The incredibly articulate Anne Leslie, Threat Management Consultant, IBM Security, shares some powerful messages and recommendations on threat management. One such message is to nurture a Whole-of-Enterprise approach where "leaders believe that the people who work for them are not just as important as the systems and the data, they're more important." Anne also emphasizes the importance of "looking within and knowing what it is that we have, why people might want that, and how they might go about getting it."

Time Stamps

00:42 -- So, let's begin by talking about the major information security threats out there and you being in Europe, we'd love to get that perspective.

05:49 -- Anything that you see out there by way of best practices, in terms of staying on top of the latest attack vectors and methods.

10:43 -- I'd love to hear your perspective on a human-centered cyber defense strategy.

19:20 -- I read in the media reports that organizations are often slow, and for lack of a better word, negligent in promptly and effectively responding to cyber intelligence. This is definitely a weakness that no organization can afford. What are your thoughts?

29:38 -- I'd love to get your thoughts on joint ownership and accountability, or shared ownership and accountability?

38:44 -- Any final thoughts?

Memorable Anne Leslie Quotes

06:29

"So one of the things that I notice in our industry, across businesses, is that we have a tendency to look outwards before we look inwards. And in practical terms, what that means is, we're not very clear collectively about what it is in our organizations and our businesses that adversaries might want."

06:29

"Let's start with looking within and knowing what it is that we have, why people might want that, and how they might go about getting it. If we already have answers to those questions, we're on a good footing."

13:34

"I believe that people come to work every day with an often unarticulated aspiration to be useful. And it just seems to me that we're totally missing out on capitalizing on people's best intentions and their creativity and their motivation - when we label them weak when we label them as a vulnerability against which we need to defend."

13:34

"People want to contribute, people want to be helpful, they want to be united in something that's a little bit bigger than themselves. And security practitioners, in particular, maybe not all of them, but the majority that I've interacted with, are driven by a desire to protect, they're driven by a cause. To them, security is more than a job, it's a cause they want to defend."

18:09

"It's not just about buying more technology, It's about doing more with what we have, where we are. And making the most of the capability that we can get from our people is a key factor in that."

23:41

"I loved what you just said about the impact of security being positively correlated with the health of the culture in the organization. Yes, a million times, yes! Because when you have a healthy organization - which is built up consistently, with consistent behaviors, consistent attitudes, consistent interventions on the part of leadership - what it instills, in people at every level of the organization, is a sense of accountability, a sense of responsibility, a sense of pride. And most importantly, it instills a desire to protect, because people have an emotional connection to their organization and an emotional connection to the leadership, even if they've never spoken to them."

----------------------------------------------

Connect with Host Dr. Dave Chatterjee and Subscribe to the Podcast

Please subscribe to the podcast so you don't miss any new episodes! And please leave the show a rating if you like what you hear. New episodes release every two weeks.

Connect with Dr. Chatterjee on these platforms:

LinkedIn: https://www.linkedin.com/in/dchatte/

Website: https://dchatte.com/

Cybersecurity Readiness Book: https://www.amazon.com/Cybersecurity-Readiness-Holistic-High-Performance-Approach/dp/1071837338

Welcome to the Cybersecurity Readiness Podcast

series with Dr. Dave Chatterjee. Dr. Chatterjee is the author of

A Holistic and High-Performance

Approach by SAGE publishing. He has been studying cybersecurity

for over a decade, authored and edited scholarly papers,

delivered talks, conducted webinars, consulted with

companies, and served on a cybersecurity SWAT team with

chief information security officers. Dr. Chatterjee is an

Associate Professor of Management Information Systems

at the Terry College of Business, the University of

Georgia, and Visiting Professor at Duke University's Pratt

School of Engineering.

Hello, folks, I'm delighted to welcome

you to this episode of the Cybersecurity Readiness Podcast

Series. Today, I will be talking with Anne Leslie of IBM, about

threat management and security, intelligence and operations best

practices. It's going to be a very exciting conversation, Anne

is a terrific speaker. I've heard her many times. And I know

you'll enjoy listening to what she has to offer. A little bit

about Anne. She is a Senior Managing Consultant for Threat

Management in the IBM Security Center of Competency. Within the

center of competency, Anne leads the application of Garage and

Design Thinking to some of the most wicked problems facing

security practitioners. And she is a fervent champion of human

centered approaches to improving security outcomes. Prior to

joining IBM, Anne's career spanned the intersection of

financial services, European regulatory policy, blockchain

and IT in leadership roles in both sales and advisory.

