In this episode, Kal Sambhangi, Senior Vice President, Cybersecurity Strategy and Architecture at Truist, shares his vision of the future of cyber governance. According to him, the leadership mindset needs to change whereby they are optimistic and opportunistic about cybersecurity and view developing cybersecurity capabilities as a source of competitive advantage. Kal also emphasized the importance of attracting professionals from other fields. He said, “I think cyber security as a community should start embracing people with other skills. I think there is a lot of opportunity here, for people skilled in software development, program management, product management, and data analytics.”

To access and download the entire podcast summary with discussion highlights --

https://www.dchatte.com/episode-38-cybersecurity-as-a-strategic-opportunity/

Connect with Host Dr. Dave Chatterjee and Subscribe to the Podcast

Please subscribe to the podcast, so you don't miss any new episodes! And please leave the show a rating if you like what you hear. New episodes release every two weeks.

Connect with Dr. Chatterjee on these platforms:

LinkedIn: https://www.linkedin.com/in/dchatte/

Website: https://dchatte.com/

Cybersecurity Readiness Book: https://www.amazon.com/Cybersecurity-Readiness-Holistic-High-Performance-Approach/dp/1071837338

https://us.sagepub.com/en-us/nam/cybersecurity-readiness/book275712

Welcome to the Cybersecurity Readiness Podcast

Series with Dr. Dave Chatterjee. Dr. Chatterjee is the author of

the book Cybersecurity Readiness: A Holistic and

High-Performance Approach, a SAGE publication. He has been

studying cybersecurity for over a decade, authored and edited

scholarly papers, delivered talks, conducted webinars and

workshops, consulted with companies and served on a

cybersecurity SWAT team with Chief Information Security

officers. Dr. Chatterjee is Associate Professor of

Management Information Systems at the Terry College of

Business, the University of Georgia. As a Duke University

Visiting Scholar, Dr. Chatterjee has taught in the Master of

Engineering in Cybersecurity program at the Pratt School of

Engineering.

Hello, everyone, I'm delighted to

welcome you to this episode of the Cybersecurity Readiness

Podcast Series. Our discussion will revolve around recognizing

the strategic potential and capabilities of cybersecurity,

instilling security in the executive mindset, the

importance of holistic cybersecurity governance, how do

you draw professionals from other fields into cybersecurity,

and more. I'm delighted to host Kal Sambhangi, Senior Vice

President, Cybersecurity Strategy and Architecture at

Truest. Kal, welcome.

Thanks Dave for having me here today.

Well, I know the listeners are in for a

treat. Because when we had our planning meeting, you shared

some very powerful perspectives. And I'm looking forward to

discussing those with you this afternoon. But before we get

into all that, how about providing listeners with some

highlights of your professional journey?

Sure, I started my professional journey soon

after I completed my engineering and MBA in finance in India. And

you know, back in the late 90s, ERP was a big thing. And my

background in finance helped me to establish myself as a intern

to start with and then worked my way up in the consulting world,

specifically in ERP implementation and

customization, then as chance by chance into data analytics, and

all. From an experience standpoint, working with large

systems integrators, consulting firms, retailers, and financial

services. Specifically, most of my career has been in data

analytics, but I took some risk, made a pivot in during the

pandemic, when an opportunity struck for me to take a role in

cybersecurity. I thought that could be something new,

refreshing, and I moved to cybersecurity in 2019. So it's

been close to five years for me in this space, apart from my

previous experiences. Hope that helps.

Fantastic! that's such an eclectic

background. In fact, that brings back memories of my own

experience, where I started my career in accounting as a

chartered accountant, and then gravitated to information

systems. And now I'm focusing on cybersecurity. So that's

phenomenal. So Kal, I'll reference our planning meeting

that we had, where you shared some very powerful and

interesting perspectives. And I quote from one of them. You

said, "the security industry needs to pivot away from talking

about things and why they go wrong, into getting things done

and fixing things." This is not a problem, which has or can have

a purely technological solution. Can you please expand?

