DtSR Episode 723 - Richard Bird Security is Built Wrong

TL;DR: This week's guest is Richard Bird, who has a new book coming out. He says, "Cybersecurity measures activity while its adversaries measure opportunity," and thirty years of spending has been priced against the wrong scoreboard. Great start, and you know it's going to get a little punchy.

Guest:

• Richard Bird

Description

Cybersecurity spending has exploded for 30 years, and the scoreboard still looks brutal. We sit down with Richard to talk about his new book, “Built Wrong: Why Cybersecurity is Failing and How We Can Rebuild It,” and we don’t sugarcoat the core claim: defenders measure activity while adversaries measure opportunity, and our metrics push us toward more tools, more dashboards, and more noise instead of fewer breaches and smaller blast radii.

We dig into why common security metrics behave like “measuring the weather” and how that creates a self-perpetuating cycle of reports, blinky lights, and ROI stories that don’t hold up in financial terms. Richard shares a blunt economic lens through his Hacker in a Hoodie framing, then we connect the dots to cyber insurance and how premium pricing can accidentally reward planned security purchases rather than proven loss reduction. If losses go up while premiums go down, something is broken in the measurement and incentive chain.

From there we get practical: how do we justify investments like firewall upgrades without relying on vendor promises and buzzwords? We talk about using real evidence like the Verizon DBIR and OWASP Top 10, and Richard offers a simple way to organize security thinking and metrics into three buckets: exposure, interdiction, and consequence. We also push on the leadership problem: if “security is everyone’s job” but only the CISO gets penalized, accountability will always be uneven.

If you care about cybersecurity metrics, cyber risk management, CISO leadership, and building a security program that speaks the CFO’s language, this conversation will challenge your defaults. Subscribe, share this with a security leader who’s tired of vanity metrics, and leave us a review with one measurement you think the industry needs to stop using.

YouTube Video: https://youtu.be/sOdKjIibIKc

Transcript

Copy Transcript Copied

Welcome And Book Premise

SPEAKER_04 0:54

Good morning, good afternoon, and good evening. Welcome down the security rabbit hole to another edition of your favorite cyber security podcast. Welcome down the security rabbit hole. This is Raf. Below me is James. Below that is Jim. And over in the big window is can I say it? Blah blah blah bird's a word. I I I went all uh Peter Griffin on you. I'm sorry. Not apologizing. All right. All right. Guys, welcome to the show. Today is a little special because I I've I've you know I've got Richard on to talk about his new book. It'll be fun and interesting as always. It's called Built Wrong, Why Cybersecurity is Failing and How We Can Rebuild It. I I I like the summary, Richard. The the cybersecurity measures activity while adversaries measure opportunity, and the 30 years of spending has placed or priced against the wrong scoreboard. I'm kind of with you on that. Uh I've been to RSA, I've been to Black Hat, I I've seen the outcome of this. So yeah, I I definitely uh I think I know what what what you mean. So what compelled you to write another book, dude?

SPEAKER_03 2:17

A lot of drinking and being a CISO. Those are definitely the two entry points. Uh that and they're they're not mutually exclusive, I guess. No, uh, you know, the the weird thing is if I go back more than 15 years ago when I first got into cybersecurity, a lot of people know the story that I was an IT ops guy, I'd become a CIO, and I got an invitation to come back to JP Morgan Chase when centralized information security was just forming up at Chase. And my my favorite part of the story and why I became such a motivation for writing the book was I I came in, I had a lot of special projects experience, and that's the reason why the leader wanted to hire me. And Amy looked at me and she goes, Well, you know, we're gonna put you in the identity group. And I said, Well, I don't know anything about identity, and she goes, Oh, you're gonna do great. And and and and identity became kind of this hallmark that everyone in the industry knows me for. But even then, uh being an IT operations person, coming through 15 years of transaction-based technology, I was always confused. Like, why is identity like a redheaded stepchild? Why is like the most uh easy place to get into systems like the least invested in? Why? And that started to spawn other questions. And of course, I became a multi-you know NIST ISO domain CISO, and I have been multiple times over. And I kept looking at this massive amount of investment and this exponential growth curve in dollars lost. And I kept asking a question like what other business function in the world keeps investing more money and losing more money? And nobody had an answer. And and that really became the the beginning part of building the books. I've been working on it for about two and a half years. And when I say them, you can't build a book like this that people are immediately going to be emotionally triggered by if you don't come with some answers. So I actually built an entire operating manual for it. I made the dumb mistake of trying to release them both on