Bilingual in French and English, she holds an executive MBA from

the HEC Business School in Paris, and also has several

technology and cybersecurity certifications. Anne was born

and raised in the Republic of Ireland, and currently resides

in Paris, France, which has been her home now for over 20 years.

Anne welcome! thanks for making time to share your expertise

with our listeners here. So, let's begin by talking about the

major information security threats out there and you being

in Europe, we'd love to get that perspective.

Thanks, Dave, I'm absolutely delighted to be with

you. And I really appreciate the invitation. So the threats that

are, you know, prevalent. It's very easy in cybersecurity, to

feel constantly overwhelmed. There are threats everywhere,

affecting every industry. And they just you know that the

headlines just seem to give us this impression that it's an

unfightable wave, you know, that almost sort of resistance is

futile that there are threats coming at us from every

direction. And it's just all terrible. Now, that's not a

helpful state of affairs. And I'm not here to tell you that

there aren't threats. I'm not here to tell you that, you know,

we're not facing things that are serious, we are. But we're not

all facing the same threats. And that's one of the things that I

think is really important to emphasize is that all of the

headlines that are coming out and the bulletins and the

warnings, they don't apply to everybody. And it's knowing how

to sift through that mass of information, and to not get

lulled by fear into inertia, that that's that's really where

the secret sauce is in all of this. It's knowing how to

distill out of all of that, what is the intelligence that matters

to me, my team, my organization, what are the threats that

matter? And, one of the things that I've noticed in my time in

security is that the people who have real expertise in this the

people who have real mastery, and I'm not putting myself in

that category, right? I'm looking at sort of, you know,

Katie Nickels, for example, who's now at Red Canary and used

to be at MITRE, now an instructor at SANS. I'd look to

her often right, as a teacher in this space, and I've noticed

that the people in in cybersecurity who do have

mastery of their domain, they have no problem simplifying it.

They have no problem asking simple questions as a way of

getting started. And having that ability to ask simple but

targeted questions, it seems to come with confidence. I think

that's one of the things that we really need to help each other

do better in security is as practitioners, we need to help

each other, build the confidence to ask better questions, simpler

questions, more targeted questions as a way of starting,

and then getting incrementally better at identifying and then

defending against the threats that matter.

Excellent. Yes, that's precisely the way to

go about staying up on things. Talking about staying abreast of

the latest attack vectors and methods, like you said, every

organization needs to be able to filter through all the messaging

out there, all the information out there, all the intelligence

out there, and taking what is most relevant to their context

to their organizational needs. You know, anything that you see

out there by way of best practices, in terms of staying

on top of the latest attack vectors and methods?

So a personal life hack that I use, as a way of

filtering through, just there's too much information out there

right now on every single topic. And as a way for me, to manage

that information, what I have a tendency to do is go back to

timeless pieces of writing. And what I mean by that, I go back

to writings of stoic philosophers, I go back to the

Art of War by Sun Tzu. And the reason I do that is because

there is wisdom in there, that is applicable everywhere, in our

personal lives, and in our professional lives, and two

particular aspects of those writings stick with me. So from

the art of war, I would look for example, at the wisdom about

knowing yourself and knowing your enemy. And from the stoic

philosophers, this idea that we can't choose our circumstances,

but we always have a choice in response. So one of the things,

again, that I noticed in our industry, across businesses, is

that we have a tendency to look outwards before we look inwards.

