In a highly engrossing and in-depth discussion, Tej Patel, Vice President, and CIO at Stevens Institute of Technology sheds light on the various information security challenges that plague academic institutions and how best to deal with them. He talks about establishing a highly collaborative and security-centric culture, structuring an ideal CIO-CISO relationship, effective execution strategies, and more.

Time Stamps

01:57

Why don't you give listeners an overview of your professional background?

02:57

Let's begin by discussing the information security challenges that academic institutions face.

05:17

So the challenge lies in enabling the university pursue its mission as safely and securely as possible. Is that a fair understanding of the fundamental challenge?

09:09

How do you keep up with all the activities that are going on across campus or at satellite locations if you'll have satellite locations? What's the mechanism in place whereby you would be forewarned, people will feel the need to say, hey, we need to talk to the security office, because this has some serious security implications, and we want to make sure that we are doing it the right way.

13:44

How feasible is it to offer customized guidance to the various operating units at an academic institution?

16:23

What is your vision of an ideal CIO-CISO relationship?

21:40

If you could share an example of how you and your team brought about a change in the security culture at your institution

25:03

What steps do you all take to secure the student population as best as possible?

30:25

People are busy, they have to deal with so many things. So that becomes another chore where you are expected to diligently look through every email and see whether any particular email deserves to be reported. Where are you on this? What's your perspective?

35:25

How should organizations prepare for cyber attacks? And what does it take to execute plans effectively in a sustained manner?

39:49

I'd like to give you the final word.

Memorable Tej Patel Quotes/Statements

"Cybersecurity is a moving target in higher education."

"Cybersecurity is a shared responsibility to provide a protected cyber infrastructure on campus."

"Building trust and relationship are so critical; that allows my team and me to have a conversation with our researchers to fully understand what exactly they are trying to achieve."

"There are a lot of things that we have changed in our practices to ensure that we instill the culture of cybersecurity in our business from day one."

"It's not so much about reporting structures, it's more about how a CISO and CIO can partner together to deliver the message that cybersecurity or security is a strategic value service for any institution or organization."

Nowadays, the role of the CISO and the CIO is more geared toward reducing business risk. It's all about risk management.

"Organization must spend sufficient time, effort and resources to build a security-centric culture."

"It's not so much about reporting structures. It's more about how a CISO and CIO can partner together to deliver the message that cybersecurity or security is a strategic value service for any institution or organization."

"The role of CISO and CIO, in my view is more towards reducing the business risk nowadays."

"They expect the cybersecurity economy to grow to $10 trillion by 2025."

"You have to go back to the basics, do the basics right. Make sure you're transparent, make sure you find good people on your team who are stewards of good security hygiene and do your best efforts daily."

"The majority of the breaches happen not through any highly sophisticated cyber attacks. They happen because basic controls are lacking, fundamental training hasn't been provided, unsatisfactory patch management, and more."

"We also pay very close attention to finding that balance between user experiences and maintaining the security."

"Someone recently shared some statistics about cyber attacks. It happens every 39 seconds. The ransomware attacks are targeted every 14 seconds, and only 10% get reported."

Connect with Host Dr. Dave Chatterjee and Subscribe to the Podcast

Please subscribe to the podcast, so you don't miss any new episodes! And please leave the show a rating if you like what you hear. New episodes release every two weeks.

Connect with Dr. Chatterjee on these platforms:

LinkedIn: https://www.linkedin.com/in/dchatte/

Website: https://dchatte.com/

Cybersecurity Readiness Book: https://www.amazon.com/Cybersecurity-Readiness-Holistic-High-Performance-Approach/dp/1071837338

Hello, everyone, I'm delighted to

welcome you to this episode of the Cybersecurity Readiness

Podcast Series. Today, our guest is Mr. Tej Patel, Vice President

and CIO at Stevens Institute of Technology. So I'm really

thrilled to welcome someone who is from my industry, academia,

and I can't wait to learn more about his thoughts and

perspectives on how you secure academic institutions from

different types of attacks. Our discussion will revolve around

unique security challenges, CIO-CISO relationships,

preparing for cyber attacks, effective execution strategies.

