CISO Interview Series: Hai Tran, CISO, WA Police

"With government moving to cloud services ……understanding the security capabilities is important"

David Gee (CSO Online) on 16 December, 2015 08:33

Could you describe your average day as CISO at WA Police? Do you have a particular routine for the start and end of day??
As I am involved throughout the lifecycle of a project, the typical day includes meetings with a diverse group of stakeholders, committees and technical briefings. I don’t have a particularly daily routine except for keeping my eye on the news.

Many of the big name organisations have recently boosted their security divisions by securing top ranking IT security heads like yourself, do you think the key cyber security threats and recent breaches have pushed companies to invest more in this area?
Organisations have become increasingly aware that information is a key business asset potentially thanks to increased media coverage of security breaches. Over time information security professionals have matured, focusing their skills towards improving business performance through governance, risk and compliance activities. The increasing level of maturity of security professionals has meant that business do see value in investing more into information security.

On a scale 1-5 do you expect that your investment on Cyber & Information Security will be increased over the next 3-5 years? What’s going to drive that??
I expect a moderate uplift in spending on Cybersecurity over the coming years. This is part of ensuring security is inherent in every project and service across the agency. There is also an ongoing effort to reprioritise existing spend on those initiatives that will produce the most significant outcomes.

How do you balance your own bandwidth between attention on you longer term security agenda and today's issue that has just arisen?
Targeting longer term security initiatives such as providing security architecture services and risk management services during the conceptual stages of a new information system project is an investment that delivers an ongoing business benefit. Getting some of those initiatives rolling before dealing with the tactical issues of today means that there are less tactical issues going forward. Establishing documented, repeatable processes and procedures is more often than not, a priority than dealing with short term issues.

I’m interested in understanding the degree of engagement that you have with the average policeman? I assume that you are a specialised unit operating within WA Police.
I am fortunate enough to be able to work closely the deputy CIO and his staff officer, both are sworn members. This allows me to socialise ideas and initiatives with them and to obtain feedback from them as to how this might affect frontline policing. The sworn officers help ensure that any communications and engagement with frontline officers are effective. My primary aim is to ensure that frontline officers have access to reliable and accurate information when and where they need it.

There are many new cyber security startups that are appearing. Are there any that have caught your eye recently and you are tracking their progress?
I have seen an increase in cloud services security assessment offerings. The general trend in government moving to cloud services means that getting visibility across the agency on the use of cloud services and understanding the security capabilities is important.

WA Police would clearly be a target for hackers. How do you conduct ‘mock’ incidents so that the team is prepared for data breaches??
The agency conducts regular vulnerability assessments and penetration tests conducted by both agency staff and external contractors.

I would expect that there is more and more data forensics work that WA Police have to perform in their role. How does these shifts change your cyber security stance that you need to adopt?
The Data forensics is function that is performed by the Technology Crime Unit. Conversely I’m focused on prevention, detection and stopping any security breaches ASAP. Identification of the offender and subsequent prosecution isn’t my focus.
If there is a significant security incident I refer that matter to the technology crime unit. They are appropriately resourced to conduct forensics and investigation.

When you think about adding new talent into your team. What key attributes that you look for when selecting a new staff member? Also I’m aware that there is a shortage of capability in the industry - how long does it take on average to find new talent, is this especially hard in WA??
Traditional security functions have been devolved as technical security controls have become pervasive within the network and server teams, or have been moved cloud services. The key skills I look for in an information security processionals are:

• The ability to communicate technical information with a diverse group of non-technical stakeholders.
• Able to build good working relationships across the entire organisation.
• Research and report writing skills.
• Being able to objectively look at risk vs reward
• Have a “can do” attitude
• Being a trusted advisor instead of a road block

Building a good team can be challenging in WA because many of the experienced security professionals are based on the East coast.

Finally what keeps you awake at night?
It’s pointless worrying about when an attack will occur. I try to focus on ensuring that when one does occur, we have the right process and procedures in place to minimise any damage and be able to restore from backups.

How businesses can make more of their existing security infrastructure

David Gee (CSO Online) on 11 December, 2015 09:21

There is never going to be enough budget funds for all the security risks that exist in any enterprise. This leaves you in a tricky and most likely precarious position that you as leader have to address.
In most organisations, just ensuring that this funding gap is understood is critical but it doesn’t get you off the hook.

So what can you do about this?

Most of these are measures to fortify your enterprise, that don’t require big investment dollars.

Build Security into Digital efforts

Be on the front foot and get yourself along with your team into the game. Let’s not wait for new digital initiatives to be launched, I would suggest that members of the Security Team get involved early in the new developments and attend the standup meetings of groups that are building these new digital tools.