Measuring The Weather In Security

SPEAKER_03 4:20

the same day and decided I would put my attention first on the core book and the thesis, and then, you know, hopefully in about 90 to 120 days, I'll be able to get the metrics and measures out. Uh, but uh, let's round it back around. We measure the wrong things, and we have. And this book has got over a hundred citations and references, academic as well as you know, industry, and the data is there. It shows that we are continuously measuring the wrong things. And and and that's hopefully what I'm gonna draw some attention to.

SPEAKER_04 4:54

Uh you know, having having been somewhat of a connoisseur of the metrics myself, I got an early taste of it early in my career. Back at GE, we had a rotating, a rotating title of whoever got to uh grab the metrics off of all of our systems. Now you are you having uh we have internet problems over there? You seem to be dropping out. I think you're back now. Okay, maybe a little bit. We'll figure it out. All right, but anyway, so I I remember like being you know the one that got stuck with the metrics for that quarter or whatever. And the worst part of it was going out and trying to figure out like what are we gonna collect? And it was always the same thing. It was like, okay, how many antivirus semantic at the time did we have deployed? Uh, how many of them were within like one update at the time that was like a weekly update of signatures? Guys, remember how long ago that was? It was a long time ago. And then we collect collected all kinds of like how many attacks did we have and how many systems deployed, how many this, how many that. But you're right in that we we are measuring perhaps the the wrong things. Uh oh. And we've lost we've lost my guy again.

SPEAKER_05 6:18

I would say we're measuring the weather. I think we do a lot of measuring the weather.

SPEAKER_04 6:22

No, that's that's probably not wrong, right? Like measuring the weather feels like and and and then trying to but but but if we're but if we're measuring I mean for measuring the weather, at least that gives you an idea of what you're doing. I don't feel like we've we've adjusted behaviors a little bit, but not in a meaningful way, which is strange.

SPEAKER_03 6:45

Well, I use a I cannot believe that my two gig service sucks so bad that I just changed to my cell phone, and now I've got perfect I have perfect cellular and Wi-Fi to be connected to this call. There's a there's a great navigational reference here, right? You can measure speed and you can measure direction. Think of it from a standpoint of navigating a ship, and you can still be way off of where you're trying to get to because of currents. Yeah, fair. Because of wind, because of, you know, there are so many elements of measurement, and what we've done within cybersecurity is is persisted a near binary version of metrics. You either have or you don't, right? And and that has propagated, you know. I think it's when we think about how important accurate measurement is, we need to kind of reel this back. And these are many of the arguments within the book. If I start measuring the wrong things, and in the course of measuring the wrong things, I am incentivized and rewarded for measuring those wrong things, then what do I do? I produce more of those wrong things. Now think about in the context of the last 30 years of security: more dashboards, more blinky lights, more lines, more graphs, more this, more that. And yet nobody's ever stopped to question whether or not the the measurement devices that we're currently using are keeping us on course, right? And then this is compounded by a really interesting problem. Yeah, go ahead, please.

SPEAKER_04 8:18

No, no. So this is this this is something that's that's bothered me for years because we measure things like how many attempts have there been. Like we measure I I remember measuring things like how many IDs did we have that had not had a password change in 45 days. Yeah. And it seemed like it was a good idea to annoy people to change their password every 45 days. But if you sit and think about it, you go, but why is that relevant? And the answer was because that's what security does. We change passwords every 45 days because you need to. But if you kept saying why, eventually you'd get to well because we say so.