So we will be covering a lot of ground and I hope you find it

interesting. But before we get into the details, let's bring

our guest into the discussion. So welcome, Tej. Thanks again

for making time,

Dave, pleasure to be here.

So Tej, why don't you give listeners an

overview of your professional background?

Absolutely. They and again, it's my pleasure to be

here and look forward to sharing some of the thoughts around this

very important topic in all industry, in fact. So, a little

bit about me, I have been in higher education for almost 20

years now. My first job was in higher education, and I'm still

in higher education. Prior to joining my current organization,

I was at University of Pennsylvania, where I have held

several roles, most most recently, Chief Information

Officer for Penn Nursing. And in August of 2020, I joined Stevens

Institute of Technology as the Vice President for Information

Technology and University CIO. I am responsible for end-to-end

digital, IT cybersecurity enterprise data and data

services, classroom technology and learning technology.

Okay, fantastic. So let's begin by

discussing the information security challenges that

academic institutions face.

Yeah, I think that's a great question. And before I

share challenges, I must tell you that cybersecurity is a

moving target in higher education. Right. And I, as I

tell my team and my constituency is that it's a team sport, where

it's a shared response, cybersecurity is a shared

responsibility to promote a protected cyber infrastructure

on campus. Right. And some of the challenges are unique to

higher education. But I think there are a lot of similarities

as well, when we look at banking, financial institutions,

or pharmaceuticals or healthcare and what have you, right. There

are specific areas within higher education, I believe, that are

very challenging to manage and maintain and meet the

expectation. For example, research, particularly research

IP, when a researchers is doing or conducting a research that

deals with a treatment or DOD or confidential data Department of

Defense. It's a very unique environment at that point. Then

you have students data, that is also very high target,

libraries, right, where open research, it's the motto, right?

The network is open in some of those areas where it creates a

very unique challenges where you want to find a perfect balance

between security and allowing learning and teaching to take

place for our students. Right. Classroom instructions nowadays,

right? Particularly throughout the pandemic, and the journeys

that we all went through, how do we secure that kind of hybrid

environment where we live in an increasingly interconnected

world? Right. So these are some of the unique challenges that we

have from a business perspective that I find it extremely

challenging to manage, and make sure that we are able to find a

perfect balance, where we are not hindering the progress of

faculties and students. So those are a few few things come in

mind.

That makes a lot of sense. In fact, as you

were articulating the challenges, I was reflecting on

my experiences and expectations as an academic, the faculty

members would like to operate in a very autonomous and open kind

of an environment and environment that would enable

the pursuit of research and teaching as freely and

independently as possible. However, as you rightly pointed

out, there is a lot of sensitive data that needs to be carefully

managed, protected, we're talking about intellectual

property, student data, library resources, and more. So the

challenge lies in enabling the university pursue its mission as

safely and securely as possible. Is that a fair understanding of

the fundamental challenge?

It's more about understanding a researchers'

needs versus wants. I think that's where we draw the line.

But more importantly, building that trust and relationship that

is so critical, that allows my team and myself to have a

conversation with our researchers to fully understand

what exactly are they trying to achieve. And once we understand

their needs and requirements, we are able to create custom

solutions that allowed them to flourish and produce the amount

of work that they're committed to do. But we also take this

opportunity to educate them as well. So it's a learning on both

sides, right. And I think that's the most important thing that we

all need to understand that it begins, we need to have a

dialogue where both parties are able to understand like, right

before this call, you mentioned, make sure if I use any acronyms,

I spell it out. Right. And this goes same for a lot of our

faculty members who are tremendous researchers, they are

10X knowledgeable compared to some of us in our team. But

there is that's their expertise. And we have our own expertise.

The goal is to how do we bring both expertise together to meet

that digital ambition for that particular individual faculty.