Sure, I said, getting things done, rather than

talking about things. I think it goes back to some of the other

thoughts I shared in terms of a moving away from a

compliance-oriented function towards really doing something

from an implementation standpoint. But before I get

there, I think today, as we all know, cyber risk is everywhere.

And for all the investments we've been making, to secure our

systems, product, customers, we're still struggling to make

cybersecurity, in my view, a vibrant, proactive part of

strategy, operations and the enterprise culture. In my view,

the root cause could be twofold. Now, obviously, cyber security

most of the time is treated as a back office job. 2) most cyber

leaders, at least I have come across I have had experience

with, not to kind of belittle anything, but I've come from

technology backgrounds, just like me and we lack a little or

maybe a little ill-equipped from exerting strategic influence

across the organization. So given that, again, we also hear

that an average tenure for a cyber leader is 18 months. But

it's clear that something is not right, something needs to

change. And we have all seen historically, companies have

expected security leaders to focus on technical tasks. And

not maybe a lot of expected more of them. But as the regulatory

policies change, as this cyber threats and the compliance

regulation aspect, and as companies become more and more

digital enabled, I think the goal of securing the business is

a much more big strategic decision, rather than a set of

technical tasks. It's all about the business models, the digital

strategy, the product mix, the merger and acquisitions.

cybersecurity, in my view, is or should not be an afterthought,

but should be part of the business model itself, or part

of the digital strategy itself, part of the product mix itself,

we can discuss those in detail later. But at a at a high level,

that's what I think.

I couldn't agree with you more.

Cybersecurity needs to be part of the strategic core, integral

to strategic decision making, and a key and distinctive value

proposition. So please continue. This is great.

I think the cyber leadership should help embed

security throughout the company's products, channels,

operations. And to do so, obviously have to influence

fellow senior leaders, right. Has to be a collaborative

effort. So if you have to influence fellow senior leaders,

then you got to be talking the same language, you got to be

talking and walking the same languages as well. So I think

that's the key from a cyber leadership standpoint. That

means, companies need to develop security executives, who have

the skills to do so. And this goes back to my point of how

much of inboarding could we do to expedite building these

skills within the organization versus onboarding, or basically

bringing in more business leaders into security in some

form or fashion, building that connectivity, that thread

between the various functions in the organization.

Interesting. So essentially, what you're

saying is, unless the C-suite folks recognize the significance

of security, and are willing to make it centric to the overall

strategic goals of the organization, you're unlikely to

see an organization-wide acceptance, organization-wide

involvement, whereby everybody does their part, as opposed to

kind of outsourcing it to a group of people, whether

internal or external, to do the heavy lifting.

Absolutely, absolutely. And security should

not just be embedded in the processes, but at the end of the

day in the culture. So it's about how securely we are

engaging with our customers, how securely we are running our

business. So it needs to be embedded in the culture. I think

that that's where I was going to. And that kind of resonates

with your statement as well.

For security, to become part of the

organizational culture, for security to become part of the

executive mindset, organizational mindset. It

requires training, it requires awareness, it requires job

rotation. Like you said, it requires creation of attractive

roles, which will draw people from other fields into

cybersecurity. How the CISO function and reporting

relationships are structured also depends on how information

security is perceived by the leadership. Talking about

structuring CISO reporting relationships, there are various

views out there. According to one school of thought the Chief

Information Security Officer CISO should report directly to

the CEO. According to another school of thought CISOs should

report to the external audit committee. Based on your

experience Kal, having worked in different organizations,

currently, you're a senior leader in a very large

institution, do you feel that steps are being taken to create

and sustain a high-performance information security culture.

Also, what are your thoughts and perspectives on the ideal CISO

reporting structure?

I think yes, there is the intent. And large

organizations specifically in certain industries are moving

towards that. But you just mentioned about where should the

cyber leadership role align to? Shouldn't it be reporting into

the CEO or the chief operating officer, or the risk committee?