And in practical terms, what that means is, we're not very

clear collectively about what it is in our organizations and our

businesses that adversaries might want. What do we have

that's valuable? Have we catalogued it? Have we

inventoried it? Do we know precisely what it is that

adversaries might want to steal from us? Do we know precisely

what are the systems, information assets, the

infrastructure that if it was attacked, or if it was subject

to some kind of harm, what parts of our business would cripple us

if they were attacked? And it's a simple question, getting the

answer isn't always easy. But it does blew my mind a little bit

that we are so bad in some ways as having an answer to it. And

not knowing is not a crime, right? I'm not trying to

castigate anybody here for not knowing but skirting around it

is negligence. You know, not asking that question is

negligence. So I always encourage, when I get the

opportunity, starts by looking within, start by talking to the

people, if you've got experienced people who've been

in your organization, system administrators, for example, go

talk to them. They're going to know, for example, what your

network looks like, they'll probably have a pretty good idea

of where you're vulnerable. Start there. Start by collecting

the intelligence that the people in your organization already

have about you. And once you've exhausted what you can get from

within your organization, then start looking out. But it's a

question of knowing what to look for. And you know, when we talk

about intelligence, there's the the framework of the

intelligence cycle, the first and the last stages of that are

the ones where I sort of see the most most problems. So we'd be

talking about to the planning and direction. You know, what,

what intelligence are we trying to gather for what purpose. And

that requires making choices. And as humans, we're not great

at making choices because choices imply risk, that always

the risk that we might get it wrong. But starting with looking

within and knowing what it is that we have, why people might

want that, and how they might go about getting it. If we already

have answers to those questions, we're on a good footing.

I love it, I'd like to re emphasize what

you just said. The two things that came to mind, first is,

ignorance is not bliss, when it comes to cybersecurity

management. I like the way you framed it, you have to look

inside first, you have to know what your vulnerabilities are as

an organization. And who's you? I guess it starts all at the

top, the senior management, the top management. Now, are we

expecting top management to know everything about security?

Absolutely not. But are we expecting them to be on top of

it to make every effort, like you said that it's not

acceptable to not know or make no effort to know. I think

that's probably the more appropriate word that and again,

negligence is a very powerful word, we'll talk about that as

we go along in this conversation. But at the onset,

as a senior executive, I would make every effort to know as

much as I can about the security threats that plague my

organization, or that could potentially affect my

organization, and how best I could organize to defend against

those threats. I would make every effort, so later on, if

something were to go wrong, and there's no guarantee that an

organization won't be hacked, so that is a possibility. If that

were to happen, I have a much stronger case, I can at least

emphatically state that I did everything I possibly could.

There are no dearth of resources, there are no dearth

of expertise out there. You have to make the effort to plug into

those resources, plug into those expertise. You're not, you know,

likely to have everyone that you would like, who are experts in

the field, but there are many who are really good. And there

is a lot of advice that is out there that you could benefit

from. So ultimately, it comes down to the will, the desire to

want to be on top of things. Fantastic. The next thing I want

to talk about, I loved reading this in your bio, you state that

you are a fervent champion of human centered approaches to

improving security outcomes. And you know, human element is such

an important element. You can't overemphasize the significance

of the human factor. I'd love to hear your perspective on a

human-centered cyber defense strategy.

Thank you so much for asking that question. So I,

I noticed when I first started working in security, that

frequently, we'd hear about how the human element was the

weakest element, how people are the achilles heel of the best

laid plans in security, how people make mistakes, how people

click on links, how people are what makes our organizations

vulnerable. Now, that grinds my gears on so many levels, because

I do believe that organizations depend on people, no! We live in

a world where organizations are fueled by human endeavor. And I

believe that people come to work every day with sometimes an

unarticulated aspiration but to be useful. And it just seems to

me that we're totally missing out on capitalizing on people's

best intentions and their creativity and their motivation,

when we label them weak when we label them as a vulnerability

against which we need to defend. So there are a few layers on

this. The first is that I am always positively blown away

when I get the chance to go and speak to security practitioners

in different organizations, and even not just security

practitioners, just people in general. People want to

contribute, people want to be helpful, they want to be united

in something that's a little bit bigger than themselves. And

security people in particular, maybe not all of them, but the

majority that I've interacted with, are driven by a desire to

protect, they're driven by a cause security is more than a

job, it's a cause they want to defend. And when I talk about

utilizing human centered methods, it's going and actually

interacting with these people and saying to them, how could we

go about making your day go better? How could we go about

allowing you to have more impact? What might we be able to

do to take obstacles out of your way? And those are simple

questions, but they don't get asked very often. And one of the

the experiences that I had earlier this year was talking to

a Level II SOC (security and operations center) analyst. And

I was interviewing him asking him, you know about process and

you know, how his day is structured. And we're talking

about systems he uses. And he was very suspicious initially in

the interview, a bit cagey and I, you know, I really had to

work hard to try and build up a bit of a rapport, put him at

ease. And eventually I just said it to myself, you seem to be,

you know, very wary of me. I'm not trying to catch you out. He

looked at me and said, well, okay, it's just nobody's ever

asked me before. Nobody's ever really seem to care. You know,

as I used to be a level one analyst and I got promoted to

level two. But, you know, we're kind of looked as though we're

grunts. We're kind of looked at as though, well, we can't

replace you yet with bots. But if we could, we would. And it

made me sad. It made me sad that there is so much potential

there. There are so many great people being thwarted for the

impact that they would be able to have for their organizations'

because we don't try to help them enough to actually do the

jobs, but deep down, they really want to do, they want to defend,

they want to protect, they want to feel that they're doing

something positive and constructive. And yet, too

often, they feel that it's futile, that the work they're

doing is a) unnoticed, b) unremarkable, and c) just

thankless.