And when that happens, a lot of great solutions come to life,

right? Most recently, we partnered with one of the

faculty where we were able to create a closed VLAN network

where he was able to conduct his research. And our CISO was also

happy that this this partnership took place because we also

reduced the overall risk that is associated with this kind of

setup. And lot of time, then we document all of this in our

exception processes. And everyone was it was a win-win

for both where the researchers were allowed to conduct their

research, the security folks and the network folks said that

providing this environment in the most secure possible way

that we could. And and this is the type of partnership that

will be required to address some of the challenges. Dave, there's

one more thing I also wanted to mention around the challenges,

right, there are two specific challenges that I believe were

unique to Higher Ed as well. Number one is having

non-centralized security perform on campus, right? Because you

know, the larger the organization, the larger the IT

teams and the research that take place in a localized area,

right? And they all have independent systems, how do you

bring them together? Right. And the second one is, majority of

the universities are still dealing with outdated systems,

whether it's desktop systems or service systems. And that also

creates rather unique challenges to keep up with what's happening

in the security. So those are a few things that probably we need

to pay very close attention to.

very true. In fact, when he talked about

the importance of a collaborative relationship, it

brought to mind a podcast that I just published today, where the

guest talks about transitioning to the cloud, and how they were

very successful. Because it was an all hands on deck, kind of an

operation. Everybody was engaged. Everyone recognize that

this organization, which was the American Cancer Society, they

couldn't lose any more money because money was needs to go to

research and not be spent on on it operating costs. So they were

doing their best to optimize operations. So that's an

interesting story. But essentially what he was trying

to say is, is is is similar to what you're saying, is that The

importance of collaboration. That brings up the next

question, you know, a university setting different schools,

different departments doing so many different things. And you

gave us this example of helping a particular researchers set up

a virtual LAN so they could securely, you know, exchange

information with their colleagues in other parts of the

world. How do you keep up with all the activities that's going

on across campus or at satellite locations? If you'll have

satellite locations? What's the mechanism in place where you

would be forewarned, people will feel the need to say, hey, we

need to talk to the security office, because this has some

serious security implications that we want to make sure that

we are doing doing it the right way.

I think that's, that's a very good question,

Dave. Again, and there are some specific steps that we have

taken to to gain that visibility campus wide, right, whether it's

one campus or multi multiple campus. The first and first most

important thing is, is having a solid cybersecurity program and

governance that will guide us through some of those challenges

that you describe in your question. For example, how are

we partnering with procurement? Is our CISO and, and, and CIO

involved in some of the new contracts that are being

reviewed or drafted? Are we following hacker guidelines? Are

we following certain steps to ensure that privacy and other

standards are being followed? So there are a lot of things that

we have changed our practices to make sure that we instill the

culture of cybersecurity in our business from day one, right? So

before even a software platform shows up on our campus, we have

some visibility, and IT and and the Security office are part of

this conversation. That's number one. Number two is what happens

once all these platforms and activities are taking place on

campus, right? It requires solid 24/7 monitoring, right? So we

have partnered with external vendors, for example, we have

24/7 SOC center, a security operation centers where we are

we are monitoring and detection and response takes place in that

area, right? We have developed risk profiles, where we are able

to look at university wide between manage assets and non

managed assets. Where do we stand overall, in terms of patch

management, OS deployments and all of that, right? And the last

and the most important is network monitoring and

partnership with our network ISP provider, right? How do we work

with them to make sure that we have a good visibility

throughout our entire network, whether it's wired or physical,

and that is what allows us at a very high level, to make sure

that if we see some activities like Bitcoin mining or what have

you, that's taking place, we are able to stop the problem before

it becomes a larger issue. So those are some of the steps we

take very proactively on a daily basis. And then on a weekly and

bi-weekly basis, we have executive updates as well, where

I get briefed on on certain incidents that takes place

certain projects that are moving on, or just simply speaking,

just just review of some of the KPIs that we have built around

to improve our security posture.