SPEAKER_03 9:06

Yeah. I mean, the because we say so thing is interesting. It's we have built massive amounts of processes around security. Basically, I I phrase it as you know, if you're a history buff at all, in 1961, Eisenhower talks about the uh cyber or puts about the uh military-industrial complex, right? That that the U.S. economy has become industry that serves military, and military makes you know economic requests of the industry, and then they just create this really self-perpetuating cycle of arms escalation, all the different kinds of things. And that's what Eisenhower is pointing to. What I've seen is the rise of the cybersecurity corporate complex, right? Which is, and let me give you a very specific example of this. I've got an index site out called the Hacker in a Hoodie Index, uh, hackernahoodie.com. Yes, that URL was available. And and instead of framing cybersecurity in terms of winning or losing, I'm framing it in terms of succeeding or failing. And in succeeding or failing, I decided, you know, the most relevant economic measure is investment growth. So if I invested $100 in the hacker 20 years ago, how much more money would I have if I invested in the hundred, $100 in the SP or NASDAQ? Well, it turns out that if you look at the last 10 years, 2014 to 2024, that time frame, the growth rate for hacker returns just by using the FBI IC3 report was 35% compound average growth a year. The SP 500 with inflation return about 7%. Right? You would be better off investing in the hackers for your 401k than investing in security solutions companies or cybersecurity investment. Now, the cybersecurity corporate complex comes into play when you think about it from the standpoint of, oh, we have cyber insurance as a backstop, right? It's been the financial backstop and tool for more than two decades. Except if we're measuring all the wrong things, and then that's the way that cyber insurance is pricing policies, then we're insuring the wrong things. But it gets even worse than that. There's an exhibit on the Hacker in a Hoodie site about the most recent NAIC report, which is the National Insurance Consortium. And in the cybersecurity space, they come back and they say, well, the way that

Hacker In A Hoodie Economics

SPEAKER_03 11:35

we price premiums, I don't make this stuff up. This is data that's readily available, just nobody's pulling it together. The way that we price insurance premiums for cyber insurance is based upon your investment plan in solutions for cybersecurity for the coming year. Now think about that for just a second. Like we're not basing it on actual losses. In fact, in 2025, for the first time ever in history, cyber insurance premiums went down and the FBI IC3 hit a brand new record. Like there is no insurance market in the world where losses go up and premiums go down at all. Right? That defies mathematics. But why then is the insurance industry pumping solutions acquisition as the solve for cybersecurity problems? Well, because it's become the self-perpetuating giant ecosystem of build more metrics, build more measures, build more, have more activity. And now if you buy more of that stuff, I'm going to reduce your cyber insurance premium. This is the death spiral that we've put cybersecurity in in the last 30 years. And we're all complicit in it, right? All of us have been a part of that. All I'm trying to do is draw attention to the fact that there's data and numbers that clearly show that forget about winning or losing. We are failing at cybersecurity, and we need to think about the problem set differently. That makes sense.

SPEAKER_04 13:16

Look at all the things I'm doing for you, right? Yeah. And so, I mean, I again, having been complicit in this, because I've been in this industry long enough to see it, you're like, it's it's like if you've ever sold something, right? And and and the customer says, ah, what's the ROI on this? And you go back and you and you create an ROI when we damn well know there's no ROI, right? Like there's there's not there's not a there's not a clear ROI here. You're making it look really good. Which congratulations to you. But but you're you're making stuff up. And and and so this is a lot of again to justify the spend, we create metrics and data points that show you how well something is working to to to then show you that you justify more spend and then and this is kind of the spiral. Okay.