And it shouldn't be that way. What we're up against

individually in organizations and collectively is too

important for us to miss out on leveraging all of that human

potential. So where I get the opportunity, I try to do

discovery around what's really going on for these

practitioners. And I do my utmost to then communicate it to

the leaders in those organizations, to translate it

into business terms, risk impact, and say, if we did this,

it will allow you from an executive perspective, to have

these, this impact and these outcomes which matter to you

from an executive perspective. But it's not just about buying

more technology. It's about doing more with what we have,

where we are. And instrumentalizing capability

that we can get from our people is a key key factor in that.

Wonderful, very well articulated, in fact,

several thoughts come to mind, as I hear your take on

involving, engaging humans; as you've heard me mentioned

several times and in my talks, I'm a huge fan of theme or

statement that cybersecurity or cybersecurity readiness is

everyone's business. This is not just a domain for technology

experts. This is not just a domain for information security

experts. Everyone needs to get involved. And I couldn't agree

with you more when you said that people come to work with great

intentions, they want to do great things. The exact same

view was articulated in my first podcast, with the president of

an insurance company, he said exactly the same thing. We must

trust in the people in our organization, they can do great

things, we are not asking them to all become cybersecurity

experts, we should not frighten them away by making them think

that they have to learn all these technical details. But we

can definitely equip them with the necessary knowledge that

could help us deal with one of the key threats in cyber

security, which is hacking, and as you know, 99% of the hacks

are focused on the vulnerable humans. Along those lines,

there's one more thing I'd like to share with our listeners, I

talked about it in my book. And that relates to how do you

create a cohesive culture, a human-centered

We-Are-In-It-Together culture? Whenever we use the word

culture, you know, it's kind of abstract. People like to stay

away from it, because it's easier said than done. But as

you know, there's a lot of research, backed by great

evidence, case studies, that the more high-performing the

culture, the more effective the firm performance. So what how do

you create this high-performance information security culture, I

won't get into all the details of it. But one thing I'm going

to mention, and that is striving to build emotional capital, over

a period of time, where employees feel valued, and

develop a sense of belonging, they take pride in their work.

They're having fun. And last, but not the least, they perceive

leadership to be genuine and authentic. We've touched upon

this earlier, we will touch upon it again. At the end of the day,

I'm convinced that it really boils down to how committed, how

involved, how engaged, top management is, because then

that's the spirit that spreads throughout the organization that

infuses people to do great things. And the result is

generally great. Fabulous, you really got me going here Anne.

I'm not the guest, but I'm going to switch it back to you

shortly. So let's talk about what you do at IBM, in the area

of security, intelligence and operations. By way of a prompt,

and again, feel free to deviate from it. One of the things that,

once again, strikes me as extremely important is, I read

in the media reports that organizations are often slow,

and for lack of a better word, negligent in promptly and

effectively responding to cyber intelligence. This is definitely

a weakness that no organization can afford. What are your

thoughts?

So there are a few aspects to that. The first one

is that we have, and I mean that in the broader sense that we as

a society, we love to, we love to blame. We love victim

blaming. Yeah. And yes, there's always they're always

contributing factors. We need to look at root causes, we need to

find out what happened. But the tendency that we have to try and

pin blame frequently on an individual in my view is

unhelpful and we do it way too often. There are some been some

very, very high profile breaches where responsibility was

assigned to the chief information security officer.

Generally that person gets dismissed in disgrace. Okay. Is

it an appropriate response? That's probably a conversation

for another time, but the thing that really bothers me about

that approach is that, were any real changes made to the

fundamental systemic problems that exists in those

organizations. Was there any organizational cultural change?