I think there are different variations of the model, there

are different thought processes. I think, from my perspective, I

always felt it is about setting the intent. There is no one size

fits all. But I think setting the intent in terms of primary

options considering building the strategy around business

continuity, brand protection, bottom line growth, regulatory

compliance, I think setting the intent around these larger

strategic themes is key. I think the business context drives

these choices where it should lie. I think the business

context and the intent are very, very important. You may want to

think factors like regulatory pressure or risk exposure, what

really customers are looking for. I'll give you a couple of

examples here, an electric company may prioritize business

continuity to ensure the highest service or time, in a cost

pressure market, while an IoT manufacturer may focus on

growth, betting on cyber security's ability, to be a

differentiator, and to justify the premium raises. Similarly,

if financial services firm given that the thin line between

fraud, privacy, and cybersecurity is kind of thin

line, and it's waning away, I think the intent here in terms

of hey, if, at the end of the day, it's the customer

experience which matters. At the end of the day, it's the

customer experience on digital channels, which is going to was

growth, I think that intent and the context should drive the

choices in terms of the cyber leader should report into and so

on, so forth. I think it's all about the why for cybersecurity,

the why for cybersecurity, and, and these choices, go back to

the why. And choosing strategy, or the response to the why will

obviously cascade down to operational activities will then

drive business outcomes. I think at the end of the day,

cybersecurity as a function cannot afford to be just

technology and tools driven, because there's too much at

stake right now. So I think it is the business context. And it

is the intent, and why which will drive a broader strategy

and the alignment of cyber leadership within the

organization. That's my perspective, rather than saying

it should be aligned to the CEO or the COO or the risk

committee.

Very fair. You have to contextualize

cybersecurity, given the vision, mission, goals of the

organization,

Growth strategy as well, where am I in? How do I

want to grow? Yeah, things like that.

This reminds me of another guest, who

made a very interesting and poignant statement. He said, I'd

encourage the C level leaders to look at cybersecurity as an

opportunity, instead of viewing it as a hurdle, a stumbling

block, and a cost of doing business. So the leadership

mindset needs to change, where they are optimistic and

opportunistic about cybersecurity. They view

developing cybersecurity capabilities as a source of

competitive edge, competitive advantage. So

Exactly. I think the key is the cybersecurity

could be a competitive advantage. I think that's the

paradigm shift.

Yes, that is the kind of paradigm shift

that is needed for information security, to become part of the

strategic core. When the leadership starts looking at

cyber. from a strategic standpoint, they will include

cybersecurity in their discussions of whether they

should launch a certain initiative or a certain product,

and if so, what are the security implications? And how are they

going to address it?

You're absolutely right Prof. Chatterjee. I just

wanted to, you know as the businesses are evolving, and the

digital channels are becoming the prime channels to, to sell a

product or an offering or to service a product or an

offering, I think the the the trust factor, and the importance

of trust factor, between the one who is offering the service and

one who is consuming the service, I think that the

importance of the trust factor has kind of an elevated level

and for the business to be successful. Be it any industry,

you don't see, we're talking about back or a few years ago,

when we say a bank was a brick-and-mortar walkin branch,

similarly, retailer was the same thing. But now, when we're

talking about e-commerce and e-banking and digital channels,

the trust factor is the key, and that becomes a competitive

advantage. Establishing a greater trust, when we're

talking about the digital channels, when we are not really

touching them talking to people at a branch. So establishing

that trust is a competitive advantage. And obviously,

cybersecurity is part of that trust. Breach means you have

your customers who are kind of thinking about, hey, should I

actually stay with this organization where there is a

breach and my data could be compromised, my personal

information could be compromised. And that's a

reputational risk, huge reputational risk, apart from

the financial risk and other risks for the organization. But

at the same time, for the end-customer, not having the

trust, I think I know that some much broader business risk for

the for the organizations.

I like the way you brought in trust to

frame the significance of what we are talking about. Trust is

such a great leveler. And it brings to perspective, what's

key, and how cyber can play a role in enhancing trust.