SPEAKER_03 14:11

Well that that's I don't love that. Yeah, there's an important question in there. Does that suggest that the the ROI math that we're using for cybersecurity is wrong? If we can't quantify in financial terms, which is what the business speaks, if we can't quantify it, have we spent the last 25 years sitting on our hands just mumbling and compliant, complaining and groaning, going, it's impossible? It does not seem impossible. It seems like if you are measuring based upon what our currency is, and let me let me give you a really great example of this. I hear all the time, and you guys can finish this sentence too, the problem with security, and the reason that we can't prove ROI is because cybersecurity is a cost of doing business. Right? That that is the economic justification for what we do. There are only two costs of doing business in corporate America. Two. One is cybersecurity by our own emission, two are corporate taxes. What are the things that we all try and avoid in life? Taxes and in the corporate environment, cybersecurity. Why? Because we priced it as a tax. We didn't price it as a business function. And so when you start to look at things like, okay, what if I had something like, and this is all in the book, my I propose a whole new series of models around turning cybersecurity into an actual business function? What if there were math that associated to something like a security yield? Now, CFO knows what a yield is, right? So for every dollar that I spend on cybersecurity solutions, how many dollars does that does that represent in reduction of risk and external threat? Now, the argument could be made as I don't know that number. And forgive me, folks, on LinkedIn Live, but that's bullshit. We know that number. We know that number in spades. In fact, IBM financial cost of reach has been consistent for 20 plus years, and that number has been around four and a half to five million dollars minimum for every incident. You could start there, right? And you could put a solution in place and go, okay, how much of that four or five million dollars that is a potential financial impact, would your solution reduce? Or how much would replacing a 20-year contract with one of the top 10 security solution providers actually save me in both reduced risk and cost of dollars spent if I could compare it against a security yield? Now, I you deep diving into this discussion is is difficult. I'd need the glass whiteboard and all that, but it is there, and it is true, and it begins with a very simple economic reality that cybersecurity has never embraced. And I didn't create it, and I learned it at JP Morgan Chase, and that is unit costing. We unit costed everything in security down to the OS and stack for every transaction in security. And because I had unit costing, I knew exactly how much my program cost, and because I knew exactly how much my program cost and what value it delivered, I could make financial decisions and business decisions and replace solutions that weren't getting the job done. And the reality is that the cybersecurity industry hasn't embraced that because the business has convinced us that we are a tax and we are a problem

Cyber Insurance And The Death Spiral

SPEAKER_03 17:40

and we are the office of no. And every time I hear somebody say CISOs are going to have to be much more, become much more like business leaders, I say baloney because there's no possible way for a CISO to become a business leader when his function or her function is priced as a tax. As soon as it's priced as a business function, then they get a seat at the big kids table. And we all know most of us in security haven't had a seat at the big kids table for decades, right? We don't report to a CEO. We don't don't give me the five percent that are reporting to a board or to a CEO. Give me the 95% who aren't. Or the 95%. What the hell? Everything just shut down. Am I back? Uh your video is your video is toast, but your audio is as good. Everything just wit kablooey. Anyhow, it's uh you know, I'm I'm I'm doing a lot of you know data dumping and verbal vomit here. I mean, come on, you guys gotta take some swings.

SPEAKER_05 18:47

I I do want to make one quick point. It's going back a little while ago. You said something that resonated with me. I can give a dozen examples, but in situations where we're measuring things because they they one the process of measuring takes so much time and energy, it creates you know teams around it sometimes. And also there's this fear of changing. And I've seen this again, I've got a number of stories like this, but where I've walked into leadership room and said, hey, you're literally measuring the wrong thing. You're actually your math is actually wrong. Let's take a step back and at least get the math right. And they were like, nope, because you know, they had already gotten into a rhythm, and that rhythm had defined their professional identity within that organization. So there's a lot of danger there. Yeah, a a question for for you, Richard, would be let's take something kind of simple and maybe help us, you know, frame it in kind of a model that you're speaking about in your book. You know, so let's say, for example, I don't know, you need to replace all your firewalls, or you need to buy new firewalls, or you need to upgrade your firewalls kind of thing. You know, new license come out from Paolo, they need they're now they're doing fancy things, and you need to sort of justify that expense. And your model, I like to, by the way, I love the yield concept, but help me to take, let's take a really small something. And how how can we start framing that differently to be more like a contributing business unit as opposed to a you know, giant sucking sound?

SPEAKER_03 20:19

Yeah. Well, the you know, it's it's interesting to dive into something like that specifically because it it raises a couple of key questions first, which is you know, what are your input data sources to make the decision to begin with? Right. Now, if we look at the way that the world has grown for cybersecurity solutions today, the way that we do that is is maybe a POC and and really a whole lot of promises from the vendor, right? We we just do better. We do more, right? And I and and so it raises and AI. And it raises that question. It's like based on what? Right? Like, what are your comparative metrics that you're telling me that you do better than you know firewall company, you know, Q, right? And and and this gets into a really interesting set of problems because we lack for a tremendous amount of comparative information amongst our industry comparatives, right? I mean, Jim, I know you know this, you know, inside and out. Like we go in in front of customers, and the customer is desperate. They're like, great, we're gonna put your technology in. Can you give us an entire manual of best practices? It's like, wait, what? Wait, like you want to know how to run the thing in your environment, right? Well, why did they ask for best practices? Because there's no industry sharing of actual breach numbers, of attack vectors, of nobody is sharing that stuff, right? And why don't we do that? Well, you know, if if we shared how we got breached, then we would be opening up the door to admitting that uh in class action litigation that we, you know, we made a mistake. Well, that's That's great, except nobody learns anything. Like, how on earth? Great input source. How on earth are the key three identity vectors in the in the Verizon DBIR the same breach metrics that we have been exposed to for the last 23 years? Like, how did we how is it possible that we could have all this information about what we're doing wrong? And we have never improved on a single Verizon DBIR attack vector. Not one. In fact, the only one that has ever come off was POS malware