Makes a lot of sense. So you mentioned about

creating a collaborative learning environment, where your

unit is learning about the researchers, about what they do,

and they're learning about the role of Information Technology,

Information Security personnel. So, you are essentially feeding

off each other's knowledge and expertise. And that's great. In

that spirit, how feasible is it to provide every unit, every

department with a customized do's and don'ts list?

I would, for us at least, that journey starts as

part of our onboarding process, particularly speaking faculty

orientation, there are very specific sessions geared towards

data security and privacy. They were we walk the new onboarding

faculty members, the resources that they have available, how to

partner with IT. And this goes back to your do's and don'ts,

Don's. Not going to go into a lot of details there. But at a

very high level, we provide the data classification review, and

what that entails right. High, medium, low risk, and where and

how they should partner with IT, and the Security to ensure that

the data that they are acquiring or sharing, it meets some of

those guidelines. Followed by once they determine their high

medium risk data, there are some specific guidelines that have

been put together, whether it's related to Cloud Storage, or

servers or virtual servers, or what have you. And that guides

them to have to make sure that this data and the systems remain

secure. Furthermore, there are certain there are specific

instructions that we also provide because many of these

faculty work with graduate students as well. And we have

very specific guidelines for for them as well whenever CISO meets

with them actually on a regular basis to make sure that these

guidelines are being followed. And the last one is we created a

dotted reporting structure, sort of, where the local tier system

administrator and researchers, they work very closely with our

systems and infrastructure group, where they have learned

to share some of the details at the system level to make sure

they are following the best practices, whether it's a Zero

Trust framework, or NIST framework that we are adopting

and deploying some of the controls to make sure that

university wide we have a similar controls applied and

Okay. Good to know, good to know. So let's

configured.

talk a little bit about the CIO-CISO relationship. You know,

you keep referring to we we we, which sounds great actually

seems like you're a very integrated, cohesive team. But

what is your vision of an ideal CIO-CISO relationship?

It's a it's a great question. And there's so much

debate going on, right? Do you couple them, do you decouple

them? What's the reporting structure looks like and this

and that, right? There are three main topics that a lot of folks

talk about right one where CISO reports to CIO, one where a CISO

reports to the CEO or President. Right. And I think the third one

nowadays, the new one that I hear is the CISO reports to the

CPO, the chief privacy officer, right? That's it. Those are the

three themes I have seen. But really the way I look at it,

it's not so much about reporting structures. It's more about how

a CISO and CIO can partner together to deliver the message

that cybersecurity or security is a strategic value service for

any institution and organization. Right. This is

something that is beyond CIO and CISO relation. It's about

instilling a culture of security at large and institution, right?

How do we leverage and implement governance structure around

security that allows us to bring together, work together, right.

For me, the CISO does report to me, but one of the major changes

that we instilled is the CISO also has dotted reporting into

our Audit and Risk committee as well for full transparency and

visibility. And that's the way I look at it, right? We don't want

to control anything, but how do we bring information to life?

How do we share some of these learnings lesson learned? Right?

And how can we be transparent with the community and the

Board? That what are some of the challenges? What are some of the

things we are doing well, and what are some of the deltas that

we need to constantly adapt and and proactively address some of

those right? And the last and the most important, which I also

pointed out earlier, right? The role of CISO and CIO, in my

view, is more towards reducing the business risk nowadays,

right? It's all about risk management there. Right? It's

not about technology, cybersecurity, 10 years ago, it

was all about bits and bytes, right? But now, if you look at

the CISO, who understands bits and bytes, but also pays very

close attention to figuring out the business risk, and how to

manage that business risk and works with CIO very closely as a

peer. They are the ones who are going to make sure that the

institution or the organization remains safe. And they could

provide the value added services that any organization will

benefit from. So that's the way I look at that CIO CISO.

relationship in today's world.

I couldn't agree with you more. That's a

very holistic approach. It's a very pragmatic and practical

approach. And as you said, one can always debate the different

reporting relationships. And each reporting approach has its

pros and cons, there is no one perfect approach. Absolutely.