Customers have to trust the quality of the product, quality

of the service, and alongside with those, customers must also

be able to trust that the information they're sharing, or

the information the company has about them is being safe

safeguarded, to the best of the organization's abilities. So

trust is definitely a common denominator. And that's a great

way of trying to raise the level at which cybersecurity should be

perceived and integrated within the organization. On a related

note, as we have seen time and again, it brings back memories

of the Enron scandal, then the arrival of the SOX legislation,

time and time again, history tells us that organizations are

more reactive, organizations need the fear of enforcement of

compliance requirements, to get things done, the proactive

effort is not there. And to to make it a proactive initiative,

one has to find a way of linking it to the strategic goals, to

the business goals, to revenue generation. So that's the

challenge, because otherwise, you're gonna have a hard time

convincing leadership to spend time focusing on cyber because

they'll say well, we got to run the business, we got to manage

our customer base and so on so forth. And it varies from

industry to industry, you are in a financial services industry,

the regulations are very stringent. So probably the

perspective is different. But I have seen different views of the

leadership across different industries, and they are not all

aligned in terms of seeing cybersecurity as part of their

strategic core. What are your thoughts?

Yeah, as you rightly said, depending upon the

industry, the size of the business, I think the focus and

magnitude of focus could differ. However, I think there are some

common factors or common forces irrespective of the industry

size as we see this sprawl with the digital products channels. I

think there are some common factors, right. It has nothing

to do with the size of the organization or the offering the

organization has, or the regulatory compliance to serve

the organization. At the end of the day, every business is

dealing with consumers, and we're seeing more and more and

more increasingly complex regulation around consumer data

protection, and I would say it is across the board. 2) The role

of smart decisions, the role of smart equipment. We could about

IoT as an industry. We all talk about self driving cars, very

soon. So when we talk about all of these, which are very

software driven, and the moment we talk about these digital

channels, platforms, products, we obviously talk about the data

we capture, the analytics we conduct on the data, machine

learning, artificial intelligence, the ecosystem

partnerships, because no one company can build all the nuts

to nuts and bolts and all the all the moving shaking parts,

for digital products. Obviously, there is going to be an

ecosystem partnership, a platform partnerships

irrespective of the industries. So that's where that's where we

are seeing the business models, evolving into ecosystem partner

partnerships, platform partnerships, and so forth. And

as these ecosystems evolve, and as more of these platform

partnerships are built so that the smaller businesses could

grow quickly, grow fast, obviously, there is an increase

in supply chain risk, because now we have too many touching

connected points. So obviously there is supply chain risk. And

it goes back to how well are we protecting my customer

information, and then and then the threat could be from the

supply chains you're operating within. So I think I think the

the leadership aspect of cybersecurity, irrespective of

the size that needs to be positioned to function for

lateral impact across the organization, not just across

the organization, but also across the supply chain. So the

lateral impact or positioning for the lateral impact, I think

that's the key and it has nothing to do with the size of

the organization or the industry in which the organization is

operating. I think having the if we all agree that having that

lateral impact is key, then proper authority is vital. And

having a inter organizational political sway, and extra

organizational political sway to orchestrate the change. I think

that's the key. So I don't think we should are we we could or we

should look at it from a lens of the organizational size and the

and then the industry itself.

Great point! competition today is not

simply between say Publix and Kroger. But between Publix and

its network, and Kroger and its network. As you put it,

competition is taking place at the ecosystem level, at an inter

organizational network level.

Yeah,

I couldn't agree with you more. And that

brings up something that I've been recommending through my

book, articles and talks. And that is establishing some sort

of shared accountability and responsibility among the value

chain partners, whereby, when data of Company A resides on the

server of Service Provider B, Service Provider B should work

in unison with company A, to make sure that the data is safe.

The two supply chain partners should work as a team to ensure

the most rigorous information security standards are being

maintained and met. In other words, it is not okay to simply

rent out the storage space or computing power and say, okay,

here are your servers. This is how you configure the security

settings. And now it's your problem, it's your

responsibility to secure your customer data. I think that's

where there has to be some changes, whether it comes in the

form of regulations, or it is through SLA provisions, whereby

both the parties, in this case A and B, will be held jointly

liable for the breach consequences. Only when there is

responsibility and accountability Kal are you

likely to see the kind of security centric supply chain

partnerships that you talk about. Security controls have to

be embedded within inter-organizational processes

and business models.