It is often these changes to the environment can introduce new vulnerabilities and risks. This partnership between the CDO \ CMO and CISO is one that is going to be critical for all enterprises that are moving towards a digital future – so in reality that means everyone.


Challenge how Tools are already used


Is it the tool or how your team uses it? From what I have witnessed we implement a bunch of tools over a period of time and also have legacy that installed that we frankly don’t always understand. I’ve seen instances where firewall rules can be the 1000’s and I would challenge any single person to be able to rationalise if these are actually as a totality effective.

Having your team, challenge how the tools have been implemented and optimising this will add confidence to the degree of certainty around understanding your actual strengths and weakness.

By having a hard look at your Security Architecture, you will find opportunities that will point to legacy technology that is superfluous. In speaking to Rob Lentz the retired CISO for US Department of Defence, he commented to that “in his experience 80% of all security systems are legacy”.

This provides an incredible opportunity to reshape and challenge the status quo.

 

Treat Security as a Portfolio


Understand how all the components you have complement each other. This is somewhat of using Design Thinking approach and looking at the issue at the broadest possible perspective.
This means that you understand how security affects the customer experience and ensure where there are interventions that this is both appropriate and measured.

We want our users both internal and external to be an effective ‘1^st line of defence’ and this can’t be enabled unless their roles are designed correctly. By treating security as a portfolio of change we can get some advantage.

Strengthen your Partnering


Both with the vendor, internally and with others that you can benchmark with outside of your own organisation.

First your Security vendor, who is a great source of knowledge and often utilized enough to provide you with updated intel. They (vendors) can provide you good benchmark data, and perhaps more importantly some suggested updates on recommended configuration changes.

Internally with IT Infrastructure – are you partnering to work together on security? For many enterprises there is a somewhat adversarial element to this relationship and there is not alwys shared goals and measures. As the leader you have to drive the alignment of the teams, starting with regular joint team meetings.

Externally you can never over doing the degree of networking that can be done. By selecting others in the ecosystem to share information with and especially when you both use similar security components.


Be Disciplined


Patching, patching, patching…..sorry to be boring but this will keep the existing capability that you have in place operating at the maximum level possible.

This has to be measured and remeasured, along with strong accountability within the team to ensure your security infrastructure and IT infrastructure is kept up-to-date.

Just by being ‘disciplined’ we can make more from our existing security infrastructure.


Step Change versus Continous Improvement

 
Security is like all other domains there are times for large scale transformation and there is always going to be scope and value in continuous improvement. All businesses can make more of their existing infrastructure all it takes is a mindset of tackling the issue.

CISO Interview Series: Jeff Jacobs, CISO, IAG

"Exploring ways to build security into DevOps to ensure new digital services are ‘secure by design"

David Gee (CSO Online) on 10 December, 2015 08:20

Could you describe your average day as CISO at IAG? Do you have a particular routine for the start and end of day??
It's hard to describe an average day at IAG. So far no two days have been alike. My days are a combination of setting strategy, making various choices, engaging with my team and colleagues and making things happen.
I like to start my day by getting up to speed on what I need to focus on for the day over breakfast and a coffee. I then usually finish the day with a list. I love lists. They keep me focused.


Many of the big name organisations have recently boosted their security divisions by securing top ranking IT security heads like yourself, do you think the key cyber security threats and recent breaches have pushed companies to invest more in this area?
For many of the larger players like IAG there has always been a focus on cyber security in some form. However the growing sophistication of adversaries and the magnitude of the losses experienced by some high profile organisations has likely led to cyber security becoming more front of mind.

Also, many of the global consulting and research firms have confirmed cyber security as one of the top priorities for the next few years.
Boards are acutely aware of the new and emerging risks in this space and this is certainly having an impact. Progressive companies are tending to invest more in this area and I expect this will be the norm for some time to come.

On a scale 1-5 do you expect that your investment on Cyber & Information Security will be increased over the next 3-5 years? What’s going to drive that??
IAG takes the security of its information very seriously. As such, we would rate our plans to invest as a “5” on the scale. The evolving threat landscape and our own transformation to a digital enterprise are the key drivers for an increased focus in cyber security investment.


How do you balance your own bandwidth between attention on your longer term security agenda and today's issue that has just arisen?
It’s just one of those things that you have to do as a senior leader. It’s not specific to Cyber Security. All leaders have to balance between longer term strategy and day to day issues. From my perspective, its what keeps my job interesting. As I said earlier, no two days are alike in IAG.





