trying to
make your job harder. And sometimes there are
those kind of, to my other employee was, there's
the bug, bug bounty, you know, bug finders that
we have to work through. And sometimes it is
a little painful to find those and disrupt the
workflow. Have patience because we can usually
work through those. No one's trying to come in
with ill intent on any of it. We're just trying
to align with what the business needs are and
what has been requested of us along the way.
That seems like a great place to end. So thank
you so much for joining us today. If you enjoyed
this topic, please let us know. like, subscribe,
or reach out to us at info at cit -net .com or
head out to our website cit -net .com slash podcast.
We'll be back next week with an all new episode.