Totally, totally agree. I think we're not too

far, at least from my perspective, and the way I look

at it, we are not too far to get to that place, not just from a,

in this case, you mentioned, for example, cloud providers, party

A and party B, one of that could be a cloud provider. I think

it's much broader than that. We're talking about data

sharing. We're talking about ecosystem partners, monetizing

shared data and information, because their offerings are

built around that. So as we get into those complex ecosystem

models, it can never be the responsibility of the partner,

where the data is originating, versus when it is hosted versus

who is using it, so on so forth. Becomes a collective

responsibility. And I think the industry, two things, there is

an organic natural shift to self regulate ties and self regulate

this and some kind of a model to support the increasing needs and

the challenges. Mitigate the challenges. 2) More of

regulation, more of the oversight from the government

and institutions. I think we will get to the path. And my

view is before a lot of the regulation comes into frame,

more than driven by regulation, I think, as partners in the

ecosystem, because again, as we talk about evolving technologies

like blockchain, but we're talking about, again, leveraging

technologies across the partner ecosystems, building platforms,

across partner ecosystems, I think some amount of sanity will

prevail. And people would come together and say, Hey, how do I

protect the interests of my customer, consumer, and I think

we will arrive at that kind of a point, that's my view.

I'm so delighted that you're painting

such an optimistic picture. And that's how leaders like you

should be, because you're kind of guiding where cybersecurity

governance needs to go. And talking about cybersecurity

governance. And I'm glad you mentioned that it's not enough

just to focus on the technical controls. Technical controls are

important, not trying to minimize their significance. But

I like to emphasize holistic governance. Drawing upon my

framework, holistic cybersecurity governance is

reflected in the three dimensions of a

high-performance, information security -- culture, commitment,

preparedness, and discipline. Each of these dimensions are

associated with success factors, 17 of them to be precise. Many

of these success factors are linked to leadership and

governance. For instance, one of the success factors of holistic

cybersecurity governance is hands-on top management; how

actively engaged is top management from the standpoint

of providing oversight, and also participating in cybersecurity

strategy development, implementation, monitoring,

measurement, and more. Other managerial factors include the

structuring and empowering of the CISO function, shared

ownership and responsibility, cross functional participation,

and strategic alignment and partnerships. So anyhow, the

bottom line is that the approach to cybersecurity governance must

be holistic by focusing on people, process, and

technology-centric measures.

Absolutely Prof. Chatterjee. And again, there

cannot be 100% Cyber safe.

Absolutely.

Situation. Right? You know, that's not not even a

statement of Nirvana and we can never have 100%.

Totally,

I think I think it's all about when we talk

about commitment, discipline, preparedness against these three

dimensions, and when I said, the technical concepts versus the

management and leadership concepts here, I think the key

is the ability to extract the technical concepts into messages

that would grip senior leaders, both logically and emotionally.

Right. So the ability to do that, I think, that attribute in

a cyber leader would help the commitment part, the discipline

part and also the preparedness part. And what this means is to

have the ability to exstract the technical concepts. And as I

have seen, in my experience, for example, the best person to lead

the digital transformation, or a best person to lead AI adoption

within an organization and the products offer, need not be or

necessarily be a digital expert, right, I have not seen a

technical digital expert becoming the chief digital

officer or a chief data officer, at least in my experience, I

think, to a large extent, it could work for cybersecurity, or

it should work for cybersecurity, as well. Now, the

cyber leader could be a proven non cyber executive, but who

knows the business has key relationships throughout the

organization, and a general appreciation of the technology.

I think having those traits, obviously, if there is much more

than general appreciation for technology, well and good. But

it's not the other way. Right? I think, finding these critical

traits, I think that would ensure and serve as an enduring

force from a upliftment standpoint of your cyber

posture, and also making it part of the broader organizational

design, organizational culture.