I’m really curious on how your job is measured, would you mind sharing your key performance objectives (just the headings not the details)?
As an IAG executive I am measured on the same KPIs as the other executives. Our scorecards cover the usual shared areas of customer, culture, financials and business outcomes. I also have a number of personal objectives around building the new cyber security function and uplifting our capability across the globe.

There are many new cyber security startups that are appearing. Are there any that have caught your eye recently and you are tracking their progress?
I am looking at a number of start-ups in the cyber security space. There are so many areas that are of interest ranging from new forms of encryption, innovative ways to think of passwords, identity and access management to name a few. There are also organisations that are looking at novel ways to protect the Internet of Things against new threats. All of these are catching my eye.

What do you regard as the crown jewels within IAG that has the highest level of security? How well do you conduct ‘mock’ incidents so that the team is prepared for data breaches??
I am pretty sure that this is the one question that most CISOs would be too paranoid to respond to in too much depth.

Certainly we put a lot of emphasis on protecting our data and a key focus for us is on responding and recovering when required.
Only recently we ran a very successful exercise with our executive and broader teams in a mock cyber exercise. Although it went very well, we did learn a lot.


I’m aware that for IAG, Digital is a major strategic driver and clearly on the radar of your new CEO. How much attention have you paid to this online channel in your tenure sofar?
This is one of the core drivers of our enhanced focus on cyber security and it’s not just about our online channels. For us Digital and digitisation permeate everything we do. There are a range of new challenges that enterprises face when ‘going digital’. One area of focus right now are ways to safely expose our information and services via APIs. We are also exploring ways to build security into DevOps to ensure new digital services are ‘secure by design’.

Personally I have been very close to this because in my previous life I was consulting in this space to IAG.



Within the IAG environment are you more concerned about the internal technology vulnerabilities or of rogue insiders?
I don't make a distinction. We are focusing our efforts on detecting and responding to all threats.
Certainly internal technology vulnerabilities are an area that we do need to focus on. Also, addressing this reduces our exposure from both internal and external threats (both deliberate and accidental).

I've noted that you are in the process of recruiting new talent into your team. What key attributes that you look for when selecting a new staff member?
I’m aware that there is a shortage of capability in the industry - how long does it take on average to find new talent??

Yes, I am recruiting. I am trying to assemble one of the best cyber security teams in the country and I always expected that this would be a challenge. Having said that, anyone who has worked with me will know that I am persistent and confident. Finding new talent is part planning, part timing and part luck. I am confident I will find the expertise I need.

How do you keep up to date with developments in Digital innovation and Cyber Security, this is clearly a dynamic area and it must be challenging?

It certainly is a constantly changing area. Fortunately I am genuinely passionate about this topic and always have been. So for me, keeping up to date is not tiresome because I love the topic. I keep up to date through a combination of endless reading, listening to industry experts and vendors and collaborating with peers. One thing I have learned is that the more you share you more you get back.


Finally what keeps you awake at night?
Lately it’s been Cyber Security webinars scheduled at very unfriendly times!

CISO Interview Series: Silas Barnes, CISO, Virgin Australia

​“There's not yet any evidence that remote control access of an aircrafts' avionics system via an in-flight wifi network is possible”

David Gee (CSO Online) on 02 December, 2015 07:39

Could you describe your average day as CISO at Virgin Australia? Do you have a particular routine for the start and end of day?
An average day includes a variety of meetings, project reviews, steering committees, strategy sessions, presentations and briefings. Each day is different, but I try to kick them off in the same way - spending the first 30 minutes going through emails, catching up on
global infosec developments over the last 12 hours, logging into monitoring consoles and going through the list of notable events identified by our various security systems. I try to reserve the late afternoon and evening for tool development, coding and other technical work.

Many of the big name organisations have recently boosted their security divisions by securing top ranking IT security heads like yourself, do you think the key cyber security threats and recent breaches have pushed companies to invest more in this area?
Information security is a hot topic, and increasingly an item on the agenda at company board meetings. Computer-based threats are experienced across all sectors, and businesses are looking to build a stronger leadership capability by creating a senior security role at the top level of the business. While the ability to procure modern security technology is quite easy, obtaining experienced information security leaders remains a challenge here in Australia.

At Virgin Australia the CISO role reports directly to the Group CEO, John Borghetti. The positioning of this role in the organisational structure reflects both its importance to the business and the acknowledgement that information security is not an IT challenge – it’s a business challenge.

On a scale 1-5, do you expect that your investment on Cyber & Information Security will be increased over the next 3-5 years? What’s going to drive that?
Further investment is planned, and the key driver is the change in investment strategy that a modern approach to information security requires. We call it the Stop:Response Ratio - the level of investment put into stopping attacks before they breach the network versus that put into detection, response and recovery after a successful attack.