Were there any leadership changes? Did we really exercise

due diligence in being disciplined? And looking at why,

from a systemic perspective, that breach happened? And I

would hazard a guess, and say, No. That's the problem. That's

where leadership is absolutely essential. Because it doesn't

matter how great we have, how great the people we have lower

down the organization, if the culture is one of blame, if the

culture is one of making individuals responsible for

organizational failure, then security will never be able to

deliver. So I loved what you just said about the the impact

of security being positively correlated with the health of

the culture in the organization. Yes, a million times, yes.

Because when you have a healthy organization, which is built up

consistently, with consistent behaviors, consistent attitudes,

consistent interventions on the part of leadership, what it

instills, in people at every level of the organization, is a

sense of accountability, a sense of responsibility, a sense of

pride, and most importantly, a desire to protect, because they

have an emotional connection to their organization, an emotional

connection to the leadership, even if they've never spoken to

them. There's an emotional connection, which says, I feel

responsible for the person to the left of me, the person to

the right of me, I feel responsible for the things that

we work on, the data, the systems, I'm going to make an

effort that if I see something that's a bit odd, a bit of

scans, I could just walk on by. But if I care, if I feel that

emotional connection, I won't walk on by, I'll find a way of

alerting somebody who can do something about it. And people

who are disengaged from the organization, don't care. They

don't have that emotional connection. So they won't make

the effort. And in the worst cases, that's where you get your

insider threats is where people are so, so resentful, so bitter,

so disenchanted. That they want to hurt the organization that

they work for. So security, yes, we have systems, we have

technology, we have processes, we have security operation

centers, we have all of the component parts of security as a

domain, but for security to really infuse the fabric of an

organization.

It will never have the impact it needs to have unless the

organization as a whole is already functioning well as a

collective body, with leaders who care leaders who connect

leaders who believe that the people who work for them are not

just as important as the systems and the data, they're more

important. And we try them to enable them. We try to protect

those people. And there is a real difference in in the the

outcomes that you will see in companies where the leadership

embodies this belief that people matter. That's an organization

where you can do amazing things with security, because it will

be a whole of enterprise initiative. And like you say, We

don't need everybody in the organization to know all the

specifics of what happens on the back -end of security. We have

experts to do that. But we need to have a whole of enterprise

approach so that people care.

Love it, love it. The whole of enterprise

approach. That makes so much sense. In fact, I'd like to

again, highlight a few things that you talked about. I

believe, you emphasized the importance of getting away from

the scapegoating culture. We don't need that. I think as you

said, brilliantly, when a problem happens, when there's a

major breach, the easy part is to point to an individual, blame

that person person, fire him or her. And often the organization

comes across as very responsive, acting promptly and often the

organization is rewarded by the financial markets. But even I am

of the opinion as you that that may not be the right approach,

the organization has to look deeper. Root cause analysis is

an approach or method that is widely touted whatever the name

whatever the acronym bottom line is, you've got to look deeper

into your systems and processes to see what went wrong. As

compared to just blaming one person, by replacing that person

really would you have solved the problem that caused the breach,

let's say; that may not be the case, there might be a need for

bringing about more systemic changes in structure, in

processes, in training. So it has to be an organization- wide

effort. So we've got to be much more substantive in our

approach, and not being very superficial. So that's kind of,

it is important to remind folks, that, at the end of the day, we

want an organization, like you said, where everyone comes

together as a team, and wants to do their best to protect. In

return, there is an expectation that while I do my best to

protect the organization from getting breached, the

organization also has a responsibility to give me the

benefit of the doubt and protect me. And I know that we might be

entering a territory that has its pros and cons. So not trying

to suggest that there is this one right approach, but at least

trying to alert the leadership that you've got to look at it

more holistically. Along those lines, and the next thing I

wanted to discuss with you and you touched upon it, which is

about joint ownership and accountability, or shared

ownership and accountability. Easier said than done. But if

there are structures and mechanisms through which this

can be accomplished, that's another way of bringing the

business people, the operations people, together with the

security people. And I also include the vendors, the service

providers, because organizations are often leveraging their

services, it's very important to create a true partnership, where

everyone has a stake in the game, as opposed to, here are my

services you've paid for it. So you have access to these

servers. Here is how you set the security for the servers. Now,

now that I have trained you, I've given you some tutorial,

it's your problem, nnd not mine. Instead of taking that approach,

being there and saying, yes, we will support you as you manage.

That is how I look at it. I'd love to get your perspective,

your thoughts?