But the extent to which you can strike that balance where there

is independence, yet, there is cohesion, you don't want to

create a situation where the structure is such that you have

a competing relationship where it becomes you know, then then

we have constant have conflicts. And that's what you want to

avoid, because they have to address the different pieces of

the puzzle so that, you know, each has a certain role to play.

I have a couple of follow ups for you. Absolutely. I'm so glad

that you talked about transparency, I feel very

strongly about it, that the keeping the various stakeholders

informed about where the organization is, in terms of

readiness, what are the possibilities? Without, you

know, again, when you are transparent, you're mindful that

any and everybody is not getting the information. But you don't

want the stakeholders to be surprised that what happened? We

never knew anything about this. Why didn't you brief us? So the

fact that you mentioned about transparency and regular

reporting to the board and to the other stakeholders, that is

definitely very reassuring. You wanted to say something I'm

sorry, I didn't mean to,

One of the example I was going to share with you in

this audience is, is there are ways to craft business cases

together that improve user experiences overall, right. And

that's the strength when you have CISO and CIO working

together, one trying to bring that efficiency or tools or

platforms versus one is making sure that the tools and the

platforms that that we are we are adding to our ecosystem is

being managed securely, data is being protected. And that's the

type of environment that that will be very successful in the

coming days.

Yeah, yeah, true. The other thing that I

wanted to touch upon was culture. In my book that I

published last year through sage publishing, I talk about the

importance of creating and sustaining a high-performance

information security culture. Commitment, preparedness, and

discipline are the cornerstones of the proposed high-performance

information security culture, in my book. Each of these cultural

dimensions -- commitment, preparedness, and discipline --

are associated with a set of success factors. I don't want to

get into all the details of how to create and sustain such a

security culture, because that's something that one can pick up

from reading the book. However, it would be valuable, if you

could share an example of how you and your team brought about

a change in the security culture at your institution.

I think that's, that's a very good question. And

we could have conversation about that probably for hours. But at

a very high level, I will touch upon a little bit where I talked

about Protect Stevens cybersecurity program, part of

that program, there are a few things that we did that I'm very

proud of. Number one, we made certain tools available to our

entire community at no cost, right. For example, our entire

faculty, staff, student community enjoys LastPass and

and anti-virus that they're able to download at no cost, because

we wanted to make sure that no matter what environment they're

working from, no matter what devices they're working from,

it's safe. So for us, our approach starts from their home

security, right? How do we make sure that that our users are

fully aware of what's happening? So we wanted to make sure that

tools are provided. That's number one. Second, we made sure

that they were provided periodic security awareness training,

right? There was some gamification and all of that and

based on how they did they were rewarded certain things as well.

Right? We celebrate Cybersecurity Awareness month

where the CISO and CIO together provide state of the

cybersecurity at the University and it's an open event to

faculty, staff and students. Again, this goes back to the

creating that culture of fairness and transparency. It

begins With CIO and CISO goes all the way to faculty, staff

and students. Right. This is how we approach today's

cybersecurity at Stevens, Dave. And it has been very successful,

it generates a lot of dialogue among the community. And the

last one that I should also add is to our student program, we

also hire cybersecurity undergrad and grad students as

well who work very closely on our CSIS team, right? Whether

it's cybersecurity or physical security, because we might

monitor and manage both of those system, and they help us improve

some of those experience from their own experiences, they come

and tell us this, this is working, this is not working,

and we try to learn and adopt from them. So these four things,

I find that we have done it very well, that builds the culture

that we talked about.

Fabulous, I'm so happy to learn that you

are providing students with hands-on experience by involving

them in different cybersecurity projects. Duke University is

another institution that does that. And I'm sure there are

many others doing the same. You also talked about making

available the various security tools for free. So there are no

excuses, excellent! Securing the student population can be a big

challenge, and it's heartening to hear the many concrete steps

you're taking to deal with this challenge. At this time, it

might be a good idea to revisit this important aspect of

securing an academic institution. So what steps do

you all take to secure the student population as best as

possible?