While baseline investment in solutions to stop attackers at the gate remains
essential, successful penetration of networks by attackers is inevitable. Companies must place more focus, and investment, on early detection, response and recovery.

How do you balance your own bandwidth between attention on your longer term security agenda and today's issue that has just arisen?
Like most prioritisation challenges, a risk-based approach is key. Flexibility is also important, as is a good understanding of the pipeline of projects and initiatives that the business has planned - across all business functions, not just information technology.

I’m interested in understanding the degree of engagement that you have with the business folks in Virgin Australia? How is cyber security viewed from their perspective?
One of the first points I make to new staff is that security is a support service - we're here to help the business achieve its strategic aims by contributing in the area of information security. Engagement with all parts of the business is crucial, and we've put increased focus on growing our enterprise security awareness to ensure it covers all areas of Virgin Australia.

Like most businesses, we have a diverse workforce when it comes to security awareness and experience. Building a strong information security culture is one of the harder challenges, but approaching awareness training from a personal angle rather than a business perspective helps make it "real" for staff.

There are many new cyber security start-ups that are appearing. Are there any that have caught your eye recently and you are tracking their progress?
There are a lot of new players on the market, which is not surprising given the explosive growth being experienced in the sector. We use a small number of specialised providers to support us when it comes to security services – the relationship we have with these companies is very important as we take a no-holds-barred approach to penetration testing and attack simulation.

I’ve found in the past that some of the larger security service providers experience challenges in keeping quality consistently high during periods of fast growth. At the end of the day it depends on what you, as an organisation, want to get out of your security services. We’re not just after a compliance tick – we want to know how all parts of our security supply-chain are performing.

What do you regard as the crown jewels within Virgin Australia that has the highest level of security? How well do you conduct ‘mock’ incidents so that the team is prepared for data breaches??
For us, keeping our planes flying safely and protecting customer data are our top priorities. As an airline, we have always had a strong focus on business resilience, and our information security incident simulations are now run as part of the business resilience team’s annual program.

More and more we are hearing about Airlines adding WiFi to their
offering. What’s your view of this and how this changes the risk profile of an air service – is this positive or negative?
In-flight internet services have been around for many years, as have discussions around any associated risks. While it's a headline-grabbing concept, there's not yet any evidence that remote control access of an aircrafts' avionics system via an in-flight WiFi network is possible. Aerospace companies make use of one-way network interfaces for sending selected flight data to in-flight entertainment systems, along with a host of other controls to maintain the integrity of the on-board avionics control system.

Virgin Australia takes all potential information security threats seriously, and the risk in this regard is extremely low. I believe in-flight internet access in Australia will be a great connectivity option for travellers when it does eventually arrive.

Within the Virgin Australia environment, are you more concerned about the internal technology vulnerabilities or of rogue insiders?
Like most security teams, we're concerned about a range of threats to the business, which also include emerging vulnerabilities and malicious insiders. At some point, you will have to provide high-level access to individuals in order for them to perform their role - ensuring you have the right spread of both preventative and detective controls in place increases your chances of catching malicious behaviour early.

Internal vulnerabilities will always present a challenge, particularly when exploit code is made widely available before vendors have released security patches. A flexible approach to vulnerability management coupled with the ability to move quickly means that even if the temporary solution isn't clean, it will tide you over until an official security patch becomes available.

When you think about adding new talent into your team. What key attributes that you look for when selecting a new staff member? Also I’m aware that there is a shortage of capability in the industry - how long does it take on average to find new talent?
Passion for all things security is critical. We also look for people with great customer service skills, an eye for detail and a flexible approach to problem solving.
Part of the onboarding process for all new infosec team members at Virgin Australia (including the CISO) is the requirement to gain certification as an Offensive Security Certified Professional.

Knowing how to attack improves your understanding of how to defend, and the training provided by Offensive Security also arms staff with the foundational skills to meaningfully contribute to internal penetration tests. Because we expect a lot from our staff, we choose them pretty carefully.
Acquiring senior talent is probably the most difficult task - it took almost 12 months to find one of our recent hires.

How do you keep up to date with developments in Digital innovation and Cyber Security, this is clearly a dynamic area and it must be challenging?
It can be. Being an active member of the local information security community definitely gives you an advantage in this space - building strong connections with likeminded security folk across all sectors helps keep you in tune with the local and regional threat landscape.