Proving ROI With Security Yield

SPEAKER_03 22:35

because we went to chip and pin in 2015 and then all of a sudden malware dropped off. Every one of them's been the same. We know how we get beat. And that comes back to the firewall point. How do we use data that's available? Well, first of all, we stop hamstring our pen testers, right? Pen testers can't touch production. Pen testers do fully scope pen tests. Last I checked, bad guys don't have any scoping. Bad guys get to do whatever the hell they want to. And when you don't have the data that can tell you that one thing is better than another, in the case of firewalls, then the best that you can do is rely on markitecture and marketing slicks and all the information that comes from your providers and trying to dedicate engineers to POCs. So what you need to do is to assemble information that is clear and available, the Verizon DBIR, OWASP top 10, particularly as it relates to networking. And then you take that bolus of information, and that is what you put the firewall provider up against. Like, show me how you eliminate this specific attack vector with your solution. And if the argument comes back, well, we can't promise that we can eliminate it. Well, what can you promise? Right? What is it that you can do with your solution that shows market improvement against the attack vectors that we have known about for decades and have made no improvement or progress against? If you show me you can take one of those out, then we've got a really interesting conversation. And that's without even having to go into the financials on this, right? The the we tend to ignore I've said it for years, cybersecurity is the only function in the enterprise world that actively ignores evidence, data, and history. We just flat out refuse to actually look at any of that, right? We look at the data inside of our own organization, and then we don't understand the echo chamber effect that that causes. If it's the old hammer and the nail problem. If all I ever see is attacks through this particular port, then I'm going to build a solution that only addresses attacks through this just this specific port, right? I have a hammer, therefore everything is a nail. In today's world, our problems are not nails anymore, right? Our problems are way more diverse than that. So the the use of data, I actually think that using data that's ready readily available like that, Jim, could could uh eliminate half of the field in any vendor category right out of the gate. Like you're not going to be dorking around with POCs taking three months of your engineer's time, right?

SPEAKER_05 25:20

Yeah, I remember conversations we would have about the concept, and this is a long time ago about actuarial tables and the concept of having a data-driven risk discussion so you can actually make investments where it made a difference to the business. And you know, I used to always say is security is nothing more than the controls you put to protect your assets from threats. And we just need to really focus on threats, trying to make a control where we think it's going to be, and we still are trying to figure out the data part sometimes. And I and I and it's just kind of like if we could get information, actual information about what's happening in a in a tactical sense and more up to date, then you could actually adjust more readily without having to spend a ton of money. But I think your core around using data for decision making, you know, you say I say that out loud and you would think that's what we're doing, but I don't think I think we're not doing it to your point at a level of sophistication. And then if we are, as it moves to the system, it gets refined and it gets more executized into a bullet point. Well, how much is that going to be? A million dollars, you know, whatever kind of thing. But I I I 100% agree with your point, is we are we could use, I don't know if I would say more data, but more more information that more not more data, but better information that we can make decisions.

SPEAKER_02 26:41

Jim, it's almost like we have too much data already. Yeah in the in the sense that we're trying to cover everything. I mean, Richard, you mentioned uh, you know, OWASP top 10. Going back kind of like fundamental, like which OWASP top 10 of the hundred top 10s that exist out there, like everybody's trying to solve. I gotta do PCI, I gotta do HIPAA, I gotta do SOC2, I gotta do this, I gotta do, you know, again, all hundred of the OWASP top tens, I gotta do all these. Now AI's involved. Like nobody's taking the time to step back and say, okay, but what are the issues to my organization? It's I gotta solve all this. Yeah. Instead of those what they would call the fundamentals, right? That we've talked about for the last 20 years.