The majority of the breaches happen not through any

highly sophisticated cyber attacks, right? It happens

because of basic controls are lacking. Some fundamentals

training haven't been provided, patch management, and and what

have you. So at the very minimum, what we try to do is we

regularly communicate with our student community. I have a CIO

Student Advisory. So we also leverage that advisory committee

to make sure the word gets out about phishing, scam, right?

Password practices, and all of that. But that's creates a very

good, a very aware community. So next time when these phishing

attacks are happening, they know that these are not legit, and

they know how to report it. Right. So that's the very low

hanging fruit for us. But it pays a high dividend, right?

That's one thing. Second one is, there are very specific controls

that we take in the backend infrastructure side, right?

Whether it's bringing a new device on our network, right,

how do you authenticate that? Are we using two-step

authentication, multifactor authentication, and all of that,

are they connecting to wide network or a wireless network

and what have you, and we use very specific VLANs and taggings

that takes place where if you know, this individual is a user,

we put them in a separate network environment where it's

completely separate from, from our day to day business

operations, for example, right? The same concept applies for

gaming consoles and IoT device, we have a complete separate

mechanism for onboarding and monitoring that kind of network.

And those are some of the the steps that we have taken that

that we find that that has been working very well. And also

remember, we want to make sure the user experience stays as is

where they don't have to contact IT for every day. How do I

connect my console versus how do I connect to your wireless

network, right, so we also pay very close attention to find

that balance between user experiences and maintaining the

security.

And you know, that brings up a thought

here. One of my previous guests he talked about in his

organization, which is also an academic institution, they

created what is called a Champions Network. And the

Champions Network comprised of students, faculty, staff, and

these were the folks who were enthusiastic about securing the

institution, enthusiastic about enhancing awareness. And they

would serve as ambassadors, liaisons, evangelists, in their

respective domains, areas. So you know, to your point, it's

not possible for you to have somebody from your unit embedded

everywhere. You have to find a way of getting the word out by

creating those ambassadors, who can who will serve the interests

of your department, of your unit as well. So I thought that that

structure of creating a champions network and rewarding

them and again, rewards doesn't have to be expensive, but just

the recognition goes goes a long way. I just thought of putting

it out there.

I think that's a fantastic way to engage with

with all all the constituents within your organization, and we

also benefit from being a technological university Dave.

So we have a lot of awareness, generally speaking, and, and the

students are sophisticated, technically sophisticated

students, right. And they are demanding. They have

expectations when they show it show up on campus. So we don't

have a champion network like that. But I feel that the

culture that we instill early on, that's, that's our

champions. So it's a community effort. It's a team sport. So

everyone's part of this Cybersecurity Awareness Campaign

for us. And they all play their their individual roles. And then

the IT team and the Security team provides innovative,

easy-to-use solution, right? 'Report a Spam' button, for

example, in your Outlook, right, that makes it easier, right? How

do you report some of the phishing attempts and all of

that. So we have also created into an intuitive environment

where they don't have to spend a lot of time to go through the

hoops to report an incident, right. So, we made it easy for

them as well. So these are the things that probably could work.

But the champion network, it's a fantastic idea.

Fantastic. On a related note, I recall a

discussion with the Chief Information Security Officer of

another organization. He said that there is an expectation in

his organization, that members will help by diligently going

through their emails, and flagging the ones that deserve

attention, I can totally see from where he's coming. There is

no disagreement there. But it's also true that people are busy,

they have to deal with so many things. So that becomes another

chore for the user trying to diligently look through every

email and identify the ones that are worth reporting. Where are

you on this? What's your perspective?