I'm lucky enough to be part of a fantastic community team that participates in various “Capture The Flag” competitions a few times a year, which is a great way to keep the technical part of the brain moving. There are some great local, regional and international conferences such as Def Con in Las Vegas and RuxCon in Melbourne but at the end of the day, keeping up to date means committing hours outside of work.

Finally, what keeps you awake at night?
A combination of my two-month-old baby and knowing that no organisation can completely mitigate the risk of successful attack, but having a great team who work tirelessly to protect our digital assets does help me get some shut-eye.

CISO Interview Series: Kevin Shaw, Head of Security, Foxtel

  "Incident response plans are ‘war gamed’, and are done so on a regular basis"

David Gee (CSO Online) on 26 November, 2015 14:05

Could you describe your average day as Head of Security at Foxtel? Do you have a particular routine for the start and end of day??
I try not to settle into predictable routines, but there are a number of tactical priorities I like to address at the start of the day. Things like reviewing threat intelligence, checking over the managed security service dashboard, and checking in with the security team for status updates.
Generally my day is split between operational security matters, supported by our Operational Security Manager, responding to requests for advice from business units and project teams, and driving our strategic security agenda.

Something that is a continual focus and almost daily activity is finding ways of ensuring that security is front of mind with our executives so we can continue to maintain a good security culture throughout all levels of the organisation. A good chunk of time is spent looking at how to generate meaningful security metrics and communications for the executive from the ever growing pool of operational data.

Like most security professionals, there is no clearly defined ‘end of the day’, but I do tend to focus more on reading security news and trends and networking with others in the security community.

Many of the big name organisations have recently boosted their security divisions by securing top ranking IT security heads like yourself, do you think the key cyber security threats and recent breaches have pushed companies to invest more in this area?
There is certainly a heightened awareness at the executive and board level, which has led to changes in security leadership and the size and mix of security teams. These organisations are realising that traditional security approaches and technologies are no longer adequate on their own and are looking to security leaders who can build capability in the areas of detection and response, rather than classic defend/deflect capabilities. They are looking for individuals who are well connected to the global security community, which keeps them informed of emerging threats, interesting new technologies and players, and who can leverage their professional networks to the advantage of the organisation.

  

Change such as this takes time to wash through the system, and while I am seeing early indicators of change such as fewer and fewer security leaders with IT or IS in their titles, the vast majority are still reporting into a CIO or similar function, which indicates that to some degree security continues to be perceived as an IT issue to be ‘fixed’ rather than a business issue to be continually “managed”.

On a scale 1-5 do you expect that your investment on Cyber & Information Security will be increased over the next 3-5 years? What’s going to drive that??
I won’t give a scale rating but I do see investment increasing over the next 3-5 years largely driven by changes in how we do business, such as cloud adoption, outsourcing business processes, and data management, impacting on traditional security models. These changes to security architectures and adoption of new technologies and services come on top of the existing security costs of maintaining ‘good hygiene’

How do you balance your own bandwidth between attention on your longer term security agenda and today's issue that has just arisen?
It’s a juggling act but I am fortunate to be part of a team of good technical security professionals, ably supported by an operations security manager, that take the initial response to issues arising. Having an incident response plan and a third party cyber security incident response service certainly allows me to spend more time on our longer term security agenda.

My assumption is that for your line of business a “Man in the Middle” attack, with a 3^rd party hacking onto your live broadcast is a serious threat. Is this the worse thing that could occur to Foxtel?
I take it you are referring to something like the TV5 Monde attack? While there is no arguing that that was a very serious incident, like most incidents lessons are learnt and shared, and procedures and measures are updated and we all benefit from this.

That incident was a great example of the need to change from a mainly defensive model into a more detect and response posture. These days it is becoming difficult to prevent or even predict all attacks so organisations are being judged by the public and the regulators on how well they identify attacks and how effective their response is. I am not advocating losing defensive capability, which is basic security hygiene, but being better equipped to discover and deal with the ‘worst thing that could happen’ when it happens.

I have to assume that the crown jewels within Foxtel is this the content such as prime time new series shows that have the highest level of security? Is that close to the truth?? How do you conduct ‘mock’ incidents so that the team is prepared for such potential data breaches?
Content security is important to Foxtel and we do have, and do execute, a duty of care to protect this on behalf of the content creators and owners. Our crown jewels are no different than that of other organisations, being customer data, financial information such as credit cards, intellectual property, and so on.

I certainly advocate that incident response plans are ‘war gamed’, and are done so on a regular basis. They tend to knock out the kinks in the plan and provide ‘muscle memory’ so when people are acting in a high pressure environment the right actions are taken, it’s something the military have recognised for a very long time that is taking root in the corporate world.