SPEAKER_03 27:22

Yeah, I I don't say this to insult anybody, but look, companies are still getting popped on SQL injection. That's how bad we suck. Like, we haven't fixed a 30-year attack vector anywhere. Like, and and when when you look at it, so so to your point, it you you know, James, when you come back to we have too much data, do we have do we have enough data that points us towards actual effectiveness, or do we have too much data of all the things that we're measuring incorrectly? Right. And that that kind of is the mess that we find ourselves in. And I think that the I think it gets really frustrating when you take this step and back. And I'd love hearing what you guys have said so far. Like us as old dogs in security, we take a step back and we go, oh my God, we have actually been doing this. Maybe we aren't looking at the right things. I haven't talked to, I've had 40 peer readers in the cybersecurity industry for this book. Everyone is a name that you know, and every one of them is an important voice in cybersecurity, and everyone says the same thing. They're like, damn, we probably have been looking at the wrong stuff, right? Maybe we need to think about looking at things differently. And then that presents opportunities for us to look at data differently. And I want to make sure that that I cover some of the things that I'm sure the people who are listening wanna know about. Two and a half, nearly three years of research, I realized that when you think about everything in cybersecurity, it really falls into three specific buckets. And this is where we can begin, Jim, to

Vendor Decisions Using DBIR Data

SPEAKER_03 29:05

orient data and information toward those buckets. There are really only three things in security exposure, interdiction, okay, exposure, what am I exposed to? And and when you have things like stuff that I see in the Hacker and the Hoodie index when the breaches come across, when you've gotten popped on a third-party vendor supply problem from a from a breach standpoint, and then 21 months 21 months later, you get popped again on the same vector, you're just ignoring data at that point. Like you are willfully choosing to get hit again. And that actually is a company called Veridime. It happened, right? Tell us it just happened again. That one just popped yesterday. Revolute bank, it just popped again. Same vectors, API hijacking. And you're like, wait a minute. Like, if you know that it's a problem, why aren't you going to address that problem specifically? And because now you know where your exposure is at. Interdiction. Once that exposure has been exploited, what are the interdiction measures? Now we start talking about micro-segmentation. We start talking about how do I contain it? Because you get to the third one and it's consequence. How big is the blast radius? And you guys are already hearing this in the AI world. People have stopped talking about trying to make security better. Now everybody is already taught always talking about resiliency, right? What another indictment. If everybody in the AI space is going, we're not going to ever make security better, so we just need to make sure that we can survive it. That's messed up. Like, how about we go back and like fix security? Like, so inner exposure, interdiction, and consequence, it I haven't found anything in security that falls outside of those three building blocks. And that gets us where we're into the right level of metrics.

SPEAKER_04 30:57

Yeah, I mean, look, that that makes sense. I'm sorry we lost your lost your video there. I think if if you refresh in your browser, that might bring that restart that part of your you want you want to give it a shot? Yeah, hang on. Here we go. See if he comes back. And he is back, kids. All right. I don't know, man. Your internet connection just does not want to participate with us today. I don't know what's going on there, bud.

SPEAKER_03 31:30

Me neither, man. Me neither. It's it, you know, if technology is truly going to run the world, we better fix both fix both teleconferencing and bandwidth. Because those are the limiting factors.

SPEAKER_04 31:42

Yeah. Yeah, for for sure. Listen, so one last thought here before I let you go. There's a there's a bit of me that says we we've had this conversation before. We've been trying to fix this for a long time. I like I distinctly remember early 2000s saying these these are just numbers. These don't help drive decisions, they're just numbers for the sake of gathering numbers. Where where's the inflection point? Where's the pivot? What what's gotta change so that things change? Because we've had like so one podcast back, if you go back a show, Rob and Jeremiah on talking about how vulnerability management is is finally, now that there's actuarial data, is finally able to make a change in in itself. Is that gonna catalyze other changes?