I think it's a very complex situation where how do

we find the balance between being productive versus making

sure we are contributing towards the cybersecurity right, and I

think that's where the, it's important for the for the IT

folks to, to do a lot of things on the backend side before even

the message arrives in the inbox, right. So for example, we

use something called mail tip, I believe that's the right term,

pardon me, I'm not a CISO for example. I'm an accidental CISO

again, but so we have enabled certain mechanism to our email

platform. So if a message is coming in, it will say message

from external sender or something that automatically

alerts the user, right. The second thing is, we have

adjusted and continue to adjust our spam filtering, right, where

where we have enabled a lot of built in encryptions, or DLP, or

data loss prevention type of a policies upfront at that level

as well. And and we continue to partner with our vendors to make

sure that we remain up to date in terms of those signatures,

and all of that. So there are a lot of things we do also in the

back end to mitigate this particular risk and still be

able to manage the expectations of users. But again, if you are

so right, 90% of the emails that you get, it's either spam, sales

call, or marketing emails. Only 10% or less than of 10% are, are

legit emails that you will read, open, open, read and respond to,

You make a lot of sense, when you say that

it's important to do that work at the backend, use relevant

tools to automate the filtering process. Through such process

automation, one can take the load off the user, freeing them

up to focus on their core expertise. Reminds me of a

discussion that I was having with the CISO of another

academic institution. When I asked him, what were some

principles that guided his day to day activities, he said

something very interesting. He said, Dave, we are not in the

business of saying No. The first thing that I always think about

is that the job of security is not to stop the institution from

doing what they are formed to do. The job of security is to

enable those functions, those activities, and that stayed with

me, a very compelling statement. You also emphasized the

importance of creating a culture of enablement, where the role of

the CISO is recognized to be much more than just a security

officer. They are strategic enablers, business enablers, and

that's exactly how the CISO role needs to be perceived and

operationalized. CIOs and CISOs must have a seat at the table

when strategic decisions are being made. They can provide

valuable feedback on how technology can be an enabler, on

the security implications of the proposed strategic initiatives.

So, treating the CIO, the CISO as strategic partners, as

opposed to seeing those functions, IT and Information

Security as hurdles or stumbling blocks can go a long way, in

creating and sustaining a high-performance information

security culture.

Dave, you're so spot on on that observation Dave. And

as I said earlier, it's about building and fostering that

trust and relationships, right, that allows the community to

come together and have this type of conversation and discussions

that will enable folks, right to make sure that they provide a

solid, secure, robust environment for them to

flourish.

Awesome, awesome. Well, like you said

that we can have this discussion forever. But we don't want to go

too long. For the sake of the listeners, we want to keep it

short and sweet. So as we wrap up the session, I want you to,

of course, you know, talk about anything you want. But also

think about anything that you'd like to share from the

standpoint of how organizations should prepare for cyber

attacks. And what does it take to effectively execute plans on

a sustained manner? As you know, we have plans, we're always

planning, strategizing, but everybody is not good at

executing when the time comes. So I'll leave it. I'll leave it

at that. I'll let you take over from here.

I think that's that's a really, really great question.

Do you know, and I think we can write a dissertation paper on

that together, actually, when you specifically talk about

operational excellence and change management, right. But,

let me let me take a different approach to answer this

question, right. Let's look at it from a strategic side. And

then from an operational side, right. From a strategic

perspective, right, I think the organization must spend

sufficient time effort and resources to build a

security-centric culture, right? They need to look at security

from business lenses, period, they must be involved at a top

level, whether it's Board or CEO for corporate or President at a

higher level, right? They need to implement frameworks and

architectures, right, that are well aligned with particular

business needs. And more importantly, I'll take it to the

next level where it must be aligned with cloud-smart

initiatives. Right? Those are certain things, I would look at

it from a strategic perspective. And the last one I would add is

find the talent that will help you achieve what I'm about to

talk about next. Right. So that's from from more of a

strategic perspective. And in that you would have a

cybersecurity program that you will work with engage with the

community to come up with a program that addresses certain

things, right. And this is something from my own learning

from Protect Stevens and the IAM program that we launched, right?

Implement solid plans for training and phishing awareness,

implement some controls for endpoint device management.