 

There are many new cyber security start-ups that are appearing. Are there any that have caught your eye recently and you are tracking their progress?
Certainly are a few that I am keeping a watch on and ‘kicking the tires’, for example: Elastica in the CASB (Cloud Security Access Broker) sector, HIVINT in the security community portal space, Soltra in the threat intelligence arena.

Within the Foxtel environment are you more concerned about the internal technology vulnerabilities or of rogue insiders?
It’s a very much contextual answer in that securely designed, configured, and patched technologies change over time, and circumstances can cause individuals to occasionally behave in less than acceptable ways. So I would say they are only two of the many risk indicators we look at on a continual basis, and manage through a continuous compliance monitoring regime underpinned by a focus on security culture.


What key attributes that you look for when selecting a new staff member?I’m aware that there is a shortage of capability in the industry - how long does it take on average to find new talent??
Given there is a shortage of talent in the industry and we are competing with the financial services sector and consulting worlds for resources, I look for individuals who embrace and thrive on change, are willing to learn, able to accept accountability, are straight talkers, and are self-managing. Often to end up with good capable professionals it is a case of focusing their enthusiasm, giving clear expectations, providing the right training and career path, and recognising their contribution.

On the same note, given that it is hard to find talent. How successful have you been in training to other IT professionals into a Security career?
Over my time at Foxtel the majority of our security team have come from other areas of the business and IT department and most have stayed in the team. Not everyone enjoys the unpredictability and pressure that comes with a security career but when you come across those who do you need to hold onto them. It helps if you have a strong strategic plan that you can articulate well, where you can clearly lay out their role and development opportunities.

Finally what keeps you awake at night?
Many and varied things can keep me awake from time to time and sometimes do, but worry is a wasted and debilitating emotion. It’s better to be able to go to sleep knowing that you have the support of the executive, are further along your security journey each day, you have better detection and response capabilities than in the past, are supported by effective third party security services, and have a capable security team maintaining a good security hygiene level. Then if something happens you will at least be fresh when you come to invoke your incident response plan.


http://www.cso.com.au/article/589753/incident-response-plans-war-gamed-done-regular-basis/

CISO Interview Series: Michael Wallmannsberger, CISO, Wynyard Group

"Cost-effective security is only arrived at through careful and elegant design"

CISO Interview Series: Michael Wallmannsberger, CISO, Wynyard Group

David Gee (CSO Online) on 26 November, 2015 13:13

Could you describe your average day as CISO at Wynyard Group? Do you have a particular routine for the start and end of day??
I love that my role is broad and varied. Each day is potentially very different and I expect the work I do day-to-day to change over time. Right now I’m spending time helping the IT team to design security into the foundation of some work we have underway. In the longer term my focus will be much more on process, assurance, and engaging with people about security.

Do you think the key cyber security threats and recent breaches have pushed companies to invest more in this area?
Yes, anecdotal evidence of companies making substantial new investments in security is increasing. Top management and boards are aware that security is a strategic business issue. However, few companies have sufficient awareness of risks and appropriate controls at all levels. Many are still not investing in enough of the right things. Security budgets in some organisations need to increase and that money needs to be carefully spent.

 

On a scale 1-5 do you expect that your own investment on Cyber & Information Security will be increased over the next 3-5 years? What’s going to drive that??
To put a number on it, I’d say 4 out of 5. As a company operating in the crime fighting and security software industry, we invest substantially in cyber and information security and our investment is sure to increase. Our growth, products, markets and the rigorous security requirements of our customers will all drive demand for ongoing improvements in information security.

How do you balance your own bandwidth between attention on you longer term security agenda and today's issue that has just arisen?
I put priority on the longer term security agenda as much as possible because comprehensive, cost-effective security is only arrived at through careful and elegant design.


There are many new cyber security startups that are appearing. Are there any that have caught your eye recently and you are tracking their progress?
I track many vendors and products including a few new companies. Entire classes of controls like application whitelisting, threat emulation (sandboxing), and advanced analytics look set to become baseline features of high-security infrastructures.

Existing, as well as new, vendors are moving to claim this territory. For example, firewall veteran Check Point has sandboxing and mobile security solutions and I am watching the move by network vulnerability scanning vendors to incorporate scanning on the endpoint.
I also have my eye on the next generation of endpoint security approaches. Bit9 (application whitelisting) and Bromium (micro-virtualisation) are examples of how approaches to endpoint security are evolving. In large environments where consistent deployment of endpoint technologies is challenging, CISOs can look to advancing security analytics capabilities. One thing that is for sure, though, is that deploying traditional anti-virus is no longer doing enough.