Great question. One of the real obstacles to

security delivering outcomes that are positive for the

business, visible to the business, is that security in a

lot of organizations is still very much siloed. The security

team does security. And you'll have the ops team and the

infrastructure team doing their thing, separately. And, it gets

even more complicated, if for example, in the mix, you have a

managed security provider from an external organization and an

external infrastructure provider. And one of the things

that I've seen again and again and again is massive, massive

frustration in security teams saying we know where the

vulnerabilities are. We keep flagging them. Can't do anything

about them. Because we don't have access to the

infrastructure. We don't have access to those assets. So what

frequently happens is that they alert and it kind of, for want

of a better expression, gets thrown over the fence to the

infrastructure team. But the thing is, is that the security

team is measured on a certain set of metrics and KPIs, the

infrastructure team is managed on something completely

different. And if the infrastructure team took

instruction already, that's one of the things they don't want to

take instruction from the security team, who are you to

tell me how I should be doing my work. So you have that problem,

there's an interpersonal issue there. And they frequently

fight, they hate each other. But the the impact in terms of

security is that the infrastructure team gets

measured on uptime, and they have their own set of

performance metrics and implementing the best advice

coming from the security team would actually adversely affect

their performance metrics.

So what happens is that you end up having a false view from an

executive level, because both teams are probably doing vanity

reporting, because they don't want to look bad, you know,

their metrics, and their dashboards are probably green.

And yet, the enterprise is probably pretty vulnerable.

Because alerts are coming in, there are known vulnerabilities,

but they're not being fixed, because there's no incentive to

actually go fix them because it will actually adversely affect

the metrics against which people are measured and incentivized.

So again, leadership problem, we're not measuring the right

things. And we're not incentivizing the right types of

behaviors, to get the teams who have dependencies on each other,

to deliver an outcome that matters for the business. We're

not enabling them to do that we're actually setting them up

for conflict and failure, because they have antagonistic

incentives, they have antagonistic performance

metrics. So what would need to happen and again, you know, sort

of human centered approaches, but it's like design thinking is

bringing those people together, allow them to actually build a

relationship, get them talking, allow them to express what it

is, that frustrates them about the people on the other side of

the fence, and then explain much you probably don't even need to

explain to them right, people aren't stupid. They know,

intuitively what needs to be done. But it's let's find a way

again, you know, your analogy of we're all in it together a team

sport. Nobody comes to work. I really don't believe this, that

people come to work wanting to fight, right. And yet we do in

companies, we spend a lot of time with turf wars and

politics; wouldn't it be great if we could actually focus on

something that was much more positive, much more

constructive. So trying to get the security teams with the

infrastructure teams and with leadership, so that the

leadership actually realizes how badly aligned incentives cause

people's days to be full of hostility and aggression,

friction, and bad outcomes. How might we go about actually

instilling something much more productive, where there are

aligned incentives towards a shared objective, which is one

of risk reduction and better defense?

Well, wow! Totally agree, in fact, what a

great segue way to the next topic, and probably the final

topic of our discussion, we can go on and on. But in the

interest of time, we'll probably have to draw a line somewhere.

But I wanted to touch upon performance measures before we

ended this episode. And you already talked about it, and

you're such a great articulator of these very important trends

principles. I'd like to say a few things about performance

measures, what I have found in my research and work with

organizations, unfortunately, often what gets measured is what

is convenient to measure measure, not what needs to be

measured. And I have seen that problem with e-business

initiatives. And I wouldn't be surprised if that problem

transcends and also exists in the cybersecurity governance

space. Once again, referring to my book in the appendix, I share

some examples of cybersecurity KPIs and I come at it

holistically, because as you know, when you are assessing or

evaluating performance, it cannot be unit dimensional, it

has to be multi dimensional. So from the standpoint of cyber,

you have to look at the business value impact, you have to look

at the productivity impact. You also have to assess extent of

preparedness, nature of incidents frequency of

occurrence, compliance. So there are various aspects that needs

to be monitored, and you need good measures to monitor. And

you put it so well when you said your call to align these

incentives. Because if I'm doing these things, if I'm attending

Cybersecurity Awareness classes, and if I'm being able to apply

some of the training in practice, who's watching, who's

recognizing, so at the end of the year, or whenever the

performance review happens, are my efforts in becoming a better

cybersecurity citizen are my efforts being recognized. And at

the end of the day, like you said, when people come to the

organization, they all want to do great things. But it is also

human nature, to want to be recognized to want to be

appreciated, and there's nothing wrong with that. And often, I'll

hear somebody say, well, they get paid. And I don't think

that's good enough, we all get paid to do what we do. But

there's something to be said for the other forms of recognition.