SPEAKER_03 32:43

Please say yes, please say yes, please say yes. No, no. No, but but but but it's not hopeless, right? I I had a kid that came up to me. I did a kind of a teaser spoiler presentation on this in in Columbus, Ohio at the at the big conference there, because it was old home turf. And uh young man was super excited. He was like, I loved everything in your presentation. He goes, and I've I've I'm rolling out a new maturity model. And um I think it's gonna really, really make a difference. And and I said, you know, I said, I I appreciate that. I said, I have a question for you. I said, who gets paid when that maturity model successfully implements? And he kind of paused for a second and I said, nobody. Welcome to American Business, incentives and rewards. So you can do all the maturity programs that you want. You can do all the vulnerability, you know, uh solution and process uplift that you want. When we live in a world where a CEO can stand in front of a shareholder conference and say, security in our company is everybody's job. And the only person that actually gets compensated or penalized for security performance is a CISO. Again, that's bullshit, right? Imagine a business function that is the only business function in corporate America that nobody in corporate America is incentivized or rewarded for success or failure, right? And you're talking about cybersecurity. Why? Because it's a cost of doing business under the current model. So the truth is that we need to talk about cybersecurity performance in economic terms, not in technical terms. We can build the next best technical solution for any attack vector. And until a group of senior executives in a company is held

Incentives And Accountability To Fix Security

SPEAKER_03 34:40

responsible and accountable from an incentives and rewards standpoint, and this always brings up a problem. And I, Ralph, I know that you've heard this line before because we've tried it, except the way that we phrase it in cybersecurity is that if we get breached, you don't get paid a bonus. That is freaking stupid. A breach is an outcome. A breach is not a task, a function. It is so when Jeff jailbreaks production for the eighth time in DevOps, because he keeps hiding one of those passwords, and then you go to that manager, and that manager says, you know what, we can't let Jeff go because if Jeff gets hit by a bus, our business stops tomorrow. Well, guess who gets to eat the risk of Jeff and DevOps continuously jailbreaking production? The CISO. Last thing I saw, Jeff Joe Sullivan got sold out by his CEO for evidence and got, you know, got popped in in terms of litigation because you had a C-suite in Uber that was willing to just walk away and say, not our problem. This this CISO over here is the guy that screwed this up, even though the CEO was in every single freaking meeting, right? We have built a massive unaccountability model on cybersecurity. And those are harder problems to solve. But until we do, until we start actually talking about incentives and rewards, and if you are doing unsafe things, if you fail your cybersecurity awareness training for 17 consecutive times, Jane, right? And you don't actually suffer any consequences from it, then why on earth would anybody do security in my organization? Right? These are the things that we've got to solve. We've got to fix the problems economically and business function wise before we will see massive improvements in actual security performance.

SPEAKER_04 36:36

Well, that's a good place to end it because that that's the that's the punctuation mark at the end of that sentence, right? We got we got to do that. I think I think I think that's a lot of I don't know how we get there though. I maybe that's a conversation for the next time. But thanks for breaking through us with the a guy might have written a book. So go go when it's available, go grab a copy. This will be a good read. Cathartic, I think, for a lot of us, at very least.

SPEAKER_03 37:07

Well, I and let me let me let me be clear real quick. I I I obviously do not have all the answers. I barely have any, right? I I just I've embarked on a journey to just ask a different set of questions. And my hope is that instead of being cathartic, instead of, as my buddy Chase Cunningham likes to say, and all in enjoying a lick at the perpetual self-licking ice cream cone of misery, maybe we can actually start to have internal reason debate and conversation and discourse around changing things in cybersecurity instead of commiserating with each other about how badly it sucks. That's my goal, right? Is we have a way, because we have a tremendous amount of intellectual horsepower in the cybersecurity realm. And if we can get together and start thinking about these problems differently, maybe we can start solving them differently. That's my motivation.

SPEAKER_04 38:04

I like it. Let's end it there. Richard, congrats on the book. I I'm looking forward to the read. James, Jim, thanks. Uh thanks for joining. Uh good questions, good conversation. Not the last we're gonna we're gonna have of this for sure. Uh, and if you're listening thinking, I've got some ideas, or you guys are nuts, let's hear it. I I think that healthy debate is a good thing. I think we need to, I think we certainly need to talk about this. So Richard, thank you for joining us, folks. Thank you for listening and bearing with our audio video streaming issues today. The internet just some days does not want to cooperate, and that's how it's gonna be. But I hope you get a good one, and thanks guys for listening. We'll catch you another time, another place, another down the security rabbit hole podcast. We'll catch you guys later.