What do you regard as the crown jewels within Wynyard Group that has the highest level of security? How well do you conduct ‘mock’ incidents so that the team is prepared for data breaches??
The “crown jewels” of an organisation can often be simply defined. For us what is really important is having a complete understanding of what is valuable data, who has access to that data, where it is located, who is protecting it and how well it is protected. For me our company’s intellectual property is one type of information that is most important for me to defend.

I have had the greatest success with mock incidents that have a realistic premise. Fabricating a good incident can be a lot of work. I recommend taking inspiration from real incidents (plenty are in the public domain) and encouraging users to consider routine issues—like a computer crashing unexpectedly—as a potential security event and to follow the incident notification and handling process so that it is well drilled.

Mike, given that trust is such a key part of why others work with your organisation. Have you put in place any additional measures for your senior management around Spear Phising etc?
Operating in the crime fighting and security software industry means that security is very much on the radar of key senior managers and those people take a keen interest in keeping up to date with new malicious attacks. With most large companies being bombarded with cyber-attacks all the time it is important to remember that senior management are just one type of privileged user—IT administrators are also risky users, for example.

 

When you yourself choose partners to work with – what’s the key criteria that you use to select and then also retain them as a partner?
Security is obviously my first consideration but I often observe that other important things like quality, design and user experience, functionality, support, and even value-for-money go in the same direction. It is difficult to get security right if your business is a shambles so I think of security as alluding to the canary in a coal mine. I also put a lot of stock in genuine partnerships and a frank exchange of ideas. A portfolio of security products is infinitely complex and there is sometimes a lot of vendor puff to bust through.

What key attributes that you look for when selecting a new staff member?I’m aware that there is a shortage of capability in the industry - how long does it take on average to find new talent??
I always look for experience—at whatever level—and engagement with the security community. Security is a broad, deep, and rapidly moving discipline so a person has to be a passionate self-starter to have a chance of keeping up.

We need more talent in security but we also need to make better use of our people. Better technology is one part of that. Some organisations struggle more than others to recruit—it’s not unusual for recruits to have multiple offers—but I don’t think we are seeing the full impact of this yet. The very small number of practitioners with more than ten years’ experience and up-to-date skills is a concern. Keeping current is a challenge with so much to get done.

Finally what keeps you awake at night?
 Worrying is not an effective control so I try not to lose sleep over things. The two challenges I am thinking most about at the moment are: (1) telling the security story succinctly without making it sound like the sky is always falling; and (2) job satisfaction and burnout amongst experienced security professionals. Every day a multitude of new cyber-attacks are launched so finding ways to stay cheerful when you are in charge of an unsolvable problem is something we need to master if we are to retain our most experienced people.

CISO Interview Series: Troy Braban, CISO, Australia Post

"Our approach when recruiting is based on culture, leadership and communications first"

CISO Interview Series: Troy Braban, CISO, Australia Post

David Gee (CSO Online)

Troy would you please describe your average day as CISO at Australia Post? Do you have a particular routine for the start and end of day??

One of the things that I love most about this industry and this job is that there is no “average day”. Each day is different because of the variety in our work. This can include strategic discussions, solving customer problems, investing in our great people and of course keeping a careful watch on attacks, threats and our cyber activities. I have no fixed routine other than getting into the office as early as I can, which is typically around 6am, to get as much done as possible so I can spend time with my family at the end of the working day.

It is clear to me that “trust” is a key critical component of the Australia Post brand. Does “maintaining trust and the brand” appear on your own personal performance accountabilities that you are judged on?

This is definitely one of the great strengths of Australia Post and something that everyone, right across the company, takes seriously. It is not just my job or my team. Not just our Enterprise risk teams or brand and marketing teams. It really is everyone that cares about our customers, our brand and reputation. As such we are all accountable and measured on a range of brand and trust related aspects.

Many of the big name organisations have recently boosted their security divisions by securing top ranking IT security heads like yourself, do you think the key cyber security threats and recent breaches have pushed companies to invest more in this area?

I personally believe there are two main reasons why large organisations have done this. The first is clearly in response to threats, breaches and media attention. The second however is where more mature organisations have understood early, ahead of all of this recent media attention, just how critical cyber security is to customer trust, brand and to new products and services that take advantage of software and technology. To the credit of our Executive Leadership team and Board, Australia Post is squarely in the second category. As an organisation we have been rapidly building a strong capability right across the business over a number of years.


On a scale of 1-5 do you expect that your investment on Cyber & Information Security will be increased over the next 3-5 years? What’s going to drive that??