And that comes through some of these measures, and you're

tapping into the findings. And then accordingly, making

adjustments where you need to praise the person, please do so

praise a function, please do so. There, you need to change

tactics, you somebody needs more counseling, more help make those

efforts. And along those lines, there's something else that I

have often preached shared with whoever wishes to listen. And

that is, we have our annual reports, where the key aspects

of performance are highlighted for the shareholders. And I feel

that there should be a line in there are a couple of lines in

there, where the cyber performance should be talked

about. Especially when there are no breaches to report, it has

been an uneventful year, doesn't mean you go silent. let's

recognize the people who are behind the scenes, doing the

good good work. And for all, you know, that's the reason why

there has been no incidents. So as organizational leaders, we

have to be very mindful of these things. And once again, take a

very holistic approach to readiness to preparedness,

because that's how we are going to bring the best out of of

people. So and as we are coming to the end of this discussion,

share with the audience any final words, any final thoughts,

reflections?

Absolutely. So I'd love to just to jump on what you

just said, which is reflecting as well, in the context of

Mental Health Awareness Day, right? So mental health is an

issue in cyber, and it's linked to the stress. And there's also

an aspect of the futility, there can be a sometimes feeling that

resistance is futile, that what we're doing is futile. We only

ever get noticed when things go wrong. We never get acknowledged

for all of the things we're doing to reverse the breaches to

avert the terrible headlines. So I love what you just said, it's

super important to acknowledge what didn't go wrong. If things

have been quiet, fantastic, well done. And I think it's really

important to bring the cyber security teams the information

security teams, into things like reporting on customer

satisfaction. So for example, you know, I've been doing some

work in the banking industry, we'd be looking at Net Promoter

scores, okay, that's an imperfect measure, but for the

volume that it does where customers are satisfied? Well,

it's because they feel secure doing their banking. It's

because they've been able to access their bank accounts, it's

because they trust that the balance that they're seeing in

their mobile app is actually the money that they have. Security

is instrumental in that. So when a business is reporting the fact

that customers are happy, we need to also acknowledge that

security paid played a role in that, where business continuity

hasn't been impacted, adversely impacted adversely. Again, same

thing. So anytime we're reporting on things that are

going well, let's emphasize them, let's accentuate them. And

let's acknowledge all of the contributors to that, including

security, we tend to only talk about security when things have

gone wrong. But no, you know, this whole of enterprise

approach that I mentioned earlier, customer satisfaction

in a digital enterprise, which is increasingly every enterprise

these days, security is a key player in that. So where things

are going wrong, let's fix them. Let's be curious about them.

Let's be disciplined and intellectually honest, when

we're looking for root causes, and how we can better address

them. But let's not just focus on the negative, let's celebrate

small wins. And it's super important for operational teams

who often feel overwhelmed, unloved, and thanked. Let's find

metrics for executive level reporting. It's important for

securing it's important for investment. But let's also have

metrics that allow the people who are turning up every day to

do security, to provide defense, let's find some way of taking

the futility out of their day to day, let's take away some of the

frustration. Let's find a way of celebrating the things that are

going well, the things that we've managed to achieve.

Because it's really important from a mental health

perspective, from a motivational perspective, from an engagement

perspective, people are the core of security. So let's celebrate

them. Let's celebrate us. And let's find a way of

communicating the value that we bring individually and

collectively at our level, and then amplify it and defuse it

and give it to our leadership in a way that helps them secure the

business. But let's not underestimate how important

small wins are, we can find something to celebrate every

day.

Well, thank you. And thank you very much for

your time, your insights or perspectives. It is much

appreciated, and I hope you will come back again to share your

thoughts and perspective. Thanks again.

Thank you so much Dave.

A special thanks to Anne Leslie, for her

time and insights. If you liked what you heard, please leave the

podcast a rating and share it with your network. Also

subscribe to the show, so you don't miss any new episodes.

Thank you for listening, and I'll see you in the next

episode.

The information contained in this podcast is for

general guidance only. The discussants assume no

responsibility or liability for any errors or omissions in the

content of this podcast. The information contained in this

podcast is provided on an AS IS BASIS with no guarantee of

completeness, accuracy, usefulness, or timeliness. The

opinions and recommendations expressed in this podcast are

those of the discussants and not of any organization.