Fantastic, fantastic. I like the way you

articulated the reality that for a cyber leader to be truly

effective, having the necessary technical skills is not

sufficient. It's great if it's there, but the business savvy,

the ability to connect and communicate with the leadership,

and probably, most importantly, the point you made at the very

beginning, is the ability to articulate technological issues

from a security standpoint, in a manner and a fashion that

everybody can relate to. So the speak has to be simple, the

speak has to be easily understandable, because

otherwise, you're going to lose a lot of the constituencies, and

you can't afford that. The moment you get into extreme tech

speak and extreme security speak, and you are engaging in

acronyms and jargons, immediately folks who are not

familiar, they jump to the conclusion, Oh, that's too

complicated for me. Just tell me what I have to do. And I'll do

it.

exactly right.

As it transitioned into cybersecurity few weeks ago, the

initial six to eight months, very challenging, because there

was the speak of IP addresses, speak of different frameworks,

NIST framework, CIS framework, and basically some numbers which

would talk about a particular requirement in a framework like

NIST. At the the end of the day, it was a bit challenging for

someone like me who's coming from a different area. But I

think, 1), I could bring in my experience and my skills in data

analytics, digital experience space, to cyber. I'm just

quoting this as an example, having worked in data, I was

always a little scary to talk to, and operate within my peers

in the cybersecurity space, because I've always seen them as

someone who would come and say, No, you can't do this. But then

moving here, I realized the challenge here is both parties

are not able to talk the same language. I think that helped me

appreciate the the challenges within cybersecurity and also

the mindsets, within my fellow teammates, it will appreciate.

2) help build that bridge, that relationship, with the business

partners. To be a real bridge from a communication standpoint,

calls for the cross pollination of skills, cross pollination of

leadership skills, managerial skills, and also the domain

expertise and understanding the business itself. I think that's

the key.

Fantastic, I could use that as I wrap up,

because we are coming to the end of our time here. And I also

want to take this opportunity of congratulating you on your new

role. And I like the way you envision the future of cyber and

I have no doubt that you will be super successful in your in your

current role. I wish you the very best. But once again, I'd

like to give you the opportunity of sharing some final words

before we call it for for today.

Thank you, Professor Chatterjee. It was a

pleasure for me to sit with you and have this conversation.

Again, you know, personally, I'm learning a lot. This has been a

great journey for the last four years, as I peek into the

different mindsets of our mates and very interesting journies.

It's not just about the technology, it's about how we

operate in cyber, how we can build relationships across the

board, both internally and outside. And as I said, as

platform based ecosystems become the central point of how

business models evolve, and how artificial intelligence machine

learning and these technologies come to the, to the middle and

how we deliver more and more of digital products, I think this

is going to get much more interesting, not just because

there is going to be more of regulation and compliance needs.

And at the same time, one other thing I want to mention as a

closing comment, there needs to be a digital transformation

within the cyber function itself. What I mean by that is

cut down a lot of plethora of tools, make it simple. Adopt

artificial intelligence, or machine learning to automate a

lot of the cyber functions, be it on the product side or the or

the Detect side. So I think there is there is a lot of

opportunity here, for people with software development

skills, people with program management skills, people with

product management skills, because I think cybersecurity

needs to move more towards the paradigm of product management

in terms of delivering cyber capabilities within the

organization. So there is an opportunity for agile

practitioners, data scientists. So I think there is opportunity

for a lot of different skills, not just specific cyber skills

with cyber certifications, because I see a lot of people

focusing on a lot of cybersecurity certifications I

think that is needed. That is for a set of functions, for a

set of roles. But I think cyber security as a community should

start embracing people with other skills, as I mentioned

earlier, and vice versa. I think there is a huge opportunity

going forward and kind of feel really happy and delighted to be

part of this movement at this point in time. Thank you again

for having me.

Thank you so much, Kal. I'm sure we'll

have many more conversations. It's been a pleasure.

A special thanks to Kal Sambhangi for his time and

insights. If you like what you heard, please leave the podcast

a rating and share it with your network. Also, subscribe to the

show, so you don't miss any new episodes. Thank you for

listening, and I'll see you in the next episode.

The information contained in this podcast is for

general guidance only. The discussants assume no

responsibility or liability for any errors or omissions in the

content of this podcast. The information contained in this

podcast is provided on an as-is basis with no guarantee of

completeness, accuracy, usefulness, or timeliness. The

opinions and recommendations expressed in this podcast are

those of the discussants and not of any organization.