That's a big challenge. I didn't talk about that earlier on

there. Every faculty staff students have multiple devices,

grant issued personal what have you. Have a solid 24/7 SOC

center monitoring that allows you that extended detection and

response that you need, right. We talked a little bit about

network segmentations, and then make sure that there are certain

things that we want to also focus on within that program, is

make sure you have a return incident response plan, right.

This is more operational, but it's needed, right? Make sure

you you you draft confidentially agreements for employees,

vendors and visitors. Many folks still don't pay close attention

to visitors. And this goes back to like, you know, having low

hanging fruit and attack surfaces, right. Regularly

perform data discovery and privacy reviews for risk

assessment, right. We perform at least two penetration testing.

We also include social engineering aspect of it. So,

make sure we do that. And one last topic is review your

onboarding and offboarding processes. So important, so

critical. And for all the folks who are listening from an IT

perspective, adopt these four basic practices. If he can't do

all of that for for financial resources or otherwise, make

sure you have a solid password management practices, implement

multifactor authentication, provide solid user awareness

training and timely update systems. I hope it covers your

question.

Oh, brilliant, absolutely brilliant.

You know, there's a reason why you do what you do. And you do

it so well. I think you addressed it brilliantly. And as

you were talking, I was just thinking about the vastness of

the attack surfaces and the various ways that these surfaces

can be compromised. For lack of a better word, organizations,

individuals, are sitting ducks. Despite your best efforts, there

could still be a loophole that somebody could find and drive

right through. But having said that, just like you said, you

have to do the basics, right. Do the fundamentals, right. I'm

sure you might agree that there's also some wisdom in

prioritizing what you want to secure, at what level. Because

it's impossible to secure everything. And so you have to

prioritize and then focus your security strategy, your

defense-in-depth strategy accordingly. So this way, it's a

more of a manageable, feasible kind of plan. And finally, from

my standpoint, finally, I'm a big fan of, make sure that you

work closely with with legal because the unfortunate

consequences often result in the courtroom where you're having,

you're being sued, and you having to defend yourself. So

make sure you're totally familiar with the laws, the

regulations, the standards, and you're in compliance, so that

when unfortunate events happen, and when you have to present how

you have been governing, managing security, you look good

out there that you did your best, and despite your best

efforts, things went wrong. As opposed to, it was sloppy, or it

was negligent, which is something I'm sure everybody

would like to avoid. But again, I'd like to give you the final

word. So please.

Absolutely, I think I think you're so spot on that.

And I will take it to a further as well, right, that the

incident response plan that I briefly touched upon, that

should also include your cyber insurance provider as well,

right. And they will bring in all the legal help. And because

different states have different regulations nowadays in terms of

what you report and what you don't write. But I think someone

recently shared some statistics about cyber attacks, right? It

was something around like it happens every 39 seconds, the

ransomware attacks are targeted every 14 seconds, and only 10%

gets reported. Right. And to make it even this this whole

cybersecurity economy, they're expecting it will grow to $10

trillion by 2025. Right? I mean, this is fascinating numbers,

like, you know, how do you keep up with all of this Dave? So,

again, you have to go back to the basics, do the basics,

right. Make sure you're transparent. Make sure you you

find good people on your team who are stewards of good

security, hygiene and, and and do your your best efforts on a

daily basis. Right.

Fantastic. Well, with that we'll conclude

our discussion for today. Thanks again Tej, for the wonderful

insights. I so appreciate it. I know listeners are also very

grateful.

Dave, thanks for having me. And I really enjoyed

our conversation. Thanks again.

A special thanks to Tej Patel for his time

and insights. If you like what you heard, please leave the

podcast a rating and share it with your network. Also,

subscribe to the show, so you don't miss any new episodes.

Thank you for listening, and I'll see you in the next

episode.

The information contained in this podcast is for

general guidance only. The discussants assume no

responsibility or liability for any errors or omissions in the

content of this podcast. The information contained in this

podcast is provided on an as-is basis with no guarantee of

completeness, accuracy, usefulness, or timeliness. The

opinions and recommendations expressed in this podcast are

those of the discussants and not of any organization.