The answer to this is very much a 5 – though I’ll expand on the definition of “investment’ to mean more than just money. Our business strategy is very clearly focused on providing eCommerce products and services for our customers. This includes helping consumers transact and shop online, enabling small businesses to sell online and partnering with larger businesses and government in their digital transformation.

As such Cyber and Information Security plays a critical role in our business strategy so we will continue to invest in the security of our customers, people and the community. Our spend profile will fluctuate – as it should. We’ll dial it up and down depending on our customers’ needs and business strategy, the threats and attacks that we face and also our risk appetite.

How do you balance your own bandwidth between attention on your longer term security agenda and today's issue that has just arisen?

One of my primary responsibilities is to build and maintain a great team and culture. And then invest in their personal growth in leadership, soft skills and security capability. I have a great team who look after much of the day to day. This enables me to spend as much time as possible with our businesses, helping deliver great products and services for our customers, helping enable our business strategy and steering the security strategy. I am a strong believer in leading by getting out of the way and giving great people opportunities – but being there when they need me.

There are many new cyber security startups that are appearing. Are there any that have caught your eye recently and you are tracking their progress?

 

I think the most interesting battle ground at the moment is on the end point. The old generation of anti-virus vendors are struggling to reinvent themselves and move at pace while a range of smart, well-funded startups have entered with a very different approach and value proposition.

What do you regard as the crown jewels within Australia Post that has the highest level of security? How well do you conduct ‘mock’ incidents so that the team is prepared for data breaches??

Our crown jewels are easy to find in our business strategy. We are an eCommerce company with a growth vehicle in trusted services that wants to deliver more and more value for our customers.

Clearly that translates for my team into protecting and helping our customers use the services that we provide to them. We have a good understanding of this and over the years have done a range of incident and breach response preparation. Every time we do something we learn more and certainly have taken lessons from others in the industry.

Digital and online is clearly a key strategic part of where Australia Post is repositioning. How do you personally stay in touch with this digital channel which is exploding with developments?

There is no way I can, or should, do everything myself. I am a strong believer that great people solve hard problems so for me, leadership and culture is the answer to just about everything. From a digital and online perspective we have some exceptional people that have chosen to work at Australia Post and deliver great results. As an example we took the build of a new infrastructure environment down from over 20 days to less than 10 minutes – with a range of security patterns and tools pre built into the environment. I learn constantly from our teams and from immersing myself in what we do. I also learn from my peers in the industry whenever I can. Cyber Security is a team sport and the sharing network within Australia, and in some areas internationally is exceptional. I know that I can ring a whole range of CISOs and they’ll answer and happily share – which I will also do for them.

Within the Australia Post environment are you more concerned about the internal technology vulnerabilities or of rogue insiders?

Honestly both of these and more. There are so many ways, both malicious and accidental, that an organisation could suffer an incident or breach. By the same token I am also worried about “too much” security that leads to driving away customers through poor experiences or in slowing down our business so much that we can’t compete. Our approach is to align our security program against our business strategy – with a non-negotiable on protecting our customers.

What key attributes do you look for when selecting a new staff member? I’m aware that there is a shortage of capability in the industry - how long does it take on average to find new talent??

From an industry perspective I say that we have a glut of people in certain areas and a massive shortfall in others. I can easily hire for a security operations role or to work in risk or compliance. However finding great agile security engineers or customer security leaders is a massive challenge.

Our approach when recruiting is based on culture, leadership and communication skills first. Then we look at security and technology skills. It is far easier to teach someone security content knowledge than to teach a positive mindset, a collaborative personality profile or a customer centric pragmatism. As a result our recruitment timing varies. Some roles are a matter of days while others can take months. We’ll wait for the right person rather than recruit someone with the wrong culture or leadership attributes.

When you choose partners to work with are there gaps in the Australian marketplace that you can’t find capabilities that you have demand for? (Could you provide some examples)

Yes definitely. I have found over the years that our partnership model tends to follow people rather than companies. Having said that there are still gaps. Finding a partner to do old world penetration testing is easy. Finding a partner to do secure software development in agile teams is a major challenge.

Finally what keeps you awake at night?

My 2 boys under 3!
And from a work perspective “coverage”. We have great executive support, leadership and I am lucky to have a wonderful team. We have built some exceptional capability and have done some really innovative things such as our agile security development and our customer cyber security services.

The coverage issue though is that despite all of that “good” it only takes one gap, one mistake or one unknown that could lead to that customer data breach or material security incident. As such I worry about covering everything that we need. Are we enabling all parts of our business effectively? Are we protecting all customers? Have we looked at every piece of code? Do we understand every partner? Can we cover every threat and every risk? Trusting in great people and taking a threat and risk approach is critical.